diff --git a/.env.compose.example b/.env.compose.example
index dd55b89..83ef694 100644
--- a/.env.compose.example
+++ b/.env.compose.example
@@ -3,9 +3,8 @@
 # apps/web/.env.example and apps/indexer/.env.example.
 
 # --- Passwords (local development values; Compose composes the connection URLs) ---
-# Only the administrator password is an input. The three runtime roles
-# (xcs_indexer, xcs_api and the dedicated pg_monitor identity xcs_monitor) are
-# created by db/compose-initdb/01-runtime-roles.sql when the postgres volume is
+# Only the administrator password is an input. All eight runtime users are
+# created by db/compose-initdb/01-runtime-roles.sql when the PostgreSQL volume is
 # first initialised, with published non-secret local-development passwords that
 # docker-compose.yml uses verbatim. In a deployment those users are created by
 # the managed database service instead; db:bootstrap only assigns privileges and
@@ -62,10 +61,9 @@ XCS_PINNING_IP_HASH_SECRET=
 # file named by XCS_NETWORK_PROFILE above, so there is nothing to set here.
 # Public, browser-reachable endpoint. Never put credentials or a private indexer URL here.
 XCS_PUBLIC_RPC_URL=wss://testnet.xrpl-labs.com/
-# Optional Xaman OAuth configuration. The API key is public. Register the exact redirect URL
-# in the Xaman Developer Console; it must be this deployment's origin with a trailing slash.
+# Optional Xaman OAuth configuration. The API key is public. Register the site origin
+# in the Xaman Developer Console; the wallet SDK owns the redirect callback.
 XCS_PUBLIC_XAMAN_API_KEY=
-XCS_PUBLIC_XAMAN_REDIRECT_URL=http://localhost:3000/
 XCS_PUBLIC_WALLET_CONNECT_PROJECT_ID=
 
 # --- Host bindings ---
@@ -114,3 +112,18 @@ XCS_GRAFANA_MEMORY_LIMIT=512m
 XCS_GRAFANA_CPU_LIMIT=0.5
 XCS_EXPORTER_MEMORY_LIMIT=128m
 XCS_EXPORTER_CPU_LIMIT=0.25
+
+
+# --- Optional application overlay ---
+# Providing this complete group enables auth, Commons review and issuer journeys.
+XCS_AUTH_ORIGIN=https://localhost:3445
+XCS_IDENTITY_CLIENT_ID=
+XCS_IDENTITY_CLIENT_SECRET=
+XCS_ADMIN_DOCUMENT_KEY=
+XCS_MAILPIT_PORT=8025
+XCS_NOTIFIER_IMAGE=xcs-notifier:local
+
+# --- Optional hosted-payload overlay ---
+XCS_PUBLIC_PAYLOAD_BASE_URL=
+XCS_PAYLOAD_STORAGE_IP_HASH_SECRET=
+XCS_HOSTED_PAYLOAD_NETWORKS=
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22aa9ed..61ee5a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,10 +20,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          # The vendored-copy check reads a retired source (the former
-          # packages/db) with `git show <sha>:<path>`, which the default
-          # depth-1 clone does not contain.
-          fetch-depth: 0
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.34.4
@@ -73,6 +69,8 @@ jobs:
       # the production (security) configuration.
       - name: Run browser pilot flows
         run: pnpm --dir apps/web test:e2e
+      - name: Run authentication browser flows
+        run: pnpm --dir apps/web test:e2e:auth
       - name: Run browser security flows
         run: pnpm --dir apps/web test:e2e:security
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -99,8 +97,22 @@ jobs:
           --health-interval 5s
           --health-timeout 3s
           --health-retries 20
+      mailpit:
+        image: axllent/mailpit:v1.29.2
+        ports:
+          - 1025:1025
+          - 8025:8025
+        options: >-
+          --health-cmd "/mailpit readyz"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 20
     env:
       XCS_TEST_DATABASE_URL: postgres://postgres:postgres-integration-only-password-0001@127.0.0.1:5432/postgres
+      XCS_TEST_MAILPIT_URL: http://127.0.0.1:8025
+      XCS_TEST_SMTP_PORT: '1025'
+      XCS_ISSUER_RUNTIME_MAILPIT_ORIGIN: http://127.0.0.1:8025
+      XCS_ISSUER_RUNTIME_SMTP_PORT: '1025'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -122,7 +134,31 @@ jobs:
       # it runs against this job's service rather than a second database.
       - run: pnpm --dir apps/web install --ignore-workspace --frozen-lockfile
       - run: pnpm --dir apps/web test:postgres
-      - name: Verify generated database baseline is committed
+      - name: Install Chromium for compiled authenticated flows
+        run: pnpm --dir apps/web exec playwright install --with-deps chromium
+      - name: Exercise compiled Nitro with restricted PostgreSQL pools
+        run: pnpm test:runtime
+      - name: Verify generated database migrations are committed
         run: |
           pnpm --dir apps/indexer db:generate
           git diff --exit-code -- db/migrations
+          test -z "$(git ls-files --others --exclude-standard -- db/migrations)"
+
+  deployment-images:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        component: [web, indexer, notifier, db-bootstrap]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build ${{ matrix.component }} deployment image
+        run: >-
+          docker build
+          --file apps/${{ matrix.component }}/Dockerfile
+          --tag xcs-${{ matrix.component }}:ci
+          --build-arg XCS_REVISION=${{ github.sha }}
+          .
diff --git a/.github/workflows/operations.yml b/.github/workflows/operations.yml
index 0325d05..245da5a 100644
--- a/.github/workflows/operations.yml
+++ b/.github/workflows/operations.yml
@@ -15,19 +15,17 @@ jobs:
     env:
       COMPOSE_PROJECT_NAME: xcs-ci-${{ github.run_id }}-${{ github.run_attempt }}
       XCS_POSTGRES_ADMIN_PASSWORD: compose-ci-admin-password-00000001
-      # The three runtime roles are created by db/compose-initdb/01-runtime-roles.sql
-      # with published local-development passwords; they are not inputs.
+      XCS_AUTH_ORIGIN: https://compose.invalid
+      XCS_IDENTITY_CLIENT_ID: compose-ci-client
+      XCS_IDENTITY_CLIENT_SECRET: compose-ci-identity-secret-000001
+      XCS_ADMIN_DOCUMENT_KEY: compose-ci-document-signing-key-000001
       XCS_METRICS_TOKEN: compose-ci-metrics-token-000000000001
       XCS_RPC_URL_PRIMARY: wss://primary.invalid.example
       XCS_RPC_URL_SECONDARY: wss://secondary.invalid.example
-      # XCS_NETWORK_PROFILE is deliberately unset. The only committed profile,
-      # config/networks/testnet.example.json, is an invalid template, and both
-      # services now read this file: the indexer (not started here) would refuse
-      # it at preflight and the web service, which derives the browser-visible
-      # profile identifier from it, would refuse to start.
       XCS_PUBLIC_RPC_URL: wss://submission.invalid.example
       XCS_INDEXER_IMAGE: xcs-indexer:ci
       XCS_WEB_IMAGE: xcs-web:ci
+      XCS_NOTIFIER_IMAGE: xcs-notifier:ci
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -49,48 +47,8 @@ jobs:
           chmod 644 ops/secrets/xcs_metrics_token
           test -s ops/secrets/xcs_metrics_token
 
-      - name: Render and validate every Compose profile
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker compose config --quiet
-          docker compose --profile monitoring --profile demo-pinning config --quiet
-          docker compose -f docker-compose.yml -f docker-compose.dev.yml --profile monitoring config --quiet
-
-          mapfile -t DEFAULT_SERVICES < <(docker compose config --services | sort)
-          EXPECTED=(db-bootstrap indexer postgres web)
-          if [[ "${DEFAULT_SERVICES[*]}" != "${EXPECTED[*]}" ]]; then
-            printf 'Unexpected default services: %s\n' "${DEFAULT_SERVICES[*]}" >&2
-            exit 1
-          fi
-
-          docker compose --profile monitoring --profile demo-pinning config --format json \
-            > "$RUNNER_TEMP/xcs-compose.json"
-          jq -e '
-            (.services.postgres.ports == null) and
-            (.services.prometheus.ports == null) and
-            (.services.grafana.ports == null) and
-            (.services["postgres-exporter"].ports == null) and
-            (.services["node-exporter"].ports == null) and
-            (.services.ipfs.ports == null) and
-            (.services.prometheus.profiles | index("monitoring") != null) and
-            (.services.grafana.profiles | index("monitoring") != null) and
-            (.networks.database.internal == true) and
-            (.networks.monitoring.internal == true) and
-            ([.services[] | select(.image | endswith(":latest"))] | length == 0)
-          ' "$RUNNER_TEMP/xcs-compose.json"
-
-          docker compose -f docker-compose.yml -f docker-compose.dev.yml \
-            --profile monitoring --profile demo-pinning config --format json \
-            > "$RUNNER_TEMP/xcs-compose-dev.json"
-          jq -e '
-            [
-              .services.postgres.ports[],
-              .services.prometheus.ports[],
-              .services.grafana.ports[],
-              .services.ipfs.ports[]
-            ] | all(.host_ip == "127.0.0.1")
-          ' "$RUNNER_TEMP/xcs-compose-dev.json"
+      - name: Render and validate every Compose overlay and profile
+        run: node ops/ci/check-compose-overlays.mjs
 
       - name: Validate monitoring configuration with Prometheus
         shell: bash
@@ -108,13 +66,13 @@ jobs:
           jq empty ops/monitoring/grafana/dashboards/*.json
 
       - name: Build production-only core images
-        run: docker compose build web indexer
+        run: docker compose -f docker-compose.yml -f docker-compose.application.yml build web indexer admin-notifier
 
       - name: Assert runtime images exclude development tools
         shell: bash
         run: |
           set -euo pipefail
-          for IMAGE in "$XCS_WEB_IMAGE" "$XCS_INDEXER_IMAGE"; do
+          for IMAGE in "$XCS_WEB_IMAGE" "$XCS_INDEXER_IMAGE" "$XCS_NOTIFIER_IMAGE"; do
             docker run --rm --entrypoint sh "$IMAGE" -c \
               'test ! -e node_modules/typescript && test ! -e node_modules/vitest && test ! -e node_modules/tsx'
           done
@@ -157,39 +115,30 @@ jobs:
           fi
 
           # The bootstrap is deliberately restart-safe. Run it again after the
-          # dependency chain has completed to prove repeated initialization and
-          # role provisioning do not require a clean volume.
+          # dependency chain has completed to prove repeated migrations and
+          # privilege grants do not require a clean volume.
           "${COMPOSE[@]}" run --rm --no-deps db-bootstrap
 
           curl --fail --silent --show-error http://127.0.0.1:3000/health/live > /dev/null
           READY_STATUS="$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:3000/health/ready)"
           test "$READY_STATUS" = '503'
-          # The metrics routes are enabled by the presence of a valid
-          # XCS_METRICS_TOKEN, which this job supplies to the web service, so they
-          # are registered here and must be gated rather than absent: an
-          # unauthenticated request is rejected and the job's own token is
-          # accepted. The routes deliberately stay 200 while the database is
-          # unavailable, which is the state this stack is in.
-          for METRICS_PATH in /internal/metrics /internal/metrics/prometheus; do
-            METRICS_STATUS="$(curl --silent --output /dev/null --write-out '%{http_code}' \
-              "http://127.0.0.1:3000${METRICS_PATH}")"
-            test "$METRICS_STATUS" = '401'
-            WRONG_TOKEN_STATUS="$(curl --silent --output /dev/null --write-out '%{http_code}' \
-              --header 'Authorization: Bearer compose-ci-wrong-token-0000000000001' \
-              "http://127.0.0.1:3000${METRICS_PATH}")"
-            test "$WRONG_TOKEN_STATUS" = '401'
-            AUTHENTICATED_STATUS="$(curl --silent --output /dev/null --write-out '%{http_code}' \
-              --header "Authorization: Bearer $XCS_METRICS_TOKEN" \
-              "http://127.0.0.1:3000${METRICS_PATH}")"
-            test "$AUTHENTICATED_STATUS" = '200'
-          done
+          UNAUTHENTICATED_STATUS="$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:3000/internal/metrics/prometheus)"
+          test "$UNAUTHENTICATED_STATUS" = '401'
+          curl --fail --silent --show-error \
+            --header "Authorization: Bearer $XCS_METRICS_TOKEN" \
+            http://127.0.0.1:3000/internal/metrics/prometheus \
+            | grep --fixed-strings 'xcs_database_available'
 
           if "${COMPOSE[@]}" ps --services --status running | grep --extended-regexp '^(prometheus|grafana|postgres-exporter|node-exporter|ipfs)$'; then
             echo 'A non-core profile service started unexpectedly' >&2
             exit 1
           fi
-          if PUBLISHED_POSTGRES="$("${COMPOSE[@]}" port postgres 5432 2>/dev/null)" && [[ -n "$PUBLISHED_POSTGRES" ]]; then
-            echo "PostgreSQL was unexpectedly published at $PUBLISHED_POSTGRES" >&2
+          POSTGRES_CONTAINER="$("${COMPOSE[@]}" ps --quiet postgres)"
+          # Compose versions can report "invalid IP:0" for an exposed but
+          # unpublished port. Inspect the actual Engine bindings instead.
+          if ! docker inspect --format '{{json .NetworkSettings.Ports}}' "$POSTGRES_CONTAINER" \
+            | jq --exit-status '[.[]? | select(. != null) | .[]?] | length == 0' > /dev/null; then
+            echo 'PostgreSQL unexpectedly has published host ports' >&2
             exit 1
           fi
 
@@ -197,11 +146,14 @@ jobs:
             --command "
               SELECT
                 pg_has_role('xcs_monitor', 'pg_monitor', 'MEMBER')
-                AND (SELECT bool_and(rolcanlogin) FROM pg_roles
-                     WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor'))
-                AND (SELECT rolconnlimit FROM pg_roles WHERE rolname = 'xcs_indexer') = 12
-                AND (SELECT rolconnlimit FROM pg_roles WHERE rolname = 'xcs_api') = 12
-                AND (SELECT rolconnlimit FROM pg_roles WHERE rolname = 'xcs_monitor') = 3
+                AND NOT EXISTS (
+                  SELECT 1 FROM pg_roles
+                  WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+                    AND (
+                      NOT rolcanlogin OR rolsuper OR rolcreaterole OR rolcreatedb
+                      OR rolreplication OR rolbypassrls
+                    )
+                )
                 AND NOT has_schema_privilege('xcs_monitor', 'public', 'CREATE')
                 AND NOT EXISTS (
                   SELECT 1
@@ -231,6 +183,35 @@ jobs:
                 );
             " | grep --fixed-strings --line-regexp t
 
+          "${COMPOSE[@]}" exec -T postgres psql -U xcs_admin -d xcs --no-psqlrc --tuples-only --no-align \
+            --command "
+              SELECT
+                has_table_privilege('xcs_payload_writer', 'hosted_payloads', 'INSERT')
+                AND has_table_privilege('xcs_issuer', 'app_issuer_payloads', 'INSERT')
+                AND has_table_privilege('xcs_app', 'app_sessions', 'INSERT')
+                AND has_column_privilege('xcs_admin_app', 'app_organization_applications', 'status', 'UPDATE')
+                AND has_column_privilege('xcs_notifier', 'app_admin_notifications', 'status', 'UPDATE')
+                AND NOT EXISTS (
+                  SELECT 1 FROM pg_roles
+                  WHERE rolname IN ('xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer', 'xcs_payload_writer')
+                    AND (
+                      NOT rolcanlogin OR rolsuper OR rolcreaterole OR rolcreatedb
+                      OR rolreplication OR rolbypassrls
+                    )
+                )
+                AND NOT EXISTS (
+                  SELECT 1 FROM pg_class relation
+                  JOIN pg_namespace namespace ON namespace.oid = relation.relnamespace
+                  CROSS JOIN (VALUES ('xcs_api'), ('xcs_indexer'), ('xcs_payload_writer')) AS runtime(role_name)
+                  WHERE namespace.nspname = 'public' AND relation.relname LIKE 'app_%'
+                    AND relation.relkind IN ('r', 'p')
+                    AND has_table_privilege(runtime.role_name, relation.oid, 'SELECT,INSERT,UPDATE,DELETE')
+                )
+                AND NOT has_table_privilege('xcs_admin_app', 'app_issuer_payloads', 'SELECT')
+                AND NOT has_table_privilege('xcs_notifier', 'app_issuer_payloads', 'SELECT')
+                AND NOT has_table_privilege('xcs_app', 'app_issuer_payloads', 'SELECT');
+            " | grep --fixed-strings --line-regexp t
+
           "${COMPOSE[@]}" --profile monitoring up --no-build --detach --wait postgres-exporter prometheus
           PROMETHEUS_CONTAINER="$("${COMPOSE[@]}" --profile monitoring ps --quiet prometheus)"
           PROMETHEUS_STATE="$(docker inspect --format '{{.State.Status}}' "$PROMETHEUS_CONTAINER")"
@@ -274,7 +255,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          for DOCKERFILE in apps/web/Dockerfile apps/indexer/Dockerfile; do
+          for DOCKERFILE in apps/web/Dockerfile apps/indexer/Dockerfile apps/notifier/Dockerfile apps/db-bootstrap/Dockerfile; do
             grep --fixed-strings -- 'USER node' "$DOCKERFILE"
             grep --fixed-strings -- 'pnpm install --frozen-lockfile' "$DOCKERFILE"
             if grep --extended-regexp 'RUN --mount|<<[A-Z]' "$DOCKERFILE"; then
diff --git a/.gitignore b/.gitignore
index 9b4924e..b4872e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@ coverage/
 .nuxt/
 .output/
 .data/
+.do/
 .env
 .env.*
 !.env.compose.example
diff --git a/AGENTS.md b/AGENTS.md
index 1ec1af1..d3695c0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,11 +1,18 @@
 # Repository Codex Instructions
 
+- Keep active source worktrees, wallet-test browser profiles, unpacked wallet extensions, and long-lived Docker bind mounts in durable directories, never OS temporary directories. Before opening a wallet test site, verify the extension files exist and select the browser profile where it is installed.
+- In browser wallet checks, resolve local certificate warnings before testing provider availability. A failed CDP navigation may expose an internal error document, not the visible browser interstitial; do not assume its URL or DOM is the site or disable certificate verification globally.
+- On macOS, Chromium ignores hostname-scoped keychain trust rules. Verify local TLS in the target browser as well as with native SecTrust; never remove the hostname restriction or broaden CA trust without explicit user approval.
+- Before reading paths from an earlier architecture, another XCS checkout, or another agent’s planned file list, resolve them with `rg --files` in the active worktree; layouts differ between worktrees and concurrent implementations can choose different final paths. Resolve directory arguments too before narrowing a search to a presumed tooling or scripts directory. Reuse discovered filenames verbatim; use absolute paths for files belonging to an outer or sibling checkout.
 - The Compose stack is local development only. Before pushing changes to it, render the exact overlays with every referenced profile and, when a Docker engine is available, build `apps/web/Dockerfile` and `apps/indexer/Dockerfile` with the repository root as build context and start the stack under the `node` runtime user; configuration rendering alone does not validate the build context or the shared `db/` and `config/` copies the images depend on.
 - Every per-app pnpm command that resolves dependencies — `install`, `audit`, `licenses list` — must carry `--ignore-workspace`. Without it, `pnpm --dir apps/web install` silently operates on the root workspace and still exits 0.
 - When cryptographically checking an XRPL transaction returned by `tx`, request `binary: true` and verify the canonical `tx_blob`; API v2 `tx_json` can rename serialized fields (for example, `Amount` is exposed as `DeliverMax`) and is not the canonical object to re-encode for signature verification.
-- For Playwright smoke assertions, inspect the rendered semantics and use a unique role, test ID, or explicitly scoped locator; do not assume localized headings or repeated public identifiers resolve to exactly one element in strict mode.
+- For Playwright smoke assertions, inspect the rendered semantics and use a unique role, test ID, or explicitly scoped locator; scope navigation links to the named main-navigation region because the footer repeats them. Read the current locale catalog after concurrent UI edits. Do not assume localized headings or repeated public identifiers resolve to exactly one element in strict mode. Inspect the accessibility snapshot before matching unfamiliar controls: concatenated `textContent` and CSS-uppercase visible text do not determine an exact accessible name. After changing labels or disclosure controls, search both `e2e/` and compiled browser scenarios in `test/` for affected selectors; default unit runs skip those runtime scenarios.
 - When running a second Nuxt dev or Playwright web-server instance from another worktree, set `NUXT_IGNORE_LOCK=1` and use a distinct port; Nuxt's development lock is shared across worktrees.
 - After editing Prettier-managed files, format the touched files before running format checks; do not use the check command as the formatter.
+- For scripted text replacements, assert that the expected original text exists and inspect the resulting diff before rerunning validation; a successful script exit does not prove that an edit occurred.
 - For one-off Node scripts, resolve dependencies from the owning workspace package; running from the monorepo root can silently select an incompatible ancestor `node_modules` package.
 - The two apps do not import `@xcs-protocol/*`. Protocol behaviour changes land in `packages/core` first and are mirrored by hand into `apps/web/app/lib/xcs/` and `apps/indexer/src/lib/xcs/` in the same pull request; rebuild the owning app, not the package, to validate an app change.
 - Quote shell paths that contain route brackets or other glob metacharacters before passing them to commands such as `sed` or `rg`.
+- For wallet connection regressions, derive SignIn responses, live queries and initialization events separately from the installed extension’s public code, then test connection, account refresh and pre-signature checks through the real SDK. Treat account/network notifications as a request to recheck identity, not proof that an approved session changed.
+- On macOS, keep the wallet test browser within the visible screen and foreground it before requesting approval. If GemWallet rejects without a popup, inspect its service worker for window-bounds errors before diagnosing a permission or signing failure.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3425b08..3cd145f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -44,13 +44,13 @@ The rule is therefore:
 
 The copy locations are:
 
-| Copy                         | Source                                            |
-| ---------------------------- | ------------------------------------------------- |
-| `apps/web/app/lib/xcs/core/` | `packages/core/src/**`                            |
-| `apps/web/app/lib/xcs/sdk/`  | `packages/sdk/src/**`                             |
-| `apps/web/server/lib/db/`    | the former `packages/db` client and transactions  |
-| `apps/indexer/src/lib/xcs/`  | the `packages/core` modules the indexer reaches   |
-| `apps/indexer/src/lib/db/`   | client, fencing, transactions, provision, migrate |
+| Copy                         | Source                                          |
+| ---------------------------- | ----------------------------------------------- |
+| `apps/web/app/lib/xcs/core/` | `packages/core/src/**`                          |
+| `apps/web/app/lib/xcs/sdk/`  | `packages/sdk/src/**`                           |
+| `apps/web/server/lib/db/`    | application-local database implementation       |
+| `apps/indexer/src/lib/xcs/`  | the `packages/core` modules the indexer reaches |
+| `apps/indexer/src/lib/db/`   | application-local database implementation       |
 
 ### How the rule is enforced
 
@@ -73,10 +73,11 @@ from` module specifier — which is the case this check exists for, since a chan
 - a new file under a vendored directory with no header at all, so a copy cannot be added unlabelled;
 - a stale by-design divergence (below).
 
-It compares against the source **as it is now**, not as it was at the recorded `<sha>`. The sha is
-immutable, so comparing against it would only ever notice edits to the copy. A source that has been
-retired from the tree (the former `packages/db`) can no longer change, so for those files the
-recorded commit is used.
+It compares protocol copies against the source **as it is now**, not as it was at the recorded
+`<sha>`. The sha is immutable, so comparing against it would only ever notice edits to the copy. The
+former `packages/db` implementation was retired before this repository history and cannot be
+resolved here; its descendants are explicitly marked as application-local code and are covered by
+each application's tests. Shared tables and migrations remain canonical under `db/`.
 
 A copy that genuinely has to differ — because the surrounding application requires it, not because
 someone edited it — declares that on a second header line, pinning the exact source the divergence
diff --git a/README.md b/README.md
index 702dac6..e64f8f9 100644
--- a/README.md
+++ b/README.md
@@ -6,13 +6,16 @@ This repository is alpha software for XRPL Testnet. Do not use personal data or
 
 ## Layout
 
-Two deployable applications:
+Two application runtimes and two one-purpose deployment components:
 
 - `apps/indexer`: validated-ledger ingestion and rebuildable projections. It owns the database
   tooling (`db:generate`, `db:migrate`, `db:bootstrap`).
 - `apps/web`: the Nuxt Testnet explorer and issuer/subject workflows **and** the read/verification
   API it serves from the same origin at `/v1`, with `/health/*`, `/internal/metrics*` and
   `/documentation`.
+- `apps/notifier`: the restricted SMTP notification worker built from the web application.
+- `apps/db-bootstrap`: the pre-deploy migration and least-privilege role provisioning job built from
+  the indexer.
 
 Each application is standalone: its own `package.json`, `pnpm-lock.yaml`, `.npmrc`, tsconfig,
 Prettier config, `Dockerfile` and `.env.example`. Neither imports a workspace package; each carries
@@ -76,11 +79,10 @@ pnpm --dir apps/indexer verify
 
 ### Pointing the applications at a database
 
-PostgreSQL is provisioned outside this repository, and so are its users: create `xcs_indexer`,
-`xcs_api` and `xcs_monitor` in the DigitalOcean control panel or with `doctl databases user create`
-and keep the passwords DigitalOcean generates. The indexer then owns the grants; run it once against
-a fresh database as the administrator, then give each application its least-privilege connection
-string:
+PostgreSQL is provisioned outside this repository. First create these eight managed users in
+DigitalOcean: `xcs_indexer`, `xcs_api`, `xcs_payload_writer`, `xcs_monitor`, `xcs_app`,
+`xcs_admin_app`, `xcs_notifier` and `xcs_issuer`. DigitalOcean generates and owns their passwords.
+Then run the grants-only bootstrap with the database administrator URL:
 
 ```bash
 XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@host:5432/xcs \
@@ -88,10 +90,13 @@ XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@host:5432/xcs \
   pnpm --dir apps/indexer db:bootstrap
 ```
 
-The indexer then reads `XCS_INDEXER_DATABASE_URL` (role `xcs_indexer`) and the web app reads
-`XCS_DATABASE_URL` (role `xcs_api`). The complete contracts are
+The command applies migrations 0000–0008 and database grants atomically. It never creates a user and
+never reads, sets or rotates a runtime password. Each component then receives its own managed URL.
+The complete contracts are
 [`apps/indexer/.env.example`](./apps/indexer/.env.example) and
-[`apps/web/.env.example`](./apps/web/.env.example).
+[`apps/web/.env.example`](./apps/web/.env.example). The pre-deploy and notification contracts are
+[`apps/db-bootstrap/.env.example`](./apps/db-bootstrap/.env.example) and
+[`apps/notifier/.env.example`](./apps/notifier/.env.example).
 
 For a disposable local database, `docker-compose.yml` runs PostgreSQL, the one-shot bootstrap and
 both applications. It is a **local-development stack only**; it is not a deployment template. Copy
diff --git a/apps/db-bootstrap/.env.example b/apps/db-bootstrap/.env.example
new file mode 100644
index 0000000..ee85950
--- /dev/null
+++ b/apps/db-bootstrap/.env.example
@@ -0,0 +1,4 @@
+# One-off pre-deploy contract. DigitalOcean creates all eight runtime users and
+# owns their generated passwords; this job never receives or changes them.
+XCS_BOOTSTRAP_DATABASE_URL=               # held (managed PostgreSQL administrator)
+XCS_DATABASE_CLUSTER_SCOPE=dedicated      # required acknowledgement
diff --git a/apps/db-bootstrap/Dockerfile b/apps/db-bootstrap/Dockerfile
new file mode 100644
index 0000000..5fe5fb2
--- /dev/null
+++ b/apps/db-bootstrap/Dockerfile
@@ -0,0 +1,39 @@
+# One-shot database migration and role bootstrap job. Build context: repository root.
+ARG XCS_NODE_IMAGE=node:24-alpine
+FROM ${XCS_NODE_IMAGE} AS build
+
+RUN npm install -g pnpm@10.34.4
+
+WORKDIR /workspace
+COPY apps/indexer ./apps/indexer
+COPY db ./db
+COPY config ./config
+
+WORKDIR /workspace/apps/indexer
+RUN pnpm install --frozen-lockfile
+RUN pnpm build
+RUN pnpm install --frozen-lockfile --prod
+
+FROM ${XCS_NODE_IMAGE} AS runtime
+
+ARG XCS_REVISION=unknown
+ARG XCS_VERSION=0.0.0
+
+LABEL org.opencontainers.image.title="XCS database bootstrap" \
+      org.opencontainers.image.description="XCS pre-deploy migrations and least-privilege roles" \
+      org.opencontainers.image.source="https://github.com/XRPL-Commons/XCS" \
+      org.opencontainers.image.revision="${XCS_REVISION}" \
+      org.opencontainers.image.version="${XCS_VERSION}" \
+      org.opencontainers.image.licenses="MIT"
+
+ENV NODE_ENV=production
+ENV XCS_MIGRATIONS_DIR=/workspace/db/migrations
+
+WORKDIR /workspace
+COPY --from=build --chown=node:node /workspace/apps/indexer/dist ./dist
+COPY --from=build --chown=node:node /workspace/apps/indexer/node_modules ./node_modules
+COPY --from=build --chown=node:node /workspace/apps/indexer/package.json ./package.json
+COPY --chown=node:node db/migrations ./db/migrations
+
+USER node
+CMD ["node", "dist/lib/db/bin/bootstrap.js"]
diff --git a/apps/indexer/.env.example b/apps/indexer/.env.example
index c6fb361..4db10ec 100644
--- a/apps/indexer/.env.example
+++ b/apps/indexer/.env.example
@@ -1,47 +1,15 @@
-# Contract for the XCS indexer worker.
-# Names only; values live in the deployment's secret store.
-#
-# This file holds secrets and values that genuinely differ per deployment.
-# Behavioural settings -- the poll interval, the lease duration and the batch
-# size -- are checked-in code, in src/settings.ts; they are not deployment
-# inputs and a variable of the same name here has no effect.
-
-# PostgreSQL connection string for the indexer role.
-XCS_INDEXER_DATABASE_URL=                  # config
-# Commons-operated complete-history rippled endpoint, supplied out of band.
+# Runtime worker contract. Secrets and deployment-specific values are supplied by
+# the deployment platform; worker behaviour defaults live in src/settings.ts.
+XCS_INDEXER_DATABASE_URL=                  # held
 XCS_RPC_URL_PRIMARY=                       # held
 # Public fallback endpoint; no availability or retention SLA for XCS.
 XCS_RPC_URL_SECONDARY=                     # held
 
-# Path to the network profile JSON this worker indexes; must be the same
-# published file the web app serves. Every profile is its own operator-created
-# file (config/networks/README.md), so this one cannot live in code.
+# Path to the same published network profile JSON served by the web app.
 XCS_NETWORK_PROFILE=                       # config
 
-# The three values below default in src/settings.ts to the safe public posture
-# (`blackholed`, `shared`, and no acknowledgement). They stay overridable because
-# ADR 0003's disposable controlled Testnet pilot is the one deployment that needs
-# the weaker registry posture, and it must still supply every acknowledgement
-# explicitly. Never set them for a public profile.
-# `blackholed` or `controlled-testnet-pilot` (ADR 0003 only).
+# Safe defaults live in src/settings.ts. These three overrides exist only for the
+# disposable controlled Testnet pilot described by ADR 0003.
 XCS_REGISTRY_POLICY=                       # optional config
-# Must equal DISPOSABLE_PROFILE_AND_DATABASE for controlled-testnet-pilot.
 XCS_CONTROLLED_PILOT_ACK=                  # optional config
-# `shared` or `exclusive-profile`; the controlled pilot requires exclusive-profile.
 XCS_DATABASE_SCOPE=                        # optional config
-
-# The two values below are read only by db:bootstrap, run once from an operator
-# machine or a one-off job against the external database. The long-running
-# service reads only the variables above.
-#
-# db:bootstrap is grants-only. The managed database service owns the users: create
-# xcs_indexer, xcs_api and xcs_monitor in the DigitalOcean control panel or with
-# `doctl databases user create`, take the passwords DigitalOcean generates, and
-# only then run db:bootstrap as the administrator. It never creates a role and
-# never sets, resets or reads a role password; a missing role fails the run by
-# name. No runtime password is an input here.
-XCS_BOOTSTRAP_DATABASE_URL=                # optional held
-# Must be exactly `dedicated`: an acknowledgement, not a choice. The grants and
-# role attributes db:bootstrap applies are cluster-visible, so it refuses to run
-# on a cluster the operator does not own.
-XCS_DATABASE_CLUSTER_SCOPE=                # optional config
diff --git a/apps/indexer/README.md b/apps/indexer/README.md
index 1c4cab6..c8d4c4b 100644
--- a/apps/indexer/README.md
+++ b/apps/indexer/README.md
@@ -26,8 +26,10 @@ pnpm --dir apps/indexer dev      # tsx watch src/main.ts
 pnpm --dir apps/indexer verify   # format:check, lint, test, build
 ```
 
-Configuration is the contract in [`.env.example`](./.env.example). The long-running service reads the
-first ten variables; the last two are read only by `db:bootstrap`.
+Configuration for the long-running service is the contract in [`.env.example`](./.env.example).
+Bootstrap secrets have a separate contract in
+[`apps/db-bootstrap/.env.example`](../db-bootstrap/.env.example) and must never be delivered to the
+indexer worker.
 
 The committed `config/networks/testnet.example.json` is a placeholder with an invalid registry and
 activation boundary. The indexer refuses it and stops with `SOURCE_REGISTRY_NOT_BLACKHOLED`. **This is
@@ -40,18 +42,22 @@ The indexer owns every database command. `drizzle-kit` and the migration runner
 devDependencies; the web app has none of them.
 
 ```sh
-pnpm --dir apps/indexer db:generate    # regenerate db/migrations after editing db/schema — commit the result
+pnpm --dir apps/indexer db:generate    # add a migration after editing db/schema — retain applied files
 pnpm --dir apps/indexer db:migrate     # apply migrations to an existing database (idempotent)
-pnpm --dir apps/indexer db:bootstrap   # migrate + grant privileges to xcs_indexer / xcs_api / xcs_monitor
+pnpm --dir apps/indexer db:bootstrap   # migrate + grant all eight runtime users
 ```
 
-`db:bootstrap` runs once against a fresh database and needs only `XCS_BOOTSTRAP_DATABASE_URL` and
-`XCS_DATABASE_CLUSTER_SCOPE=dedicated`. It is **grants-only**: the managed database service owns the
-users, so create `xcs_indexer`, `xcs_api` and `xcs_monitor` in the DigitalOcean control panel or with
-`doctl databases user create` first, take the passwords DigitalOcean generates, then run this once as
-the administrator. It never creates a role and never sets, resets or reads a role password; if a role
-is missing it fails and names it. It is idempotent. Rotating a runtime password is now a DigitalOcean
-operation and does not need this step. PostgreSQL is provisioned outside this repository; see
+Before `db:bootstrap`, create all eight runtime users listed in [`db/README.md`](../../db/README.md)
+through DigitalOcean and retain the generated connection strings in the deployment secret store.
+The bootstrap needs only `XCS_BOOTSTRAP_DATABASE_URL` and
+`XCS_DATABASE_CLUSTER_SCOPE=dedicated`. It checks every user before DDL, applies migrations 0000–0008
+and least-privilege grants in one transaction, and never reads or changes a runtime password.
+
+`db:migrate` applies pending migrations without provisioning roles. The committed 0000–0008 history
+supports populated-baseline upgrades and repeated runs; integration tests check preservation of
+profiles and legacy payload bytes/locators. Never rewrite an applied migration. This is not an
+upgrader for arbitrary schema drift or the former Nuxt MVP. See the [shared database contract](../../db/README.md).
+PostgreSQL is provisioned outside this repository; see
 [`docs/database.md`](../../docs/database.md) and the
 [deployment runbook](../../docs/runbooks/deployment.md).
 
@@ -71,6 +77,22 @@ the selected registry policy on both sources, and prints no endpoint or credenti
 procedures — healthy state, recovery, deterministic rebuild and evidence capture — are in the
 [indexer runbook](../../docs/runbooks/indexer.md).
 
+Ledger transport requests the complete transaction set with `transactions: true`, `expand: true`
+and `binary: true`. Large expanded JSON responses can exceed a provider's WebSocket limit even
+when that provider retains the ledger. The official binary codec decodes the header, transaction
+bytes and metadata locally; XRPL hash helpers validate the header and derive transaction IDs.
+Protocol pseudo-transactions use the standard unsigned transaction-ID domain. Canonical serialized
+fields such as `Payment.Amount` are preserved instead of API v2 JSON aliases such as `DeliverMax`.
+See the [XRPL ledger API](https://xrpl.org/docs/references/http-websocket-apis/public-api-methods/ledger-methods/ledger).
+
+Both independently operated sources must still agree on the complete normalized header and every
+transaction/metadata object. Malformed blobs, conflicting hashes, missing transactions and a source
+without the required history remain fatal. The transport change neither skips checkpoints nor
+resets a projection or reduces the quorum. `ripple-binary-codec@2.11.0` is a direct dependency for
+its official ledger-header decoder, matching the version already used transitively by `xrpl`.
+An existing database with a different migration journal still requires its own reviewed upgrade;
+rebuilding the indexer image does not authorize rewriting that history.
+
 ## Tests
 
 ```sh
diff --git a/apps/indexer/package.json b/apps/indexer/package.json
index aaede45..491e563 100644
--- a/apps/indexer/package.json
+++ b/apps/indexer/package.json
@@ -14,7 +14,7 @@
     "ceremony": "tsx src/ceremony-cli.ts",
     "clean": "rm -rf dist coverage",
     "db:bootstrap": "tsx src/lib/db/bin/bootstrap.ts",
-    "db:generate": "cd ../../db && drizzle-kit generate --config ./drizzle.config.ts",
+    "db:generate": "NODE_PATH=./node_modules drizzle-kit generate --config ../../db/drizzle.config.ts",
     "db:migrate": "tsx src/lib/db/bin/migrate.ts",
     "dev": "tsx watch src/main.ts",
     "fixture:capture": "tsx src/fixture-cli.ts capture",
@@ -28,9 +28,11 @@
     "start": "node dist/main.js",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
-    "test:postgres": "XCS_REQUIRE_POSTGRES_TESTS=1 vitest run test/postgres.integration.test.ts",
+    "test:postgres": "XCS_REQUIRE_POSTGRES_TESTS=1 vitest run --no-file-parallelism test/db/migrations.integration.test.ts test/db/app-model.integration.test.ts test/db/auth.integration.test.ts test/db/admin.integration.test.ts test/postgres.integration.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "verify": "pnpm format:check && pnpm lint && pnpm test && pnpm build"
+    "verify": "pnpm format:check && pnpm lint && pnpm test && pnpm build",
+    "db:status": "tsx src/lib/db/bin/status.ts",
+    "admin:bootstrap": "tsx src/lib/db/bin/admin-bootstrap.ts"
   },
   "dependencies": {
     "@noble/hashes": "2.3.0",
@@ -40,6 +42,7 @@
     "jsonc-parser": "3.3.1",
     "multiformats": "14.0.5",
     "postgres": "^3.4.7",
+    "ripple-binary-codec": "2.11.0",
     "tr46": "4.1.1",
     "xrpl": "^5.0.0"
   },
diff --git a/apps/indexer/pnpm-lock.yaml b/apps/indexer/pnpm-lock.yaml
index bc35c47..61c58bd 100644
--- a/apps/indexer/pnpm-lock.yaml
+++ b/apps/indexer/pnpm-lock.yaml
@@ -33,6 +33,9 @@ importers:
       postgres:
         specifier: ^3.4.7
         version: 3.4.9
+      ripple-binary-codec:
+        specifier: 2.11.0
+        version: 2.11.0
       tr46:
         specifier: 4.1.1
         version: 4.1.1
diff --git a/apps/indexer/src/lib/db/app/bootstrap-admin.ts b/apps/indexer/src/lib/db/app/bootstrap-admin.ts
new file mode 100644
index 0000000..dd6f98c
--- /dev/null
+++ b/apps/indexer/src/lib/db/app/bootstrap-admin.ts
@@ -0,0 +1,37 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import type { DatabaseClient } from '../client.js'
+
+/** Explicit one-time operator action. Never invoked by login or migration. */
+export async function bootstrapFirstAdmin(
+  client: DatabaseClient,
+  input: { issuer: string; subject: string; operator: string },
+): Promise<{ userId: string; created: boolean }> {
+  if (
+    !input.issuer.trim() ||
+    !input.subject.trim() ||
+    !input.operator.trim() ||
+    input.operator.length > 200
+  ) {
+    throw new Error('ADMIN_BOOTSTRAP_INPUT_INVALID')
+  }
+  return client.sql.begin(async (sql) => {
+    await sql`SELECT pg_advisory_xact_lock(1480807217, 30)`
+    const [user] = await sql<{ id: string }[]>`SELECT id FROM app_users
+      WHERE identity_issuer = ${input.issuer} AND identity_subject = ${input.subject} AND status = 'active' FOR UPDATE`
+    if (!user) throw new Error('ADMIN_BOOTSTRAP_ACCOUNT_NOT_FOUND')
+    const roles = await sql<
+      { user_id: string; revoked_at: Date | null }[]
+    >`SELECT user_id, revoked_at FROM app_user_roles WHERE role = 'admin' FOR UPDATE`
+    if (roles.some((role) => role.user_id === user.id && role.revoked_at !== null))
+      throw new Error('ADMIN_BOOTSTRAP_REVOKED')
+    if (roles.some((role) => role.user_id !== user.id && role.revoked_at === null))
+      throw new Error('ADMIN_BOOTSTRAP_ALREADY_INITIALIZED')
+    if (roles.some((role) => role.user_id === user.id)) return { userId: user.id, created: false }
+    // Historical bootstrap also prevents using this command to replace a removed administrator.
+    const previous = await sql`SELECT id FROM app_admin_bootstrap_audit LIMIT 1`
+    if (previous.length) throw new Error('ADMIN_BOOTSTRAP_ALREADY_INITIALIZED')
+    await sql`INSERT INTO app_user_roles (user_id, role, granted_by) VALUES (${user.id}, 'admin', ${user.id})`
+    await sql`INSERT INTO app_admin_bootstrap_audit (user_id, operator) VALUES (${user.id}, ${input.operator.trim()})`
+    return { userId: user.id, created: true }
+  })
+}
diff --git a/apps/indexer/src/lib/db/app/invitations.ts b/apps/indexer/src/lib/db/app/invitations.ts
new file mode 100644
index 0000000..d4e5fd1
--- /dev/null
+++ b/apps/indexer/src/lib/db/app/invitations.ts
@@ -0,0 +1,41 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { and, eq, exists, gt, isNull, sql } from 'drizzle-orm'
+
+import type { XcsDatabase } from '../client.js'
+import { appInvites, appUsers } from '#db/schema/app/index.js'
+import { hashAppToken } from './tokens.js'
+
+/** Call only from an authenticated mutation, with userId supplied by the server's session. */
+export async function claimInvitation(db: XcsDatabase, input: { token: string; userId: string }) {
+  const tokenHash = hashAppToken(input.token)
+  if (tokenHash === null) return null
+
+  // One conditional UPDATE is the claim boundary. Statement time, not transaction start,
+  // prevents a caller's long-running transaction from extending the invitation's lifetime.
+  const [claimed] = await db
+    .update(appInvites)
+    .set({ claimedBy: input.userId, claimedAt: sql`statement_timestamp()` })
+    .where(
+      and(
+        eq(appInvites.tokenHash, tokenHash),
+        isNull(appInvites.claimedAt),
+        isNull(appInvites.revokedAt),
+        gt(appInvites.expiresAt, sql`statement_timestamp()`),
+        exists(
+          db
+            .select({ id: appUsers.id })
+            .from(appUsers)
+            .where(and(eq(appUsers.id, input.userId), eq(appUsers.status, 'active'))),
+        ),
+      ),
+    )
+    .returning({
+      id: appInvites.id,
+      organizationId: appInvites.organizationId,
+      profileId: appInvites.profileId,
+      schemaUid: appInvites.schemaUid,
+      claimedBy: appInvites.claimedBy,
+      claimedAt: appInvites.claimedAt,
+    })
+  return claimed ?? null
+}
diff --git a/apps/indexer/src/lib/db/app/tokens.ts b/apps/indexer/src/lib/db/app/tokens.ts
new file mode 100644
index 0000000..3505451
--- /dev/null
+++ b/apps/indexer/src/lib/db/app/tokens.ts
@@ -0,0 +1,13 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { createHash, randomBytes } from 'node:crypto'
+
+/** Bearer secrets stay outside the database; persist only the returned hash. */
+export function createAppToken(): { token: string; tokenHash: string } {
+  const token = randomBytes(32).toString('base64url')
+  return { token, tokenHash: hashAppToken(token)! }
+}
+
+export function hashAppToken(token: string): string | null {
+  if (!/^[A-Za-z0-9_-]{43}$/.test(token)) return null
+  return createHash('sha256').update(token, 'utf8').digest('hex')
+}
diff --git a/apps/indexer/src/lib/db/app/visibility.ts b/apps/indexer/src/lib/db/app/visibility.ts
new file mode 100644
index 0000000..f89729d
--- /dev/null
+++ b/apps/indexer/src/lib/db/app/visibility.ts
@@ -0,0 +1,169 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { and, eq, isNull, sql } from 'drizzle-orm'
+import { alias } from 'drizzle-orm/pg-core'
+
+import type { XcsDatabase } from '../client.js'
+import {
+  appCredentialMetadata,
+  appOrganizationApplications,
+  appOrganizations,
+  appPresentations,
+  appUsers,
+} from '#db/schema/app/index.js'
+import { hashAppToken } from './tokens.js'
+
+export interface CredentialAccess {
+  scope: 'public' | 'full'
+  publicFields: string[]
+}
+
+/** All authorization facts are read together, never accepted as request-supplied roles/approvals. */
+export async function getCredentialAccess(
+  db: XcsDatabase,
+  input: {
+    profileId: string
+    generationId: string
+    viewerUserId: string | null
+    presentationToken?: string
+  },
+): Promise<CredentialAccess | null> {
+  const issuer = alias(appOrganizations, 'issuer_organization')
+  const verifier = alias(appOrganizations, 'verifier_organization')
+  const tokenHash =
+    input.presentationToken === undefined ? null : hashAppToken(input.presentationToken)
+
+  const [row] = await db
+    .select({
+      visibility: appCredentialMetadata.visibility,
+      publicFields: appCredentialMetadata.publicFields,
+      viewerId: appUsers.id,
+      recipientUserId: appCredentialMetadata.recipientUserId,
+      issuerResponsibleUserId: issuer.responsibleUserId,
+      issuerStatus: issuer.status,
+      verifierResponsibleUserId: verifier.responsibleUserId,
+      verifierStatus: verifier.status,
+      verifierApproval: appOrganizationApplications.status,
+    })
+    .from(appCredentialMetadata)
+    .leftJoin(
+      appUsers,
+      input.viewerUserId === null
+        ? sql`FALSE`
+        : and(eq(appUsers.id, input.viewerUserId), eq(appUsers.status, 'active')),
+    )
+    .leftJoin(issuer, eq(issuer.id, appCredentialMetadata.issuerOrganizationId))
+    .leftJoin(
+      appPresentations,
+      tokenHash === null
+        ? sql`FALSE`
+        : and(
+            eq(appPresentations.tokenHash, tokenHash),
+            eq(appPresentations.profileId, appCredentialMetadata.profileId),
+            eq(appPresentations.generationId, appCredentialMetadata.generationId),
+            eq(appPresentations.recipientUserId, appCredentialMetadata.recipientUserId),
+            eq(appPresentations.scope, 'full'),
+            isNull(appPresentations.revokedAt),
+          ),
+    )
+    .leftJoin(verifier, eq(verifier.id, appPresentations.verifierOrganizationId))
+    .leftJoin(
+      appOrganizationApplications,
+      and(
+        eq(appOrganizationApplications.organizationId, verifier.id),
+        eq(appOrganizationApplications.role, 'verifier'),
+      ),
+    )
+    .where(
+      and(
+        eq(appCredentialMetadata.profileId, input.profileId),
+        eq(appCredentialMetadata.generationId, input.generationId),
+      ),
+    )
+  if (!row) return null
+
+  const isOwner =
+    row.viewerId !== null &&
+    (row.viewerId === row.recipientUserId ||
+      (row.viewerId === row.issuerResponsibleUserId && row.issuerStatus === 'active'))
+  const isAuthorizedVerifier =
+    row.viewerId !== null &&
+    row.viewerId === row.verifierResponsibleUserId &&
+    row.verifierStatus === 'active' &&
+    row.verifierApproval === 'approved'
+  return {
+    scope: row.visibility === 'public' || isOwner || isAuthorizedVerifier ? 'full' : 'public',
+    publicFields: row.publicFields,
+  }
+}
+
+export type ClaimValue =
+  null | boolean | number | string | ClaimValue[] | { [key: string]: ClaimValue }
+export type Claims = { [key: string]: ClaimValue }
+
+interface Selection {
+  whole: boolean
+  children: Map<string, Selection>
+}
+
+/** RFC 6901 pointers relative to claims. Objects can be narrowed; arrays are atomic fields. */
+export function validatePublicFields(paths: readonly string[]): void {
+  selection(paths)
+}
+
+function selection(paths: readonly string[]): Selection {
+  if (!Array.isArray(paths) || paths.length > 256) throw new Error('INVALID_PUBLIC_FIELDS')
+  const root: Selection = { whole: false, children: new Map() }
+  for (const path of paths) {
+    if (
+      typeof path !== 'string' ||
+      !path.startsWith('/') ||
+      path.length > 1024 ||
+      /~(?![01])/u.test(path)
+    ) {
+      throw new Error('INVALID_PUBLIC_FIELD_PATH')
+    }
+    const parts = path
+      .slice(1)
+      .split('/')
+      .map((part) => part.replaceAll('~1', '/').replaceAll('~0', '~'))
+    if (
+      parts.length > 32 ||
+      parts.some((part) => ['__proto__', 'constructor', 'prototype'].includes(part))
+    ) {
+      throw new Error('INVALID_PUBLIC_FIELD_PATH')
+    }
+    let node = root
+    for (const part of parts) {
+      let child = node.children.get(part)
+      if (!child) {
+        child = { whole: false, children: new Map() }
+        node.children.set(part, child)
+      }
+      node = child
+    }
+    node.whole = true
+  }
+  return root
+}
+
+function project(source: Claims, node: Selection): Claims {
+  const result: Claims = {}
+  for (const [key, child] of node.children) {
+    if (!Object.hasOwn(source, key)) continue
+    const value = source[key]!
+    if (child.whole) {
+      result[key] = structuredClone(value)
+    } else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+      const nested = project(value, child)
+      if (Object.keys(nested).length > 0) result[key] = nested
+    }
+  }
+  return result
+}
+
+/** Return only claims, never spread a private payload envelope into a public response. */
+export function filterCredentialClaims(claims: Claims, access: CredentialAccess): Claims {
+  if (access.scope === 'full') return structuredClone(claims)
+  if (access.scope !== 'public') throw new Error('INVALID_CREDENTIAL_ACCESS')
+  return project(claims, selection(access.publicFields))
+}
diff --git a/apps/indexer/src/lib/db/bin/admin-bootstrap.ts b/apps/indexer/src/lib/db/bin/admin-bootstrap.ts
new file mode 100644
index 0000000..7cf646b
--- /dev/null
+++ b/apps/indexer/src/lib/db/bin/admin-bootstrap.ts
@@ -0,0 +1,27 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { createDatabaseClient } from '../client.js'
+import { bootstrapFirstAdmin } from '../app/bootstrap-admin.js'
+import { requiredEnvironment } from './environment.js'
+
+try {
+  const client = createDatabaseClient(requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL'), {
+    onNotice: () => undefined,
+  })
+  try {
+    const result = await bootstrapFirstAdmin(client, {
+      issuer: requiredEnvironment('XCS_ADMIN_IDENTITY_ISSUER'),
+      subject: requiredEnvironment('XCS_ADMIN_IDENTITY_SUBJECT'),
+      operator: requiredEnvironment('XCS_ADMIN_BOOTSTRAP_OPERATOR'),
+    })
+    process.stdout.write(`${JSON.stringify({ ok: true, created: result.created })}\n`)
+  } finally {
+    await client.close()
+  }
+} catch (error) {
+  const code =
+    error instanceof Error && /^ADMIN_BOOTSTRAP_[A-Z_]+$/.test(error.message)
+      ? error.message
+      : 'ADMIN_BOOTSTRAP_FAILED'
+  process.stderr.write(`${JSON.stringify({ ok: false, code })}\n`)
+  process.exitCode = 1
+}
diff --git a/apps/indexer/src/lib/db/bin/bootstrap.ts b/apps/indexer/src/lib/db/bin/bootstrap.ts
index e3fa9e2..8a39d1d 100644
--- a/apps/indexer/src/lib/db/bin/bootstrap.ts
+++ b/apps/indexer/src/lib/db/bin/bootstrap.ts
@@ -1,29 +1,20 @@
-// Copied from packages/db/src/bin/bootstrap.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (provisioning is grants-only, so no runtime password is read from the environment, and a missing role is reported by name); source sha256:d9142aa3fda17e3032510d9dd0405a01464b531e59ed59299d5823c06e2fa8fd.
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import {
   bootstrapDatabase,
   DatabaseBootstrapConfigurationError,
   MissingRuntimeDatabaseRolesError,
   parseDatabaseClusterScope,
   UnsafeRuntimeDatabaseRolesError,
+  XCS_RUNTIME_DATABASE_ROLES,
 } from '../bootstrap.js'
 import { createDatabaseClient } from '../client.js'
-
-function requiredEnvironment(name: string): string {
-  const value = process.env[name]
-  if (value === undefined || value.trim().length === 0) {
-    throw new DatabaseBootstrapConfigurationError(
-      `${name} is required. Set it in the same command that runs this step: a bare ` +
-        'shell assignment on its own line is a shell variable, not an environment ' +
-        'variable, and this process never sees it.',
-    )
-  }
-  return value
-}
+import { requiredEnvironment } from './environment.js'
 
 async function main(): Promise<void> {
   const databaseUrl = requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')
-  const client = createDatabaseClient(databaseUrl)
+  const client = createDatabaseClient(databaseUrl, {
+    onNotice: () => undefined,
+  })
 
   try {
     const report = await bootstrapDatabase(client, {
@@ -35,7 +26,7 @@ async function main(): Promise<void> {
     process.stdout.write(
       `${JSON.stringify({
         ok: true,
-        roles: ['xcs_indexer', 'xcs_api', 'xcs_monitor'],
+        roles: XCS_RUNTIME_DATABASE_ROLES,
         administrator: report.administrator,
         unappliedResourceControls: report.unappliedResourceControls,
       })}\n`,
@@ -66,7 +57,12 @@ try {
           ? { roles: error.roles, findings: error.findings }
           : {}
     process.stderr.write(
-      `${JSON.stringify({ ok: false, code: error.code, ...roles, message: error.message })}\n`,
+      `${JSON.stringify({
+        ok: false,
+        code: error.code,
+        ...roles,
+        message: error.message,
+      })}\n`,
     )
   } else {
     // Drivers and migration helpers wrap the original failure, so walk the
diff --git a/apps/indexer/src/lib/db/bin/environment.ts b/apps/indexer/src/lib/db/bin/environment.ts
new file mode 100644
index 0000000..77df208
--- /dev/null
+++ b/apps/indexer/src/lib/db/bin/environment.ts
@@ -0,0 +1,36 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { readFileSync, statSync } from 'node:fs'
+
+import { DatabaseBootstrapConfigurationError } from '../provision.js'
+
+/** Supports secret files in native CLI runs as well as the container entrypoint. */
+export function requiredEnvironment(name: string): string {
+  const direct = process.env[name]
+  const path = process.env[`${name}_FILE`]
+  if (direct && path) {
+    throw new DatabaseBootstrapConfigurationError(
+      `DATABASE_ENVIRONMENT_CONFLICT: ${name} and ${name}_FILE cannot both be set`,
+    )
+  }
+  let value = direct
+  if (path) {
+    const stat = statSync(path)
+    if (!stat.isFile() || stat.size < 1 || stat.size > 16_384) {
+      throw new DatabaseBootstrapConfigurationError(
+        `DATABASE_SECRET_FILE_INVALID: ${name}_FILE must contain one non-empty value of at most 16384 bytes`,
+      )
+    }
+    value = readFileSync(path, 'utf8').replace(/\r?\n$/, '')
+    if (/[\r\n]/.test(value)) {
+      throw new DatabaseBootstrapConfigurationError(
+        `DATABASE_SECRET_FILE_INVALID: ${name}_FILE must contain exactly one line`,
+      )
+    }
+  }
+  if (!value?.trim()) {
+    throw new DatabaseBootstrapConfigurationError(
+      `DATABASE_ENVIRONMENT_REQUIRED: ${name} is required. Set it in the same command that runs this step; a bare shell assignment on its own line is not exported to the process.`,
+    )
+  }
+  return value
+}
diff --git a/apps/indexer/src/lib/db/bin/migrate.ts b/apps/indexer/src/lib/db/bin/migrate.ts
index b46dcd9..3c208d7 100644
--- a/apps/indexer/src/lib/db/bin/migrate.ts
+++ b/apps/indexer/src/lib/db/bin/migrate.ts
@@ -1,33 +1,20 @@
-// Not a vendored copy (no upstream: packages/db never had a bin/migrate.ts): applies
-// db/migrations without provisioning roles.
-import { initializeDatabase, migrationsFolder } from '../bootstrap.js'
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import { createDatabaseClient } from '../client.js'
+import { migrateDatabase } from '../migrations.js'
+import { requiredEnvironment } from './environment.js'
 
-function administratorDatabaseUrl(): string {
-  for (const name of ['XCS_BOOTSTRAP_DATABASE_URL', 'XCS_DATABASE_URL'] as const) {
-    const value = process.env[name]
-    if (value !== undefined && value.trim().length > 0) return value
-  }
-  throw new Error('XCS_BOOTSTRAP_DATABASE_URL or XCS_DATABASE_URL is required')
-}
-
-async function main(): Promise<void> {
-  const client = createDatabaseClient(administratorDatabaseUrl())
-
+try {
+  const client = createDatabaseClient(requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL'), {
+    onNotice: () => undefined,
+  })
   try {
-    // The migrator records applied migrations in `drizzle.__drizzle_migrations`,
-    // so a second run against the same database applies nothing.
-    await initializeDatabase(client)
-    process.stdout.write(`${JSON.stringify({ ok: true, migrationsFolder: migrationsFolder() })}\n`)
+    const result = await migrateDatabase(client)
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`)
   } finally {
     await client.close()
   }
-}
-
-try {
-  await main()
 } catch {
-  // Do not serialize the thrown error: connection errors may contain a URL or password.
-  process.stderr.write(`${JSON.stringify({ ok: false, code: 'DATABASE_MIGRATE_FAILED' })}\n`)
+  // Database errors may include connection credentials or SQL; never serialize them.
+  process.stderr.write(`${JSON.stringify({ ok: false, code: 'DATABASE_MIGRATION_FAILED' })}\n`)
   process.exitCode = 1
 }
diff --git a/apps/indexer/src/lib/db/bin/status.ts b/apps/indexer/src/lib/db/bin/status.ts
new file mode 100644
index 0000000..f194e1c
--- /dev/null
+++ b/apps/indexer/src/lib/db/bin/status.ts
@@ -0,0 +1,21 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { createDatabaseClient } from '../client.js'
+import { databaseMigrationStatus } from '../migrations.js'
+import { requiredEnvironment } from './environment.js'
+
+try {
+  const client = createDatabaseClient(requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL'), {
+    onNotice: () => undefined,
+  })
+  try {
+    const result = await databaseMigrationStatus(client)
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`)
+  } finally {
+    await client.close()
+  }
+} catch {
+  process.stderr.write(
+    `${JSON.stringify({ ok: false, code: 'DATABASE_MIGRATION_STATUS_FAILED' })}\n`,
+  )
+  process.exitCode = 1
+}
diff --git a/apps/indexer/src/lib/db/bootstrap.ts b/apps/indexer/src/lib/db/bootstrap.ts
index 378d6da..a8dbe4d 100644
--- a/apps/indexer/src/lib/db/bootstrap.ts
+++ b/apps/indexer/src/lib/db/bootstrap.ts
@@ -1,33 +1,27 @@
-// Copied from packages/db/src/bootstrap.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (migrations moved from packages/db/drizzle to db/migrations, with the XCS_MIGRATIONS_DIR override the container image sets, and provisioning is grants-only so no password travels through this module); source sha256:ef5dc1f95861fc8465a9d68e59e25f5a55eedab91a483b9d34ec89abf7346ca3.
-import { fileURLToPath } from 'node:url'
-
-import { migrate } from 'drizzle-orm/postgres-js/migrator'
-
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import type { DatabaseClient } from './client.js'
+import { migrateDatabase, migrateDatabaseInTransaction } from './migrations.js'
 import {
-  provisionRuntimeDatabasePrivileges,
+  applyRuntimeDatabasePrivilegesInTransaction,
+  parseDatabaseClusterScope,
+  prepareRuntimeDatabaseProvisioningInTransaction,
   type RuntimeDatabaseProvisioning,
   type RuntimeDatabaseProvisioningReport,
 } from './provision.js'
 
-const DEFAULT_MIGRATIONS_FOLDER = fileURLToPath(
-  new URL('../../../../../db/migrations', import.meta.url),
-)
-
-export function migrationsFolder(): string {
-  const override = process.env.XCS_MIGRATIONS_DIR?.trim()
-  return override === undefined || override.length === 0 ? DEFAULT_MIGRATIONS_FOLDER : override
-}
-
 export {
   DatabaseBootstrapConfigurationError,
   MissingRuntimeDatabaseRolesError,
+  UnsafeRuntimeDatabaseRolesError,
   parseDatabaseClusterScope,
   provisionRuntimeDatabasePrivileges,
-  UnsafeRuntimeDatabaseRolesError,
   XCS_API_DATABASE_CONNECTION_LIMIT,
   XCS_API_DATABASE_ROLE,
+  XCS_APP_DATABASE_ROLE,
+  XCS_ADMIN_APP_DATABASE_ROLE,
+  XCS_NOTIFIER_DATABASE_ROLE,
+  XCS_ISSUER_DATABASE_ROLE,
+  XCS_PAYLOAD_WRITER_DATABASE_ROLE,
   XCS_DATABASE_CLUSTER_SCOPE,
   XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
   XCS_INDEXER_DATABASE_ROLE,
@@ -40,13 +34,22 @@ export {
 } from './provision.js'
 
 export async function initializeDatabase(client: DatabaseClient): Promise<void> {
-  await migrate(client.db, { migrationsFolder: migrationsFolder() })
+  await migrateDatabase(client)
 }
 
 export async function bootstrapDatabase(
   client: DatabaseClient,
   provisioning: RuntimeDatabaseProvisioning,
 ): Promise<RuntimeDatabaseProvisioningReport> {
-  await initializeDatabase(client)
-  return await provisionRuntimeDatabasePrivileges(client, provisioning)
+  // Reject an invalid acknowledgement before reserving a connection.
+  parseDatabaseClusterScope(provisioning.clusterScope)
+  return await client.sql.begin(async (transaction) => {
+    // DigitalOcean must have created every user before any migration changes state.
+    const administrator = await prepareRuntimeDatabaseProvisioningInTransaction(
+      transaction,
+      provisioning,
+    )
+    await migrateDatabaseInTransaction(transaction)
+    return await applyRuntimeDatabasePrivilegesInTransaction(transaction, administrator)
+  })
 }
diff --git a/apps/indexer/src/lib/db/client.ts b/apps/indexer/src/lib/db/client.ts
index bd0a28c..fa20878 100644
--- a/apps/indexer/src/lib/db/client.ts
+++ b/apps/indexer/src/lib/db/client.ts
@@ -1,8 +1,8 @@
-// Copied from packages/db/src/client.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js'
 import postgres, { type Sql } from 'postgres'
 
-import * as schema from '#db/schema'
+import * as schema from '#db/schema/index.js'
 
 export type XcsDatabase = PostgresJsDatabase<typeof schema>
 
@@ -12,7 +12,10 @@ export interface DatabaseClient {
   close: () => Promise<void>
 }
 
-export function createDatabaseClient(databaseUrl: string): DatabaseClient {
+export function createDatabaseClient(
+  databaseUrl: string,
+  options: { onNotice?: () => void } = {},
+): DatabaseClient {
   if (databaseUrl.trim().length === 0) {
     throw new Error('DATABASE_URL must not be empty')
   }
@@ -22,6 +25,7 @@ export function createDatabaseClient(databaseUrl: string): DatabaseClient {
     idle_timeout: 20,
     connect_timeout: 10,
     prepare: false,
+    ...(options.onNotice ? { onnotice: options.onNotice } : {}),
   })
 
   return {
diff --git a/apps/indexer/src/lib/db/index.ts b/apps/indexer/src/lib/db/index.ts
new file mode 100644
index 0000000..345e16c
--- /dev/null
+++ b/apps/indexer/src/lib/db/index.ts
@@ -0,0 +1,10 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+export * from './client.js'
+export * from './indexer-fencing.js'
+export * from './transactions.js'
+export * from '#db/schema/index.js'
+export * from '#db/schema/app/index.js'
+export * from './app/tokens.js'
+export * from './app/invitations.js'
+export * from './app/visibility.js'
+export * from './app/bootstrap-admin.js'
diff --git a/apps/indexer/src/lib/db/indexer-fencing.ts b/apps/indexer/src/lib/db/indexer-fencing.ts
index 73e53fe..f7ed0d3 100644
--- a/apps/indexer/src/lib/db/indexer-fencing.ts
+++ b/apps/indexer/src/lib/db/indexer-fencing.ts
@@ -1,4 +1,4 @@
-// Copied from packages/db/src/indexer-fencing.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import { and, eq, gt, isNull, lte, or, sql } from 'drizzle-orm'
 
 import type { XcsDatabase } from './client.js'
@@ -8,7 +8,7 @@ import {
   indexerStatuses,
   type IndexerStatusRow,
   type IndexerStatusState,
-} from '#db/schema'
+} from '#db/schema/index.js'
 
 const UINT32_MAX = 4_294_967_295
 const MAX_SAFE_EPOCH = Number.MAX_SAFE_INTEGER
diff --git a/apps/indexer/src/lib/db/migrations.ts b/apps/indexer/src/lib/db/migrations.ts
new file mode 100644
index 0000000..ea631a4
--- /dev/null
+++ b/apps/indexer/src/lib/db/migrations.ts
@@ -0,0 +1,160 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+// Diverges by design (shared db/migrations location and XCS_MIGRATIONS_DIR deployment override); source sha256:42c7d5380bba58dcfc4414b033d5e9c028d5dc93bec2ddce6db860d43cb1abae.
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { readMigrationFiles } from 'drizzle-orm/migrator'
+import type { Sql, TransactionSql } from 'postgres'
+
+import type { DatabaseClient } from './client.js'
+
+const DEFAULT_MIGRATIONS_FOLDERS = [
+  fileURLToPath(new URL('../../../../../db/migrations', import.meta.url)),
+  fileURLToPath(new URL('../../../db/migrations', import.meta.url)),
+]
+
+export function migrationsFolder(): string {
+  return (
+    process.env.XCS_MIGRATIONS_DIR?.trim() ||
+    DEFAULT_MIGRATIONS_FOLDERS.find((folder) => existsSync(join(folder, 'meta/_journal.json'))) ||
+    DEFAULT_MIGRATIONS_FOLDERS[0]!
+  )
+}
+
+export const DATABASE_MIGRATIONS_FOLDER = migrationsFolder()
+const LOCK_CLASS = 1_480_807_217
+const LOCK_OBJECT = 2
+
+export interface MigrationStatus {
+  applied: string[]
+  pending: string[]
+}
+
+interface MigrationEntry {
+  tag: string
+  when: number
+  hash: string
+  statements: string[]
+}
+
+function readCatalog(folder: string): MigrationEntry[] {
+  const journal = JSON.parse(readFileSync(join(folder, 'meta/_journal.json'), 'utf8')) as {
+    dialect?: unknown
+    entries?: Array<{ idx?: unknown; tag?: unknown; when?: unknown }>
+  }
+  if (
+    journal.dialect !== 'postgresql' ||
+    !Array.isArray(journal.entries) ||
+    journal.entries.length === 0
+  ) {
+    throw new Error('DATABASE_MIGRATION_CATALOG_INVALID')
+  }
+  const tags = new Set<string>()
+  let previous = 0
+  for (const [index, entry] of journal.entries.entries()) {
+    if (
+      entry.idx !== index ||
+      typeof entry.tag !== 'string' ||
+      !/^\d{4}_[a-zA-Z0-9_-]+$/.test(entry.tag) ||
+      tags.has(entry.tag) ||
+      typeof entry.when !== 'number' ||
+      !Number.isSafeInteger(entry.when) ||
+      entry.when <= previous
+    ) {
+      throw new Error('DATABASE_MIGRATION_CATALOG_INVALID')
+    }
+    tags.add(entry.tag)
+    previous = entry.when
+  }
+  const migrations = readMigrationFiles({ migrationsFolder: folder })
+  return migrations.map((migration, index) => ({
+    tag: journal.entries![index]!.tag as string,
+    when: migration.folderMillis,
+    hash: migration.hash,
+    statements: migration.sql,
+  }))
+}
+
+async function status(
+  sql: Sql | TransactionSql,
+  catalog: MigrationEntry[],
+): Promise<MigrationStatus> {
+  const [table] = await sql<{ exists: boolean }[]>`
+    SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS exists
+  `
+  // Inspection of an empty database must not create the Drizzle schema or journal.
+  const applied = table?.exists
+    ? await sql<{ hash: string; created_at: string | number | null }[]>`
+        SELECT hash, created_at FROM drizzle.__drizzle_migrations ORDER BY created_at, id
+      `
+    : []
+  if (
+    applied.length > catalog.length ||
+    applied.some((row, index) => {
+      const expected = catalog[index]!
+      return row.hash !== expected.hash || String(row.created_at) !== String(expected.when)
+    })
+  ) {
+    throw new Error('DATABASE_MIGRATION_HISTORY_MISMATCH')
+  }
+  return {
+    applied: catalog.slice(0, applied.length).map((entry) => entry.tag),
+    pending: catalog.slice(applied.length).map((entry) => entry.tag),
+  }
+}
+
+export async function databaseMigrationStatus(
+  client: DatabaseClient,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  return status(client.sql, readCatalog(migrationsFolder))
+}
+
+/** Applies the existing Drizzle journal without rotating passwords or widening runtime grants. */
+export async function migrateDatabase(
+  client: DatabaseClient,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  const catalog = readCatalog(migrationsFolder)
+  return client.sql.begin((transaction) => migrateCatalogInTransaction(transaction, catalog))
+}
+
+async function migrateCatalogInTransaction(
+  transaction: TransactionSql,
+  catalog: MigrationEntry[],
+): Promise<MigrationStatus> {
+  // The stock migrator reads history before its transaction. Read, validate and apply on
+  // one locked transaction instead, retaining Drizzle's SQL reader and exact journal format.
+  const [lock] = await transaction<{ locked: boolean }[]>`
+    SELECT pg_try_advisory_xact_lock(${LOCK_CLASS}, ${LOCK_OBJECT}) AS locked
+  `
+  if (!lock?.locked) throw new Error('DATABASE_MIGRATION_BUSY')
+  const before = await status(transaction, catalog)
+  if (before.pending.length === 0) return before
+  await transaction`CREATE SCHEMA IF NOT EXISTS drizzle`
+  await transaction`
+    CREATE TABLE IF NOT EXISTS drizzle.__drizzle_migrations (
+      id SERIAL PRIMARY KEY,
+      hash text NOT NULL,
+      created_at bigint
+    )
+  `
+  for (const migration of catalog.slice(before.applied.length)) {
+    // These are reviewed local migration artifacts, never request-supplied SQL.
+    for (const statement of migration.statements) await transaction.unsafe(statement)
+    await transaction`
+      INSERT INTO drizzle.__drizzle_migrations (hash, created_at)
+      VALUES (${migration.hash}, ${migration.when})
+    `
+  }
+  return status(transaction, catalog)
+}
+
+/** Applies migrations inside a caller-owned transaction, allowing an atomic bootstrap. */
+export async function migrateDatabaseInTransaction(
+  transaction: TransactionSql,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  return migrateCatalogInTransaction(transaction, readCatalog(migrationsFolder))
+}
diff --git a/apps/indexer/src/lib/db/provision.ts b/apps/indexer/src/lib/db/provision.ts
index 0fec561..3266cd6 100644
--- a/apps/indexer/src/lib/db/provision.ts
+++ b/apps/indexer/src/lib/db/provision.ts
@@ -1,25 +1,37 @@
-// Copied from packages/db/src/provision.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (provisioning is grants-only: the managed PostgreSQL service owns the runtime users and their passwords, so this copy neither creates roles nor sets passwords); source sha256:ad624bb5a8d9403dda699767be589440680ac21bb4e2a3d7cfd648fb592b0fb5.
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+// Provisioning is grants-only: DigitalOcean owns runtime users and passwords.
+import type { TransactionSql } from 'postgres'
+
 import type { DatabaseClient } from './client.js'
 
 export const XCS_INDEXER_DATABASE_ROLE = 'xcs_indexer' as const
 export const XCS_API_DATABASE_ROLE = 'xcs_api' as const
+export const XCS_PAYLOAD_WRITER_DATABASE_ROLE = 'xcs_payload_writer' as const
 export const XCS_MONITOR_DATABASE_ROLE = 'xcs_monitor' as const
+export const XCS_APP_DATABASE_ROLE = 'xcs_app' as const
+export const XCS_ADMIN_APP_DATABASE_ROLE = 'xcs_admin_app' as const
+export const XCS_NOTIFIER_DATABASE_ROLE = 'xcs_notifier' as const
+export const XCS_ISSUER_DATABASE_ROLE = 'xcs_issuer' as const
 export const XCS_DATABASE_CLUSTER_SCOPE = 'dedicated' as const
 
+const PROVISION_LOCK_CLASS_ID = 1_480_807_217
+const PROVISION_LOCK_OBJECT_ID = 1
+
 export const XCS_RUNTIME_DATABASE_ROLES = [
   XCS_INDEXER_DATABASE_ROLE,
   XCS_API_DATABASE_ROLE,
+  XCS_PAYLOAD_WRITER_DATABASE_ROLE,
   XCS_MONITOR_DATABASE_ROLE,
+  XCS_APP_DATABASE_ROLE,
+  XCS_ADMIN_APP_DATABASE_ROLE,
+  XCS_NOTIFIER_DATABASE_ROLE,
+  XCS_ISSUER_DATABASE_ROLE,
 ] as const
 
 export const XCS_INDEXER_DATABASE_CONNECTION_LIMIT = 12
 export const XCS_API_DATABASE_CONNECTION_LIMIT = 12
 export const XCS_MONITOR_DATABASE_CONNECTION_LIMIT = 3
 
-const PROVISION_LOCK_CLASS_ID = 1_480_807_217
-const PROVISION_LOCK_OBJECT_ID = 1
-
 export interface RuntimeDatabaseProvisioning {
   clusterScope: typeof XCS_DATABASE_CLUSTER_SCOPE
 }
@@ -125,6 +137,14 @@ const XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS: Readonly<
       idle_in_transaction_session_timeout: '30s',
     },
   },
+  xcs_payload_writer: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
   xcs_monitor: {
     connectionLimit: XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
     settings: {
@@ -133,6 +153,38 @@ const XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS: Readonly<
       idle_in_transaction_session_timeout: '30s',
     },
   },
+  xcs_app: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_admin_app: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_notifier: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_issuer: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
 }
 
 /** A resource control the cluster refused and that is not already in effect.
@@ -224,21 +276,85 @@ function unsafeRoleNames(findings: readonly string[]): string[] {
 }
 
 const REVOKE_CURRENT_DATABASE_ACCESS_SQL = `
-  REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
+  REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
   REVOKE CREATE ON SCHEMA public FROM PUBLIC;
   DO $xcs_database_grants$
   BEGIN
-    EXECUTE format('REVOKE ALL PRIVILEGES ON DATABASE %I FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor', current_database());
-    EXECUTE format('GRANT CONNECT ON DATABASE %I TO xcs_indexer, xcs_api, xcs_monitor', current_database());
+    EXECUTE format('REVOKE ALL PRIVILEGES ON DATABASE %I FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', current_database());
+    EXECUTE format('GRANT CONNECT ON DATABASE %I TO xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', current_database());
   END
   $xcs_database_grants$;
 `
 
+// Table-level REVOKE does not remove column grants. Normalize every runtime role
+// so a previous release cannot retain broader column-level privileges.
+const REVOKE_RUNTIME_COLUMNS_SQL = `
+  DO $xcs_app_columns$
+  DECLARE relation record;
+  BEGIN
+    FOR relation IN
+      SELECT table_name, string_agg(format('%I', column_name), ', ' ORDER BY ordinal_position) AS columns
+      FROM information_schema.columns WHERE table_schema = 'public' GROUP BY table_name
+    LOOP
+      EXECUTE format('REVOKE SELECT (%2$s), INSERT (%2$s), UPDATE (%2$s), REFERENCES (%2$s) ON TABLE public.%1$I FROM xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', relation.table_name, relation.columns);
+    END LOOP;
+  END
+  $xcs_app_columns$;
+`
+
+const GRANT_APPLICATION_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_app;
+  GRANT SELECT ON TABLE app_users, app_user_roles, app_wallets TO xcs_app;
+  GRANT SELECT (id, responsible_user_id, name, status) ON TABLE app_organizations TO xcs_app;
+  GRANT SELECT (organization_id, role, status) ON TABLE app_organization_applications TO xcs_app;
+  GRANT INSERT (identity_issuer, identity_subject, email, email_verified_at, display_name) ON TABLE app_users TO xcs_app;
+  GRANT UPDATE (email, email_verified_at, display_name) ON TABLE app_users TO xcs_app;
+  GRANT INSERT (user_id) ON TABLE app_user_roles TO xcs_app;
+  GRANT INSERT (user_id, network_id, address, verified_at) ON TABLE app_wallets TO xcs_app;
+  GRANT UPDATE (verified_at, revoked_at) ON TABLE app_wallets TO xcs_app;
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE app_sessions, app_auth_transactions, app_wallet_challenges TO xcs_app;
+`
+
+// The portal administrator pool is separate from the bootstrap superuser xcs_admin.
+const GRANT_ADMIN_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_admin_app;
+  GRANT SELECT (id, email, email_verified_at, display_name, status) ON app_users TO xcs_admin_app;
+  GRANT SELECT ON app_user_roles, app_sessions, app_organizations, app_organization_applications, app_documents, app_wallets TO xcs_admin_app;
+  GRANT SELECT, INSERT ON app_admin_decisions, app_admin_notifications TO xcs_admin_app;
+  GRANT UPDATE (status, reviewed_by, reviewed_at, review_reason, revision) ON app_organization_applications TO xcs_admin_app;
+  GRANT UPDATE (status, recipient_email, attempt_id, claimed_at, error_code) ON app_admin_notifications TO xcs_admin_app;
+`
+const GRANT_NOTIFIER_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_notifier;
+  GRANT SELECT ON app_admin_notifications, app_admin_decisions TO xcs_notifier;
+  GRANT SELECT (id, name) ON app_organizations TO xcs_notifier;
+  GRANT SELECT (id, email, email_verified_at, status) ON app_users TO xcs_notifier;
+  GRANT UPDATE (status, attempts, attempt_id, claimed_at, sent_at, error_code, recipient_email) ON app_admin_notifications TO xcs_notifier;
+`
+
+const GRANT_ISSUER_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_issuer;
+  GRANT SELECT (id, email, email_verified_at, display_name, status) ON app_users TO xcs_issuer;
+  GRANT SELECT ON app_sessions, app_wallets, app_organizations, app_organization_applications,
+    app_schema_metadata, app_invites, app_credential_metadata, app_issuer_payloads,
+    app_invite_deliveries, app_presentations, network_profiles, schemas, schema_events,
+    credential_generations, credential_events, ledger_checkpoints, indexer_status, app_verifier_history, app_presentation_challenges, app_presentation_proofs TO xcs_issuer;
+  GRANT INSERT (id, responsible_user_id, name) ON app_organizations TO xcs_issuer;
+  GRANT INSERT (organization_id, role, website, contact, jurisdiction, description, purpose) ON app_organization_applications TO xcs_issuer;
+  GRANT INSERT (id, organization_id, application_role, storage_key, mime_type, byte_length, sha256, uploaded_by) ON app_documents TO xcs_issuer;
+  GRANT INSERT ON app_schema_metadata, app_invites, app_credential_metadata, app_issuer_payloads, app_invite_deliveries TO xcs_issuer;
+  GRANT UPDATE (token_hash, expires_at, revoked_at, claimed_by, claimed_at) ON app_invites TO xcs_issuer;
+  GRANT UPDATE (status, error_code) ON app_invite_deliveries TO xcs_issuer;
+  GRANT INSERT ON app_presentations, app_verifier_history, app_presentation_challenges, app_presentation_proofs TO xcs_issuer;
+  GRANT DELETE ON app_presentation_challenges TO xcs_issuer;
+  GRANT UPDATE (revoked_at) ON app_presentations TO xcs_issuer;
+`
+
 const GRANT_RUNTIME_ACCESS_SQL = `
-  GRANT USAGE ON SCHEMA public TO xcs_indexer, xcs_api;
+  GRANT USAGE ON SCHEMA public TO xcs_indexer, xcs_api, xcs_payload_writer;
 
   GRANT SELECT, INSERT ON TABLE
     network_profiles, ledger_checkpoints, schema_events, schemas, credential_events
@@ -257,7 +373,8 @@ const GRANT_RUNTIME_ACCESS_SQL = `
     network_profiles, ledger_checkpoints, indexer_status, indexer_incidents,
     schema_events, schemas, credential_generations, credential_events
   TO xcs_api;
-  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE pin_challenges, demo_pins TO xcs_api;
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE pin_challenges, demo_pins TO xcs_payload_writer;
+  GRANT SELECT, INSERT ON TABLE hosted_payloads, hosted_payload_publications TO xcs_payload_writer;
 `
 
 const RUNTIME_ROLE_ATTRIBUTES_SQL = `
@@ -272,7 +389,7 @@ const RUNTIME_ROLE_ATTRIBUTES_SQL = `
     rolconnlimit AS "connectionLimit",
     rolconfig AS "configuration"
   FROM pg_roles
-  WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+  WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
   ORDER BY rolname
 `
 
@@ -281,8 +398,8 @@ const RUNTIME_ROLE_MEMBERSHIPS_SQL = `
   FROM pg_auth_members auth_membership
   JOIN pg_roles granted_role ON granted_role.oid = auth_membership.roleid
   JOIN pg_roles member_role ON member_role.oid = auth_membership.member
-  WHERE granted_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
-     OR member_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+  WHERE granted_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
+     OR member_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
   ORDER BY granted_role.rolname, member_role.rolname
 `
 
@@ -292,135 +409,147 @@ function settingOf(configuration: readonly string[] | null, name: string): strin
   return entry === undefined ? undefined : entry.slice(prefix.length)
 }
 
-export async function provisionRuntimeDatabasePrivileges(
-  client: DatabaseClient,
+export async function prepareRuntimeDatabaseProvisioningInTransaction(
+  sql: TransactionSql,
   provisioning: RuntimeDatabaseProvisioning,
-): Promise<RuntimeDatabaseProvisioningReport> {
+): Promise<string> {
   parseDatabaseClusterScope(provisioning.clusterScope)
+  await sql`SELECT pg_advisory_xact_lock(${PROVISION_LOCK_CLASS_ID}, ${PROVISION_LOCK_OBJECT_ID})`
 
-  return await client.sql.begin(async (sql) => {
-    await sql`SELECT pg_advisory_xact_lock(${PROVISION_LOCK_CLASS_ID}, ${PROVISION_LOCK_OBJECT_ID})`
-
-    // The administrator is read from the live session, not hard-coded: it is
-    // `doadmin` on DigitalOcean, something else on another provider and on a
-    // developer's own PostgreSQL.
-    const [session] = await sql<{ administrator: string }[]>`
-      SELECT current_user AS "administrator"
-    `
-    const administrator = session?.administrator
-    if (administrator === undefined) {
-      throw new DatabaseBootstrapConfigurationError(
-        'The database session reported no current user, so the cluster administrator could not ' +
-          'be identified. Provisioning verifies role memberships against it and cannot continue.',
-      )
-    }
+  const [session] = await sql<{ administrator: string }[]>`
+    SELECT current_user AS "administrator"
+  `
+  const administrator = session?.administrator
+  if (administrator === undefined) {
+    throw new DatabaseBootstrapConfigurationError(
+      'The database session reported no current user, so the cluster administrator could not ' +
+        'be identified. Provisioning verifies role memberships against it and cannot continue.',
+    )
+  }
 
-    const present = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
-    const found = new Set(present.map((row) => row.roleName))
-    const missing = XCS_RUNTIME_DATABASE_ROLES.filter((role) => !found.has(role))
-    if (missing.length > 0) {
-      throw new MissingRuntimeDatabaseRolesError(missing)
-    }
+  const present = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
+  const found = new Set(present.map((row) => row.roleName))
+  const missing = XCS_RUNTIME_DATABASE_ROLES.filter((role) => !found.has(role))
+  if (missing.length > 0) throw new MissingRuntimeDatabaseRolesError(missing)
+
+  const memberships = await sql.unsafe<RuntimeRoleMembership[]>(RUNTIME_ROLE_MEMBERSHIPS_SQL)
+  const findings = [
+    ...unsafeRoleAttributeFindings(present),
+    ...unsafeRoleMembershipFindings(memberships, administrator),
+  ]
+  if (findings.length > 0) {
+    throw new UnsafeRuntimeDatabaseRolesError(findings, unsafeRoleNames(findings))
+  }
 
-    const memberships = await sql.unsafe<RuntimeRoleMembership[]>(RUNTIME_ROLE_MEMBERSHIPS_SQL)
-    const findings = [
-      ...unsafeRoleAttributeFindings(present),
-      ...unsafeRoleMembershipFindings(memberships, administrator),
-    ]
-    if (findings.length > 0) {
-      throw new UnsafeRuntimeDatabaseRolesError(findings, unsafeRoleNames(findings))
-    }
+  return administrator
+}
 
-    await sql.unsafe(REVOKE_CURRENT_DATABASE_ACCESS_SQL)
-    await sql.unsafe(GRANT_RUNTIME_ACCESS_SQL)
-
-    // pg_monitor is a predefined role the cluster owns. Passing it on requires
-    // the administrator to hold it WITH ADMIN OPTION, which a managed provider
-    // need not grant, so this is attempted rather than assumed: DigitalOcean
-    // refuses it at `check_role_membership_authorization`. A refusal costs the
-    // monitor role its server statistics, not the deployment, and it is named
-    // in the report rather than passing unnoticed.
-    const monitorGrants: { role: string; control: string; intended: string }[] = []
-    try {
-      await sql.savepoint(async (scoped) => {
-        await scoped.unsafe('GRANT pg_monitor TO xcs_monitor WITH INHERIT TRUE, SET FALSE')
-      })
-    } catch {
-      monitorGrants.push({
-        role: XCS_MONITOR_DATABASE_ROLE,
-        control: 'pg_monitor membership',
-        intended: 'granted',
-      })
-    }
+export async function applyRuntimeDatabasePrivilegesInTransaction(
+  sql: TransactionSql,
+  administrator: string,
+): Promise<RuntimeDatabaseProvisioningReport> {
+  await sql.unsafe(REVOKE_CURRENT_DATABASE_ACCESS_SQL)
+  await sql.unsafe(REVOKE_RUNTIME_COLUMNS_SQL)
+  await sql.unsafe(GRANT_RUNTIME_ACCESS_SQL)
+  await sql.unsafe(GRANT_APPLICATION_ACCESS_SQL)
+  await sql.unsafe(GRANT_ADMIN_ACCESS_SQL)
+  await sql.unsafe(GRANT_NOTIFIER_ACCESS_SQL)
+  await sql.unsafe(GRANT_ISSUER_ACCESS_SQL)
+
+  // pg_monitor is a predefined role the cluster owns. Passing it on requires
+  // the administrator to hold it WITH ADMIN OPTION, which a managed provider
+  // need not grant, so this is attempted rather than assumed: DigitalOcean
+  // refuses it at `check_role_membership_authorization`. A refusal costs the
+  // monitor role its server statistics, not the deployment, and it is named
+  // in the report rather than passing unnoticed.
+  const monitorGrants: { role: string; control: string; intended: string }[] = []
+  try {
+    await sql.savepoint(async (scoped) => {
+      await scoped.unsafe('GRANT pg_monitor TO xcs_monitor WITH INHERIT TRUE, SET FALSE')
+    })
+  } catch {
+    monitorGrants.push({
+      role: XCS_MONITOR_DATABASE_ROLE,
+      control: 'pg_monitor membership',
+      intended: 'granted',
+    })
+  }
 
-    // Resource controls last, one statement each inside its own savepoint, so
-    // a cluster that refuses one keeps the grants above.
-    const refused: { role: string; control: string; intended: string }[] = []
-    for (const role of XCS_RUNTIME_DATABASE_ROLES) {
-      const controls = XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS[role]
-      const statements: { control: string; intended: string; statement: string }[] = [
-        {
-          control: 'CONNECTION LIMIT',
-          intended: String(controls.connectionLimit),
-          statement: `ALTER ROLE ${role} WITH CONNECTION LIMIT ${controls.connectionLimit}`,
-        },
-        ...Object.entries(controls.settings).map(([name, value]) => ({
-          control: name,
-          intended: value,
-          statement: `ALTER ROLE ${role} SET ${name} = '${value}'`,
-        })),
-      ]
-      for (const { control, intended, statement } of statements) {
-        try {
-          await sql.savepoint(async (scoped) => {
-            await scoped.unsafe(statement)
-          })
-        } catch {
-          refused.push({ role, control, intended })
-        }
+  // Resource controls last, one statement each inside its own savepoint, so
+  // a cluster that refuses one keeps the grants above.
+  const refused: { role: string; control: string; intended: string }[] = []
+  for (const role of XCS_RUNTIME_DATABASE_ROLES) {
+    const controls = XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS[role]
+    const statements: { control: string; intended: string; statement: string }[] = [
+      {
+        control: 'CONNECTION LIMIT',
+        intended: String(controls.connectionLimit),
+        statement: `ALTER ROLE ${role} WITH CONNECTION LIMIT ${controls.connectionLimit}`,
+      },
+      ...Object.entries(controls.settings).map(([name, value]) => ({
+        control: name,
+        intended: value,
+        statement: `ALTER ROLE ${role} SET ${name} = '${value}'`,
+      })),
+    ]
+    for (const { control, intended, statement } of statements) {
+      try {
+        await sql.savepoint(async (scoped) => {
+          await scoped.unsafe(statement)
+        })
+      } catch {
+        refused.push({ role, control, intended })
       }
     }
+  }
 
-    // A refusal is only a loss if the intended value is not already in effect.
-    let unappliedResourceControls: UnappliedRuntimeRoleResourceControl[] = []
-    if (refused.length > 0) {
-      const effective = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
-      const byRole = new Map(effective.map((row) => [row.roleName, row]))
-      unappliedResourceControls = refused.flatMap(({ role, control, intended }) => {
-        const row = byRole.get(role)
-        const actual =
-          control === 'CONNECTION LIMIT'
-            ? row === undefined
-              ? undefined
-              : String(row.connectionLimit)
-            : settingOf(row?.configuration ?? null, control)
-        return actual === intended ? [] : [{ role, control, intended, actual: actual ?? 'unset' }]
-      })
-    }
+  // A refusal is only a loss if the intended value is not already in effect.
+  let unappliedResourceControls: UnappliedRuntimeRoleResourceControl[] = []
+  if (refused.length > 0) {
+    const effective = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
+    const byRole = new Map(effective.map((row) => [row.roleName, row]))
+    unappliedResourceControls = refused.flatMap(({ role, control, intended }) => {
+      const row = byRole.get(role)
+      const actual =
+        control === 'CONNECTION LIMIT'
+          ? row === undefined
+            ? undefined
+            : String(row.connectionLimit)
+          : settingOf(row?.configuration ?? null, control)
+      return actual === intended ? [] : [{ role, control, intended, actual: actual ?? 'unset' }]
+    })
+  }
 
-    // A refused pg_monitor grant is only a loss when the membership is absent.
-    const unappliedMonitorGrants: UnappliedRuntimeRoleResourceControl[] = []
-    if (monitorGrants.length > 0) {
-      const [held] = await sql<Array<{ present: boolean }>>`
-        SELECT EXISTS (
-          SELECT 1
-          FROM pg_auth_members membership
-          JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
-          JOIN pg_roles member_role ON member_role.oid = membership.member
-          WHERE granted_role.rolname = 'pg_monitor'
-            AND member_role.rolname = ${XCS_MONITOR_DATABASE_ROLE}
-        ) AS present
-      `
-      if (held?.present !== true) {
-        unappliedMonitorGrants.push(
-          ...monitorGrants.map((entry) => ({ ...entry, actual: 'absent' })),
-        )
-      }
+  // A refused pg_monitor grant is only a loss when the membership is absent.
+  const unappliedMonitorGrants: UnappliedRuntimeRoleResourceControl[] = []
+  if (monitorGrants.length > 0) {
+    const [held] = await sql<Array<{ present: boolean }>>`
+      SELECT EXISTS (
+        SELECT 1
+        FROM pg_auth_members membership
+        JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
+        JOIN pg_roles member_role ON member_role.oid = membership.member
+        WHERE granted_role.rolname = 'pg_monitor'
+          AND member_role.rolname = ${XCS_MONITOR_DATABASE_ROLE}
+      ) AS present
+    `
+    if (held?.present !== true) {
+      unappliedMonitorGrants.push(...monitorGrants.map((entry) => ({ ...entry, actual: 'absent' })))
     }
+  }
 
-    return {
-      administrator,
-      unappliedResourceControls: [...unappliedResourceControls, ...unappliedMonitorGrants],
-    }
+  return {
+    administrator,
+    unappliedResourceControls: [...unappliedResourceControls, ...unappliedMonitorGrants],
+  }
+}
+export async function provisionRuntimeDatabasePrivileges(
+  client: DatabaseClient,
+  provisioning: RuntimeDatabaseProvisioning,
+): Promise<RuntimeDatabaseProvisioningReport> {
+  parseDatabaseClusterScope(provisioning.clusterScope)
+  return await client.sql.begin(async (sql) => {
+    const administrator = await prepareRuntimeDatabaseProvisioningInTransaction(sql, provisioning)
+    return await applyRuntimeDatabasePrivilegesInTransaction(sql, administrator)
   })
 }
diff --git a/apps/indexer/src/lib/db/transactions.ts b/apps/indexer/src/lib/db/transactions.ts
index 4164063..177eba7 100644
--- a/apps/indexer/src/lib/db/transactions.ts
+++ b/apps/indexer/src/lib/db/transactions.ts
@@ -1,4 +1,4 @@
-// Copied from packages/db/src/transactions.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import type { XcsDatabase } from './client.js'
 
 const RETRYABLE_TRANSACTION_ERROR_CODES = new Set(['40001', '40P01'])
diff --git a/apps/indexer/src/lib/xcs/claims.ts b/apps/indexer/src/lib/xcs/claims.ts
index 75c3bf8..939b03f 100644
--- a/apps/indexer/src/lib/xcs/claims.ts
+++ b/apps/indexer/src/lib/xcs/claims.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/claims.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/claims.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { base64urlnopad } from '@scure/base'
 import { isValidClassicAddress } from 'xrpl'
 
@@ -33,46 +33,46 @@ function isCanonicalBase64Url(value: string): boolean {
 }
 
 function parseValue(value: unknown, descriptor: FieldDescriptor, path: string): JsonValue {
-  if (value === null) return fail('INVALID_CLAIMS', 'null is not allowed', path)
+  if (value === null) return fail('CLAIMS_INVALID', 'null is not allowed', path)
 
   switch (descriptor.type) {
     case 'string':
-      if (typeof value !== 'string') return fail('INVALID_CLAIMS', 'Expected a string', path)
+      if (typeof value !== 'string') return fail('CLAIMS_INVALID', 'Expected a string', path)
       return value
     case 'bool':
-      if (typeof value !== 'boolean') return fail('INVALID_CLAIMS', 'Expected a boolean', path)
+      if (typeof value !== 'boolean') return fail('CLAIMS_INVALID', 'Expected a boolean', path)
       return value
     case 'uint': {
       if (typeof value !== 'string' || !UNSIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical unsigned decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical unsigned decimal string', path)
       }
       if (value.length > 78 || BigInt(value) > UINT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Unsigned integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Unsigned integer exceeds 256 bits', path)
       }
       return value
     }
     case 'int': {
       if (typeof value !== 'string' || !SIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical signed decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical signed decimal string', path)
       }
       const integer = BigInt(value)
       if (value.length > 79 || integer < INT256_MIN || integer > INT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Signed integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Signed integer exceeds 256 bits', path)
       }
       return value
     }
     case 'bytes':
       if (typeof value !== 'string' || !isCanonicalBase64Url(value)) {
-        return fail('INVALID_CLAIMS', 'Expected unpadded canonical base64url', path)
+        return fail('CLAIMS_INVALID', 'Expected unpadded canonical base64url', path)
       }
       return value
     case 'address':
       if (typeof value !== 'string' || !isValidClassicAddress(value)) {
-        return fail('INVALID_CLAIMS', 'Expected an XRPL classic address', path)
+        return fail('CLAIMS_INVALID', 'Expected an XRPL classic address', path)
       }
       return value
     case 'array':
-      if (!Array.isArray(value)) return fail('INVALID_CLAIMS', 'Expected an array', path)
+      if (!Array.isArray(value)) return fail('CLAIMS_INVALID', 'Expected an array', path)
       return value.map((item, index) => parseValue(item, descriptor.items, `${path}[${index}]`))
     case 'object':
       return parseObject(value, descriptor.fields, path)
@@ -80,10 +80,10 @@ function parseValue(value: unknown, descriptor: FieldDescriptor, path: string):
 }
 
 function parseObject(input: unknown, fields: SchemaFields, path: string): JsonObject {
-  if (!isRecord(input)) return fail('INVALID_CLAIMS', 'Expected an object', path)
+  if (!isRecord(input)) return fail('CLAIMS_INVALID', 'Expected an object', path)
   for (const name of Object.keys(input)) {
     if (!Object.hasOwn(fields, name)) {
-      return fail('INVALID_CLAIMS', `Unknown claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Unknown claim ${name}`, `${path}.${name}`)
     }
   }
 
@@ -91,7 +91,7 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
   for (const [name, descriptor] of Object.entries(fields)) {
     if (!Object.hasOwn(input, name)) {
       if (descriptor.optional === true) continue
-      return fail('INVALID_CLAIMS', `Missing required claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Missing required claim ${name}`, `${path}.${name}`)
     }
     claims[name] = parseValue(input[name], descriptor, `${path}.${name}`)
   }
@@ -101,3 +101,15 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
 export function parseClaims(input: unknown, fields: SchemaFields): JsonObject {
   return parseObject(input, fields, '$.claims')
 }
+
+export function validateClaims(
+  input: unknown,
+  schema: SchemaFields | { fields: SchemaFields; definition?: unknown; lineage?: unknown },
+): JsonObject {
+  const resolved = schema as { fields?: unknown; definition?: unknown; lineage?: unknown }
+  const fields =
+    resolved.definition !== undefined && resolved.lineage !== undefined
+      ? (resolved.fields as SchemaFields)
+      : (schema as SchemaFields)
+  return parseClaims(input, fields)
+}
diff --git a/apps/indexer/src/lib/xcs/credential.ts b/apps/indexer/src/lib/xcs/credential.ts
index 3c36374..043e758 100644
--- a/apps/indexer/src/lib/xcs/credential.ts
+++ b/apps/indexer/src/lib/xcs/credential.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/credential.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/credential.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress } from 'xrpl'
 
 import { parseClaims } from './claims.js'
@@ -11,7 +11,9 @@ export interface CredentialContext {
   issuer: string
   subject: string
   schemaUid: string
-  fields: SchemaFields
+  fields?: SchemaFields
+  /** Backward-compatible XCS v0.1 context name. */
+  schema?: SchemaFields
 }
 
 export interface CredentialPayload extends JsonObject {
@@ -42,47 +44,52 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 
 function assertContext(context: CredentialContext): void {
   if (!isValidClassicAddress(context.issuer)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid issuer address', '$context.issuer')
+    fail('PAYLOAD_INVALID', 'Invalid issuer address', '$context.issuer')
   }
   if (!isValidClassicAddress(context.subject)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid subject address', '$context.subject')
+    fail('PAYLOAD_INVALID', 'Invalid subject address', '$context.subject')
   }
   if (!SCHEMA_UID.test(context.schemaUid)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema UID', '$context.schemaUid')
+    fail('PAYLOAD_INVALID', 'Invalid schema UID', '$context.schemaUid')
   }
-  if (!isRecord(context.fields)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema fields', '$context.fields')
+  if (!isRecord(context.fields ?? context.schema)) {
+    fail('PAYLOAD_INVALID', 'Invalid schema fields', '$context.fields')
   }
 }
 
-function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+function contextFields(context: CredentialContext): SchemaFields {
   assertContext(context)
+  return (context.fields ?? context.schema) as SchemaFields
+}
+
+function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+  const fields = contextFields(context)
   if (!isRecord(input)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Credential payload must be an object', '$')
+    return fail('PAYLOAD_INVALID', 'Credential payload must be an object', '$')
   }
   for (const property of Object.keys(input)) {
     if (!PAYLOAD_PROPERTIES.has(property)) {
-      return fail('INVALID_CREDENTIAL_PAYLOAD', `Unknown property ${property}`, `$.${property}`)
+      return fail('PAYLOAD_INVALID', `Unknown property ${property}`, `$.${property}`)
     }
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('PAYLOAD_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (input.issuer !== context.issuer) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Issuer does not match the credential', '$.issuer')
+    return fail('PAYLOAD_INVALID', 'Issuer does not match the credential', '$.issuer')
   }
   if (input.subject !== context.subject) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Subject does not match the credential', '$.subject')
+    return fail('PAYLOAD_INVALID', 'Subject does not match the credential', '$.subject')
   }
   if (input.schema !== context.schemaUid) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Schema does not match CredentialType', '$.schema')
+    return fail('PAYLOAD_INVALID', 'Schema does not match CredentialType', '$.schema')
   }
   return {
     xcsVersion: '0.1',
     issuer: context.issuer,
     subject: context.subject,
     schema: context.schemaUid,
-    claims: parseClaims(input.claims, context.fields),
+    claims: parseClaims(input.claims, fields),
   }
 }
 
@@ -111,7 +118,21 @@ export function parseCredentialPayload(
   context: CredentialContext,
 ): CredentialPayload {
   const bytes = payloadBytes(content)
-  return parsePayload(parseCanonicalJson(bytes), context)
+  try {
+    return parsePayload(parseCanonicalJson(bytes), context)
+  } catch (error) {
+    if (
+      error instanceof XcsError &&
+      (error.code.startsWith('JSON_') ||
+        error.code === 'UTF8_INVALID' ||
+        error.code === 'CANONICALIZATION_UNSUPPORTED_VALUE')
+    ) {
+      return fail('PAYLOAD_INVALID', 'Credential payload must be canonical JSON', '$payload', {
+        cause: error.code,
+      })
+    }
+    throw error
+  }
 }
 
 export function verifyCredentialPayload(
diff --git a/apps/indexer/src/lib/xcs/errors.ts b/apps/indexer/src/lib/xcs/errors.ts
index e7948bf..d9d59ef 100644
--- a/apps/indexer/src/lib/xcs/errors.ts
+++ b/apps/indexer/src/lib/xcs/errors.ts
@@ -1,16 +1,35 @@
-// Copied from packages/core/src/errors.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
-export type XcsErrorCode =
-  | 'INVALID_NETWORK_PROFILE'
-  | 'INVALID_SCHEMA'
-  | 'INVALID_SCHEMA_REFERENCE'
-  | 'INVALID_CLAIMS'
-  | 'INVALID_UID_INPUT'
-  | 'INVALID_CREDENTIAL_PAYLOAD'
-  | 'INVALID_PAYLOAD_URI'
-  | 'INVALID_RIPPLE_TIME'
-  | 'INVALID_JSON'
-  | 'NON_CANONICAL_JSON'
-  | 'UNSUPPORTED_JSON_VALUE'
+// Copied from packages/core/src/errors.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
+export const XCS_ERROR_CODES = [
+  'JSON_INVALID',
+  'JSON_DUPLICATE_KEY',
+  'JSON_INVALID_UNICODE',
+  'JSON_NON_IJSON_NUMBER',
+  'CANONICALIZATION_UNSUPPORTED_VALUE',
+  'HEX_INVALID',
+  'UTF8_INVALID',
+  'NETWORK_PROFILE_INVALID',
+  'SCHEMA_INVALID',
+  'SCHEMA_PARENT_NOT_FOUND',
+  'SCHEMA_PARENT_NOT_PRIOR',
+  'SCHEMA_PARENT_NETWORK_MISMATCH',
+  'SCHEMA_OVERRIDE_FORBIDDEN',
+  'SCHEMA_INHERITANCE_CYCLE',
+  'SCHEMA_DEPTH_EXCEEDED',
+  'SCHEMA_FIELD_LIMIT_EXCEEDED',
+  'SCHEMA_SUPERSEDES_NOT_FOUND',
+  'SCHEMA_SUPERSEDES_NOT_PRIOR',
+  'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
+  'SCHEMA_CATALOG_INVALID',
+  'SCHEMA_CATALOG_LIMIT_EXCEEDED',
+  'VERIFICATION_REPORT_INVALID',
+  'UID_INPUT_INVALID',
+  'CLAIMS_INVALID',
+  'PAYLOAD_INVALID',
+  'PAYLOAD_URI_INVALID',
+  'RIPPLE_TIME_INVALID',
+] as const
+
+export type XcsErrorCode = (typeof XCS_ERROR_CODES)[number]
 
 export class XcsError extends Error {
   readonly code: XcsErrorCode
diff --git a/apps/indexer/src/lib/xcs/index.ts b/apps/indexer/src/lib/xcs/index.ts
index cd9dfc0..7be864c 100644
--- a/apps/indexer/src/lib/xcs/index.ts
+++ b/apps/indexer/src/lib/xcs/index.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/index.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/index.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 export {
   encodeCredentialPayload,
   parseCredentialPayload,
@@ -9,27 +9,41 @@ export {
   type EncodedCredentialPayload,
   type PayloadRetrieval,
 } from './credential.js'
-export { XcsError, type XcsErrorCode } from './errors.js'
+export { XCS_ERROR_CODES, XcsError, type XcsErrorCode } from './errors.js'
+export { parseClaims, validateClaims } from './claims.js'
 export {
+  canonicalize,
   canonicalJson,
+  decodeUtf8Hex,
   decodeHexUtf8,
   decodeUtf8,
   encodeCanonicalJson,
   encodeHexUtf8,
   encodeUtf8,
+  encodeUtf8Hex,
   parseCanonicalJson,
   parseJson,
+  parseJsonStrict,
   sha256Hex,
   utf8ByteLength,
   type JsonObject,
   type JsonPrimitive,
   type JsonValue,
 } from './json.js'
-export { parseNetworkProfile, rippleTimeToIso, type NetworkProfile } from './network.js'
 export {
+  parseNetworkProfile,
+  rippleTimeToIso,
+  validateNetworkProfile,
+  type NetworkProfile,
+} from './network.js'
+export {
+  computePayloadSha256Hex,
   createHttpsPayloadUri,
+  createIpfsRawPayloadUri,
   createIpfsPayloadUri,
+  inspectPayloadUri,
   parsePayloadUri,
+  payloadDigest,
   verifyPayloadIntegrity,
   type HttpsPayloadUri,
   type IpfsPayloadUri,
@@ -41,11 +55,19 @@ export {
   type CredentialLifecycleInput,
   type CredentialLifecycleState,
 } from './lifecycle.js'
+export {
+  iso8601ToRippleTime,
+  RIPPLE_EPOCH_UNIX_SECONDS,
+  rippleTimeToIso8601,
+  rippleTimeToUnixSeconds,
+  unixSecondsToRippleTime,
+} from './ripple-time.js'
 export { resolveSchema, type SchemaResolutionContext } from './schema-resolution.js'
 export {
   encodeSchema,
   parseSchema,
   parseSchemaBytes,
+  validateSchema,
   type ArrayFieldDescriptor,
   type FieldDescriptor,
   type ObjectFieldDescriptor,
diff --git a/apps/indexer/src/lib/xcs/json.ts b/apps/indexer/src/lib/xcs/json.ts
index c8133d3..53beded 100644
--- a/apps/indexer/src/lib/xcs/json.ts
+++ b/apps/indexer/src/lib/xcs/json.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/json.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/json.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
 import canonicalizeRfc8785 from 'canonicalize'
@@ -22,12 +22,12 @@ function assertWellFormed(value: string, path: string): void {
     const codeUnit = value.charCodeAt(index)
     if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
       const next = value.charCodeAt(index + 1)
-      if (next < 0xdc00 || next > 0xdfff) {
-        fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      if (!(next >= 0xdc00 && next <= 0xdfff)) {
+        fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
       }
       index += 1
     } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
     }
   }
 }
@@ -40,21 +40,25 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
   }
   if (typeof value === 'number') {
     if (!Number.isFinite(value)) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON numbers must be finite', path)
+      fail('JSON_NON_IJSON_NUMBER', 'JSON numbers must be finite', path)
     }
     return
   }
   if (typeof value !== 'object') {
-    fail('UNSUPPORTED_JSON_VALUE', `Unsupported ${typeof value} value`, path)
+    fail('CANONICALIZATION_UNSUPPORTED_VALUE', `Unsupported ${typeof value} value`, path)
   }
-  if (stack.has(value)) fail('UNSUPPORTED_JSON_VALUE', 'Cyclic JSON value', path)
+  if (stack.has(value)) fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Cyclic JSON value', path)
 
   stack.add(value)
   try {
     if (Array.isArray(value)) {
       for (let index = 0; index < value.length; index += 1) {
         if (!Object.hasOwn(value, index)) {
-          fail('UNSUPPORTED_JSON_VALUE', 'Sparse arrays are not JSON values', `${path}[${index}]`)
+          fail(
+            'CANONICALIZATION_UNSUPPORTED_VALUE',
+            'Sparse arrays are not JSON values',
+            `${path}[${index}]`,
+          )
         }
         assertJsonValueInternal(value[index], `${path}[${index}]`, stack)
       }
@@ -63,7 +67,7 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
 
     const prototype = Object.getPrototypeOf(value)
     if (prototype !== Object.prototype && prototype !== null) {
-      fail('UNSUPPORTED_JSON_VALUE', 'Only plain objects are JSON values', path)
+      fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Only plain objects are JSON values', path)
     }
     for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
       assertWellFormed(key, path)
@@ -82,7 +86,11 @@ export function canonicalJson(value: unknown): string {
   assertJsonValue(value)
   const serialized = canonicalizeRfc8785(value)
   if (serialized === undefined) {
-    return fail('UNSUPPORTED_JSON_VALUE', 'Value cannot be represented as canonical JSON', '$')
+    return fail(
+      'CANONICALIZATION_UNSUPPORTED_VALUE',
+      'Value cannot be represented as canonical JSON',
+      '$',
+    )
   }
   return serialized
 }
@@ -99,7 +107,7 @@ export function decodeUtf8(bytes: Uint8Array): string {
   try {
     return decoder.decode(bytes)
   } catch (cause) {
-    return fail('INVALID_JSON', 'Input is not valid UTF-8', '$', { cause: String(cause) })
+    return fail('UTF8_INVALID', 'Input is not valid UTF-8', '$', { cause: String(cause) })
   }
 }
 
@@ -124,7 +132,7 @@ export function parseJson(input: string | Uint8Array): JsonValue {
     allowEmptyContent: false,
   })
   if (!root || errors.length > 0) {
-    return fail('INVALID_JSON', 'Input is not valid JSON', '$')
+    return fail('JSON_INVALID', 'Input is not valid JSON', '$')
   }
   rejectDuplicateObjectKeys(root)
 
@@ -137,7 +145,7 @@ export function parseCanonicalJson(input: string | Uint8Array): JsonValue {
   const text = typeof input === 'string' ? input : decodeUtf8(input)
   const parsed = parseJson(text)
   if (canonicalJson(parsed) !== text) {
-    return fail('NON_CANONICAL_JSON', 'Input must use RFC 8785 canonical JSON', '$')
+    return fail('JSON_INVALID', 'Input must use RFC 8785 canonical JSON', '$')
   }
   assertJsonValue(parsed)
   return parsed
@@ -150,10 +158,10 @@ function rejectDuplicateObjectKeys(node: Node): void {
       const [keyNode, valueNode] = property.children ?? []
       const key = keyNode?.value
       if (typeof key !== 'string' || !valueNode) {
-        return fail('INVALID_JSON', 'Input contains an invalid JSON object', '$')
+        return fail('JSON_INVALID', 'Input contains an invalid JSON object', '$')
       }
       if (keys.has(key)) {
-        return fail('INVALID_JSON', `Input contains duplicate key ${key}`, '$')
+        return fail('JSON_DUPLICATE_KEY', `Input contains duplicate key ${key}`, '$')
       }
       keys.add(key)
       rejectDuplicateObjectKeys(valueNode)
@@ -167,3 +175,9 @@ export function utf8ByteLength(value: string): number {
   assertWellFormed(value, '$')
   return encoder.encode(value).length
 }
+
+/** Backward-compatible names from the normative XCS v0.1 interface. */
+export const canonicalize = canonicalJson
+export const parseJsonStrict = parseJson
+export const encodeUtf8Hex = (value: string): string => encodeHexUtf8(value).toUpperCase()
+export const decodeUtf8Hex = decodeHexUtf8
diff --git a/apps/indexer/src/lib/xcs/lifecycle.ts b/apps/indexer/src/lib/xcs/lifecycle.ts
index d0cde5e..4b52cb6 100644
--- a/apps/indexer/src/lib/xcs/lifecycle.ts
+++ b/apps/indexer/src/lib/xcs/lifecycle.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/lifecycle.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/lifecycle.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { fail } from './errors.js'
 
 export type CredentialLifecycleState = 'pending' | 'active' | 'expired' | 'deleted'
@@ -14,7 +14,7 @@ const UINT32_MAX = 0xffff_ffff
 
 function requireRippleTime(value: number): void {
   if (!Number.isInteger(value) || value < 0 || value > UINT32_MAX) {
-    return fail('INVALID_RIPPLE_TIME', 'Credential lifecycle time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Credential lifecycle time must be a uint32', '$time')
   }
 }
 
diff --git a/apps/indexer/src/lib/xcs/network.ts b/apps/indexer/src/lib/xcs/network.ts
index 876c16e..07c72f1 100644
--- a/apps/indexer/src/lib/xcs/network.ts
+++ b/apps/indexer/src/lib/xcs/network.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/network.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/network.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress, rippleTimeToISOTime as xrplRippleTimeToIso } from 'xrpl'
 
 import { fail } from './errors.js'
@@ -35,48 +35,48 @@ function isUint32(value: unknown): value is number {
 
 export function parseNetworkProfile(input: unknown): NetworkProfile {
   if (!isRecord(input)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Network profile must be an object', '$')
+    return fail('NETWORK_PROFILE_INVALID', 'Network profile must be an object', '$')
   }
   for (const key of Object.keys(input)) {
     if (!PROFILE_PROPERTIES.has(key)) {
-      return fail('INVALID_NETWORK_PROFILE', `Unknown property ${key}`, `$.${key}`)
+      return fail('NETWORK_PROFILE_INVALID', `Unknown property ${key}`, `$.${key}`)
     }
   }
   if (
     typeof input.profileId !== 'string' ||
     !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(input.profileId)
   ) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid profileId', '$.profileId')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid profileId', '$.profileId')
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_NETWORK_PROFILE', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('NETWORK_PROFILE_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (!isUint32(input.networkId)) {
-    return fail('INVALID_NETWORK_PROFILE', 'networkId must be a uint32', '$.networkId')
+    return fail('NETWORK_PROFILE_INVALID', 'networkId must be a uint32', '$.networkId')
   }
   if (
     typeof input.requiredAmendment !== 'string' ||
     !/^[0-9a-fA-F]{64}$/.test(input.requiredAmendment)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'requiredAmendment must be a 32-byte hexadecimal value',
       '$.requiredAmendment',
     )
   }
   if (typeof input.registryAddress !== 'string' || !isValidClassicAddress(input.registryAddress)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid XRPL registry address', '$.registryAddress')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid XRPL registry address', '$.registryAddress')
   }
   if (input.registrationAmountDrops !== '1') {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'registrationAmountDrops must equal "1"',
       '$.registrationAmountDrops',
     )
   }
   if (!isUint32(input.activationLedgerIndex) || input.activationLedgerIndex === 0) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerIndex must be a positive uint32',
       '$.activationLedgerIndex',
     )
@@ -86,7 +86,7 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
     !/^[0-9a-fA-F]{64}$/.test(input.activationLedgerHash)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerHash must be a 32-byte hexadecimal value',
       '$.activationLedgerHash',
     )
@@ -104,9 +104,12 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateNetworkProfile = parseNetworkProfile
+
 export function rippleTimeToIso(rippleTime: number): string {
   if (!isUint32(rippleTime)) {
-    return fail('INVALID_RIPPLE_TIME', 'Ripple time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
   }
   return xrplRippleTimeToIso(rippleTime)
 }
diff --git a/apps/indexer/src/lib/xcs/payload-uri.ts b/apps/indexer/src/lib/xcs/payload-uri.ts
index a9e4a5c..7ce8f98 100644
--- a/apps/indexer/src/lib/xcs/payload-uri.ts
+++ b/apps/indexer/src/lib/xcs/payload-uri.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/payload-uri.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/payload-uri.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex } from '@noble/hashes/utils.js'
 import { CID } from 'multiformats/cid'
@@ -30,7 +30,8 @@ export type PayloadUri = IpfsPayloadUri | HttpsPayloadUri
 
 export interface PayloadIntegrityResult {
   valid: boolean
-  expectedDigestHex: string
+  status: 'valid' | 'tampered' | 'invalid_uri'
+  expectedDigestHex?: string
   actualDigestHex: string
 }
 
@@ -48,10 +49,10 @@ export function payloadBytes(content: string | Uint8Array): Uint8Array {
   if (typeof content === 'string') utf8ByteLength(content)
   const bytes = typeof content === 'string' ? new TextEncoder().encode(content) : content
   if (!(bytes instanceof Uint8Array)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload must be UTF-8 text or bytes', '$payload')
+    return fail('PAYLOAD_INVALID', 'Payload must be UTF-8 text or bytes', '$payload')
   }
   if (bytes.length > MAX_PAYLOAD_BYTES) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload exceeds 1 MiB', '$payload', {
+    return fail('PAYLOAD_INVALID', 'Payload exceeds 1 MiB', '$payload', {
       size: bytes.length,
     })
   }
@@ -185,7 +186,7 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
       cid.multihash.size !== 32 ||
       cid.toString(base32.encoder) !== cidText
     ) {
-      return fail('INVALID_PAYLOAD_URI', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
+      return fail('PAYLOAD_URI_INVALID', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
     }
     return {
       kind: 'ipfs',
@@ -195,30 +196,30 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
     }
   } catch (cause) {
     if (cause instanceof XcsError) throw cause
-    return fail('INVALID_PAYLOAD_URI', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
   }
 }
 
 export function parsePayloadUri(uri: string): PayloadUri {
   if (typeof uri !== 'string') {
-    return fail('INVALID_PAYLOAD_URI', 'URI must be a string', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must be a string', '$uri')
   }
   const length = utf8ByteLength(uri)
   if (length < 1 || length > 256) {
-    return fail('INVALID_PAYLOAD_URI', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
   }
   const ipfs = parseIpfsUri(uri)
   if (ipfs !== undefined) return ipfs
 
   if (!uri.startsWith(HTTPS_PREFIX) || INVALID_RAW_HTTPS_CHARACTER.test(uri)) {
-    return fail('INVALID_PAYLOAD_URI', 'Expected a canonical HTTPS or IPFS URI', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Expected a canonical HTTPS or IPFS URI', '$uri')
   }
   const remainder = uri.slice(HTTPS_PREFIX.length)
   const authorityEnd = remainder.search(/[/?#]/)
   const authority = authorityEnd === -1 ? remainder : remainder.slice(0, authorityEnd)
   if (authority === '' || authority.includes('@')) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS authority cannot be empty or contain userinfo',
       '$uri',
     )
@@ -226,14 +227,14 @@ export function parsePayloadUri(uri: string): PayloadUri {
 
   const normalizedUri = normalizeHttpsAuthority(uri)
   if (normalizedUri === undefined) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS authority', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS authority', '$uri')
   }
   const fetchUrl = buildFetchUrl(normalizedUri)
   let parsed: URL
   try {
     parsed = new URL(normalizedUri)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
   }
   if (
     fetchUrl === undefined ||
@@ -243,7 +244,7 @@ export function parsePayloadUri(uri: string): PayloadUri {
     !/^#xcs-sha256=[0-9a-f]{64}$/.test(parsed.hash)
   ) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS URI must end in #xcs-sha256=<lowercase-sha256>',
       '$uri',
     )
@@ -261,12 +262,12 @@ export function createHttpsPayloadUri(baseUrl: string, content: string | Uint8Ar
   try {
     url = new URL(baseUrl)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS base URL', '$url', {
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS base URL', '$url', {
       cause: String(cause),
     })
   }
   if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.hash !== '') {
-    return fail('INVALID_PAYLOAD_URI', 'Base URL must be fragment-free HTTPS', '$url')
+    return fail('PAYLOAD_URI_INVALID', 'Base URL must be fragment-free HTTPS', '$url')
   }
   url.hash = `xcs-sha256=${payloadDigest(content)}`
   const uri = url.toString()
@@ -283,11 +284,25 @@ export function verifyPayloadIntegrity(
   content: string | Uint8Array,
   uri: string,
 ): PayloadIntegrityResult {
-  const expectedDigestHex = parsePayloadUri(uri).digestHex
   const actualDigestHex = payloadDigest(content)
+  let expectedDigestHex: string
+  try {
+    expectedDigestHex = parsePayloadUri(uri).digestHex
+  } catch (error) {
+    if (error instanceof XcsError && error.code === 'PAYLOAD_URI_INVALID') {
+      return { valid: false, status: 'invalid_uri', actualDigestHex }
+    }
+    throw error
+  }
+  const valid = expectedDigestHex === actualDigestHex
   return {
-    valid: expectedDigestHex === actualDigestHex,
+    valid,
+    status: valid ? 'valid' : 'tampered',
     expectedDigestHex,
     actualDigestHex,
   }
 }
+
+export const computePayloadSha256Hex = payloadDigest
+export const createIpfsRawPayloadUri = createIpfsPayloadUri
+export const inspectPayloadUri = parsePayloadUri
diff --git a/apps/indexer/src/lib/xcs/ripple-time.ts b/apps/indexer/src/lib/xcs/ripple-time.ts
new file mode 100644
index 0000000..9ab4448
--- /dev/null
+++ b/apps/indexer/src/lib/xcs/ripple-time.ts
@@ -0,0 +1,50 @@
+// Copied from packages/core/src/ripple-time.ts at 254c6a0; keep in sync by hand (see CONTRIBUTING.md).
+import { fail } from './errors.js'
+
+export const RIPPLE_EPOCH_UNIX_SECONDS = 946_684_800
+const UINT32_MAX = 0xffff_ffff
+
+export function unixSecondsToRippleTime(unixSeconds: number): number {
+  if (!Number.isSafeInteger(unixSeconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time must be an integer number of seconds', '$time')
+  }
+  const rippleTime = unixSeconds - RIPPLE_EPOCH_UNIX_SECONDS
+  if (rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time is outside the XRPL uint32 time range', '$time')
+  }
+  return rippleTime
+}
+
+export function rippleTimeToUnixSeconds(rippleTime: number): number {
+  if (!Number.isInteger(rippleTime) || rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
+  }
+  return rippleTime + RIPPLE_EPOCH_UNIX_SECONDS
+}
+
+export function iso8601ToRippleTime(value: string): number {
+  if (
+    typeof value !== 'string' ||
+    !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.000)?Z$/.test(value)
+  ) {
+    return fail(
+      'RIPPLE_TIME_INVALID',
+      'Expiration must be a UTC ISO-8601 timestamp with whole-second precision',
+      '$time',
+    )
+  }
+  const milliseconds = Date.parse(value)
+  if (!Number.isFinite(milliseconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a real calendar date', '$time')
+  }
+  const normalized = new Date(milliseconds).toISOString()
+  const expected = value.includes('.') ? value : value.replace('Z', '.000Z')
+  if (normalized !== expected) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a canonical calendar date', '$time')
+  }
+  return unixSecondsToRippleTime(milliseconds / 1000)
+}
+
+export function rippleTimeToIso8601(rippleTime: number): string {
+  return new Date(rippleTimeToUnixSeconds(rippleTime) * 1000).toISOString()
+}
diff --git a/apps/indexer/src/lib/xcs/schema-resolution.ts b/apps/indexer/src/lib/xcs/schema-resolution.ts
index c1b2c26..d0e612d 100644
--- a/apps/indexer/src/lib/xcs/schema-resolution.ts
+++ b/apps/indexer/src/lib/xcs/schema-resolution.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema-resolution.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema-resolution.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress } from 'xrpl'
 
 import { fail } from './errors.js'
@@ -43,20 +43,23 @@ function requireReference(
 ): RegisteredSchema {
   const referenced = context.getSchema(uid)
   if (referenced === undefined || referenced.uid !== uid) {
-    return fail('INVALID_SCHEMA_REFERENCE', `${relation} schema was not found`, `$.${relation}`, {
-      uid,
-    })
+    return fail(
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_FOUND' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
+      `${relation} schema was not found`,
+      `$.${relation}`,
+      { uid },
+    )
   }
   if (referenced.networkId !== context.networkId) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NETWORK_MISMATCH' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
       `${relation} schema belongs to another network`,
       `$.${relation}`,
     )
   }
   if (!isEarlier(referenced, context)) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_PRIOR' : 'SCHEMA_SUPERSEDES_NOT_PRIOR',
       `${relation} schema must be registered earlier`,
       `$.${relation}`,
     )
@@ -73,12 +76,11 @@ function resolve(
   let lineage: string[] = []
 
   if (schema.extends !== undefined) {
-    if (visiting.size >= MAX_SCHEMA_DEPTH - 1 || visiting.has(schema.extends)) {
-      return fail(
-        'INVALID_SCHEMA_REFERENCE',
-        'Schema inheritance is cyclic or too deep',
-        '$.extends',
-      )
+    if (visiting.has(schema.extends)) {
+      return fail('SCHEMA_INHERITANCE_CYCLE', 'Schema inheritance is cyclic', '$.extends')
+    }
+    if (visiting.size >= MAX_SCHEMA_DEPTH - 1) {
+      return fail('SCHEMA_DEPTH_EXCEEDED', 'Schema inheritance is too deep', '$.extends')
     }
     const parent = requireReference(schema.extends, 'extends', context)
     visiting.add(schema.extends)
@@ -101,7 +103,7 @@ function resolve(
   for (const [name, descriptor] of Object.entries(schema.fields)) {
     if (Object.hasOwn(fields, name)) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_OVERRIDE_FORBIDDEN',
         `Inherited field ${name} cannot be redefined`,
         `$.fields.${name}`,
       )
@@ -110,14 +112,18 @@ function resolve(
   }
 
   if (countSchemaFields(fields) > MAX_SCHEMA_FIELDS) {
-    return fail('INVALID_SCHEMA', `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`, '$.fields')
+    return fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`,
+      '$.fields',
+    )
   }
 
   if (schema.supersedes !== undefined) {
     const previous = requireReference(schema.supersedes, 'supersedes', context)
     if (previous.publisher !== context.publisher) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
         'Only the original publisher may supersede a schema',
         '$.supersedes',
       )
@@ -138,7 +144,7 @@ export function resolveSchema(
     !isValidClassicAddress(context.publisher) ||
     typeof context.getSchema !== 'function'
   ) {
-    return fail('INVALID_SCHEMA_REFERENCE', 'Invalid schema resolution context', '$context')
+    return fail('SCHEMA_INVALID', 'Invalid schema resolution context', '$context')
   }
   return resolve(parseSchema(input), context, new Set())
 }
diff --git a/apps/indexer/src/lib/xcs/schema-uid.ts b/apps/indexer/src/lib/xcs/schema-uid.ts
index 2904155..886bbf3 100644
--- a/apps/indexer/src/lib/xcs/schema-uid.ts
+++ b/apps/indexer/src/lib/xcs/schema-uid.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema-uid.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema-uid.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex } from '@noble/hashes/utils.js'
 import { isValidClassicAddress } from 'xrpl'
@@ -26,17 +26,17 @@ export function computeSchemaUid(input: SchemaUidInput): string {
     !isUint32(input.ledgerIndex) ||
     !isUint32(input.transactionIndex)
   ) {
-    return fail('INVALID_UID_INPUT', 'Network and ledger coordinates must be uint32 values', '$')
+    return fail('UID_INPUT_INVALID', 'Network and ledger coordinates must be uint32 values', '$')
   }
   if (!/^[0-9a-fA-F]{64}$/.test(input.ledgerHash)) {
     return fail(
-      'INVALID_UID_INPUT',
+      'UID_INPUT_INVALID',
       'ledgerHash must be a 32-byte hexadecimal hash',
       '$.ledgerHash',
     )
   }
   if (!isValidClassicAddress(input.publisher)) {
-    return fail('INVALID_UID_INPUT', 'publisher must be an XRPL classic address', '$.publisher')
+    return fail('UID_INPUT_INVALID', 'publisher must be an XRPL classic address', '$.publisher')
   }
 
   const preimage = {
diff --git a/apps/indexer/src/lib/xcs/schema.ts b/apps/indexer/src/lib/xcs/schema.ts
index de394e4..87b38a2 100644
--- a/apps/indexer/src/lib/xcs/schema.ts
+++ b/apps/indexer/src/lib/xcs/schema.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { fail } from './errors.js'
 import { encodeCanonicalJson, parseCanonicalJson, utf8ByteLength } from './json.js'
 
@@ -76,17 +76,17 @@ function assertOnlyProperties(
   path: string,
 ): void {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) fail('INVALID_SCHEMA', `Unknown property ${key}`, `${path}.${key}`)
+    if (!allowed.has(key)) fail('SCHEMA_INVALID', `Unknown property ${key}`, `${path}.${key}`)
   }
 }
 
 function parseText(value: unknown, path: string, maxBytes: number): string {
   if (typeof value !== 'string' || CONTROL_CHARACTER.test(value)) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   const length = utf8ByteLength(value)
   if (length < 1 || length > maxBytes) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   return value
 }
@@ -98,10 +98,10 @@ function parseDescriptor(
   count: { value: number },
 ): FieldDescriptor {
   if (!isRecord(input) || typeof input.type !== 'string') {
-    return fail('INVALID_SCHEMA', 'Field descriptor must contain a type', path)
+    return fail('SCHEMA_INVALID', 'Field descriptor must contain a type', path)
   }
   if (input.optional !== undefined && typeof input.optional !== 'boolean') {
-    return fail('INVALID_SCHEMA', 'optional must be a boolean', `${path}.optional`)
+    return fail('SCHEMA_INVALID', 'optional must be a boolean', `${path}.optional`)
   }
   const optional = input.optional === true ? { optional: true as const } : {}
 
@@ -112,7 +112,7 @@ function parseDescriptor(
   if (input.type === 'array') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'items']), path)
     if (depth >= MAX_SCHEMA_DEPTH || input.items === undefined) {
-      return fail('INVALID_SCHEMA', 'Array descriptor is missing items or exceeds depth', path)
+      return fail('SCHEMA_INVALID', 'Array descriptor is missing items or exceeds depth', path)
     }
     count.value += 1
     assertFieldLimit(count.value, `${path}.items`)
@@ -125,7 +125,7 @@ function parseDescriptor(
   if (input.type === 'object') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'fields']), path)
     if (depth >= MAX_SCHEMA_DEPTH) {
-      return fail('INVALID_SCHEMA', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
+      return fail('SCHEMA_INVALID', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
     }
     return {
       type: 'object',
@@ -133,12 +133,16 @@ function parseDescriptor(
       ...optional,
     }
   }
-  return fail('INVALID_SCHEMA', `Unsupported field type ${input.type}`, `${path}.type`)
+  return fail('SCHEMA_INVALID', `Unsupported field type ${input.type}`, `${path}.type`)
 }
 
 function assertFieldLimit(count: number, path: string): void {
   if (count > MAX_SCHEMA_FIELDS) {
-    fail('INVALID_SCHEMA', `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`, path)
+    fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`,
+      path,
+    )
   }
 }
 
@@ -149,11 +153,11 @@ function parseFields(
   count: { value: number },
 ): SchemaFields {
   if (!isRecord(input) || Object.keys(input).length === 0) {
-    return fail('INVALID_SCHEMA', 'fields must be a non-empty object', path)
+    return fail('SCHEMA_INVALID', 'fields must be a non-empty object', path)
   }
   const fields = Object.create(null) as SchemaFields
   for (const [name, descriptor] of Object.entries(input)) {
-    if (!FIELD_NAME.test(name)) fail('INVALID_SCHEMA', 'Invalid field name', `${path}.${name}`)
+    if (!FIELD_NAME.test(name)) fail('SCHEMA_INVALID', 'Invalid field name', `${path}.${name}`)
     count.value += 1
     assertFieldLimit(count.value, `${path}.${name}`)
     fields[name] = parseDescriptor(descriptor, `${path}.${name}`, depth, count)
@@ -164,22 +168,22 @@ function parseFields(
 function parseRelation(value: unknown, path: string): string | undefined {
   if (value === undefined) return undefined
   if (typeof value !== 'string' || !SCHEMA_UID.test(value)) {
-    return fail('INVALID_SCHEMA', 'Expected a lowercase 32-byte schema UID', path)
+    return fail('SCHEMA_INVALID', 'Expected a lowercase 32-byte schema UID', path)
   }
   return value
 }
 
 export function parseSchema(input: unknown): SchemaDefinition {
-  if (!isRecord(input)) return fail('INVALID_SCHEMA', 'Schema must be an object', '$')
+  if (!isRecord(input)) return fail('SCHEMA_INVALID', 'Schema must be an object', '$')
   assertOnlyProperties(input, SCHEMA_PROPERTIES, '$')
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_SCHEMA', 'Unsupported XCS schema version', '$.xcsVersion')
+    return fail('SCHEMA_INVALID', 'Unsupported XCS schema version', '$.xcsVersion')
   }
 
   const parent = parseRelation(input.extends, '$.extends')
   const predecessor = parseRelation(input.supersedes, '$.supersedes')
   if (parent !== undefined && parent === predecessor) {
-    return fail('INVALID_SCHEMA', 'extends and supersedes must reference different schemas', '$')
+    return fail('SCHEMA_INVALID', 'extends and supersedes must reference different schemas', '$')
   }
 
   return {
@@ -192,6 +196,9 @@ export function parseSchema(input: unknown): SchemaDefinition {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateSchema = parseSchema
+
 export function parseSchemaBytes(bytes: Uint8Array): SchemaDefinition {
   return parseSchema(parseCanonicalJson(bytes))
 }
diff --git a/apps/indexer/src/lib/xcs/tr46.d.ts b/apps/indexer/src/lib/xcs/tr46.d.ts
index 7ce46a7..1ac8b70 100644
--- a/apps/indexer/src/lib/xcs/tr46.d.ts
+++ b/apps/indexer/src/lib/xcs/tr46.d.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/tr46.d.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/tr46.d.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 declare module 'tr46' {
   interface ToASCIIOptions {
     checkBidi?: boolean
diff --git a/apps/indexer/src/main.ts b/apps/indexer/src/main.ts
index cac7964..c8f930f 100644
--- a/apps/indexer/src/main.ts
+++ b/apps/indexer/src/main.ts
@@ -1,4 +1,4 @@
-import { createDatabaseClient } from './lib/db/client.js'
+import { createDatabaseClient } from './lib/db/index.js'
 
 import { loadIndexerConfig } from './config.js'
 import { PostgresIndexerRepository } from './repository.js'
diff --git a/apps/indexer/src/maintenance.ts b/apps/indexer/src/maintenance.ts
index 7d4de12..58af69d 100644
--- a/apps/indexer/src/maintenance.ts
+++ b/apps/indexer/src/maintenance.ts
@@ -2,13 +2,14 @@ import { readFile } from 'node:fs/promises'
 
 import { parseNetworkProfile, type NetworkProfile } from './lib/xcs/index.js'
 import {
+  createDatabaseClient,
   credentialEvents,
   credentialGenerations,
   ledgerCheckpoints,
   schemaEvents,
   schemas,
-} from '#db/schema'
-import { type XcsDatabase, createDatabaseClient } from './lib/db/client.js'
+  type XcsDatabase,
+} from './lib/db/index.js'
 import { count, eq } from 'drizzle-orm'
 
 import {
diff --git a/apps/indexer/src/projection-digest.ts b/apps/indexer/src/projection-digest.ts
index abadba2..2243c51 100644
--- a/apps/indexer/src/projection-digest.ts
+++ b/apps/indexer/src/projection-digest.ts
@@ -6,8 +6,8 @@ import {
   networkProfiles,
   schemaEvents,
   schemas,
-} from '#db/schema'
-import { type XcsDatabase } from './lib/db/client.js'
+  type XcsDatabase,
+} from './lib/db/index.js'
 import { asc, eq } from 'drizzle-orm'
 
 import { canonicalJson, encodeUtf8, sha256Hex } from './serialization.js'
diff --git a/apps/indexer/src/repository.ts b/apps/indexer/src/repository.ts
index 8af43d7..ce36302 100644
--- a/apps/indexer/src/repository.ts
+++ b/apps/indexer/src/repository.ts
@@ -1,23 +1,21 @@
 import {
+  acquireIndexerLease,
   credentialEvents,
   credentialGenerations,
+  haltIndexer as haltDatabaseIndexer,
   ledgerCheckpoints,
+  lockActiveIndexerLease,
   networkProfiles,
+  releaseIndexerLease,
+  renewIndexerLease,
+  runSerializableTransaction,
   schemaEvents,
   schemas,
-} from '#db/schema'
-import { type XcsDatabase } from './lib/db/client.js'
-import { runSerializableTransaction } from './lib/db/transactions.js'
-import {
+  updateIndexerStatus as updateDatabaseIndexerStatus,
   type AcquiredIndexerLease,
   type IndexerLeaseToken,
-  acquireIndexerLease,
-  haltIndexer as haltDatabaseIndexer,
-  lockActiveIndexerLease,
-  releaseIndexerLease,
-  renewIndexerLease,
-  updateIndexerStatus as updateDatabaseIndexerStatus,
-} from './lib/db/indexer-fencing.js'
+  type XcsDatabase,
+} from './lib/db/index.js'
 import type { JsonValue } from './lib/xcs/index.js'
 import { and, asc, desc, eq, isNull } from 'drizzle-orm'
 
diff --git a/apps/indexer/src/types.ts b/apps/indexer/src/types.ts
index b0f468c..f222a16 100644
--- a/apps/indexer/src/types.ts
+++ b/apps/indexer/src/types.ts
@@ -5,7 +5,7 @@ import type {
   ResolvedSchema,
   SchemaDefinition,
 } from './lib/xcs/index.js'
-import type { AcquiredIndexerLease, IndexerLeaseToken } from './lib/db/indexer-fencing.js'
+import type { AcquiredIndexerLease, IndexerLeaseToken } from './lib/db/index.js'
 
 export type { NetworkProfile, RegisteredSchema, ResolvedSchema, SchemaDefinition }
 export type { AcquiredIndexerLease, IndexerLeaseToken }
diff --git a/apps/indexer/src/xrpl-source.ts b/apps/indexer/src/xrpl-source.ts
index 6f35527..7e48d88 100644
--- a/apps/indexer/src/xrpl-source.ts
+++ b/apps/indexer/src/xrpl-source.ts
@@ -1,4 +1,6 @@
-import { Client } from 'xrpl'
+import { createHash } from 'node:crypto'
+import { decodeLedgerData } from 'ripple-binary-codec'
+import { Client, decode, hashes } from 'xrpl'
 
 import {
   assertRegistryPolicy,
@@ -70,8 +72,78 @@ function nonEmptyString(value: unknown, label: string): string {
   return value
 }
 
+function binaryHex(value: unknown, label: string): string {
+  if (typeof value !== 'string' || !/^(?:[0-9a-fA-F]{2})+$/u.test(value)) {
+    return sourceFailure('SOURCE_RESPONSE_INVALID', `${label} must be binary hex`)
+  }
+  return value.toUpperCase()
+}
+
+function decodedTransaction(envelope: Record<string, unknown>): Record<string, unknown> {
+  const blob = binaryHex(envelope.tx_blob, 'transaction blob')
+  const meta = binaryHex(
+    Object.hasOwn(envelope, 'meta_blob') ? envelope.meta_blob : envelope.meta,
+    'transaction metadata blob',
+  )
+  if (
+    Object.hasOwn(envelope, 'meta_blob') &&
+    Object.hasOwn(envelope, 'meta') &&
+    binaryHex(envelope.meta, 'transaction metadata blob') !== meta
+  ) {
+    return sourceFailure('SOURCE_RESPONSE_INVALID', 'Binary metadata representations disagree')
+  }
+  try {
+    const transaction = decode(blob)
+    const metadata = decode(meta)
+    // xrpl's signed-transaction helper deliberately rejects protocol pseudo-transactions.
+    // Their ID uses the same TXN\0 domain, although no account signs these ledger operations.
+    const pseudo = ['EnableAmendment', 'SetFee', 'UNLModify'].includes(
+      String(transaction.TransactionType),
+    )
+    const transactionHash = pseudo
+      ? createHash('sha512')
+          .update(Buffer.from('54584E00' + blob, 'hex'))
+          .digest('hex')
+          .slice(0, 64)
+      : hashes.hashSignedTx(blob)
+    if (
+      envelope.hash !== undefined &&
+      hash(envelope.hash, 'transaction hash') !== transactionHash.toLowerCase()
+    ) {
+      return sourceFailure('SOURCE_RESPONSE_INVALID', 'Binary transaction hash values disagree')
+    }
+    // Always decode the serialized fields: API v2 JSON can rename Amount to DeliverMax.
+    return { hash: transactionHash, tx_json: transaction, meta: metadata }
+  } catch (error) {
+    if (error instanceof XrplSourceError) throw error
+    return sourceFailure('SOURCE_RESPONSE_INVALID', 'Cannot decode binary transaction or metadata')
+  }
+}
+
+function decodedLedgerHeader(envelope: Record<string, unknown>): Record<string, unknown> {
+  const blob = binaryHex(envelope.ledger_data, 'ledger header blob')
+  // The canonical header is 118 bytes, excluding the LWR\0 hash prefix.
+  if (blob.length !== 236)
+    return sourceFailure('SOURCE_RESPONSE_INVALID', 'Binary ledger header length is invalid')
+  try {
+    const header = asRecord(decodeLedgerData(blob), 'decoded ledger header')
+    return {
+      ...header,
+      ledger_hash: hashes.hashLedgerHeader(
+        header as unknown as Parameters<typeof hashes.hashLedgerHeader>[0],
+      ),
+      closed: envelope.closed,
+      transactions: envelope.transactions,
+    }
+  } catch (error) {
+    if (error instanceof XrplSourceError) throw error
+    return sourceFailure('SOURCE_RESPONSE_INVALID', 'Cannot decode binary ledger header')
+  }
+}
+
 function normalizeTransaction(value: unknown): LedgerTransaction {
-  const envelope = asRecord(value, 'expanded ledger transaction')
+  const raw = asRecord(value, 'expanded ledger transaction')
+  const envelope = Object.hasOwn(raw, 'tx_blob') ? decodedTransaction(raw) : raw
   const transaction =
     typeof envelope.tx_json === 'object' && envelope.tx_json !== null
       ? asRecord(envelope.tx_json, 'tx_json')
@@ -97,10 +169,18 @@ function normalizeTransaction(value: unknown): LedgerTransaction {
   delete cleanTransaction.metaData
   delete cleanTransaction.hash
 
+  // Nodes add these API conveniences at request time; they are not hashed ledger metadata.
+  const cleanMetadata = { ...metadata }
+  delete cleanMetadata.nftoken_id
+  delete cleanMetadata.nftoken_ids
+  delete cleanMetadata.offer_id
+  delete cleanMetadata.mpt_issuance_id
+  delete cleanMetadata.delivered_amount
+
   return {
     hash: transactionHash,
     transaction: cleanTransaction,
-    metadata: { ...metadata },
+    metadata: cleanMetadata,
     transactionIndex,
   }
 }
@@ -110,7 +190,10 @@ export function normalizeLedgerResponse(value: unknown): ValidatedLedger {
   if (result.validated !== true) {
     return sourceFailure('SOURCE_RESPONSE_INVALID', 'XRPL server returned a non-validated ledger')
   }
-  const ledger = asRecord(result.ledger, 'ledger')
+  const rawLedger = asRecord(result.ledger, 'ledger')
+  const ledger = Object.hasOwn(rawLedger, 'ledger_data')
+    ? decodedLedgerHeader(rawLedger)
+    : rawLedger
   if (ledger.closed !== true) {
     return sourceFailure('SOURCE_RESPONSE_INVALID', 'Validated ledger must be marked closed')
   }
@@ -298,7 +381,9 @@ export class XrplLedgerSource implements LedgerSource {
       ledger_index: ledgerIndex,
       transactions: true,
       expand: true,
-      binary: false,
+      // Large expanded JSON responses can exceed provider WebSocket limits. Binary retains
+      // the complete ledger and canonical fields while reducing transport size; no partial retry.
+      binary: true,
     })
     const ledger = normalizeLedgerResponse(result)
     if (ledger.ledgerIndex !== ledgerIndex) {
diff --git a/apps/indexer/test/db/admin.integration.test.ts b/apps/indexer/test/db/admin.integration.test.ts
new file mode 100644
index 0000000..d9c3c49
--- /dev/null
+++ b/apps/indexer/test/db/admin.integration.test.ts
@@ -0,0 +1,185 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { createDatabaseClient, type DatabaseClient } from '../../src/lib/db/client.js'
+import { bootstrapFirstAdmin } from '../../src/lib/db/app/bootstrap-admin.js'
+import { provisionRuntimeDatabasePrivileges } from '../../src/lib/db/bootstrap.js'
+import { migrateDatabase } from '../../src/lib/db/migrations.js'
+import { createManagedRuntimeDatabaseUsers } from '../helpers/managedRuntimeUsers.js'
+
+const adminUrl = process.env.XCS_TEST_DATABASE_URL?.trim() || undefined
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !adminUrl)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+let root: DatabaseClient, database: DatabaseClient, admin: DatabaseClient, notifier: DatabaseClient
+let databaseName: string,
+  userId: string,
+  secondUserId: string,
+  organizationId: string,
+  decisionId: string
+const passwords = {
+  clusterScope: 'dedicated' as const,
+  indexerPassword: randomBytes(32).toString('base64url'),
+  apiPassword: randomBytes(32).toString('base64url'),
+  payloadWriterPassword: randomBytes(32).toString('base64url'),
+  monitorPassword: randomBytes(32).toString('base64url'),
+  adminApplicationPassword: randomBytes(32).toString('base64url'),
+  notifierPassword: randomBytes(32).toString('base64url'),
+}
+const identity = {
+  issuer: 'https://identity.example.invalid',
+  subject: 'initial-admin',
+  operator: 'synthetic-test-operator',
+}
+
+describe.skipIf(!adminUrl)('admin audit, operator bootstrap and restricted database roles', () => {
+  beforeAll(async () => {
+    root = createDatabaseClient(adminUrl!, { onNotice: () => undefined })
+    databaseName = `xcs_admin_test_${randomUUID().replaceAll('-', '')}`
+    await root.sql`CREATE DATABASE ${root.sql(databaseName)} TEMPLATE template0`
+    const url = new URL(adminUrl!)
+    url.pathname = `/${databaseName}`
+    database = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+    await migrateDatabase(database)
+    await migrateDatabase(database)
+    const managedPasswords = await createManagedRuntimeDatabaseUsers(database, passwords)
+    await provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' })
+    url.username = 'xcs_admin_app'
+    url.password = managedPasswords.adminApplicationPassword
+    admin = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+    url.username = 'xcs_notifier'
+    url.password = managedPasswords.notifierPassword
+    notifier = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+    const users = await database.sql<
+      { id: string }[]
+    >`INSERT INTO app_users (identity_issuer, identity_subject) VALUES (${identity.issuer}, ${identity.subject}), (${identity.issuer}, 'another') RETURNING id`
+    userId = users[0]!.id
+    secondUserId = users[1]!.id
+    const [org] = await database.sql<
+      { id: string }[]
+    >`INSERT INTO app_organizations (responsible_user_id, name) VALUES (${secondUserId}, 'Synthetic organization') RETURNING id`
+    organizationId = org!.id
+    await database.sql`INSERT INTO app_organization_applications (organization_id, role) VALUES (${organizationId}, 'verifier')`
+  }, 30_000)
+  afterAll(async () => {
+    await admin?.close()
+    await notifier?.close()
+    await database?.close()
+    if (root && /^xcs_admin_test_[a-f0-9]{32}$/.test(databaseName))
+      await root.sql`DROP DATABASE IF EXISTS ${root.sql(databaseName)} WITH (FORCE)`
+    await root?.close()
+  })
+
+  it('serializes initial admin bootstrap, grants once and retains exactly one audit record', async () => {
+    const outcomes = await Promise.all([
+      bootstrapFirstAdmin(database, identity),
+      bootstrapFirstAdmin(database, identity),
+    ])
+    expect(outcomes.map((x) => x.created).sort()).toEqual([false, true])
+    expect(await database.sql`SELECT user_id, operator FROM app_admin_bootstrap_audit`).toEqual([
+      { user_id: userId, operator: identity.operator },
+    ])
+    await expect(
+      bootstrapFirstAdmin(database, { ...identity, subject: 'another' }),
+    ).rejects.toThrow('ADMIN_BOOTSTRAP_ALREADY_INITIALIZED')
+    await expect(
+      bootstrapFirstAdmin(database, { ...identity, issuer: 'https://another.example.invalid' }),
+    ).rejects.toThrow('ADMIN_BOOTSTRAP_ACCOUNT_NOT_FOUND')
+    await database.sql`UPDATE app_user_roles SET revoked_at = now() WHERE user_id = ${userId} AND role = 'admin'`
+    await expect(bootstrapFirstAdmin(database, identity)).rejects.toThrow('ADMIN_BOOTSTRAP_REVOKED')
+    await database.sql`UPDATE app_user_roles SET revoked_at = NULL WHERE user_id = ${userId} AND role = 'admin'`
+  })
+
+  it('rolls back the approval and audit when its notification insert fails', async () => {
+    await expect(
+      admin.sql.begin(async (sql) => {
+        await sql`UPDATE app_organization_applications SET status = 'approved', revision = 1, reviewed_by = ${userId}, reviewed_at = now() WHERE organization_id = ${organizationId} AND role = 'verifier'`
+        const [decision] = await sql<
+          { id: string }[]
+        >`INSERT INTO app_admin_decisions (organization_id,role,actor_id,action,before_status,after_status,revision,idempotency_key,request_hash) VALUES (${organizationId},'verifier',${userId},'approve','pending','approved',1,${randomUUID()},${'a'.repeat(64)}) RETURNING id`
+        await sql`INSERT INTO app_admin_notifications (decision_id,recipient_user_id,status) VALUES (${decision!.id},${secondUserId},'invalid')`
+      }),
+    ).rejects.toMatchObject({ code: '23514' })
+    expect(
+      await admin.sql`SELECT status, revision FROM app_organization_applications WHERE organization_id = ${organizationId}`,
+    ).toEqual([{ status: 'pending', revision: 0 }])
+    expect(await admin.sql`SELECT id FROM app_admin_decisions`).toEqual([])
+  })
+
+  it('enforces immutable audit, notification uniqueness and valid state metadata', async () => {
+    const key = randomUUID()
+    const [decision] = await admin.sql<
+      { id: string }[]
+    >`INSERT INTO app_admin_decisions (organization_id,role,actor_id,action,before_status,after_status,revision,idempotency_key,request_hash) VALUES (${organizationId},'verifier',${userId},'approve','pending','approved',1,${key},${'a'.repeat(64)}) RETURNING id`
+    decisionId = decision!.id
+    await expect(
+      admin.sql`INSERT INTO app_admin_decisions (organization_id,role,actor_id,action,before_status,after_status,revision,idempotency_key,request_hash) VALUES (${organizationId},'verifier',${userId},'approve','pending','approved',2,${key},${'a'.repeat(64)})`,
+    ).rejects.toMatchObject({ code: '23505' })
+    await expect(
+      admin.sql`INSERT INTO app_admin_decisions (organization_id,role,actor_id,action,before_status,after_status,revision,idempotency_key,request_hash) VALUES (${organizationId},'verifier',${userId},'suspend','approved','suspended',2,${randomUUID()},${'a'.repeat(64)})`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await admin.sql`INSERT INTO app_admin_notifications (decision_id,recipient_user_id,status) VALUES (${decisionId},${secondUserId},'blocked')`
+    await expect(
+      admin.sql`INSERT INTO app_admin_notifications (decision_id,recipient_user_id,status) VALUES (${decisionId},${secondUserId},'blocked')`,
+    ).rejects.toMatchObject({ code: '23505' })
+    await expect(
+      notifier.sql`UPDATE app_admin_notifications SET status = 'sending' WHERE decision_id = ${decisionId}`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await notifier.sql`UPDATE app_admin_notifications SET status = 'sending', attempts = attempts + 1, attempt_id = ${randomUUID()}, claimed_at = now(), recipient_email = 'synthetic@example.invalid' WHERE decision_id = ${decisionId}`
+    await notifier.sql`UPDATE app_admin_notifications SET status = 'uncertain', error_code = 'INTERRUPTED' WHERE decision_id = ${decisionId}`
+    expect(
+      await admin.sql`SELECT status, attempts FROM app_admin_notifications WHERE decision_id = ${decisionId}`,
+    ).toEqual([{ status: 'uncertain', attempts: 1 }])
+  })
+
+  it('denies claims, ledger data, identity subjects, admin grants and audit modifications to runtime pools', async () => {
+    for (const client of [admin, notifier]) {
+      for (const query of [
+        () => client.sql`SELECT * FROM app_credential_metadata`,
+        () => client.sql`SELECT * FROM app_presentations`,
+        () => client.sql`SELECT * FROM schemas`,
+        () => client.sql`SELECT identity_subject FROM public.app_users`,
+        () =>
+          client.sql`INSERT INTO app_user_roles (user_id,role) VALUES (${secondUserId},'admin')`,
+        () =>
+          client.sql`UPDATE app_admin_decisions SET reason = 'tampered' WHERE id = ${decisionId}`,
+        () => client.sql`DELETE FROM app_admin_decisions WHERE id = ${decisionId}`,
+        () => client.sql`DELETE FROM app_admin_notifications WHERE decision_id = ${decisionId}`,
+      ])
+        await expect(query()).rejects.toMatchObject({ code: '42501' })
+    }
+    await expect(notifier.sql`SELECT * FROM app_documents`).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      notifier.sql`UPDATE app_organization_applications SET revision = 2`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(admin.sql`UPDATE app_admin_notifications SET attempts = 0`).rejects.toMatchObject({
+      code: '42501',
+    })
+    await expect(
+      admin.sql`UPDATE app_organizations SET responsible_user_id = ${userId}`,
+    ).rejects.toMatchObject({ code: '42501' })
+  })
+
+  it('removes stale column grants without changing managed authentication', async () => {
+    const before = await database.sql<
+      { roleName: string; canLogin: boolean; passwordHash: string | null }[]
+    >`
+      SELECT rolname AS "roleName", rolcanlogin AS "canLogin", rolpassword AS "passwordHash"
+      FROM pg_authid WHERE rolname IN ('xcs_admin_app','xcs_notifier') ORDER BY rolname
+    `
+    await database.sql`GRANT SELECT (identity_subject) ON app_users TO xcs_admin_app, xcs_notifier`
+    await provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' })
+    const after = await database.sql<
+      { roleName: string; canLogin: boolean; passwordHash: string | null }[]
+    >`
+      SELECT rolname AS "roleName", rolcanlogin AS "canLogin", rolpassword AS "passwordHash"
+      FROM pg_authid WHERE rolname IN ('xcs_admin_app','xcs_notifier') ORDER BY rolname
+    `
+    expect(after).toEqual(before)
+    expect(after.every(({ canLogin }) => canLogin)).toBe(true)
+    for (const client of [admin, notifier])
+      await expect(client.sql`SELECT identity_subject FROM public.app_users`).rejects.toMatchObject(
+        {
+          code: '42501',
+        },
+      )
+  })
+})
diff --git a/apps/indexer/test/db/app-model.integration.test.ts b/apps/indexer/test/db/app-model.integration.test.ts
new file mode 100644
index 0000000..d226d23
--- /dev/null
+++ b/apps/indexer/test/db/app-model.integration.test.ts
@@ -0,0 +1,419 @@
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, mkdir, readFile, copyFile, writeFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { eq, sql } from 'drizzle-orm'
+import { migrate } from 'drizzle-orm/postgres-js/migrator'
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
+
+import { createDatabaseClient, type DatabaseClient } from '../../src/lib/db/client.js'
+import { claimInvitation } from '../../src/lib/db/app/invitations.js'
+import { createAppToken, hashAppToken } from '../../src/lib/db/app/tokens.js'
+import { filterCredentialClaims, getCredentialAccess } from '../../src/lib/db/app/visibility.js'
+import {
+  appUsers,
+  appUserRoles,
+  appOrganizations,
+  appOrganizationApplications,
+  appSchemaMetadata,
+  appInvites,
+  appCredentialMetadata,
+  appPresentations,
+  appWallets,
+  appDocuments,
+} from '#db/schema/app/index.js'
+
+const adminUrl = process.env.XCS_TEST_DATABASE_URL?.trim() || undefined
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !adminUrl)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+const migrationsFolder = fileURLToPath(new URL('../../../../db/migrations', import.meta.url))
+const ids = {
+  issuer: randomUUID(),
+  recipient: randomUUID(),
+  verifier: randomUUID(),
+  outsider: randomUUID(),
+  admin: randomUUID(),
+  issuerOrg: randomUUID(),
+  verifierOrg: randomUUID(),
+  otherOrg: randomUUID(),
+}
+const key = { profileId: 'app-testnet', generationId: 'b'.repeat(64) }
+const schemaUid = 'a'.repeat(64)
+const address = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
+const privateClaims = { course: 'XRPL basics', learner: { name: 'Synthetic learner' } }
+let administrator: DatabaseClient
+let database: DatabaseClient
+let databaseName: string
+let fixtureFolder: string | undefined
+let presentationToken: string
+
+async function invitation(overrides: Partial<typeof appInvites.$inferInsert> = {}) {
+  const token = createAppToken()
+  const [invite] = await database.db
+    .insert(appInvites)
+    .values({
+      organizationId: ids.issuerOrg,
+      profileId: key.profileId,
+      schemaUid,
+      deliveryEmail: 'invited@example.invalid',
+      createdBy: ids.issuer,
+      tokenHash: token.tokenHash,
+      expiresAt: new Date(Date.now() + 3600_000),
+      ...overrides,
+    })
+    .returning()
+  return { ...token, invite: invite! }
+}
+
+async function access(userId: string | null, token?: string, identity = key) {
+  return getCredentialAccess(database.db, {
+    ...identity,
+    viewerUserId: userId,
+    ...(token === undefined ? {} : { presentationToken: token }),
+  })
+}
+
+describe.skipIf(!adminUrl)('application model on PostgreSQL', () => {
+  beforeAll(async () => {
+    administrator = createDatabaseClient(adminUrl!)
+    databaseName = `xcs_app_test_${randomUUID().replaceAll('-', '')}`
+    await administrator.sql`CREATE DATABASE ${administrator.sql(databaseName)} TEMPLATE template0`
+    const url = new URL(adminUrl!)
+    url.pathname = `/${databaseName}`
+    database = createDatabaseClient(url.toString())
+
+    // Upgrade an actual previous database; preserve a pre-existing public payload.
+    const journal = JSON.parse(
+      await readFile(join(migrationsFolder, 'meta/_journal.json'), 'utf8'),
+    ) as {
+      version: string
+      dialect: string
+      entries: { tag: string }[]
+    }
+    const appIndex = journal.entries.findIndex((entry) => entry.tag.endsWith('_application_model'))
+    expect(appIndex).toBeGreaterThan(0)
+    fixtureFolder = await mkdtemp(join(tmpdir(), 'xcs-app-migrations-'))
+    await mkdir(join(fixtureFolder, 'meta'))
+    const entries = journal.entries.slice(0, appIndex)
+    for (const entry of entries)
+      await copyFile(
+        join(migrationsFolder, `${entry.tag}.sql`),
+        join(fixtureFolder, `${entry.tag}.sql`),
+      )
+    await writeFile(
+      join(fixtureFolder, 'meta/_journal.json'),
+      JSON.stringify({ ...journal, entries }),
+    )
+    await migrate(database.db, { migrationsFolder: fixtureFolder })
+    await database.sql`INSERT INTO hosted_payloads (locator, digest_hex, content) VALUES (${'1'.repeat(20)}, ${'a'.repeat(64)}, ${'{"test":true}'})`
+    await migrate(database.db, { migrationsFolder })
+    await migrate(database.db, { migrationsFolder })
+  }, 30_000)
+
+  afterAll(async () => {
+    await database?.close()
+    if (administrator && /^xcs_app_test_[a-f0-9]{32}$/.test(databaseName)) {
+      await administrator.sql`DROP DATABASE IF EXISTS ${administrator.sql(databaseName)} WITH (FORCE)`
+    }
+    await administrator?.close()
+    if (fixtureFolder?.startsWith(join(tmpdir(), 'xcs-app-migrations-')))
+      await rm(fixtureFolder, { recursive: true, force: true })
+  })
+
+  beforeEach(async () => {
+    // Only this suite's isolated database and application tables are reset.
+    await database.sql`TRUNCATE app_presentation_challenges, app_presentation_proofs, app_verifier_history, app_issuer_payloads, app_invite_deliveries, app_admin_notifications, app_admin_decisions, app_admin_bootstrap_audit, app_wallet_challenges, app_sessions, app_auth_transactions, app_presentations, app_credential_metadata, app_invites, app_schema_metadata, app_documents, app_organization_applications, app_wallets, app_user_roles, app_organizations, app_users`
+    await database.db.insert(appUsers).values(
+      Object.entries(ids)
+        .filter(([name]) => !name.endsWith('Org'))
+        .map(([name, id]) => ({
+          id,
+          identityIssuer: 'https://identity.example.invalid',
+          identitySubject: name,
+          email: `${name}@example.invalid`,
+        })),
+    )
+    await database.db.insert(appUserRoles).values({ userId: ids.admin, role: 'admin' })
+    await database.db.insert(appOrganizations).values([
+      { id: ids.issuerOrg, responsibleUserId: ids.issuer, name: 'Example school' },
+      { id: ids.verifierOrg, responsibleUserId: ids.verifier, name: 'Example verifier' },
+      { id: ids.otherOrg, responsibleUserId: ids.outsider, name: 'Other verifier' },
+    ])
+    await database.db.insert(appOrganizationApplications).values(
+      [
+        { organizationId: ids.issuerOrg, role: 'issuer' as const },
+        { organizationId: ids.verifierOrg, role: 'verifier' as const },
+        { organizationId: ids.otherOrg, role: 'verifier' as const },
+      ].map((row) => ({
+        ...row,
+        status: 'approved' as const,
+        reviewedBy: ids.admin,
+        reviewedAt: sql`CURRENT_TIMESTAMP`,
+      })),
+    )
+    await database.db.insert(appSchemaMetadata).values({
+      profileId: key.profileId,
+      schemaUid,
+      organizationId: ids.issuerOrg,
+      registrationTransactionHash: 'c'.repeat(64),
+    })
+    await database.db.insert(appCredentialMetadata).values({
+      ...key,
+      schemaUid,
+      issuerOrganizationId: ids.issuerOrg,
+      recipientUserId: ids.recipient,
+      issuerAddress: address,
+      subjectAddress: address,
+      visibility: 'private',
+      publicFields: ['/course'],
+      payloadStorageKey: 'private/fictional-test-object',
+      payloadDigest: 'd'.repeat(64),
+      creationTransactionHash: 'e'.repeat(64),
+      creationLedgerIndex: 100,
+    })
+    const token = createAppToken()
+    presentationToken = token.token
+    await database.db.insert(appPresentations).values({
+      ...key,
+      recipientUserId: ids.recipient,
+      verifierOrganizationId: ids.verifierOrg,
+      scope: 'full',
+      tokenHash: token.tokenHash,
+    })
+  })
+
+  it('upgrades without altering existing hosted payload bytes', async () => {
+    const rows =
+      await database.sql`SELECT content FROM hosted_payloads WHERE locator = ${'1'.repeat(20)}`
+    expect(rows[0]?.content).toBe('{"test":true}')
+  })
+
+  it('also creates the complete model on an empty database', async () => {
+    const name = `xcs_app_test_${randomUUID().replaceAll('-', '')}`
+    await administrator.sql`CREATE DATABASE ${administrator.sql(name)} TEMPLATE template0`
+    const url = new URL(adminUrl!)
+    url.pathname = `/${name}`
+    const fresh = createDatabaseClient(url.toString())
+    try {
+      await migrate(fresh.db, { migrationsFolder })
+      const [row] = await fresh.sql<{ count: number }[]>`
+        SELECT count(*)::integer AS count FROM information_schema.tables
+        WHERE table_schema = 'public' AND left(table_name, 4) = 'app_'
+      `
+      expect(row?.count).toBe(21)
+      expect(await fresh.db.select().from(appUsers)).toEqual([])
+    } finally {
+      await fresh.close()
+      await administrator.sql`DROP DATABASE ${administrator.sql(name)} WITH (FORCE)`
+    }
+  })
+
+  it.each([null, ids.outsider, ids.admin])(
+    'exposes only public fields to non-owners including admin %s',
+    async (user) => {
+      const result = await access(user, presentationToken)
+      expect(result?.scope).toBe('public')
+      expect(filterCredentialClaims(privateClaims, result!)).toEqual({ course: 'XRPL basics' })
+    },
+  )
+
+  it.each([ids.issuer, ids.recipient])(
+    'allows the owner without a presentation %s',
+    async (user) => {
+      const result = await access(user)
+      expect(result?.scope).toBe('full')
+      expect(filterCredentialClaims(privateClaims, result!)).toEqual(privateClaims)
+    },
+  )
+
+  it('requires the designated verifier AND its grant, without an automatic expiry', async () => {
+    expect((await access(ids.verifier))?.scope).toBe('public')
+    expect((await access(ids.verifier, 'invalid'))?.scope).toBe('public')
+    await database.db.update(appPresentations).set({ createdAt: new Date('2000-01-01T00:00:00Z') })
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('full')
+    expect((await access(ids.outsider, presentationToken))?.scope).toBe('public')
+  })
+
+  it('rechecks grant revocation and organization approval on subsequent reads', async () => {
+    await database.db.update(appPresentations).set({ revokedAt: sql`CURRENT_TIMESTAMP` })
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('public')
+    await database.db.update(appPresentations).set({ revokedAt: null })
+    await database.db
+      .update(appOrganizationApplications)
+      .set({ status: 'suspended', reviewReason: 'Test suspension' })
+      .where(eq(appOrganizationApplications.organizationId, ids.verifierOrg))
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('public')
+  })
+
+  it('rejects suspended accounts/organizations and public-only grants for private access', async () => {
+    await database.db
+      .update(appUsers)
+      .set({ status: 'suspended' })
+      .where(eq(appUsers.id, ids.verifier))
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('public')
+    await database.db
+      .update(appUsers)
+      .set({ status: 'active' })
+      .where(eq(appUsers.id, ids.verifier))
+    await database.db
+      .update(appOrganizations)
+      .set({ status: 'suspended' })
+      .where(eq(appOrganizations.id, ids.verifierOrg))
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('public')
+    await database.db
+      .update(appOrganizations)
+      .set({ status: 'active' })
+      .where(eq(appOrganizations.id, ids.verifierOrg))
+    await database.db.update(appPresentations).set({ scope: 'public' })
+    expect((await access(ids.verifier, presentationToken))?.scope).toBe('public')
+  })
+
+  it('does not reuse a grant for another generation or network profile', async () => {
+    expect(
+      await access(ids.verifier, presentationToken, { ...key, profileId: 'another-network' }),
+    ).toBeNull()
+    const [original] = await database.db.select().from(appCredentialMetadata)
+    const another = { ...key, generationId: 'f'.repeat(64) }
+    await database.db.insert(appCredentialMetadata).values({ ...original!, ...another })
+    expect((await access(ids.verifier, presentationToken, another))?.scope).toBe('public')
+    const anotherProfile = { ...key, profileId: 'another-network' }
+    const [schema] = await database.db.select().from(appSchemaMetadata)
+    await database.db
+      .insert(appSchemaMetadata)
+      .values({ ...schema!, profileId: anotherProfile.profileId })
+    await database.db.insert(appCredentialMetadata).values({ ...original!, ...anotherProfile })
+    expect((await access(ids.verifier, presentationToken, anotherProfile))?.scope).toBe('public')
+  })
+
+  it('returns all public credential claims even anonymously', async () => {
+    await database.db.update(appCredentialMetadata).set({ visibility: 'public' })
+    expect((await access(null))?.scope).toBe('full')
+  })
+
+  it('lets a different-email account claim the link without verifying that email', async () => {
+    const { token } = await invitation()
+    expect((await claimInvitation(database.db, { token, userId: ids.recipient }))?.claimedBy).toBe(
+      ids.recipient,
+    )
+    const [user] = await database.db.select().from(appUsers).where(eq(appUsers.id, ids.recipient))
+    expect(user?.email).toBe('recipient@example.invalid')
+    expect(user?.emailVerifiedAt).toBeNull()
+    expect(await claimInvitation(database.db, { token, userId: ids.outsider })).toBeNull()
+  })
+
+  it('allows only one concurrent claimant', async () => {
+    const { token } = await invitation()
+    const results = await Promise.all(
+      [ids.recipient, ids.outsider].map((userId) =>
+        claimInvitation(database.db, { token, userId }),
+      ),
+    )
+    expect(results.filter(Boolean)).toHaveLength(1)
+    const [row] = await database.db.select().from(appInvites)
+    expect(row?.claimedBy).toBe(results.find(Boolean)?.claimedBy)
+  })
+
+  it('checks invitation expiry at the claim statement, not at transaction start', async () => {
+    const { token, invite } = await invitation()
+    await database.db.transaction(async (transaction) => {
+      await transaction
+        .update(appInvites)
+        .set({ expiresAt: sql`CURRENT_TIMESTAMP + interval '50 milliseconds'` })
+        .where(eq(appInvites.id, invite.id))
+      await transaction.execute(sql`SELECT pg_sleep(0.1)`)
+      expect(await claimInvitation(transaction, { token, userId: ids.recipient })).toBeNull()
+    })
+  })
+
+  it('refuses expired, revoked, malformed invitations and suspended claimants', async () => {
+    const expired = await invitation({
+      createdAt: new Date(Date.now() - 7200_000),
+      expiresAt: new Date(Date.now() - 3600_000),
+    })
+    const revoked = await invitation({ revokedAt: new Date() })
+    for (const token of [expired.token, revoked.token, 'invalid']) {
+      expect(await claimInvitation(database.db, { token, userId: ids.recipient })).toBeNull()
+    }
+    const valid = await invitation()
+    await database.db
+      .update(appUsers)
+      .set({ status: 'suspended' })
+      .where(eq(appUsers.id, ids.recipient))
+    expect(
+      await claimInvitation(database.db, { token: valid.token, userId: ids.recipient }),
+    ).toBeNull()
+  })
+
+  it('enforces the invitation claimant and presentation recipient in SQL', async () => {
+    const { token, invite } = await invitation()
+    await claimInvitation(database.db, { token, userId: ids.outsider })
+    await expect(
+      database.db.update(appCredentialMetadata).set({ inviteId: invite.id }),
+    ).rejects.toThrow()
+    await expect(
+      database.db.update(appPresentations).set({ recipientUserId: ids.outsider }),
+    ).rejects.toThrow()
+    await expect(
+      database.db.update(appPresentations).set({ verifierOrganizationId: null }),
+    ).rejects.toThrow()
+  })
+
+  it('enforces wallet uniqueness, organization ownership and structured public-field lists', async () => {
+    const wallet = { userId: ids.recipient, networkId: 1, address, verifiedAt: new Date() }
+    await database.db.insert(appWallets).values(wallet)
+    await expect(
+      database.db.insert(appWallets).values({ ...wallet, userId: ids.outsider }),
+    ).rejects.toThrow()
+    await database.db.insert(appWallets).values({ ...wallet, networkId: 0 })
+    await expect(
+      database.db.update(appCredentialMetadata).set({ issuerOrganizationId: ids.otherOrg }),
+    ).rejects.toThrow()
+    await expect(
+      database.sql`UPDATE app_credential_metadata SET public_fields = '[1]'::jsonb`,
+    ).rejects.toThrow()
+    await expect(
+      database.sql`UPDATE app_credential_metadata SET visibility = 'unexpected'`,
+    ).rejects.toThrow()
+  })
+
+  it('keeps PII removable without cascading deletion into credential ownership', async () => {
+    const [document] = await database.db
+      .insert(appDocuments)
+      .values({
+        organizationId: ids.issuerOrg,
+        applicationRole: 'issuer',
+        storageKey: 'review/test-object',
+        mimeType: 'application/pdf',
+        byteLength: 10,
+        sha256: 'a'.repeat(64),
+        uploadedBy: ids.issuer,
+      })
+      .returning()
+    await database.db.delete(appDocuments).where(eq(appDocuments.id, document!.id))
+    await expect(
+      database.db.delete(appUsers).where(eq(appUsers.id, ids.recipient)),
+    ).rejects.toThrow()
+    await database.db
+      .update(appUsers)
+      .set({
+        status: 'deleted',
+        identityIssuer: null,
+        identitySubject: null,
+        email: null,
+        emailVerifiedAt: null,
+        displayName: null,
+        deletedAt: new Date(),
+      })
+      .where(eq(appUsers.id, ids.recipient))
+    expect((await access(ids.recipient))?.scope).toBe('public')
+    expect(await database.db.select().from(appCredentialMetadata)).toHaveLength(1)
+  })
+
+  it('can look up the presentation only by its hash, never a raw token column', async () => {
+    const [presentation] = await database.db.select().from(appPresentations)
+    expect(presentation?.tokenHash).toBe(hashAppToken(presentationToken))
+    expect(Object.values(presentation!)).not.toContain(presentationToken)
+  })
+})
diff --git a/apps/indexer/test/db/app-visibility.test.ts b/apps/indexer/test/db/app-visibility.test.ts
new file mode 100644
index 0000000..d511ca6
--- /dev/null
+++ b/apps/indexer/test/db/app-visibility.test.ts
@@ -0,0 +1,101 @@
+import { describe, expect, it } from 'vitest'
+
+import { filterCredentialClaims, validatePublicFields } from '../../src/lib/db/app/visibility.js'
+import { createAppToken, hashAppToken } from '../../src/lib/db/app/tokens.js'
+
+const claims = {
+  course: { title: 'XRPL basics', grade: 18 },
+  learner: { name: 'Synthetic learner', email: 'learner@example.invalid' },
+  passed: true,
+  credits: 0,
+  optional: null,
+  modules: [{ name: 'Ledger', privateNote: 'Do not publish' }],
+  'a/b': { '~result': 'ok' },
+}
+
+describe('credential claim disclosure', () => {
+  it('projects only named fields, including nested and escaped JSON pointers', () => {
+    expect(
+      filterCredentialClaims(claims, {
+        scope: 'public',
+        publicFields: ['/course/title', '/passed', '/credits', '/optional', '/a~1b/~0result'],
+      }),
+    ).toEqual({
+      course: { title: 'XRPL basics' },
+      passed: true,
+      credits: 0,
+      optional: null,
+      'a/b': { '~result': 'ok' },
+    })
+  })
+
+  it('does not expand an empty or missing selection into full claims', () => {
+    expect(filterCredentialClaims(claims, { scope: 'public', publicFields: [] })).toEqual({})
+    expect(
+      filterCredentialClaims(claims, {
+        scope: 'public',
+        publicFields: ['/missing', '/course/missing', '/passed/child'],
+      }),
+    ).toEqual({})
+  })
+
+  it('copies full access and explicitly selected objects without mutating the payload', () => {
+    const full = filterCredentialClaims(claims, { scope: 'full', publicFields: [] })
+    expect(full).toEqual(claims)
+    expect(full).not.toBe(claims)
+    expect(full.course).not.toBe(claims.course)
+    expect(filterCredentialClaims(claims, { scope: 'public', publicFields: ['/course'] })).toEqual({
+      course: claims.course,
+    })
+  })
+
+  it('treats arrays atomically and never exposes their siblings through an index selection', () => {
+    expect(
+      filterCredentialClaims(claims, { scope: 'public', publicFields: ['/modules/0/name'] }),
+    ).toEqual({})
+    expect(filterCredentialClaims(claims, { scope: 'public', publicFields: ['/modules'] })).toEqual(
+      { modules: claims.modules },
+    )
+  })
+
+  it.each([
+    '',
+    'course.title',
+    '/~2',
+    '/__proto__/polluted',
+    '/constructor/prototype',
+    '/course/prototype',
+    '/' + 'x'.repeat(1024),
+  ])('fails closed for invalid path %s', (path) => {
+    expect(() => filterCredentialClaims(claims, { scope: 'public', publicFields: [path] })).toThrow(
+      'INVALID_PUBLIC_FIELD_PATH',
+    )
+  })
+
+  it('ignores inherited fields and bounds selector size/depth', () => {
+    expect(filterCredentialClaims({}, { scope: 'public', publicFields: ['/toString'] })).toEqual({})
+    expect(() => validatePublicFields(Array(257).fill('/course'))).toThrow('INVALID_PUBLIC_FIELDS')
+    expect(() => validatePublicFields(['/' + Array(33).fill('x').join('/')])).toThrow(
+      'INVALID_PUBLIC_FIELD_PATH',
+    )
+    expect(Object.prototype).not.toHaveProperty('polluted')
+  })
+})
+
+describe('application bearer tokens', () => {
+  it('uses independent 256-bit tokens and persists only their SHA-256 hashes', () => {
+    const first = createAppToken()
+    const second = createAppToken()
+    expect(first.token).toMatch(/^[A-Za-z0-9_-]{43}$/)
+    expect(first.tokenHash).toMatch(/^[0-9a-f]{64}$/)
+    expect(hashAppToken(first.token)).toBe(first.tokenHash)
+    expect(first.token).not.toBe(second.token)
+    expect(first.tokenHash).not.toBe(second.tokenHash)
+  })
+
+  it('rejects malformed and unbounded tokens before database access', () => {
+    for (const token of ['', 'bad token', 'a'.repeat(44), 'a'.repeat(10000)]) {
+      expect(hashAppToken(token)).toBeNull()
+    }
+  })
+})
diff --git a/apps/indexer/test/db/auth.integration.test.ts b/apps/indexer/test/db/auth.integration.test.ts
new file mode 100644
index 0000000..5059c31
--- /dev/null
+++ b/apps/indexer/test/db/auth.integration.test.ts
@@ -0,0 +1,229 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+import { createDatabaseClient, type DatabaseClient } from '../../src/lib/db/client.js'
+import { provisionRuntimeDatabasePrivileges } from '../../src/lib/db/bootstrap.js'
+import { DATABASE_MIGRATIONS_FOLDER, migrateDatabase } from '../../src/lib/db/migrations.js'
+import { createManagedRuntimeDatabaseUsers } from '../helpers/managedRuntimeUsers.js'
+
+const adminUrl = process.env.XCS_TEST_DATABASE_URL?.trim() || undefined
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !adminUrl) {
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+}
+const passwords = {
+  clusterScope: 'dedicated' as const,
+  indexerPassword: randomBytes(32).toString('base64url'),
+  apiPassword: randomBytes(32).toString('base64url'),
+  payloadWriterPassword: randomBytes(32).toString('base64url'),
+  monitorPassword: randomBytes(32).toString('base64url'),
+  applicationPassword: randomBytes(32).toString('base64url'),
+}
+const address = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
+let administrator: DatabaseClient
+let database: DatabaseClient
+let application: DatabaseClient
+let databaseName: string
+let fixtureFolder: string | undefined
+let userId: string
+
+async function session() {
+  const [row] = await application.sql<{ id: string }[]>`
+    INSERT INTO app_sessions (token_hash, user_id, csrf_token, expires_at, absolute_expires_at)
+    VALUES (${randomBytes(32).toString('hex')}, ${userId}, ${randomBytes(32).toString('base64url')}, now() + interval '1 hour', now() + interval '1 day') RETURNING id
+  `
+  return row!.id
+}
+
+describe.skipIf(!adminUrl)('authentication schema and restricted application role', () => {
+  beforeAll(async () => {
+    administrator = createDatabaseClient(adminUrl!, { onNotice: () => undefined })
+    databaseName = `xcs_auth_test_${randomUUID().replaceAll('-', '')}`
+    await administrator.sql`CREATE DATABASE ${administrator.sql(databaseName)} TEMPLATE template0`
+    const url = new URL(adminUrl!)
+    url.pathname = `/${databaseName}`
+    database = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+
+    // Upgrade the actual preceding catalog, retaining an existing identity/admin grant.
+    const journal = JSON.parse(
+      await readFile(join(DATABASE_MIGRATIONS_FOLDER, 'meta/_journal.json'), 'utf8'),
+    ) as { entries: { tag: string }[] }
+    const authIndex = journal.entries.findIndex(({ tag }) => tag === '0004_auth_sessions')
+    expect(authIndex).toBe(4)
+    fixtureFolder = await mkdtemp(join(tmpdir(), 'xcs-auth-migrations-'))
+    await mkdir(join(fixtureFolder, 'meta'))
+    const entries = journal.entries.slice(0, authIndex)
+    for (const { tag } of entries)
+      await copyFile(
+        join(DATABASE_MIGRATIONS_FOLDER, `${tag}.sql`),
+        join(fixtureFolder, `${tag}.sql`),
+      )
+    await writeFile(
+      join(fixtureFolder, 'meta/_journal.json'),
+      JSON.stringify({ ...journal, entries }),
+    )
+    await migrateDatabase(database, fixtureFolder)
+    const [user] = await database.sql<{ id: string }[]>`
+      INSERT INTO app_users (identity_issuer, identity_subject) VALUES ('https://identity.example.invalid', 'existing') RETURNING id
+    `
+    userId = user!.id
+    await database.sql`INSERT INTO app_user_roles (user_id, role) VALUES (${userId}, 'admin')`
+    await migrateDatabase(database)
+    await migrateDatabase(database)
+    const managedPasswords = await createManagedRuntimeDatabaseUsers(database, passwords)
+    await provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' })
+    url.username = 'xcs_app'
+    url.password = managedPasswords.applicationPassword
+    application = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+  }, 30_000)
+
+  afterAll(async () => {
+    await application?.close()
+    await database?.close()
+    if (administrator && /^xcs_auth_test_[a-f0-9]{32}$/.test(databaseName)) {
+      await administrator.sql`DROP DATABASE IF EXISTS ${administrator.sql(databaseName)} WITH (FORCE)`
+    }
+    await administrator?.close()
+    if (fixtureFolder) await rm(fixtureFolder, { recursive: true, force: true })
+  })
+
+  it('preserves existing identities and admin grants while defaulting new roles to recipient', async () => {
+    expect(
+      await application.sql`SELECT role FROM app_user_roles WHERE user_id = ${userId}`,
+    ).toEqual([{ role: 'admin' }])
+    const [user] = await application.sql<{ id: string }[]>`
+      INSERT INTO app_users (identity_issuer, identity_subject, email, display_name)
+      VALUES ('https://identity.example.invalid', 'new', 'fixture@example.invalid', 'Fixture') RETURNING id
+    `
+    await application.sql`INSERT INTO app_user_roles (user_id) VALUES (${user!.id})`
+    expect(
+      await application.sql`SELECT role FROM app_user_roles WHERE user_id = ${user!.id}`,
+    ).toEqual([{ role: 'recipient' }])
+    await application.sql`UPDATE app_users SET display_name = 'Updated fixture' WHERE id = ${user!.id}`
+    for (const query of [
+      () =>
+        application.sql`INSERT INTO app_user_roles (user_id, role) VALUES (${user!.id}, 'admin')`,
+      () => application.sql`UPDATE app_user_roles SET role = 'admin' WHERE user_id = ${user!.id}`,
+      () => application.sql`UPDATE app_users SET status = 'active' WHERE id = ${user!.id}`,
+      () =>
+        application.sql`UPDATE app_users SET identity_subject = 'another' WHERE id = ${user!.id}`,
+      () => application.sql`DELETE FROM app_users WHERE id = ${user!.id}`,
+      () => application.sql`UPDATE app_organization_applications SET status = 'approved'`,
+      () => application.sql`SELECT * FROM app_organization_applications`,
+      () => application.sql`SELECT * FROM app_credential_metadata`,
+      () => application.sql`SELECT * FROM app_documents`,
+      () => application.sql`SELECT * FROM app_presentations`,
+      () => application.sql`SELECT * FROM hosted_payloads`,
+      () => application.sql`DELETE FROM schemas`,
+      () => application.sql`CREATE TABLE forbidden_auth_table (id integer)`,
+    ])
+      await expect(query()).rejects.toMatchObject({ code: '42501' })
+    expect(
+      await application.sql`SELECT organization_id, role, status FROM app_organization_applications`,
+    ).toEqual([])
+  })
+
+  it('checks session bounds and makes challenge consumption atomic with cascade on logout', async () => {
+    const sessionId = await session()
+    await expect(
+      application.sql`UPDATE app_sessions SET expires_at = absolute_expires_at + interval '1 second' WHERE id = ${sessionId}`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await expect(
+      application.sql`UPDATE app_sessions SET token_hash = 'invalid' WHERE id = ${sessionId}`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await expect(
+      application.sql`UPDATE app_sessions SET absolute_expires_at = 'infinity' WHERE id = ${sessionId}`,
+    ).rejects.toMatchObject({ code: '23514' })
+    const [challenge] = await application.sql<{ id: string }[]>`
+      INSERT INTO app_wallet_challenges (session_id, network_id, address, message, expires_at)
+      VALUES (${sessionId}, 1, ${address}, 'Synthetic proof fixture', now() + interval '5 minutes') RETURNING id
+    `
+    const consumed = await Promise.all(
+      [1, 2].map(
+        () => application.sql`
+      DELETE FROM app_wallet_challenges WHERE id = ${challenge!.id} AND session_id = ${sessionId} AND expires_at > now() RETURNING id
+    `,
+      ),
+    )
+    expect(consumed.map((rows) => rows.length).sort()).toEqual([0, 1])
+    await application.sql`
+      INSERT INTO app_wallet_challenges (session_id, network_id, address, message, expires_at)
+      VALUES (${sessionId}, 1, ${address}, 'Synthetic proof fixture', now() + interval '5 minutes')
+    `
+    await application.sql`DELETE FROM app_sessions WHERE id = ${sessionId}`
+    expect(
+      await application.sql`SELECT id FROM app_wallet_challenges WHERE session_id = ${sessionId}`,
+    ).toEqual([])
+  })
+
+  it('enforces transaction shape, expiry and one-time state consumption', async () => {
+    const stateHash = randomBytes(32).toString('hex')
+    await application.sql`
+      INSERT INTO app_auth_transactions (state_hash, browser_hash, nonce, code_verifier, return_to, expires_at)
+      VALUES (${stateHash}, ${randomBytes(32).toString('hex')}, ${randomBytes(32).toString('base64url')}, ${randomBytes(32).toString('base64url')}, '/account', now() + interval '5 minutes')
+    `
+    for (const invalid of [
+      '//attacker.example',
+      '/\\attacker.example',
+      'https://attacker.example',
+      '/account\n',
+    ]) {
+      await expect(
+        application.sql`UPDATE app_auth_transactions SET return_to = ${invalid} WHERE state_hash = ${stateHash}`,
+      ).rejects.toMatchObject({ code: '23514' })
+    }
+    await expect(
+      application.sql`UPDATE app_auth_transactions SET expires_at = created_at WHERE state_hash = ${stateHash}`,
+    ).rejects.toMatchObject({ code: '23514' })
+    const results = await Promise.all(
+      [1, 2].map(
+        () =>
+          application.sql`DELETE FROM app_auth_transactions WHERE state_hash = ${stateHash} RETURNING state_hash`,
+      ),
+    )
+    expect(results.map((rows) => rows.length).sort()).toEqual([0, 1])
+  })
+
+  it('permits wallet verification without allowing account reassignment', async () => {
+    await application.sql`INSERT INTO app_wallets (user_id, network_id, address, verified_at) VALUES (${userId}, 1, ${address}, now())`
+    await application.sql`UPDATE app_wallets SET revoked_at = now() WHERE user_id = ${userId}`
+    await expect(
+      application.sql`UPDATE app_wallets SET user_id = ${userId} WHERE address = ${address}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      application.sql`INSERT INTO app_wallets (user_id, network_id, address, verified_at) VALUES (${userId}, 4294967296, ${address}, now())`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await expect(
+      application.sql`INSERT INTO app_wallets (user_id, network_id, address, verified_at) VALUES (${userId}, 1, ${address}, now())`,
+    ).rejects.toMatchObject({ code: '23505' })
+  })
+
+  it('normalizes accidental column grants without changing managed authentication', async () => {
+    const [before] = await database.sql<{ canLogin: boolean; passwordHash: string | null }[]>`
+      SELECT rolcanlogin AS "canLogin", rolpassword AS "passwordHash"
+      FROM pg_authid WHERE rolname = 'xcs_app'
+    `
+    await database.sql`GRANT UPDATE (status) ON app_users TO xcs_app`
+    await provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' })
+
+    const [after] = await database.sql<{ canLogin: boolean; passwordHash: string | null }[]>`
+      SELECT rolcanlogin AS "canLogin", rolpassword AS "passwordHash"
+      FROM pg_authid WHERE rolname = 'xcs_app'
+    `
+    expect(after).toEqual(before)
+    expect(after?.canLogin).toBe(true)
+    await expect(
+      application.sql`UPDATE app_users SET status = 'active' WHERE id = ${userId}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    expect(await application.sql`SELECT id FROM public.app_users WHERE id = ${userId}`).toEqual([
+      { id: userId },
+    ])
+    const [grant] = await database.sql<
+      { insertAllowed: boolean }[]
+    >`SELECT has_column_privilege('xcs_app', 'app_user_roles', 'user_id', 'INSERT') AS "insertAllowed"`
+    expect(grant?.insertAllowed).toBe(true)
+  })
+})
diff --git a/apps/indexer/test/db/environment.test.ts b/apps/indexer/test/db/environment.test.ts
new file mode 100644
index 0000000..090ddcd
--- /dev/null
+++ b/apps/indexer/test/db/environment.test.ts
@@ -0,0 +1,49 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { requiredEnvironment } from '../../src/lib/db/bin/environment.js'
+
+const directories: string[] = []
+afterEach(() => {
+  vi.unstubAllEnvs()
+  for (const path of directories.splice(0)) rmSync(path, { recursive: true, force: true })
+})
+
+function fixture(value: string): string {
+  const directory = mkdtempSync(join(tmpdir(), 'xcs-db-env-'))
+  directories.push(directory)
+  const path = join(directory, 'secret')
+  writeFileSync(path, value)
+  return path
+}
+
+describe('database command environment', () => {
+  it('uses a direct URL or a one-line secret file without changing encoded credentials', () => {
+    const value = 'postgres://test:fixture%25encoded@127.0.0.1/example?sslmode=verify-full'
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL_FILE', undefined)
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL', value)
+    expect(requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')).toBe(value)
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL', undefined)
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL_FILE', fixture(`${value}\r\n`))
+    expect(requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')).toBe(value)
+  })
+
+  it('rejects missing, conflicting, empty, multiline and oversized values', () => {
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL', undefined)
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL_FILE', undefined)
+    expect(() => requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')).toThrow(
+      'DATABASE_ENVIRONMENT_REQUIRED',
+    )
+    for (const value of ['', '\n', 'first\nsecond', 'x'.repeat(16_385)]) {
+      vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL_FILE', fixture(value))
+      expect(() => requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')).toThrow()
+    }
+    vi.stubEnv('XCS_BOOTSTRAP_DATABASE_URL', 'fixture-direct-value')
+    expect(() => requiredEnvironment('XCS_BOOTSTRAP_DATABASE_URL')).toThrow(
+      'DATABASE_ENVIRONMENT_CONFLICT',
+    )
+  })
+})
diff --git a/apps/indexer/test/db/migrations.integration.test.ts b/apps/indexer/test/db/migrations.integration.test.ts
new file mode 100644
index 0000000..e025b3b
--- /dev/null
+++ b/apps/indexer/test/db/migrations.integration.test.ts
@@ -0,0 +1,527 @@
+import { randomUUID } from 'node:crypto'
+import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import type { TransactionSql } from 'postgres'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest'
+
+import { bootstrapDatabase } from '../../src/lib/db/bootstrap.js'
+import { createDatabaseClient, type DatabaseClient } from '../../src/lib/db/client.js'
+import {
+  DATABASE_MIGRATIONS_FOLDER,
+  databaseMigrationStatus,
+  migrateDatabase,
+} from '../../src/lib/db/migrations.js'
+import { createManagedRuntimeDatabaseUsers } from '../helpers/managedRuntimeUsers.js'
+
+const adminUrl = process.env.XCS_TEST_DATABASE_URL?.trim() || undefined
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && adminUrl === undefined) {
+  throw new Error('XCS_TEST_DATABASE_URL is required by test:postgres')
+}
+
+interface JournalEntry {
+  idx: number
+  version: string
+  when: number
+  tag: string
+  breakpoints: boolean
+}
+
+const journal = JSON.parse(
+  await readFile(join(DATABASE_MIGRATIONS_FOLDER, 'meta/_journal.json'), 'utf8'),
+) as { version: string; dialect: string; entries: JournalEntry[] }
+const tags = journal.entries.map((entry) => entry.tag)
+const temporaryNames = /^xcs_migration_(?:db|role)_[0-9a-f]{32}$/u
+let administrator: DatabaseClient
+let database: DatabaseClient
+let databaseName: string | undefined
+let roleName: string | undefined
+let managedDatabase: DatabaseClient | undefined
+let managedRuntimeRolesCreated = false
+let managedPreexistingRuntimeRoles = false
+const fixtureFolders: string[] = []
+const managedProvisionerPassword = 'managed-provisioner-password-000001'
+
+async function fixture(count = journal.entries.length): Promise<string> {
+  const folder = await mkdtemp(join(tmpdir(), 'xcs-migration-fixture-'))
+  fixtureFolders.push(folder)
+  await mkdir(join(folder, 'meta'))
+  const entries = journal.entries.slice(0, count)
+  for (const entry of entries) {
+    await copyFile(
+      join(DATABASE_MIGRATIONS_FOLDER, `${entry.tag}.sql`),
+      join(folder, `${entry.tag}.sql`),
+    )
+  }
+  await writeFile(join(folder, 'meta/_journal.json'), JSON.stringify({ ...journal, entries }))
+  return folder
+}
+
+async function additiveFixture(sql: string): Promise<string> {
+  const folder = await fixture()
+  const entry = {
+    idx: journal.entries.length,
+    version: '7',
+    when: journal.entries.at(-1)!.when + 1,
+    tag: `${String(journal.entries.length).padStart(4, '0')}_integration_probe`,
+    breakpoints: true,
+  }
+  await writeFile(join(folder, `${entry.tag}.sql`), sql)
+  await writeFile(
+    join(folder, 'meta/_journal.json'),
+    JSON.stringify({ ...journal, entries: [...journal.entries, entry] }),
+  )
+  return folder
+}
+
+async function journalRows() {
+  return database.sql`SELECT id, hash, created_at FROM drizzle.__drizzle_migrations ORDER BY id`
+}
+
+async function exists(relation: string): Promise<boolean> {
+  const [row] = await database.sql<{ exists: boolean }[]>`
+    SELECT to_regclass(${relation}) IS NOT NULL AS exists
+  `
+  return row?.exists === true
+}
+
+describe.skipIf(adminUrl === undefined)('PostgreSQL 18 migration lifecycle', () => {
+  beforeAll(async () => {
+    administrator = createDatabaseClient(adminUrl!)
+    const [version] = await administrator.sql<{ version: number }[]>`
+      SELECT current_setting('server_version_num')::integer AS version
+    `
+    expect(Math.trunc((version?.version ?? 0) / 10_000)).toBe(18)
+  })
+
+  beforeEach(async () => {
+    databaseName = `xcs_migration_db_${randomUUID().replaceAll('-', '')}`
+    if (!temporaryNames.test(databaseName)) throw new Error('Invalid test database name')
+    await administrator.sql`CREATE DATABASE ${administrator.sql(databaseName)} TEMPLATE template0`
+    const url = new URL(adminUrl!)
+    url.pathname = `/${databaseName}`
+    database = createDatabaseClient(url.toString())
+  })
+
+  afterEach(async () => {
+    await managedDatabase?.close()
+    managedDatabase = undefined
+    await database?.close()
+    if (databaseName !== undefined && temporaryNames.test(databaseName)) {
+      await administrator.sql`DROP DATABASE IF EXISTS ${administrator.sql(databaseName)} WITH (FORCE)`
+      databaseName = undefined
+    }
+    if (managedPreexistingRuntimeRoles && roleName !== undefined && temporaryNames.test(roleName)) {
+      await administrator.sql`
+        REVOKE pg_monitor FROM xcs_monitor
+        GRANTED BY ${administrator.sql(roleName)} CASCADE
+      `
+      await administrator.sql`
+        GRANT pg_monitor TO xcs_monitor
+        WITH ADMIN FALSE, SET FALSE, INHERIT TRUE
+      `
+      await administrator.sql`REVOKE pg_monitor FROM ${administrator.sql(roleName)}`
+      managedPreexistingRuntimeRoles = false
+    }
+    if (managedRuntimeRolesCreated) {
+      await administrator.sql`
+        DROP ROLE IF EXISTS
+          xcs_indexer,
+          xcs_api,
+          xcs_payload_writer,
+          xcs_monitor,
+          xcs_app,
+          xcs_admin_app,
+          xcs_notifier,
+          xcs_issuer
+      `
+      managedRuntimeRolesCreated = false
+    }
+    if (roleName !== undefined && temporaryNames.test(roleName)) {
+      await administrator.sql`DROP ROLE IF EXISTS ${administrator.sql(roleName)}`
+      roleName = undefined
+    }
+    for (const folder of fixtureFolders.splice(0)) {
+      await rm(folder, { recursive: true, force: true })
+    }
+  }, 30_000)
+
+  afterAll(async () => {
+    await administrator?.close()
+  })
+
+  it('inspects an empty database without DDL and applies the journal exactly once', async () => {
+    expect(await databaseMigrationStatus(database)).toEqual({ applied: [], pending: tags })
+    const schemas = await database.sql`SELECT nspname FROM pg_namespace WHERE nspname = 'drizzle'`
+    expect(schemas).toHaveLength(0)
+
+    expect(await migrateDatabase(database)).toEqual({ applied: tags, pending: [] })
+    const rows = await journalRows()
+    expect(rows).toHaveLength(tags.length)
+    expect(await migrateDatabase(database)).toEqual({ applied: tags, pending: [] })
+    expect(await journalRows()).toEqual(rows)
+  })
+
+  it('bootstraps and reruns atomically through a non-superuser managed provisioner', async () => {
+    roleName = `xcs_migration_role_${randomUUID().replaceAll('-', '')}`
+    if (!temporaryNames.test(roleName)) throw new Error('Invalid test role name')
+    const existingRoles = await administrator.sql<Array<{ rolname: string }>>`
+      SELECT rolname FROM pg_roles
+      WHERE rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
+      ORDER BY rolname
+    `
+    expect([0, 8]).toContain(existingRoles.length)
+    const createsFreshRuntimeRoles = existingRoles.length === 0
+    managedPreexistingRuntimeRoles = !createsFreshRuntimeRoles
+
+    await administrator.sql.begin(async (transaction) => {
+      await transaction`
+        CREATE ROLE ${transaction(roleName!)}
+        LOGIN NOSUPERUSER CREATEDB CREATEROLE REPLICATION BYPASSRLS
+      `
+      await transaction`SELECT set_config('xcs.test_provisioner_password', ${managedProvisionerPassword}, true)`
+      await transaction`SELECT set_config('xcs.test_provisioner_role', ${roleName!}, true)`
+      await transaction.unsafe(`
+        DO $xcs_test_password$
+        BEGIN
+          EXECUTE format(
+            'ALTER ROLE %I PASSWORD %L',
+            current_setting('xcs.test_provisioner_role'),
+            current_setting('xcs.test_provisioner_password')
+          );
+        END
+        $xcs_test_password$;
+      `)
+    })
+    await administrator.sql`
+      GRANT pg_monitor TO ${administrator.sql(roleName)}
+      WITH ADMIN TRUE, SET FALSE, INHERIT FALSE
+    `
+    if (createsFreshRuntimeRoles) {
+      await createManagedRuntimeDatabaseUsers(administrator)
+      managedRuntimeRolesCreated = true
+    }
+    await administrator.sql`
+      ALTER DATABASE ${administrator.sql(databaseName!)} OWNER TO ${administrator.sql(roleName)}
+    `
+    const managedUrl = new URL(adminUrl!)
+    managedUrl.pathname = `/${databaseName}`
+    managedUrl.username = roleName
+    managedUrl.password = managedProvisionerPassword
+    managedDatabase = createDatabaseClient(managedUrl.toString())
+
+    const provisioning = { clusterScope: 'dedicated' } as const
+    await bootstrapDatabase(managedDatabase, provisioning)
+    const firstJournal = await managedDatabase.sql`
+      SELECT id, hash, created_at FROM drizzle.__drizzle_migrations ORDER BY id
+    `
+    expect(firstJournal).toHaveLength(tags.length)
+    await bootstrapDatabase(managedDatabase, provisioning)
+    expect(
+      await managedDatabase.sql`
+        SELECT id, hash, created_at FROM drizzle.__drizzle_migrations ORDER BY id
+      `,
+    ).toEqual(firstJournal)
+
+    const [provisioner] = await administrator.sql<
+      Array<{ isSuperuser: boolean; canCreateRole: boolean }>
+    >`
+      SELECT rolsuper AS "isSuperuser", rolcreaterole AS "canCreateRole"
+      FROM pg_roles WHERE rolname = ${roleName}
+    `
+    expect(provisioner).toEqual({ isSuperuser: false, canCreateRole: true })
+    const runtimeRoles = await administrator.sql<
+      Array<{
+        roleName: string
+        isSuperuser: boolean
+        canCreateDatabase: boolean
+        canCreateRole: boolean
+        canReplicate: boolean
+        canBypassRls: boolean
+      }>
+    >`
+      SELECT
+        rolname AS "roleName",
+        rolsuper AS "isSuperuser",
+        rolcreatedb AS "canCreateDatabase",
+        rolcreaterole AS "canCreateRole",
+        rolreplication AS "canReplicate",
+        rolbypassrls AS "canBypassRls"
+      FROM pg_roles
+      WHERE rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
+      ORDER BY rolname
+    `
+    expect(runtimeRoles).toHaveLength(8)
+    expect(
+      runtimeRoles.every(
+        (role) =>
+          !role.isSuperuser &&
+          !role.canCreateDatabase &&
+          !role.canCreateRole &&
+          !role.canReplicate &&
+          !role.canBypassRls,
+      ),
+    ).toBe(true)
+    const delegations = await administrator.sql<
+      Array<{ adminOption: boolean; inheritOption: boolean; setOption: boolean }>
+    >`
+      SELECT
+        membership.admin_option AS "adminOption",
+        membership.inherit_option AS "inheritOption",
+        membership.set_option AS "setOption"
+      FROM pg_auth_members membership
+      JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
+      JOIN pg_roles member_role ON member_role.oid = membership.member
+      WHERE granted_role.rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
+        AND member_role.rolname = ${roleName}
+    `
+    // Provider-created users do not delegate ADMIN OPTION to the provisioner.
+    // A grants-only bootstrap must therefore remain idempotent without it.
+    expect(delegations).toEqual([])
+  }, 30_000)
+
+  it('rejects an obsolete migration history before creating schema objects or runtime roles', async () => {
+    const runtimeRolesBefore = await administrator.sql`
+      SELECT rolname FROM pg_roles
+      WHERE rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
+      ORDER BY rolname
+    `
+    await database.sql`CREATE SCHEMA drizzle`
+    await database.sql`
+      CREATE TABLE drizzle.__drizzle_migrations (
+        id SERIAL PRIMARY KEY,
+        hash text NOT NULL,
+        created_at bigint
+      )
+    `
+    await database.sql`
+      INSERT INTO drizzle.__drizzle_migrations (hash, created_at)
+      VALUES ('obsolete-xcs-protocol-history', 1)
+    `
+
+    await expect(migrateDatabase(database)).rejects.toThrow('DATABASE_MIGRATION_HISTORY_MISMATCH')
+    expect(await exists('public.network_profiles')).toBe(false)
+    expect(
+      await administrator.sql`
+        SELECT rolname FROM pg_roles
+        WHERE rolname IN (
+          'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+          'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+        )
+        ORDER BY rolname
+      `,
+    ).toEqual(runtimeRolesBefore)
+    expect(await journalRows()).toEqual([
+      { id: 1, hash: 'obsolete-xcs-protocol-history', created_at: '1' },
+    ])
+  })
+
+  it('upgrades a populated baseline and preserves legacy payload bytes and locators', async () => {
+    await migrateDatabase(database, await fixture(1))
+    await database.sql`
+      INSERT INTO network_profiles (
+        profile_id, xcs_version, network_id, required_amendment, registry_address,
+        registration_amount_drops, activation_ledger_index, activation_ledger_hash
+      ) VALUES (
+        'migration-test', '0.1', 1, 'Credentials', 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+        1, 100, ${'a'.repeat(64)}
+      )
+    `
+    await migrateDatabase(database, await fixture(2))
+    await database.sql`
+      INSERT INTO hosted_payloads (locator, digest_hex, content)
+      VALUES (${'b'.repeat(20)}, ${'b'.repeat(64)}, '{"retained":true}')
+    `
+    expect(await databaseMigrationStatus(database)).toEqual({
+      applied: tags.slice(0, 2),
+      pending: tags.slice(2),
+    })
+    await migrateDatabase(database)
+    expect(await database.sql`SELECT profile_id FROM network_profiles`).toEqual([
+      { profile_id: 'migration-test' },
+    ])
+    await database.sql`
+      INSERT INTO hosted_payloads (locator, digest_hex, content)
+      VALUES (${'b'.repeat(18)}, ${'b'.repeat(64)}, '{"retained":true}')
+    `
+    expect(
+      await database.sql`SELECT locator, content FROM hosted_payloads ORDER BY locator`,
+    ).toEqual([
+      { locator: 'b'.repeat(18), content: '{"retained":true}' },
+      { locator: 'b'.repeat(20), content: '{"retained":true}' },
+    ])
+  })
+
+  it('upgrades 0006 without rewriting accounts or existing presentation columns', async () => {
+    await migrateDatabase(database, await fixture(7))
+    await database.sql`INSERT INTO app_users(identity_issuer,identity_subject,display_name) VALUES ('https://identity.test','migration-recipient','Retained recipient')`
+    const users = await database.sql`SELECT * FROM app_users`
+    const columns =
+      await database.sql`SELECT column_name,data_type FROM information_schema.columns WHERE table_name='app_presentations' ORDER BY ordinal_position`
+    const history = await journalRows()
+    expect(await exists('public.app_verifier_history')).toBe(false)
+    await migrateDatabase(database)
+    expect(await database.sql`SELECT * FROM app_users`).toEqual(users)
+    expect(
+      await database.sql`SELECT column_name,data_type FROM information_schema.columns WHERE table_name='app_presentations' ORDER BY ordinal_position`,
+    ).toEqual(columns)
+    expect((await journalRows()).slice(0, history.length)).toEqual(history)
+    expect(await exists('public.app_verifier_history')).toBe(true)
+    expect(await database.sql`SELECT * FROM app_verifier_history`).toEqual([])
+  })
+
+  it('upgrades 0007 additively while preserving legacy unsigned presentations and session records', async () => {
+    await migrateDatabase(database, await fixture(8))
+    await database.sql`INSERT INTO app_users(identity_issuer,identity_subject,display_name) VALUES ('https://identity.test','proof-migration','Retained recipient')`
+    const users = await database.sql`SELECT * FROM app_users`
+    const columns =
+      await database.sql`SELECT column_name,data_type FROM information_schema.columns WHERE table_name='app_presentations' ORDER BY ordinal_position`
+    const history = await journalRows()
+    expect(await exists('public.app_presentation_challenges')).toBe(false)
+    await migrateDatabase(database)
+    expect(await database.sql`SELECT * FROM app_users`).toEqual(users)
+    expect(
+      await database.sql`SELECT column_name,data_type FROM information_schema.columns WHERE table_name='app_presentations' ORDER BY ordinal_position`,
+    ).toEqual(columns)
+    expect((await journalRows()).slice(0, history.length)).toEqual(history)
+    expect(await exists('public.app_presentation_challenges')).toBe(true)
+    expect(await database.sql`SELECT * FROM app_presentation_proofs`).toEqual([])
+  })
+
+  it.each(['tampered', 'future', 'nonprefix'] as const)(
+    'rejects %s history before executing pending DDL',
+    async (variant) => {
+      await migrateDatabase(database)
+      const folder = await additiveFixture('CREATE TABLE migration_probe (id integer);')
+      if (variant === 'tampered') {
+        await database.sql`UPDATE drizzle.__drizzle_migrations SET hash = ${'0'.repeat(64)} WHERE id = 1`
+      } else if (variant === 'future') {
+        await database.sql`
+          INSERT INTO drizzle.__drizzle_migrations (hash, created_at)
+          VALUES (${'f'.repeat(64)}, ${journal.entries.at(-1)!.when + 10})
+        `
+      } else {
+        await database.sql`DELETE FROM drizzle.__drizzle_migrations WHERE id = 1`
+      }
+      const before = await journalRows()
+      await expect(databaseMigrationStatus(database, folder)).rejects.toThrow(
+        'DATABASE_MIGRATION_HISTORY_MISMATCH',
+      )
+      await expect(migrateDatabase(database, folder)).rejects.toThrow(
+        'DATABASE_MIGRATION_HISTORY_MISMATCH',
+      )
+      expect(await exists('public.migration_probe')).toBe(false)
+      expect(await journalRows()).toEqual(before)
+    },
+  )
+
+  it('rejects an edited applied SQL file before executing a pending migration', async () => {
+    await migrateDatabase(database)
+    const before = await journalRows()
+    const folder = await additiveFixture('CREATE TABLE migration_probe (id integer);')
+    const appliedFile = join(folder, `${tags[0]}.sql`)
+    await writeFile(appliedFile, `${await readFile(appliedFile, 'utf8')}\n-- modified artifact\n`)
+
+    await expect(migrateDatabase(database, folder)).rejects.toThrow(
+      'DATABASE_MIGRATION_HISTORY_MISMATCH',
+    )
+    expect(await exists('public.migration_probe')).toBe(false)
+    expect(await journalRows()).toEqual(before)
+  })
+
+  it.each(['index', 'timestamp', 'order'] as const)(
+    'rejects an invalid catalog %s without creating the journal',
+    async (variant) => {
+      const folder = await fixture()
+      const entries = journal.entries.map((entry) => ({ ...entry }))
+      if (variant === 'index') entries[0]!.idx = 1
+      else if (variant === 'timestamp') entries[0]!.when = 0.5
+      else entries[1]!.when = entries[0]!.when
+      await writeFile(join(folder, 'meta/_journal.json'), JSON.stringify({ ...journal, entries }))
+
+      await expect(databaseMigrationStatus(database, folder)).rejects.toThrow(
+        'DATABASE_MIGRATION_CATALOG_INVALID',
+      )
+      await expect(migrateDatabase(database, folder)).rejects.toThrow(
+        'DATABASE_MIGRATION_CATALOG_INVALID',
+      )
+      expect(await exists('drizzle.__drizzle_migrations')).toBe(false)
+    },
+  )
+
+  it('rejects concurrent migration ownership and succeeds after its release', async () => {
+    const holder = await database.sql.reserve()
+    try {
+      await holder`SELECT pg_advisory_lock(1480807217, 2)`
+      await expect(migrateDatabase(database)).rejects.toThrow('DATABASE_MIGRATION_BUSY')
+      expect(await exists('drizzle.__drizzle_migrations')).toBe(false)
+    } finally {
+      await holder`SELECT pg_advisory_unlock(1480807217, 2)`
+      holder.release()
+    }
+    expect(await migrateDatabase(database)).toEqual({ applied: tags, pending: [] })
+  })
+
+  it('rolls back failed additive DDL and permits a corrected pending migration to retry', async () => {
+    await migrateDatabase(database)
+    const before = await journalRows()
+    const folder = await additiveFixture(
+      'CREATE TABLE migration_probe (id integer);--> statement-breakpoint\nSELECT * FROM migration_missing_relation;',
+    )
+    await expect(migrateDatabase(database, folder)).rejects.toThrow()
+    expect(await exists('public.migration_probe')).toBe(false)
+    expect(await journalRows()).toEqual(before)
+    const pending = await databaseMigrationStatus(database, folder)
+    expect(pending.applied).toEqual(tags)
+    expect(pending.pending).toHaveLength(1)
+
+    await writeFile(
+      join(folder, `${pending.pending[0]}.sql`),
+      'CREATE TABLE migration_probe (id integer);',
+    )
+    expect(await migrateDatabase(database, folder)).toEqual({
+      applied: [...tags, ...pending.pending],
+      pending: [],
+    })
+    expect(await exists('public.migration_probe')).toBe(true)
+  })
+
+  it('cannot perform DDL as a restricted runtime identity', async () => {
+    roleName = `xcs_migration_role_${randomUUID().replaceAll('-', '')}`
+    if (!temporaryNames.test(roleName)) throw new Error('Invalid test role name')
+    await administrator.sql`CREATE ROLE ${administrator.sql(roleName)} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE`
+    const runtimeRole = roleName
+    // Apply the identity inside a real transaction; rollback also resets the role.
+    const restrictedSql = new Proxy(database.sql, {
+      get(target, property, receiver) {
+        if (property === 'begin') {
+          return async (callback: (sql: TransactionSql) => Promise<unknown>) =>
+            database.sql.begin(async (transaction) => {
+              await transaction`SET LOCAL ROLE ${transaction(runtimeRole)}`
+              return callback(transaction)
+            })
+        }
+        return Reflect.get(target, property, receiver)
+      },
+    })
+    const restricted = {
+      ...database,
+      sql: restrictedSql,
+    }
+    await expect(migrateDatabase(restricted)).rejects.toMatchObject({ code: '42501' })
+    expect(await exists('drizzle.__drizzle_migrations')).toBe(false)
+  })
+})
diff --git a/apps/indexer/test/db/provision.test.ts b/apps/indexer/test/db/provision.test.ts
index 1ec875e..27fd69d 100644
--- a/apps/indexer/test/db/provision.test.ts
+++ b/apps/indexer/test/db/provision.test.ts
@@ -1,103 +1,87 @@
 import { describe, expect, it, vi } from 'vitest'
 
 import {
+  bootstrapDatabase,
   MissingRuntimeDatabaseRolesError,
-  UnsafeRuntimeDatabaseRolesError,
   parseDatabaseClusterScope,
   provisionRuntimeDatabasePrivileges,
+  UnsafeRuntimeDatabaseRolesError,
+  XCS_RUNTIME_DATABASE_ROLES,
 } from '../../src/lib/db/bootstrap.js'
 
 import type { DatabaseClient } from '../../src/lib/db/client.js'
 
-const ADMINISTRATOR = 'cluster_admin'
-
-function client(): DatabaseClient {
-  return {
-    db: {} as DatabaseClient['db'],
-    sql: {
-      begin: vi.fn(),
-    } as unknown as DatabaseClient['sql'],
-    close: vi.fn(),
-  }
+interface FakeDatabase extends DatabaseClient {
+  unsafeStatements: string[]
 }
 
-interface FakeRoleAttributes {
-  roleName: string
-  canLogin?: boolean
-  isSuperuser?: boolean
-  canCreateDatabase?: boolean
-  canCreateRole?: boolean
-  canReplicate?: boolean
-  canBypassRls?: boolean
-}
-
-interface FakeMembership {
-  grantedRole: string
-  memberRole: string
-}
+const ADMINISTRATOR = 'cluster_admin'
 
-/** A `sql` stand-in: the tagged template answers the advisory lock and the
- * `current_user` lookup, and `unsafe` answers the role-attribute and
- * role-membership reads and records every statement it is asked to apply. */
-function clientWithRoles(
-  existingRoles: readonly (string | FakeRoleAttributes)[],
-  memberships: readonly FakeMembership[] = [],
-  refuse: (statement: string) => boolean = () => false,
-): DatabaseClient {
-  const roles = existingRoles.map((role) => (typeof role === 'string' ? { roleName: role } : role))
-  const answer = (text: string): unknown[] => {
-    if (text.includes('rolcanlogin')) {
-      return roles.map((role) => ({
-        roleName: role.roleName,
-        canLogin: role.canLogin ?? true,
-        isSuperuser: role.isSuperuser ?? false,
-        canCreateDatabase: role.canCreateDatabase ?? false,
-        canCreateRole: role.canCreateRole ?? false,
-        canReplicate: role.canReplicate ?? false,
-        canBypassRls: role.canBypassRls ?? false,
-        connectionLimit: -1,
-        configuration: null,
-      }))
-    }
-    if (text.includes('pg_auth_members')) return [...memberships]
-    if (text.includes('current_user')) return [{ administrator: ADMINISTRATOR }]
-    return []
-  }
-  const sql = Object.assign(
-    (strings: TemplateStringsArray, ..._values: unknown[]) =>
-      Promise.resolve(answer(strings.join('?'))),
+function databaseWithRoles(
+  existingRoles: readonly string[],
+  options: {
+    unsafeAttributes?: readonly string[]
+    memberships?: ReadonlyArray<{ grantedRole: string; memberRole: string }>
+    monitorMembershipPresent?: boolean
+    refuse?: RegExp
+  } = {},
+): FakeDatabase {
+  const unsafeStatements: string[] = []
+  const transaction = Object.assign(
+    vi.fn(async (strings: TemplateStringsArray) => {
+      const statement = strings.join('?')
+      if (statement.includes('current_user')) return [{ administrator: ADMINISTRATOR }]
+      if (statement.includes('SELECT EXISTS') && statement.includes('pg_auth_members')) {
+        return [{ present: options.monitorMembershipPresent ?? false }]
+      }
+      return []
+    }),
     {
-      unsafe: vi.fn((text: string) =>
-        refuse(text)
-          ? Promise.reject(new Error('permission denied to alter role'))
-          : Promise.resolve(answer(text)),
-      ),
-      savepoint: vi.fn((handler: (inner: unknown) => Promise<void>) => handler(sql)),
-      begin: vi.fn((handler: (inner: unknown) => Promise<unknown>) => handler(sql)),
+      unsafe: vi.fn(async (statement: string) => {
+        unsafeStatements.push(statement)
+        if (statement.includes('FROM pg_roles')) {
+          return existingRoles.map((roleName) => ({
+            roleName,
+            canLogin: true,
+            isSuperuser: false,
+            canCreateDatabase: false,
+            canCreateRole: options.unsafeAttributes?.includes(roleName) ?? false,
+            canReplicate: false,
+            canBypassRls: false,
+            connectionLimit: -1,
+            configuration: [],
+          }))
+        }
+        if (statement.includes('FROM pg_auth_members')) return options.memberships ?? []
+        if (options.refuse?.test(statement)) throw new Error('statement refused')
+        return []
+      }),
+      savepoint: vi.fn(async (handler: (sql: unknown) => Promise<unknown>) => handler(transaction)),
     },
   )
   return {
     db: {} as DatabaseClient['db'],
-    sql: sql as unknown as DatabaseClient['sql'],
+    sql: {
+      begin: vi.fn(async (handler: (sql: typeof transaction) => Promise<unknown>) =>
+        handler(transaction),
+      ),
+    } as unknown as DatabaseClient['sql'],
     close: vi.fn(),
+    unsafeStatements,
   }
 }
 
-/** Only the statements provisioning applies, not the reads it answers with. */
-function appliedStatements(database: DatabaseClient): string {
-  return (database.sql.unsafe as unknown as { mock: { calls: [string][] } }).mock.calls
-    .map(([statement]) => statement)
-    .filter((statement) => !/^\s*SELECT/iu.test(statement))
-    .join('\n')
+function appliedStatements(database: FakeDatabase): string {
+  return database.unsafeStatements.filter((statement) => !/^\s*SELECT/iu.test(statement)).join('\n')
 }
 
 describe('runtime database privilege provisioning', () => {
-  it('requires an explicit dedicated-cluster acknowledgement', async () => {
+  it('requires an explicit dedicated-cluster acknowledgement before opening a transaction', async () => {
     expect(parseDatabaseClusterScope('dedicated')).toBe('dedicated')
     expect(() => parseDatabaseClusterScope(undefined)).toThrow('must be dedicated')
     expect(() => parseDatabaseClusterScope('shared')).toThrow('must be dedicated')
 
-    const database = client()
+    const database = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES)
     await expect(
       provisionRuntimeDatabasePrivileges(database, {
         clusterScope: 'shared' as 'dedicated',
@@ -107,83 +91,46 @@ describe('runtime database privilege provisioning', () => {
   })
 
   it.each([
-    [[], 'xcs_indexer, xcs_api, xcs_monitor'],
-    [['xcs_indexer', 'xcs_monitor'], 'xcs_api'],
-    [['xcs_indexer', 'xcs_api'], 'xcs_monitor'],
+    [[], XCS_RUNTIME_DATABASE_ROLES.join(', ')],
+    [
+      XCS_RUNTIME_DATABASE_ROLES.filter((role) => role !== 'xcs_payload_writer'),
+      'xcs_payload_writer',
+    ],
+    [XCS_RUNTIME_DATABASE_ROLES.filter((role) => role !== 'xcs_issuer'), 'xcs_issuer'],
   ])(
-    'fails by name when the managed database service has not created every role',
+    'fails by name before applying SQL when DigitalOcean has not created every user',
     async (existingRoles, expectedNames) => {
-      const database = clientWithRoles(existingRoles)
+      const database = databaseWithRoles(existingRoles)
 
-      await expect(
-        provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-      ).rejects.toThrow(MissingRuntimeDatabaseRolesError)
-      await expect(
-        provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-      ).rejects.toThrow(expectedNames)
+      const operation = provisionRuntimeDatabasePrivileges(database, {
+        clusterScope: 'dedicated',
+      })
+      await expect(operation).rejects.toBeInstanceOf(MissingRuntimeDatabaseRolesError)
+
+      const repeated = provisionRuntimeDatabasePrivileges(database, {
+        clusterScope: 'dedicated',
+      })
+      await expect(repeated).rejects.toThrow(expectedNames)
       await expect(
         provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
       ).rejects.toThrow('doctl databases user create')
-
-      // Nothing was applied: the run stops before any grant.
       expect(appliedStatements(database)).toBe('')
     },
   )
 
-  it.each([
-    [{ roleName: 'xcs_api', canLogin: false }, 'xcs_api cannot log in'],
-    [{ roleName: 'xcs_api', isSuperuser: true }, 'xcs_api is a superuser'],
-    [{ roleName: 'xcs_api', canCreateDatabase: true }, 'xcs_api can create databases'],
-    [{ roleName: 'xcs_api', canCreateRole: true }, 'xcs_api can create roles'],
-    [{ roleName: 'xcs_api', canReplicate: true }, 'xcs_api can replicate'],
-    [{ roleName: 'xcs_api', canBypassRls: true }, 'xcs_api can bypass row-level security'],
-  ])('refuses an unsafe role attribute by name instead of altering it', async (role, expected) => {
-    const database = clientWithRoles(['xcs_indexer', role, 'xcs_monitor'])
-
-    await expect(
-      provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-    ).rejects.toBeInstanceOf(UnsafeRuntimeDatabaseRolesError)
-    await expect(
-      provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-    ).rejects.toThrow(expected)
-    expect(appliedStatements(database)).toBe('')
-  })
-
-  it('accepts the cluster administrator as a member of every runtime role', async () => {
-    const database = clientWithRoles(
-      ['xcs_indexer', 'xcs_api', 'xcs_monitor'],
-      [
-        { grantedRole: 'pg_monitor', memberRole: 'xcs_monitor' },
-        { grantedRole: 'xcs_indexer', memberRole: ADMINISTRATOR },
-        { grantedRole: 'xcs_api', memberRole: ADMINISTRATOR },
-        { grantedRole: 'xcs_monitor', memberRole: ADMINISTRATOR },
-      ],
+  it('checks every managed user before bootstrap migration DDL', async () => {
+    const database = databaseWithRoles(
+      XCS_RUNTIME_DATABASE_ROLES.filter((role) => role !== 'xcs_admin_app'),
     )
 
-    await expect(
-      provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-    ).resolves.toEqual({ administrator: ADMINISTRATOR, unappliedResourceControls: [] })
-    expect(appliedStatements(database)).not.toMatch(/REVOKE\s+xcs_\w+\s+FROM/iu)
-  })
-
-  it.each([
-    [{ grantedRole: 'xcs_api', memberRole: 'xcs_indexer' }, 'xcs_indexer is a member of xcs_api'],
-    [{ grantedRole: 'pg_monitor', memberRole: 'xcs_api' }, 'xcs_api is a member of pg_monitor'],
-    [
-      { grantedRole: 'xcs_api', memberRole: 'someone_else' },
-      'someone_else is a member of xcs_api but is not the cluster administrator',
-    ],
-  ])('refuses a membership the managed service did not need', async (membership, expected) => {
-    const database = clientWithRoles(['xcs_indexer', 'xcs_api', 'xcs_monitor'], [membership])
-
-    await expect(
-      provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
-    ).rejects.toThrow(expected)
+    await expect(bootstrapDatabase(database, { clusterScope: 'dedicated' })).rejects.toThrow(
+      'xcs_admin_app',
+    )
     expect(appliedStatements(database)).toBe('')
   })
 
-  it('never creates a role, sets a password, revokes login or alters a security attribute', async () => {
-    const database = clientWithRoles(['xcs_indexer', 'xcs_api', 'xcs_monitor'])
+  it('validates and grants all eight users without managing their roles or authentication', async () => {
+    const database = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES)
 
     await expect(
       provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
@@ -194,34 +141,84 @@ describe('runtime database privilege provisioning', () => {
     expect(applied).not.toMatch(/PASSWORD/iu)
     expect(applied).not.toMatch(/NOLOGIN/iu)
     expect(applied).not.toMatch(/VALID UNTIL/iu)
-    // Role attributes are verified, never altered: these are the ones a managed
-    // cluster's administrator has no privilege to change.
+    expect(applied).not.toMatch(/RESET ALL/iu)
     for (const attribute of ['SUPERUSER', 'CREATEDB', 'CREATEROLE', 'REPLICATION', 'BYPASSRLS']) {
       expect(applied).not.toContain(attribute)
     }
-    expect(applied).not.toMatch(/RESET ALL/iu)
-    expect(applied).toContain('GRANT pg_monitor TO xcs_monitor')
-    // Resource controls are still applied, one statement each.
-    for (const role of ['xcs_indexer', 'xcs_api', 'xcs_monitor']) {
-      expect(applied).toContain(`ALTER ROLE ${role} WITH CONNECTION LIMIT`)
-      expect(applied).toContain(`ALTER ROLE ${role} SET statement_timeout`)
-      expect(applied).toContain(`ALTER ROLE ${role} SET lock_timeout`)
-      expect(applied).toContain(`ALTER ROLE ${role} SET idle_in_transaction_session_timeout`)
+    for (const role of XCS_RUNTIME_DATABASE_ROLES) {
+      expect(applied).toContain(role)
     }
+    expect(applied).toContain('GRANT pg_monitor TO xcs_monitor')
+    expect(applied).toContain('hosted_payloads, hosted_payload_publications TO xcs_payload_writer')
+    expect(applied).toContain(
+      'app_sessions, app_auth_transactions, app_wallet_challenges TO xcs_app',
+    )
+    expect(applied).toContain('app_admin_decisions, app_admin_notifications TO xcs_admin_app')
+    expect(applied).toContain('app_admin_notifications, app_admin_decisions TO xcs_notifier')
+    expect(applied).toContain('app_presentation_proofs TO xcs_issuer')
   })
 
-  it('reports a resource control the cluster refused and that is not in effect', async () => {
-    const database = clientWithRoles(['xcs_indexer', 'xcs_api', 'xcs_monitor'], [], (statement) =>
-      statement.startsWith('ALTER ROLE xcs_api SET lock_timeout'),
-    )
+  it('fails closed on elevated attributes or unexpected memberships', async () => {
+    const elevated = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      unsafeAttributes: ['xcs_api'],
+    })
+    await expect(
+      provisionRuntimeDatabasePrivileges(elevated, { clusterScope: 'dedicated' }),
+    ).rejects.toBeInstanceOf(UnsafeRuntimeDatabaseRolesError)
+    expect(appliedStatements(elevated)).toBe('')
 
-    const report = await provisionRuntimeDatabasePrivileges(database, {
-      clusterScope: 'dedicated',
+    const delegated = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      memberships: [{ grantedRole: 'xcs_issuer', memberRole: 'xcs_app' }],
     })
-    expect(report.unappliedResourceControls).toEqual([
-      { role: 'xcs_api', control: 'lock_timeout', intended: '15s', actual: 'unset' },
-    ])
-    // The grants were still applied: a missing timeout must not cost them.
-    expect(appliedStatements(database)).toContain('GRANT pg_monitor TO xcs_monitor')
+    await expect(
+      provisionRuntimeDatabasePrivileges(delegated, { clusterScope: 'dedicated' }),
+    ).rejects.toThrow('xcs_app, xcs_issuer')
+    expect(appliedStatements(delegated)).toBe('')
+
+    const administered = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      memberships: XCS_RUNTIME_DATABASE_ROLES.map((grantedRole) => ({
+        grantedRole,
+        memberRole: ADMINISTRATOR,
+      })),
+    })
+    await expect(
+      provisionRuntimeDatabasePrivileges(administered, { clusterScope: 'dedicated' }),
+    ).resolves.toEqual({ administrator: ADMINISTRATOR, unappliedResourceControls: [] })
+
+    const monitor = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      memberships: [{ grantedRole: 'pg_monitor', memberRole: 'xcs_monitor' }],
+    })
+    await expect(
+      provisionRuntimeDatabasePrivileges(monitor, { clusterScope: 'dedicated' }),
+    ).resolves.toEqual({ administrator: ADMINISTRATOR, unappliedResourceControls: [] })
+  })
+
+  it('reports a refused pg_monitor grant without rolling back application grants', async () => {
+    const database = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      refuse: /^GRANT pg_monitor/iu,
+    })
+
+    await expect(
+      provisionRuntimeDatabasePrivileges(database, { clusterScope: 'dedicated' }),
+    ).resolves.toEqual({
+      administrator: ADMINISTRATOR,
+      unappliedResourceControls: [
+        {
+          role: 'xcs_monitor',
+          control: 'pg_monitor membership',
+          intended: 'granted',
+          actual: 'absent',
+        },
+      ],
+    })
+    expect(appliedStatements(database)).toContain('app_presentation_proofs TO xcs_issuer')
+
+    const alreadyHeld = databaseWithRoles(XCS_RUNTIME_DATABASE_ROLES, {
+      refuse: /^GRANT pg_monitor/iu,
+      monitorMembershipPresent: true,
+    })
+    await expect(
+      provisionRuntimeDatabasePrivileges(alreadyHeld, { clusterScope: 'dedicated' }),
+    ).resolves.toEqual({ administrator: ADMINISTRATOR, unappliedResourceControls: [] })
   })
 })
diff --git a/apps/indexer/test/db/schema.test.ts b/apps/indexer/test/db/schema.test.ts
index 23521db..5fe3215 100644
--- a/apps/indexer/test/db/schema.test.ts
+++ b/apps/indexer/test/db/schema.test.ts
@@ -15,7 +15,7 @@ import {
   pinChallenges,
   schemaEvents,
   schemas,
-} from '#db/schema'
+} from '#db/schema/index.js'
 
 const DRIZZLE_DIRECTORY = new URL('../../../../db/migrations/', import.meta.url)
 
@@ -111,13 +111,33 @@ describe('database schema', () => {
     expect(indexerStatuses.leaseExpiresAt.notNull).toBe(false)
   })
 
-  it('ships one generated baseline instead of pre-production migration history', () => {
+  it('preserves deployed migrations and appends the application model', () => {
     const migrationFiles = readdirSync(DRIZZLE_DIRECTORY).filter((name) => name.endsWith('.sql'))
     const snapshotFiles = readdirSync(new URL('meta/', DRIZZLE_DIRECTORY)).filter((name) =>
       name.endsWith('_snapshot.json'),
     )
-    expect(migrationFiles).toEqual(['0000_baseline.sql'])
-    expect(snapshotFiles).toEqual(['0000_snapshot.json'])
+    expect(migrationFiles).toEqual([
+      '0000_baseline.sql',
+      '0001_hosted_payloads.sql',
+      '0002_hosted_payload_locator_compatibility.sql',
+      '0003_application_model.sql',
+      '0004_auth_sessions.sql',
+      '0005_admin_review.sql',
+      '0006_issuer_workspace.sql',
+      '0007_recipient_verifier.sql',
+      '0008_presentation_wallet_proof.sql',
+    ])
+    expect(snapshotFiles).toEqual([
+      '0000_snapshot.json',
+      '0001_snapshot.json',
+      '0002_snapshot.json',
+      '0003_snapshot.json',
+      '0004_snapshot.json',
+      '0005_snapshot.json',
+      '0006_snapshot.json',
+      '0007_snapshot.json',
+      '0008_snapshot.json',
+    ])
 
     const baseline = readFileSync(new URL('0000_baseline.sql', DRIZZLE_DIRECTORY), 'utf8')
     expect(baseline).toContain('CREATE TABLE "ledger_checkpoints"')
@@ -129,6 +149,29 @@ describe('database schema', () => {
     const journal = JSON.parse(
       readFileSync(new URL('meta/_journal.json', DRIZZLE_DIRECTORY), 'utf8'),
     ) as { entries: Array<{ idx: number; tag: string }> }
-    expect(journal.entries).toEqual([expect.objectContaining({ idx: 0, tag: '0000_baseline' })])
+    expect(journal.entries).toEqual([
+      expect.objectContaining({ idx: 0, tag: '0000_baseline' }),
+      expect.objectContaining({ idx: 1, tag: '0001_hosted_payloads' }),
+      expect.objectContaining({ idx: 2, tag: '0002_hosted_payload_locator_compatibility' }),
+      expect.objectContaining({ idx: 3, tag: '0003_application_model' }),
+      expect.objectContaining({ idx: 4, tag: '0004_auth_sessions' }),
+      expect.objectContaining({ idx: 5, tag: '0005_admin_review' }),
+      expect.objectContaining({ idx: 6, tag: '0006_issuer_workspace' }),
+      expect.objectContaining({ idx: 7, tag: '0007_recipient_verifier' }),
+      expect.objectContaining({ idx: 8, tag: '0008_presentation_wallet_proof' }),
+    ])
+
+    const previous = JSON.parse(
+      readFileSync(new URL('meta/0002_snapshot.json', DRIZZLE_DIRECTORY), 'utf8'),
+    ) as { tables: Record<string, unknown> }
+    const current = JSON.parse(
+      readFileSync(new URL('meta/0003_snapshot.json', DRIZZLE_DIRECTORY), 'utf8'),
+    ) as { tables: Record<string, unknown> }
+    for (const [name, definition] of Object.entries(previous.tables)) {
+      expect(current.tables[name]).toEqual(definition)
+    }
+    expect(Object.keys(current.tables).filter((name) => !(name in previous.tables))).toHaveLength(
+      10,
+    )
   })
 })
diff --git a/apps/indexer/test/db/serializable.test.ts b/apps/indexer/test/db/serializable.test.ts
index dbc8004..e7d1d89 100644
--- a/apps/indexer/test/db/serializable.test.ts
+++ b/apps/indexer/test/db/serializable.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 
-import type { XcsDatabase } from '../../src/lib/db/client.js'
-import { runSerializableTransaction } from '../../src/lib/db/transactions.js'
+import { runSerializableTransaction, type XcsDatabase } from '../../src/lib/db/index.js'
 
 function databaseWithResults(results: unknown[]) {
   const transaction = vi.fn(
diff --git a/apps/indexer/test/generative-extraction.test.ts b/apps/indexer/test/generative-extraction.test.ts
index 49715b0..7019e24 100644
--- a/apps/indexer/test/generative-extraction.test.ts
+++ b/apps/indexer/test/generative-extraction.test.ts
@@ -290,14 +290,14 @@ describe('generative indexer extraction', () => {
       },
       {
         name: 'malformed JSON',
-        reasonCode: 'INVALID_JSON',
+        reasonCode: 'JSON_INVALID',
         mutate: (candidate) => {
           registrationMemo(candidate).MemoData = utf8Hex('{"xcsVersion":')
         },
       },
       {
         name: 'invalid schema',
-        reasonCode: 'INVALID_SCHEMA',
+        reasonCode: 'SCHEMA_INVALID',
         mutate: (candidate) => {
           const invalidSchema = { ...schema, future: true } as unknown as JsonValue
           registrationMemo(candidate).MemoData = utf8Hex(canonicalJson(invalidSchema))
diff --git a/apps/indexer/test/helpers/managedRuntimeUsers.ts b/apps/indexer/test/helpers/managedRuntimeUsers.ts
new file mode 100644
index 0000000..2474b52
--- /dev/null
+++ b/apps/indexer/test/helpers/managedRuntimeUsers.ts
@@ -0,0 +1,70 @@
+import type { DatabaseClient } from '../../src/lib/db/client.js'
+
+const PASSWORD_PATTERN = /^[A-Za-z0-9_-]{32,256}$/u
+
+export interface ManagedRuntimeDatabasePasswords {
+  indexerPassword: string
+  apiPassword: string
+  payloadWriterPassword: string
+  monitorPassword: string
+  applicationPassword: string
+  adminApplicationPassword: string
+  notifierPassword: string
+  issuerPassword: string
+}
+
+export const MANAGED_RUNTIME_DATABASE_PASSWORDS: ManagedRuntimeDatabasePasswords = {
+  indexerPassword: 'integration-only-indexer-password-0001',
+  apiPassword: 'integration-only-api-password-00000001',
+  payloadWriterPassword: 'integration-only-payload-password-001',
+  monitorPassword: 'integration-only-monitor-password-0001',
+  applicationPassword: 'integration-only-application-password-1',
+  adminApplicationPassword: 'integration-only-admin-password-00001',
+  notifierPassword: 'integration-only-notifier-password-001',
+  issuerPassword: 'integration-only-issuer-password-00001',
+}
+
+const ROLE_PASSWORD_PROPERTIES = [
+  ['xcs_indexer', 'indexerPassword'],
+  ['xcs_api', 'apiPassword'],
+  ['xcs_payload_writer', 'payloadWriterPassword'],
+  ['xcs_monitor', 'monitorPassword'],
+  ['xcs_app', 'applicationPassword'],
+  ['xcs_admin_app', 'adminApplicationPassword'],
+  ['xcs_notifier', 'notifierPassword'],
+  ['xcs_issuer', 'issuerPassword'],
+] as const
+
+/**
+ * Test-only stand-in for DigitalOcean. Production bootstrap must never call this:
+ * the managed database service creates the users and owns their passwords.
+ */
+export async function createManagedRuntimeDatabaseUsers(
+  administrator: DatabaseClient,
+  overrides: Partial<ManagedRuntimeDatabasePasswords> = {},
+): Promise<ManagedRuntimeDatabasePasswords> {
+  const passwords = { ...MANAGED_RUNTIME_DATABASE_PASSWORDS, ...overrides }
+  for (const [, property] of ROLE_PASSWORD_PROPERTIES) {
+    if (!PASSWORD_PATTERN.test(passwords[property])) {
+      throw new Error(`Invalid test password for ${property}`)
+    }
+  }
+
+  // Role names are fixed constants and passwords are constrained above to URL-safe
+  // characters. PostgreSQL utility statements do not accept password parameters.
+  await administrator.sql.unsafe(
+    ROLE_PASSWORD_PROPERTIES.map(
+      ([role, property]) => `
+        DO $xcs_test_user$
+        BEGIN
+          IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+            CREATE ROLE ${role} LOGIN;
+          END IF;
+        END
+        $xcs_test_user$;
+        ALTER ROLE ${role} WITH LOGIN PASSWORD '${passwords[property]}';
+      `,
+    ).join('\n'),
+  )
+  return passwords
+}
diff --git a/apps/indexer/test/lib/xcs/credential.test.ts b/apps/indexer/test/lib/xcs/credential.test.ts
index f524179..8d54dcf 100644
--- a/apps/indexer/test/lib/xcs/credential.test.ts
+++ b/apps/indexer/test/lib/xcs/credential.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/credential.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/credential.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -30,7 +30,7 @@ describe('credential payload', () => {
     expect(parseCredentialPayload(encoded.bytes, context)).toEqual(encoded.payload)
     expect(encoded.json).toBe(new TextDecoder().decode(encoded.bytes))
     expect(() => parseCredentialPayload(`${encoded.json}\n`, context)).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'PAYLOAD_INVALID' }),
     )
   })
 
@@ -60,4 +60,28 @@ describe('credential payload', () => {
       verifyCredentialPayload({ status: 'retrieved', content: encoded.bytes }, uri, context),
     ).toBe('valid')
   })
+
+  it.each([{ courseId: '\ud800', passed: true }, { '\ud800': 'xcs-101' }])(
+    'reports malformed Unicode in payload values or keys as invalid',
+    (claims) => {
+      const content = JSON.stringify({
+        claims,
+        issuer: context.issuer,
+        schema: context.schemaUid,
+        subject: context.subject,
+        xcsVersion: '0.1',
+      })
+      const uri = createIpfsPayloadUri(content)
+
+      expect(verifyCredentialPayload({ status: 'retrieved', content }, uri, context)).toBe(
+        'invalid',
+      )
+    },
+  )
+
+  it('preserves valid Unicode including surrogate pairs', () => {
+    const encoded = encodeCredentialPayload({ courseId: 'Cours réussi 🎓', passed: true }, context)
+
+    expect(parseCredentialPayload(encoded.bytes, context).claims.courseId).toBe('Cours réussi 🎓')
+  })
 })
diff --git a/apps/indexer/test/lib/xcs/network-lifecycle.test.ts b/apps/indexer/test/lib/xcs/network-lifecycle.test.ts
index b75ba94..8888e31 100644
--- a/apps/indexer/test/lib/xcs/network-lifecycle.test.ts
+++ b/apps/indexer/test/lib/xcs/network-lifecycle.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/network-lifecycle.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/network-lifecycle.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -27,7 +27,7 @@ describe('network and native lifecycle', () => {
   it('wraps xrpl.js Ripple-time conversion with strict protocol bounds', () => {
     expect(rippleTimeToIso(0)).toBe('2000-01-01T00:00:00.000Z')
     expect(() => rippleTimeToIso(-1)).toThrow(
-      expect.objectContaining({ code: 'INVALID_RIPPLE_TIME' }),
+      expect.objectContaining({ code: 'RIPPLE_TIME_INVALID' }),
     )
   })
 
diff --git a/apps/indexer/test/lib/xcs/schema.test.ts b/apps/indexer/test/lib/xcs/schema.test.ts
index 333b15f..b0acef2 100644
--- a/apps/indexer/test/lib/xcs/schema.test.ts
+++ b/apps/indexer/test/lib/xcs/schema.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/schema.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/schema.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -45,7 +45,7 @@ describe('schema', () => {
     )
     expect(parseSchemaBytes(canonical).name).toBe('Schema')
     expect(() => parseSchemaBytes(new TextEncoder().encode('{ "xcsVersion": "0.1" }'))).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'JSON_INVALID' }),
     )
     expect(() =>
       parseSchemaBytes(
@@ -53,7 +53,7 @@ describe('schema', () => {
           '{"description":"First","description":"Second","fields":{"value":{"type":"string"}},"name":"Schema","xcsVersion":"0.1"}',
         ),
       ),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_JSON' }))
+    ).toThrow(expect.objectContaining({ code: 'JSON_DUPLICATE_KEY' }))
   })
 
   it('resolves prior parents and rejects field overrides', () => {
@@ -89,7 +89,7 @@ describe('schema', () => {
     expect(Object.keys(resolveSchema(child, context).fields)).toEqual(['courseId', 'score'])
     expect(() =>
       resolveSchema(parseSchema({ ...child, fields: { courseId: { type: 'bool' } } }), context),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_SCHEMA_REFERENCE' }))
+    ).toThrow(expect.objectContaining({ code: 'SCHEMA_OVERRIDE_FORBIDDEN' }))
   })
 
   it('derives the published schema UID with noble SHA-256', () => {
diff --git a/apps/indexer/test/postgres.integration.test.ts b/apps/indexer/test/postgres.integration.test.ts
index a5b6805..ccb1179 100644
--- a/apps/indexer/test/postgres.integration.test.ts
+++ b/apps/indexer/test/postgres.integration.test.ts
@@ -1,40 +1,41 @@
-import { randomUUID } from 'node:crypto'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { createHash, randomUUID } from 'node:crypto'
+import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 import {
+  acquireIndexerLease,
   credentialEvents,
   credentialGenerations,
+  createDatabaseClient,
+  haltIndexer,
   indexerIncidents,
   indexerStatuses,
   ledgerCheckpoints,
-  schemaEvents,
-  schemas,
-} from '#db/schema'
-import { type DatabaseClient, createDatabaseClient } from '../src/lib/db/client.js'
-import {
-  acquireIndexerLease,
-  haltIndexer,
   releaseIndexerLease,
   renewIndexerLease,
+  schemaEvents,
+  schemas,
   updateIndexerStatus,
-} from '../src/lib/db/indexer-fencing.js'
+  type DatabaseClient,
+} from '../src/lib/db/index.js'
 import {
+  initializeDatabase,
+  provisionRuntimeDatabasePrivileges,
   XCS_API_DATABASE_CONNECTION_LIMIT,
   XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
   XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
-  MissingRuntimeDatabaseRolesError,
-  UnsafeRuntimeDatabaseRolesError,
-  initializeDatabase,
-  provisionRuntimeDatabasePrivileges,
+  XCS_RUNTIME_DATABASE_ROLES,
 } from '../src/lib/db/bootstrap.js'
 import { computeSchemaUid, createIpfsPayloadUri, type JsonValue } from '../src/lib/xcs/index.js'
 import { and, asc, eq } from 'drizzle-orm'
+import { migrate } from 'drizzle-orm/postgres-js/migrator'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
 import { captureLedgerFixtureBundle, ledgerFixtureBundleDigest } from '../src/fixture-bundle.js'
 import { prepareFixtureReplay } from '../src/fixture-replay.js'
+import { createManagedRuntimeDatabaseUsers } from './helpers/managedRuntimeUsers.js'
 import { computeProjectionDigest } from '../src/projection-digest.js'
 import { QuorumLedgerSource } from '../src/quorum-ledger-source.js'
 import { PostgresIndexerRepository } from '../src/repository.js'
@@ -112,6 +113,7 @@ let runtimeRoleCleanupAllowed = false
 
 const INDEXER_DATABASE_PASSWORD = 'indexer-integration-password-000001'
 const API_DATABASE_PASSWORD = 'api-integration-password-0000000001'
+const PAYLOAD_DATABASE_PASSWORD = 'payload-integration-password-00000001'
 const MONITOR_DATABASE_PASSWORD = 'monitor-integration-password-00000001'
 
 function temporaryDatabaseName(): string {
@@ -164,7 +166,12 @@ async function closeAndDropTemporaryDatabases(): Promise<void> {
           DROP ROLE IF EXISTS
             xcs_indexer,
             xcs_api,
-            xcs_monitor
+            xcs_payload_writer,
+            xcs_monitor,
+            xcs_app,
+            xcs_admin_app,
+            xcs_notifier,
+            xcs_issuer
         `
         runtimeRoleCleanupAllowed = false
       } catch (error) {
@@ -824,6 +831,58 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
     expect(integrityConstraints.every((constraint) => constraint.validated)).toBe(true)
   })
 
+  it('upgrades the baseline and legacy hosted storage without losing profiles or payloads', async () => {
+    if (adminDatabaseUrl === undefined) throw new Error('PostgreSQL admin URL is not initialized')
+    const database = await createTemporaryDatabase(adminDatabaseUrl, { initialize: false })
+    const source = fileURLToPath(new URL('../../../db/migrations/', import.meta.url))
+    const fixture = await mkdtemp(join(tmpdir(), 'xcs-migration-upgrade-'))
+    const journal = JSON.parse(await readFile(join(source, 'meta/_journal.json'), 'utf8'))
+    const content = '{"course":"test-upgrade"}'
+    const digest = createHash('sha256').update(content).digest('hex')
+    try {
+      await mkdir(join(fixture, 'meta'))
+      for (const count of [1, 2]) {
+        const entries = journal.entries.slice(0, count)
+        for (const entry of entries) {
+          await copyFile(join(source, `${entry.tag}.sql`), join(fixture, `${entry.tag}.sql`))
+        }
+        await writeFile(
+          join(fixture, 'meta/_journal.json'),
+          JSON.stringify({ ...journal, entries }),
+        )
+        await migrate(database.client.db, { migrationsFolder: fixture })
+        if (count === 1) {
+          await new PostgresIndexerRepository(database.client.db).initializeProfile(
+            profile('upgrade'),
+          )
+        } else {
+          await database.client.sql`
+            INSERT INTO hosted_payloads (locator, digest_hex, content)
+            VALUES (${digest.slice(0, 20)}, ${digest}, ${content})
+          `
+        }
+      }
+      await initializeDatabase(database.client)
+      await initializeDatabase(database.client)
+      const profiles = await database.client.sql`SELECT profile_id FROM network_profiles`
+      expect(profiles.map((row) => row.profile_id)).toEqual(['upgrade'])
+      // The same bytes may have an old 20-character link and a new 18-character link.
+      await database.client.sql`
+        INSERT INTO hosted_payloads (locator, digest_hex, content)
+        VALUES (${digest.slice(0, 18)}, ${digest}, ${content})
+      `
+      const payloads = await database.client.sql`
+        SELECT locator, content FROM hosted_payloads ORDER BY length(locator)
+      `
+      expect(payloads).toEqual([
+        { locator: digest.slice(0, 18), content },
+        { locator: digest.slice(0, 20), content },
+      ])
+    } finally {
+      await rm(fixture, { recursive: true, force: true })
+    }
+  })
+
   it('allows exact restarts but rejects another profile in exclusive database scope', async () => {
     if (adminDatabaseUrl === undefined) throw new Error('PostgreSQL admin URL is not initialized')
     const database = await createTemporaryDatabase(adminDatabaseUrl)
@@ -861,67 +920,37 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
     })
   })
 
-  it('provisions idempotent least-privilege indexer, API and monitor roles', async () => {
+  it('provisions idempotent least-privilege indexer, read API, payload writer and monitor roles', async () => {
     const database = temporaryDatabases[0]
     if (database === undefined) throw new Error('First temporary database was not created')
     if (adminClient === undefined) throw new Error('PostgreSQL admin client is not initialized')
 
     const provisioning = { clusterScope: 'dedicated' } as const
 
-    // The roles do not exist yet: provisioning is grants-only and must say so by name.
-    await expect(
-      provisionRuntimeDatabasePrivileges(database.client, provisioning),
-    ).rejects.toBeInstanceOf(MissingRuntimeDatabaseRolesError)
-    await expect(provisionRuntimeDatabasePrivileges(database.client, provisioning)).rejects.toThrow(
-      'xcs_indexer, xcs_api, xcs_monitor',
-    )
-
-    // Stands in for the managed database service: it, not this step, owns the
-    // users and their passwords.
     runtimeRoleCleanupAllowed = true
-    await adminClient.sql.unsafe(`
-      CREATE ROLE xcs_indexer LOGIN PASSWORD '${INDEXER_DATABASE_PASSWORD}';
-      CREATE ROLE xcs_api LOGIN PASSWORD '${API_DATABASE_PASSWORD}';
-      CREATE ROLE xcs_monitor LOGIN PASSWORD '${MONITOR_DATABASE_PASSWORD}';
-      GRANT xcs_indexer, xcs_api, xcs_monitor TO CURRENT_USER WITH ADMIN OPTION;
-    `)
-
-    // Reproduces a managed cluster: the platform makes its administrator a
-    // member of every user it creates. That membership is how the service
-    // administers those users, so provisioning accepts it instead of trying to
-    // revoke it -- which the administrator cannot do, not being the grantor.
-    const firstRun = await provisionRuntimeDatabasePrivileges(database.client, provisioning)
-    const secondRun = await provisionRuntimeDatabasePrivileges(database.client, provisioning)
-    const [session] = await adminClient.sql<{ administrator: string }[]>`
-      SELECT current_user AS "administrator"
+    await createManagedRuntimeDatabaseUsers(adminClient, {
+      indexerPassword: INDEXER_DATABASE_PASSWORD,
+      apiPassword: API_DATABASE_PASSWORD,
+      payloadWriterPassword: PAYLOAD_DATABASE_PASSWORD,
+      monitorPassword: MONITOR_DATABASE_PASSWORD,
+    })
+    const firstReport = await provisionRuntimeDatabasePrivileges(database.client, provisioning)
+    expect(firstReport).toEqual({
+      administrator: expect.any(String),
+      unappliedResourceControls: [],
+    })
+    // Simulate the pre-split API grants: reprovisioning must remove them, not just add a writer.
+    await database.client.sql`
+      GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE pin_challenges, demo_pins TO xcs_api
+    `
+    await database.client.sql`
+      GRANT SELECT, INSERT ON TABLE hosted_payloads, hosted_payload_publications TO xcs_api
     `
-    expect(firstRun).toEqual({
-      administrator: session?.administrator,
+    const repeatedReport = await provisionRuntimeDatabasePrivileges(database.client, provisioning)
+    expect(repeatedReport).toEqual({
+      administrator: firstReport.administrator,
       unappliedResourceControls: [],
     })
-    expect(secondRun).toEqual(firstRun)
-
-    // An unsafe attribute is verified, not altered away: provisioning cannot
-    // change it without a superuser, so it refuses and names the role.
-    await adminClient.sql.unsafe('ALTER ROLE xcs_api WITH CREATEDB')
-    await expect(
-      provisionRuntimeDatabasePrivileges(database.client, provisioning),
-    ).rejects.toBeInstanceOf(UnsafeRuntimeDatabaseRolesError)
-    await expect(provisionRuntimeDatabasePrivileges(database.client, provisioning)).rejects.toThrow(
-      'xcs_api can create databases',
-    )
-    await adminClient.sql.unsafe('ALTER ROLE xcs_api WITH NOCREATEDB')
-
-    // A membership between two runtime roles, or held by anyone other than the
-    // cluster administrator, is still rejected.
-    await adminClient.sql.unsafe('GRANT xcs_api TO xcs_indexer')
-    await expect(provisionRuntimeDatabasePrivileges(database.client, provisioning)).rejects.toThrow(
-      'xcs_indexer is a member of xcs_api',
-    )
-    await adminClient.sql.unsafe('REVOKE xcs_api FROM xcs_indexer')
-
-    // And the cluster is back to a state provisioning accepts.
-    await provisionRuntimeDatabasePrivileges(database.client, provisioning)
 
     const roleProperties = await adminClient.sql<
       Array<{
@@ -953,46 +982,19 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
           ORDER BY setting
         ) AS configuration
       FROM pg_roles
-      WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+      WHERE rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
       ORDER BY rolname
     `
-    expect(roleProperties).toEqual([
-      {
-        roleName: 'xcs_api',
-        canLogin: true,
-        isSuperuser: false,
-        canCreateDatabase: false,
-        canCreateRole: false,
-        canReplicate: false,
-        canBypassRls: false,
-        // Left as the managed service created it: INHERIT is not in the unsafe
-        // set, and with no membership beyond pg_monitor -> xcs_monitor it is inert.
-        inheritsPrivileges: true,
-        connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
-        configuration: [
-          'idle_in_transaction_session_timeout=30s',
-          'lock_timeout=15s',
-          'statement_timeout=30s',
-        ],
-      },
-      {
-        roleName: 'xcs_indexer',
-        canLogin: true,
-        isSuperuser: false,
-        canCreateDatabase: false,
-        canCreateRole: false,
-        canReplicate: false,
-        canBypassRls: false,
-        inheritsPrivileges: true,
-        connectionLimit: XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
-        configuration: [
-          'idle_in_transaction_session_timeout=30s',
-          'lock_timeout=30s',
-          'statement_timeout=5min',
-        ],
-      },
-      {
-        roleName: 'xcs_monitor',
+    expect(roleProperties.map(({ roleName }) => roleName)).toEqual(
+      [...XCS_RUNTIME_DATABASE_ROLES].sort(),
+    )
+    for (const role of roleProperties) {
+      const monitor = role.roleName === 'xcs_monitor'
+      const indexer = role.roleName === 'xcs_indexer'
+      expect(role).toMatchObject({
         canLogin: true,
         isSuperuser: false,
         canCreateDatabase: false,
@@ -1000,14 +1002,18 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
         canReplicate: false,
         canBypassRls: false,
         inheritsPrivileges: true,
-        connectionLimit: XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
+        connectionLimit: monitor
+          ? XCS_MONITOR_DATABASE_CONNECTION_LIMIT
+          : indexer
+            ? XCS_INDEXER_DATABASE_CONNECTION_LIMIT
+            : XCS_API_DATABASE_CONNECTION_LIMIT,
         configuration: [
           'idle_in_transaction_session_timeout=30s',
-          'lock_timeout=10s',
-          'statement_timeout=30s',
+          `lock_timeout=${monitor ? '10s' : indexer ? '30s' : '15s'}`,
+          `statement_timeout=${indexer ? '5min' : '30s'}`,
         ],
-      },
-    ])
+      })
+    }
 
     const runtimeMemberships = await adminClient.sql<
       Array<{
@@ -1027,7 +1033,10 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
       FROM pg_auth_members membership
       JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
       JOIN pg_roles member_role ON member_role.oid = membership.member
-      WHERE member_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+      WHERE member_role.rolname IN (
+        'xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor',
+        'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer'
+      )
       ORDER BY granted_role.rolname, member_role.rolname
     `
     expect(runtimeMemberships).toEqual([
@@ -1061,173 +1070,48 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
       JOIN pg_roles grantee_role ON grantee_role.oid = privilege.grantee
       WHERE namespace_object.nspname = 'public'
         AND relation.relkind IN ('r', 'p')
-        AND grantee_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+        AND grantee_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor', 'xcs_payload_writer')
       ORDER BY grantee_role.rolname, relation.relname, privilege.privilege_type
     `
-    expect(tableGrants).toEqual([
-      {
-        grantee: 'xcs_api',
-        tableName: 'credential_events',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'credential_generations',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      { grantee: 'xcs_api', tableName: 'demo_pins', privilegeType: 'DELETE', grantable: false },
-      { grantee: 'xcs_api', tableName: 'demo_pins', privilegeType: 'INSERT', grantable: false },
-      { grantee: 'xcs_api', tableName: 'demo_pins', privilegeType: 'SELECT', grantable: false },
-      { grantee: 'xcs_api', tableName: 'demo_pins', privilegeType: 'UPDATE', grantable: false },
-      {
-        grantee: 'xcs_api',
-        tableName: 'indexer_incidents',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'indexer_status',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'ledger_checkpoints',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'network_profiles',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'pin_challenges',
-        privilegeType: 'DELETE',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'pin_challenges',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'pin_challenges',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_api',
-        tableName: 'pin_challenges',
-        privilegeType: 'UPDATE',
-        grantable: false,
-      },
-      { grantee: 'xcs_api', tableName: 'schema_events', privilegeType: 'SELECT', grantable: false },
-      { grantee: 'xcs_api', tableName: 'schemas', privilegeType: 'SELECT', grantable: false },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'credential_events',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'credential_events',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'credential_generations',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'credential_generations',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'indexer_incidents',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'indexer_incidents',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'indexer_status',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'indexer_status',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'ledger_checkpoints',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'ledger_checkpoints',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'network_profiles',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'network_profiles',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'schema_events',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'schema_events',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'schemas',
-        privilegeType: 'INSERT',
-        grantable: false,
-      },
-      {
-        grantee: 'xcs_indexer',
-        tableName: 'schemas',
-        privilegeType: 'SELECT',
-        grantable: false,
-      },
-    ])
+    const projectionTables = [
+      'credential_events',
+      'credential_generations',
+      'indexer_incidents',
+      'indexer_status',
+      'ledger_checkpoints',
+      'network_profiles',
+      'schema_events',
+      'schemas',
+    ]
+    const expectedTableGrants = [
+      ...projectionTables.flatMap((tableName) => [
+        { grantee: 'xcs_api', tableName, privilegeType: 'SELECT', grantable: false },
+        ...['SELECT', 'INSERT'].map((privilegeType) => ({
+          grantee: 'xcs_indexer',
+          tableName,
+          privilegeType,
+          grantable: false,
+        })),
+      ]),
+      ...['demo_pins', 'pin_challenges'].flatMap((tableName) =>
+        ['SELECT', 'INSERT', 'UPDATE', 'DELETE'].map((privilegeType) => ({
+          grantee: 'xcs_payload_writer',
+          tableName,
+          privilegeType,
+          grantable: false,
+        })),
+      ),
+      ...['hosted_payloads', 'hosted_payload_publications'].flatMap((tableName) =>
+        ['SELECT', 'INSERT'].map((privilegeType) => ({
+          grantee: 'xcs_payload_writer',
+          tableName,
+          privilegeType,
+          grantable: false,
+        })),
+      ),
+    ]
+    expect(tableGrants).toHaveLength(expectedTableGrants.length)
+    expect(tableGrants).toEqual(expect.arrayContaining(expectedTableGrants))
 
     const columnGrants = await database.client.sql<
       Array<{
@@ -1252,7 +1136,7 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
       WHERE namespace_object.nspname = 'public'
         AND attribute_object.attnum > 0
         AND NOT attribute_object.attisdropped
-        AND grantee_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
+        AND grantee_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor', 'xcs_payload_writer')
       ORDER BY grantee_role.rolname, relation.relname, attribute_object.attname, privilege.privilege_type
     `
     expect(columnGrants).toEqual([
@@ -1369,6 +1253,9 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
     const apiClient = createDatabaseClient(
       runtimeDatabaseUrl(database.url, 'xcs_api', API_DATABASE_PASSWORD),
     )
+    const payloadClient = createDatabaseClient(
+      runtimeDatabaseUrl(database.url, 'xcs_payload_writer', PAYLOAD_DATABASE_PASSWORD),
+    )
     const monitorClient = createDatabaseClient(
       runtimeDatabaseUrl(database.url, 'xcs_monitor', MONITOR_DATABASE_PASSWORD),
     )
@@ -1554,7 +1441,7 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
 
       const challengeId = '1'.repeat(64)
       const pinId = '2'.repeat(64)
-      await apiClient.sql`
+      await payloadClient.sql`
         INSERT INTO pin_challenges (
           challenge_id, profile_id, wallet, requester_ip_hash, message, expires_at
         ) VALUES (
@@ -1562,7 +1449,7 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
           ${'3'.repeat(64)}, 'authorized', CURRENT_TIMESTAMP + interval '5 minutes'
         )
       `
-      await apiClient.sql`
+      await payloadClient.sql`
         INSERT INTO demo_pins (
           pin_id, challenge_id, profile_id, wallet, requester_ip_hash,
           cid, byte_length, status, expires_at
@@ -1572,20 +1459,58 @@ describePostgres('PostgreSQL 18 indexer integration', () => {
           CURRENT_TIMESTAMP + interval '1 hour'
         )
       `
-      const [pinRead] = await apiClient.sql<{ status: string }[]>`
+      const [pinRead] = await payloadClient.sql<{ status: string }[]>`
         SELECT status FROM demo_pins WHERE pin_id = ${pinId}
       `
       expect(pinRead?.status).toBe('pending')
-      await apiClient.sql`
+      await payloadClient.sql`
         UPDATE demo_pins SET status = 'pinned' WHERE pin_id = ${pinId}
       `
-      await apiClient.sql`DELETE FROM demo_pins WHERE pin_id = ${pinId}`
-      await apiClient.sql`DELETE FROM pin_challenges WHERE challenge_id = ${challengeId}`
+      await payloadClient.sql`DELETE FROM demo_pins WHERE pin_id = ${pinId}`
+      await payloadClient.sql`DELETE FROM pin_challenges WHERE challenge_id = ${challengeId}`
 
+      for (const runtimeClient of [apiClient, payloadClient]) {
+        for (const tableName of projectionTables) {
+          await expectPermissionDenied(
+            runtimeClient.sql`DELETE FROM ${runtimeClient.sql(tableName)} WHERE false`,
+          )
+          await expectPermissionDenied(
+            runtimeClient.sql`INSERT INTO ${runtimeClient.sql(tableName)} DEFAULT VALUES`,
+          )
+        }
+        await expectPermissionDenied(runtimeClient.sql`SET ROLE xcs_indexer`)
+        await expectPermissionDenied(runtimeClient.sql`SET ROLE xcs_monitor`)
+      }
+      await expectPermissionDenied(apiClient.sql`SET ROLE xcs_payload_writer`)
+      await expectPermissionDenied(payloadClient.sql`SET ROLE xcs_api`)
+      await expectPermissionDenied(payloadClient.sql`SELECT * FROM schemas`)
+      await expectPermissionDenied(
+        payloadClient.sql`UPDATE credential_generations SET accepted = true WHERE false`,
+      )
+      for (const tableName of [
+        'demo_pins',
+        'pin_challenges',
+        'hosted_payloads',
+        'hosted_payload_publications',
+      ]) {
+        await expectPermissionDenied(apiClient.sql`SELECT * FROM ${apiClient.sql(tableName)}`)
+        await expectPermissionDenied(
+          apiClient.sql`INSERT INTO ${apiClient.sql(tableName)} DEFAULT VALUES`,
+        )
+        await expectPermissionDenied(
+          apiClient.sql`DELETE FROM ${apiClient.sql(tableName)} WHERE false`,
+        )
+      }
+      await expectPermissionDenied(payloadClient.sql`CREATE TABLE forbidden_payload (id integer)`)
       await expectPermissionDenied(apiClient.sql`CREATE TABLE forbidden_api (id integer)`)
       await expectPermissionDenied(indexerClient.sql`CREATE TABLE forbidden_indexer (id integer)`)
     } finally {
-      await Promise.allSettled([indexerClient.close(), apiClient.close(), monitorClient.close()])
+      await Promise.allSettled([
+        indexerClient.close(),
+        apiClient.close(),
+        payloadClient.close(),
+        monitorClient.close(),
+      ])
     }
   }, 120_000)
 
diff --git a/apps/indexer/test/registration.test.ts b/apps/indexer/test/registration.test.ts
index 200309c..3ef0293 100644
--- a/apps/indexer/test/registration.test.ts
+++ b/apps/indexer/test/registration.test.ts
@@ -256,6 +256,6 @@ describe('interpretSchemaRegistration', () => {
         profile,
         new Map(),
       ),
-    ).toMatchObject({ status: 'rejected', reasonCode: 'INVALID_JSON' })
+    ).toMatchObject({ status: 'rejected', reasonCode: 'JSON_INVALID' })
   })
 })
diff --git a/apps/indexer/test/xrpl-source.test.ts b/apps/indexer/test/xrpl-source.test.ts
index 1a3e18e..b378519 100644
--- a/apps/indexer/test/xrpl-source.test.ts
+++ b/apps/indexer/test/xrpl-source.test.ts
@@ -1,8 +1,11 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+import { encode } from 'ripple-binary-codec'
+import { Client, decode, hashes, Wallet } from 'xrpl'
 
 import {
   assertFeatureResponseSupportsAmendment,
   normalizeLedgerResponse,
+  XrplLedgerSource,
 } from '../src/xrpl-source.js'
 
 const LEDGER_HASH = 'a'.repeat(64)
@@ -102,6 +105,41 @@ describe('normalizeLedgerResponse', () => {
     })
   })
 
+  it.each<[string, unknown]>([
+    ['nftoken_id', FIRST_TX_HASH],
+    ['nftoken_ids', [FIRST_TX_HASH]],
+    ['offer_id', FIRST_TX_HASH],
+    ['mpt_issuance_id', '1'.repeat(48)],
+    ['delivered_amount', '1'],
+  ])(
+    'ignores the synthetic API metadata field %s without mutating the response',
+    (field, value) => {
+      const decorated = response()
+      const metadata = record(transactions(decorated)[0]!.meta)
+      metadata[field] = value
+
+      expect(normalizeLedgerResponse(decorated)).toEqual(normalizeLedgerResponse(response()))
+      expect(metadata[field]).toEqual(value)
+    },
+  )
+
+  it.each<[string, unknown]>([
+    ['DeliveredAmount', '1'],
+    ['AffectedNodes', [{ ModifiedNode: { LedgerEntryType: 'AccountRoot' } }]],
+    ['TransactionResult', 'tecFAILED'],
+    ['FutureCanonicalField', 'preserved'],
+  ])('preserves %s for the quorum to detect canonical metadata differences', (field, value) => {
+    const changed = response()
+    const metadata = record(transactions(changed)[0]!.meta)
+    metadata[field] = value
+    metadata.delivered_amount = '1'
+
+    const normalized = normalizeLedgerResponse(changed)
+    expect(normalized).not.toEqual(normalizeLedgerResponse(response()))
+    expect(normalized.transactions[1]!.metadata[field]).toEqual(value)
+    expect(normalized.transactions[1]!.metadata).not.toHaveProperty('delivered_amount')
+  })
+
   it('rejects a ledger that is not marked validated or closed', () => {
     const unvalidated = response()
     unvalidated.validated = false
@@ -242,3 +280,173 @@ describe('assertFeatureResponseSupportsAmendment', () => {
     )
   })
 })
+
+// Published XRPL binary-codec header vector (ledger 32052277); no transaction/account secrets.
+const BINARY_HEADER =
+  '01E91435016340767BF1C4A3EACEB081770D8ADE216C85445DD6FB002C6B5A2930F2DECE006DA18150CB18F6DD33F6F0990754C962A7CCE62F332FF9C13939B03B864117F0BDA86B6E9B4F873B5C3E520634D343EF5D9D9A4246643D64DAD278BA95DC0EAC6EB5350CF970D521276CDE21276CE60A00'
+const BINARY_HEADER_FIELDS = {
+  ledger_index: 32052277,
+  total_coins: '99994494362043555',
+  parent_hash: 'EACEB081770D8ADE216C85445DD6FB002C6B5A2930F2DECE006DA18150CB18F6',
+  transaction_hash: 'DD33F6F0990754C962A7CCE62F332FF9C13939B03B864117F0BDA86B6E9B4F87',
+  account_hash: '3B5C3E520634D343EF5D9D9A4246643D64DAD278BA95DC0EAC6EB5350CF970D5',
+  parent_close_time: 556231902,
+  close_time: 556231910,
+  close_time_resolution: 10,
+  close_flags: 0,
+}
+function binaryResponse() {
+  const holder = Wallet.generate()
+  const tx = holder.sign({
+    TransactionType: 'Payment',
+    Account: holder.address,
+    Destination: Wallet.generate().address,
+    Amount: '123',
+    Sequence: 1,
+    Fee: '12',
+  })
+  const metadata = {
+    TransactionIndex: 0,
+    TransactionResult: 'tesSUCCESS',
+    AffectedNodes: [],
+    DeliveredAmount: '123',
+  }
+  return {
+    signed: tx,
+    metadata,
+    result: {
+      validated: true,
+      ledger_index: BINARY_HEADER_FIELDS.ledger_index,
+      ledger_hash: hashes.hashLedgerHeader(
+        BINARY_HEADER_FIELDS as Parameters<typeof hashes.hashLedgerHeader>[0],
+      ),
+      ledger: {
+        closed: true,
+        ledger_data: BINARY_HEADER,
+        transactions: [{ tx_blob: tx.tx_blob, meta: encode(metadata) }],
+      },
+    },
+  }
+}
+
+describe('binary ledger transport', () => {
+  it('decodes canonical header/transaction/metadata and derives the missing transaction hash from signed bytes', () => {
+    const fixture = binaryResponse()
+    const normalized = normalizeLedgerResponse(fixture.result)
+    expect(normalized).toMatchObject({
+      ledgerIndex: 32052277,
+      totalCoins: '99994494362043555',
+      parentCloseTime: 556231902,
+      closeTime: 556231910,
+      closeTimeResolution: 10,
+      closeFlags: 0,
+      parentHash: BINARY_HEADER_FIELDS.parent_hash.toLowerCase(),
+      transactionRoot: BINARY_HEADER_FIELDS.transaction_hash.toLowerCase(),
+      accountRoot: BINARY_HEADER_FIELDS.account_hash.toLowerCase(),
+    })
+    expect(normalized.transactions[0]).toMatchObject({
+      hash: fixture.signed.hash.toLowerCase(),
+      transactionIndex: 0,
+      metadata: fixture.metadata,
+      transaction: { TransactionType: 'Payment', Amount: '123' },
+    })
+    expect(normalized.transactions[0]!.transaction).not.toHaveProperty('DeliverMax')
+    const expanded = {
+      ...fixture.result,
+      ledger: {
+        ...BINARY_HEADER_FIELDS,
+        ledger_hash: fixture.result.ledger_hash,
+        closed: true,
+        transactions: [
+          {
+            hash: fixture.signed.hash,
+            tx_json: decode(fixture.signed.tx_blob),
+            meta: fixture.metadata,
+          },
+        ],
+      },
+    }
+    expect(normalized).toEqual(normalizeLedgerResponse(expanded))
+  })
+  it('accepts API v2 meta_blob and hash while rejecting conflicting metadata aliases', () => {
+    const fixture = binaryResponse()
+    const expected = normalizeLedgerResponse(fixture.result)
+    const tx = record(fixture.result.ledger.transactions[0])
+    tx.meta_blob = tx.meta
+    tx.hash = fixture.signed.hash
+    delete tx.meta
+    expect(normalizeLedgerResponse(fixture.result)).toEqual(expected)
+    tx.meta = encode({ ...fixture.metadata, TransactionResult: 'tecUNFUNDED_PAYMENT' })
+    expect(() => normalizeLedgerResponse(fixture.result)).toThrow(
+      'metadata representations disagree',
+    )
+  })
+  it('requests a complete binary ledger and keeps the response-index guard', async () => {
+    const fixture = binaryResponse()
+    const request = vi
+      .spyOn(Client.prototype, 'request')
+      .mockResolvedValue({ result: fixture.result } as never)
+    try {
+      const source = new XrplLedgerSource('wss://source.invalid')
+      expect(await source.getLedger(32052277)).toEqual(normalizeLedgerResponse(fixture.result))
+      expect(request).toHaveBeenCalledWith({
+        command: 'ledger',
+        ledger_index: 32052277,
+        transactions: true,
+        expand: true,
+        binary: true,
+      })
+      await expect(source.getLedger(32052278)).rejects.toMatchObject({
+        code: 'SOURCE_RESPONSE_INVALID',
+      })
+    } finally {
+      request.mockRestore()
+    }
+  })
+  it.each(['', '0', 'GG', '00', BINARY_HEADER + '00'])(
+    'rejects malformed or trailing binary header bytes %s',
+    (header) => {
+      const fixture = binaryResponse()
+      fixture.result.ledger.ledger_data = header
+      expect(() => normalizeLedgerResponse(fixture.result)).toThrow()
+    },
+  )
+  it('rejects a binary header that disagrees with the advertised hash', () => {
+    const fixture = binaryResponse()
+    fixture.result.ledger_hash = '0'.repeat(64)
+    expect(() => normalizeLedgerResponse(fixture.result)).toThrow('hash values disagree')
+  })
+  it.each(['tx_blob', 'meta'] as const)(
+    'rejects invalid binary %s instead of trusting optional JSON shadows',
+    (field) => {
+      const fixture = binaryResponse()
+      const tx = fixture.result.ledger.transactions[0]!
+      tx[field] = '00'
+      Object.assign(tx, { hash: fixture.signed.hash, tx_json: decode(fixture.signed.tx_blob) })
+      expect(() => normalizeLedgerResponse(fixture.result)).toThrow('Cannot decode binary')
+    },
+  )
+  it('rejects a conflicting optional transaction hash', () => {
+    const fixture = binaryResponse()
+    Object.assign(fixture.result.ledger.transactions[0]!, { hash: '0'.repeat(64) })
+    expect(() => normalizeLedgerResponse(fixture.result)).toThrow('hash values disagree')
+  })
+  it('retains legitimate protocol pseudo-transactions without claiming an account signature', () => {
+    const fixture = binaryResponse()
+    const pseudo = {
+      TransactionType: 'EnableAmendment',
+      Account: 'rrrrrrrrrrrrrrrrrrrrrhoLvTp',
+      LedgerSequence: 32052277,
+      Amendment: 'a'.repeat(64),
+    }
+    const blob = encode(pseudo)
+    fixture.result.ledger.transactions[0]!.tx_blob = blob
+    const normalized = normalizeLedgerResponse(fixture.result).transactions[0]!
+    expect(normalized.transaction).toMatchObject({
+      ...pseudo,
+      Amendment: pseudo.Amendment.toUpperCase(),
+    })
+    // The standard ID domain applies to unsigned protocol operations too.
+    expect(normalized.hash).toBe('38b05da5a7dc38038355bb22ce9b605ba616f1cf87e8576dd6be3da1a6bf1702')
+  })
+})
diff --git a/apps/indexer/tsup.config.ts b/apps/indexer/tsup.config.ts
index c072052..a4de7ba 100644
--- a/apps/indexer/tsup.config.ts
+++ b/apps/indexer/tsup.config.ts
@@ -10,6 +10,8 @@ export default defineConfig({
     'src/fixture-cli.ts',
     'src/lib/db/bin/bootstrap.ts',
     'src/lib/db/bin/migrate.ts',
+    'src/lib/db/bin/status.ts',
+    'src/lib/db/bin/admin-bootstrap.ts',
   ],
   format: ['esm'],
   dts: false,
diff --git a/apps/indexer/vitest.config.ts b/apps/indexer/vitest.config.ts
index 0ce4b3b..4d5f7f0 100644
--- a/apps/indexer/vitest.config.ts
+++ b/apps/indexer/vitest.config.ts
@@ -9,5 +9,7 @@ export default defineConfig({
   test: {
     environment: 'node',
     include: ['test/**/*.test.ts'],
+    // Integration files provision the same cluster-wide roles, even in separate databases.
+    fileParallelism: !process.env.XCS_TEST_DATABASE_URL?.trim(),
   },
 })
diff --git a/apps/notifier/.env.example b/apps/notifier/.env.example
new file mode 100644
index 0000000..e2fb453
--- /dev/null
+++ b/apps/notifier/.env.example
@@ -0,0 +1,13 @@
+# Contract for the XCS administrator notification worker.
+# Names only; values live in the deployment's secret store.
+XCS_NOTIFIER_DATABASE_URL=                # held (xcs_notifier role)
+XCS_AUTH_ORIGIN=                          # config; exact HTTPS portal origin
+XCS_SMTP_HOST=                            # config
+XCS_SMTP_PORT=                            # config
+# External servers must use `starttls` or `tls`; only local Mailpit may use `disabled`.
+XCS_SMTP_TLS_MODE=                        # config (disabled, starttls, or tls)
+XCS_SMTP_USERNAME=                        # optional held (pair with XCS_SMTP_PASSWORD)
+XCS_SMTP_PASSWORD=                        # optional held (pair with XCS_SMTP_USERNAME)
+XCS_SMTP_FROM_NAME=                       # optional config
+XCS_SMTP_FROM_ADDRESS=                    # config (required for external SMTP)
+XCS_SMTP_ENVELOPE_FROM=                   # optional config (defaults to FROM_ADDRESS)
diff --git a/apps/notifier/Dockerfile b/apps/notifier/Dockerfile
new file mode 100644
index 0000000..a607b9b
--- /dev/null
+++ b/apps/notifier/Dockerfile
@@ -0,0 +1,39 @@
+# Administrator notification worker. Build context: the repository root.
+# It compiles the notifier from apps/web so the worker and web service use the
+# exact same mail delivery and database code.
+ARG XCS_NODE_IMAGE=node:24-alpine
+FROM ${XCS_NODE_IMAGE} AS build
+
+RUN npm install -g pnpm@10.34.4
+
+WORKDIR /workspace
+COPY apps/web ./apps/web
+COPY db ./db
+COPY config ./config
+
+WORKDIR /workspace/apps/web
+RUN pnpm install --frozen-lockfile
+RUN NODE_ENV=production pnpm build
+RUN pnpm install --frozen-lockfile --prod
+
+FROM ${XCS_NODE_IMAGE} AS runtime
+
+ARG XCS_REVISION=unknown
+ARG XCS_VERSION=0.0.0
+
+LABEL org.opencontainers.image.title="XCS administrator notifier" \
+      org.opencontainers.image.description="XCS administrator decision notification worker" \
+      org.opencontainers.image.source="https://github.com/XRPL-Commons/XCS" \
+      org.opencontainers.image.revision="${XCS_REVISION}" \
+      org.opencontainers.image.version="${XCS_VERSION}" \
+      org.opencontainers.image.licenses="MIT"
+
+ENV NODE_ENV=production
+
+WORKDIR /workspace
+COPY --from=build --chown=node:node /workspace/apps/web/dist ./dist
+COPY --from=build --chown=node:node /workspace/apps/web/node_modules ./node_modules
+COPY --from=build --chown=node:node /workspace/apps/web/package.json ./package.json
+
+USER node
+CMD ["node", "dist/admin/admin-notifier.js"]
diff --git a/apps/web/.env.example b/apps/web/.env.example
index 4944fe1..c7f68ec 100644
--- a/apps/web/.env.example
+++ b/apps/web/.env.example
@@ -1,35 +1,61 @@
-# Contract for the XCS web app (Nuxt server + the /v1 read API).
-# Names only; values live in the deployment's secret store.
-#
-# This file holds secrets and values that genuinely differ per deployment.
-# Behavioural settings and feature flags are checked-in code, in
-# server/xcs/settings.ts; they are not deployment inputs and a variable of the
-# same name here has no effect.
+# XCS web deployment contract. Behavioural settings live in
+# server/xcs/settings.ts; this file contains only secrets and values that differ
+# between deployments.
 
-# Read-only PostgreSQL connection string for the API role.
-XCS_DATABASE_URL=                          # config
-# Comma-separated browser origins allowed on /v1/**; `*` is rejected.
-XCS_ALLOWED_ORIGINS=                       # config
-# Narrow reverse-proxy CIDRs trusted for forwarded client-IP headers; catch-all /0 is rejected.
+# Public API and network.
+XCS_DATABASE_URL=                          # held; xcs_api PostgreSQL URL
+XCS_ALLOWED_ORIGINS=                       # config; explicit comma-separated origins
 XCS_TRUSTED_PROXY_CIDRS=                   # optional config
-# Bearer token guarding /internal/metrics*; 32 to 256 URL-safe characters. Setting
-# it is what turns the two routes on; left unset the routes are not registered at
-# all. A value that is not 32 to 256 URL-safe characters fails at start-up rather
-# than leaving the deployment quietly unmonitored.
-XCS_METRICS_TOKEN=                         # optional generate
-# Salt for hashing pinning client addresses; at least 32 random bytes. Read only
-# once XCS_DEMO_PINNING_ENABLED is turned on in server/xcs/settings.ts.
-XCS_PINNING_IP_HASH_SECRET=                # optional generate
-# Path to the network profile JSON this deployment serves; the browser-visible
-# profile identifier is that file's `profileId`. Must be the same published file
-# the indexer indexes. Left unset, the site does not filter the network list,
-# which is what an unset NUXT_PUBLIC_PROFILE_ID used to mean.
-XCS_NETWORK_PROFILE=                       # optional config
-# Public wss:// XRPL submission endpoint; no credentials, no private indexer URL.
-NUXT_PUBLIC_RPC_URL=                       # config
-# Public Xaman application identifier; enables the Xaman adapter.
-NUXT_PUBLIC_XAMAN_API_KEY=                 # optional
-# Deployment origin with a trailing slash, registered in the Xaman Developer Console.
-NUXT_PUBLIC_XAMAN_REDIRECT_URL=            # optional config
-# Public Reown project identifier; enables the WalletConnect adapter.
-NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID=     # optional
+XCS_METRICS_TOKEN=                         # optional generate; presence enables metrics
+XCS_PINNING_IP_HASH_SECRET=                # optional generate; demo pinning only
+XCS_NETWORK_PROFILE=                       # optional config; same JSON as the indexer
+NUXT_PUBLIC_RPC_URL=                       # config; public wss:// submission endpoint
+NUXT_PUBLIC_XAMAN_API_KEY=                 # optional public identifier
+NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID=     # optional public identifier
+
+# Account workspace. Supplying any field requires the complete group; a complete
+# group enables authentication without a separate feature flag.
+XCS_AUTH_ORIGIN=                           # config; exact HTTPS origin
+# Local qualification only: 1 requires loopback HTTPS auth and Identity origins.
+XCS_LOCAL_IDENTITY_QUALIFICATION=
+XCS_IDENTITY_CLIENT_ID=                    # held
+XCS_IDENTITY_CLIENT_SECRET=                # held
+NUXT_APP_DATABASE_URL=                     # held; xcs_app PostgreSQL URL
+
+# Commons review workspace. Supplying its database/key enables it after auth.
+NUXT_ADMIN_DATABASE_URL=                   # held; xcs_admin_app PostgreSQL URL
+XCS_ADMIN_DOCUMENT_KEY=                    # generate
+
+# Issuer workspace. Supplying its database enables it after auth. The browser
+# navigation is derived from this same validated server contract.
+NUXT_ISSUER_DATABASE_URL=                  # held; xcs_issuer PostgreSQL URL
+
+# Shared private evidence storage. Filesystem is local-only; production uses a
+# private S3-compatible bucket such as DigitalOcean Spaces.
+XCS_DOCUMENT_STORAGE_DRIVER=              # config; filesystem or s3
+XCS_DOCUMENT_FILESYSTEM_DIRECTORY=        # local-only absolute private directory
+XCS_DOCUMENT_FILESYSTEM_LOCAL=            # local-only acknowledgement; must be 1
+XCS_DOCUMENT_S3_ENDPOINT=                 # config; exact HTTPS origin
+XCS_DOCUMENT_S3_REGION=                   # config
+XCS_DOCUMENT_S3_BUCKET=                   # config; private bucket
+XCS_DOCUMENT_S3_PRIVATE_BUCKET=           # production acknowledgement; must be 1
+XCS_DOCUMENT_S3_PREFIX=                   # optional config
+XCS_DOCUMENT_S3_ACCESS_KEY_ID=             # held
+XCS_DOCUMENT_S3_SECRET_ACCESS_KEY=         # held
+
+# Invitation and lifecycle email. External SMTP must use starttls or tls.
+XCS_SMTP_HOST=                             # optional config
+XCS_SMTP_PORT=                             # optional config
+XCS_SMTP_TLS_MODE=                         # optional config; disabled/starttls/tls
+XCS_SMTP_USERNAME=                         # optional held; pair with password
+XCS_SMTP_PASSWORD=                         # optional held; pair with username
+XCS_SMTP_FROM_NAME=                        # optional config
+XCS_SMTP_FROM_ADDRESS=                     # required for external SMTP
+XCS_SMTP_ENVELOPE_FROM=                    # optional config
+
+# Public hosted payloads. Supplying any hosted value requires the complete
+# group and enables publication; the browser origin is derived from it.
+XCS_PAYLOAD_DATABASE_URL=                  # optional held; xcs_payload_writer URL
+XCS_PUBLIC_PAYLOAD_BASE_URL=               # optional config; exact HTTPS origin
+XCS_PAYLOAD_STORAGE_IP_HASH_SECRET=        # optional generate
+XCS_HOSTED_PAYLOAD_NETWORKS=               # optional config
diff --git a/apps/web/.prettierignore b/apps/web/.prettierignore
index 11a4452..04929d0 100644
--- a/apps/web/.prettierignore
+++ b/apps/web/.prettierignore
@@ -5,3 +5,4 @@ coverage
 playwright-report
 test-results
 pnpm-lock.yaml
+dist
diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index 7b20825..0a646f5 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -16,6 +16,8 @@ COPY config ./config
 WORKDIR /workspace/apps/web
 RUN pnpm install --frozen-lockfile
 RUN NODE_ENV=production pnpm build
+# The optional notification worker uses the same web image and production dependencies.
+RUN pnpm install --frozen-lockfile --prod
 
 FROM ${XCS_NODE_IMAGE} AS runtime
 
@@ -34,7 +36,11 @@ ENV NITRO_PORT=3000
 
 WORKDIR /workspace
 COPY --from=build --chown=node:node /workspace/apps/web/.output ./.output
+COPY --from=build --chown=node:node /workspace/apps/web/dist ./dist
+COPY --from=build --chown=node:node /workspace/apps/web/node_modules ./node_modules
+COPY --from=build --chown=node:node /workspace/apps/web/package.json ./package.json
 COPY --chown=node:node config ./config
+RUN mkdir -p /var/lib/xcs-review && chown node:node /var/lib/xcs-review
 
 USER node
 EXPOSE 3000
diff --git a/apps/web/README.md b/apps/web/README.md
index 1b8a46a..0a7c4b8 100644
--- a/apps/web/README.md
+++ b/apps/web/README.md
@@ -1,9 +1,10 @@
 # XCS Testnet web app
 
-The Nuxt application is the accountless, non-custodial Testnet site for XCS. Its public navigation
-keeps four entries—Explorer, Create, Verify and Docs—while preserving the schema, issuance,
-lifecycle and developer workflows in one deployment. EAS and EASScan are interaction-design
-references only; the site constructs native XRPL transactions under the frozen XCS v0.1 protocol.
+The Nuxt application is the non-custodial Testnet site for XCS. Public read-only discovery remains
+accountless; authenticated business mutations use the guided `/issuer` and `/recipient` portals,
+and shared attestations open through `/presentations`. The site constructs native XRPL transactions
+under the frozen XCS v0.1 protocol while keeping protocol identifiers in integration surfaces, not
+business forms.
 
 The same Nitro server also **is** the XCS read and verification API: `/v1/**`, `/health/*`,
 `/internal/metrics*` and `/documentation` are served from this application, on the same origin as the
@@ -36,10 +37,10 @@ The site is built on Nuxt UI 4 and Tailwind CSS 4. The XCS identity lives in
 `EmptyState`); pages compose Nuxt UI primitives with it and keep their workflow logic in
 `composables/` and `utils/`.
 
-For every write, the application constructs and autofills an XRPL transaction, shows those exact
-final fields to the user, then asks an external wallet to sign without submitting. The private key
-or seed never enters the application. There is no XCS user or organization account, server session,
-team administration or batch issuer in the Testnet beta; one wallet action is prepared at a time.
+For every write, the application constructs and autofills an XRPL transaction, presents a readable
+business summary, then asks an external wallet to sign without submitting. The private key or seed
+never enters the application. Application accounts and organization approval do not replace wallet
+authorization. One wallet action is prepared at a time; batch issuance is not implemented.
 
 Immediately before opening the wallet, the site requires a fresh, profile-bound readiness proof
 from the authoritative indexer. It repeats that proof after the wallet returns and before retaining
@@ -65,14 +66,15 @@ The current application organizes the existing workflows as follows:
   statistics and exact search. `/schemas` and `/schemas/:uid` provide paginated schema discovery,
   `/activity` shows schema registrations only, `/credentials/:generationId` and
   `/transactions/:hash` expose exact evidence, and `/status` shows the indexer/network view;
-- **Create:** `/studio` is the single creation hub. It emphasizes schema registration and
-  single-credential issuance, then links acceptance, revocation and local operation recovery.
-  Schema registration has a guided scalar-field editor, course-completion and diploma templates,
-  plus the advanced JSON editor. Issuance can derive a guided claims form from a compatible
-  resolved schema and retains the advanced JSON path;
-- **Verify:** `/verify` accepts a shared generation ID and opens its exact permalink, or exposes the
-  complete issuer/subject/schema tuple as an advanced lookup. The permalink reports ledger state,
-  schema validity, payload integrity and issuer trust separately;
+- **Issuer:** `/issuer` derives one next action from application approval, linked issuer wallet,
+  templates, invitations and issuance state. The guided screens use business names and readable
+  fields; wallet signing remains explicit;
+- **Recipient:** `/recipient` joins claimed invitations, external wallet preparation, attestation
+  review, acceptance and sharing. Private content is fetched only after the explicit “show and
+  verify” action;
+- **Verify:** `/presentations` removes a bearer fragment before resolving it, opens public shares
+  without an account, resumes private shares through the one-time login handoff, and leads with
+  issuer admission, XRPL lifecycle and recipient-wallet proof;
 - **Docs:** `/developers` loads the active runtime profile, executes the privacy-explicit
   exact-generation verification flow, derives REST/cURL, TypeScript and monorepo CLI examples from
   that evidence, documents the wallet `Signer` boundary and catalogs aggregate versus exact API
@@ -113,12 +115,16 @@ third-party integrator call. It reads the indexer's PostgreSQL projection as the
 | `POST` | `/v1/pinning/challenges`                                                                |
 | `POST` | `/v1/pinning/pins`                                                                      |
 
-The two pinning routes answer `404` unless demo pinning is turned on for the requested profile in
-`server/xcs/settings.ts`. It is off in the checked-in settings.
+The two pinning routes answer `404` unless `XCS_DEMO_PINNING_ENABLED=true` for the requested profile.
+Optional hosted publication adds signed `POST /v1/payloads/:locator` and immutable public reads at
+`/p/:locator`. Managed issuer payloads use `/api/issuer/payloads` and `/q/:locator` with separate
+application authorization; their bytes are not exposed through projection discovery routes.
+SSR calls use Nuxt's in-process request fetch on `/v1`; browsers call the same origin without an
+external API base URL.
 
 Authoritative ledger-derived routes fail closed: they return `503` when the indexer's writer lease,
 source agreement, checkpoint, transaction-root evidence or freshness
-(`readinessMaxLedgerAgeSeconds` in `server/xcs/settings.ts`, 120 seconds) do not hold. Discovery is deliberately
+(`XCS_READINESS_MAX_LEDGER_AGE_SECONDS`, default 120 seconds) do not hold. Discovery is deliberately
 exact — there is no subject feed, account-wide enumeration or claims search.
 
 ### OpenAPI
@@ -141,8 +147,9 @@ process — and restrict all three at the ingress to the load balancer and monit
 
 ### Metrics
 
-Setting `XCS_METRICS_TOKEN` to 32 to 256 URL-safe characters exposes two routes, both requiring
-`Authorization: Bearer $XCS_METRICS_TOKEN`, both `Cache-Control: no-store`, neither consuming the public rate-limit budget:
+Supplying a valid `XCS_METRICS_TOKEN` exposes two routes, both requiring `Authorization: Bearer
+$XCS_METRICS_TOKEN`, both `Cache-Control: no-store`, neither consuming the public rate-limit budget.
+With no token, neither route is registered:
 
 - `GET /internal/metrics` — a bounded JSON operator snapshot (schema version 1);
 - `GET /internal/metrics/prometheus` — the Prometheus exposition Prometheus scrapes.
@@ -164,50 +171,81 @@ need a shared edge or store-backed limiter.
 
 ## Wallet support
 
-The web app pins `xrpl-connect@1.0.0-rc.0` and registers its eight official adapters: Xaman,
-Crossmark, GemWallet, WalletConnect, Ledger, Xyra, Otsu and MetaMask Snap. Crossmark, GemWallet,
-Ledger, Xyra, Otsu and MetaMask Snap are registered without deployment-specific configuration.
-Xaman is added only when `NUXT_PUBLIC_XAMAN_API_KEY` is set, and WalletConnect only when
-`NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID` is set. Both values identify a public application to its
-wallet provider; they are browser-visible identifiers, not secrets. One Xaman application key is
-used by every visitor of that XCS deployment. Register the deployment origin with a trailing slash
-as an exact redirect URI in the Xaman Developer Console. XCS uses that stable root callback from
-every page; it never uses the current route as the OAuth callback.
-
-Two third-party wallet licences are not plain permissive SPDX identifiers, and
-`docs/third-party-licenses.md` records why XCS may ship them. The GemWallet permission, granted by
-Florent Bouron in January 2026, covers public and beta use of the GemWallet API, which its dual
-`LICENSE` otherwise reserves (its MIT-like arm allows only personal, educational and non-public
-research use). The WalletConnect Community License Agreement is covered by its attribution and
-usage-threshold conditions: attribution is carried by `packages/xrpl-connect/THIRD_PARTY_NOTICES.md`
-upstream in `XRPL-Commons/xrpl-connect`, and the XCS maintainer attested on 2026-09-28 that XRPL
-Commons is below the agreement's usage thresholds. No CI job verifies any of this, so re-read that
-note before a release that changes wallet dependencies. Reclassifying either licence as MIT,
-returning to `0.8.2` or deleting the declared dependencies would only hide the same bundled code; it
-is not a compliant workaround, and the upstream adapter packages are not yet published separately.
-
-`vaul-vue@0.4.1` arrives through Nuxt UI's drawer component, reports no licence and ships no licence
-file, so `patches/vaul-vue@0.4.1.patch` adds the verbatim upstream MIT text (Copyright (c) 2025
-unovue). Keep that patch: distributing the component without its licence text would breach the MIT
-notice condition.
-
-The workspace applies `patches/xrpl-connect@1.0.0-rc.0.patch` while that release candidate is
-pinned. Xaman's OAuth provider serializes `network_id` as a decimal string and may omit optional
-network metadata from a later `ping()`, whereas the published adapter requires a complete
-string/number pair. The patch accepts only canonical safe-integer IDs, preserves missing optional
-metadata and rejects a network that contradicts the explicit transaction target. Because Xaman's
-public browser SDK does not expose its supported OAuth `force_network` parameter, the XCS adapter
-adds `force_network=TESTNET` only to the official Xaman authorization URL and evicts an older cached
-XCS OAuth session when it cannot prove Testnet. The patch also accepts an absent or empty
-`multisign_account` in a valid single-signature response: Xaman uses both forms for that
-inapplicable field, while the release candidate incorrectly requires an explicit `null`. Every
-signing payload separately carries `force_network: TESTNET`, and the adapter validates the resolved
-signing network. The patch also retries the authoritative resolved-payload read for sign-only
-requests: Xaman can report the signature before that payload is immediately readable, and the RC
-otherwise abandons the operation before XCS can validate and submit the blob. Remove these
-compatibility measures only after equivalent behavior ships in the pinned dependency.
-After a sign request resolves, the XCS adapter closes the script-opened Xaman window when browser
-policy allows it and restores focus to the application so submission progress remains visible.
+The chooser shows the pending wallet name while approval and network confirmation are outstanding.
+Connection errors stay at the top of the scrollable chooser. If the wallet reports another
+network, select XRP Ledger Testnet and retry; an existing app permission in the extension does not
+by itself establish the site's current session. Reloading the page requires connecting again
+because automatic reconnection is disabled.
+A connection must finish within 90 seconds; **Cancel connection** invalidates the attempt immediately,
+so a late extension response cannot reconnect it. Once approved, the header shows the wallet name,
+address, network and an explicit **Disconnect** action. Rejection and timeout errors remain visible.
+The open chooser updates when Crossmark emits its real provider-detection event; it does not require
+closing and reopening the menu. Account refresh before preparation/signing has a 10-second deadline.
+A timeout invalidates the session immediately, even if extension teardown hangs; late replies cannot
+restore the old account.
+
+The rc.2 Crossmark adapter does not forward session-change events. XCS listens to the official
+Crossmark SDK's `signout`, `user-change` and `network-change` events. Signout clears the connection;
+user/network notifications trigger an authoritative account refresh. Duplicate initialization
+notifications retain the approved session when its account and network are unchanged. Changed or
+unverifiable sessions are disconnected with an explanation. Pending sign-in events and other wallets
+are left alone. This does not replace the account/network and signature checks at submission.
+
+`pnpm --dir apps/web exec playwright test --config playwright.crossmark.config.ts` checks the full production
+connection path against `https://localhost:3443` (override with `XCS_WALLET_TEST_URL`). The test uses
+an isolated browser with a fixture of Crossmark's extension messages, including response envelopes
+and duplicate initialization notifications; it does not replace SDK methods or modify the deployed
+site. Set `XCS_BROWSER_EXECUTABLE` to Brave's executable when using the macOS-trusted local CA.
+Actual wallet approval still requires a manual extension test.
+
+The web app pins `xrpl-connect@1.0.0-rc.2` and
+`@xrpl-commons/xrpl-connect-vue@1.0.0-rc.2`. The official Vue plugin owns the application-scoped
+`WalletManager` and reactive account state. XCS uses its documented headless `connect()` API from a
+small CSP-compatible chooser: the packaged `<WalletConnector>` loads Google Fonts and inline styles,
+which do not satisfy XCS's current browser policy. XCS does not subclass wallet adapters.
+One versioned pnpm patch fixes the rc.2 ESM Crossmark adapter used by this application:
+it validates the network returned with the fresh SignIn approval instead of discarding it
+and reading Crossmark's separately hydrated background replica. Older responses that omit
+the network still require the live query. A present but incomplete network is rejected;
+Mainnet never becomes Testnet. Account refresh and pre-signature checks validate the documented
+SDK session network, updated by approval and network-change events. The raw background getter
+is stale in Crossmark 0.2.19; it is not used as a second network gate. Missing/malformed session
+data still fails closed, without falling back to the adapter's previous network. See
+[`patches/README.md`](./patches/README.md) for scope and removal criteria.
+It registers Xaman, Crossmark, GemWallet, WalletConnect, Ledger, Xyra, Otsu and MetaMask Snap. Xaman is added only when `NUXT_PUBLIC_XAMAN_API_KEY` is set, and
+WalletConnect only when `NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID` is set. Both values identify a
+public application to its wallet provider; they are browser-visible identifiers, not secrets.
+
+For local testing, keep Otsu and Crossmark in separate browser profiles. The inspected Otsu
+unpacked extension locks `window.xrpl` and `window.crossmark`; Crossmark 0.2.19 also writes
+those globals. Co-installation can prevent Crossmark's provider from initializing. This is
+an extension collision, not something the application should hide by faking availability.
+
+The pinned XRPL Connect packages declare MIT, but that does not clear every transitive dependency.
+The standalone license-policy run reports unresolved `Unknown` entries for
+`@gemwallet/api@3.8.0`, `@walletconnect/types@2.25.0` and `vaul-vue@0.4.1`, plus
+`nodemailer@10.0.10` (`MIT-0`, outside the current allowlist). Review the installed dependency
+artifacts and required notices; no license exception or policy relaxation was added by this port.
+Run dependency reports against the standalone lockfile with `--ignore-workspace`.
+
+`autoConnect` is disabled: an explicit selection in the XCS chooser is the only connection trigger,
+so a cached Xaman session is never presented as a fresh user action. Xaman may replace
+`LastLedgerSequence` during signing; XCS omits that volatile field from the Xaman request, then
+cryptographically checks the complete returned blob and permits only the SDK's explicit
+`LastLedgerSequence` refresh rule. The initial wallet network, active XCS profile and configured
+XRPL RPC are all required to resolve to Testnet before submission. XCS does not use Xaman's later
+optional `ping()` metadata as a second network gate.
+
+Otsu stores dApp permissions by origin and otherwise resolves a later `connect()` from the stored
+address without presenting the wallet approval again. Before an explicit Otsu selection, XCS calls
+the adapter's public `disconnect()` method to revoke that stale origin permission, then delegates the
+new connection to XRPL Connect. This keeps the selected account bound to a fresh user-approved Otsu
+session instead of silently reusing an older address. Otsu's extension service worker can retain the
+public account while its signing key is locked. XRPL Connect rc.2 currently mislabels the resulting
+Otsu `Account not found` failure as an uninstalled wallet. XCS rechecks the adapter's public
+availability, reports the signing-account failure accurately and closes that unusable session. The
+user must unlock Otsu and explicitly reconnect before retrying; XCS never accesses wallet keys or
+repeats a rejected signing request automatically.
 
 XCS filters this surface to adapters that expose `sign()` and never calls `signAndSubmit`. A wallet
 may return a `tx_blob` or signed `tx_json`; the application normalizes the artifact, derives and
@@ -218,9 +256,19 @@ before persistence or relay.
 
 Wallet capability is transaction-specific. GemWallet 3.8.x embeds an XRPL validator from before
 native XLS-70 Credentials: it can sign the `Payment` used for schema registration but rejects
-`CredentialCreate`, `CredentialAccept` and `CredentialDelete` before signing. XCS therefore keeps
-GemWallet available for schemas while blocking those three transactions early with
-`WALLET_CREDENTIAL_TRANSACTION_UNSUPPORTED`. Xaman has native Credential handling in its current
+`CredentialCreate`, `CredentialAccept` and `CredentialDelete` before signing. For these three types,
+XCS offers an explicit raw-signing path. The full reviewed transaction remains visible, and a new
+acknowledgement is required for every attempt: GemWallet displays a hex message, not decoded fields.
+This is a transaction authorization, not a login signature. XCS uses `GemWalletAPI.signMessage(hex,
+true)`, exported by XRPL Connect, because rc.2's generic message adapter discards the hex flag.
+`xrpl.js` validates and serializes the exact prepared transaction, binds its public key to the
+connected Testnet account, assembles the returned signature and verifies it through the same SDK
+boundary before journaling or submission. No keys enter XCS, no automatic fallback follows a
+rejection, and schema Payments still use the normal adapter. Raw signing currently supports master
+keys only; delegated regular keys and multisigning are rejected rather than guessed.
+See [the real GemWallet Testnet qualification](../../docs/runbooks/gemwallet-raw-signing.md) for
+validated create/accept/delete transactions, popup limitations and local rollback.
+Xaman has native Credential handling in its current
 source and is the preferred candidate when its public application identifier is configured, but it
 still requires the real-wallet Testnet gate below. Unknown adapters remain visible as unvalidated;
 if one emits the exact legacy `Invalid field TransactionType` error, XCS converts it to the same
@@ -236,7 +284,7 @@ signature, persistence and submission invariants, not a released wallet UI.
 
 The required Playwright gate exercises schema registration and credential issuance in Chromium,
 including the two distinct finality stages. Issuance first receives deliberately mismatched indexed
-evidence, withholds XCS success, then proves that `/operations` can re-confirm the exact event
+evidence, withholds XCS success, then proves that role recovery can re-confirm the exact event
 without signing or submitting again. The same deterministic journey accepts the pending Credential,
 removes the resulting active generation through the subject wallet, opens its exact deleted
 permalink and exports the sanitized `subject_removed` receipt. A separate case proves that rejecting
@@ -257,7 +305,7 @@ proves that an external IPFS CID absent from local storage is never described as
 
 ```bash
 pnpm --dir apps/web exec playwright install chromium
-pnpm test:e2e
+pnpm --dir apps/web test:e2e
 ```
 
 Playwright starts its own Nuxt development server with `XCS_BROWSER_E2E=1`. In that process only,
@@ -301,6 +349,52 @@ Private and public runtime switches must match exactly, and both the Nitro start
 plugin reject the mode outside a development bundle. `nuxt.config.ts` also rejects
 `XCS_BROWSER_E2E=1` when `NODE_ENV=production`.
 
+## Schema text fields
+
+Schema names (1–64 UTF-8 bytes) and descriptions (1–256 UTF-8 bytes) are required
+single-line protocol fields. The guided editor uses single-line inputs with byte
+counters and field-specific validation messages. Accents and emoji can use several
+bytes; the UI does not truncate or replace the submitted text. JSON mode uses the
+same protocol checks and identifies the failing field instead of discarding its
+error path.
+
+## Hosted HTTPS payloads
+
+Supply the complete hosted-payload contract, including `XCS_PUBLIC_PAYLOAD_BASE_URL`; the server
+derives the browser-visible origin from that validated value. Hosted issuance requires explicit
+public-storage consent and `XCS_LOCAL_PAYLOAD_STORE=0`.
+Canonical payloads larger than **64 KiB of UTF-8 bytes** are rejected before preparation and again
+before signing, matching the hosted API limit. External issuer-managed storage keeps its own limit.
+The page builds the immutable URI, signs and submits `CredentialCreate`, waits for
+ledger/indexer confirmation, then publishes the canonical bytes with the validated
+signed blob. It checks the publication receipt and reads the HTTPS bytes back.
+Before signing, a credential-specific HEAD request checks that the public host is
+reachable. A 404 is expected before first publication; network/CORS failures or
+server errors block signing. This does not prove future availability or successful
+publication. Sharing/acceptance links appear only after exact-byte publication
+verification succeeds, never just because the ledger transaction was validated.
+Issuer-managed external HTTPS hosting still requires publication before signing.
+
+The consented public payload is saved in a per-job browser recovery queue before opening the wallet.
+The validated signature is persisted before submission and linked to the operation journal. This
+link also recovers an interrupted second storage write. Storage/quota failures block submission;
+pending copies are never silently evicted. Up to 20 pending copies are retained until successful
+publication or explicit removal. Do not clear browser data while recovery is needed.
+
+After a reload, **Issue** and **Operations** show pending publications. **Retry payload publication**
+only uploads the same payload and signed transaction; it never signs or submits another credential.
+The API still requires validated, indexed evidence. If submission timed out, reconcile the original
+operation in Operations, then retry publication. Recovery is removed only after the receipt and
+HTTPS bytes verify; terminal journal signatures are then purged. Damaged records are isolated and
+can be explicitly removed without blocking valid jobs. An interrupted wallet approval with no
+recorded signature requires checking the wallet/Operations first, not blindly issuing again.
+Download the payload copy before removing an unfinished recovery record. Recovery is local to this
+browser profile and origin, not a backup across devices; it uses no test payload-serving fallback.
+
+Do not use a rotating tunnel domain for durable credentials: the URI on XRPL cannot
+follow a domain change. A tunnel can prove a disposable Testnet flow, but production
+requires a fixed domain and persistent, backed-up storage.
+
 ## Local browser payload store
 
 For manual Testnet flows without an issuer-controlled HTTPS host, start the development site with:
@@ -328,9 +422,9 @@ when enabled in a production build.
 ## Browser response security
 
 The Node SSR deployment emits defensive browser headers and a nonce-based strict Content Security
-Policy in `Content-Security-Policy-Report-Only`. The observed policy has no `unsafe-inline` or
+Policy in `Content-Security-Policy-Report-Only`. Scripts do not allow `unsafe-inline` or
 `unsafe-eval`: Nuxt's server-rendered scripts and styles receive a fresh random nonce for every HTML
-response. Production browser connections are limited to the same origin, HTTPS and WSS. Local
+response. Inline style attributes remain allowed for Nuxt UI positioning. Production browser connections are limited to the same origin, HTTPS and WSS. Local
 development additionally permits HTTP and WS for Vite HMR.
 
 The CSP is intentionally report-only until every enabled XRPL Connect adapter passes the manual
@@ -357,12 +451,7 @@ XRPL WSS endpoint.
 
 ## Configuration
 
-The complete contract is [`.env.example`](./.env.example): secrets and per-deployment values only.
-Behavioural settings and feature flags -- payload fetching, demo pinning, the metrics routes, the
-IPFS endpoints, the readiness threshold and the static issuer trust policy -- are checked-in code in
-[`server/xcs/settings.ts`](./server/xcs/settings.ts), with the same parsing and the same error
-messages as before. Changing one is a reviewed code change and an image rebuild, and a deployment
-variable of the same name has no effect. A minimal deployment sets:
+The complete contract is [`.env.example`](./.env.example). A minimal deployment sets:
 
 ```bash
 XCS_DATABASE_URL=postgres://xcs_api:...@db.example:5432/xcs
@@ -371,12 +460,13 @@ XCS_TRUSTED_PROXY_CIDRS=10.42.0.2/32
 XCS_NETWORK_PROFILE=/workspace/config/networks/testnet.json
 NUXT_PUBLIC_RPC_URL=wss://s.altnet.rippletest.net:51233
 NUXT_PUBLIC_XAMAN_API_KEY=optional-public-xaman-application-id
-NUXT_PUBLIC_XAMAN_REDIRECT_URL=https://xcs.example/
 NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID=optional-public-reown-project-id
 ```
 
 `XCS_DATABASE_URL` authenticates as the read-only `xcs_api` role that `db:bootstrap` provisions; the
-web app has no migration command and must never receive the admin URL. The database itself is
+web app has no migration command and must never receive the admin URL. Optional hosted publication,
+auth/admin and issuer services use distinct restricted writer pools configured in `.env.example`;
+none may reuse the projection reader connection for writes. The database itself is
 provisioned outside this repository, and the indexer owns every database command.
 
 Forwarded client addresses are ignored unless the immediate peer matches `XCS_TRUSTED_PROXY_CIDRS`.
@@ -386,27 +476,17 @@ behind an undeclared proxy.
 
 The active network profile is read from this application's own `/v1` API, parsed locally and matched
 against the RPC server's reported `network_id` before autofill and again before signing or recovery.
-This alpha rejects profiles other than XRPL Testnet (`networkId: 1`).
-
-The browser-visible profile identifier is the `profileId` inside the profile file named by
-`XCS_NETWORK_PROFILE` -- the same published file the indexer indexes -- rather than a variable of its
-own. The retired `NUXT_PUBLIC_PROFILE_ID` duplicated that value with nothing checking the two agreed,
-so a mismatch could have labelled one network's data with another network's name. A named profile is
-parsed at start-up and fails closed. If `XCS_NETWORK_PROFILE` is omitted the identifier is empty, and
-then exactly one Testnet profile must be available.
+This alpha rejects profiles other than XRPL Testnet (`networkId: 1`). The browser-visible profile ID
+is derived from `XCS_NETWORK_PROFILE`; if the file is omitted, exactly one Testnet profile must be
+available.
 
 `NUXT_PUBLIC_XAMAN_API_KEY` and `NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID` are optional public
 application identifiers. Omitting either variable removes only that adapter; it does not prevent the
 other six adapters from loading. Do not put a Xaman secret, WalletConnect relay secret, wallet key or
-other credential in either value. `NUXT_PUBLIC_XAMAN_REDIRECT_URL` is optional and otherwise defaults
-to the current application origin with a trailing slash. When set, it must be that exact same-origin
-root URL; non-loopback deployments require HTTPS. Add the same exact URL to the Xaman application's
-redirect allowlist.
-
-Each independently hosted XCS deployment needs its own Xaman public application key and registered
-origin. The Commons key is not a universal credential for arbitrary self-hosted domains. Follow
-Xaman's [browser SDK setup](https://docs.xaman.dev/environments/browser-web3); API secrets remain
-server-side and are not used by this browser integration.
+other credential in either value. Xaman redirect selection is delegated to its SDK; the old
+`NUXT_PUBLIC_XAMAN_REDIRECT_URL` variable is no longer consumed. Register the deployment's actual
+callback URLs and qualify homepage and deep-link sign-in separately. Each independently hosted
+deployment needs its own provider configuration.
 
 `XCS_LOCAL_PAYLOAD_STORE` is a source-time development gate rather than a deployment setting. Do not
 pass it through Compose or expose it as a general Commons storage option.
@@ -423,9 +503,10 @@ rather than either private indexer source.
 
 ## Pilot payload publication
 
-The deployed Commons beta issuance and acceptance flows support issuer-hosted public HTTPS payloads
-only; the loopback development aid documented above is intentionally not deployable. Commons does
-not store, cache or search credential claims. The issuer payload host must
+The public issuance and acceptance flows support public HTTPS payloads, either externally hosted or
+published through the optional signed-upload service above. The ledger projection does not contain
+claims; enabled payload services store them separately. Managed issuer private payloads follow the
+authorization rules below; the recipient workspace uses a separate authenticated private reader. The payload host must
 allow the web origin through CORS and return `application/json` (or a `+json` media type). Acceptance
 first displays only indexed metadata, the URI and its host. The subject must explicitly consent
 before the browser contacts that host. Consent stays in memory and is bound to the displayed
@@ -452,13 +533,12 @@ resolve the URI, so its remote resolver may remain disabled. There is intentiona
 fetch proxy, avoiding an SSRF trust boundary. IPFS remains part of the protocol and CLI, but is
 outside the Commons-hosted browser beta.
 
-The standalone `/verify` page opens `/credentials/:generationId` directly when the verifier has a
-shared generation ID. Its advanced tuple flow follows the same privacy boundary: it first reads and
-displays indexed credential metadata without contacting the issuer. Only after the verifier consents
-to the exact displayed host does the browser fetch the payload with credentials omitted, CORS
-enabled and redirects disabled, then POST the parsed object to the API. Verification never requests
-API-side URI resolution. A link generation constraint is checked before the host fetch and again
-before the result is accepted.
+The read-only exact Credential page preserves the integration-oriented verification boundary: it
+first reads indexed metadata without contacting the issuer. Only after explicit host consent does
+the browser fetch the payload with credentials omitted, CORS enabled and redirects disabled, then
+POST the parsed object to the API. Verification never requests API-side URI resolution. This is an
+Explorer/integrator surface; the guided verifier journey uses `/presentations` and never asks for a
+generation ID or tuple.
 
 The exact `/credentials/:generationId` permalink applies the same boundary while also showing the
 schema and bounded lifecycle timeline. Its server-rendered response loads only indexed generation,
@@ -483,8 +563,10 @@ exactly equal the reviewed transaction. SDK journal stages are retained with the
 `LastLedgerSequence`, profile, XRPL result and the minimum business context needed to reconcile the
 operation. Schema registration stores publisher, canonical schema digest and exact memo size.
 Issuance stores the tuple, public URI, payload digest and optional expiration. Tuple-only actions
-store the exact reviewed generation ID. The `/operations` page first checks transaction status by
-hash, but only after decoding the blob and matching its derived hash, `LastLedgerSequence`, account,
+store the exact reviewed generation ID. Managed issuer records keep only nonsecret references and
+visibility selections locally, never private claims, invitation tokens or email addresses. Role
+recovery first checks transaction status by hash, but only after decoding the blob and matching its
+derived hash, `LastLedgerSequence`, account,
 transaction type and any explicit `NetworkID` against the journal. Only a still-unvalidated
 transaction may be resubmitted, after checking that its generation is still current. The blob is
 removed from the local record as soon as the operation becomes `validated`, `expired`, or `failed`.
@@ -504,7 +586,12 @@ publisher and schema digest for registration; profile and credential tuple for i
 tuple and generation for every lifecycle action, independently of the selected action. A second
 recoverable operation with the same key is rejected. Ownership is checked atomically again after the
 wallet returns the signed blob and before submission. Only a `prepared` draft that has neither hash
-nor signed blob may be abandoned to release its key.
+nor signed blob may be abandoned to release its key. Managed issuance additionally reserves the
+invitation ID across recipient and issuer wallet choices. This survives reloads and excludes concurrent
+tabs in one browser profile, including a ledger-successful operation awaiting metadata recovery.
+It is not a distributed lock across browsers or devices: simultaneous devices can still sign an
+extra ledger object that the application refuses to attach. Backend metadata uniqueness does not
+reserve ledger execution.
 
 The profile-bound readiness endpoint is checked just before the wallet call and again after the
 wallet response. Once the SDK has validated the wallet artifact, the application immediately
@@ -531,8 +618,8 @@ treated as XCS-confirmed without new exact evidence.
 Receipts are sanitized local records, not signatures from Commons or independent trust anchors; a
 verifier must still resolve the referenced transaction against an authoritative XCS indexer.
 
-For any complete operation already validated with `tesSUCCESS`, `/operations` can re-check a
-`pending`, `timeout` or `mismatch` business confirmation. Schema registration uses the exact
+For any complete operation already validated with `tesSUCCESS`, the originating role screen can
+re-check a `pending`, `timeout` or `mismatch` business confirmation. Schema registration uses the exact
 `GET /v1/networks/:network/schema-registrations/:transactionHash` proof and requires its publisher
 and canonical digest before accepting the returned UID. Credential issuance and lifecycle actions
 use `GET /v1/networks/:network/credentials/:issuer/:subject/:schemaUid/events/:transactionHash` and
@@ -546,3 +633,51 @@ removal and issuer revocation return to that same generation page so its updated
 can be reviewed. A generation-bound subject action resolves that generation before the tuple lookup
 and rejects a connected wallet that is not its subject, instead of surfacing a misleading tuple 404.
 Reconfirmation never reads a signed blob, connects to XRPL or rebroadcasts the transaction.
+
+## Optional accounts and issuer workspace
+
+Authentication is disabled by default. `/account` supports XRP Identity authorization code/PKCE,
+PostgreSQL sessions, CSRF-protected mutations, role guards and verified Testnet wallet linking.
+Provision the application migrations and dedicated `xcs_app` pool before enabling it. Supported
+wallet message formats and real OIDC registration requirements are in the
+[authentication runbook](../../docs/runbooks/authentication.md). Public Explorer reads and public
+presentation resolution remain accountless; web mutations are role-guided.
+
+The admin workspace reviews issuer/verifier applications and documents, records decisions and
+manages approval/suspension. Approval grants application access, not issuer trust or protocol validity;
+admin status alone does not grant access to private credential claims. See
+[ADR 0005](../../docs/adr/0005-role-based-application.md).
+
+The optional issuer workspace provides onboarding, owned schemas, recipient invitations, issuance
+and revocation. It reuses the public transaction engine with server-derived organization, schema and
+claimant context, a linked issuer wallet and renewed approval checks before signing. The delivery
+email is not identity evidence: review the actual authenticated claimant and their verified wallet.
+A bearer link can be claimed by any authenticated holder. The recipient inbox provides consented
+private acceptance through the same wallet engine and revocable presentation links/QR codes.
+Approved verifiers open designated full presentations and retain metadata-only history/CSV.
+See the [issuer runbook](../../docs/runbooks/issuer.md) for provisioning and delivery semantics.
+
+Managed issuance defaults to private. The issuer reviews the complete authorized view and selected
+public claims before signing. Canonical bytes stay in private application storage; the immutable
+`/q/:locator` URI and digest, issuer/subject addresses and schema remain public on XRPL. Authorized
+issuer/recipient sessions may read the full payload; anonymous private views receive only selected
+claims. This is access control, not end-to-end encryption. Public disclosure cannot recall copies.
+The public reader omits credentials and treats a filtered `x-xcs-claim-scope: public` response as
+`PAYLOAD_SCOPE_RESTRICTED`, with integrity not checked, rather than claiming the full digest failed.
+
+After a confirmed ledger transaction, issuer recovery records its metadata or reconciles revocation
+without signing again. Pending or unknown journal outcomes remain blocked. An explicit reset requires
+matching durable proof of expiry or a validated failing transaction; it never treats a timeout as
+proof that signing is safe again. Browser-local recovery is lost when site data is cleared. Email
+notification status is separate from successful ledger recording and cannot undo it.
+
+See the [recipient/verifier runbook](../../docs/runbooks/recipient-verifier.md) for routes, grants,
+login handoff and upgrade order. These workspaces reuse the restricted issuer pool; they add no new
+connection URL. Presentation scope and current approval are checked server-side on each disclosure.
+
+The guided role journey now returns recipients to their inbox after wallet linking and shows
+issuers whether the actual claimant has a verified wallet ready for issuance. Every new presentation
+requires a separate wallet message signature bound to that exact credential, disclosure and audience.
+The verifier opens only the shared link: current organization admission, recipient address/ledger
+state and dated holder proof are displayed without manual URI input. Master-key proof limitations,
+legacy unsigned links and additive migration 0008 are described in the recipient/verifier runbook.
diff --git a/apps/web/app/app.vue b/apps/web/app/app.vue
index a0b9d6b..0e3f897 100644
--- a/apps/web/app/app.vue
+++ b/apps/web/app/app.vue
@@ -1,9 +1,20 @@
 <script setup lang="ts">
 const uiLocale = useUiLocale()
+const { locale } = useI18n()
+useHead(() => ({ htmlAttrs: { lang: locale.value === 'fr' ? 'fr-FR' : 'en-US' } }))
+onMounted(() => {
+  if (window.location.hash !== '#xcs-legacy-redirect') return
+  window.history.replaceState(
+    window.history.state,
+    '',
+    window.location.pathname + window.location.search,
+  )
+})
 </script>
 
 <template>
   <UApp :locale="uiLocale">
+    <span id="xcs-legacy-redirect" hidden aria-hidden="true" />
     <NuxtLayout>
       <NuxtPage />
     </NuxtLayout>
diff --git a/apps/web/app/components/AttestationFields.vue b/apps/web/app/components/AttestationFields.vue
new file mode 100644
index 0000000..b618624
--- /dev/null
+++ b/apps/web/app/components/AttestationFields.vue
@@ -0,0 +1,29 @@
+<script setup lang="ts">
+defineProps<{ claims: Record<string, unknown> }>()
+
+function nestedFields(value: object): Record<string, unknown> {
+  return Array.isArray(value)
+    ? Object.fromEntries(value.map((item, index) => [String(index + 1), item]))
+    : Object.fromEntries(Object.entries(value))
+}
+</script>
+
+<template>
+  <dl class="grid gap-3" data-testid="attestation-fields">
+    <div v-for="(value, key) in claims" :key="key" class="rounded border border-default p-3">
+      <dt class="font-semibold break-words">{{ key }}</dt>
+      <dd class="mt-1 break-words whitespace-pre-wrap">
+        <AttestationFields
+          v-if="value !== null && typeof value === 'object'"
+          class="mt-2"
+          :claims="nestedFields(value)"
+        />
+        <template v-else-if="value === null">{{ $t('simpleUi.notProvided') }}</template>
+        <template v-else-if="typeof value === 'boolean'">{{
+          $t(value ? 'simpleUi.yes' : 'simpleUi.no')
+        }}</template>
+        <template v-else>{{ String(value) }}</template>
+      </dd>
+    </div>
+  </dl>
+</template>
diff --git a/apps/web/app/components/AttestationStatus.vue b/apps/web/app/components/AttestationStatus.vue
new file mode 100644
index 0000000..e19ea71
--- /dev/null
+++ b/apps/web/app/components/AttestationStatus.vue
@@ -0,0 +1,12 @@
+<script setup lang="ts">
+const props = defineProps<{ value: string }>()
+const state = computed(() =>
+  ['active', 'pending', 'expired', 'deleted', 'not_found'].includes(props.value)
+    ? props.value
+    : 'unknown',
+)
+</script>
+
+<template>
+  <StatusPill :value="state" :label="$t(`simpleUi.states.${state}`)" />
+</template>
diff --git a/apps/web/app/components/BusinessFinality.vue b/apps/web/app/components/BusinessFinality.vue
index dab328a..8fdb452 100644
--- a/apps/web/app/components/BusinessFinality.vue
+++ b/apps/web/app/components/BusinessFinality.vue
@@ -7,76 +7,81 @@ defineProps<{
   ledgerIndex?: number | undefined
   businessConfirmation?: Exclude<BusinessConfirmation, 'pending'> | undefined
   businessEvidence?: BusinessEvidence | undefined
+  compact?: boolean
 }>()
 </script>
 
 <template>
   <UCard class="mb-6" data-testid="business-finality">
     <template #header>
-      <h2 class="text-xl font-semibold">{{ $t('finality.title') }}</h2>
+      <h2 class="text-xl font-semibold">{{ $t('simpleUi.finalityTitle') }}</h2>
     </template>
-    <StatusBox tone="notice" :title="$t('finality.xrplValidated')" data-testid="xrpl-finality">
-      <p>
-        <code>{{ txHash }}</code>
-      </p>
-      <p>{{ engineResult ?? 'tesSUCCESS' }} · ledger {{ ledgerIndex ?? '—' }}</p>
+    <StatusBox tone="notice" :title="$t('simpleUi.recorded')" data-testid="xrpl-finality">
     </StatusBox>
     <StatusBox
       v-if="businessConfirmation === 'confirmed'"
       tone="success"
-      :title="$t('finality.xcsConfirmed')"
+      :title="$t('simpleUi.completed')"
       data-testid="xcs-confirmed"
     />
     <StatusBox
       v-else-if="businessConfirmation === 'rejected'"
       tone="error"
-      :title="$t('finality.xcsRejected')"
+      :title="$t('simpleUi.rejected')"
       data-testid="xcs-rejected"
     >
-      <code v-if="businessEvidence?.reasonCode">{{ businessEvidence.reasonCode }}</code>
+      <p>{{ $t('simpleUi.rejectedHelp') }}</p>
     </StatusBox>
     <StatusBox
       v-else-if="businessConfirmation === 'mismatch'"
       tone="error"
-      :title="$t('finality.xcsMismatch')"
+      :title="$t('simpleUi.mismatch')"
       data-testid="xcs-mismatch"
     />
-    <StatusBox v-else tone="notice" :title="$t('finality.xcsPending')" data-testid="xcs-pending">
-      <p>{{ $t('finality.reconfirm') }}</p>
+    <StatusBox v-else tone="notice" :title="$t('simpleUi.processing')" data-testid="xcs-pending">
+      <p>{{ $t('simpleUi.noRepeat') }}</p>
     </StatusBox>
-    <MetadataList v-if="businessEvidence" class="mt-5">
-      <dt>{{ $t('finality.proofLedger') }}</dt>
-      <dd>{{ businessEvidence.ledgerIndex }}</dd>
-      <dt>{{ $t('finality.proofLedgerHash') }}</dt>
-      <dd>
-        <code>{{ businessEvidence.ledgerHash }}</code>
-      </dd>
-      <dt>{{ $t('finality.proofTransactionIndex') }}</dt>
-      <dd>{{ businessEvidence.transactionIndex }}</dd>
-      <template v-if="businessEvidence.schemaUid">
-        <dt>Schema UID</dt>
-        <dd>
-          <code>{{ businessEvidence.schemaUid }}</code>
-        </dd>
-      </template>
-      <template v-if="businessEvidence.generationId">
-        <dt>Generation ID</dt>
-        <dd>
-          <code>{{ businessEvidence.generationId }}</code>
-        </dd>
-      </template>
-      <template v-if="businessEvidence.eventType">
-        <dt>{{ $t('finality.proofEvent') }}</dt>
-        <dd>
-          <code>{{ businessEvidence.eventType }}</code>
-        </dd>
-      </template>
-      <template v-if="businessEvidence.deletionCause">
-        <dt>{{ $t('finality.proofDeletionCause') }}</dt>
+    <details v-if="!compact" class="mt-5" data-testid="finality-technical-details">
+      <summary class="cursor-pointer font-semibold">{{ $t('simpleUi.technicalDetails') }}</summary>
+      <p class="mt-3 break-all">
+        <code>{{ txHash }}</code>
+      </p>
+      <p>{{ engineResult ?? 'tesSUCCESS' }} · ledger {{ ledgerIndex ?? '—' }}</p>
+      <code v-if="businessEvidence?.reasonCode">{{ businessEvidence.reasonCode }}</code>
+      <MetadataList v-if="businessEvidence" class="mt-5">
+        <dt>{{ $t('finality.proofLedger') }}</dt>
+        <dd>{{ businessEvidence.ledgerIndex }}</dd>
+        <dt>{{ $t('finality.proofLedgerHash') }}</dt>
         <dd>
-          <code>{{ businessEvidence.deletionCause }}</code>
+          <code>{{ businessEvidence.ledgerHash }}</code>
         </dd>
-      </template>
-    </MetadataList>
+        <dt>{{ $t('finality.proofTransactionIndex') }}</dt>
+        <dd>{{ businessEvidence.transactionIndex }}</dd>
+        <template v-if="businessEvidence.schemaUid">
+          <dt>Schema UID</dt>
+          <dd>
+            <code>{{ businessEvidence.schemaUid }}</code>
+          </dd>
+        </template>
+        <template v-if="businessEvidence.generationId">
+          <dt>Generation ID</dt>
+          <dd>
+            <code>{{ businessEvidence.generationId }}</code>
+          </dd>
+        </template>
+        <template v-if="businessEvidence.eventType">
+          <dt>{{ $t('finality.proofEvent') }}</dt>
+          <dd>
+            <code>{{ businessEvidence.eventType }}</code>
+          </dd>
+        </template>
+        <template v-if="businessEvidence.deletionCause">
+          <dt>{{ $t('finality.proofDeletionCause') }}</dt>
+          <dd>
+            <code>{{ businessEvidence.deletionCause }}</code>
+          </dd>
+        </template>
+      </MetadataList>
+    </details>
   </UCard>
 </template>
diff --git a/apps/web/app/components/CredentialIssueForm.vue b/apps/web/app/components/CredentialIssueForm.vue
new file mode 100644
index 0000000..b0c99b9
--- /dev/null
+++ b/apps/web/app/components/CredentialIssueForm.vue
@@ -0,0 +1,923 @@
+<script setup lang="ts">
+import {
+  createHttpsPayloadUri,
+  encodeCredentialPayload,
+  parseJson,
+  payloadDigest,
+} from '#xcs/core/index.js'
+import { buildCredentialCreate } from '#xcs/sdk/index.js'
+import type { CredentialCreate } from 'xrpl'
+import type { WalletSubmissionResult } from '~/composables/useWallet'
+import {
+  claimsObjectToGuidedClaims,
+  guidedClaimsToJson,
+  guidedClaimsToPartialObject,
+  resolvedSchemaToGuidedClaims,
+  type GuidedClaimField,
+} from '~/utils/claimAuthoring'
+import { buildCredentialAcceptLink, buildCredentialPermalink } from '~/utils/operationLinks'
+import {
+  verifyHttpsPayloadPublication,
+  type PayloadPublicationProof,
+} from '~/utils/payloadPublication'
+import {
+  assertHostedPayloadReachable,
+  assertHostedPayloadSize,
+  createHostedPayloadLocation,
+  type PendingHostedPayload,
+} from '~/utils/hostedPayload'
+import { createHostedPublicationQueue } from '~/utils/hostedPublicationQueue'
+import { IndexedDbOperationJournal } from '~/utils/operationJournal'
+import { walletTransactionErrorMessage } from '~/utils/walletCompatibility'
+
+import {
+  assertIssuerPayloadReceipt,
+  claimPublicPointer,
+  issuerVisibilityPreview,
+  type IssuerIssueEngineContext,
+  type IssuerPayloadReceipt,
+} from '~/utils/issuerEngine'
+
+const props = defineProps<{ issuerContext?: IssuerIssueEngineContext }>()
+const emit = defineEmits<{ busy: [value: boolean] }>()
+const recovery = useIssuerEngineRecovery(() => props.issuerContext)
+const managedPayload = shallowRef<IssuerPayloadReceipt | null>(null)
+const visibility = ref<'private' | 'public'>('private')
+const publicFields = ref<string[]>([])
+const visibilityReviewed = ref(false)
+const claimObject = computed<Record<string, unknown>>(() => {
+  try {
+    const value = parseJson(claimsText.value)
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {}
+  } catch {
+    return {}
+  }
+})
+const visibilityPreview = computed(() =>
+  issuerVisibilityPreview(claimObject.value, {
+    visibility: visibility.value,
+    publicFields: publicFields.value,
+  }),
+)
+const route = useRoute()
+const localePath = useLocalePath()
+const { t } = useI18n()
+const config = useRuntimeConfig()
+const { account, busy, prepare, signAndSubmit } = useWallet()
+const { getActiveNetworkProfile, getSchema, publishHostedPayload } = useXcsApi()
+const hostedPayloadsEnabled = computed(
+  () => !props.issuerContext && config.public.payloadBaseUrl.trim().length > 0,
+)
+
+const schemaUid = ref(
+  props.issuerContext?.schemaUid ??
+    (typeof route.query.schema === 'string' ? route.query.schema : ''),
+)
+const subject = ref(props.issuerContext?.subjectAddress ?? '')
+const claimsEditorMode = ref<'guided' | 'json'>('guided')
+const guidedClaims = ref<GuidedClaimField[]>([])
+const guidedClaimsError = ref('')
+const loadedSchemaUid = ref('')
+const loadedSchemaName = ref('')
+const schemaLoadBusy = ref(false)
+const claimsText = ref('{}')
+const httpsUrl = ref('')
+const publicStoreAcknowledged = ref(false)
+const expiration = ref('')
+const publicationProof = ref<PayloadPublicationProof | null>(null)
+const publicationCheckBusy = ref(false)
+const flowBusy = ref(false)
+const canonicalPayload = ref('')
+const credentialUri = ref('')
+const transaction = shallowRef<CredentialCreate | null>(null)
+const preparedProfileId = ref('')
+const formError = ref('')
+const payloadLocator = ref('')
+const result = shallowRef<WalletSubmissionResult | null>(null)
+const pendingPublication = shallowRef<PendingHostedPayload | null>(null)
+const publicationJobId = ref('')
+const issuedLinkInputs = shallowRef<{
+  profileId: string
+  issuer: string
+  subject: string
+  schemaUid: string
+} | null>(null)
+const submissionBusy = computed(
+  () => busy.value || flowBusy.value || pendingPublication.value !== null || recovery.saving.value,
+)
+watch(submissionBusy, (value) => emit('busy', value), { immediate: true })
+let previewRevision = 0
+
+const formErrorMessage = computed(() => {
+  const walletError = walletTransactionErrorMessage(formError.value, t)
+  if (walletError) return walletError
+  if (formError.value === 'PAYLOAD_FETCH_FAILED') {
+    return t('issue.errors.payloadFetchFailed')
+  }
+  if (formError.value === 'PAYLOAD_HOST_UNREACHABLE_BEFORE_SIGNING') {
+    return t('issue.errors.hostedBeforeSigning')
+  }
+  if (formError.value === 'PAYLOAD_HTTPS_URL_REQUIRED') {
+    return t('issue.errors.httpsUrlRequired')
+  }
+  if (formError.value === 'PAYLOAD_HTTPS_URL_PLACEHOLDER') {
+    return t('issue.errors.httpsUrlPlaceholder')
+  }
+  if (formError.value === 'HOSTED_PAYLOAD_CONSENT_REQUIRED') {
+    return t('issue.errors.hostedConsent')
+  }
+  if (formError.value === 'PAYLOAD_SIZE_INVALID') return t('issue.errors.hostedSize')
+  if (formError.value.startsWith('PAYLOAD_RECOVERY_')) return t('issue.hosted.recoveryUnavailable')
+  if (
+    formError.value === 'PAYLOAD_SERVICE_NOT_CONFIGURED' ||
+    formError.value === 'PAYLOAD_SERVICE_HTTPS_REQUIRED' ||
+    formError.value === 'PAYLOAD_STORAGE_UNAVAILABLE'
+  ) {
+    return t('issue.errors.hostedUnavailable')
+  }
+  if (
+    formError.value === 'PAYLOAD_SERVICE_URL_TOO_LONG' ||
+    formError.value === 'SIGNED_TRANSACTION_PAYLOAD_MISMATCH' ||
+    formError.value === 'PAYLOAD_LOCATOR_MISMATCH' ||
+    formError.value === 'PUBLISHED_PAYLOAD_BYTES_MISMATCH'
+  ) {
+    return t('issue.errors.hostedIntegrity')
+  }
+  if (formError.value === 'HOSTED_PAYLOAD_PII_FIELD_FORBIDDEN') {
+    return t('issue.errors.hostedPii')
+  }
+  if (formError.value === 'PAYLOAD_PUBLICATION_QUOTA_EXCEEDED') {
+    return t('issue.errors.hostedQuota')
+  }
+  if (formError.value === 'SIGNED_TRANSACTION_NOT_INDEXED') {
+    return t('issue.errors.hostedNotIndexed')
+  }
+  return props.issuerContext ? t('simpleIssuer.error') : formError.value
+})
+
+const formErrorIsLocalized = computed(
+  () => formError.value.length > 0 && formErrorMessage.value !== formError.value,
+)
+
+function assertPayloadHttpsUrlIsConfigured(value: string): void {
+  if (value.length === 0) throw new Error('PAYLOAD_HTTPS_URL_REQUIRED')
+
+  let url: URL
+  try {
+    url = new URL(value)
+  } catch {
+    throw new Error('PAYLOAD_HTTPS_URL_REQUIRED')
+  }
+  const hostname = url.hostname.toLowerCase().replace(/\.$/u, '')
+  if (hostname === 'example' || hostname.endsWith('.example')) {
+    throw new Error('PAYLOAD_HTTPS_URL_PLACEHOLDER')
+  }
+}
+
+watch(recovery.pending, (current, previous) => {
+  if (previous && !current && !recovery.saved.value) invalidatePreview()
+})
+
+function invalidatePreview() {
+  managedPayload.value = null
+  visibilityReviewed.value = false
+  previewRevision += 1
+  publicStoreAcknowledged.value = false
+  publicationProof.value = null
+  canonicalPayload.value = ''
+  credentialUri.value = ''
+  payloadLocator.value = ''
+  transaction.value = null
+  preparedProfileId.value = ''
+  result.value = null
+  issuedLinkInputs.value = null
+}
+
+watch([schemaUid, subject, claimsText, httpsUrl, expiration], invalidatePreview)
+watch(claimsEditorMode, invalidatePreview)
+watch([visibility, publicFields], invalidatePreview, { deep: true })
+onMounted(() => {
+  if (props.issuerContext && !props.issuerContext.existingCredential) void loadGuidedClaimForm()
+})
+watch(
+  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
+  invalidatePreview,
+)
+watch(schemaUid, (value) => {
+  if (value.toLowerCase() === loadedSchemaUid.value) return
+  guidedClaims.value = []
+  guidedClaimsError.value = ''
+  loadedSchemaUid.value = ''
+  loadedSchemaName.value = ''
+})
+watch(
+  guidedClaims,
+  (fields) => {
+    if (claimsEditorMode.value !== 'guided') return
+    invalidatePreview()
+    try {
+      claimsText.value = JSON.stringify(guidedClaimsToPartialObject(fields), null, 2)
+      guidedClaimsToJson(fields)
+      guidedClaimsError.value = ''
+    } catch (error) {
+      guidedClaimsError.value = error instanceof Error ? error.message : String(error)
+    }
+  },
+  { deep: true },
+)
+
+async function loadGuidedClaimForm() {
+  const requestedUid = schemaUid.value.toLowerCase()
+  formError.value = ''
+  if (!/^[0-9a-f]{64}$/.test(requestedUid)) {
+    formError.value = 'SCHEMA_UID_INVALID'
+    return
+  }
+  schemaLoadBusy.value = true
+  try {
+    const profile = await getActiveNetworkProfile()
+    if (props.issuerContext && profile.profileId !== props.issuerContext.profileId)
+      throw new Error('ISSUER_PROFILE_MISMATCH')
+    const schema = await getSchema(requestedUid, profile.profileId)
+    if (schemaUid.value.toLowerCase() !== requestedUid) {
+      throw new Error('SCHEMA_CHANGED_DURING_LOAD')
+    }
+    guidedClaims.value = claimsObjectToGuidedClaims(
+      resolvedSchemaToGuidedClaims(schema.resolved),
+      parseJson(claimsText.value),
+    )
+    loadedSchemaUid.value = requestedUid
+    loadedSchemaName.value = schema.name
+    invalidatePreview()
+    claimsEditorMode.value = 'guided'
+    guidedClaimsError.value = ''
+  } catch (error) {
+    formError.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    schemaLoadBusy.value = false
+  }
+}
+
+function selectClaimsEditorMode(mode: 'guided' | 'json') {
+  if (mode === claimsEditorMode.value) return
+  formError.value = ''
+  if (mode === 'json') {
+    claimsText.value = JSON.stringify(guidedClaimsToPartialObject(guidedClaims.value), null, 2)
+    claimsEditorMode.value = mode
+    return
+  }
+  if (loadedSchemaUid.value !== schemaUid.value.toLowerCase() || guidedClaims.value.length === 0) {
+    formError.value = 'GUIDED_CLAIMS_SCHEMA_REQUIRED'
+    return
+  }
+  let convertedClaims: GuidedClaimField[]
+  try {
+    convertedClaims = claimsObjectToGuidedClaims(guidedClaims.value, parseJson(claimsText.value))
+  } catch (error) {
+    formError.value = error instanceof Error ? error.message : String(error)
+    return
+  }
+  invalidatePreview()
+  guidedClaims.value = convertedClaims
+  claimsEditorMode.value = mode
+}
+
+function downloadPayload() {
+  const blob = new Blob([canonicalPayload.value], { type: 'application/json' })
+  const url = URL.createObjectURL(blob)
+  const anchor = document.createElement('a')
+  anchor.href = url
+  anchor.download = 'xcs-credential.json'
+  anchor.click()
+  URL.revokeObjectURL(url)
+}
+
+async function buildPreview() {
+  if (props.issuerContext?.existingCredential) return
+  if (props.issuerContext && (recovery.pending.value || recovery.saved.value)) return
+  invalidatePreview()
+  formError.value = ''
+  result.value = null
+  if (!account.value) return void (formError.value = 'WALLET_NOT_CONNECTED')
+  const revision = previewRevision
+  const issuerAddress = account.value.address
+  const normalizedSchemaUid = schemaUid.value.toLowerCase()
+  const subjectAddress = subject.value
+  let claimsInput = claimsText.value
+  const expirationInput = expiration.value
+  try {
+    if (claimsEditorMode.value === 'guided') {
+      if (loadedSchemaUid.value !== normalizedSchemaUid) {
+        throw new Error('GUIDED_CLAIMS_SCHEMA_REQUIRED')
+      }
+      claimsInput = guidedClaimsToJson(guidedClaims.value)
+    }
+    const profile = await getActiveNetworkProfile()
+    if (props.issuerContext) {
+      if (profile.profileId !== props.issuerContext.profileId)
+        throw new Error('ISSUER_PROFILE_MISMATCH')
+      await props.issuerContext.beforeSign(issuerAddress)
+    }
+    const schema = await getSchema(normalizedSchemaUid, profile.profileId)
+    if (revision !== previewRevision) throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_BUILD')
+    const claims = parseJson(claimsInput)
+    const canonical = encodeCredentialPayload(claims, {
+      issuer: issuerAddress,
+      subject: subjectAddress,
+      schemaUid: normalizedSchemaUid,
+      fields: schema.resolved.fields,
+    }).json
+    canonicalPayload.value = canonical
+    if (props.issuerContext) {
+      const managed = await props.issuerContext.preparePayload(canonical, {
+        visibility: visibility.value,
+        publicFields: [...publicFields.value],
+      })
+      assertIssuerPayloadReceipt(managed, canonical)
+      if (revision !== previewRevision) throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_BUILD')
+      managedPayload.value = managed
+      credentialUri.value = managed.credentialUri
+      payloadLocator.value = managed.payloadId
+    } else if (hostedPayloadsEnabled.value) {
+      const hosted = createHostedPayloadLocation(config.public.payloadBaseUrl, canonical)
+      credentialUri.value = hosted.credentialUri
+      payloadLocator.value = hosted.locator
+    } else {
+      assertPayloadHttpsUrlIsConfigured(httpsUrl.value)
+      credentialUri.value = createHttpsPayloadUri(httpsUrl.value, canonical)
+      payloadLocator.value = 'issuer-hosted'
+    }
+    const raw = buildCredentialCreate({
+      issuer: issuerAddress,
+      subject: subjectAddress,
+      schemaUid: normalizedSchemaUid,
+      uri: credentialUri.value,
+      ...(expirationInput ? { expiration: new Date(expirationInput).toISOString() } : {}),
+    })
+    const prepared = (await prepare(raw, profile)) as CredentialCreate
+    if (revision !== previewRevision) throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_BUILD')
+    transaction.value = prepared
+    preparedProfileId.value = profile.profileId
+  } catch (error) {
+    transaction.value = null
+    formError.value = error instanceof Error ? error.message : String(error)
+  }
+}
+
+async function submit() {
+  if (pendingPublication.value || flowBusy.value) return
+  const preparedTransaction = transaction.value
+  const expectedPayload = canonicalPayload.value
+  const expectedUri = credentialUri.value
+  const expectedIssuer = account.value?.address
+  const expectedSubject = subject.value
+  const expectedSchemaUid = schemaUid.value.toLowerCase()
+  const expectedClaims = claimsText.value
+  const expectedClaimsEditorMode = claimsEditorMode.value
+  const expectedGuidedClaims = JSON.stringify(guidedClaims.value)
+  const expectedLocator = payloadLocator.value
+  const expectedPublicStoreAcknowledged = publicStoreAcknowledged.value
+  const expectedExpiration = expiration.value
+  const expectedProfileId = preparedProfileId.value
+  const expectedRevision = previewRevision
+  const expectedManagedPayload = managedPayload.value
+  const expectedVisibility = visibility.value
+  const expectedPublicFields = [...publicFields.value]
+  if (props.issuerContext && (!expectedManagedPayload || !visibilityReviewed.value)) {
+    formError.value = 'ISSUER_VISIBILITY_REVIEW_REQUIRED'
+    return
+  }
+  if (hostedPayloadsEnabled.value && !expectedPublicStoreAcknowledged) {
+    formError.value = 'HOSTED_PAYLOAD_CONSENT_REQUIRED'
+    return
+  }
+  if (
+    !preparedTransaction ||
+    !expectedPayload ||
+    !expectedUri ||
+    !expectedIssuer ||
+    !expectedLocator ||
+    !expectedProfileId
+  ) {
+    formError.value = 'TRANSACTION_PREVIEW_REQUIRED'
+    return
+  }
+  if (hostedPayloadsEnabled.value) {
+    const exactPublicationConfirmed = window.confirm(
+      t('issue.hosted.confirmExactPublication', {
+        url: expectedUri.split('#')[0],
+        payload: expectedPayload,
+      }),
+    )
+    if (!exactPublicationConfirmed) return
+  }
+
+  flowBusy.value = true
+  publicationCheckBusy.value = !hostedPayloadsEnabled.value
+  publicationProof.value = null
+  formError.value = ''
+  try {
+    const assertCurrent = () => {
+      if (
+        previewRevision !== expectedRevision ||
+        transaction.value !== preparedTransaction ||
+        canonicalPayload.value !== expectedPayload ||
+        credentialUri.value !== expectedUri ||
+        account.value?.address !== expectedIssuer ||
+        subject.value !== expectedSubject ||
+        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
+        claimsText.value !== expectedClaims ||
+        claimsEditorMode.value !== expectedClaimsEditorMode ||
+        JSON.stringify(guidedClaims.value) !== expectedGuidedClaims ||
+        payloadLocator.value !== expectedLocator ||
+        publicStoreAcknowledged.value !== expectedPublicStoreAcknowledged ||
+        expiration.value !== expectedExpiration ||
+        preparedProfileId.value !== expectedProfileId ||
+        managedPayload.value !== expectedManagedPayload ||
+        visibility.value !== expectedVisibility ||
+        JSON.stringify(publicFields.value) !== JSON.stringify(expectedPublicFields)
+      ) {
+        throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_PUBLICATION_CHECK')
+      }
+    }
+    if (props.issuerContext) {
+      await props.issuerContext.beforeSign(expectedIssuer)
+    } else if (hostedPayloadsEnabled.value) {
+      assertHostedPayloadSize(expectedPayload)
+      await assertHostedPayloadReachable(expectedUri)
+    } else {
+      publicationProof.value = await verifyHttpsPayloadPublication({
+        canonicalPayload: expectedPayload,
+        credentialUri: expectedUri,
+      })
+    }
+    assertCurrent()
+    publicationCheckBusy.value = false
+    if (hostedPayloadsEnabled.value) {
+      publicationJobId.value = createHostedPublicationQueue(localStorage).begin({
+        network: expectedProfileId,
+        locator: expectedLocator,
+        canonicalPayload: expectedPayload,
+        credentialUri: expectedUri,
+      }).id
+    }
+    const normalizedExpiration = expectedExpiration
+      ? new Date(expectedExpiration).toISOString()
+      : undefined
+    const response = await signAndSubmit(
+      preparedTransaction,
+      {
+        action: 'credential-issue',
+        issuer: expectedIssuer,
+        subject: expectedSubject,
+        schemaUid: expectedSchemaUid,
+        credentialUri: expectedUri,
+        payloadDigestHex: payloadDigest(expectedPayload),
+        ...(props.issuerContext ? { issuerInviteId: props.issuerContext.inviteId } : {}),
+        ...(publicationJobId.value ? { publicationJobId: publicationJobId.value } : {}),
+        ...(normalizedExpiration ? { expiration: normalizedExpiration } : {}),
+      },
+      assertCurrent,
+      async (signature) => {
+        if (props.issuerContext && expectedManagedPayload) {
+          await props.issuerContext.beforeSign(expectedIssuer)
+          assertCurrent()
+          recovery.stash({
+            transactionHash: signature.txHash,
+            payloadId: expectedManagedPayload.payloadId,
+            visibility: expectedVisibility,
+            publicFields: expectedPublicFields,
+          })
+        }
+        if (publicationJobId.value) {
+          pendingPublication.value = createHostedPublicationQueue(localStorage).signed(
+            publicationJobId.value,
+            signature,
+          ).payload
+        }
+      },
+      (validated) => {
+        issuedLinkInputs.value = {
+          profileId: expectedProfileId,
+          issuer: expectedIssuer,
+          subject: expectedSubject,
+          schemaUid: expectedSchemaUid,
+        }
+        result.value = { ...validated }
+        // Ledger success is irreversible. Keep publication retryable even if
+        // waiting for the indexer fails, and never offer to issue it again.
+        transaction.value = null
+      },
+    )
+    result.value = response
+    transaction.value = null
+    await publishPendingPayload()
+    await recovery.finish(response)
+  } catch (error) {
+    formError.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    // An interrupted/failed signing attempt without a returned signature stays
+    // recoverable after reload. Never silently delete the only saved payload.
+    if (!pendingPublication.value) publicationJobId.value = ''
+    publicationCheckBusy.value = false
+    flowBusy.value = false
+    await recovery.checkFailure()
+  }
+}
+
+async function publishPendingPayload() {
+  const pending = pendingPublication.value
+  if (!pending) return
+  publicationCheckBusy.value = true
+  try {
+    const completedJobId = publicationJobId.value
+    publicationProof.value = await createHostedPublicationQueue(localStorage).publish(
+      completedJobId,
+      publishHostedPayload,
+    )
+    pendingPublication.value = null
+    publicationJobId.value = ''
+    transaction.value = null
+    try {
+      await new IndexedDbOperationJournal().completePublication(completedJobId)
+    } catch {
+      // Publication is already verified. A cleanup failure must not offer an
+      // impossible publication retry or imply that the credential was not issued.
+      formError.value = t('issue.hosted.journalCleanupFailed')
+    }
+  } finally {
+    publicationCheckBusy.value = false
+  }
+}
+
+async function retryPublication() {
+  if (flowBusy.value || busy.value) return
+  flowBusy.value = true
+  formError.value = ''
+  try {
+    await publishPendingPayload()
+  } catch (error) {
+    formError.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    flowBusy.value = false
+  }
+}
+
+const acceptLink = computed(() => {
+  const generationId = result.value?.businessEvidence?.generationId
+  if (
+    result.value?.businessConfirmation !== 'confirmed' ||
+    !publicationProof.value ||
+    pendingPublication.value !== null ||
+    !generationId ||
+    !issuedLinkInputs.value
+  ) {
+    return null
+  }
+  return buildCredentialAcceptLink({ ...issuedLinkInputs.value, generationId })
+})
+
+const credentialLink = computed(() => {
+  const generationId = result.value?.businessEvidence?.generationId
+  if (
+    result.value?.businessConfirmation !== 'confirmed' ||
+    !generationId ||
+    !issuedLinkInputs.value
+  ) {
+    return null
+  }
+  return buildCredentialPermalink({
+    profileId: issuedLinkInputs.value.profileId,
+    generationId,
+  })
+})
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('simpleIssuer.issueTitle')" :lead="$t('simpleIssuer.issueLead')" />
+    <StatusBox v-if="!issuerContext" tone="warning">{{ $t('issue.noPii') }}</StatusBox>
+    <HostedPublicationRecovery v-if="!issuerContext" :exclude-id="publicationJobId" />
+    <IssuerEngineRecovery
+      v-if="issuerContext"
+      :pending="recovery.pending.value"
+      :saved="recovery.saved.value"
+      :busy="recovery.saving.value"
+      :error="recovery.error.value"
+      :can-restart="recovery.canRestart.value"
+      @restart="recovery.restart"
+      @retry="recovery.retry"
+    />
+
+    <UCard
+      v-if="
+        !issuerContext ||
+        (!issuerContext.existingCredential && !recovery.pending.value && !recovery.saved.value)
+      "
+      class="mb-6"
+    >
+      <div class="grid gap-5">
+        <template v-if="issuerContext">
+          <p>
+            <strong>{{ $t('simpleIssuer.model') }}:</strong> {{ issuerContext.schemaName }}
+          </p>
+          <p>
+            <strong>{{ $t('simpleIssuer.recipient') }}:</strong> {{ issuerContext.recipientLabel }}
+          </p>
+        </template>
+        <UFormField v-if="!issuerContext" label="Schema UID">
+          <UInput
+            id="schema-uid"
+            v-model.trim="schemaUid"
+            required
+            pattern="[0-9a-fA-F]{64}"
+            :disabled="submissionBusy"
+          />
+        </UFormField>
+        <UFormField v-if="!issuerContext" label="Subject">
+          <UInput
+            id="subject"
+            v-model.trim="subject"
+            required
+            placeholder="r…"
+            :disabled="submissionBusy"
+          />
+        </UFormField>
+
+        <div class="flex flex-wrap gap-3">
+          <UButton
+            v-if="claimsEditorMode === 'json'"
+            color="neutral"
+            variant="outline"
+            :disabled="submissionBusy"
+            @click="selectClaimsEditorMode('guided')"
+            >{{ $t('simpleIssuer.guided') }}</UButton
+          >
+          <UButton
+            v-if="!issuerContext || (guidedClaims.length === 0 && !schemaLoadBusy)"
+            color="neutral"
+            variant="outline"
+            :disabled="submissionBusy || schemaLoadBusy"
+            @click="loadGuidedClaimForm"
+            >{{ $t('issue.loadSchema') }}</UButton
+          >
+          <details v-if="!issuerContext">
+            <summary class="cursor-pointer text-sm text-muted">
+              {{ $t('simpleIssuer.advanced') }}
+            </summary>
+            <UButton
+              class="mt-2"
+              color="neutral"
+              variant="outline"
+              :disabled="submissionBusy"
+              @click="selectClaimsEditorMode('json')"
+              >{{ $t('simpleIssuer.editJson') }}</UButton
+            >
+          </details>
+        </div>
+
+        <template v-if="claimsEditorMode === 'guided'">
+          <p v-if="loadedSchemaName" class="text-sm text-muted">
+            {{ $t('simpleIssuer.model') }} : {{ loadedSchemaName }}
+          </p>
+          <div v-if="guidedClaims.length" class="grid gap-4">
+            <UFormField
+              v-for="field in guidedClaims"
+              :key="field.name"
+              :label="field.name"
+              :hint="`${$t(`simpleIssuer.fieldTypes.${field.type}`)} · ${$t(field.optional ? 'issue.optionalField' : 'issue.requiredField')}`"
+            >
+              <USelect
+                v-if="field.type === 'bool'"
+                :id="`claim-${field.name}`"
+                v-model="field.value"
+                :items="[
+                  { label: '—', value: undefined },
+                  { label: $t('simpleIssuer.yes'), value: 'true' },
+                  { label: $t('simpleIssuer.no'), value: 'false' },
+                ]"
+                :required="!field.optional"
+                :disabled="submissionBusy"
+              />
+              <UInput
+                v-else
+                :id="`claim-${field.name}`"
+                v-model="field.value"
+                :required="!field.optional"
+                :inputmode="field.type === 'uint' || field.type === 'int' ? 'numeric' : 'text'"
+                :disabled="submissionBusy"
+                autocomplete="off"
+              />
+            </UFormField>
+          </div>
+          <p v-else class="text-sm text-muted">{{ $t('issue.advancedClaimsHint') }}</p>
+          <StatusBox v-if="guidedClaimsError && guidedClaims.length" tone="error">
+            <p>{{ $t('simpleIssuer.fieldError') }}</p>
+            <details v-if="!issuerContext">
+              <summary class="cursor-pointer">{{ $t('simpleIssuer.technical') }}</summary>
+              <code>{{ guidedClaimsError }}</code>
+            </details>
+          </StatusBox>
+        </template>
+        <template v-else>
+          <UFormField label="Claims JSON">
+            <UTextarea
+              id="claims"
+              v-model="claimsText"
+              :rows="12"
+              spellcheck="false"
+              :disabled="submissionBusy"
+            />
+          </UFormField>
+        </template>
+
+        <div v-if="issuerContext" class="grid gap-4">
+          <UFormField :label="$t('simpleIssuer.visibility')">
+            <USelect
+              v-model="visibility"
+              :disabled="submissionBusy"
+              :items="[
+                { label: $t('simpleIssuer.private'), value: 'private' },
+                { label: $t('simpleIssuer.public'), value: 'public' },
+              ]"
+            />
+          </UFormField>
+          <StatusBox v-if="visibility === 'public'" tone="warning">{{
+            $t('simpleIssuer.publicWarning')
+          }}</StatusBox>
+          <fieldset v-else class="grid gap-2">
+            <legend>{{ $t('simpleIssuer.publicFields') }}</legend>
+            <UCheckbox
+              v-for="name in Object.keys(claimObject)"
+              :key="name"
+              :label="name"
+              :model-value="publicFields.includes(claimPublicPointer(name))"
+              :disabled="submissionBusy"
+              @update:model-value="
+                (checked) => {
+                  publicFields = checked
+                    ? [...publicFields, claimPublicPointer(name)]
+                    : publicFields.filter((field) => field !== claimPublicPointer(name))
+                }
+              "
+            />
+          </fieldset>
+          <p class="text-sm text-muted">{{ $t('simpleIssuer.publicMetadata') }}</p>
+        </div>
+        <StatusBox
+          v-else-if="hostedPayloadsEnabled"
+          tone="notice"
+          :title="$t('issue.hosted.title')"
+        >
+          {{ $t('issue.hosted.description', { origin: config.public.payloadBaseUrl }) }}
+        </StatusBox>
+        <UFormField v-else :label="$t('issue.httpsUrlLabel')" :help="$t('issue.httpsProof')">
+          <UInput
+            id="https-url"
+            v-model.trim="httpsUrl"
+            type="url"
+            required
+            autocomplete="off"
+            :placeholder="$t('issue.httpsUrlPlaceholder')"
+            :disabled="submissionBusy"
+          />
+        </UFormField>
+
+        <UFormField :label="$t('simpleIssuer.expiration')">
+          <UInput
+            id="expiration"
+            v-model="expiration"
+            type="datetime-local"
+            :disabled="submissionBusy"
+          />
+        </UFormField>
+        <div>
+          <UButton type="button" :disabled="submissionBusy" @click="buildPreview">
+            {{ $t('simpleIssuer.reviewIssue') }}
+          </UButton>
+        </div>
+      </div>
+    </UCard>
+
+    <StatusBox
+      v-if="formError"
+      tone="error"
+      data-testid="issue-error"
+      :title="formErrorMessage"
+      role="alert"
+    >
+      <details v-if="formErrorIsLocalized && !issuerContext">
+        <summary class="cursor-pointer">{{ $t('simpleIssuer.technical') }}</summary>
+        <code>{{ formError }}</code>
+      </details>
+    </StatusBox>
+
+    <UCard v-if="canonicalPayload" class="mb-6">
+      <template #header>
+        <h2 class="text-xl font-semibold">{{ $t('simpleIssuer.reviewTitle') }}</h2>
+      </template>
+      <div v-if="issuerContext" class="grid gap-4 sm:grid-cols-2">
+        <section>
+          <h3 class="font-semibold">{{ $t('simpleIssuer.publicPreview') }}</h3>
+          <AttestationFields :claims="visibilityPreview.public" />
+        </section>
+        <section>
+          <h3 class="font-semibold">{{ $t('simpleIssuer.privatePreview') }}</h3>
+          <AttestationFields :claims="visibilityPreview.private" />
+        </section>
+      </div>
+      <JsonBlock v-else :code="canonicalPayload" />
+      <UCheckbox
+        v-if="issuerContext"
+        v-model="visibilityReviewed"
+        :disabled="submissionBusy"
+        :label="$t('simpleIssuer.visibilityReviewed')"
+      />
+      <details v-if="!issuerContext" class="mt-4">
+        <summary class="cursor-pointer text-sm text-muted">
+          {{ $t('simpleIssuer.technical') }}
+        </summary>
+        <p class="mt-2 text-sm break-all">
+          <code>{{ credentialUri }}</code>
+        </p>
+        <JsonBlock class="mt-3" :code="canonicalPayload" />
+        <UButton class="mt-3" color="neutral" variant="outline" @click="downloadPayload">{{
+          $t('simpleIssuer.download')
+        }}</UButton>
+      </details>
+      <p v-if="!issuerContext" class="text-sm break-all">
+        <code>{{ credentialUri }}</code>
+      </p>
+      <UCheckbox
+        v-if="hostedPayloadsEnabled"
+        v-model="publicStoreAcknowledged"
+        :disabled="submissionBusy"
+        :label="$t('issue.hosted.consent', { url: credentialUri.split('#')[0] })"
+      />
+      <div v-if="!issuerContext" class="my-4">
+        <UButton color="neutral" variant="outline" type="button" @click="downloadPayload">
+          {{ $t('issue.download') }}
+        </UButton>
+      </div>
+      <p v-if="hostedPayloadsEnabled" class="text-sm text-muted">
+        {{ $t('issue.hosted.publishAfterSignature') }}
+      </p>
+      <p v-else-if="!issuerContext" class="text-sm break-words text-muted">
+        {{ $t('issue.publishBeforeSigning', { url: httpsUrl }) }}
+      </p>
+      <StatusBox v-if="publicationCheckBusy" tone="notice">{{ $t('issue.checking') }}</StatusBox>
+      <StatusBox v-else-if="publicationProof" tone="success">
+        <p class="break-all">
+          {{ $t('issue.checked', { bytes: publicationProof.byteLength }) }}
+          <code>{{ publicationProof.digestHex }}</code>
+        </p>
+      </StatusBox>
+    </UCard>
+
+    <TransactionPreview
+      :transaction="transaction"
+      :busy="submissionBusy"
+      :compact="!!issuerContext"
+      :confirm-label="$t('simpleIssuer.sendIssue')"
+      @confirm="submit"
+    />
+    <StatusBox v-if="pendingPublication" tone="notice" role="status">
+      <p>{{ $t('issue.hosted.publicationPending') }}</p>
+      <UButton
+        type="button"
+        :disabled="flowBusy || busy"
+        data-testid="retry-hosted-publication"
+        @click="retryPublication"
+      >
+        {{ $t('issue.hosted.retryPublication') }}
+      </UButton>
+    </StatusBox>
+    <BusinessFinality
+      v-if="result"
+      :tx-hash="result.txHash"
+      :engine-result="result.transactionResult"
+      :ledger-index="result.ledgerIndex"
+      :business-confirmation="result.businessConfirmation"
+      :business-evidence="result.businessEvidence"
+      :compact="!!issuerContext"
+    />
+    <UCard v-if="!issuerContext && acceptLink && credentialLink" class="mb-6">
+      <template #header>
+        <h2 class="text-xl font-semibold">{{ $t('issue.links') }}</h2>
+      </template>
+      <div class="flex flex-wrap gap-3">
+        <UButton
+          color="neutral"
+          variant="outline"
+          data-testid="issue-credential-link"
+          :to="localePath(credentialLink)"
+        >
+          {{ $t('issue.credentialLink') }}
+        </UButton>
+        <UButton color="neutral" variant="outline" :to="localePath(acceptLink)">
+          {{ $t('issue.acceptLink') }}
+        </UButton>
+      </div>
+    </UCard>
+  </UContainer>
+</template>
diff --git a/apps/web/app/components/CredentialRevokeForm.vue b/apps/web/app/components/CredentialRevokeForm.vue
new file mode 100644
index 0000000..a42fd28
--- /dev/null
+++ b/apps/web/app/components/CredentialRevokeForm.vue
@@ -0,0 +1,394 @@
+<script setup lang="ts">
+import { decodeHexUtf8, rippleTimeToIso } from '#xcs/core/index.js'
+import { buildCredentialDelete } from '#xcs/sdk/index.js'
+import type { CredentialDelete } from 'xrpl'
+import type { WalletSubmissionResult } from '~/composables/useWallet'
+import {
+  credentialRevocationBlockReason,
+  parseApiCredentialDetail,
+  parseVerificationDimensions,
+  type ApiCredentialDetail,
+  type VerificationDimensions,
+} from '~/utils/credentialReview'
+import {
+  assertLinkGeneration,
+  assertLinkProfile,
+  buildCredentialPermalink,
+  singleRouteQueryValue,
+} from '~/utils/operationLinks'
+import { walletTransactionErrorMessage } from '~/utils/walletCompatibility'
+
+import type { IssuerRevokeEngineContext } from '~/utils/issuerEngine'
+
+const props = defineProps<{ issuerContext?: IssuerRevokeEngineContext }>()
+const route = useRoute()
+const localePath = useLocalePath()
+const { t } = useI18n()
+const { account, busy: walletBusy, prepare, signAndSubmit } = useWallet()
+const { getActiveNetworkProfile, getCredential, verify } = useXcsApi()
+const subject = ref(
+  props.issuerContext?.subjectAddress ?? singleRouteQueryValue(route.query.subject),
+)
+const schemaUid = ref(props.issuerContext?.schemaUid ?? singleRouteQueryValue(route.query.schema))
+const linkedProfileId = ref(
+  props.issuerContext?.profileId ?? singleRouteQueryValue(route.query.profile),
+)
+const linkedGenerationId = ref(
+  props.issuerContext?.generationId ?? singleRouteQueryValue(route.query.generation),
+)
+const transaction = shallowRef<CredentialDelete | null>(null)
+const credential = shallowRef<ApiCredentialDetail | null>(null)
+const report = shallowRef<VerificationDimensions | null>(null)
+const reviewProfileId = ref<string | null>(null)
+const reviewBusy = ref(false)
+const message = ref('')
+const result = shallowRef<WalletSubmissionResult | null>(null)
+const busy = computed(() => walletBusy.value || reviewBusy.value)
+const messageDisplay = computed(() => {
+  return (
+    walletTransactionErrorMessage(message.value, t) ??
+    (props.issuerContext ? t('simpleIssuer.error') : message.value)
+  )
+})
+const messageIsLocalized = computed(
+  () => message.value.length > 0 && messageDisplay.value !== message.value,
+)
+const resultCredentialLink = computed(() => {
+  const generationId = result.value?.businessEvidence?.generationId
+  if (
+    result.value?.businessConfirmation !== 'confirmed' ||
+    !generationId ||
+    !reviewProfileId.value
+  ) {
+    return null
+  }
+  return buildCredentialPermalink({
+    profileId: reviewProfileId.value,
+    generationId,
+  })
+})
+const decodedUri = computed(() => {
+  if (!credential.value?.uriHex) return null
+  try {
+    return decodeHexUtf8(credential.value.uriHex)
+  } catch {
+    return null
+  }
+})
+const expiration = computed(() =>
+  credential.value?.expiration === null || credential.value?.expiration === undefined
+    ? null
+    : rippleTimeToIso(credential.value.expiration),
+)
+let previewRevision = 0
+
+function invalidatePreview() {
+  previewRevision += 1
+  transaction.value = null
+  credential.value = null
+  report.value = null
+  reviewProfileId.value = null
+  result.value = null
+}
+
+watch([subject, schemaUid, linkedProfileId, linkedGenerationId], invalidatePreview)
+watch(
+  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
+  invalidatePreview,
+)
+watch(
+  () => [route.query.subject, route.query.schema, route.query.profile, route.query.generation],
+  ([nextSubject, nextSchema, nextProfile, nextGeneration]) => {
+    if (props.issuerContext) return
+    subject.value = singleRouteQueryValue(nextSubject)
+    schemaUid.value = singleRouteQueryValue(nextSchema)
+    linkedProfileId.value = singleRouteQueryValue(nextProfile)
+    linkedGenerationId.value = singleRouteQueryValue(nextGeneration)
+  },
+)
+
+async function fetchExactCredential(input: {
+  issuer: string
+  subject: string
+  schemaUid: string
+  profileId: string
+  expectedGenerationId?: string | undefined
+}) {
+  const [rawCredential, rawReport] = await Promise.all([
+    getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
+    verify(
+      {
+        issuer: input.issuer,
+        subject: input.subject,
+        schemaUid: input.schemaUid,
+        resolvePayload: false,
+      },
+      input.profileId,
+    ),
+  ])
+  const exactCredential = parseApiCredentialDetail(rawCredential, input)
+  assertLinkGeneration(input.expectedGenerationId, exactCredential.generationId)
+  const dimensions = parseVerificationDimensions(rawReport)
+  if (exactCredential.state !== dimensions.onChain) {
+    throw new Error('CREDENTIAL_REVIEW_STATE_MISMATCH')
+  }
+  if (dimensions.generationId && dimensions.generationId !== exactCredential.generationId) {
+    throw new Error('CREDENTIAL_REVIEW_GENERATION_MISMATCH')
+  }
+  const reason = credentialRevocationBlockReason(exactCredential)
+  if (reason) throw new Error(reason)
+  return { exactCredential, dimensions }
+}
+
+async function buildPreview() {
+  invalidatePreview()
+  message.value = ''
+  if (!account.value) return void (message.value = 'WALLET_NOT_CONNECTED')
+
+  reviewBusy.value = true
+  const revision = previewRevision
+  const issuerAddress = account.value.address
+  const subjectAddress = subject.value
+  const normalizedSchemaUid = schemaUid.value.toLowerCase()
+  try {
+    if (props.issuerContext) {
+      if (issuerAddress !== props.issuerContext.issuerAddress)
+        throw new Error('ISSUER_VERIFIED_WALLET_REQUIRED')
+      await props.issuerContext.beforeSign(issuerAddress)
+    }
+    const profile = await getActiveNetworkProfile()
+    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
+    const loaded = await fetchExactCredential({
+      issuer: issuerAddress,
+      subject: subjectAddress,
+      schemaUid: normalizedSchemaUid,
+      profileId: profile.profileId,
+      ...(linkedGenerationId.value ? { expectedGenerationId: linkedGenerationId.value } : {}),
+    })
+    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
+    credential.value = loaded.exactCredential
+    report.value = loaded.dimensions
+    reviewProfileId.value = profile.profileId
+    const raw = buildCredentialDelete({
+      account: issuerAddress,
+      issuer: issuerAddress,
+      subject: subjectAddress,
+      schemaUid: normalizedSchemaUid,
+    })
+    const prepared = (await prepare(raw, profile)) as CredentialDelete
+    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_BUILD')
+    transaction.value = prepared
+  } catch (error) {
+    transaction.value = null
+    message.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    reviewBusy.value = false
+  }
+}
+
+async function submit() {
+  const preparedTransaction = transaction.value
+  const expectedCredential = credential.value
+  const expectedIssuer = account.value?.address
+  const expectedSubject = subject.value
+  const expectedSchemaUid = schemaUid.value.toLowerCase()
+  const expectedLinkedProfileId = linkedProfileId.value
+  const expectedLinkedGenerationId = linkedGenerationId.value
+  const expectedReviewProfileId = reviewProfileId.value
+  const expectedRevision = previewRevision
+  if (!preparedTransaction || !expectedCredential || !expectedIssuer) {
+    message.value = 'TRANSACTION_PREVIEW_REQUIRED'
+    return
+  }
+
+  if (
+    props.issuerContext &&
+    !window.confirm(
+      t('issuer.engine.confirmRevoke', {
+        recipient: props.issuerContext.recipientLabel,
+        schema: props.issuerContext.schemaName,
+      }),
+    )
+  )
+    return
+  reviewBusy.value = true
+  message.value = ''
+  try {
+    const assertCurrent = () => {
+      if (
+        previewRevision !== expectedRevision ||
+        transaction.value !== preparedTransaction ||
+        account.value?.address !== expectedIssuer ||
+        subject.value !== expectedSubject ||
+        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
+        linkedProfileId.value !== expectedLinkedProfileId ||
+        linkedGenerationId.value !== expectedLinkedGenerationId ||
+        reviewProfileId.value !== expectedReviewProfileId
+      ) {
+        throw new Error('CREDENTIAL_REVIEW_CHANGED_BEFORE_SIGNATURE')
+      }
+    }
+    assertCurrent()
+    if (props.issuerContext) {
+      if (expectedIssuer !== props.issuerContext.issuerAddress)
+        throw new Error('ISSUER_VERIFIED_WALLET_REQUIRED')
+      await props.issuerContext.beforeSign(expectedIssuer)
+      assertCurrent()
+    }
+    const profile = await getActiveNetworkProfile()
+    assertLinkProfile(expectedLinkedProfileId || undefined, profile.profileId)
+    assertLinkProfile(expectedReviewProfileId ?? undefined, profile.profileId)
+    const loaded = await fetchExactCredential({
+      issuer: expectedIssuer,
+      subject: expectedSubject,
+      schemaUid: expectedSchemaUid,
+      profileId: profile.profileId,
+      ...(expectedLinkedGenerationId ? { expectedGenerationId: expectedLinkedGenerationId } : {}),
+    })
+    assertCurrent()
+    if (loaded.exactCredential.generationId !== expectedCredential.generationId) {
+      throw new Error('CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE')
+    }
+    credential.value = loaded.exactCredential
+    report.value = loaded.dimensions
+    const response = await signAndSubmit(
+      preparedTransaction,
+      {
+        action: 'credential-revoke',
+        issuer: expectedIssuer,
+        subject: expectedSubject,
+        schemaUid: expectedSchemaUid,
+        generationId: loaded.exactCredential.generationId,
+      },
+      assertCurrent,
+      async (signature) => {
+        await props.issuerContext?.beforeSign(expectedIssuer)
+        assertCurrent()
+        props.issuerContext?.onSigned?.(signature.txHash)
+      },
+      (validated) => {
+        result.value = { ...validated }
+        transaction.value = null
+      },
+    )
+    result.value = response
+    transaction.value = null
+    if (response.businessConfirmation === 'confirmed')
+      await props.issuerContext?.afterConfirmed?.(response)
+  } catch (error) {
+    message.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    reviewBusy.value = false
+  }
+}
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('simpleIssuer.revokeTitle')" :lead="$t('simpleIssuer.revokeLead')" />
+    <StatusBox tone="warning">{{ $t('simpleIssuer.revokeWarning') }}</StatusBox>
+
+    <UCard class="mb-6">
+      <div class="grid gap-5">
+        <template v-if="issuerContext">
+          <p>
+            <strong>{{ $t('simpleIssuer.model') }}:</strong> {{ issuerContext.schemaName }}
+          </p>
+          <p>
+            <strong>{{ $t('simpleIssuer.recipient') }}:</strong> {{ issuerContext.recipientLabel }}
+          </p>
+        </template>
+        <UFormField v-if="!issuerContext" label="Subject">
+          <UInput id="revoke-subject" v-model.trim="subject" placeholder="r…" :disabled="busy" />
+        </UFormField>
+        <UFormField v-if="!issuerContext" label="Schema UID">
+          <UInput
+            id="revoke-schema"
+            v-model.trim="schemaUid"
+            pattern="[0-9a-fA-F]{64}"
+            :disabled="busy"
+          />
+        </UFormField>
+        <div>
+          <UButton :disabled="busy" @click="buildPreview">
+            {{ busy ? $t('common.working') : $t('simpleIssuer.reviewRevoke') }}
+          </UButton>
+        </div>
+      </div>
+    </UCard>
+
+    <StatusBox v-if="message" tone="error" data-testid="revoke-error" :title="messageDisplay">
+      <details v-if="messageIsLocalized && !issuerContext">
+        <summary>{{ $t('simpleIssuer.technical') }}</summary>
+        <code>{{ message }}</code>
+      </details>
+    </StatusBox>
+
+    <UCard v-if="credential && report" class="mb-6">
+      <template #header>
+        <h2 class="text-xl font-semibold">{{ $t('revoke.exactCredential') }}</h2>
+      </template>
+      <p>{{ $t('simpleIssuer.currentState') }} : <AttestationStatus :value="credential.state" /></p>
+      <p class="mt-2">
+        {{ $t('simpleIssuer.expiration') }} : {{ expiration ?? $t('revoke.noExpiration') }}
+      </p>
+      <details v-if="!issuerContext" class="mt-4">
+        <summary class="cursor-pointer text-sm text-muted">
+          {{ $t('simpleIssuer.technical') }}
+        </summary>
+        <MetadataList>
+          <dt>Issuer</dt>
+          <dd>
+            <code>{{ credential.issuer }}</code>
+          </dd>
+          <dt>Subject</dt>
+          <dd>
+            <code>{{ credential.subject }}</code>
+          </dd>
+          <dt>Schema UID</dt>
+          <dd>
+            <code>{{ credential.schemaUid }}</code>
+          </dd>
+          <dt>{{ $t('revoke.state') }}</dt>
+          <dd><StatusPill :value="credential.state" /></dd>
+          <dt>{{ $t('revoke.expiration') }}</dt>
+          <dd>{{ expiration ?? $t('revoke.noExpiration') }}</dd>
+          <dt>URI</dt>
+          <dd>
+            <code>{{ decodedUri ?? '—' }}</code>
+          </dd>
+          <dt>{{ $t('revoke.generation') }}</dt>
+          <dd>
+            <code>{{ credential.generationId }}</code>
+          </dd>
+        </MetadataList>
+      </details>
+    </UCard>
+
+    <TransactionPreview
+      :transaction="transaction"
+      :busy="busy"
+      :compact="!!issuerContext"
+      :confirm-label="$t('simpleIssuer.revoke')"
+      @confirm="submit"
+    />
+    <BusinessFinality
+      v-if="result"
+      :tx-hash="result.txHash"
+      :engine-result="result.transactionResult"
+      :ledger-index="result.ledgerIndex"
+      :business-confirmation="result.businessConfirmation"
+      :business-evidence="result.businessEvidence"
+      :compact="!!issuerContext"
+    />
+    <UButton
+      v-if="resultCredentialLink"
+      color="neutral"
+      variant="outline"
+      data-testid="revoke-result-permalink"
+      :to="localePath(resultCredentialLink)"
+    >
+      {{ $t('revoke.openPermalink') }}
+    </UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/components/CredentialSubjectAction.vue b/apps/web/app/components/CredentialSubjectAction.vue
new file mode 100644
index 0000000..4b1c3f9
--- /dev/null
+++ b/apps/web/app/components/CredentialSubjectAction.vue
@@ -0,0 +1,1079 @@
+<script setup lang="ts">
+import { buildCredentialAccept, buildCredentialDelete } from '#xcs/sdk/index.js'
+import type { CredentialAccept, CredentialDelete } from 'xrpl'
+import type { ApiSchemaDetail } from '~/composables/useXcsApi'
+import type { WalletSubmissionResult } from '~/composables/useWallet'
+import {
+  assertCredentialAcceptanceReviewCurrent,
+  assertCredentialSubjectMutationReviewCurrent,
+  assertPayloadFetchConsentCurrent,
+  createIssuerTrustAcknowledgementToken,
+  createPayloadFetchConsentToken,
+  credentialActionBlockReason,
+  loadCredentialMutationReview,
+  loadCredentialReview,
+  type CredentialMutationReview,
+  type CredentialReview,
+  type CredentialSubjectAction,
+  type IssuerTrustAcknowledgementToken,
+  type PayloadFetchConsentToken,
+} from '~/utils/credentialReview'
+import {
+  assertLinkGeneration,
+  assertLinkProfile,
+  buildCredentialPermalink,
+  singleRouteQueryValue,
+} from '~/utils/operationLinks'
+import { LOCAL_PAYLOAD_LOCATION } from '~/utils/localPayloadStore'
+import { readRecipientPayload } from '~/utils/recipientPayload'
+import type { RecipientPayloadView } from '~/types/portal'
+import { walletTransactionErrorMessage } from '~/utils/walletCompatibility'
+
+const props = defineProps<{
+  fixedCredential?: {
+    profileId: string
+    generationId: string
+    issuerAddress: string
+    subjectAddress: string
+    schemaUid: string
+    visibility: 'public' | 'private'
+    organizationName?: string
+    issuerAdmission?: 'approved' | 'suspended' | 'not_approved' | 'unknown'
+  }
+  initialAction?: 'accept' | 'reject' | 'remove'
+}>()
+const emit = defineEmits<{ reconciled: [] }>()
+const primaryAction = computed(() => props.initialAction ?? 'accept')
+const auth = useAuth()
+const request = useRequestFetch()
+const privateReview = computed(() => props.fixedCredential?.visibility === 'private')
+const route = useRoute()
+const localePath = useLocalePath()
+const { t } = useI18n()
+const { account, busy: walletBusy, prepare, signAndSubmit } = useWallet()
+const { getActiveNetworkProfile, getCredential, getCredentialGeneration, getSchema, verify } =
+  useXcsApi()
+const localPayloadStore = useLocalPayloadStore()
+const issuer = ref(
+  props.fixedCredential?.issuerAddress ?? singleRouteQueryValue(route.query.issuer),
+)
+const schemaUid = ref(props.fixedCredential?.schemaUid ?? singleRouteQueryValue(route.query.schema))
+const linkedProfileId = ref(
+  props.fixedCredential?.profileId ?? singleRouteQueryValue(route.query.profile),
+)
+const linkedGenerationId = ref(
+  props.fixedCredential?.generationId ?? singleRouteQueryValue(route.query.generation),
+)
+const linkedAction = ref(
+  props.initialAction ?? (props.fixedCredential ? '' : singleRouteQueryValue(route.query.action)),
+)
+
+function linkedSubjectAction(value: string): CredentialSubjectAction {
+  return value === 'reject' || value === 'remove' ? value : 'accept'
+}
+
+function assertLinkedActionValid(value: string): void {
+  if (value !== '' && value !== 'accept' && value !== 'reject' && value !== 'remove') {
+    throw new Error('CREDENTIAL_LINK_ACTION_INVALID')
+  }
+}
+
+const action = ref<CredentialSubjectAction>(linkedSubjectAction(linkedAction.value))
+const transaction = shallowRef<CredentialAccept | CredentialDelete | null>(null)
+const review = shallowRef<CredentialReview | CredentialMutationReview | null>(null)
+const acceptanceReview = computed<CredentialReview | null>(() => {
+  const current = review.value
+  return current && 'report' in current ? current : null
+})
+const reviewProfileId = ref<string | null>(null)
+const schemaDetail = shallowRef<ApiSchemaDetail | null>(null)
+const payloadConsent = ref(false)
+const payloadConsentToken = shallowRef<PayloadFetchConsentToken | null>(null)
+const issuerTrustAcknowledgementToken = shallowRef<IssuerTrustAcknowledgementToken | null>(null)
+const reviewBusy = ref(false)
+const message = ref('')
+const result = shallowRef<WalletSubmissionResult | null>(null)
+const busy = computed(() => walletBusy.value || reviewBusy.value)
+const messageDisplay = computed(() => {
+  if (message.value === 'PAYLOAD_DIGEST_MISMATCH') return t('accept.payloadMismatch')
+  if (
+    message.value.startsWith('PAYLOAD_') ||
+    message.value === 'CREDENTIAL_PAYLOAD_REVIEW_FAILED'
+  ) {
+    return t('accept.payloadUnavailable')
+  }
+  if (message.value === 'CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH') {
+    return t('accept.subjectWalletMismatch')
+  }
+  return (
+    walletTransactionErrorMessage(message.value, t) ??
+    (props.fixedCredential && message.value
+      ? t('simpleRecipient.actionUnavailable')
+      : message.value)
+  )
+})
+const messageIsLocalized = computed(
+  () => message.value.length > 0 && messageDisplay.value !== message.value,
+)
+const resultCredentialLink = computed(() => {
+  const generationId = result.value?.businessEvidence?.generationId
+  if (
+    result.value?.businessConfirmation !== 'confirmed' ||
+    !generationId ||
+    !reviewProfileId.value
+  ) {
+    return null
+  }
+  return buildCredentialPermalink({
+    profileId: reviewProfileId.value,
+    generationId,
+  })
+})
+const resultShareLink = computed(() => {
+  const fixed = props.fixedCredential
+  if (!fixed || action.value !== 'accept' || result.value?.businessConfirmation !== 'confirmed') {
+    return null
+  }
+  return {
+    path: localePath(`/recipient/credentials/${fixed.generationId}/present`),
+    query: { profile: fixed.profileId },
+  }
+})
+const blockReason = computed(() => {
+  if (!review.value) return undefined
+  if (action.value === 'accept' && acceptanceReview.value?.claims === undefined) {
+    return acceptanceReview.value?.report.issuerTrust === 'untrusted'
+      ? 'CREDENTIAL_ISSUER_NOT_TRUSTED'
+      : undefined
+  }
+  return credentialActionBlockReason(
+    review.value,
+    action.value,
+    issuerTrustAcknowledgementToken.value ?? undefined,
+    reviewProfileId.value ?? undefined,
+  )
+})
+const blockReasonMessage = computed(() => {
+  if (blockReason.value === 'CREDENTIAL_ISSUER_NOT_TRUSTED') return t('accept.issuerUntrusted')
+  if (blockReason.value === 'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED') {
+    return t('accept.issuerAcknowledgementRequired')
+  }
+  if (blockReason.value === 'CREDENTIAL_ISSUER_TRUST_ACK_STALE') {
+    return t('accept.issuerAcknowledgementStale')
+  }
+  return props.fixedCredential && blockReason.value
+    ? t('simpleRecipient.actionUnavailable')
+    : blockReason.value
+})
+const payloadHost = computed(() => {
+  if (!review.value?.uri) return null
+  try {
+    return localPayloadStore.inspectPayloadLocation(review.value.uri)
+  } catch {
+    return null
+  }
+})
+const payloadUsesLocalStore = computed(() => payloadHost.value === LOCAL_PAYLOAD_LOCATION)
+const payloadHostBlockReason = computed(() => {
+  if (!review.value?.uri) return 'CREDENTIAL_URI_REQUIRED'
+  try {
+    localPayloadStore.inspectPayloadLocation(review.value.uri)
+    return undefined
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error)
+  }
+})
+const payloadHostBlockMessage = computed(() =>
+  payloadHostBlockReason.value === 'LOCAL_PAYLOAD_NOT_AVAILABLE_IN_BROWSER'
+    ? t('accept.localPayloadUnavailable')
+    : payloadHostBlockReason.value,
+)
+let previewRevision = 0
+const privatePreviewHidden = ref(false)
+
+function invalidatePreview() {
+  previewRevision += 1
+  transaction.value = null
+  review.value = null
+  reviewProfileId.value = null
+  schemaDetail.value = null
+  payloadConsent.value = false
+  payloadConsentToken.value = null
+  issuerTrustAcknowledgementToken.value = null
+  result.value = null
+}
+
+function hidePrivatePreview() {
+  privatePreviewHidden.value = document.visibilityState === 'hidden'
+  // An external wallet can hide this page while signing. Keep the reviewed
+  // transaction intact; identity and generation guards still run after signing.
+  if (privateReview.value && privatePreviewHidden.value && !walletBusy.value) invalidatePreview()
+}
+onMounted(() => document.addEventListener('visibilitychange', hidePrivatePreview))
+onBeforeUnmount(() => {
+  invalidatePreview()
+  document.removeEventListener('visibilitychange', hidePrivatePreview)
+})
+
+watch(
+  [issuer, schemaUid, action, linkedProfileId, linkedGenerationId, linkedAction],
+  invalidatePreview,
+)
+watch(
+  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
+  invalidatePreview,
+)
+watch(
+  () => [
+    route.query.issuer,
+    route.query.schema,
+    route.query.profile,
+    route.query.generation,
+    route.query.action,
+  ],
+  ([nextIssuer, nextSchema, nextProfile, nextGeneration, nextAction]) => {
+    if (props.fixedCredential) return
+    issuer.value = singleRouteQueryValue(nextIssuer)
+    schemaUid.value = singleRouteQueryValue(nextSchema)
+    linkedProfileId.value = singleRouteQueryValue(nextProfile)
+    linkedGenerationId.value = singleRouteQueryValue(nextGeneration)
+    linkedAction.value = singleRouteQueryValue(nextAction)
+    action.value = linkedSubjectAction(linkedAction.value)
+  },
+)
+
+async function setPayloadConsent(granted: boolean) {
+  if (!granted) {
+    payloadConsent.value = false
+    payloadConsentToken.value = null
+    if (transaction.value === null) return
+    previewRevision += 1
+    transaction.value = null
+    return
+  }
+
+  try {
+    if (!acceptanceReview.value) throw new Error('CREDENTIAL_PAYLOAD_CONSENT_REQUIRED')
+    payloadConsentToken.value = createPayloadFetchConsentToken(acceptanceReview.value)
+    payloadConsent.value = true
+    message.value = ''
+    await buildPreview()
+  } catch (error) {
+    payloadConsent.value = false
+    payloadConsentToken.value = null
+    message.value = error instanceof Error ? error.message : String(error)
+  }
+}
+
+async function setIssuerTrustAcknowledgement(granted: boolean) {
+  if (!granted) {
+    issuerTrustAcknowledgementToken.value = null
+    if (transaction.value === null) return
+    previewRevision += 1
+    transaction.value = null
+    result.value = null
+    return
+  }
+
+  try {
+    if (!acceptanceReview.value) throw new Error('CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED')
+    if (!reviewProfileId.value) throw new Error('CREDENTIAL_ISSUER_TRUST_ACK_PROFILE_REQUIRED')
+    issuerTrustAcknowledgementToken.value = createIssuerTrustAcknowledgementToken(
+      acceptanceReview.value,
+      reviewProfileId.value,
+    )
+    message.value = ''
+    if (payloadConsent.value) await buildPreview()
+  } catch (error) {
+    issuerTrustAcknowledgementToken.value = null
+    message.value = error instanceof Error ? error.message : String(error)
+  }
+}
+
+function clearStalePayloadConsent(error: unknown): void {
+  if (!(error instanceof Error) || error.message !== 'CREDENTIAL_PAYLOAD_CONSENT_STALE') return
+  payloadConsent.value = false
+  payloadConsentToken.value = null
+  issuerTrustAcknowledgementToken.value = null
+  review.value = null
+  reviewProfileId.value = null
+  schemaDetail.value = null
+  previewRevision += 1
+  transaction.value = null
+  result.value = null
+}
+
+function clearInvalidIssuerTrustAcknowledgement(error: unknown): void {
+  if (
+    !(error instanceof Error) ||
+    ![
+      'CREDENTIAL_ISSUER_NOT_TRUSTED',
+      'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED',
+      'CREDENTIAL_ISSUER_TRUST_ACK_STALE',
+      'CREDENTIAL_ISSUER_TRUST_CHANGED_AFTER_SIGNATURE',
+      'CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE',
+      'CREDENTIAL_GENERATION_CHANGED_AFTER_SIGNATURE',
+      'CREDENTIAL_REVIEW_CHANGED_AFTER_SIGNATURE',
+      'CREDENTIAL_STATE_CHANGED_AFTER_SIGNATURE',
+      'CREDENTIAL_LINK_GENERATION_MISMATCH',
+      'NETWORK_PROFILE_CHANGED_AFTER_SIGNATURE',
+    ].includes(error.message)
+  ) {
+    return
+  }
+  issuerTrustAcknowledgementToken.value = null
+  previewRevision += 1
+  transaction.value = null
+  result.value = null
+}
+
+watch(
+  () => props.fixedCredential,
+  (fixed) => {
+    invalidatePreview()
+    if (!fixed) return
+    issuer.value = fixed.issuerAddress
+    schemaUid.value = fixed.schemaUid
+    linkedProfileId.value = fixed.profileId
+    linkedGenerationId.value = fixed.generationId
+  },
+  { deep: true },
+)
+// A reconciled credential can stay on the same page while its available action changes.
+watch(
+  () => props.initialAction,
+  (next) => {
+    if (!props.fixedCredential) return
+    linkedAction.value = next ?? ''
+    action.value = linkedSubjectAction(linkedAction.value)
+    invalidatePreview()
+  },
+)
+async function reviewAction(next: CredentialSubjectAction) {
+  if (busy.value) return
+  action.value = next
+  await nextTick()
+  await buildPreview()
+}
+
+watch(
+  () => auth.user.value?.id,
+  () => {
+    if (props.fixedCredential) invalidatePreview()
+  },
+)
+
+async function assertRecipientContext(subject: string) {
+  const fixed = props.fixedCredential
+  if (!fixed) return
+  if (subject !== fixed.subjectAddress) throw new Error('CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH')
+  await auth.load(true)
+  if (
+    !auth.user.value?.wallets.some((wallet) => wallet.address === subject && wallet.networkId === 1)
+  )
+    throw new Error('CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH')
+  // Session, recipient ownership and indexed generation are checked server-side on every review.
+  await request(
+    `/api/recipient/credentials/${encodeURIComponent(fixed.profileId)}/${fixed.generationId}`,
+  )
+}
+
+async function fetchExactReview(input: {
+  issuer: string
+  subject: string
+  schemaUid: string
+  profileId: string
+  payloadConsent?: PayloadFetchConsentToken | undefined
+  expectedGenerationId?: string | undefined
+}): Promise<{ credentialReview: CredentialReview; schema: ApiSchemaDetail | null }> {
+  await assertLinkedGenerationCoordinates(input)
+  const [credential, metadataReport, schemaResult] = await Promise.all([
+    getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
+    verify(
+      {
+        issuer: input.issuer,
+        subject: input.subject,
+        schemaUid: input.schemaUid,
+        resolvePayload: false,
+      },
+      input.profileId,
+    ),
+    getSchema(input.schemaUid, input.profileId).then(
+      (schema) => ({ schema }),
+      (error: unknown) => ({ error }),
+    ),
+  ])
+  if ('error' in schemaResult && input.payloadConsent) throw schemaResult.error
+  const schema = 'schema' in schemaResult ? schemaResult.schema : null
+  const reviewOptions = {
+    credential,
+    report: metadataReport,
+    issuer: input.issuer,
+    subject: input.subject,
+    schemaUid: input.schemaUid,
+    ...(schema ? { schema: schema.resolved } : {}),
+    payloadReader: privateReview.value
+      ? (options: Parameters<typeof readRecipientPayload>[0]) =>
+          readRecipientPayload(options, window.location.origin)
+      : localPayloadStore.readPayload,
+  }
+  const metadataReview = await loadCredentialReview(reviewOptions)
+  assertLinkGeneration(input.expectedGenerationId, metadataReview.generationId)
+  if (!input.payloadConsent) return { credentialReview: metadataReview, schema }
+  assertPayloadFetchConsentCurrent(metadataReview, input.payloadConsent)
+  const localReview = await loadCredentialReview({ ...reviewOptions, fetchPayload: true })
+  if (localReview.payload === undefined) throw new Error('CREDENTIAL_PAYLOAD_REVIEW_FAILED')
+
+  // The API validates the already-consented, locally parsed object. It never
+  // resolves the issuer URI, so the server-side URL resolver may stay disabled.
+  // Private claims stay on the authenticated surface; the browser independently
+  // checks the canonical bytes, schema and on-chain digest before wallet consent.
+  const fixed = props.fixedCredential
+  const verifiedReport =
+    privateReview.value && fixed
+      ? (
+          await request<RecipientPayloadView>(
+            `/api/recipient/credentials/${encodeURIComponent(fixed.profileId)}/${fixed.generationId}/payload`,
+          )
+        ).verification
+      : await verify(
+          {
+            issuer: input.issuer,
+            subject: input.subject,
+            schemaUid: input.schemaUid,
+            payload: localReview.payload,
+          },
+          input.profileId,
+        )
+  const verifiedMetadata = await loadCredentialReview({
+    credential,
+    report: verifiedReport,
+    issuer: input.issuer,
+    subject: input.subject,
+    schemaUid: input.schemaUid,
+  })
+  return {
+    schema,
+    credentialReview: {
+      ...verifiedMetadata,
+      payload: localReview.payload,
+      claims: localReview.claims,
+      payloadDigestHex: localReview.payloadDigestHex,
+      payloadByteLength: localReview.payloadByteLength,
+      payloadCheckedAt: localReview.payloadCheckedAt,
+    },
+  }
+}
+
+async function fetchExactMutationReview(input: {
+  issuer: string
+  subject: string
+  schemaUid: string
+  profileId: string
+  expectedGenerationId?: string | undefined
+}): Promise<CredentialMutationReview> {
+  await assertLinkedGenerationCoordinates(input)
+  const credentialReview = loadCredentialMutationReview(
+    await getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
+    {
+      issuer: input.issuer,
+      subject: input.subject,
+      schemaUid: input.schemaUid,
+    },
+  )
+  assertLinkGeneration(input.expectedGenerationId, credentialReview.generationId)
+  return credentialReview
+}
+
+async function assertLinkedGenerationCoordinates(input: {
+  issuer: string
+  subject: string
+  schemaUid: string
+  profileId: string
+  expectedGenerationId?: string | undefined
+}): Promise<void> {
+  await assertRecipientContext(input.subject)
+  if (!input.expectedGenerationId) return
+  const detail = await getCredentialGeneration(input.expectedGenerationId, input.profileId)
+  const generation = detail.generation
+  assertLinkGeneration(input.expectedGenerationId, generation.generationId)
+  if (generation.issuer !== input.issuer) throw new Error('CREDENTIAL_LINK_ISSUER_MISMATCH')
+  if (generation.schemaUid.toLowerCase() !== input.schemaUid.toLowerCase()) {
+    throw new Error('CREDENTIAL_LINK_SCHEMA_MISMATCH')
+  }
+  if (generation.subject !== input.subject) {
+    throw new Error('CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH')
+  }
+}
+
+async function buildPreview() {
+  if (busy.value) return
+  previewRevision += 1
+  transaction.value = null
+  message.value = ''
+  result.value = null
+  if (!account.value) return void (message.value = 'WALLET_NOT_CONNECTED')
+
+  reviewBusy.value = true
+  const revision = previewRevision
+  const subjectAddress = account.value.address
+  const issuerAddress = issuer.value
+  const normalizedSchemaUid = schemaUid.value.toLowerCase()
+  const selectedAction = action.value
+  const consent = selectedAction === 'accept' ? payloadConsentToken.value : null
+  const trustAcknowledgement =
+    selectedAction === 'accept' ? issuerTrustAcknowledgementToken.value : null
+  try {
+    assertLinkedActionValid(linkedAction.value)
+    const profile = await getActiveNetworkProfile()
+    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
+    const linkedGeneration = linkedGenerationId.value
+      ? { expectedGenerationId: linkedGenerationId.value }
+      : {}
+    const loaded =
+      selectedAction === 'accept'
+        ? await fetchExactReview({
+            issuer: issuerAddress,
+            subject: subjectAddress,
+            schemaUid: normalizedSchemaUid,
+            profileId: profile.profileId,
+            ...linkedGeneration,
+            ...(consent ? { payloadConsent: consent } : {}),
+          })
+        : {
+            credentialReview: await fetchExactMutationReview({
+              issuer: issuerAddress,
+              subject: subjectAddress,
+              schemaUid: normalizedSchemaUid,
+              profileId: profile.profileId,
+              ...linkedGeneration,
+            }),
+            schema: null,
+          }
+    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
+
+    review.value = loaded.credentialReview
+    reviewProfileId.value = profile.profileId
+    schemaDetail.value = loaded.schema
+    if (selectedAction === 'accept' && !consent) {
+      message.value = payloadHostBlockReason.value ?? ''
+      return
+    }
+    const reason = credentialActionBlockReason(
+      loaded.credentialReview,
+      selectedAction,
+      trustAcknowledgement ?? undefined,
+      profile.profileId,
+    )
+    // The next visible step asks for this acknowledgement. It is not an error.
+    if (reason === 'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED') return
+    if (reason) throw new Error(reason)
+
+    const raw =
+      selectedAction === 'accept'
+        ? buildCredentialAccept({
+            subject: subjectAddress,
+            issuer: issuerAddress,
+            schemaUid: normalizedSchemaUid,
+          })
+        : buildCredentialDelete({
+            account: subjectAddress,
+            issuer: issuerAddress,
+            subject: subjectAddress,
+            schemaUid: normalizedSchemaUid,
+          })
+    const prepared = (await prepare(raw, profile)) as CredentialAccept | CredentialDelete
+    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_BUILD')
+    transaction.value = prepared
+  } catch (error) {
+    clearStalePayloadConsent(error)
+    clearInvalidIssuerTrustAcknowledgement(error)
+    transaction.value = null
+    message.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    reviewBusy.value = false
+  }
+}
+
+async function submit() {
+  const preparedTransaction = transaction.value
+  const expectedReview = review.value
+  const expectedSubject = account.value?.address
+  const expectedIssuer = issuer.value
+  const expectedSchemaUid = schemaUid.value.toLowerCase()
+  const expectedAction = action.value
+  const expectedPayloadConsent = payloadConsentToken.value
+  const expectedIssuerTrustAcknowledgement = issuerTrustAcknowledgementToken.value
+  const expectedLinkedProfileId = linkedProfileId.value
+  const expectedLinkedGenerationId = linkedGenerationId.value
+  const expectedLinkedAction = linkedAction.value
+  const expectedRevision = previewRevision
+  if (!preparedTransaction || !expectedReview || !expectedSubject) {
+    message.value = 'TRANSACTION_PREVIEW_REQUIRED'
+    return
+  }
+
+  reviewBusy.value = true
+  message.value = ''
+  try {
+    const assertCurrent = () => {
+      if (
+        previewRevision !== expectedRevision ||
+        transaction.value !== preparedTransaction ||
+        account.value?.address !== expectedSubject ||
+        issuer.value !== expectedIssuer ||
+        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
+        action.value !== expectedAction ||
+        payloadConsentToken.value !== expectedPayloadConsent ||
+        issuerTrustAcknowledgementToken.value !== expectedIssuerTrustAcknowledgement ||
+        linkedProfileId.value !== expectedLinkedProfileId ||
+        linkedGenerationId.value !== expectedLinkedGenerationId ||
+        linkedAction.value !== expectedLinkedAction
+      ) {
+        throw new Error('CREDENTIAL_REVIEW_CHANGED_BEFORE_SIGNATURE')
+      }
+    }
+    assertCurrent()
+    assertLinkedActionValid(expectedLinkedAction)
+    const profile = await getActiveNetworkProfile()
+    assertLinkProfile(expectedLinkedProfileId || undefined, profile.profileId)
+    const linkedGeneration = expectedLinkedGenerationId
+      ? { expectedGenerationId: expectedLinkedGenerationId }
+      : {}
+    const loaded =
+      expectedAction === 'accept'
+        ? await (async () => {
+            if (!expectedPayloadConsent) throw new Error('CREDENTIAL_PAYLOAD_CONSENT_REQUIRED')
+            return fetchExactReview({
+              issuer: expectedIssuer,
+              subject: expectedSubject,
+              schemaUid: expectedSchemaUid,
+              profileId: profile.profileId,
+              ...linkedGeneration,
+              payloadConsent: expectedPayloadConsent,
+            })
+          })()
+        : {
+            credentialReview: await fetchExactMutationReview({
+              issuer: expectedIssuer,
+              subject: expectedSubject,
+              schemaUid: expectedSchemaUid,
+              profileId: profile.profileId,
+              ...linkedGeneration,
+            }),
+            schema: null,
+          }
+    assertCurrent()
+    if (loaded.credentialReview.generationId !== expectedReview.generationId) {
+      throw new Error('CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE')
+    }
+    if (expectedAction === 'accept') {
+      if (!('report' in expectedReview) || !('report' in loaded.credentialReview)) {
+        throw new Error('CREDENTIAL_ACCEPTANCE_REVIEW_REQUIRED')
+      }
+      assertCredentialAcceptanceReviewCurrent(
+        expectedReview,
+        loaded.credentialReview,
+        profile.profileId,
+        profile.profileId,
+        expectedIssuerTrustAcknowledgement ?? undefined,
+      )
+    } else {
+      if ('report' in expectedReview || 'report' in loaded.credentialReview) {
+        throw new Error('CREDENTIAL_MUTATION_REVIEW_REQUIRED')
+      }
+      assertCredentialSubjectMutationReviewCurrent(
+        expectedReview,
+        loaded.credentialReview,
+        profile.profileId,
+        profile.profileId,
+        expectedAction,
+      )
+    }
+    review.value = loaded.credentialReview
+    reviewProfileId.value = profile.profileId
+    schemaDetail.value = loaded.schema
+    const reason = credentialActionBlockReason(
+      loaded.credentialReview,
+      expectedAction,
+      expectedIssuerTrustAcknowledgement ?? undefined,
+      profile.profileId,
+    )
+    if (reason) throw new Error(reason)
+
+    const revalidateSubjectActionAfterSignature = async () => {
+      assertCurrent()
+      const latestProfile = await getActiveNetworkProfile()
+      assertLinkProfile(expectedLinkedProfileId || undefined, latestProfile.profileId)
+      if (expectedAction === 'accept') {
+        if (!('report' in loaded.credentialReview)) {
+          throw new Error('CREDENTIAL_ACCEPTANCE_REVIEW_REQUIRED')
+        }
+        const latest = await fetchExactReview({
+          issuer: expectedIssuer,
+          subject: expectedSubject,
+          schemaUid: expectedSchemaUid,
+          profileId: latestProfile.profileId,
+          ...linkedGeneration,
+        })
+        assertCurrent()
+        assertCredentialAcceptanceReviewCurrent(
+          loaded.credentialReview,
+          latest.credentialReview,
+          profile.profileId,
+          latestProfile.profileId,
+          expectedIssuerTrustAcknowledgement ?? undefined,
+        )
+      } else {
+        if ('report' in loaded.credentialReview) {
+          throw new Error('CREDENTIAL_MUTATION_REVIEW_REQUIRED')
+        }
+        const latest = await fetchExactMutationReview({
+          issuer: expectedIssuer,
+          subject: expectedSubject,
+          schemaUid: expectedSchemaUid,
+          profileId: latestProfile.profileId,
+          ...linkedGeneration,
+        })
+        assertCurrent()
+        assertCredentialSubjectMutationReviewCurrent(
+          loaded.credentialReview,
+          latest,
+          profile.profileId,
+          latestProfile.profileId,
+          expectedAction,
+        )
+      }
+    }
+
+    const response = await signAndSubmit(
+      preparedTransaction,
+      {
+        action:
+          expectedAction === 'accept'
+            ? 'credential-accept'
+            : expectedAction === 'reject'
+              ? 'credential-reject'
+              : 'credential-remove',
+        issuer: expectedIssuer,
+        subject: expectedSubject,
+        schemaUid: expectedSchemaUid,
+        generationId: loaded.credentialReview.generationId,
+        ...('payloadDigestHex' in loaded.credentialReview &&
+        loaded.credentialReview.payloadDigestHex
+          ? { payloadDigestHex: loaded.credentialReview.payloadDigestHex }
+          : {}),
+      },
+      assertCurrent,
+      revalidateSubjectActionAfterSignature,
+      (validated) => {
+        result.value = { ...validated }
+      },
+    )
+    result.value = response
+    transaction.value = null
+    const fixed = props.fixedCredential
+    if (fixed && response.businessConfirmation === 'confirmed') {
+      await auth.mutateApplication(
+        `/api/recipient/credentials/${encodeURIComponent(fixed.profileId)}/${fixed.generationId}/reconcile`,
+        {
+          transactionHash: response.txHash,
+          action: expectedAction,
+        },
+      )
+      emit('reconciled')
+    }
+  } catch (error) {
+    clearStalePayloadConsent(error)
+    clearInvalidIssuerTrustAcknowledgement(error)
+    message.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    reviewBusy.value = false
+    if (privateReview.value && document.visibilityState === 'hidden') invalidatePreview()
+  }
+}
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader
+      v-if="!fixedCredential"
+      eyebrow="Credential subject"
+      :title="$t('accept.title')"
+      :lead="$t('accept.description')"
+    />
+    <UCard class="mb-6">
+      <div class="grid gap-5">
+        <template v-if="fixedCredential">
+          <template v-if="primaryAction === 'accept'">
+            <h2 class="text-xl font-semibold">{{ $t('simpleRecipient.reviewStep') }}</h2>
+            <p class="text-muted">{{ $t('simpleRecipient.reviewIntro') }}</p>
+            <UButton :disabled="busy" @click="reviewAction('accept')">{{
+              busy ? $t('common.working') : $t('accept.review')
+            }}</UButton>
+          </template>
+          <p v-else-if="primaryAction === 'remove'" class="text-muted">
+            {{ $t('simpleRecipient.acceptedActions') }}
+          </p>
+          <details id="subject-action" class="rounded border border-default p-4">
+            <summary class="cursor-pointer font-semibold">
+              {{ $t('simpleRecipient.otherActions') }}
+            </summary>
+            <p v-if="primaryAction === 'remove'" class="mt-3 text-sm text-muted">
+              {{ $t('simpleRecipient.removeIntro') }}
+            </p>
+            <UButton
+              class="mt-3"
+              color="neutral"
+              variant="outline"
+              :disabled="busy"
+              @click="reviewAction(primaryAction === 'remove' ? 'remove' : 'reject')"
+              >{{
+                $t(primaryAction === 'remove' ? 'accept.removeAction' : 'accept.rejectAction')
+              }}</UButton
+            >
+          </details>
+        </template>
+        <UFormField v-else :label="$t('accept.action')">
+          <USelect
+            id="subject-action"
+            v-model="action"
+            :items="[
+              { label: $t('accept.acceptAction'), value: 'accept' },
+              { label: $t('accept.rejectAction'), value: 'reject' },
+              { label: $t('accept.removeAction'), value: 'remove' },
+            ]"
+            :disabled="busy"
+          />
+        </UFormField>
+        <UFormField v-if="!fixedCredential" label="Issuer">
+          <UInput id="issuer" v-model.trim="issuer" placeholder="r…" :disabled="busy" />
+        </UFormField>
+        <UFormField v-if="!fixedCredential" label="Schema UID">
+          <UInput
+            id="accept-schema"
+            v-model.trim="schemaUid"
+            pattern="[0-9a-fA-F]{64}"
+            :disabled="busy"
+          />
+        </UFormField>
+        <div v-if="!fixedCredential">
+          <UButton type="button" :disabled="busy" @click="buildPreview">
+            {{ busy ? $t('common.working') : $t('accept.review') }}
+          </UButton>
+        </div>
+      </div>
+    </UCard>
+
+    <StatusBox
+      v-if="message && (!review || result)"
+      tone="error"
+      role="alert"
+      data-testid="accept-error"
+      :title="messageDisplay"
+    >
+      <details v-if="messageIsLocalized && !fixedCredential">
+        <summary class="cursor-pointer">{{ $t('accept.technicalDetails') }}</summary>
+        <code>{{ message }}</code>
+      </details>
+    </StatusBox>
+    <!-- The review is a pre-signing snapshot, not the state after ledger validation. -->
+    <UCard v-if="review && !result" class="mb-6" data-testid="credential-subject-review">
+      <template #header>
+        <h2 class="text-xl font-semibold">{{ $t('accept.exactCredential') }}</h2>
+      </template>
+      <MetadataList>
+        <dt>{{ $t('simpleRecipient.reviewIssuer') }}</dt>
+        <dd v-if="fixedCredential">
+          {{ fixedCredential.organizationName ?? $t('recipient.credential') }}
+        </dd>
+        <dd v-else>
+          <code>{{ review.issuer }}</code>
+        </dd>
+        <dt>{{ $t('simpleRecipient.reviewSubject') }}</dt>
+        <dd v-if="fixedCredential">
+          {{ $t('simpleRecipient.yourWallet') }}
+        </dd>
+        <dd v-else>
+          <code>{{ review.subject }}</code>
+        </dd>
+        <dt>{{ $t(fixedCredential ? 'simpleUi.attestationType' : 'verify.schema') }}</dt>
+        <dd>
+          <strong>{{
+            schemaDetail?.name ?? (fixedCredential ? $t('recipient.credential') : review.schemaUid)
+          }}</strong>
+        </dd>
+        <dt>{{ $t('accept.expiration') }}</dt>
+        <dd>{{ review.expiration ?? $t('accept.noExpiration') }}</dd>
+        <dt>{{ $t('accept.state') }}</dt>
+        <dd>
+          <AttestationStatus v-if="fixedCredential" :value="review.state" /><StatusPill
+            v-else
+            :value="review.state"
+          />
+        </dd>
+      </MetadataList>
+
+      <StatusBox v-if="action === 'accept' && !acceptanceReview?.claims" tone="notice">
+        <p>
+          {{
+            $t(
+              payloadUsesLocalStore
+                ? 'accept.localPayloadConsentIntro'
+                : 'accept.payloadConsentIntro',
+              { host: payloadHost ?? '—' },
+            )
+          }}
+        </p>
+        <StatusBox v-if="payloadHostBlockReason" tone="error">{{
+          payloadHostBlockMessage
+        }}</StatusBox>
+        <UButton
+          v-else
+          data-testid="payload-consent"
+          :disabled="busy"
+          @click="setPayloadConsent(true)"
+          >{{ $t('portal.recipient.showAndVerify') }}</UButton
+        >
+      </StatusBox>
+      <p v-if="reviewBusy" role="status" aria-live="polite">{{ $t('accept.checking') }}</p>
+      <template
+        v-if="
+          action === 'accept' &&
+          acceptanceReview?.claims &&
+          !(privateReview && privatePreviewHidden)
+        "
+      >
+        <h2 class="mt-6 mb-2 text-xl font-semibold">
+          {{ $t(privateReview ? 'recipient.readContent' : 'accept.publicClaims') }}
+        </h2>
+        <div data-testid="credential-claims">
+          <AttestationFields :claims="acceptanceReview.claims" />
+        </div>
+      </template>
+      <StatusBox
+        v-if="action === 'accept' && acceptanceReview?.report.issuerTrust === 'unknown'"
+        tone="notice"
+        data-testid="issuer-trust-acknowledgement"
+      >
+        <p>{{ $t('accept.issuerUnknown') }}</p>
+        <UCheckbox
+          :model-value="issuerTrustAcknowledgementToken !== null"
+          :disabled="busy || !acceptanceReview?.claims"
+          :label="$t('accept.issuerAcknowledgement')"
+          @update:model-value="setIssuerTrustAcknowledgement(Boolean($event))"
+        />
+      </StatusBox>
+      <p v-if="action === 'accept'" class="text-sm text-muted">{{ $t('accept.notTruth') }}</p>
+      <StatusBox v-if="action === 'accept' && fixedCredential?.issuerAdmission" class="mt-4">
+        {{ $t(`portal.admission.${fixedCredential.issuerAdmission}`) }}
+      </StatusBox>
+      <p v-if="blockReason === 'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED'" class="text-sm text-muted">
+        {{ blockReasonMessage }}
+      </p>
+      <StatusBox v-else-if="blockReasonMessage" tone="error">{{ blockReasonMessage }}</StatusBox>
+      <StatusBox v-else-if="action === 'reject'" tone="warning">{{
+        $t('accept.rejectSafety')
+      }}</StatusBox>
+      <StatusBox v-else-if="action === 'remove'" tone="warning">{{
+        $t('accept.removeSafety')
+      }}</StatusBox>
+      <StatusBox
+        v-if="message"
+        tone="error"
+        role="alert"
+        data-testid="accept-error"
+        :title="messageDisplay"
+      >
+        <details v-if="messageIsLocalized && !fixedCredential">
+          <summary>{{ $t('accept.technicalDetails') }}</summary>
+          <code>{{ message }}</code>
+        </details>
+      </StatusBox>
+      <TransactionPreview
+        v-if="action === 'accept'"
+        :transaction="transaction"
+        :busy="busy"
+        compact
+        :confirm-label="$t('accept.acceptInWallet')"
+        @confirm="submit"
+      />
+      <p v-if="action === 'accept' && transaction" class="text-sm text-muted">
+        {{ $t('accept.walletNext') }}
+      </p>
+      <UButton
+        v-if="
+          action === 'accept' && payloadConsent && !transaction && !busy && message && !blockReason
+        "
+        color="neutral"
+        variant="outline"
+        type="button"
+        @click="buildPreview"
+        >{{ $t('accept.retry') }}</UButton
+      >
+      <details v-if="!fixedCredential" class="mt-5 rounded-lg p-4 ring-1 ring-default">
+        <summary class="cursor-pointer font-semibold">{{ $t('accept.technicalDetails') }}</summary>
+        <MetadataList class="mt-4">
+          <template v-if="fixedCredential">
+            <dt>{{ $t('recipient.issuerWallet') }}</dt>
+            <dd>
+              <code class="break-all">{{ review.issuer }}</code>
+            </dd>
+          </template>
+          <dt>Schema UID</dt>
+          <dd>
+            <code>{{ review.schemaUid }}</code>
+          </dd>
+          <dt>URI</dt>
+          <dd>
+            <code>{{ review.uri ?? '—' }}</code>
+          </dd>
+          <dt>{{ $t('accept.generation') }}</dt>
+          <dd>
+            <code>{{ review.generationId }}</code>
+          </dd>
+          <dt>{{ $t('accept.acceptedFlag') }}</dt>
+          <dd>
+            <code>{{ review.accepted }}</code>
+          </dd>
+          <template v-if="acceptanceReview?.payloadDigestHex">
+            <dt>SHA-256</dt>
+            <dd>
+              <code>{{ acceptanceReview.payloadDigestHex }}</code>
+            </dd>
+          </template>
+        </MetadataList>
+        <VerificationGrid v-if="acceptanceReview" :report="acceptanceReview.report" :note="false" />
+      </details>
+    </UCard>
+
+    <TransactionPreview
+      v-if="action !== 'accept'"
+      :transaction="transaction"
+      :busy="busy"
+      :compact="!!fixedCredential"
+      @confirm="submit"
+    />
+    <BusinessFinality
+      v-if="result"
+      :tx-hash="result.txHash"
+      :engine-result="result.transactionResult"
+      :ledger-index="result.ledgerIndex"
+      :business-confirmation="result.businessConfirmation"
+      :business-evidence="result.businessEvidence"
+      :compact="!!fixedCredential"
+    />
+    <UButton v-if="resultShareLink" :to="resultShareLink">
+      {{ $t('portal.recipient.shareNow') }}
+    </UButton>
+    <UButton
+      v-else-if="resultCredentialLink && !fixedCredential"
+      color="neutral"
+      variant="outline"
+      data-testid="subject-result-permalink"
+      :to="localePath(resultCredentialLink)"
+    >
+      {{ $t('accept.openPermalink') }}
+    </UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/components/HostedPublicationRecovery.client.vue b/apps/web/app/components/HostedPublicationRecovery.client.vue
new file mode 100644
index 0000000..4484057
--- /dev/null
+++ b/apps/web/app/components/HostedPublicationRecovery.client.vue
@@ -0,0 +1,171 @@
+<script setup lang="ts">
+import {
+  createHostedPublicationQueue,
+  recoverPublicationSignatures,
+  type HostedPublicationJob,
+} from '~/utils/hostedPublicationQueue'
+import { buildCredentialPermalink } from '~/utils/operationLinks'
+import { IndexedDbOperationJournal } from '~/utils/operationJournal'
+
+const props = defineProps<{ excludeId?: string }>()
+const { t } = useI18n()
+const { publishHostedPayload } = useXcsApi()
+const jobs = ref<HostedPublicationJob[]>([])
+const busyId = ref('')
+const error = ref('')
+const errorDetails = ref('')
+const publishedLink = ref('')
+const invalidKeys = ref<string[]>([])
+const visibleJobs = computed(() => jobs.value.filter((job) => job.id !== props.excludeId))
+
+async function refresh() {
+  try {
+    const snapshot = createHostedPublicationQueue(localStorage).inspect()
+    invalidKeys.value = snapshot.invalidKeys
+    jobs.value = snapshot.jobs
+    if (snapshot.jobs.some((job) => !job.payload.transactionHash)) {
+      jobs.value = recoverPublicationSignatures(
+        snapshot.jobs,
+        await new IndexedDbOperationJournal().list(),
+      )
+    }
+  } catch {
+    error.value = t('issue.hosted.recoveryUnavailable')
+  }
+}
+
+async function publish(job: HostedPublicationJob) {
+  if (busyId.value) return
+  busyId.value = job.id
+  error.value = ''
+  errorDetails.value = ''
+  try {
+    const journal = new IndexedDbOperationJournal()
+    await createHostedPublicationQueue(localStorage).publish(
+      job.id,
+      publishHostedPayload,
+      undefined,
+      await journal.list(),
+    )
+    publishedLink.value = buildCredentialPermalink({
+      profileId: job.payload.network,
+      generationId: job.payload.transactionHash.toLowerCase(),
+    })
+    refresh()
+    try {
+      await journal.completePublication(job.id)
+    } catch {
+      error.value = t('issue.hosted.journalCleanupFailed')
+    }
+  } catch (cause) {
+    error.value = t('issue.hosted.retryFailed')
+    errorDetails.value = cause instanceof Error ? cause.message : ''
+  } finally {
+    busyId.value = ''
+  }
+}
+
+function discardInvalid(key: string) {
+  if (!window.confirm(t('issue.hosted.discardConfirm'))) return
+  try {
+    createHostedPublicationQueue(localStorage).removeInvalid(key)
+    void refresh()
+  } catch {
+    error.value = t('issue.hosted.recoveryUnavailable')
+  }
+}
+
+function discard(job: HostedPublicationJob) {
+  if (!window.confirm(t('issue.hosted.discardConfirm'))) return
+  try {
+    createHostedPublicationQueue(localStorage).remove(job.id)
+    refresh()
+  } catch {
+    error.value = t('issue.hosted.recoveryUnavailable')
+  }
+}
+
+function download(job: HostedPublicationJob) {
+  const url = URL.createObjectURL(
+    new Blob([job.payload.canonicalPayload], { type: 'application/json' }),
+  )
+  const link = document.createElement('a')
+  link.href = url
+  link.download = `xcs-payload-${job.payload.locator}.json`
+  link.click()
+  URL.revokeObjectURL(url)
+}
+
+onMounted(() => {
+  refresh()
+  window.addEventListener('storage', refresh)
+})
+onBeforeUnmount(() => window.removeEventListener('storage', refresh))
+watch(() => props.excludeId, refresh)
+</script>
+
+<template>
+  <UCard
+    v-if="visibleJobs.length || invalidKeys.length || error || publishedLink"
+    class="mb-6"
+    data-testid="publication-recovery"
+  >
+    <h2 class="mb-2 text-xl font-semibold">{{ $t('issue.hosted.recoveryTitle') }}</h2>
+    <p class="mb-4 text-sm text-muted">{{ $t('issue.hosted.recoveryDescription') }}</p>
+    <StatusBox v-if="error" tone="error">
+      <p>{{ error }}</p>
+      <details v-if="errorDetails" class="mt-3">
+        <summary class="cursor-pointer">{{ $t('simpleUi.technicalDetails') }}</summary>
+        <p class="break-words">{{ errorDetails }}</p>
+      </details>
+    </StatusBox>
+    <StatusBox v-for="key in invalidKeys" :key="key" tone="error">
+      <p>{{ $t('issue.hosted.corruptRecovery') }}</p>
+      <UButton
+        color="neutral"
+        variant="outline"
+        :disabled="Boolean(busyId)"
+        @click="discardInvalid(key)"
+      >
+        {{ $t('issue.hosted.discardRecovery') }}
+      </UButton>
+    </StatusBox>
+    <StatusBox v-if="publishedLink" tone="success">
+      <NuxtLinkLocale :to="publishedLink">{{ $t('issue.credentialLink') }}</NuxtLinkLocale>
+    </StatusBox>
+    <StatusBox v-for="(job, index) in visibleJobs" :key="job.id" tone="notice">
+      <p class="font-medium">{{ $t('simpleUi.pendingPublication', { number: index + 1 }) }}</p>
+      <p v-if="!job.payload.transactionHash">{{ $t('issue.hosted.signatureMissing') }}</p>
+      <p v-else>{{ $t('simpleUi.signedPublicationPending') }}</p>
+      <div class="mt-3 flex flex-wrap gap-2">
+        <UButton
+          v-if="job.payload.transactionHash"
+          :disabled="Boolean(busyId)"
+          @click="publish(job)"
+        >
+          {{ $t('issue.hosted.retryPublication') }}
+        </UButton>
+        <UButton
+          color="neutral"
+          variant="outline"
+          :disabled="Boolean(busyId)"
+          @click="discard(job)"
+        >
+          {{ $t('issue.hosted.discardRecovery') }}
+        </UButton>
+        <UButton color="neutral" variant="outline" @click="download(job)">
+          {{ $t('issue.hosted.downloadRecovery') }}
+        </UButton>
+      </div>
+      <details class="mt-3" data-testid="publication-technical-details">
+        <summary class="cursor-pointer">{{ $t('simpleUi.technicalDetails') }}</summary>
+        <p class="break-all">
+          <code>{{ job.payload.credentialUri.split('#')[0] }}</code>
+        </p>
+        <p v-if="job.payload.transactionHash" class="break-all">
+          <code>{{ job.payload.transactionHash }}</code>
+        </p>
+      </details>
+    </StatusBox>
+  </UCard>
+</template>
diff --git a/apps/web/app/components/IssuerEngineRecovery.vue b/apps/web/app/components/IssuerEngineRecovery.vue
new file mode 100644
index 0000000..1a9aec6
--- /dev/null
+++ b/apps/web/app/components/IssuerEngineRecovery.vue
@@ -0,0 +1,29 @@
+<script setup lang="ts">
+import type { IssuerEngineRecord } from '~/utils/issuerEngine'
+defineProps<{
+  pending: IssuerEngineRecord | null
+  saved: boolean
+  busy: boolean
+  error: string
+  canRestart?: boolean
+}>()
+defineEmits<{ retry: []; restart: [] }>()
+</script>
+
+<template>
+  <StatusBox v-if="pending" tone="warning" role="status" data-testid="issuer-save-pending">
+    <p>{{ $t(canRestart ? 'issuer.engine.failedOperation' : 'issuer.engine.savePending') }}</p>
+    <div class="mt-3 flex gap-3">
+      <UButton v-if="canRestart" :disabled="busy" @click="$emit('restart')">{{
+        $t('issuer.engine.restartFailedOperation')
+      }}</UButton>
+      <UButton v-else :disabled="busy" @click="$emit('retry')">{{
+        $t('issuer.engine.retrySave')
+      }}</UButton>
+    </div>
+    <p v-if="error" role="alert">{{ $t('simpleUi.saveError') }}</p>
+  </StatusBox>
+  <StatusBox v-else-if="saved" tone="success" role="status">{{
+    $t('issuer.engine.saved')
+  }}</StatusBox>
+</template>
diff --git a/apps/web/app/components/IssuerWorkspace.vue b/apps/web/app/components/IssuerWorkspace.vue
new file mode 100644
index 0000000..adc3225
--- /dev/null
+++ b/apps/web/app/components/IssuerWorkspace.vue
@@ -0,0 +1,346 @@
+<script setup lang="ts">
+import { issuerCredentialState, issuerInvitationState } from '~/utils/issuerWorkspace'
+import { invitationProgress } from '~/utils/portalPresenters'
+const props = defineProps<{ section: 'schemas' | 'recipients' | 'credentials' }>()
+const invitationSteps = ['email', 'claimed', 'wallet', 'issuance'] as const
+const { t, locale } = useI18n()
+const localePath = useLocalePath()
+const route = useRoute()
+const { data, error, status, refresh, mutate } = useIssuerWorkspace()
+const selected = computed(() => data.value?.selectedOrganizationId)
+const selectedOrganization = computed(() =>
+  data.value?.organizations.find((org) => org.id === selected.value),
+)
+const approved = computed(
+  () =>
+    selectedOrganization.value?.status === 'active' &&
+    selectedOrganization.value.applicationStatus === 'approved',
+)
+const busy = ref(false)
+const failure = ref(false)
+const notice = ref('')
+const noticeTone = ref<'success' | 'notice'>('success')
+const email = ref('')
+const message = ref('')
+const chosenSchema = ref(typeof route.query.model === 'string' ? route.query.model : '')
+const confirmation = ref<string | null>(null)
+const availableSchemas = computed(() => data.value?.schemas ?? [])
+watch(
+  availableSchemas,
+  (schemas) => {
+    if (!data.value) return
+    if (schemas.some((schema) => `${schema.profileId}:${schema.schemaUid}` === chosenSchema.value))
+      return
+    chosenSchema.value =
+      schemas.length === 1 ? `${schemas[0]!.profileId}:${schemas[0]!.schemaUid}` : ''
+  },
+  { immediate: true },
+)
+const selectedSchema = computed(() =>
+  availableSchemas.value.find(
+    (schema) => `${schema.profileId}:${schema.schemaUid}` === chosenSchema.value,
+  ),
+)
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium', timeStyle: 'short' }).format(
+    new Date(value),
+  )
+
+async function selectOrganization(event: Event) {
+  await navigateTo({
+    path: route.path,
+    query: { ...route.query, organizationId: (event.target as HTMLSelectElement).value },
+  })
+}
+async function action(
+  work: () => Promise<unknown>,
+  successKey: string | (() => string) = 'simpleIssuer.recorded',
+) {
+  if (busy.value) return
+  busy.value = true
+  failure.value = false
+  notice.value = ''
+  noticeTone.value = 'success'
+  try {
+    await work()
+    notice.value = t(typeof successKey === 'function' ? successKey() : successKey)
+    await refresh()
+  } catch {
+    failure.value = true
+  } finally {
+    busy.value = false
+  }
+}
+async function invite() {
+  const schema = selectedSchema.value
+  if (!schema || !selected.value) return
+  let deliveryConfirmed = false
+  await action(
+    async () => {
+      const response = await mutate<{ deliveryStatus: string }>('/api/issuer/invites', {
+        organizationId: selected.value,
+        profileId: schema.profileId,
+        schemaUid: schema.schemaUid,
+        email: email.value,
+        message: message.value,
+      })
+      deliveryConfirmed = response.deliveryStatus === 'sent'
+      noticeTone.value = deliveryConfirmed ? 'success' : 'notice'
+      email.value = ''
+      message.value = ''
+    },
+    () => (deliveryConfirmed ? 'simpleIssuer.invitationSent' : 'simpleIssuer.invitationCreated'),
+  )
+}
+async function confirmInvitationAction(inviteId: string) {
+  const operation = confirmation.value?.startsWith('resend:') ? 'resend' : 'revoke'
+  await action(() => mutate(`/api/issuer/invites/${inviteId}/${operation}`, {}))
+  confirmation.value = null
+}
+useSeoMeta({
+  title: () => `${t(`simpleIssuer.sections.${props.section}`)} — XCS`,
+  robots: 'noindex,nofollow',
+})
+</script>
+
+<template>
+  <PageHeader :title="$t(`simpleIssuer.sections.${section}`)" :lead="$t('issuer.intro')" />
+  <StatusBox v-if="error || failure" tone="error" role="alert" class="mb-5"
+    >{{ $t('issuer.error') }}
+    <UButton class="ml-3" color="neutral" variant="outline" @click="refresh()">{{
+      $t('issuer.retry')
+    }}</UButton>
+  </StatusBox>
+  <StatusBox v-if="notice" :tone="noticeTone" role="status" class="mb-5">{{ notice }}</StatusBox>
+  <p v-if="status === 'pending'">{{ $t('issuer.loading') }}</p>
+  <template v-if="data">
+    <label class="mb-2 block font-semibold" for="issuer-organization">{{
+      $t('issuer.organization')
+    }}</label>
+    <select
+      id="issuer-organization"
+      :value="selected"
+      class="mb-6 w-full rounded border border-default bg-default p-3"
+      @change="selectOrganization"
+    >
+      <option v-for="org in data.organizations" :key="org.id" :value="org.id">
+        {{ org.name }} — {{ $t(`issuer.states.${org.applicationStatus}`) }}
+      </option>
+    </select>
+    <StatusBox v-if="!approved" tone="notice"
+      >{{ $t('issuer.approvalRequired') }}
+      <UButton :to="localePath('/issuer/application')" class="ml-3">{{
+        $t('issuer.application')
+      }}</UButton>
+    </StatusBox>
+    <template v-else-if="section === 'schemas'">
+      <UButton
+        :to="{ path: localePath('/issuer/schemas/new'), query: { organizationId: selected } }"
+        >{{ $t('simpleIssuer.createModel') }}</UButton
+      >
+      <p v-if="!data.schemas.length" class="mt-6 text-muted">{{ $t('simpleIssuer.noModels') }}</p>
+      <ul class="mt-6 grid gap-4 sm:grid-cols-2">
+        <li v-for="schema in data.schemas" :key="`${schema.profileId}:${schema.schemaUid}`">
+          <UCard>
+            <h2 class="font-semibold">{{ schema.displayName || schema.name }}</h2>
+            <p class="text-muted">{{ schema.category }}</p>
+            <UButton
+              class="mt-3"
+              :to="{
+                path: localePath('/issuer/recipients'),
+                query: {
+                  organizationId: selected,
+                  model: `${schema.profileId}:${schema.schemaUid}`,
+                },
+              }"
+              >{{ $t('simpleIssuer.invite') }}</UButton
+            >
+          </UCard>
+        </li>
+      </ul>
+    </template>
+    <template v-else-if="section === 'recipients'">
+      <StatusBox v-if="!availableSchemas.length" tone="notice" class="mb-5">
+        <p>{{ $t('simpleIssuer.createFirst') }}</p>
+        <UButton
+          class="mt-3"
+          :to="{ path: localePath('/issuer/schemas/new'), query: { organizationId: selected } }"
+          >{{ $t('simpleIssuer.createModel') }}</UButton
+        >
+      </StatusBox>
+      <UCard v-else>
+        <h2 class="text-xl font-semibold">{{ $t('simpleIssuer.invite') }}</h2>
+        <p class="mt-2 text-muted">{{ $t('simpleIssuer.inviteHelp') }}</p>
+        <form class="mt-4 grid gap-4" @submit.prevent="invite">
+          <label
+            >{{ $t('simpleIssuer.contactEmail')
+            }}<input
+              v-model="email"
+              type="email"
+              maxlength="254"
+              required
+              class="mt-1 block w-full rounded border border-default bg-default p-3"
+          /></label>
+          <label
+            >{{ $t('simpleIssuer.model')
+            }}<select
+              v-model="chosenSchema"
+              required
+              class="mt-1 block w-full rounded border border-default bg-default p-3"
+            >
+              <option value="" disabled>{{ $t('simpleIssuer.chooseModel') }}</option>
+              <option
+                v-for="schema in availableSchemas"
+                :key="`${schema.profileId}:${schema.schemaUid}`"
+                :value="`${schema.profileId}:${schema.schemaUid}`"
+              >
+                {{ schema.displayName || schema.name }}
+              </option>
+            </select></label
+          >
+          <UButton type="submit" :loading="busy" :disabled="busy || !selectedSchema">{{
+            $t('issuer.sendInvite')
+          }}</UButton>
+        </form>
+      </UCard>
+      <p v-if="!data.invites.length" class="mt-6 text-muted">{{ $t('issuer.noInvites') }}</p>
+      <ul class="mt-6 grid gap-4">
+        <li v-for="item in data.invites" :key="item.id">
+          <UCard>
+            <h2 class="font-semibold break-all">{{ item.recipientDisplayName || item.email }}</h2>
+            <p v-if="item.recipientDisplayName" class="mt-1 text-sm text-muted">{{ item.email }}</p>
+            <p class="mt-2 font-semibold">
+              {{
+                data.schemas.find(
+                  (schema) =>
+                    schema.profileId === item.profileId && schema.schemaUid === item.schemaUid,
+                )?.displayName || $t('recipient.credential')
+              }}
+            </p>
+            <p class="mt-2">{{ $t(`issuer.states.${issuerInvitationState(item)}`) }}</p>
+            <p v-if="!item.revokedAt" class="mt-2 font-semibold">
+              {{ $t(`roleJourney.recipientStates.${item.recipientStatus ?? 'unavailable'}`) }}
+            </p>
+            <p v-if="item.recipientWalletVerifiedAt" class="mt-2 text-sm text-muted">
+              {{
+                $t('roleJourney.walletVerifiedAt', { date: date(item.recipientWalletVerifiedAt) })
+              }}
+            </p>
+            <details class="mt-3">
+              <summary class="cursor-pointer text-sm text-muted">
+                {{ $t('simpleIssuer.deliveryDetails') }}
+              </summary>
+              <p class="text-sm text-muted">
+                {{ $t('issuer.delivery') }}:
+                {{ $t(`issuer.deliveryStates.${item.deliveryStatus || 'pending'}`) }}
+              </p>
+            </details>
+            <StatusBox v-if="item.deliveryStatus === 'failed'" tone="error" class="mt-3">
+              {{ $t('simpleIssuer.deliveryFailed') }}
+            </StatusBox>
+            <StatusBox v-else-if="item.deliveryStatus === 'uncertain'" tone="warning" class="mt-3">
+              {{ $t('issuer.uncertain') }}
+            </StatusBox>
+            <ol
+              class="mt-4 grid gap-2 sm:grid-cols-4"
+              :aria-label="$t('portal.invitationProgress.title')"
+            >
+              <li
+                v-for="step in invitationSteps"
+                :key="step"
+                class="rounded border border-default p-3 text-sm"
+              >
+                <span class="font-semibold">{{ $t(`portal.invitationProgress.${step}`) }}</span>
+                <span class="mt-1 block text-muted">
+                  {{ $t(`portal.progress.${invitationProgress(item)[step]}`) }}
+                </span>
+              </li>
+            </ol>
+            <div class="mt-4 flex flex-wrap gap-3">
+              <UButton
+                v-if="item.claimedAt && !item.revokedAt && item.recipientStatus === 'ready'"
+                :to="localePath(`/issuer/issue/${item.id}`)"
+                >{{ $t('simpleIssuer.readyAction') }}</UButton
+              >
+              <UButton
+                v-if="!item.claimedAt && !item.revokedAt"
+                :disabled="busy"
+                color="neutral"
+                :variant="
+                  item.deliveryStatus === 'failed' || item.deliveryStatus === 'uncertain'
+                    ? 'solid'
+                    : 'outline'
+                "
+                @click="confirmation = `resend:${item.id}`"
+                >{{ $t('issuer.resend') }}</UButton
+              >
+              <UButton
+                v-if="!item.revokedAt && !item.claimedAt"
+                :disabled="busy"
+                color="neutral"
+                variant="outline"
+                @click="confirmation = `revoke:${item.id}`"
+                >{{ $t('simpleIssuer.cancelInvitation') }}</UButton
+              >
+            </div>
+            <div
+              v-if="confirmation?.endsWith(item.id)"
+              class="mt-4 rounded border border-default p-4"
+            >
+              <p>
+                {{
+                  confirmation.startsWith('resend:')
+                    ? $t('issuer.resendConfirm')
+                    : $t('simpleIssuer.cancelInvitationConfirm')
+                }}
+              </p>
+              <UButton class="mt-3" :disabled="busy" @click="confirmInvitationAction(item.id)">{{
+                $t('issuer.confirm')
+              }}</UButton>
+              <UButton
+                class="ml-3 mt-3"
+                color="neutral"
+                variant="outline"
+                @click="confirmation = null"
+                >{{ $t('issuer.cancel') }}</UButton
+              >
+            </div>
+          </UCard>
+        </li>
+      </ul>
+    </template>
+    <template v-else-if="section === 'credentials'">
+      <p v-if="!data.credentials.length" class="text-muted">{{ $t('issuer.noCredentials') }}</p>
+      <ul class="grid gap-4">
+        <li v-for="item in data.credentials" :key="item.generationId">
+          <UCard>
+            <h2 class="font-semibold">
+              {{
+                data.schemas.find(
+                  (schema) =>
+                    schema.schemaUid === item.schemaUid && schema.profileId === item.profileId,
+                )?.displayName || $t('issuer.attestation')
+              }}
+            </h2>
+            <p class="mt-2">
+              {{
+                data.invites.find((invite) => invite.id === item.inviteId)?.recipientDisplayName ||
+                $t('simpleIssuer.recipientFallback')
+              }}
+            </p>
+            <p class="text-sm text-muted">{{ $t(`simpleIssuer.${item.visibility}`) }}</p>
+            <p>{{ $t(`issuer.states.${issuerCredentialState(item)}`) }}</p>
+            <UButton
+              class="mt-3"
+              :to="{
+                path: localePath(`/issuer/credentials/${item.generationId}`),
+                query: { profile: item.profileId },
+              }"
+              >{{ $t('issuer.open') }}</UButton
+            >
+          </UCard>
+        </li>
+      </ul>
+    </template>
+  </template>
+</template>
diff --git a/apps/web/app/components/OrganizationApplicationForm.vue b/apps/web/app/components/OrganizationApplicationForm.vue
new file mode 100644
index 0000000..613cd90
--- /dev/null
+++ b/apps/web/app/components/OrganizationApplicationForm.vue
@@ -0,0 +1,132 @@
+<script setup lang="ts">
+const props = defineProps<{ role: 'issuer' | 'verifier' }>()
+const { t } = useI18n()
+const localePath = useLocalePath()
+const auth = useAuth()
+const { loading, problem, run, reset } = usePortalMutation()
+const form = reactive({
+  name: '',
+  website: '',
+  contact: '',
+  jurisdiction: '',
+  description: '',
+  purpose: '',
+})
+const fields = ['name', 'website', 'contact', 'jurisdiction', 'description', 'purpose'] as const
+const files = ref<File[]>([])
+
+const title = computed(() =>
+  props.role === 'issuer' ? t('simpleIssuer.applyTitle') : t('verifier.apply'),
+)
+const lead = computed(() =>
+  props.role === 'issuer' ? t('simpleIssuer.applyLead') : t('verifier.applyHelp'),
+)
+const statusPath = computed(() => (props.role === 'issuer' ? '/issuer/application' : '/verifier'))
+
+function selectFiles(event: Event) {
+  reset()
+  files.value = Array.from((event.target as HTMLInputElement).files ?? [])
+}
+
+function encodeFile(file: File): Promise<{ mimeType: string; base64: string }> {
+  return new Promise((resolve, reject) => {
+    if (
+      file.size > 5 * 1024 * 1024 ||
+      !['application/pdf', 'image/png', 'image/jpeg'].includes(file.type)
+    )
+      return reject(new Error('DOCUMENT_INVALID'))
+    const reader = new FileReader()
+    reader.onload = () =>
+      resolve({ mimeType: file.type, base64: String(reader.result).split(',')[1] ?? '' })
+    reader.onerror = () => reject(new Error('DOCUMENT_UNREADABLE'))
+    reader.readAsDataURL(file)
+  })
+}
+
+async function submit() {
+  await run(async () => {
+    if (files.value.length < 1 || files.value.length > 3) throw new Error('DOCUMENT_INVALID')
+    const documents = await Promise.all(files.value.map(encodeFile))
+    const result = await auth.mutateApplication<{ organizationId: string }>(
+      `/api/${props.role}/applications`,
+      { ...form, documents },
+    )
+    await navigateTo({
+      path: localePath(statusPath.value),
+      ...(props.role === 'issuer' ? { query: { organizationId: result.organizationId } } : {}),
+    })
+  })
+}
+</script>
+
+<template>
+  <UContainer class="max-w-3xl py-10">
+    <PageHeader :title="title" :lead="lead" />
+    <StatusBox v-if="problem" tone="error" role="alert" class="mb-5">
+      {{
+        $t(
+          problem.code.startsWith('DOCUMENT_')
+            ? 'simpleIssuer.documentError'
+            : 'issuer.applicationError',
+        )
+      }}
+      <p v-if="problem.stateUnchanged" class="mt-2 text-sm">
+        {{ $t('portal.errors.unchanged') }}
+      </p>
+    </StatusBox>
+    <form class="grid gap-5" @submit.prevent="submit">
+      <label v-for="field in fields" :key="field" class="font-semibold">
+        {{ $t(`simpleIssuer.applicationFields.${field}`) }}
+        <textarea
+          v-if="field === 'description' || field === 'purpose'"
+          v-model="form[field]"
+          required
+          maxlength="2000"
+          :disabled="loading"
+          class="mt-2 block w-full rounded border border-default bg-default p-3 font-normal"
+        />
+        <input
+          v-else
+          v-model="form[field]"
+          :type="field === 'website' ? 'url' : field === 'contact' ? 'email' : 'text'"
+          required
+          :maxlength="field === 'website' ? 2048 : 254"
+          :disabled="loading"
+          class="mt-2 block w-full rounded border border-default bg-default p-3 font-normal"
+        />
+      </label>
+      <label class="font-semibold">
+        {{ $t('issuer.documents') }}
+        <input
+          type="file"
+          multiple
+          required
+          accept="application/pdf,image/png,image/jpeg"
+          :disabled="loading"
+          class="mt-2 block w-full"
+          @change="selectFiles"
+        />
+        <span class="mt-2 block text-sm font-normal text-muted">{{
+          $t('issuer.documentsHelp')
+        }}</span>
+      </label>
+      <ul
+        v-if="files.length"
+        class="list-disc pl-5 text-sm"
+        :aria-label="$t('simpleIssuer.documentsReady')"
+      >
+        <li v-for="(file, index) in files" :key="`${file.name}:${index}`">{{ file.name }}</li>
+      </ul>
+      <p class="text-sm text-muted">{{ $t('simpleIssuer.applicationPrivacy') }}</p>
+      <p class="text-sm text-muted">
+        {{ $t(role === 'issuer' ? 'simpleIssuer.applicationNext' : 'verifier.approvalMeaning') }}
+      </p>
+      <UButton type="submit" :loading="loading" :disabled="loading">
+        {{ $t(role === 'issuer' ? 'simpleIssuer.applySubmit' : 'issuer.submit') }}
+      </UButton>
+    </form>
+    <UButton :to="localePath(statusPath)" color="neutral" variant="link" class="mt-5">
+      {{ $t(role === 'issuer' ? 'issuer.application' : 'verifier.title') }}
+    </UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/components/PresentationLink.vue b/apps/web/app/components/PresentationLink.vue
new file mode 100644
index 0000000..2706e86
--- /dev/null
+++ b/apps/web/app/components/PresentationLink.vue
@@ -0,0 +1,72 @@
+<script setup lang="ts">
+import { renderSVG } from 'uqr'
+
+const props = defineProps<{ url: string }>()
+const copied = ref(false)
+const failed = ref(false)
+const shared = ref(false)
+const qr = computed(
+  () => `data:image/svg+xml;charset=utf-8,${encodeURIComponent(renderSVG(props.url))}`,
+)
+watch(
+  () => props.url,
+  () => {
+    copied.value = false
+    failed.value = false
+    shared.value = false
+  },
+)
+async function copy() {
+  try {
+    await navigator.clipboard.writeText(props.url)
+    copied.value = true
+    failed.value = false
+  } catch {
+    failed.value = true
+  }
+}
+async function share() {
+  if (!navigator.share) return copy()
+  try {
+    await navigator.share({ title: 'XCS', url: props.url })
+    shared.value = true
+    failed.value = false
+  } catch (cause) {
+    if ((cause as { name?: string }).name !== 'AbortError') failed.value = true
+  }
+}
+</script>
+<template>
+  <section
+    class="mt-5 rounded border border-default p-4"
+    :aria-label="$t('presentation.shareLink')"
+  >
+    <p class="mb-3 text-sm text-muted">{{ $t('presentation.copyOnce') }}</p>
+    <label class="block font-semibold" for="presentation-created-link">{{
+      $t('presentation.shareLink')
+    }}</label>
+    <input
+      id="presentation-created-link"
+      :value="url"
+      readonly
+      class="mt-2 w-full rounded border border-default bg-default p-3 font-mono text-sm"
+      @focus="($event.target as HTMLInputElement).select()"
+    />
+    <img
+      :src="qr"
+      :alt="$t('presentation.qrAlt')"
+      width="240"
+      height="240"
+      class="mx-auto my-4 bg-white p-3"
+    />
+    <div class="flex flex-wrap gap-3">
+      <UButton @click="copy">{{ $t('presentation.copy') }}</UButton>
+      <UButton color="neutral" variant="outline" @click="share">{{
+        $t('presentation.share')
+      }}</UButton>
+    </div>
+    <p v-if="copied" role="status" class="mt-2">{{ $t('presentation.copied') }}</p>
+    <p v-if="shared" role="status" class="mt-2">{{ $t('presentation.shared') }}</p>
+    <p v-if="failed" role="alert" class="mt-2">{{ $t('presentation.copyFailed') }}</p>
+  </section>
+</template>
diff --git a/apps/web/app/components/PresentationResult.vue b/apps/web/app/components/PresentationResult.vue
new file mode 100644
index 0000000..6b9e896
--- /dev/null
+++ b/apps/web/app/components/PresentationResult.vue
@@ -0,0 +1,98 @@
+<script setup lang="ts">
+import type { ResolvedPresentationView } from '~/types/portal'
+import { presentationHeadline } from '~/utils/presentationView'
+
+const props = defineProps<{ result: ResolvedPresentationView }>()
+const auth = useAuth()
+const { locale } = useI18n()
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium', timeStyle: 'short' }).format(
+    new Date(value),
+  )
+const holderProof = computed(() =>
+  props.result.holderProof?.status === 'verified' &&
+  props.result.holderProof.address === props.result.credential.subjectAddress &&
+  props.result.holderProof.networkId === props.result.credential.networkId
+    ? props.result.holderProof
+    : null,
+)
+const admission = computed(() =>
+  props.result.issuerAdmission?.organizationId === props.result.credential.organizationId
+    ? props.result.issuerAdmission
+    : undefined,
+)
+const headline = computed(() =>
+  presentationHeadline(props.result.verification, { usable: true, fresh: true }),
+)
+</script>
+<template>
+  <article data-testid="presentation-result">
+    <h1 class="text-2xl font-bold">
+      {{ result.credential.schemaName ?? $t('recipient.credential') }}
+    </h1>
+    <p class="mt-2 text-lg">
+      {{ $t('simpleUi.issuedBy', { name: result.credential.organizationName }) }}
+    </p>
+    <h2 class="mt-5 text-xl font-semibold" data-testid="presentation-headline">
+      {{ $t(`presentation.headlines.${headline}`) }}
+    </h2>
+    <p class="mt-2 text-sm text-muted">{{ $t('presentation.limitation') }}</p>
+    <p v-if="result.verification.payload === 'not_checked'" class="mt-2 font-semibold">
+      {{ $t('presentation.partialHelp') }}
+    </p>
+    <div class="mt-5 grid gap-4 lg:grid-cols-3">
+      <section
+        class="rounded border border-default p-4"
+        :aria-label="$t('roleJourney.admissionTitle')"
+      >
+        <h2 class="font-semibold">{{ $t('roleJourney.admissionTitle') }}</h2>
+        <p class="mt-2">{{ result.credential.organizationName }}</p>
+        <p class="mt-2 font-semibold">
+          {{ $t(`roleJourney.admissionStatuses.${admission?.status ?? 'unknown'}`) }}
+        </p>
+        <p v-if="admission?.reviewedAt" class="mt-2 text-sm">
+          {{ $t('roleJourney.admissionReviewedAt', { date: date(admission.reviewedAt) }) }}
+        </p>
+        <p v-if="admission?.checkedAt" class="mt-2 text-sm">
+          {{ $t('roleJourney.checkedAt', { date: date(admission.checkedAt) }) }}
+        </p>
+        <p class="mt-2 text-sm text-muted">{{ $t('roleJourney.admissionMeaning') }}</p>
+      </section>
+      <section
+        class="rounded border border-default p-4"
+        :aria-label="$t('roleJourney.ledgerRecipientTitle')"
+      >
+        <h2 class="font-semibold">{{ $t('roleJourney.ledgerRecipientTitle') }}</h2>
+        <p class="mt-2">{{ $t(`roleJourney.ledgerStatuses.${result.credential.status.state}`) }}</p>
+      </section>
+      <section
+        class="rounded border border-default p-4"
+        :aria-label="$t('roleJourney.holderProofTitle')"
+      >
+        <h2 class="font-semibold">{{ $t('roleJourney.holderProofTitle') }}</h2>
+        <p class="mt-3 font-semibold">
+          {{
+            holderProof
+              ? $t('roleJourney.holderVerifiedAt', { date: date(holderProof.verifiedAt) })
+              : $t('roleJourney.holderProofMissing')
+          }}
+        </p>
+        <p class="mt-2 text-sm text-muted">{{ $t('roleJourney.holderProofMeaning') }}</p>
+        <p v-if="!holderProof" class="mt-2 text-sm text-muted">
+          {{ $t('roleJourney.holderProofRecreate') }}
+        </p>
+      </section>
+    </div>
+
+    <p class="mt-4 font-semibold">
+      {{ $t(result.scope === 'full' ? 'presentation.fullFields' : 'presentation.publicFields') }}
+    </p>
+    <p v-if="!Object.keys(result.claims).length" class="mt-3 text-muted">
+      {{ $t('presentation.noFields') }}
+    </p>
+    <AttestationFields v-else class="mt-3" :claims="result.claims" />
+    <StatusBox v-if="result.requiresAuthorization" class="mt-5" tone="warning">{{
+      $t(auth.user.value ? 'presentation.audienceIncorrect' : 'presentation.authorizationHelp')
+    }}</StatusBox>
+  </article>
+</template>
diff --git a/apps/web/app/components/SchemaRegistrationForm.vue b/apps/web/app/components/SchemaRegistrationForm.vue
new file mode 100644
index 0000000..cae3c9a
--- /dev/null
+++ b/apps/web/app/components/SchemaRegistrationForm.vue
@@ -0,0 +1,505 @@
+<script setup lang="ts">
+import { encodeUtf8, parseJson, sha256Hex, utf8ByteLength, XcsError } from '#xcs/core/index.js'
+import { buildSchemaRegistrationPayment } from '#xcs/sdk/index.js'
+import type { Payment } from 'xrpl'
+import type { WalletSubmissionResult } from '~/composables/useWallet'
+import { walletTransactionErrorMessage } from '~/utils/walletCompatibility'
+import {
+  GUIDED_SCHEMA_FIELD_TYPES,
+  createCourseCompletionDraft,
+  createDiplomaDraft,
+  createEmptyGuidedField,
+  guidedSchemaToJson,
+  schemaDefinitionToGuidedDraft,
+  type GuidedSchemaDraft,
+} from '~/utils/schemaAuthoring'
+
+import type { IssuerSchemaEngineContext } from '~/utils/issuerEngine'
+
+const props = defineProps<{ issuerContext?: IssuerSchemaEngineContext }>()
+const emit = defineEmits<{ busy: [value: boolean] }>()
+const recovery = useIssuerEngineRecovery(() => props.issuerContext)
+const { account, busy, prepare, signAndSubmit } = useWallet()
+const { t } = useI18n()
+const route = useRoute()
+const { getActiveNetworkProfile } = useXcsApi()
+const editorMode = ref<'guided' | 'json'>('guided')
+const guidedDraft = ref<GuidedSchemaDraft>(createCourseCompletionDraft())
+const guidedError = ref('')
+const schemaText = ref(guidedSchemaToJson(guidedDraft.value))
+const transaction = shallowRef<Payment | null>(null)
+const canonicalSchema = ref('')
+const schemaDigestHex = ref('')
+const memoByteLength = ref<number | null>(null)
+const formError = ref('')
+const result = shallowRef<WalletSubmissionResult | null>(null)
+const submitting = ref(false)
+const pageBusy = computed(() => busy.value || submitting.value || recovery.saving.value)
+watch(pageBusy, (value) => emit('busy', value), { immediate: true })
+const nameBytes = computed(() => utf8ByteLength(guidedDraft.value.name))
+const descriptionBytes = computed(() => utf8ByteLength(guidedDraft.value.description))
+function readableSchemaError(value: string): string {
+  const walletMessage = walletTransactionErrorMessage(value, t)
+  if (walletMessage) return walletMessage
+  if (value.startsWith('SCHEMA_INVALID ($.description):'))
+    return t('simpleIssuer.descriptionInvalid')
+  if (value.startsWith('SCHEMA_INVALID ($.name):')) return t('simpleIssuer.nameInvalid')
+  if (value.startsWith('SCHEMA_INVALID ($.fields') || value === 'SCHEMA_FIELD_DUPLICATE')
+    return t('simpleIssuer.fieldsInvalid')
+  if (value.startsWith('SCHEMA_INVALID') || value.startsWith('JSON_INVALID'))
+    return t('simpleIssuer.modelInvalid')
+  return t('simpleIssuer.error')
+}
+const formErrorMessage = computed(() => readableSchemaError(formError.value))
+const modelSummary = computed(() => {
+  if (!canonicalSchema.value) return null
+  return parseJson(canonicalSchema.value) as {
+    name: string
+    description: string
+    fields: Record<string, { type: string; optional?: boolean }>
+  }
+})
+let previewRevision = 0
+
+function schemaErrorMessage(error: unknown): string {
+  if (error instanceof XcsError)
+    return `${error.code}${error.path ? ` (${error.path})` : ''}: ${error.message}`
+  return error instanceof Error ? error.message : String(error)
+}
+
+watch(recovery.pending, (current, previous) => {
+  if (previous && !current && !recovery.saved.value) invalidatePreview()
+})
+
+function invalidatePreview() {
+  previewRevision += 1
+  transaction.value = null
+  canonicalSchema.value = ''
+  schemaDigestHex.value = ''
+  memoByteLength.value = null
+  result.value = null
+}
+
+watch(schemaText, invalidatePreview)
+watch(
+  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
+  invalidatePreview,
+)
+watch(
+  guidedDraft,
+  (draft) => {
+    if (editorMode.value !== 'guided') return
+    invalidatePreview()
+    formError.value = ''
+    try {
+      schemaText.value = guidedSchemaToJson(draft)
+      guidedError.value = ''
+    } catch (error) {
+      guidedError.value = schemaErrorMessage(error)
+    }
+  },
+  { deep: true },
+)
+
+function applyTemplate(factory: () => GuidedSchemaDraft) {
+  editorMode.value = 'guided'
+  guidedDraft.value = factory()
+  formError.value = ''
+}
+
+function addField() {
+  guidedDraft.value.fields.push(createEmptyGuidedField())
+}
+
+function removeField(index: number) {
+  if (guidedDraft.value.fields.length === 1) {
+    guidedDraft.value.fields[0] = createEmptyGuidedField()
+    return
+  }
+  guidedDraft.value.fields.splice(index, 1)
+}
+
+function selectEditorMode(mode: 'guided' | 'json') {
+  if (mode === editorMode.value) return
+  formError.value = ''
+  if (mode === 'json') {
+    if (guidedError.value) {
+      formError.value = guidedError.value
+      return
+    }
+    editorMode.value = mode
+    return
+  }
+
+  try {
+    guidedDraft.value = schemaDefinitionToGuidedDraft(parseJson(schemaText.value))
+    editorMode.value = mode
+    guidedError.value = ''
+  } catch (error) {
+    formError.value = schemaErrorMessage(error)
+  }
+}
+
+async function buildPreview() {
+  if (props.issuerContext && (recovery.pending.value || recovery.saved.value)) return
+  invalidatePreview()
+  formError.value = ''
+  result.value = null
+  if (editorMode.value === 'guided' && guidedError.value) {
+    formError.value = guidedError.value
+    return
+  }
+  if (!account.value) {
+    formError.value = 'WALLET_NOT_CONNECTED'
+    return
+  }
+  const revision = previewRevision
+  const publisher = account.value.address
+  const schemaInput = schemaText.value
+  try {
+    const profile = await getActiveNetworkProfile()
+    if (props.issuerContext) {
+      if (profile.profileId !== props.issuerContext.profileId)
+        throw new Error('ISSUER_PROFILE_MISMATCH')
+      await props.issuerContext.beforeSign(publisher)
+    }
+    const built = buildSchemaRegistrationPayment({
+      publisher,
+      profile,
+      schema: parseJson(schemaInput),
+    })
+    const prepared = (await prepare(built.transaction, profile)) as Payment
+    if (revision !== previewRevision) throw new Error('SCHEMA_PREVIEW_CHANGED_DURING_BUILD')
+    canonicalSchema.value = built.canonicalSchema
+    schemaDigestHex.value = sha256Hex(encodeUtf8(built.canonicalSchema))
+    memoByteLength.value = built.memoByteLength
+    transaction.value = prepared
+  } catch (error) {
+    formError.value = schemaErrorMessage(error)
+    transaction.value = null
+  }
+}
+
+async function submit() {
+  const preparedTransaction = transaction.value
+  const expectedPublisher = account.value?.address
+  const expectedSchema = schemaText.value
+  const expectedCanonical = canonicalSchema.value
+  const expectedDigest = schemaDigestHex.value
+  const expectedMemoByteLength = memoByteLength.value
+  const expectedRevision = previewRevision
+  if (
+    !preparedTransaction ||
+    !expectedPublisher ||
+    !expectedCanonical ||
+    !expectedDigest ||
+    expectedMemoByteLength === null
+  ) {
+    formError.value = 'TRANSACTION_PREVIEW_REQUIRED'
+    return
+  }
+  submitting.value = true
+  try {
+    const assertCurrent = () => {
+      if (
+        previewRevision !== expectedRevision ||
+        transaction.value !== preparedTransaction ||
+        account.value?.address !== expectedPublisher ||
+        schemaText.value !== expectedSchema ||
+        canonicalSchema.value !== expectedCanonical ||
+        schemaDigestHex.value !== expectedDigest ||
+        memoByteLength.value !== expectedMemoByteLength
+      ) {
+        throw new Error('SCHEMA_PREVIEW_CHANGED_BEFORE_SIGNATURE')
+      }
+    }
+    await props.issuerContext?.beforeSign(expectedPublisher)
+    assertCurrent()
+    const response = await signAndSubmit(
+      preparedTransaction,
+      {
+        action: 'schema-register',
+        publisher: expectedPublisher,
+        schemaDigestHex: expectedDigest,
+        memoByteLength: expectedMemoByteLength,
+      },
+      assertCurrent,
+      async (signature) => {
+        if (!props.issuerContext) return
+        await props.issuerContext.beforeSign(expectedPublisher)
+        assertCurrent()
+        recovery.stash({ transactionHash: signature.txHash })
+      },
+      (validated) => {
+        result.value = { ...validated }
+        transaction.value = null
+      },
+    )
+    result.value = response
+    transaction.value = null
+    await recovery.finish(response)
+  } catch (error) {
+    formError.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    submitting.value = false
+    await recovery.checkFailure()
+  }
+}
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('simpleIssuer.modelTitle')" :lead="$t('simpleIssuer.modelLead')" />
+
+    <IssuerEngineRecovery
+      v-if="issuerContext"
+      :pending="recovery.pending.value"
+      :saved="recovery.saved.value"
+      :busy="recovery.saving.value"
+      :error="recovery.error.value"
+      :can-restart="recovery.canRestart.value"
+      @restart="recovery.restart"
+      @retry="recovery.retry"
+    />
+    <UCard v-if="!issuerContext || (!recovery.pending.value && !recovery.saved.value)" class="mb-6">
+      <div class="grid gap-5">
+        <div class="flex flex-wrap gap-3">
+          <UButton
+            v-if="editorMode === 'json'"
+            color="neutral"
+            variant="outline"
+            :disabled="pageBusy"
+            @click="selectEditorMode('guided')"
+            >{{ $t('simpleIssuer.guided') }}</UButton
+          >
+          <details v-if="!issuerContext">
+            <summary class="cursor-pointer text-sm text-muted">
+              {{ $t('simpleIssuer.advanced') }}
+            </summary>
+            <UButton
+              class="mt-2"
+              color="neutral"
+              variant="outline"
+              :disabled="pageBusy"
+              @click="selectEditorMode('json')"
+              >{{ $t('simpleIssuer.editJson') }}</UButton
+            >
+            <p class="mt-2 text-sm text-muted">{{ $t('register.advancedHint') }}</p>
+          </details>
+        </div>
+
+        <template v-if="editorMode === 'guided'">
+          <div class="flex flex-wrap gap-3">
+            <UButton
+              color="neutral"
+              variant="link"
+              class="px-0"
+              type="button"
+              :disabled="pageBusy"
+              @click="applyTemplate(createCourseCompletionDraft)"
+            >
+              {{ $t('register.courseTemplate') }}
+            </UButton>
+            <UButton
+              color="neutral"
+              variant="link"
+              class="px-0"
+              type="button"
+              :disabled="pageBusy"
+              @click="applyTemplate(createDiplomaDraft)"
+            >
+              {{ $t('register.diplomaTemplate') }}
+            </UButton>
+          </div>
+
+          <UFormField
+            :label="$t('simpleIssuer.modelName')"
+            :error="nameBytes === 0 || nameBytes > 64"
+          >
+            <UInput
+              id="schema-name"
+              v-model="guidedDraft.name"
+              :disabled="pageBusy"
+              required
+              aria-describedby="schema-name-hint"
+            />
+            <p id="schema-name-hint" class="text-sm text-muted">
+              {{ $t('simpleIssuer.shortName') }}
+            </p>
+          </UFormField>
+          <UFormField
+            :label="$t('simpleIssuer.modelDescription')"
+            :error="descriptionBytes === 0 || descriptionBytes > 256"
+          >
+            <UTextarea
+              id="schema-description"
+              v-model="guidedDraft.description"
+              required
+              aria-describedby="schema-description-hint"
+              :rows="3"
+              :disabled="pageBusy"
+            />
+            <p id="schema-description-hint" class="text-sm text-muted">
+              {{ $t('simpleIssuer.shortDescription') }}
+            </p>
+          </UFormField>
+
+          <fieldset class="grid gap-3 rounded-[0.8rem] p-4 ring-1 ring-default">
+            <legend class="px-1 font-semibold">{{ $t('simpleIssuer.fields') }}</legend>
+            <div
+              v-for="(field, index) in guidedDraft.fields"
+              :key="index"
+              class="grid gap-3 border-b border-default pb-3 sm:grid-cols-[1fr_10rem_auto_auto] sm:items-end"
+            >
+              <UFormField
+                :label="$t('simpleIssuer.fieldName')"
+                :help="$t('simpleIssuer.fieldNameHint')"
+              >
+                <UInput v-model="field.name" :disabled="pageBusy" autocomplete="off" />
+              </UFormField>
+              <UFormField :label="$t('simpleIssuer.fieldType')">
+                <USelect
+                  v-model="field.type"
+                  :items="
+                    GUIDED_SCHEMA_FIELD_TYPES.map((type) => ({
+                      label: $t(`simpleIssuer.fieldTypes.${type}`),
+                      value: type,
+                    }))
+                  "
+                  :disabled="pageBusy"
+                />
+              </UFormField>
+              <UCheckbox
+                v-model="field.optional"
+                class="sm:pb-2"
+                :disabled="pageBusy"
+                :label="$t('simpleIssuer.optional')"
+              />
+              <UButton
+                color="neutral"
+                variant="link"
+                class="px-0 sm:pb-2"
+                type="button"
+                :disabled="pageBusy"
+                @click="removeField(index)"
+              >
+                {{ $t('simpleIssuer.removeField') }}
+              </UButton>
+            </div>
+            <div>
+              <UButton
+                size="sm"
+                color="neutral"
+                variant="outline"
+                type="button"
+                :disabled="pageBusy"
+                @click="addField"
+              >
+                {{ $t('simpleIssuer.addField') }}
+              </UButton>
+            </div>
+          </fieldset>
+          <StatusBox v-if="guidedError" tone="error" role="alert"
+            ><p>{{ readableSchemaError(guidedError) }}</p>
+            <details v-if="!issuerContext">
+              <summary>{{ $t('simpleIssuer.technical') }}</summary>
+              {{ guidedError }}
+            </details></StatusBox
+          >
+        </template>
+
+        <template v-else>
+          <UFormField :label="$t('register.schema')">
+            <UTextarea
+              id="schema-json"
+              v-model="schemaText"
+              :rows="18"
+              spellcheck="false"
+              :disabled="pageBusy"
+            />
+          </UFormField>
+        </template>
+
+        <StatusBox tone="warning">{{ $t('simpleIssuer.publicModel') }}</StatusBox>
+        <div>
+          <UButton type="button" :disabled="pageBusy" @click="buildPreview">
+            {{ $t('simpleIssuer.reviewModel') }}
+          </UButton>
+        </div>
+      </div>
+    </UCard>
+
+    <StatusBox v-if="formError" tone="error" role="alert" :title="formErrorMessage">
+      <details v-if="formErrorMessage !== formError && !issuerContext">
+        <summary class="cursor-pointer">{{ $t('simpleIssuer.technical') }}</summary>
+        <code>{{ formError }}</code>
+      </details>
+    </StatusBox>
+
+    <UCard v-if="modelSummary" class="mb-6" data-testid="schema-review">
+      <template #header
+        ><h2 class="text-xl font-semibold">{{ $t('simpleIssuer.modelReview') }}</h2></template
+      >
+      <h3 class="font-semibold">{{ modelSummary.name }}</h3>
+      <p class="mt-2 text-muted">{{ modelSummary.description }}</p>
+      <dl class="mt-4 grid gap-3">
+        <div
+          v-for="(field, name) in modelSummary.fields"
+          :key="name"
+          class="flex flex-wrap justify-between gap-2"
+        >
+          <dt class="font-medium">{{ name }}</dt>
+          <dd>
+            {{ $t(`simpleIssuer.fieldTypes.${field.type}`)
+            }}<span v-if="field.optional"> · {{ $t('simpleIssuer.optional') }}</span>
+          </dd>
+        </div>
+      </dl>
+      <details v-if="!issuerContext" class="mt-5">
+        <summary class="cursor-pointer text-sm text-muted">
+          {{ $t('simpleIssuer.technical') }}
+        </summary>
+        <JsonBlock class="mt-3" :code="canonicalSchema" />
+        <p class="text-sm break-all text-muted">
+          {{ memoByteLength }} bytes · <code>{{ schemaDigestHex }}</code>
+        </p>
+      </details>
+    </UCard>
+
+    <TransactionPreview
+      :transaction="transaction"
+      :busy="pageBusy"
+      compact
+      :confirm-label="$t('simpleIssuer.publishModel')"
+      @confirm="submit"
+    />
+    <BusinessFinality
+      v-if="result"
+      :tx-hash="result.txHash"
+      :engine-result="result.transactionResult"
+      :ledger-index="result.ledgerIndex"
+      :business-confirmation="result.businessConfirmation"
+      :business-evidence="result.businessEvidence"
+      :compact="!!issuerContext"
+    />
+    <StatusBox
+      v-if="result?.businessConfirmation === 'confirmed' && result.businessEvidence?.schemaUid"
+      tone="success"
+    >
+      <NuxtLinkLocale
+        :to="
+          issuerContext
+            ? {
+                path: '/issuer/schemas',
+                query: route.query.organizationId
+                  ? { organizationId: route.query.organizationId }
+                  : {},
+              }
+            : `/schemas/${result.businessEvidence.schemaUid}`
+        "
+      >
+        {{ $t(issuerContext ? 'simpleIssuer.openModels' : 'register.openSchema') }}
+      </NuxtLinkLocale>
+    </StatusBox>
+  </UContainer>
+</template>
diff --git a/apps/web/app/components/StatusPill.vue b/apps/web/app/components/StatusPill.vue
index 66b9e2e..644d7a2 100644
--- a/apps/web/app/components/StatusPill.vue
+++ b/apps/web/app/components/StatusPill.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-const props = defineProps<{ value: string }>()
+const props = defineProps<{ value: string; label?: string }>()
 const color = computed(() => {
   if (['active', 'valid', 'trusted', 'ready', 'accepted', 'created'].includes(props.value)) {
     return 'success'
@@ -25,5 +25,5 @@ const color = computed(() => {
 </script>
 
 <template>
-  <UBadge :color="color" variant="subtle" :label="value" :data-tone="color" />
+  <UBadge :color="color" variant="subtle" :label="label ?? value" :data-tone="color" />
 </template>
diff --git a/apps/web/app/components/TransactionPreview.vue b/apps/web/app/components/TransactionPreview.vue
index b822abb..52ea19d 100644
--- a/apps/web/app/components/TransactionPreview.vue
+++ b/apps/web/app/components/TransactionPreview.vue
@@ -1,29 +1,104 @@
 <script setup lang="ts">
-import type { Transaction } from 'xrpl'
+import type { Transaction } from 'xrpl-connect'
+import { requiresGemWalletRawSigning } from '~/utils/gemWalletRawSigning'
 
-defineProps<{ transaction: Transaction | null; busy?: boolean }>()
-defineEmits<{ confirm: [] }>()
+const props = defineProps<{
+  transaction: Transaction | null
+  busy?: boolean
+  compact?: boolean
+  confirmLabel?: string
+}>()
+const emit = defineEmits<{ confirm: [] }>()
+const { walletId, account, consentToRawSigning } = useWallet()
+const actionKey = computed(() => {
+  switch (props.transaction?.TransactionType) {
+    case 'CredentialCreate':
+      return 'issue'
+    case 'CredentialAccept':
+      return 'accept'
+    case 'CredentialDelete':
+      return 'remove'
+    case 'Payment':
+      return 'payment'
+    default:
+      return 'other'
+  }
+})
+function formatDrops(drops: unknown): string | null {
+  if (typeof drops !== 'string' || !/^\d+$/.test(drops)) return null
+  const padded = drops.padStart(7, '0')
+  return `${padded.slice(0, -6)}.${padded.slice(-6)}`
+}
+const fee = computed(() => formatDrops(props.transaction?.Fee))
+const paymentAmount = computed(() =>
+  props.transaction?.TransactionType === 'Payment' ? formatDrops(props.transaction.Amount) : null,
+)
+const rawSigning = computed(() =>
+  requiresGemWalletRawSigning(walletId.value, props.transaction?.TransactionType),
+)
+const rawAcknowledged = ref(false)
+watch(
+  [() => props.transaction, walletId],
+  () => {
+    rawAcknowledged.value = false
+  },
+  { deep: true },
+)
+
+function confirm() {
+  if (!props.transaction || props.busy || (rawSigning.value && !rawAcknowledged.value)) return
+  if (rawSigning.value) consentToRawSigning(props.transaction)
+  rawAcknowledged.value = false
+  emit('confirm')
+}
 </script>
 
 <template>
   <UCard v-if="transaction" class="mb-6" data-testid="transaction-preview" aria-live="polite">
-    <template #header>
-      <p class="text-xs font-semibold tracking-[0.2em] text-muted uppercase">
-        {{ $t('transaction.preview') }}
-      </p>
-      <h2 class="text-xl font-semibold">{{ transaction.TransactionType }}</h2>
-    </template>
-    <MetadataList>
-      <template v-for="(value, key) in transaction" :key="key">
-        <dt>{{ key }}</dt>
-        <dd>
-          <code>{{ typeof value === 'object' ? JSON.stringify(value) : value }}</code>
-        </dd>
-      </template>
-    </MetadataList>
-    <StatusBox tone="warning" class="mt-5">{{ $t('transaction.confirmWarning') }}</StatusBox>
-    <UButton data-testid="transaction-sign" :disabled="busy" @click="$emit('confirm')">
-      {{ busy ? $t('common.working') : $t('transaction.sign') }}
+    <h2 class="text-xl font-semibold">{{ $t('transaction.preview') }}</h2>
+    <p class="mt-3 font-semibold">{{ $t(`simpleUi.signActions.${actionKey}`) }}</p>
+    <p class="mt-2 text-sm">{{ $t('simpleUi.walletWillAsk') }}</p>
+    <p class="mt-2 font-semibold">
+      {{
+        account?.network.id === 'testnet' ? $t('simpleUi.testNetwork') : $t('simpleUi.checkNetwork')
+      }}
+    </p>
+    <p class="mt-2">
+      {{ fee === null ? $t('simpleUi.feeUnknown') : $t('simpleUi.fee', { fee }) }}
+    </p>
+    <p v-if="paymentAmount !== null" class="mt-2">
+      {{ $t('simpleUi.paymentAmount', { amount: paymentAmount }) }}
+    </p>
+    <details v-if="!compact" class="mt-4" data-testid="transaction-technical-details">
+      <summary class="cursor-pointer font-semibold">{{ $t('simpleUi.technicalDetails') }}</summary>
+      <MetadataList>
+        <template v-for="(value, key) in transaction" :key="key">
+          <dt>{{ key }}</dt>
+          <dd>
+            <code>{{ typeof value === 'object' ? JSON.stringify(value) : value }}</code>
+          </dd>
+        </template>
+      </MetadataList>
+    </details>
+    <StatusBox v-if="rawSigning" tone="warning" class="mt-5">
+      <p>{{ $t('transaction.rawWarning') }}</p>
+      <UCheckbox
+        v-model="rawAcknowledged"
+        :disabled="busy"
+        data-testid="raw-signing-consent"
+        :label="$t('transaction.rawConsent')"
+      />
+    </StatusBox>
+    <StatusBox v-else-if="!compact" tone="warning" class="mt-5">{{
+      $t('transaction.confirmWarning')
+    }}</StatusBox>
+    <UButton
+      class="mt-3"
+      data-testid="transaction-sign"
+      :disabled="busy || (rawSigning && !rawAcknowledged)"
+      @click="confirm"
+    >
+      {{ busy ? $t('common.working') : (confirmLabel ?? $t('transaction.sign')) }}
     </UButton>
   </UCard>
 </template>
diff --git a/apps/web/app/components/WalletButton.client.vue b/apps/web/app/components/WalletButton.client.vue
new file mode 100644
index 0000000..d79fbfb
--- /dev/null
+++ b/apps/web/app/components/WalletButton.client.vue
@@ -0,0 +1,303 @@
+<script setup lang="ts">
+import { useWallet as useXrplConnectWallet } from '@xrpl-commons/xrpl-connect-vue'
+import { CrossmarkSDK, isWalletError, WalletErrorCode } from 'xrpl-connect'
+import { bindCrossmarkSession } from '~/utils/crossmarkSession'
+import { walletCredentialSupport } from '~/utils/walletCompatibility'
+import { observeWalletAvailability } from '~/utils/walletDiscovery'
+import { supportsWalletLinkProof } from '~/utils/roleJourney'
+import {
+  connectWallet,
+  WALLET_CONNECTION_CANCELLED,
+  WALLET_CONNECTION_TIMEOUT,
+} from '~/utils/walletConnection'
+
+interface WalletChoice {
+  readonly id: string
+  readonly name: string
+  readonly url?: string | undefined
+  readonly available: boolean
+}
+
+const props = withDefaults(defineProps<{ proofOnly?: boolean; testIdPrefix?: string }>(), {
+  proofOnly: false,
+  testIdPrefix: 'wallet',
+})
+// Callers give local pickers a distinct prefix; avoid consuming SSR IDs in this client component.
+const menuId = `${props.testIdPrefix}-menu`
+
+const walletConnection = useXrplConnectWallet()
+const { connecting, disconnect, manager } = walletConnection
+const { t } = useI18n()
+const { account, busy: operationBusy, error: operationError } = useWallet()
+const open = ref(false)
+const discovering = ref(false)
+const localError = ref<string | null>(null)
+const wallets = shallowRef<WalletChoice[]>([])
+const trigger = ref<{ $el?: HTMLElement } | null>(null)
+let discoveryRun = 0
+let stopDiscovery: (() => void) | undefined
+const pendingWallet = ref<string | null>(null)
+let connectionAttempt: AbortController | undefined
+const busy = computed(
+  () =>
+    pendingWallet.value !== null || connecting.value || operationBusy.value || discovering.value,
+)
+const error = computed(() => localError.value ?? operationError.value)
+const unbindCrossmark = props.proofOnly
+  ? () => {}
+  : bindCrossmarkSession({
+      events: CrossmarkSDK.default,
+      manager,
+      disconnect,
+      onError: (cause) => {
+        const message = cause instanceof Error ? cause.message : String(cause)
+        localError.value =
+          message === 'CROSSMARK_SESSION_CHANGED'
+            ? t('wallet.sessionChanged')
+            : message.startsWith('CROSSMARK_SESSION_REFRESH_')
+              ? t('wallet.sessionRefreshFailed')
+              : message
+      },
+    })
+
+async function closeWalletMenu() {
+  discoveryRun += 1
+  stopDiscovery?.()
+  stopDiscovery = undefined
+  discovering.value = false
+  open.value = false
+  await nextTick()
+  if (!discovering.value) trigger.value?.$el?.focus()
+}
+
+function onOpenRequest(next: boolean) {
+  if (next) void toggle()
+  else {
+    connectionAttempt?.abort()
+    void closeWalletMenu()
+  }
+}
+
+async function toggle() {
+  if (busy.value) return
+  localError.value = null
+  if (account.value) {
+    try {
+      await disconnect()
+    } catch (cause) {
+      localError.value = cause instanceof Error ? cause.message : String(cause)
+    }
+    return
+  }
+  discovering.value = true
+  const run = ++discoveryRun
+  stopDiscovery?.()
+  stopDiscovery = observeWalletAvailability({
+    manager,
+    events: CrossmarkSDK.default,
+    onChange: (availableWallets) => {
+      if (run !== discoveryRun) return
+      const available = new Set(availableWallets.map((wallet) => wallet.id))
+      wallets.value = manager.wallets
+        .filter((wallet) => !props.proofOnly || supportsWalletLinkProof(wallet.id))
+        .map((wallet) => ({
+          id: wallet.id,
+          name: wallet.name,
+          ...(wallet.url ? { url: wallet.url } : {}),
+          available: available.has(wallet.id),
+        }))
+      open.value = true
+      discovering.value = false
+    },
+    onError: (cause) => {
+      if (run !== discoveryRun) return
+      localError.value = cause instanceof Error ? cause.message : String(cause)
+      discovering.value = false
+    },
+  })
+}
+
+function handleEscape(event: KeyboardEvent) {
+  if (event.key !== 'Escape' || (!open.value && !discovering.value && !pendingWallet.value)) return
+  event.stopPropagation()
+  connectionAttempt?.abort()
+  void closeWalletMenu()
+}
+
+onMounted(() => document.addEventListener('keydown', handleEscape))
+onBeforeUnmount(() => {
+  document.removeEventListener('keydown', handleEscape)
+  connectionAttempt?.abort()
+  stopDiscovery?.()
+  unbindCrossmark()
+})
+
+async function chooseWallet(walletId: string) {
+  if (busy.value) return
+  if (props.proofOnly && !supportsWalletLinkProof(walletId)) return
+  localError.value = null
+  const attempt = new AbortController()
+  connectionAttempt = attempt
+  pendingWallet.value = manager.wallets.find((wallet) => wallet.id === walletId)?.name ?? walletId
+  try {
+    await connectWallet(walletConnection, walletId, attempt.signal, 90_000, () => {
+      if (!account.value && !connectionAttempt) localError.value = t('wallet.disconnectFailed')
+    })
+    await closeWalletMenu()
+  } catch (cause) {
+    const message = cause instanceof Error ? cause.message : String(cause)
+    if (message !== WALLET_CONNECTION_CANCELLED) {
+      localError.value =
+        message === WALLET_CONNECTION_TIMEOUT
+          ? t('wallet.connectionTimeout')
+          : isWalletError(cause) && cause.code === WalletErrorCode.NETWORK_MISMATCH
+            ? t('wallet.networkMismatch')
+            : message
+    }
+  } finally {
+    if (connectionAttempt === attempt) {
+      connectionAttempt = undefined
+      pendingWallet.value = null
+    }
+  }
+}
+
+function safeWalletUrl(value: string | undefined): string | undefined {
+  if (!value) return undefined
+  try {
+    const parsed = new URL(value)
+    return parsed.protocol === 'https:' ? parsed.href : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function shortAddress(address: string) {
+  return `${address.slice(0, 6)}…${address.slice(-5)}`
+}
+</script>
+
+<template>
+  <div class="relative min-w-0 max-w-[calc(100vw-7rem)]">
+    <UPopover
+      :open="!account && (open || pendingWallet !== null)"
+      :content="{ side: 'bottom', align: 'end', collisionPadding: 8 }"
+      @update:open="onOpenRequest"
+    >
+      <UButton
+        ref="trigger"
+        color="neutral"
+        :variant="account ? 'outline' : 'solid'"
+        size="sm"
+        class="max-w-full px-2 sm:px-3 [&_span]:truncate"
+        :data-testid="`${testIdPrefix}-toggle`"
+        :disabled="busy"
+        :aria-busy="busy"
+        :title="account ? $t('wallet.disconnect') : undefined"
+        :aria-expanded="account ? undefined : open || pendingWallet !== null"
+        :aria-controls="account ? undefined : menuId"
+        type="button"
+      >
+        <span class="truncate">{{
+          pendingWallet
+            ? $t('wallet.connecting', { wallet: pendingWallet })
+            : account
+              ? `${manager.wallet?.name} · ${shortAddress(account.address)}`
+              : $t(proofOnly ? 'roleJourney.chooseCompatibleWallet' : 'wallet.connect')
+        }}</span>
+      </UButton>
+      <template #content>
+        <div
+          v-if="!account"
+          :id="menuId"
+          :data-testid="`${testIdPrefix}-menu`"
+          class="max-h-[min(36rem,80vh)] w-[min(22rem,calc(100vw-1rem))] space-y-3 overflow-y-auto p-4"
+        >
+          <StatusBox v-if="error" tone="error">{{ error }}</StatusBox>
+          <div v-if="pendingWallet" role="status" :data-testid="`${testIdPrefix}-pending`">
+            <p>{{ $t('wallet.approvalPending', { wallet: pendingWallet }) }}</p>
+            <UButton color="neutral" variant="link" @click="connectionAttempt?.abort()">
+              {{ $t('wallet.cancelConnection') }}
+            </UButton>
+          </div>
+          <strong>{{
+            $t(proofOnly ? 'roleJourney.chooseCompatibleWallet' : 'wallet.choose')
+          }}</strong>
+          <div
+            v-for="wallet in wallets"
+            :key="wallet.id"
+            class="flex items-start justify-between gap-3 border-t border-default pt-3"
+            :data-wallet-choice="wallet.id"
+          >
+            <span class="grid min-w-0 gap-0.5 text-sm">
+              <strong>{{ wallet.name }}</strong>
+              <small class="text-muted">{{
+                $t(wallet.available ? 'wallet.available' : 'wallet.unavailable')
+              }}</small>
+              <small
+                class="text-muted"
+                :data-credential-support="walletCredentialSupport(wallet.id)"
+              >
+                {{ $t(`wallet.credentials.${walletCredentialSupport(wallet.id)}`) }}
+              </small>
+            </span>
+            <UButton
+              v-if="wallet.available"
+              color="neutral"
+              variant="link"
+              size="sm"
+              class="shrink-0 px-0"
+              :data-wallet-id="wallet.id"
+              type="button"
+              :disabled="busy"
+              @click="chooseWallet(wallet.id)"
+            >
+              {{ $t('wallet.select') }}
+            </UButton>
+            <UButton
+              v-else-if="safeWalletUrl(wallet.url)"
+              color="neutral"
+              variant="link"
+              size="sm"
+              class="shrink-0 px-0"
+              :data-wallet-id="wallet.id"
+              :href="safeWalletUrl(wallet.url)"
+              rel="noopener noreferrer"
+              target="_blank"
+            >
+              {{ $t('wallet.setup') }}
+            </UButton>
+          </div>
+          <UButton v-if="!pendingWallet" color="neutral" variant="link" @click="closeWalletMenu">
+            {{ $t('common.close') }}
+          </UButton>
+        </div>
+      </template>
+    </UPopover>
+    <p
+      v-if="account"
+      class="mt-1 flex flex-wrap items-center gap-x-2 text-xs text-muted"
+      role="status"
+      :data-testid="`${testIdPrefix}-status`"
+    >
+      {{ $t('wallet.connected') }} · {{ account.network.name }}
+      <UButton
+        color="neutral"
+        variant="link"
+        size="xs"
+        class="p-0"
+        :disabled="busy"
+        @click="toggle"
+      >
+        {{ $t('wallet.disconnect') }}
+      </UButton>
+    </p>
+    <p
+      v-if="error && !open && !pendingWallet"
+      class="absolute top-full right-0 mt-1 w-[min(20rem,calc(100vw-1rem))] rounded bg-default p-2 text-xs break-words text-error"
+      role="alert"
+    >
+      {{ error }}
+    </p>
+  </div>
+</template>
diff --git a/apps/web/app/components/WalletButton.vue b/apps/web/app/components/WalletButton.vue
deleted file mode 100644
index bd4771c..0000000
--- a/apps/web/app/components/WalletButton.vue
+++ /dev/null
@@ -1,127 +0,0 @@
-<script setup lang="ts">
-import type { WalletChoice } from '~/composables/useWallet'
-
-const { account, busy, error, walletChoices, connect, disconnect } = useWallet()
-const open = ref(false)
-const wallets = ref<WalletChoice[]>([])
-const trigger = ref<{ $el?: HTMLElement } | null>(null)
-let walletMenuRequest = 0
-
-function focusTrigger(): void {
-  const element = trigger.value?.$el
-  if (element instanceof HTMLElement) element.focus()
-}
-
-async function closeWalletMenu(): Promise<void> {
-  walletMenuRequest += 1
-  open.value = false
-  await nextTick()
-  focusTrigger()
-}
-
-async function toggle() {
-  if (account.value) {
-    await disconnect()
-    return
-  }
-  const request = ++walletMenuRequest
-  const discoveredWallets = await walletChoices()
-  if (request !== walletMenuRequest || account.value) return
-  wallets.value = discoveredWallets
-  open.value = true
-}
-
-function onOpenRequest(next: boolean): void {
-  if (next) void toggle()
-  else void closeWalletMenu()
-}
-
-async function chooseWallet(walletId: string) {
-  try {
-    await connect(walletId)
-    await closeWalletMenu()
-  } catch {
-    // useWallet exposes the adapter error next to the control.
-  }
-}
-
-function shortAddress(address: string) {
-  return `${address.slice(0, 6)}…${address.slice(-5)}`
-}
-</script>
-
-<template>
-  <!-- Escape here only covers focus on the trigger during wallet discovery: the popover is not open yet, so Reka UI does not handle it. -->
-  <div class="relative" @keydown.esc.stop="closeWalletMenu()">
-    <UPopover
-      :open="open"
-      :content="{ side: 'bottom', align: 'end', collisionPadding: 8 }"
-      @update:open="onOpenRequest"
-    >
-      <UButton
-        ref="trigger"
-        data-testid="wallet-toggle"
-        color="neutral"
-        :variant="account ? 'outline' : 'solid'"
-        size="sm"
-        :disabled="busy"
-        class="px-2 whitespace-nowrap sm:px-3"
-      >
-        {{ account ? shortAddress(account.address) : $t('wallet.connect') }}
-      </UButton>
-
-      <template #content>
-        <div v-if="!account" id="wallet-menu" class="w-[min(20rem,calc(100vw-1rem))] space-y-3 p-4">
-          <strong class="block text-sm">{{ $t('wallet.choose') }}</strong>
-          <div
-            v-for="wallet in wallets"
-            :key="wallet.id"
-            class="flex items-start justify-between gap-3 border-t border-default pt-3"
-            :data-wallet-choice="wallet.id"
-          >
-            <span class="grid gap-0.5 text-sm">
-              <strong>{{ wallet.name }}</strong>
-              <small class="text-muted">
-                {{ $t(wallet.available ? 'wallet.available' : 'wallet.unavailable') }}
-              </small>
-              <small class="text-muted" :data-credential-support="wallet.credentialSupport">
-                {{ $t(`wallet.credentials.${wallet.credentialSupport}`) }}
-              </small>
-            </span>
-            <UButton
-              v-if="wallet.available"
-              color="neutral"
-              variant="link"
-              size="sm"
-              class="px-0"
-              :data-wallet-id="wallet.id"
-              @click="chooseWallet(wallet.id)"
-            >
-              {{ $t('wallet.select') }}
-            </UButton>
-            <UButton
-              v-else-if="wallet.url"
-              color="neutral"
-              variant="link"
-              size="sm"
-              class="px-0"
-              :data-wallet-id="wallet.id"
-              :href="wallet.url"
-              rel="noopener noreferrer"
-              target="_blank"
-            >
-              {{ $t('wallet.setup') }}
-            </UButton>
-          </div>
-          <p v-if="wallets.length === 0" class="text-sm text-muted">{{ $t('wallet.none') }}</p>
-          <UButton color="neutral" variant="link" size="sm" class="px-0" @click="closeWalletMenu()">
-            {{ $t('common.close') }}
-          </UButton>
-        </div>
-      </template>
-    </UPopover>
-    <p v-if="error" class="absolute top-full right-0 mt-1 text-xs whitespace-nowrap text-error">
-      {{ error }}
-    </p>
-  </div>
-</template>
diff --git a/apps/web/app/components/WalletProgress.vue b/apps/web/app/components/WalletProgress.vue
new file mode 100644
index 0000000..d408f27
--- /dev/null
+++ b/apps/web/app/components/WalletProgress.vue
@@ -0,0 +1,18 @@
+<script setup lang="ts">
+defineProps<{ stage: 'prepare' | 'connect' | 'prove' | 'ready' }>()
+const steps = ['prepare', 'connect', 'prove', 'ready'] as const
+</script>
+
+<template>
+  <ol class="grid gap-3 sm:grid-cols-4" :aria-label="$t('portal.walletProgress.title')">
+    <li
+      v-for="(step, index) in steps"
+      :key="step"
+      class="rounded border border-default p-3"
+      :aria-current="step === stage ? 'step' : undefined"
+    >
+      <span class="text-sm text-muted">{{ index + 1 }}</span>
+      <p class="font-semibold">{{ $t(`portal.walletProgress.${step}`) }}</p>
+    </li>
+  </ol>
+</template>
diff --git a/apps/web/app/components/admin/AdminApplications.vue b/apps/web/app/components/admin/AdminApplications.vue
new file mode 100644
index 0000000..34e2867
--- /dev/null
+++ b/apps/web/app/components/admin/AdminApplications.vue
@@ -0,0 +1,128 @@
+<script setup lang="ts">
+import type { AdminApplication, AdminPage } from '~/composables/useAdminApi'
+const props = defineProps<{ verifiers?: boolean }>()
+const route = useRoute()
+const localePath = useLocalePath()
+const api = useAdminApi()
+const page = computed(() => Math.max(1, Math.floor(Number(route.query.page) || 1)))
+const role = computed(() =>
+  ['issuer', 'verifier'].includes(String(route.query.role)) ? String(route.query.role) : '',
+)
+const query = computed(() => ({ page: page.value, ...(role.value ? { role: role.value } : {}) }))
+const { data, status, error, refresh } = await useAsyncData(
+  props.verifiers ? 'admin-verifiers' : 'admin-queue',
+  () =>
+    api.get<AdminPage<AdminApplication>>(
+      props.verifiers ? 'verifiers' : 'applications',
+      query.value,
+    ),
+  { watch: [query] },
+)
+const busy = computed(() => status.value === 'pending')
+
+async function changePage(value: number) {
+  await navigateTo({ path: route.path, query: { ...route.query, page: value } })
+}
+async function changeRole(value: string) {
+  await navigateTo({ path: route.path, query: { page: 1, ...(value ? { role: value } : {}) } })
+}
+</script>
+
+<template>
+  <div>
+    <StatusBox v-if="route.query.decided === '1'" tone="success" role="status">{{
+      $t('admin.decisionRecorded')
+    }}</StatusBox>
+    <div v-if="!verifiers" class="mb-6 flex flex-wrap items-center gap-3">
+      <span class="font-medium">{{ $t('admin.filterRole') }}</span>
+      <UButton
+        v-for="value in ['', 'issuer', 'verifier']"
+        :key="value"
+        color="neutral"
+        :variant="role === value ? 'solid' : 'outline'"
+        :aria-pressed="role === value"
+        :disabled="busy"
+        @click="changeRole(value)"
+      >
+        {{ value ? $t(`auth.roles.${value}`) : $t('admin.allRoles') }}
+        <span v-if="data?.counts"
+          >({{
+            value === 'issuer'
+              ? data.counts.issuer
+              : value === 'verifier'
+                ? data.counts.verifier
+                : data.counts.issuer + data.counts.verifier
+          }})</span
+        >
+      </UButton>
+    </div>
+    <AdminError :error="error" @retry="refresh()" />
+    <EmptyState v-if="busy" loading />
+    <template v-else-if="!error && data">
+      <EmptyState v-if="!data.items.length">
+        <p>{{ $t(verifiers ? 'admin.emptyVerifiers' : 'admin.emptyQueue') }}</p>
+        <UButton class="mt-4" :to="localePath('/admin/audit')" color="neutral" variant="outline">{{
+          $t('admin.audit')
+        }}</UButton>
+      </EmptyState>
+      <div v-else class="overflow-x-auto">
+        <table class="w-full text-left text-sm" data-testid="admin-applications">
+          <caption class="sr-only">
+            {{
+              $t(verifiers ? 'admin.verifiers' : 'admin.queue')
+            }}
+          </caption>
+          <thead>
+            <tr class="border-b border-default">
+              <th scope="col" class="p-3">{{ $t('admin.organization') }}</th>
+              <th scope="col" class="p-3">{{ $t('admin.role') }}</th>
+              <th scope="col" class="p-3">{{ $t('admin.currentStatus') }}</th>
+              <th scope="col" class="p-3">{{ $t('admin.submitted') }}</th>
+              <th scope="col" class="p-3">{{ $t('auth.actions') }}</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr
+              v-for="item in data.items"
+              :key="`${item.organization_id}:${item.role}`"
+              class="border-b border-default"
+            >
+              <td class="p-3 font-medium">{{ item.name }}</td>
+              <td class="p-3">{{ $t(`auth.roles.${item.role}`) }}</td>
+              <td class="p-3">
+                <UBadge color="neutral" variant="subtle">{{
+                  $t(`admin.status.${item.status}`)
+                }}</UBadge>
+              </td>
+              <td class="p-3">{{ api.date(item.submitted_at) }}</td>
+              <td class="p-3">
+                <UButton
+                  color="neutral"
+                  variant="outline"
+                  size="sm"
+                  :to="{
+                    path: localePath(`/admin/applications/${item.organization_id}/${item.role}`),
+                    query: {
+                      page,
+                      ...(role ? { role } : {}),
+                      ...(verifiers ? { from: 'verifiers' } : {}),
+                    },
+                  }"
+                  :aria-label="$t('admin.reviewNamed', { name: item.name })"
+                  >{{ $t(verifiers ? 'admin.manage' : 'admin.review') }}</UButton
+                >
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+      <AdminPager
+        :page="page"
+        :page-size="data.pageSize"
+        :total="data.total"
+        :busy="busy"
+        @change="changePage"
+      />
+    </template>
+  </div>
+</template>
diff --git a/apps/web/app/components/admin/AdminError.vue b/apps/web/app/components/admin/AdminError.vue
new file mode 100644
index 0000000..0256d1b
--- /dev/null
+++ b/apps/web/app/components/admin/AdminError.vue
@@ -0,0 +1,34 @@
+<script setup lang="ts">
+const props = defineProps<{ error: unknown }>()
+defineEmits<{ retry: [] }>()
+const localePath = useLocalePath()
+const status = computed(() => {
+  const error = props.error as { statusCode?: number; status?: number }
+  return error?.statusCode ?? error?.status
+})
+const message = computed(() => {
+  if (status.value === 401) return 'admin.errors.session'
+  if (status.value === 403) return 'admin.errors.forbidden'
+  if (status.value === 404) return 'admin.errors.missing'
+  if (status.value === 409) return 'admin.errors.conflict'
+  if (status.value === 503) return 'admin.errors.unavailable'
+  return 'admin.errors.generic'
+})
+</script>
+
+<template>
+  <StatusBox v-if="error" tone="error">
+    <p>{{ $t(message) }}</p>
+    <UButton v-if="status === 401" :to="localePath('/auth/login')" size="sm">{{
+      $t('auth.signIn')
+    }}</UButton>
+    <UButton
+      v-else-if="status !== 403"
+      size="sm"
+      variant="outline"
+      color="neutral"
+      @click="$emit('retry')"
+      >{{ $t('admin.retry') }}</UButton
+    >
+  </StatusBox>
+</template>
diff --git a/apps/web/app/components/admin/AdminHistory.vue b/apps/web/app/components/admin/AdminHistory.vue
new file mode 100644
index 0000000..6efefbc
--- /dev/null
+++ b/apps/web/app/components/admin/AdminHistory.vue
@@ -0,0 +1,86 @@
+<script setup lang="ts">
+import type { AdminAudit } from '~/composables/useAdminApi'
+defineProps<{ items: AdminAudit[] }>()
+const emit = defineEmits<{ retried: [] }>()
+const api = useAdminApi()
+const busy = ref<string | null>(null)
+const error = ref<unknown>(null)
+const failedId = ref<string | null>(null)
+const notice = ref(false)
+
+async function retry(id: string) {
+  if (busy.value) return
+  busy.value = id
+  failedId.value = id
+  error.value = null
+  notice.value = false
+  try {
+    await api.post(`notifications/${encodeURIComponent(id)}/retry`)
+    notice.value = true
+    failedId.value = null
+    emit('retried')
+  } catch (cause) {
+    error.value = cause
+  } finally {
+    busy.value = null
+  }
+}
+</script>
+
+<template>
+  <div>
+    <AdminError :error="error" @retry="failedId && retry(failedId)" />
+    <StatusBox v-if="notice" tone="success" role="status">{{
+      $t('admin.notificationQueued')
+    }}</StatusBox>
+    <EmptyState v-if="!items.length">{{ $t('admin.emptyHistory') }}</EmptyState>
+    <ol v-else class="space-y-4">
+      <li v-for="item in items" :key="item.id" class="rounded-lg border border-default p-4">
+        <div class="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <h3 class="font-semibold">
+              {{ item.organization_name ?? $t('admin.operatorAction') }}
+            </h3>
+            <p class="mt-1 text-sm text-muted">
+              {{ item.actor_name ?? item.actor_id }} · {{ api.date(item.created_at) }}
+            </p>
+          </div>
+          <UBadge v-if="item.role" color="neutral" variant="subtle">{{
+            $t(`auth.roles.${item.role}`)
+          }}</UBadge>
+        </div>
+        <p class="mt-3 text-sm">
+          {{ item.before_status ? $t(`admin.status.${item.before_status}`) : '—' }}
+          →
+          {{
+            item.after_status ? $t(`admin.status.${item.after_status}`) : $t('admin.operatorAction')
+          }}
+        </p>
+        <p v-if="item.reason" class="mt-2 whitespace-pre-wrap text-sm">{{ item.reason }}</p>
+        <div v-if="item.notification_status" class="mt-3 border-t border-default pt-3 text-sm">
+          <p>
+            {{ $t('admin.notification') }}:
+            {{ $t(`admin.notifications.${item.notification_status}`) }}
+          </p>
+          <p v-if="item.notification_status === 'blocked'" class="mt-1 text-muted">
+            {{ $t('admin.blockedHelp') }}
+          </p>
+          <p v-if="item.notification_status === 'uncertain'" class="mt-1 text-muted">
+            {{ $t('admin.uncertainHelp') }}
+          </p>
+          <UButton
+            v-if="item.notification_id && ['failed', 'blocked'].includes(item.notification_status)"
+            class="mt-2"
+            size="sm"
+            color="neutral"
+            variant="outline"
+            :loading="busy === item.notification_id"
+            :disabled="busy !== null"
+            @click="retry(item.notification_id)"
+            >{{ $t('admin.retryNotification') }}</UButton
+          >
+        </div>
+      </li>
+    </ol>
+  </div>
+</template>
diff --git a/apps/web/app/components/admin/AdminNav.vue b/apps/web/app/components/admin/AdminNav.vue
new file mode 100644
index 0000000..5a2e86f
--- /dev/null
+++ b/apps/web/app/components/admin/AdminNav.vue
@@ -0,0 +1,23 @@
+<script setup lang="ts">
+const localePath = useLocalePath()
+const route = useRoute()
+const links = [
+  { path: '/admin', label: 'admin.queue' },
+  { path: '/admin/verifiers', label: 'admin.verifiers' },
+  { path: '/admin/audit', label: 'admin.audit' },
+]
+</script>
+
+<template>
+  <nav class="mb-7 flex flex-wrap gap-3" :aria-label="$t('admin.navigation')">
+    <UButton
+      v-for="link in links"
+      :key="link.path"
+      :to="localePath(link.path)"
+      color="neutral"
+      :variant="route.path === localePath(link.path) ? 'solid' : 'outline'"
+      :aria-current="route.path === localePath(link.path) ? 'page' : undefined"
+      >{{ $t(link.label) }}</UButton
+    >
+  </nav>
+</template>
diff --git a/apps/web/app/components/admin/AdminPager.vue b/apps/web/app/components/admin/AdminPager.vue
new file mode 100644
index 0000000..c2ee7e0
--- /dev/null
+++ b/apps/web/app/components/admin/AdminPager.vue
@@ -0,0 +1,28 @@
+<script setup lang="ts">
+defineProps<{ page: number; pageSize: number; total: number; busy?: boolean }>()
+defineEmits<{ change: [page: number] }>()
+</script>
+
+<template>
+  <nav
+    v-if="page > 1 || total > pageSize"
+    class="mt-6 flex items-center gap-4"
+    :aria-label="$t('admin.pagination')"
+  >
+    <UButton
+      color="neutral"
+      variant="outline"
+      :disabled="busy || page <= 1"
+      @click="$emit('change', page - 1)"
+      >{{ $t('admin.previous') }}</UButton
+    >
+    <span>{{ $t('admin.page', { page, total: Math.max(1, Math.ceil(total / pageSize)) }) }}</span>
+    <UButton
+      color="neutral"
+      variant="outline"
+      :disabled="busy || page * pageSize >= total"
+      @click="$emit('change', page + 1)"
+      >{{ $t('admin.next') }}</UButton
+    >
+  </nav>
+</template>
diff --git a/apps/web/app/composables/useAdminApi.ts b/apps/web/app/composables/useAdminApi.ts
new file mode 100644
index 0000000..c5e8d38
--- /dev/null
+++ b/apps/web/app/composables/useAdminApi.ts
@@ -0,0 +1,92 @@
+import type { AuthSessionView } from './useAuth'
+
+export type AdminRole = 'issuer' | 'verifier'
+export type AdminStatus = 'pending' | 'approved' | 'rejected' | 'suspended'
+export type AdminAction = 'approve' | 'reject' | 'suspend' | 'restore'
+export interface AdminApplication {
+  organization_id: string
+  role: AdminRole
+  status: AdminStatus
+  revision: number
+  name: string
+  submitted_at: string
+  reviewed_at: string | null
+  review_reason: string | null
+  website?: string | null
+  contact?: string | null
+  jurisdiction?: string | null
+  description?: string | null
+  purpose?: string | null
+  responsible_name?: string | null
+  responsible_email?: string | null
+}
+export interface AdminAudit {
+  id: string
+  organization_id: string | null
+  role: AdminRole | null
+  organization_name: string | null
+  actor_name: string | null
+  actor_id: string
+  action: string
+  before_status: AdminStatus | null
+  after_status: AdminStatus | null
+  reason: string | null
+  created_at: string
+  notification_id?: string | null
+  notification_status?: 'pending' | 'sending' | 'sent' | 'failed' | 'blocked' | 'uncertain' | null
+}
+export interface AdminPage<T> {
+  items: T[]
+  total: number
+  page: number
+  pageSize: number
+  counts?: { issuer: number; verifier: number }
+}
+export interface AdminDetail {
+  application: AdminApplication
+  wallets: { address: string; network_id: number; verified_at: string }[]
+  documents: { id: string; mime_type: string; byte_length: number }[]
+  history: AdminAudit[]
+}
+export interface AdminDecisionRequest {
+  action: AdminAction
+  revision: number
+  reason: string
+  idempotencyKey: string
+}
+
+export function useAdminApi() {
+  const request = useRequestFetch()
+  const session = useState<AuthSessionView | null>('xcs-auth-session', () => null)
+  const { locale } = useI18n()
+  if (import.meta.server) useResponseHeader('cache-control').value = 'private, no-store'
+
+  function get<T>(path: string, query?: Record<string, string | number>) {
+    return request<T>(`/api/admin/${path}`, { query, retry: 0 })
+  }
+
+  function post<T>(path: string, body: Record<string, unknown> = {}) {
+    if (!session.value?.csrfToken) {
+      throw createError({ statusCode: 401, message: 'AUTH_REQUIRED' })
+    }
+    return request<T>(`/api/admin/${path}`, {
+      method: 'POST',
+      headers: { 'x-xcs-csrf': session.value.csrfToken },
+      body,
+      retry: 0,
+    })
+  }
+
+  function date(value: string | null | undefined): string {
+    if (!value) return '—'
+    return (
+      new Intl.DateTimeFormat(locale.value, {
+        dateStyle: 'medium',
+        timeStyle: 'short',
+        timeZone: 'UTC',
+      }).format(new Date(value)) + ' UTC'
+    )
+  }
+
+  return { get, post, date }
+}
diff --git a/apps/web/app/composables/useAuth.ts b/apps/web/app/composables/useAuth.ts
new file mode 100644
index 0000000..11acc96
--- /dev/null
+++ b/apps/web/app/composables/useAuth.ts
@@ -0,0 +1,112 @@
+import type { AppRole, PortalAccount } from '~/types/portal'
+
+export interface AuthSessionView {
+  enabled: boolean
+  user: PortalAccount | null
+  csrfToken?: string
+  expiresAt?: string
+  absoluteExpiresAt?: string
+}
+
+export function useAuth() {
+  // Nuxt scopes these values to the SSR request, then hydrates the browser instance.
+  const session = useState<AuthSessionView | null>('xcs-auth-session', () => null)
+  const loaded = useState('xcs-auth-loaded', () => false)
+  const unavailable = useState('xcs-auth-unavailable', () => false)
+  const request = useRequestFetch()
+  const cacheControl = import.meta.server ? useResponseHeader('cache-control') : undefined
+
+  async function load(force = false): Promise<void> {
+    if (loaded.value && !force) return
+    try {
+      session.value = await request<AuthSessionView>('/api/auth/session')
+      unavailable.value = false
+      // The SSR payload includes identity and CSRF state when account access is enabled.
+      if (session.value.enabled && cacheControl) cacheControl.value = 'private, no-store'
+    } catch {
+      session.value = null
+      unavailable.value = true
+    } finally {
+      loaded.value = true
+    }
+  }
+
+  async function mutate<T>(path: string, body?: Record<string, unknown>): Promise<T> {
+    return mutateApplication<T>(`/api/auth/${path}`, body)
+  }
+
+  async function mutateApplication<T>(path: string, body?: Record<string, unknown>): Promise<T> {
+    const target = new URL(path, 'https://xcs.invalid')
+    if (
+      target.origin !== 'https://xcs.invalid' ||
+      target.pathname !== path ||
+      target.search ||
+      target.hash ||
+      !/^\/api\/(?:auth|issuer|recipient|verifier)\//.test(target.pathname)
+    ) {
+      throw new Error('AUTH_PATH_INVALID')
+    }
+    if (import.meta.server) throw new Error('AUTH_BROWSER_REQUIRED')
+    if (!session.value?.csrfToken) throw new Error('AUTH_REQUIRED')
+    try {
+      return await request<T>(path, {
+        method: 'POST',
+        headers: { 'x-xcs-csrf': session.value.csrfToken },
+        ...(body ? { body } : {}),
+      })
+    } catch (error) {
+      if ((error as { statusCode?: number }).statusCode === 401) {
+        session.value = { enabled: true, user: null }
+      }
+      throw error
+    }
+  }
+
+  async function updateSession(path: string, body?: Record<string, unknown>): Promise<void> {
+    session.value = await mutate<AuthSessionView>(path, body)
+  }
+
+  async function logout(): Promise<void> {
+    await mutate('logout')
+    session.value = { enabled: true, user: null }
+  }
+
+  function hasRole(role: AppRole, organizationId?: string): boolean {
+    const user = session.value?.user
+    if (!user) return false
+    if (role === 'admin' || role === 'recipient') return user.roles.includes(role)
+    return user.organizations.some(
+      (organization) =>
+        (!organizationId || organization.id === organizationId) &&
+        organization.roles.includes(role),
+    )
+  }
+
+  return {
+    user: computed(() => session.value?.user ?? null),
+    enabled: computed(() => session.value?.enabled === true),
+    expiresAt: computed(() => session.value?.expiresAt),
+    absoluteExpiresAt: computed(() => session.value?.absoluteExpiresAt),
+    unavailable: readonly(unavailable),
+    csrfToken: computed(() => session.value?.csrfToken),
+    load,
+    mutateApplication,
+    hasRole,
+    checkRole: (role: AppRole, organizationId?: string) =>
+      request('/api/auth/access', {
+        query: { role, ...(organizationId ? { organizationId } : {}) },
+      }),
+    refresh: () => updateSession('refresh'),
+    logout,
+    createWalletChallenge: (address: string) =>
+      mutate<{ id: string; message: string; expiresAt: string }>('wallet/challenge', {
+        address,
+        networkId: 1,
+      }),
+    linkWallet: (
+      challengeId: string,
+      proof: { signature: string; publicKey: string; scheme: 'ripple' | 'otsu' },
+    ) => updateSession('wallet/link', { challengeId, ...proof }),
+    unlinkWallet: (walletId: string) => updateSession('wallet/unlink', { walletId }),
+  }
+}
diff --git a/apps/web/app/composables/useIssuerEngineApi.ts b/apps/web/app/composables/useIssuerEngineApi.ts
new file mode 100644
index 0000000..c110933
--- /dev/null
+++ b/apps/web/app/composables/useIssuerEngineApi.ts
@@ -0,0 +1,54 @@
+import type {
+  IssuerCredentialDetail,
+  IssuerEngineRecord,
+  IssuerIssuanceContext,
+  IssuerPayloadReceipt,
+  IssuerVisibility,
+} from '../utils/issuerEngine'
+
+export function useIssuerEngineApi() {
+  const request = useRequestFetch()
+  const { mutateApplication } = useAuth()
+  return {
+    issuance: (inviteId: string) =>
+      request<IssuerIssuanceContext>(
+        `/api/issuer/invites/${encodeURIComponent(inviteId)}/issuance`,
+        { cache: 'no-store' },
+      ),
+    credential: (profileId: string, generationId: string) =>
+      request<IssuerCredentialDetail>(
+        `/api/issuer/credentials/${encodeURIComponent(profileId)}/${encodeURIComponent(generationId)}`,
+        { cache: 'no-store' },
+      ),
+    preparePayload: (
+      inviteId: string,
+      subjectAddress: string,
+      canonicalPayload: string,
+      setting: IssuerVisibility,
+    ) =>
+      mutateApplication<IssuerPayloadReceipt>('/api/issuer/payloads', {
+        inviteId,
+        subjectAddress,
+        canonicalPayload,
+        ...setting,
+      }),
+    recordCredential: (inviteId: string, receipt: IssuerEngineRecord) =>
+      mutateApplication<{
+        profileId: string
+        generationId: string
+        organizationId: string
+        inviteId: string
+      }>('/api/issuer/credentials', { inviteId, ...receipt }),
+    recordSchema: (organizationId: string, profileId: string, receipt: IssuerEngineRecord) =>
+      mutateApplication('/api/issuer/schemas', {
+        organizationId,
+        profileId,
+        transactionHash: receipt.transactionHash,
+      }),
+    reconcileRevocation: (profileId: string, generationId: string, transactionHash: string) =>
+      mutateApplication(
+        `/api/issuer/credentials/${encodeURIComponent(profileId)}/${encodeURIComponent(generationId)}/reconcile`,
+        { transactionHash },
+      ),
+  }
+}
diff --git a/apps/web/app/composables/useIssuerEngineRecovery.ts b/apps/web/app/composables/useIssuerEngineRecovery.ts
new file mode 100644
index 0000000..e5b62c2
--- /dev/null
+++ b/apps/web/app/composables/useIssuerEngineRecovery.ts
@@ -0,0 +1,93 @@
+import type { WalletSubmissionResult } from './useWallet'
+import {
+  clearIssuerEngineRecord,
+  issuerOperationDefinitelyFailed,
+  readIssuerEngineRecord,
+  saveIssuerEngineRecord,
+  type IssuerEngineRecord,
+  type IssuerSchemaEngineContext,
+} from '../utils/issuerEngine'
+import { IndexedDbOperationJournal } from '../utils/operationJournal'
+
+export function useIssuerEngineRecovery(context: () => IssuerSchemaEngineContext | undefined) {
+  const pending = shallowRef<IssuerEngineRecord | null>(null)
+  const saved = ref(false)
+  const saving = ref(false)
+  const error = ref('')
+  const canRestart = ref(false)
+
+  onMounted(async () => {
+    const current = context()
+    if (current) pending.value = readIssuerEngineRecord(localStorage, current.key)
+    await checkFailure()
+  })
+
+  async function checkFailure(): Promise<boolean> {
+    const current = context()
+    const receipt = pending.value
+    canRestart.value = false
+    if (!current || !receipt) return false
+    try {
+      const operations = await new IndexedDbOperationJournal().list()
+      if (pending.value === receipt && context()?.key === current.key) {
+        canRestart.value = issuerOperationDefinitelyFailed(receipt, current.profileId, operations)
+      }
+    } catch {
+      /* Missing local evidence must keep the original operation pending. */
+    }
+    return canRestart.value
+  }
+
+  async function restart(): Promise<void> {
+    if (saving.value) return
+    saving.value = true
+    try {
+      if (!(await checkFailure())) return
+      const current = context()
+      if (!current) return
+      clearIssuerEngineRecord(localStorage, current.key)
+      pending.value = null
+      canRestart.value = false
+      saved.value = false
+      error.value = ''
+    } finally {
+      saving.value = false
+    }
+  }
+
+  function stash(receipt: IssuerEngineRecord): void {
+    const current = context()
+    if (!current) return
+    // A reload can reconcile the original signed transaction without issuing again.
+    saveIssuerEngineRecord(localStorage, current.key, receipt)
+    pending.value = receipt
+    saved.value = false
+    canRestart.value = false
+  }
+
+  async function retry(): Promise<void> {
+    const current = context()
+    const receipt = pending.value
+    if (!current || !receipt || saving.value) return
+    saving.value = true
+    error.value = ''
+    try {
+      // The server independently requires the exact validated ledger evidence.
+      await current.record(receipt)
+      clearIssuerEngineRecord(localStorage, current.key)
+      pending.value = null
+      saved.value = true
+    } catch (cause) {
+      error.value = cause instanceof Error ? cause.message : String(cause)
+    } finally {
+      saving.value = false
+      await checkFailure()
+    }
+  }
+
+  async function finish(result: WalletSubmissionResult): Promise<void> {
+    if (result.businessConfirmation === 'confirmed') await retry()
+  }
+
+  return { pending, saved, saving, error, canRestart, stash, retry, finish, checkFailure, restart }
+}
diff --git a/apps/web/app/composables/useIssuerWorkspace.ts b/apps/web/app/composables/useIssuerWorkspace.ts
new file mode 100644
index 0000000..f0cfce6
--- /dev/null
+++ b/apps/web/app/composables/useIssuerWorkspace.ts
@@ -0,0 +1,19 @@
+import type { IssuerWorkspaceView } from '~/types/portal'
+
+export function useIssuerWorkspace() {
+  const route = useRoute()
+  const request = useRequestFetch()
+  const auth = useAuth()
+  const organizationId = computed(() =>
+    typeof route.query.organizationId === 'string' ? route.query.organizationId : undefined,
+  )
+  const state = useAsyncData(
+    'issuer-workspace',
+    () =>
+      request<IssuerWorkspaceView>('/api/issuer/workspace', {
+        query: organizationId.value ? { organizationId: organizationId.value } : {},
+      }),
+    { watch: [organizationId] },
+  )
+  return { ...state, organizationId, mutate: auth.mutateApplication }
+}
diff --git a/apps/web/app/composables/useLocalPayloadStore.ts b/apps/web/app/composables/useLocalPayloadStore.ts
index 47412e1..da33e3e 100644
--- a/apps/web/app/composables/useLocalPayloadStore.ts
+++ b/apps/web/app/composables/useLocalPayloadStore.ts
@@ -1,28 +1,13 @@
 import { parsePayloadUri } from '#xcs/core/index.js'
-import {
-  clearLocalTestPayloads,
-  inspectLocalTestPayloadLocation,
-  readLocalTestPayload,
-  storeLocalTestPayload,
-} from '~/utils/localPayloadStore'
+import { inspectLocalTestPayloadLocation, readLocalTestPayload } from '~/utils/localPayloadStore'
 import { resolveLocalPayloadStoreClientMode } from '~/utils/localPayloadStoreMode'
 import {
   inspectPilotHttpsPayloadHost,
   readCanonicalHttpsPayload,
   type HttpsPayloadRead,
-  type PayloadPublicationProof,
   type ReadPayloadOptions,
 } from '~/utils/payloadPublication'
 
-function exactBytesMatch(left: string, right: string): boolean {
-  const leftBytes = new TextEncoder().encode(left)
-  const rightBytes = new TextEncoder().encode(right)
-  return (
-    leftBytes.byteLength === rightBytes.byteLength &&
-    leftBytes.every((byte, index) => byte === rightBytes[index])
-  )
-}
-
 export function useLocalPayloadStore() {
   const config = useRuntimeConfig()
   const enabled = ref(false)
@@ -44,25 +29,6 @@ export function useLocalPayloadStore() {
     }
   }
 
-  function publish(
-    canonicalPayload: string,
-    options: { readonly nonPersonalTestDataAcknowledged: boolean },
-  ) {
-    const publication = storeLocalTestPayload({
-      storage: browserStorage(),
-      content: canonicalPayload,
-      nonPersonalTestDataAcknowledged: options.nonPersonalTestDataAcknowledged,
-    })
-    const read = readLocalTestPayload({
-      storage: browserStorage(),
-      credentialUri: publication.credentialUri,
-    })
-    if (!exactBytesMatch(read.content, canonicalPayload)) {
-      throw new Error('LOCAL_PAYLOAD_BYTES_MISMATCH')
-    }
-    return publication
-  }
-
   async function readPayload(options: ReadPayloadOptions): Promise<HttpsPayloadRead> {
     if (parsePayloadUri(options.credentialUri).kind === 'https') {
       return readCanonicalHttpsPayload(options)
@@ -88,33 +54,9 @@ export function useLocalPayloadStore() {
     }
   }
 
-  async function verifyPublication(input: {
-    readonly canonicalPayload: string
-    readonly credentialUri: string
-  }): Promise<PayloadPublicationProof> {
-    const read = await readPayload({ credentialUri: input.credentialUri })
-    if (!exactBytesMatch(read.content, input.canonicalPayload)) {
-      throw new Error('PUBLISHED_PAYLOAD_BYTES_MISMATCH')
-    }
-    return {
-      fetchUrl: read.fetchUrl,
-      digestHex: read.digestHex,
-      byteLength: read.byteLength,
-      checkedAt: read.checkedAt,
-      credentialUri: input.credentialUri,
-    }
-  }
-
-  function clear(): number {
-    return clearLocalTestPayloads(browserStorage())
-  }
-
   return {
     enabled: readonly(enabled),
-    publish,
     readPayload,
     inspectPayloadLocation,
-    verifyPublication,
-    clear,
   }
 }
diff --git a/apps/web/app/composables/usePortalMutation.ts b/apps/web/app/composables/usePortalMutation.ts
new file mode 100644
index 0000000..3911e0a
--- /dev/null
+++ b/apps/web/app/composables/usePortalMutation.ts
@@ -0,0 +1,44 @@
+import { portalProblem, type PortalProblem } from '~/utils/portalProblem'
+
+export function usePortalMutation() {
+  const state = ref<'idle' | 'loading' | 'success' | 'error'>('idle')
+  const problem = shallowRef<PortalProblem | null>(null)
+  let lastWork: (() => Promise<unknown>) | null = null
+
+  async function run<T>(work: () => Promise<T>): Promise<T | undefined> {
+    if (state.value === 'loading') return undefined
+    lastWork = work
+    state.value = 'loading'
+    problem.value = null
+    try {
+      const result = await work()
+      state.value = 'success'
+      return result
+    } catch (error) {
+      problem.value = portalProblem(error)
+      state.value = 'error'
+      return undefined
+    }
+  }
+
+  async function retry(): Promise<void> {
+    const work = lastWork
+    if (!work || !problem.value?.recoverable) return
+    await run(work)
+  }
+
+  function reset(): void {
+    state.value = 'idle'
+    problem.value = null
+    lastWork = null
+  }
+
+  return {
+    state: readonly(state),
+    loading: computed(() => state.value === 'loading'),
+    problem: readonly(problem),
+    run,
+    retry,
+    reset,
+  }
+}
diff --git a/apps/web/app/composables/usePrivateLinkHandoff.ts b/apps/web/app/composables/usePrivateLinkHandoff.ts
new file mode 100644
index 0000000..d3175f4
--- /dev/null
+++ b/apps/web/app/composables/usePrivateLinkHandoff.ts
@@ -0,0 +1,19 @@
+export type PrivateLinkKind = 'invitation' | 'presentation'
+
+/** Hold a link through OIDC in a short-lived HttpOnly cookie, never browser storage. */
+export function usePrivateLinkHandoff() {
+  const auth = useAuth()
+  async function save(kind: PrivateLinkKind, token: string): Promise<void> {
+    if (import.meta.server) throw new Error('AUTH_BROWSER_REQUIRED')
+    await $fetch('/api/auth/link-handoff', { method: 'POST', body: { kind, token } })
+  }
+  async function consume(kind: PrivateLinkKind): Promise<string | null> {
+    if (!auth.user.value) return null
+    const result = await auth.mutateApplication<{ token: string | null }>(
+      '/api/auth/link-handoff/consume',
+      { kind },
+    )
+    return result.token
+  }
+  return { save, consume }
+}
diff --git a/apps/web/app/composables/useRecipientWorkspace.ts b/apps/web/app/composables/useRecipientWorkspace.ts
new file mode 100644
index 0000000..c80b7df
--- /dev/null
+++ b/apps/web/app/composables/useRecipientWorkspace.ts
@@ -0,0 +1,8 @@
+import type { RecipientWorkspaceView } from '~/types/portal'
+
+export function useRecipientWorkspace() {
+  const request = useRequestFetch()
+  return useAsyncData('recipient-workspace', () =>
+    request<RecipientWorkspaceView>('/api/recipient/workspace'),
+  )
+}
diff --git a/apps/web/app/composables/useWallet.ts b/apps/web/app/composables/useWallet.ts
index 2687fdf..819beca 100644
--- a/apps/web/app/composables/useWallet.ts
+++ b/apps/web/app/composables/useWallet.ts
@@ -1,4 +1,5 @@
 import type { NetworkProfile } from '#xcs/core/index.js'
+import { useWallet as useXrplConnectWallet } from '@xrpl-commons/xrpl-connect-vue'
 import {
   autofillXcsTransaction,
   connectAndValidateNetwork,
@@ -6,14 +7,10 @@ import {
   signPreparedAndSubmit,
   submitSignedTransaction,
   type ReliableSubmissionResult,
+  type ValidatedSignature,
 } from '#xcs/sdk/index.js'
-import type { SubmittableTransaction } from 'xrpl'
-import {
-  supportsFetchAccount,
-  type AccountInfo,
-  type NetworkInfo,
-  type Transaction,
-} from 'xrpl-connect'
+import { encode, type SubmittableTransaction } from 'xrpl'
+import { supportsFetchAccount, type AccountInfo, type Transaction } from 'xrpl-connect'
 import {
   reconfirmValidatedBusinessOperation,
   waitForIndexedBusinessEvidence,
@@ -32,26 +29,26 @@ import {
 import { assertCredentialGenerationCurrent } from '~/utils/credentialReview'
 import { assertPublicRpcUrl } from '~/utils/publicRpcUrl'
 import { assertTransactionSigner } from '~/utils/transactions'
+import { closeWalletRpc, finishWalletOperation } from '~/utils/walletOperationCleanup'
+import { refreshWalletAccount } from '~/utils/walletConnection'
+import { requiresGemWalletRawSigning, signGemWalletCredential } from '~/utils/gemWalletRawSigning'
 import {
-  assertWalletSupportsXcsTransaction,
+  OTSU_SIGNING_ACCOUNT_UNAVAILABLE,
   normalizeWalletTransactionError,
-  walletCredentialSupport,
-  type WalletCredentialSupport,
 } from '~/utils/walletCompatibility'
 import {
   assertValidatedTesSuccess,
   createWalletSigner,
+  transactionForWalletSigning,
   validateStoredRecoveryMaterial,
 } from '~/utils/walletSubmission'
 
-const account = shallowRef<AccountInfo | null>(null)
-const walletError = ref<string | null>(null)
+const serverAccount = shallowRef<AccountInfo | null>(null)
 const walletBusy = ref(false)
-const listenersInstalled = ref(false)
 const operations = shallowRef<StoredOperation[]>([])
 const preparedProfiles = new WeakMap<object, NetworkProfile>()
-const preparedWalletSessions = new WeakMap<object, number>()
-let walletSession = 0
+const preparedWalletSessions = new WeakMap<object, string>()
+const rawSigningConsents = new WeakMap<object, string>()
 let journal: IndexedDbOperationJournal | undefined
 
 export interface WalletSubmissionResult extends ReliableSubmissionResult {
@@ -59,14 +56,6 @@ export interface WalletSubmissionResult extends ReliableSubmissionResult {
   readonly businessEvidence?: BusinessEvidence | undefined
 }
 
-export interface WalletChoice {
-  readonly id: string
-  readonly name: string
-  readonly available: boolean
-  readonly credentialSupport: WalletCredentialSupport
-  readonly url?: string | undefined
-}
-
 function operationJournal(): IndexedDbOperationJournal {
   if (!import.meta.client) throw new Error('WALLET_BROWSER_REQUIRED')
   journal ??= new IndexedDbOperationJournal()
@@ -77,17 +66,25 @@ function assertWalletTestnet(connectedAccount: AccountInfo): void {
   if (connectedAccount.network.id !== 'testnet') throw new Error('WALLET_TESTNET_REQUIRED')
 }
 
-function replaceAccount(nextAccount: AccountInfo | null): void {
-  walletSession += 1
-  account.value = nextAccount
+function walletSessionKey(account: AccountInfo | null, walletId: string | undefined): string {
+  if (!account || !walletId) return ''
+  return `${walletId}:${account.address}:${account.network.id}`
 }
 
-function assertWalletContext(transaction: Transaction, address: string, session: number): void {
-  if (walletSession !== session) throw new Error('WALLET_CHANGED_AFTER_PREVIEW')
-  if (!account.value || account.value.address !== address) {
+function assertWalletContext(
+  transaction: Transaction,
+  address: string,
+  expectedSessionKey: string,
+  account: AccountInfo | null,
+  walletId: string | undefined,
+): void {
+  if (walletSessionKey(account, walletId) !== expectedSessionKey) {
+    throw new Error('WALLET_CHANGED_AFTER_PREVIEW')
+  }
+  if (!account || account.address !== address) {
     throw new Error('WALLET_CHANGED_AFTER_PREVIEW')
   }
-  assertWalletTestnet(account.value)
+  assertWalletTestnet(account)
   assertTransactionSigner(transaction, address)
 }
 
@@ -105,7 +102,31 @@ function sameProfile(left: NetworkProfile, right: NetworkProfile): boolean {
 }
 
 export function useWallet() {
-  const { $walletManager, $xrplClientFactory } = useNuxtApp()
+  const { $xrplClientFactory } = useNuxtApp()
+  const xrplConnect = import.meta.client ? useXrplConnectWallet() : undefined
+  const walletManager = xrplConnect?.manager
+  const disconnecting = ref(walletManager?.connected !== true)
+  // rc.2's Vue binding waits for provider teardown before clearing its account.
+  // Stop presenting that old account as usable as soon as disconnect starts.
+  const invalidateSession = () => {
+    disconnecting.value = true
+  }
+  const approveSession = () => {
+    disconnecting.value = false
+  }
+  if (walletManager) {
+    walletManager.on('disconnecting', invalidateSession)
+    walletManager.on('connect', approveSession)
+    onScopeDispose(() => {
+      walletManager.off('disconnecting', invalidateSession)
+      walletManager.off('connect', approveSession)
+    })
+  }
+  const account = computed(() =>
+    disconnecting.value ? null : (xrplConnect?.account.value ?? serverAccount.value),
+  )
+  const error = computed(() => xrplConnect?.error.value?.message ?? null)
+  const busy = computed(() => walletBusy.value || xrplConnect?.connecting.value === true)
   const config = useRuntimeConfig()
   const {
     getActiveNetworkProfile,
@@ -184,155 +205,84 @@ export function useWallet() {
     }
   }
 
-  if (import.meta.client && !listenersInstalled.value) {
-    listenersInstalled.value = true
-    $walletManager.on('connect', (connectedAccount) => {
-      const nextAccount = connectedAccount as AccountInfo
-      try {
-        assertWalletTestnet(nextAccount)
-        replaceAccount(nextAccount)
-        walletError.value = null
-      } catch (error) {
-        replaceAccount(null)
-        walletError.value = error instanceof Error ? error.message : String(error)
-      }
-    })
-    $walletManager.on('disconnect', () => {
-      replaceAccount(null)
-    })
-    $walletManager.on('accountChanged', (changedAccount) => {
-      const nextAccount = changedAccount as AccountInfo
-      try {
-        assertWalletTestnet(nextAccount)
-        replaceAccount(nextAccount)
-        walletError.value = null
-      } catch (error) {
-        replaceAccount(null)
-        walletError.value = error instanceof Error ? error.message : String(error)
-      }
-    })
-    $walletManager.on('networkChanged', (changedNetwork) => {
-      if (!account.value) return
-      const nextAccount = {
-        ...account.value,
-        network: changedNetwork as NetworkInfo,
-      }
-      try {
-        assertWalletTestnet(nextAccount)
-        replaceAccount(nextAccount)
-        walletError.value = null
-      } catch (error) {
-        replaceAccount(null)
-        walletError.value = error instanceof Error ? error.message : String(error)
-      }
-    })
-    $walletManager.on('error', (error) => {
-      walletError.value = error instanceof Error ? error.message : String(error)
-    })
-  }
-
-  function safeWalletUrl(value: string | undefined): string | undefined {
-    if (!value) return undefined
-    try {
-      const url = new URL(value)
-      return url.protocol === 'https:' ? url.href : undefined
-    } catch {
-      return undefined
-    }
+  function requireWalletManager() {
+    if (!walletManager) throw new Error('WALLET_BROWSER_REQUIRED')
+    return walletManager
   }
 
   async function refreshConnectedWallet(): Promise<void> {
-    const adapter = $walletManager.wallet
+    const manager = requireWalletManager()
+    const adapter = manager.wallet
     if (!adapter || !supportsFetchAccount(adapter)) return
-    const refreshed = await $walletManager.fetchAccount()
-    if (!refreshed) {
-      replaceAccount(null)
-      throw new Error('WALLET_NOT_CONNECTED')
+    // Xaman already binds every signature to the connected account. Its live
+    // ping can omit optional network metadata, so the rc.2 adapter must not be
+    // used as a second connection gate after the initial OAuth result.
+    if (adapter.id === 'xaman') {
+      if (!account.value) throw new Error('WALLET_NOT_CONNECTED')
+      assertWalletTestnet(account.value)
+      return
     }
+    const refreshed = await refreshWalletAccount({
+      manager,
+      disconnect: () => xrplConnect!.disconnect(),
+    })
+    if (!refreshed) throw new Error('WALLET_NOT_CONNECTED')
     assertWalletTestnet(refreshed)
     if (
       !account.value ||
       account.value.address !== refreshed.address ||
       account.value.network.id !== refreshed.network.id
     ) {
-      replaceAccount(refreshed)
-      return
-    }
-    account.value = refreshed
-  }
-
-  async function walletChoices(): Promise<WalletChoice[]> {
-    let availableIds = new Set<string>()
-    try {
-      availableIds = new Set(
-        (await $walletManager.getAvailableWallets()).map((wallet) => wallet.id),
-      )
-    } catch (error) {
-      walletError.value = error instanceof Error ? error.message : String(error)
-    }
-
-    return $walletManager.wallets.map((wallet) => {
-      const url = safeWalletUrl(wallet.url)
-      return {
-        id: wallet.id,
-        name: wallet.name,
-        available: availableIds.has(wallet.id),
-        credentialSupport: walletCredentialSupport(wallet.id),
-        ...(url ? { url } : {}),
-      }
-    })
-  }
-
-  async function connect(walletId: string) {
-    walletBusy.value = true
-    walletError.value = null
-    try {
-      const connectedAccount = await $walletManager.connect(walletId, { network: 'testnet' })
-      assertWalletTestnet(connectedAccount)
-      replaceAccount(connectedAccount)
-    } catch (error) {
-      replaceAccount(null)
-      walletError.value = error instanceof Error ? error.message : String(error)
-      if ($walletManager.connected) await $walletManager.disconnect().catch(() => undefined)
-      throw error
-    } finally {
-      walletBusy.value = false
+      throw new Error('WALLET_CHANGED_AFTER_PREVIEW')
     }
   }
 
-  async function disconnect() {
-    await $walletManager.disconnect()
-    replaceAccount(null)
-  }
-
   async function prepare(
     transaction: Transaction,
     expectedProfile?: NetworkProfile,
   ): Promise<Transaction> {
+    const manager = requireWalletManager()
     await refreshConnectedWallet()
     if (!account.value) throw new Error('WALLET_NOT_CONNECTED')
     assertWalletTestnet(account.value)
     assertTransactionSigner(transaction, account.value.address)
-    assertWalletSupportsXcsTransaction($walletManager.wallet, transaction.TransactionType)
-    const preparingSession = walletSession
+    const preparingSession = walletSessionKey(account.value, manager.wallet?.id)
     const preparingAddress = account.value.address
 
     const profile = await getActiveNetworkProfile()
-    assertWalletContext(transaction, preparingAddress, preparingSession)
+    assertWalletContext(
+      transaction,
+      preparingAddress,
+      preparingSession,
+      account.value,
+      manager.wallet?.id,
+    )
     if (expectedProfile !== undefined && !sameProfile(expectedProfile, profile)) {
       throw new Error('NETWORK_PROFILE_CHANGED_BEFORE_PREVIEW')
     }
     const client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
     try {
       await connectAndValidateNetwork(client, profile)
-      assertWalletContext(transaction, preparingAddress, preparingSession)
+      assertWalletContext(
+        transaction,
+        preparingAddress,
+        preparingSession,
+        account.value,
+        manager.wallet?.id,
+      )
       const prepared = await autofillXcsTransaction(client, transaction)
-      assertWalletContext(prepared.transaction, preparingAddress, preparingSession)
+      assertWalletContext(
+        prepared.transaction,
+        preparingAddress,
+        preparingSession,
+        account.value,
+        manager.wallet?.id,
+      )
       preparedProfiles.set(prepared.transaction, profile)
-      preparedWalletSessions.set(prepared.transaction, walletSession)
+      preparedWalletSessions.set(prepared.transaction, preparingSession)
       return prepared.transaction
     } finally {
-      if (client.isConnected()) await client.disconnect()
+      await closeWalletRpc(client)
     }
   }
 
@@ -340,9 +290,10 @@ export function useWallet() {
     transaction: Transaction,
     business?: OperationBusinessContext,
     assertCurrent?: () => void,
-    afterSignatureValidated?: () => void | Promise<void>,
+    afterSignatureValidated?: (signature: ValidatedSignature) => void | Promise<void>,
     afterLedgerValidated?: (result: ReliableSubmissionResult) => void | Promise<void>,
   ): Promise<WalletSubmissionResult> {
+    const manager = requireWalletManager()
     await refreshConnectedWallet()
     if (!account.value) throw new Error('WALLET_NOT_CONNECTED')
     assertWalletTestnet(account.value)
@@ -350,32 +301,53 @@ export function useWallet() {
 
     const preparedProfile = preparedProfiles.get(transaction)
     if (!preparedProfile) throw new Error('TRANSACTION_PREVIEW_REQUIRED')
-    if (preparedWalletSessions.get(transaction) !== walletSession) {
+    const preparedWalletSession = preparedWalletSessions.get(transaction)
+    if (
+      !preparedWalletSession ||
+      preparedWalletSession !== walletSessionKey(account.value, manager.wallet?.id)
+    ) {
       throw new Error('WALLET_CHANGED_AFTER_PREVIEW')
     }
-    assertWalletSupportsXcsTransaction($walletManager.wallet, transaction.TransactionType)
-    const signingSession = walletSession
+    const rawSigning = requiresGemWalletRawSigning(manager.wallet?.id, transaction.TransactionType)
+    const rawConsent = rawSigningConsents.get(transaction)
+    rawSigningConsents.delete(transaction)
+    if (rawSigning && rawConsent !== encode(transaction)) {
+      throw new Error('GEMWALLET_RAW_SIGNING_CONSENT_REQUIRED')
+    }
+    const signingSession = preparedWalletSession
     const signingAddress = account.value.address
     const normalizedBusiness = business ? validateOperationBusinessContext(business) : undefined
     assertCurrent?.()
     const activeProfile = await getActiveNetworkProfile()
-    assertWalletContext(transaction, signingAddress, signingSession)
+    assertWalletContext(
+      transaction,
+      signingAddress,
+      signingSession,
+      account.value,
+      manager.wallet?.id,
+    )
     assertCurrent?.()
     if (!sameProfile(preparedProfile, activeProfile)) {
       throw new Error('NETWORK_PROFILE_CHANGED_AFTER_PREVIEW')
     }
 
     walletBusy.value = true
-    walletError.value = null
-    const operationId = crypto.randomUUID()
-    const operationStore = operationJournal()
-    const client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
+    let client: ReturnType<typeof $xrplClientFactory> | undefined
 
     try {
+      const operationId = crypto.randomUUID()
+      const operationStore = operationJournal()
+      client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
       // Network identity is known before the wallet is asked to sign. The SDK
       // will refuse to sign or submit through an unvalidated client.
       await connectAndValidateNetwork(client, activeProfile)
-      assertWalletContext(transaction, signingAddress, signingSession)
+      assertWalletContext(
+        transaction,
+        signingAddress,
+        signingSession,
+        account.value,
+        manager.wallet?.id,
+      )
       assertCurrent?.()
       const createdAt = new Date().toISOString()
       await operationStore.create({
@@ -388,10 +360,16 @@ export function useWallet() {
         ...(normalizedBusiness ? { business: normalizedBusiness } : {}),
       })
 
-      const walletSigner = createWalletSigner($walletManager)
+      const walletSigner = createWalletSigner({ sign: (request) => manager.sign(request) })
       const signer = {
         sign: async (preparedTransaction: Readonly<SubmittableTransaction>) => {
-          assertWalletContext(transaction, signingAddress, signingSession)
+          assertWalletContext(
+            transaction,
+            signingAddress,
+            signingSession,
+            account.value,
+            manager.wallet?.id,
+          )
           assertCurrent?.()
           const latestProfile = await getActiveNetworkProfile()
           if (!sameProfile(activeProfile, latestProfile)) {
@@ -399,16 +377,43 @@ export function useWallet() {
           }
           await getNetworkReadiness(activeProfile.profileId)
           await refreshConnectedWallet()
-          assertWalletContext(transaction, signingAddress, signingSession)
+          assertWalletContext(
+            transaction,
+            signingAddress,
+            signingSession,
+            account.value,
+            manager.wallet?.id,
+          )
           assertCurrent?.()
           try {
-            return await walletSigner.sign(preparedTransaction)
+            if (rawSigning) {
+              if (rawConsent !== encode(preparedTransaction)) {
+                throw new Error('GEMWALLET_RAW_SIGNING_CONSENT_REQUIRED')
+              }
+              return await signGemWalletCredential(
+                preparedTransaction as Transaction,
+                account.value!,
+              )
+            }
+            return await walletSigner.sign(
+              transactionForWalletSigning(
+                preparedTransaction as Transaction,
+                manager.wallet?.id,
+              ) as SubmittableTransaction,
+            )
           } catch (error) {
-            throw normalizeWalletTransactionError(
+            const normalized = await normalizeWalletTransactionError(
               error,
-              $walletManager.wallet,
+              manager.wallet,
               preparedTransaction.TransactionType,
             )
+            if (normalized.message === OTSU_SIGNING_ACCOUNT_UNAVAILABLE) {
+              // The provider exists but the session cannot access its selected
+              // signing key. Do not leave XCS displaying a connected session
+              // that cannot authorize the reviewed transaction.
+              await manager.disconnect().catch(() => undefined)
+            }
+            throw normalized
           }
         },
       }
@@ -420,8 +425,9 @@ export function useWallet() {
         {
           journal: operationStore,
           operationId,
-          allowSignerLastLedgerSequenceRefresh: $walletManager.wallet?.id === 'xaman',
-          onValidatedSignature: async ({ txBlob, txHash, lastLedgerSequence }) => {
+          allowSignerLastLedgerSequenceRefresh: manager.wallet?.id === 'xaman',
+          onValidatedSignature: async (signature) => {
+            const { txBlob, txHash, lastLedgerSequence } = signature
             await operationStore.persistSigned({
               operationId,
               txBlob,
@@ -429,6 +435,7 @@ export function useWallet() {
               lastLedgerSequence,
               at: new Date().toISOString(),
             })
+            await afterSignatureValidated?.(signature)
           },
           beforeSubmit: async () => {
             // The signature already proves which account authorized the exact
@@ -436,7 +443,6 @@ export function useWallet() {
             // wallet session refresh; only re-run volatile application guards.
             assertCurrent?.()
             await assertBusinessGenerationCurrent(normalizedBusiness, activeProfile.profileId)
-            await afterSignatureValidated?.()
             assertCurrent?.()
             const latestProfile = await getActiveNetworkProfile()
             if (!sameProfile(activeProfile, latestProfile)) {
@@ -460,9 +466,7 @@ export function useWallet() {
       preparedWalletSessions.delete(transaction)
       return { ...result, ...businessResult }
     } finally {
-      await loadOperations().catch(() => undefined)
-      if (client.isConnected()) await client.disconnect()
-      walletBusy.value = false
+      await finishWalletOperation(walletBusy, loadOperations, client)
     }
   }
 
@@ -474,10 +478,10 @@ export function useWallet() {
 
   async function retryOperation(operationId: string): Promise<WalletSubmissionResult> {
     walletBusy.value = true
-    walletError.value = null
-    const operationStore = operationJournal()
-    const client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
+    let client: ReturnType<typeof $xrplClientFactory> | undefined
     try {
+      const operationStore = operationJournal()
+      client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
       const stored = (await operationStore.list()).find(
         (operation) => operation.operationId === operationId,
       )
@@ -552,17 +556,14 @@ export function useWallet() {
       )
       return { ...result, ...businessResult }
     } finally {
-      await loadOperations().catch(() => undefined)
-      if (client.isConnected()) await client.disconnect()
-      walletBusy.value = false
+      await finishWalletOperation(walletBusy, loadOperations, client)
     }
   }
 
   async function reconfirmOperation(operationId: string) {
     walletBusy.value = true
-    walletError.value = null
-    const operationStore = operationJournal()
     try {
+      const operationStore = operationJournal()
       const stored = (await operationStore.list()).find(
         (operation) => operation.operationId === operationId,
       )
@@ -591,30 +592,28 @@ export function useWallet() {
           operationStore.setBusinessConfirmation(operationId, confirmation, at, evidence),
       })
     } finally {
-      await loadOperations().catch(() => undefined)
-      walletBusy.value = false
+      await finishWalletOperation(walletBusy, loadOperations)
     }
   }
 
   async function abandonOperation(operationId: string): Promise<void> {
     walletBusy.value = true
-    walletError.value = null
     try {
       await operationJournal().abandon(operationId)
     } finally {
-      await loadOperations().catch(() => undefined)
-      walletBusy.value = false
+      await finishWalletOperation(walletBusy, loadOperations)
     }
   }
 
   return {
-    account: readonly(account),
-    busy: readonly(walletBusy),
-    error: readonly(walletError),
+    account,
+    walletId: computed(() => (account.value ? walletManager?.wallet?.id : undefined)),
+    consentToRawSigning(transaction: Transaction) {
+      rawSigningConsents.set(transaction, encode(transaction))
+    },
+    busy,
+    error,
     operations: readonly(operations),
-    walletChoices,
-    connect,
-    disconnect,
     prepare,
     signAndSubmit,
     loadOperations,
diff --git a/apps/web/app/composables/useXcsApi.ts b/apps/web/app/composables/useXcsApi.ts
index 05e45a5..1407aae 100644
--- a/apps/web/app/composables/useXcsApi.ts
+++ b/apps/web/app/composables/useXcsApi.ts
@@ -1,4 +1,5 @@
 import type { NetworkProfile, ResolvedSchema, SchemaDefinition } from '#xcs/core/index.js'
+import type { FetchOptions } from 'ofetch'
 import type { VerificationDimensions } from '../utils/credentialReview'
 import {
   exactCredentialEventPath,
@@ -173,12 +174,26 @@ export interface ApiTransactionDetail {
 
 export type VerificationResponse = VerificationDimensions
 
+export interface HostedPayloadPublicationResponse {
+  readonly uri: string
+  readonly fetchUrl: string
+  readonly digestHex: string
+  readonly byteLength: number
+  readonly transactionHash: string
+}
+
 export function useXcsApi() {
   const config = useRuntimeConfig()
-  // The read API is served by this application's own server routes, so the same
-  // relative paths work in the browser and, in process, during server rendering.
+  // Read routes belong to this Nuxt app in production and in the browser harness.
   const baseURL = ''
-  const apiFetch = $fetch
+  // Nitro dispatches relative SSR requests in process with native request context.
+  // The server exempts these local requests using its own request-object identity.
+  // This REST boundary declares its response types below, rather than asking
+  // Nitro to infer them from the catch-all route's dynamic schema dispatcher.
+  type ApiFetch = <T>(url: string, options?: FetchOptions<'json'>) => Promise<T>
+  const apiFetch: ApiFetch = import.meta.server
+    ? (useRequestFetch() as unknown as ApiFetch)
+    : ($fetch as unknown as ApiFetch)
 
   function listNetworks() {
     return apiFetch<{ items: NetworkProfile[] }>('/v1/networks', { baseURL })
@@ -401,6 +416,28 @@ export function useXcsApi() {
     })
   }
 
+  async function publishHostedPayload(input: {
+    network: string
+    locator: string
+    payloadBase64: string
+    signedTransactionBlob: string
+  }): Promise<HostedPayloadPublicationResponse> {
+    return apiFetch<HostedPayloadPublicationResponse>(
+      `/v1/payloads/${encodeURIComponent(input.locator)}`,
+      {
+        baseURL,
+        method: 'POST',
+        body: {
+          network: input.network,
+          payloadBase64: input.payloadBase64,
+          signedTransactionBlob: input.signedTransactionBlob,
+        },
+        retry: 0,
+        timeout: 15_000,
+      },
+    )
+  }
+
   return {
     listNetworks,
     getActiveNetworkProfile,
@@ -416,6 +453,7 @@ export function useXcsApi() {
     getCredential,
     getCredentialEventByTransaction,
     getSchemaRegistrationByTransaction,
+    publishHostedPayload,
     verify,
   }
 }
diff --git a/apps/web/app/layouts/default.vue b/apps/web/app/layouts/default.vue
index adc40e0..d5738cf 100644
--- a/apps/web/app/layouts/default.vue
+++ b/apps/web/app/layouts/default.vue
@@ -1,7 +1,15 @@
 <script setup lang="ts">
 const { locale, locales, setLocale, t } = useI18n()
 const localePath = useLocalePath()
+const auth = useAuth()
+const issuerEnabled = String(useRuntimeConfig().public.issuerEnabled) === '1'
+await auth.load()
 const clientReady = ref(false)
+const route = useRoute()
+const simpleNavigation = computed(() => issuerEnabled && auth.enabled.value)
+const walletFreePage = computed(
+  () => simpleNavigation.value && /^\/(?:fr\/?)?(?:presentations|verifier)?\/?$/.test(route.path),
+)
 
 const localeItems = computed(() =>
   locales.value.map((item) =>
@@ -11,16 +19,59 @@ const localeItems = computed(() =>
   ),
 )
 
-const navigation = computed(() => [
+const protocolNavigation = computed(() => [
   { label: t('nav.explorer'), to: localePath('/schemas') },
-  { label: t('nav.create'), to: localePath('/studio') },
-  { label: t('nav.verify'), to: localePath('/verify') },
+  { label: t('simpleNavigation.verify'), to: localePath('/presentations') },
   { label: t('nav.docs'), to: localePath('/developers') },
+  ...(auth.hasRole('admin') ? [{ label: t('admin.title'), to: localePath('/admin') }] : []),
+  ...(issuerEnabled && auth.user.value
+    ? [
+        { label: t('recipient.title'), to: localePath('/recipient') },
+        { label: t('verifier.title'), to: localePath('/verifier') },
+        {
+          label: t('auth.issuerSpace'),
+          to: localePath(auth.hasRole('issuer') ? '/issuer' : '/issuer/application'),
+        },
+      ]
+    : []),
 ])
 
+const navigation = computed(() =>
+  simpleNavigation.value
+    ? [
+        { label: t('simpleNavigation.receive'), to: localePath('/recipient') },
+        {
+          label: t('simpleNavigation.issue'),
+          to: localePath(auth.hasRole('issuer') ? '/issuer' : '/issuer/application'),
+        },
+        { label: t('simpleNavigation.verify'), to: localePath('/presentations') },
+        {
+          label: t('simpleNavigation.more'),
+          children: [
+            ...(auth.user.value
+              ? [{ label: t('verifier.title'), to: localePath('/verifier') }]
+              : []),
+            ...(auth.hasRole('admin')
+              ? [{ label: t('admin.title'), to: localePath('/admin') }]
+              : []),
+            { label: t('nav.explorer'), to: localePath('/schemas') },
+            { label: t('nav.docs'), to: localePath('/developers') },
+            { label: t('nav.status'), to: localePath('/status') },
+          ],
+        },
+      ]
+    : protocolNavigation.value,
+)
+
 const footerLinks = computed(() => [
   { label: t('nav.schemas'), to: localePath('/schemas') },
-  { label: t('nav.create'), to: localePath('/studio') },
+  ...(simpleNavigation.value
+    ? [
+        { label: t('simpleNavigation.receive'), to: localePath('/recipient') },
+        { label: t('simpleNavigation.issue'), to: localePath('/issuer') },
+        { label: t('simpleNavigation.verify'), to: localePath('/presentations') },
+      ]
+    : []),
   { label: t('nav.docs'), to: localePath('/developers') },
   { label: t('nav.activity'), to: localePath('/activity') },
   { label: t('nav.status'), to: localePath('/status') },
@@ -65,7 +116,7 @@ onMounted(() => {
       <UNavigationMenu :items="navigation" data-testid="primary-nav" :aria-label="$t('nav.main')" />
 
       <template #right>
-        <ExplorerSearch compact class="hidden md:flex" />
+        <ExplorerSearch v-if="!simpleNavigation" compact class="hidden md:flex" />
         <div class="hidden md:block">
           <label class="sr-only" for="locale">{{ $t('nav.language') }}</label>
           <USelect
@@ -77,12 +128,22 @@ onMounted(() => {
             @update:model-value="setLocale($event as 'fr' | 'en')"
           />
         </div>
-        <WalletButton />
+        <WalletButton v-if="!walletFreePage" />
+        <UButton
+          v-if="auth.enabled.value"
+          :to="localePath(auth.user.value ? '/account' : '/auth/login')"
+          color="neutral"
+          variant="outline"
+          size="sm"
+          data-testid="auth-account-link"
+        >
+          {{ $t(auth.user.value ? 'auth.account' : 'auth.signIn') }}
+        </UButton>
       </template>
 
       <template #body>
         <UNavigationMenu :items="navigation" orientation="vertical" class="-mx-2.5" />
-        <ExplorerSearch compact class="mt-4" />
+        <ExplorerSearch v-if="!simpleNavigation" compact class="mt-4" />
         <div class="mt-4 md:hidden">
           <label class="sr-only" for="locale-mobile">{{ $t('nav.language') }}</label>
           <USelect
@@ -103,7 +164,9 @@ onMounted(() => {
 
     <UFooter>
       <template #left>
-        <p class="text-sm text-muted">{{ $t('footer.summary') }}</p>
+        <p class="text-sm text-muted">
+          {{ $t(simpleNavigation ? 'simpleNavigation.footer' : 'footer.summary') }}
+        </p>
       </template>
       <nav class="flex flex-wrap gap-x-5 gap-y-2 text-sm" :aria-label="$t('footer.navigation')">
         <NuxtLink
diff --git a/apps/web/app/layouts/issuer.vue b/apps/web/app/layouts/issuer.vue
new file mode 100644
index 0000000..39adcc9
--- /dev/null
+++ b/apps/web/app/layouts/issuer.vue
@@ -0,0 +1,32 @@
+<script setup lang="ts">
+const localePath = useLocalePath()
+const route = useRoute()
+const links = [
+  ['schemas', '/issuer/schemas'],
+  ['recipients', '/issuer/recipients'],
+  ['credentials', '/issuer/credentials'],
+  ['settings', '/issuer/settings'],
+]
+</script>
+
+<template>
+  <NuxtLayout name="default">
+    <UContainer class="py-8">
+      <nav :aria-label="$t('issuer.navigation')" class="mb-7 flex flex-wrap gap-3">
+        <UButton
+          v-for="[label, path] in links"
+          :key="path"
+          color="neutral"
+          variant="outline"
+          :to="{
+            path: localePath(path!),
+            query: route.query.organizationId ? { organizationId: route.query.organizationId } : {},
+          }"
+        >
+          {{ $t(`simpleIssuer.nav.${label}`) }}
+        </UButton>
+      </nav>
+      <slot />
+    </UContainer>
+  </NuxtLayout>
+</template>
diff --git a/apps/web/app/lib/xcs/core/claims.ts b/apps/web/app/lib/xcs/core/claims.ts
index 75c3bf8..939b03f 100644
--- a/apps/web/app/lib/xcs/core/claims.ts
+++ b/apps/web/app/lib/xcs/core/claims.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/claims.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/claims.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { base64urlnopad } from '@scure/base'
 import { isValidClassicAddress } from 'xrpl'
 
@@ -33,46 +33,46 @@ function isCanonicalBase64Url(value: string): boolean {
 }
 
 function parseValue(value: unknown, descriptor: FieldDescriptor, path: string): JsonValue {
-  if (value === null) return fail('INVALID_CLAIMS', 'null is not allowed', path)
+  if (value === null) return fail('CLAIMS_INVALID', 'null is not allowed', path)
 
   switch (descriptor.type) {
     case 'string':
-      if (typeof value !== 'string') return fail('INVALID_CLAIMS', 'Expected a string', path)
+      if (typeof value !== 'string') return fail('CLAIMS_INVALID', 'Expected a string', path)
       return value
     case 'bool':
-      if (typeof value !== 'boolean') return fail('INVALID_CLAIMS', 'Expected a boolean', path)
+      if (typeof value !== 'boolean') return fail('CLAIMS_INVALID', 'Expected a boolean', path)
       return value
     case 'uint': {
       if (typeof value !== 'string' || !UNSIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical unsigned decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical unsigned decimal string', path)
       }
       if (value.length > 78 || BigInt(value) > UINT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Unsigned integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Unsigned integer exceeds 256 bits', path)
       }
       return value
     }
     case 'int': {
       if (typeof value !== 'string' || !SIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical signed decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical signed decimal string', path)
       }
       const integer = BigInt(value)
       if (value.length > 79 || integer < INT256_MIN || integer > INT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Signed integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Signed integer exceeds 256 bits', path)
       }
       return value
     }
     case 'bytes':
       if (typeof value !== 'string' || !isCanonicalBase64Url(value)) {
-        return fail('INVALID_CLAIMS', 'Expected unpadded canonical base64url', path)
+        return fail('CLAIMS_INVALID', 'Expected unpadded canonical base64url', path)
       }
       return value
     case 'address':
       if (typeof value !== 'string' || !isValidClassicAddress(value)) {
-        return fail('INVALID_CLAIMS', 'Expected an XRPL classic address', path)
+        return fail('CLAIMS_INVALID', 'Expected an XRPL classic address', path)
       }
       return value
     case 'array':
-      if (!Array.isArray(value)) return fail('INVALID_CLAIMS', 'Expected an array', path)
+      if (!Array.isArray(value)) return fail('CLAIMS_INVALID', 'Expected an array', path)
       return value.map((item, index) => parseValue(item, descriptor.items, `${path}[${index}]`))
     case 'object':
       return parseObject(value, descriptor.fields, path)
@@ -80,10 +80,10 @@ function parseValue(value: unknown, descriptor: FieldDescriptor, path: string):
 }
 
 function parseObject(input: unknown, fields: SchemaFields, path: string): JsonObject {
-  if (!isRecord(input)) return fail('INVALID_CLAIMS', 'Expected an object', path)
+  if (!isRecord(input)) return fail('CLAIMS_INVALID', 'Expected an object', path)
   for (const name of Object.keys(input)) {
     if (!Object.hasOwn(fields, name)) {
-      return fail('INVALID_CLAIMS', `Unknown claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Unknown claim ${name}`, `${path}.${name}`)
     }
   }
 
@@ -91,7 +91,7 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
   for (const [name, descriptor] of Object.entries(fields)) {
     if (!Object.hasOwn(input, name)) {
       if (descriptor.optional === true) continue
-      return fail('INVALID_CLAIMS', `Missing required claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Missing required claim ${name}`, `${path}.${name}`)
     }
     claims[name] = parseValue(input[name], descriptor, `${path}.${name}`)
   }
@@ -101,3 +101,15 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
 export function parseClaims(input: unknown, fields: SchemaFields): JsonObject {
   return parseObject(input, fields, '$.claims')
 }
+
+export function validateClaims(
+  input: unknown,
+  schema: SchemaFields | { fields: SchemaFields; definition?: unknown; lineage?: unknown },
+): JsonObject {
+  const resolved = schema as { fields?: unknown; definition?: unknown; lineage?: unknown }
+  const fields =
+    resolved.definition !== undefined && resolved.lineage !== undefined
+      ? (resolved.fields as SchemaFields)
+      : (schema as SchemaFields)
+  return parseClaims(input, fields)
+}
diff --git a/apps/web/app/lib/xcs/core/credential.ts b/apps/web/app/lib/xcs/core/credential.ts
index 3c36374..043e758 100644
--- a/apps/web/app/lib/xcs/core/credential.ts
+++ b/apps/web/app/lib/xcs/core/credential.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/credential.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/credential.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress } from 'xrpl'
 
 import { parseClaims } from './claims.js'
@@ -11,7 +11,9 @@ export interface CredentialContext {
   issuer: string
   subject: string
   schemaUid: string
-  fields: SchemaFields
+  fields?: SchemaFields
+  /** Backward-compatible XCS v0.1 context name. */
+  schema?: SchemaFields
 }
 
 export interface CredentialPayload extends JsonObject {
@@ -42,47 +44,52 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 
 function assertContext(context: CredentialContext): void {
   if (!isValidClassicAddress(context.issuer)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid issuer address', '$context.issuer')
+    fail('PAYLOAD_INVALID', 'Invalid issuer address', '$context.issuer')
   }
   if (!isValidClassicAddress(context.subject)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid subject address', '$context.subject')
+    fail('PAYLOAD_INVALID', 'Invalid subject address', '$context.subject')
   }
   if (!SCHEMA_UID.test(context.schemaUid)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema UID', '$context.schemaUid')
+    fail('PAYLOAD_INVALID', 'Invalid schema UID', '$context.schemaUid')
   }
-  if (!isRecord(context.fields)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema fields', '$context.fields')
+  if (!isRecord(context.fields ?? context.schema)) {
+    fail('PAYLOAD_INVALID', 'Invalid schema fields', '$context.fields')
   }
 }
 
-function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+function contextFields(context: CredentialContext): SchemaFields {
   assertContext(context)
+  return (context.fields ?? context.schema) as SchemaFields
+}
+
+function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+  const fields = contextFields(context)
   if (!isRecord(input)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Credential payload must be an object', '$')
+    return fail('PAYLOAD_INVALID', 'Credential payload must be an object', '$')
   }
   for (const property of Object.keys(input)) {
     if (!PAYLOAD_PROPERTIES.has(property)) {
-      return fail('INVALID_CREDENTIAL_PAYLOAD', `Unknown property ${property}`, `$.${property}`)
+      return fail('PAYLOAD_INVALID', `Unknown property ${property}`, `$.${property}`)
     }
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('PAYLOAD_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (input.issuer !== context.issuer) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Issuer does not match the credential', '$.issuer')
+    return fail('PAYLOAD_INVALID', 'Issuer does not match the credential', '$.issuer')
   }
   if (input.subject !== context.subject) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Subject does not match the credential', '$.subject')
+    return fail('PAYLOAD_INVALID', 'Subject does not match the credential', '$.subject')
   }
   if (input.schema !== context.schemaUid) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Schema does not match CredentialType', '$.schema')
+    return fail('PAYLOAD_INVALID', 'Schema does not match CredentialType', '$.schema')
   }
   return {
     xcsVersion: '0.1',
     issuer: context.issuer,
     subject: context.subject,
     schema: context.schemaUid,
-    claims: parseClaims(input.claims, context.fields),
+    claims: parseClaims(input.claims, fields),
   }
 }
 
@@ -111,7 +118,21 @@ export function parseCredentialPayload(
   context: CredentialContext,
 ): CredentialPayload {
   const bytes = payloadBytes(content)
-  return parsePayload(parseCanonicalJson(bytes), context)
+  try {
+    return parsePayload(parseCanonicalJson(bytes), context)
+  } catch (error) {
+    if (
+      error instanceof XcsError &&
+      (error.code.startsWith('JSON_') ||
+        error.code === 'UTF8_INVALID' ||
+        error.code === 'CANONICALIZATION_UNSUPPORTED_VALUE')
+    ) {
+      return fail('PAYLOAD_INVALID', 'Credential payload must be canonical JSON', '$payload', {
+        cause: error.code,
+      })
+    }
+    throw error
+  }
 }
 
 export function verifyCredentialPayload(
diff --git a/apps/web/app/lib/xcs/core/errors.ts b/apps/web/app/lib/xcs/core/errors.ts
index e7948bf..d9d59ef 100644
--- a/apps/web/app/lib/xcs/core/errors.ts
+++ b/apps/web/app/lib/xcs/core/errors.ts
@@ -1,16 +1,35 @@
-// Copied from packages/core/src/errors.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
-export type XcsErrorCode =
-  | 'INVALID_NETWORK_PROFILE'
-  | 'INVALID_SCHEMA'
-  | 'INVALID_SCHEMA_REFERENCE'
-  | 'INVALID_CLAIMS'
-  | 'INVALID_UID_INPUT'
-  | 'INVALID_CREDENTIAL_PAYLOAD'
-  | 'INVALID_PAYLOAD_URI'
-  | 'INVALID_RIPPLE_TIME'
-  | 'INVALID_JSON'
-  | 'NON_CANONICAL_JSON'
-  | 'UNSUPPORTED_JSON_VALUE'
+// Copied from packages/core/src/errors.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
+export const XCS_ERROR_CODES = [
+  'JSON_INVALID',
+  'JSON_DUPLICATE_KEY',
+  'JSON_INVALID_UNICODE',
+  'JSON_NON_IJSON_NUMBER',
+  'CANONICALIZATION_UNSUPPORTED_VALUE',
+  'HEX_INVALID',
+  'UTF8_INVALID',
+  'NETWORK_PROFILE_INVALID',
+  'SCHEMA_INVALID',
+  'SCHEMA_PARENT_NOT_FOUND',
+  'SCHEMA_PARENT_NOT_PRIOR',
+  'SCHEMA_PARENT_NETWORK_MISMATCH',
+  'SCHEMA_OVERRIDE_FORBIDDEN',
+  'SCHEMA_INHERITANCE_CYCLE',
+  'SCHEMA_DEPTH_EXCEEDED',
+  'SCHEMA_FIELD_LIMIT_EXCEEDED',
+  'SCHEMA_SUPERSEDES_NOT_FOUND',
+  'SCHEMA_SUPERSEDES_NOT_PRIOR',
+  'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
+  'SCHEMA_CATALOG_INVALID',
+  'SCHEMA_CATALOG_LIMIT_EXCEEDED',
+  'VERIFICATION_REPORT_INVALID',
+  'UID_INPUT_INVALID',
+  'CLAIMS_INVALID',
+  'PAYLOAD_INVALID',
+  'PAYLOAD_URI_INVALID',
+  'RIPPLE_TIME_INVALID',
+] as const
+
+export type XcsErrorCode = (typeof XCS_ERROR_CODES)[number]
 
 export class XcsError extends Error {
   readonly code: XcsErrorCode
diff --git a/apps/web/app/lib/xcs/core/index.ts b/apps/web/app/lib/xcs/core/index.ts
index cd9dfc0..7be864c 100644
--- a/apps/web/app/lib/xcs/core/index.ts
+++ b/apps/web/app/lib/xcs/core/index.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/index.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/index.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 export {
   encodeCredentialPayload,
   parseCredentialPayload,
@@ -9,27 +9,41 @@ export {
   type EncodedCredentialPayload,
   type PayloadRetrieval,
 } from './credential.js'
-export { XcsError, type XcsErrorCode } from './errors.js'
+export { XCS_ERROR_CODES, XcsError, type XcsErrorCode } from './errors.js'
+export { parseClaims, validateClaims } from './claims.js'
 export {
+  canonicalize,
   canonicalJson,
+  decodeUtf8Hex,
   decodeHexUtf8,
   decodeUtf8,
   encodeCanonicalJson,
   encodeHexUtf8,
   encodeUtf8,
+  encodeUtf8Hex,
   parseCanonicalJson,
   parseJson,
+  parseJsonStrict,
   sha256Hex,
   utf8ByteLength,
   type JsonObject,
   type JsonPrimitive,
   type JsonValue,
 } from './json.js'
-export { parseNetworkProfile, rippleTimeToIso, type NetworkProfile } from './network.js'
 export {
+  parseNetworkProfile,
+  rippleTimeToIso,
+  validateNetworkProfile,
+  type NetworkProfile,
+} from './network.js'
+export {
+  computePayloadSha256Hex,
   createHttpsPayloadUri,
+  createIpfsRawPayloadUri,
   createIpfsPayloadUri,
+  inspectPayloadUri,
   parsePayloadUri,
+  payloadDigest,
   verifyPayloadIntegrity,
   type HttpsPayloadUri,
   type IpfsPayloadUri,
@@ -41,11 +55,19 @@ export {
   type CredentialLifecycleInput,
   type CredentialLifecycleState,
 } from './lifecycle.js'
+export {
+  iso8601ToRippleTime,
+  RIPPLE_EPOCH_UNIX_SECONDS,
+  rippleTimeToIso8601,
+  rippleTimeToUnixSeconds,
+  unixSecondsToRippleTime,
+} from './ripple-time.js'
 export { resolveSchema, type SchemaResolutionContext } from './schema-resolution.js'
 export {
   encodeSchema,
   parseSchema,
   parseSchemaBytes,
+  validateSchema,
   type ArrayFieldDescriptor,
   type FieldDescriptor,
   type ObjectFieldDescriptor,
diff --git a/apps/web/app/lib/xcs/core/json.ts b/apps/web/app/lib/xcs/core/json.ts
index c8133d3..53beded 100644
--- a/apps/web/app/lib/xcs/core/json.ts
+++ b/apps/web/app/lib/xcs/core/json.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/json.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/json.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
 import canonicalizeRfc8785 from 'canonicalize'
@@ -22,12 +22,12 @@ function assertWellFormed(value: string, path: string): void {
     const codeUnit = value.charCodeAt(index)
     if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
       const next = value.charCodeAt(index + 1)
-      if (next < 0xdc00 || next > 0xdfff) {
-        fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      if (!(next >= 0xdc00 && next <= 0xdfff)) {
+        fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
       }
       index += 1
     } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
     }
   }
 }
@@ -40,21 +40,25 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
   }
   if (typeof value === 'number') {
     if (!Number.isFinite(value)) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON numbers must be finite', path)
+      fail('JSON_NON_IJSON_NUMBER', 'JSON numbers must be finite', path)
     }
     return
   }
   if (typeof value !== 'object') {
-    fail('UNSUPPORTED_JSON_VALUE', `Unsupported ${typeof value} value`, path)
+    fail('CANONICALIZATION_UNSUPPORTED_VALUE', `Unsupported ${typeof value} value`, path)
   }
-  if (stack.has(value)) fail('UNSUPPORTED_JSON_VALUE', 'Cyclic JSON value', path)
+  if (stack.has(value)) fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Cyclic JSON value', path)
 
   stack.add(value)
   try {
     if (Array.isArray(value)) {
       for (let index = 0; index < value.length; index += 1) {
         if (!Object.hasOwn(value, index)) {
-          fail('UNSUPPORTED_JSON_VALUE', 'Sparse arrays are not JSON values', `${path}[${index}]`)
+          fail(
+            'CANONICALIZATION_UNSUPPORTED_VALUE',
+            'Sparse arrays are not JSON values',
+            `${path}[${index}]`,
+          )
         }
         assertJsonValueInternal(value[index], `${path}[${index}]`, stack)
       }
@@ -63,7 +67,7 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
 
     const prototype = Object.getPrototypeOf(value)
     if (prototype !== Object.prototype && prototype !== null) {
-      fail('UNSUPPORTED_JSON_VALUE', 'Only plain objects are JSON values', path)
+      fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Only plain objects are JSON values', path)
     }
     for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
       assertWellFormed(key, path)
@@ -82,7 +86,11 @@ export function canonicalJson(value: unknown): string {
   assertJsonValue(value)
   const serialized = canonicalizeRfc8785(value)
   if (serialized === undefined) {
-    return fail('UNSUPPORTED_JSON_VALUE', 'Value cannot be represented as canonical JSON', '$')
+    return fail(
+      'CANONICALIZATION_UNSUPPORTED_VALUE',
+      'Value cannot be represented as canonical JSON',
+      '$',
+    )
   }
   return serialized
 }
@@ -99,7 +107,7 @@ export function decodeUtf8(bytes: Uint8Array): string {
   try {
     return decoder.decode(bytes)
   } catch (cause) {
-    return fail('INVALID_JSON', 'Input is not valid UTF-8', '$', { cause: String(cause) })
+    return fail('UTF8_INVALID', 'Input is not valid UTF-8', '$', { cause: String(cause) })
   }
 }
 
@@ -124,7 +132,7 @@ export function parseJson(input: string | Uint8Array): JsonValue {
     allowEmptyContent: false,
   })
   if (!root || errors.length > 0) {
-    return fail('INVALID_JSON', 'Input is not valid JSON', '$')
+    return fail('JSON_INVALID', 'Input is not valid JSON', '$')
   }
   rejectDuplicateObjectKeys(root)
 
@@ -137,7 +145,7 @@ export function parseCanonicalJson(input: string | Uint8Array): JsonValue {
   const text = typeof input === 'string' ? input : decodeUtf8(input)
   const parsed = parseJson(text)
   if (canonicalJson(parsed) !== text) {
-    return fail('NON_CANONICAL_JSON', 'Input must use RFC 8785 canonical JSON', '$')
+    return fail('JSON_INVALID', 'Input must use RFC 8785 canonical JSON', '$')
   }
   assertJsonValue(parsed)
   return parsed
@@ -150,10 +158,10 @@ function rejectDuplicateObjectKeys(node: Node): void {
       const [keyNode, valueNode] = property.children ?? []
       const key = keyNode?.value
       if (typeof key !== 'string' || !valueNode) {
-        return fail('INVALID_JSON', 'Input contains an invalid JSON object', '$')
+        return fail('JSON_INVALID', 'Input contains an invalid JSON object', '$')
       }
       if (keys.has(key)) {
-        return fail('INVALID_JSON', `Input contains duplicate key ${key}`, '$')
+        return fail('JSON_DUPLICATE_KEY', `Input contains duplicate key ${key}`, '$')
       }
       keys.add(key)
       rejectDuplicateObjectKeys(valueNode)
@@ -167,3 +175,9 @@ export function utf8ByteLength(value: string): number {
   assertWellFormed(value, '$')
   return encoder.encode(value).length
 }
+
+/** Backward-compatible names from the normative XCS v0.1 interface. */
+export const canonicalize = canonicalJson
+export const parseJsonStrict = parseJson
+export const encodeUtf8Hex = (value: string): string => encodeHexUtf8(value).toUpperCase()
+export const decodeUtf8Hex = decodeHexUtf8
diff --git a/apps/web/app/lib/xcs/core/lifecycle.ts b/apps/web/app/lib/xcs/core/lifecycle.ts
index d0cde5e..4b52cb6 100644
--- a/apps/web/app/lib/xcs/core/lifecycle.ts
+++ b/apps/web/app/lib/xcs/core/lifecycle.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/lifecycle.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/lifecycle.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { fail } from './errors.js'
 
 export type CredentialLifecycleState = 'pending' | 'active' | 'expired' | 'deleted'
@@ -14,7 +14,7 @@ const UINT32_MAX = 0xffff_ffff
 
 function requireRippleTime(value: number): void {
   if (!Number.isInteger(value) || value < 0 || value > UINT32_MAX) {
-    return fail('INVALID_RIPPLE_TIME', 'Credential lifecycle time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Credential lifecycle time must be a uint32', '$time')
   }
 }
 
diff --git a/apps/web/app/lib/xcs/core/network.ts b/apps/web/app/lib/xcs/core/network.ts
index 876c16e..07c72f1 100644
--- a/apps/web/app/lib/xcs/core/network.ts
+++ b/apps/web/app/lib/xcs/core/network.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/network.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/network.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress, rippleTimeToISOTime as xrplRippleTimeToIso } from 'xrpl'
 
 import { fail } from './errors.js'
@@ -35,48 +35,48 @@ function isUint32(value: unknown): value is number {
 
 export function parseNetworkProfile(input: unknown): NetworkProfile {
   if (!isRecord(input)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Network profile must be an object', '$')
+    return fail('NETWORK_PROFILE_INVALID', 'Network profile must be an object', '$')
   }
   for (const key of Object.keys(input)) {
     if (!PROFILE_PROPERTIES.has(key)) {
-      return fail('INVALID_NETWORK_PROFILE', `Unknown property ${key}`, `$.${key}`)
+      return fail('NETWORK_PROFILE_INVALID', `Unknown property ${key}`, `$.${key}`)
     }
   }
   if (
     typeof input.profileId !== 'string' ||
     !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(input.profileId)
   ) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid profileId', '$.profileId')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid profileId', '$.profileId')
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_NETWORK_PROFILE', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('NETWORK_PROFILE_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (!isUint32(input.networkId)) {
-    return fail('INVALID_NETWORK_PROFILE', 'networkId must be a uint32', '$.networkId')
+    return fail('NETWORK_PROFILE_INVALID', 'networkId must be a uint32', '$.networkId')
   }
   if (
     typeof input.requiredAmendment !== 'string' ||
     !/^[0-9a-fA-F]{64}$/.test(input.requiredAmendment)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'requiredAmendment must be a 32-byte hexadecimal value',
       '$.requiredAmendment',
     )
   }
   if (typeof input.registryAddress !== 'string' || !isValidClassicAddress(input.registryAddress)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid XRPL registry address', '$.registryAddress')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid XRPL registry address', '$.registryAddress')
   }
   if (input.registrationAmountDrops !== '1') {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'registrationAmountDrops must equal "1"',
       '$.registrationAmountDrops',
     )
   }
   if (!isUint32(input.activationLedgerIndex) || input.activationLedgerIndex === 0) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerIndex must be a positive uint32',
       '$.activationLedgerIndex',
     )
@@ -86,7 +86,7 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
     !/^[0-9a-fA-F]{64}$/.test(input.activationLedgerHash)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerHash must be a 32-byte hexadecimal value',
       '$.activationLedgerHash',
     )
@@ -104,9 +104,12 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateNetworkProfile = parseNetworkProfile
+
 export function rippleTimeToIso(rippleTime: number): string {
   if (!isUint32(rippleTime)) {
-    return fail('INVALID_RIPPLE_TIME', 'Ripple time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
   }
   return xrplRippleTimeToIso(rippleTime)
 }
diff --git a/apps/web/app/lib/xcs/core/payload-uri.ts b/apps/web/app/lib/xcs/core/payload-uri.ts
index a9e4a5c..7ce8f98 100644
--- a/apps/web/app/lib/xcs/core/payload-uri.ts
+++ b/apps/web/app/lib/xcs/core/payload-uri.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/payload-uri.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/payload-uri.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex } from '@noble/hashes/utils.js'
 import { CID } from 'multiformats/cid'
@@ -30,7 +30,8 @@ export type PayloadUri = IpfsPayloadUri | HttpsPayloadUri
 
 export interface PayloadIntegrityResult {
   valid: boolean
-  expectedDigestHex: string
+  status: 'valid' | 'tampered' | 'invalid_uri'
+  expectedDigestHex?: string
   actualDigestHex: string
 }
 
@@ -48,10 +49,10 @@ export function payloadBytes(content: string | Uint8Array): Uint8Array {
   if (typeof content === 'string') utf8ByteLength(content)
   const bytes = typeof content === 'string' ? new TextEncoder().encode(content) : content
   if (!(bytes instanceof Uint8Array)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload must be UTF-8 text or bytes', '$payload')
+    return fail('PAYLOAD_INVALID', 'Payload must be UTF-8 text or bytes', '$payload')
   }
   if (bytes.length > MAX_PAYLOAD_BYTES) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload exceeds 1 MiB', '$payload', {
+    return fail('PAYLOAD_INVALID', 'Payload exceeds 1 MiB', '$payload', {
       size: bytes.length,
     })
   }
@@ -185,7 +186,7 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
       cid.multihash.size !== 32 ||
       cid.toString(base32.encoder) !== cidText
     ) {
-      return fail('INVALID_PAYLOAD_URI', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
+      return fail('PAYLOAD_URI_INVALID', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
     }
     return {
       kind: 'ipfs',
@@ -195,30 +196,30 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
     }
   } catch (cause) {
     if (cause instanceof XcsError) throw cause
-    return fail('INVALID_PAYLOAD_URI', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
   }
 }
 
 export function parsePayloadUri(uri: string): PayloadUri {
   if (typeof uri !== 'string') {
-    return fail('INVALID_PAYLOAD_URI', 'URI must be a string', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must be a string', '$uri')
   }
   const length = utf8ByteLength(uri)
   if (length < 1 || length > 256) {
-    return fail('INVALID_PAYLOAD_URI', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
   }
   const ipfs = parseIpfsUri(uri)
   if (ipfs !== undefined) return ipfs
 
   if (!uri.startsWith(HTTPS_PREFIX) || INVALID_RAW_HTTPS_CHARACTER.test(uri)) {
-    return fail('INVALID_PAYLOAD_URI', 'Expected a canonical HTTPS or IPFS URI', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Expected a canonical HTTPS or IPFS URI', '$uri')
   }
   const remainder = uri.slice(HTTPS_PREFIX.length)
   const authorityEnd = remainder.search(/[/?#]/)
   const authority = authorityEnd === -1 ? remainder : remainder.slice(0, authorityEnd)
   if (authority === '' || authority.includes('@')) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS authority cannot be empty or contain userinfo',
       '$uri',
     )
@@ -226,14 +227,14 @@ export function parsePayloadUri(uri: string): PayloadUri {
 
   const normalizedUri = normalizeHttpsAuthority(uri)
   if (normalizedUri === undefined) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS authority', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS authority', '$uri')
   }
   const fetchUrl = buildFetchUrl(normalizedUri)
   let parsed: URL
   try {
     parsed = new URL(normalizedUri)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
   }
   if (
     fetchUrl === undefined ||
@@ -243,7 +244,7 @@ export function parsePayloadUri(uri: string): PayloadUri {
     !/^#xcs-sha256=[0-9a-f]{64}$/.test(parsed.hash)
   ) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS URI must end in #xcs-sha256=<lowercase-sha256>',
       '$uri',
     )
@@ -261,12 +262,12 @@ export function createHttpsPayloadUri(baseUrl: string, content: string | Uint8Ar
   try {
     url = new URL(baseUrl)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS base URL', '$url', {
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS base URL', '$url', {
       cause: String(cause),
     })
   }
   if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.hash !== '') {
-    return fail('INVALID_PAYLOAD_URI', 'Base URL must be fragment-free HTTPS', '$url')
+    return fail('PAYLOAD_URI_INVALID', 'Base URL must be fragment-free HTTPS', '$url')
   }
   url.hash = `xcs-sha256=${payloadDigest(content)}`
   const uri = url.toString()
@@ -283,11 +284,25 @@ export function verifyPayloadIntegrity(
   content: string | Uint8Array,
   uri: string,
 ): PayloadIntegrityResult {
-  const expectedDigestHex = parsePayloadUri(uri).digestHex
   const actualDigestHex = payloadDigest(content)
+  let expectedDigestHex: string
+  try {
+    expectedDigestHex = parsePayloadUri(uri).digestHex
+  } catch (error) {
+    if (error instanceof XcsError && error.code === 'PAYLOAD_URI_INVALID') {
+      return { valid: false, status: 'invalid_uri', actualDigestHex }
+    }
+    throw error
+  }
+  const valid = expectedDigestHex === actualDigestHex
   return {
-    valid: expectedDigestHex === actualDigestHex,
+    valid,
+    status: valid ? 'valid' : 'tampered',
     expectedDigestHex,
     actualDigestHex,
   }
 }
+
+export const computePayloadSha256Hex = payloadDigest
+export const createIpfsRawPayloadUri = createIpfsPayloadUri
+export const inspectPayloadUri = parsePayloadUri
diff --git a/apps/web/app/lib/xcs/core/ripple-time.ts b/apps/web/app/lib/xcs/core/ripple-time.ts
new file mode 100644
index 0000000..9ab4448
--- /dev/null
+++ b/apps/web/app/lib/xcs/core/ripple-time.ts
@@ -0,0 +1,50 @@
+// Copied from packages/core/src/ripple-time.ts at 254c6a0; keep in sync by hand (see CONTRIBUTING.md).
+import { fail } from './errors.js'
+
+export const RIPPLE_EPOCH_UNIX_SECONDS = 946_684_800
+const UINT32_MAX = 0xffff_ffff
+
+export function unixSecondsToRippleTime(unixSeconds: number): number {
+  if (!Number.isSafeInteger(unixSeconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time must be an integer number of seconds', '$time')
+  }
+  const rippleTime = unixSeconds - RIPPLE_EPOCH_UNIX_SECONDS
+  if (rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time is outside the XRPL uint32 time range', '$time')
+  }
+  return rippleTime
+}
+
+export function rippleTimeToUnixSeconds(rippleTime: number): number {
+  if (!Number.isInteger(rippleTime) || rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
+  }
+  return rippleTime + RIPPLE_EPOCH_UNIX_SECONDS
+}
+
+export function iso8601ToRippleTime(value: string): number {
+  if (
+    typeof value !== 'string' ||
+    !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.000)?Z$/.test(value)
+  ) {
+    return fail(
+      'RIPPLE_TIME_INVALID',
+      'Expiration must be a UTC ISO-8601 timestamp with whole-second precision',
+      '$time',
+    )
+  }
+  const milliseconds = Date.parse(value)
+  if (!Number.isFinite(milliseconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a real calendar date', '$time')
+  }
+  const normalized = new Date(milliseconds).toISOString()
+  const expected = value.includes('.') ? value : value.replace('Z', '.000Z')
+  if (normalized !== expected) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a canonical calendar date', '$time')
+  }
+  return unixSecondsToRippleTime(milliseconds / 1000)
+}
+
+export function rippleTimeToIso8601(rippleTime: number): string {
+  return new Date(rippleTimeToUnixSeconds(rippleTime) * 1000).toISOString()
+}
diff --git a/apps/web/app/lib/xcs/core/schema-resolution.ts b/apps/web/app/lib/xcs/core/schema-resolution.ts
index c1b2c26..d0e612d 100644
--- a/apps/web/app/lib/xcs/core/schema-resolution.ts
+++ b/apps/web/app/lib/xcs/core/schema-resolution.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema-resolution.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema-resolution.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { isValidClassicAddress } from 'xrpl'
 
 import { fail } from './errors.js'
@@ -43,20 +43,23 @@ function requireReference(
 ): RegisteredSchema {
   const referenced = context.getSchema(uid)
   if (referenced === undefined || referenced.uid !== uid) {
-    return fail('INVALID_SCHEMA_REFERENCE', `${relation} schema was not found`, `$.${relation}`, {
-      uid,
-    })
+    return fail(
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_FOUND' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
+      `${relation} schema was not found`,
+      `$.${relation}`,
+      { uid },
+    )
   }
   if (referenced.networkId !== context.networkId) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NETWORK_MISMATCH' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
       `${relation} schema belongs to another network`,
       `$.${relation}`,
     )
   }
   if (!isEarlier(referenced, context)) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_PRIOR' : 'SCHEMA_SUPERSEDES_NOT_PRIOR',
       `${relation} schema must be registered earlier`,
       `$.${relation}`,
     )
@@ -73,12 +76,11 @@ function resolve(
   let lineage: string[] = []
 
   if (schema.extends !== undefined) {
-    if (visiting.size >= MAX_SCHEMA_DEPTH - 1 || visiting.has(schema.extends)) {
-      return fail(
-        'INVALID_SCHEMA_REFERENCE',
-        'Schema inheritance is cyclic or too deep',
-        '$.extends',
-      )
+    if (visiting.has(schema.extends)) {
+      return fail('SCHEMA_INHERITANCE_CYCLE', 'Schema inheritance is cyclic', '$.extends')
+    }
+    if (visiting.size >= MAX_SCHEMA_DEPTH - 1) {
+      return fail('SCHEMA_DEPTH_EXCEEDED', 'Schema inheritance is too deep', '$.extends')
     }
     const parent = requireReference(schema.extends, 'extends', context)
     visiting.add(schema.extends)
@@ -101,7 +103,7 @@ function resolve(
   for (const [name, descriptor] of Object.entries(schema.fields)) {
     if (Object.hasOwn(fields, name)) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_OVERRIDE_FORBIDDEN',
         `Inherited field ${name} cannot be redefined`,
         `$.fields.${name}`,
       )
@@ -110,14 +112,18 @@ function resolve(
   }
 
   if (countSchemaFields(fields) > MAX_SCHEMA_FIELDS) {
-    return fail('INVALID_SCHEMA', `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`, '$.fields')
+    return fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`,
+      '$.fields',
+    )
   }
 
   if (schema.supersedes !== undefined) {
     const previous = requireReference(schema.supersedes, 'supersedes', context)
     if (previous.publisher !== context.publisher) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
         'Only the original publisher may supersede a schema',
         '$.supersedes',
       )
@@ -138,7 +144,7 @@ export function resolveSchema(
     !isValidClassicAddress(context.publisher) ||
     typeof context.getSchema !== 'function'
   ) {
-    return fail('INVALID_SCHEMA_REFERENCE', 'Invalid schema resolution context', '$context')
+    return fail('SCHEMA_INVALID', 'Invalid schema resolution context', '$context')
   }
   return resolve(parseSchema(input), context, new Set())
 }
diff --git a/apps/web/app/lib/xcs/core/schema-uid.ts b/apps/web/app/lib/xcs/core/schema-uid.ts
index 2904155..886bbf3 100644
--- a/apps/web/app/lib/xcs/core/schema-uid.ts
+++ b/apps/web/app/lib/xcs/core/schema-uid.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema-uid.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema-uid.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex } from '@noble/hashes/utils.js'
 import { isValidClassicAddress } from 'xrpl'
@@ -26,17 +26,17 @@ export function computeSchemaUid(input: SchemaUidInput): string {
     !isUint32(input.ledgerIndex) ||
     !isUint32(input.transactionIndex)
   ) {
-    return fail('INVALID_UID_INPUT', 'Network and ledger coordinates must be uint32 values', '$')
+    return fail('UID_INPUT_INVALID', 'Network and ledger coordinates must be uint32 values', '$')
   }
   if (!/^[0-9a-fA-F]{64}$/.test(input.ledgerHash)) {
     return fail(
-      'INVALID_UID_INPUT',
+      'UID_INPUT_INVALID',
       'ledgerHash must be a 32-byte hexadecimal hash',
       '$.ledgerHash',
     )
   }
   if (!isValidClassicAddress(input.publisher)) {
-    return fail('INVALID_UID_INPUT', 'publisher must be an XRPL classic address', '$.publisher')
+    return fail('UID_INPUT_INVALID', 'publisher must be an XRPL classic address', '$.publisher')
   }
 
   const preimage = {
diff --git a/apps/web/app/lib/xcs/core/schema.ts b/apps/web/app/lib/xcs/core/schema.ts
index de394e4..87b38a2 100644
--- a/apps/web/app/lib/xcs/core/schema.ts
+++ b/apps/web/app/lib/xcs/core/schema.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/schema.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/schema.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { fail } from './errors.js'
 import { encodeCanonicalJson, parseCanonicalJson, utf8ByteLength } from './json.js'
 
@@ -76,17 +76,17 @@ function assertOnlyProperties(
   path: string,
 ): void {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) fail('INVALID_SCHEMA', `Unknown property ${key}`, `${path}.${key}`)
+    if (!allowed.has(key)) fail('SCHEMA_INVALID', `Unknown property ${key}`, `${path}.${key}`)
   }
 }
 
 function parseText(value: unknown, path: string, maxBytes: number): string {
   if (typeof value !== 'string' || CONTROL_CHARACTER.test(value)) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   const length = utf8ByteLength(value)
   if (length < 1 || length > maxBytes) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   return value
 }
@@ -98,10 +98,10 @@ function parseDescriptor(
   count: { value: number },
 ): FieldDescriptor {
   if (!isRecord(input) || typeof input.type !== 'string') {
-    return fail('INVALID_SCHEMA', 'Field descriptor must contain a type', path)
+    return fail('SCHEMA_INVALID', 'Field descriptor must contain a type', path)
   }
   if (input.optional !== undefined && typeof input.optional !== 'boolean') {
-    return fail('INVALID_SCHEMA', 'optional must be a boolean', `${path}.optional`)
+    return fail('SCHEMA_INVALID', 'optional must be a boolean', `${path}.optional`)
   }
   const optional = input.optional === true ? { optional: true as const } : {}
 
@@ -112,7 +112,7 @@ function parseDescriptor(
   if (input.type === 'array') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'items']), path)
     if (depth >= MAX_SCHEMA_DEPTH || input.items === undefined) {
-      return fail('INVALID_SCHEMA', 'Array descriptor is missing items or exceeds depth', path)
+      return fail('SCHEMA_INVALID', 'Array descriptor is missing items or exceeds depth', path)
     }
     count.value += 1
     assertFieldLimit(count.value, `${path}.items`)
@@ -125,7 +125,7 @@ function parseDescriptor(
   if (input.type === 'object') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'fields']), path)
     if (depth >= MAX_SCHEMA_DEPTH) {
-      return fail('INVALID_SCHEMA', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
+      return fail('SCHEMA_INVALID', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
     }
     return {
       type: 'object',
@@ -133,12 +133,16 @@ function parseDescriptor(
       ...optional,
     }
   }
-  return fail('INVALID_SCHEMA', `Unsupported field type ${input.type}`, `${path}.type`)
+  return fail('SCHEMA_INVALID', `Unsupported field type ${input.type}`, `${path}.type`)
 }
 
 function assertFieldLimit(count: number, path: string): void {
   if (count > MAX_SCHEMA_FIELDS) {
-    fail('INVALID_SCHEMA', `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`, path)
+    fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`,
+      path,
+    )
   }
 }
 
@@ -149,11 +153,11 @@ function parseFields(
   count: { value: number },
 ): SchemaFields {
   if (!isRecord(input) || Object.keys(input).length === 0) {
-    return fail('INVALID_SCHEMA', 'fields must be a non-empty object', path)
+    return fail('SCHEMA_INVALID', 'fields must be a non-empty object', path)
   }
   const fields = Object.create(null) as SchemaFields
   for (const [name, descriptor] of Object.entries(input)) {
-    if (!FIELD_NAME.test(name)) fail('INVALID_SCHEMA', 'Invalid field name', `${path}.${name}`)
+    if (!FIELD_NAME.test(name)) fail('SCHEMA_INVALID', 'Invalid field name', `${path}.${name}`)
     count.value += 1
     assertFieldLimit(count.value, `${path}.${name}`)
     fields[name] = parseDescriptor(descriptor, `${path}.${name}`, depth, count)
@@ -164,22 +168,22 @@ function parseFields(
 function parseRelation(value: unknown, path: string): string | undefined {
   if (value === undefined) return undefined
   if (typeof value !== 'string' || !SCHEMA_UID.test(value)) {
-    return fail('INVALID_SCHEMA', 'Expected a lowercase 32-byte schema UID', path)
+    return fail('SCHEMA_INVALID', 'Expected a lowercase 32-byte schema UID', path)
   }
   return value
 }
 
 export function parseSchema(input: unknown): SchemaDefinition {
-  if (!isRecord(input)) return fail('INVALID_SCHEMA', 'Schema must be an object', '$')
+  if (!isRecord(input)) return fail('SCHEMA_INVALID', 'Schema must be an object', '$')
   assertOnlyProperties(input, SCHEMA_PROPERTIES, '$')
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_SCHEMA', 'Unsupported XCS schema version', '$.xcsVersion')
+    return fail('SCHEMA_INVALID', 'Unsupported XCS schema version', '$.xcsVersion')
   }
 
   const parent = parseRelation(input.extends, '$.extends')
   const predecessor = parseRelation(input.supersedes, '$.supersedes')
   if (parent !== undefined && parent === predecessor) {
-    return fail('INVALID_SCHEMA', 'extends and supersedes must reference different schemas', '$')
+    return fail('SCHEMA_INVALID', 'extends and supersedes must reference different schemas', '$')
   }
 
   return {
@@ -192,6 +196,9 @@ export function parseSchema(input: unknown): SchemaDefinition {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateSchema = parseSchema
+
 export function parseSchemaBytes(bytes: Uint8Array): SchemaDefinition {
   return parseSchema(parseCanonicalJson(bytes))
 }
diff --git a/apps/web/app/lib/xcs/core/tr46.d.ts b/apps/web/app/lib/xcs/core/tr46.d.ts
index 7ce46a7..1ac8b70 100644
--- a/apps/web/app/lib/xcs/core/tr46.d.ts
+++ b/apps/web/app/lib/xcs/core/tr46.d.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/src/tr46.d.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/src/tr46.d.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 declare module 'tr46' {
   interface ToASCIIOptions {
     checkBidi?: boolean
diff --git a/apps/web/app/lib/xcs/sdk/builders.ts b/apps/web/app/lib/xcs/sdk/builders.ts
index 7ae5a6c..1426983 100644
--- a/apps/web/app/lib/xcs/sdk/builders.ts
+++ b/apps/web/app/lib/xcs/sdk/builders.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/builders.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/builders.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import {
   computeSchemaUid,
   encodeSchema,
diff --git a/apps/web/app/lib/xcs/sdk/encoding.ts b/apps/web/app/lib/xcs/sdk/encoding.ts
index 4d97658..d8d3892 100644
--- a/apps/web/app/lib/xcs/sdk/encoding.ts
+++ b/apps/web/app/lib/xcs/sdk/encoding.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/encoding.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/encoding.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
 import { parsePayloadUri } from '../core/index.js'
 import { encode, type Memo, type Payment } from 'xrpl'
diff --git a/apps/web/app/lib/xcs/sdk/errors.ts b/apps/web/app/lib/xcs/sdk/errors.ts
index 868528c..9276922 100644
--- a/apps/web/app/lib/xcs/sdk/errors.ts
+++ b/apps/web/app/lib/xcs/sdk/errors.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/errors.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/errors.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 export type SdkErrorCode =
   | 'XCS_SDK_INVALID_ADDRESS'
   | 'XCS_SDK_INVALID_SCHEMA_UID'
diff --git a/apps/web/app/lib/xcs/sdk/index.ts b/apps/web/app/lib/xcs/sdk/index.ts
index d103b08..ca4f4d7 100644
--- a/apps/web/app/lib/xcs/sdk/index.ts
+++ b/apps/web/app/lib/xcs/sdk/index.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/index.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/index.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 export * from './builders.js'
 export * from './encoding.js'
 export * from './errors.js'
diff --git a/apps/web/app/lib/xcs/sdk/network.ts b/apps/web/app/lib/xcs/sdk/network.ts
index 5806699..b239c63 100644
--- a/apps/web/app/lib/xcs/sdk/network.ts
+++ b/apps/web/app/lib/xcs/sdk/network.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/network.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/network.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import {
   parseNetworkProfile as parseCoreNetworkProfile,
   type NetworkProfile,
diff --git a/apps/web/app/lib/xcs/sdk/submission.ts b/apps/web/app/lib/xcs/sdk/submission.ts
index 1aa23ea..58590ff 100644
--- a/apps/web/app/lib/xcs/sdk/submission.ts
+++ b/apps/web/app/lib/xcs/sdk/submission.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/submission.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/submission.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import {
   decode,
   encode,
@@ -65,6 +65,14 @@ export interface ValidatedSignature {
   readonly lastLedgerSequence: number
 }
 
+export interface ValidatedSignedTransaction {
+  /** The exact unsigned fields recovered from the signed blob. */
+  readonly transaction: Readonly<SubmittableTransaction>
+  readonly txBlob: string
+  readonly txHash: string
+  readonly lastLedgerSequence: number
+}
+
 export interface ReliableSubmissionOptions {
   readonly journal: OperationJournal
   readonly operationId?: string | undefined
@@ -107,6 +115,43 @@ const HASH_PATTERN = /^[0-9a-fA-F]{64}$/u
 const BLOB_PATTERN = /^(?:[0-9a-fA-F]{2})+$/u
 const XRPL_JS_5_MAX_URI_HEX_CHARACTERS = 256
 
+/**
+ * Decode and cryptographically verify a single-signed XRPL transaction blob.
+ * This is the server-safe counterpart to the browser submission validation.
+ */
+export function decodeSignedTransactionBlob(txBlob: string): ValidatedSignedTransaction {
+  if (!BLOB_PATTERN.test(txBlob)) {
+    throw new XcsSdkError(
+      'XCS_SDK_INVALID_SIGNED_BLOB',
+      'Signed transaction input must be non-empty hexadecimal data.',
+    )
+  }
+
+  let decoded: Record<string, unknown>
+  let txHash: string
+  try {
+    decoded = decode(txBlob)
+    txHash = hashes.hashSignedTx(txBlob).toUpperCase()
+  } catch {
+    throw new XcsSdkError('XCS_SDK_INVALID_SIGNED_BLOB', 'Cannot decode signed transaction.')
+  }
+  assertValidSingleSignature(decoded, txBlob)
+  const lastLedgerSequence = asPositiveInteger(decoded.LastLedgerSequence)
+  if (lastLedgerSequence === undefined) {
+    throw new XcsSdkError(
+      'XCS_SDK_INVALID_SIGNED_BLOB',
+      'Signed transaction must contain a positive LastLedgerSequence.',
+    )
+  }
+
+  return {
+    transaction: withoutSignatureFields(decoded) as unknown as SubmittableTransaction,
+    txBlob,
+    txHash,
+    lastLedgerSequence,
+  }
+}
+
 export async function autofillXcsTransaction<T extends SubmittableTransaction>(
   client: Client,
   transaction: T,
@@ -213,6 +258,9 @@ export async function signPreparedAndSubmit<T extends SubmittableTransaction>(
       allowLastLedgerSequenceRefresh: options.allowSignerLastLedgerSequenceRefresh,
     })
     signedLastLedgerSequence = signedTransaction.LastLedgerSequence as number
+    // A wallet approval can outlive the reviewed ledger window. Reject before
+    // exposing recovery material to host hooks, so a fresh operation can retry.
+    await assertTransactionNotExpired(client, signedLastLedgerSequence)
     await options.onValidatedSignature?.({
       operationId,
       transaction: signedTransaction,
@@ -233,6 +281,13 @@ export async function signPreparedAndSubmit<T extends SubmittableTransaction>(
   return submitSignedTransaction(client, signed.txBlob, {
     ...options,
     operationId,
+    beforeSubmit: async (signature) => {
+      await options.beforeSubmit?.(signature)
+      // Recheck after asynchronous persistence/business guards, at the last
+      // boundary before this first relay. Recovery of old blobs stays separate:
+      // passing LastLedgerSequence does not prove absence from ledger history.
+      await assertTransactionNotExpired(client, signature.lastLedgerSequence)
+    },
   })
 }
 
@@ -247,31 +302,10 @@ export async function submitSignedTransaction(
       'Connect and validate the XRPL client before submitting a transaction.',
     )
   }
-  if (!BLOB_PATTERN.test(txBlob)) {
-    throw new XcsSdkError(
-      'XCS_SDK_INVALID_SIGNED_BLOB',
-      'Signed transaction input must be non-empty hexadecimal data.',
-    )
-  }
-
   const operationId = options.operationId ?? crypto.randomUUID()
-  let decoded: Record<string, unknown>
-  let txHash: string
-  try {
-    decoded = decode(txBlob)
-    txHash = hashes.hashSignedTx(txBlob).toUpperCase()
-  } catch {
-    throw new XcsSdkError('XCS_SDK_INVALID_SIGNED_BLOB', 'Cannot decode signed transaction.')
-  }
-  assertValidSingleSignature(decoded, txBlob)
-
-  const lastLedgerSequence = asPositiveInteger(decoded.LastLedgerSequence)
-  if (lastLedgerSequence === undefined) {
-    throw new XcsSdkError(
-      'XCS_SDK_INVALID_SIGNED_BLOB',
-      'Reliable submission requires a signed transaction with LastLedgerSequence.',
-    )
-  }
+  const validated = decodeSignedTransactionBlob(txBlob)
+  const decoded = validated.transaction as unknown as Record<string, unknown>
+  const { txHash, lastLedgerSequence } = validated
 
   // Persist the recovery identifiers before the first network side effect.
   await append(options.journal, {
@@ -393,17 +427,10 @@ export async function getTransactionStatus(
     }
   }
 
-  if (lastLedgerSequence !== undefined) {
-    const currentLedger = await getCurrentLedgerIndex(client)
-    if (currentLedger > lastLedgerSequence) {
-      return {
-        status: 'expired',
-        txHash: txHash.toUpperCase(),
-        lastLedgerSequence,
-      }
-    }
-  }
-
+  // A missing hash is not proof of expiry: the open ledger can be ahead of
+  // validation, and the server may lack historical ledgers. This API has no
+  // persisted submission-window start with which to prove complete absence.
+  // Keep the operation reconcilable instead of recording a terminal failure.
   return { status: 'not_found', txHash: txHash.toUpperCase(), lastLedgerSequence }
 }
 
diff --git a/apps/web/app/lib/xcs/sdk/transaction-validation.ts b/apps/web/app/lib/xcs/sdk/transaction-validation.ts
index 942d304..e19b713 100644
--- a/apps/web/app/lib/xcs/sdk/transaction-validation.ts
+++ b/apps/web/app/lib/xcs/sdk/transaction-validation.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/src/transaction-validation.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/src/transaction-validation.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { hexToBytes } from '@noble/hashes/utils.js'
 import { parseSchemaBytes } from '../core/index.js'
 import {
diff --git a/apps/web/app/middleware/auth.ts b/apps/web/app/middleware/auth.ts
new file mode 100644
index 0000000..1af899f
--- /dev/null
+++ b/apps/web/app/middleware/auth.ts
@@ -0,0 +1,12 @@
+import { authReturnPath } from '~/utils/portalRoutes'
+
+export default defineNuxtRouteMiddleware(async (to) => {
+  const auth = useAuth()
+  await auth.load(true)
+  if (!auth.user.value) {
+    return navigateTo({
+      path: useLocalePath()('/auth/login'),
+      query: { returnTo: authReturnPath(to.fullPath) },
+    })
+  }
+})
diff --git a/apps/web/app/middleware/role.ts b/apps/web/app/middleware/role.ts
new file mode 100644
index 0000000..7a29c9e
--- /dev/null
+++ b/apps/web/app/middleware/role.ts
@@ -0,0 +1,23 @@
+import type { AppRole } from '~/types/portal'
+
+export default defineNuxtRouteMiddleware(async (to) => {
+  const role = to.meta.requiredRole
+  if (!role) return
+  const localePath = useLocalePath()
+  if (!['admin', 'recipient', 'issuer', 'verifier'].includes(String(role))) {
+    return navigateTo(localePath('/auth/not-authorized'))
+  }
+  const auth = useAuth()
+  await auth.load()
+  if (!auth.user.value) return navigateTo(localePath('/auth/login'))
+  try {
+    await auth.checkRole(role as AppRole)
+  } catch (error) {
+    const status = (error as { statusCode?: number }).statusCode
+    if (status === 401) return navigateTo(localePath('/auth/login'))
+    return navigateTo({
+      path: localePath('/auth/not-authorized'),
+      ...(status === 403 ? {} : { query: { reason: 'unavailable' } }),
+    })
+  }
+})
diff --git a/apps/web/app/pages/accept.vue b/apps/web/app/pages/accept.vue
index b18b83e..ca13f30 100644
--- a/apps/web/app/pages/accept.vue
+++ b/apps/web/app/pages/accept.vue
@@ -1,829 +1,11 @@
 <script setup lang="ts">
-import { buildCredentialAccept, buildCredentialDelete } from '#xcs/sdk/index.js'
-import type { CredentialAccept, CredentialDelete } from 'xrpl'
-import type { ApiSchemaDetail } from '~/composables/useXcsApi'
-import type { WalletSubmissionResult } from '~/composables/useWallet'
-import {
-  assertCredentialAcceptanceReviewCurrent,
-  assertCredentialSubjectMutationReviewCurrent,
-  assertPayloadFetchConsentCurrent,
-  createIssuerTrustAcknowledgementToken,
-  createPayloadFetchConsentToken,
-  credentialActionBlockReason,
-  loadCredentialMutationReview,
-  loadCredentialReview,
-  type CredentialMutationReview,
-  type CredentialReview,
-  type CredentialSubjectAction,
-  type IssuerTrustAcknowledgementToken,
-  type PayloadFetchConsentToken,
-} from '~/utils/credentialReview'
-import {
-  assertLinkGeneration,
-  assertLinkProfile,
-  buildCredentialPermalink,
-  singleRouteQueryValue,
-} from '~/utils/operationLinks'
-import { LOCAL_PAYLOAD_LOCATION } from '~/utils/localPayloadStore'
-import { parseWalletCredentialTransactionError } from '~/utils/walletCompatibility'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const route = useRoute()
-const localePath = useLocalePath()
-const { t } = useI18n()
-const { account, busy: walletBusy, prepare, signAndSubmit } = useWallet()
-const { getActiveNetworkProfile, getCredential, getCredentialGeneration, getSchema, verify } =
-  useXcsApi()
-const localPayloadStore = useLocalPayloadStore()
-const issuer = ref(singleRouteQueryValue(route.query.issuer))
-const schemaUid = ref(singleRouteQueryValue(route.query.schema))
-const linkedProfileId = ref(singleRouteQueryValue(route.query.profile))
-const linkedGenerationId = ref(singleRouteQueryValue(route.query.generation))
-const linkedAction = ref(singleRouteQueryValue(route.query.action))
-
-function linkedSubjectAction(value: string): CredentialSubjectAction {
-  return value === 'reject' || value === 'remove' ? value : 'accept'
-}
-
-function assertLinkedActionValid(value: string): void {
-  if (value !== '' && value !== 'accept' && value !== 'reject' && value !== 'remove') {
-    throw new Error('CREDENTIAL_LINK_ACTION_INVALID')
-  }
-}
-
-const action = ref<CredentialSubjectAction>(linkedSubjectAction(linkedAction.value))
-const transaction = shallowRef<CredentialAccept | CredentialDelete | null>(null)
-const review = shallowRef<CredentialReview | CredentialMutationReview | null>(null)
-const acceptanceReview = computed<CredentialReview | null>(() => {
-  const current = review.value
-  return current && 'report' in current ? current : null
-})
-const reviewProfileId = ref<string | null>(null)
-const schemaDetail = shallowRef<ApiSchemaDetail | null>(null)
-const payloadConsent = ref(false)
-const payloadConsentToken = shallowRef<PayloadFetchConsentToken | null>(null)
-const issuerTrustAcknowledgementToken = shallowRef<IssuerTrustAcknowledgementToken | null>(null)
-const reviewBusy = ref(false)
-const message = ref('')
-const result = shallowRef<WalletSubmissionResult | null>(null)
-const busy = computed(() => walletBusy.value || reviewBusy.value)
-const messageDisplay = computed(() => {
-  if (message.value === 'CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH') {
-    return t('accept.subjectWalletMismatch')
-  }
-  const walletTransactionError = parseWalletCredentialTransactionError(message.value)
-  return walletTransactionError
-    ? t('wallet.errors.credentialUnsupported', {
-        wallet: walletTransactionError.walletName,
-        transactionType: walletTransactionError.transactionType,
-      })
-    : message.value
-})
-const messageIsLocalized = computed(
-  () => message.value.length > 0 && messageDisplay.value !== message.value,
-)
-const resultCredentialLink = computed(() => {
-  const generationId = result.value?.businessEvidence?.generationId
-  if (
-    result.value?.businessConfirmation !== 'confirmed' ||
-    !generationId ||
-    !reviewProfileId.value
-  ) {
-    return null
-  }
-  return buildCredentialPermalink({
-    profileId: reviewProfileId.value,
-    generationId,
-  })
-})
-const blockReason = computed(() => {
-  if (!review.value) return undefined
-  if (action.value === 'accept' && acceptanceReview.value?.claims === undefined) {
-    return acceptanceReview.value?.report.issuerTrust === 'untrusted'
-      ? 'CREDENTIAL_ISSUER_NOT_TRUSTED'
-      : undefined
-  }
-  return credentialActionBlockReason(
-    review.value,
-    action.value,
-    issuerTrustAcknowledgementToken.value ?? undefined,
-    reviewProfileId.value ?? undefined,
-  )
-})
-const blockReasonMessage = computed(() => {
-  if (blockReason.value === 'CREDENTIAL_ISSUER_NOT_TRUSTED') return t('accept.issuerUntrusted')
-  if (blockReason.value === 'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED') {
-    return t('accept.issuerAcknowledgementRequired')
-  }
-  if (blockReason.value === 'CREDENTIAL_ISSUER_TRUST_ACK_STALE') {
-    return t('accept.issuerAcknowledgementStale')
-  }
-  return blockReason.value
-})
-const payloadHost = computed(() => {
-  if (!review.value?.uri) return null
-  try {
-    return localPayloadStore.inspectPayloadLocation(review.value.uri)
-  } catch {
-    return null
-  }
-})
-const payloadUsesLocalStore = computed(() => payloadHost.value === LOCAL_PAYLOAD_LOCATION)
-const payloadHostBlockReason = computed(() => {
-  if (!review.value?.uri) return 'CREDENTIAL_URI_REQUIRED'
-  try {
-    localPayloadStore.inspectPayloadLocation(review.value.uri)
-    return undefined
-  } catch (error) {
-    return error instanceof Error ? error.message : String(error)
-  }
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/accept', locale.value), {
+  replace: true,
+  redirectCode: 308,
 })
-const payloadHostBlockMessage = computed(() =>
-  payloadHostBlockReason.value === 'LOCAL_PAYLOAD_NOT_AVAILABLE_IN_BROWSER'
-    ? t('accept.localPayloadUnavailable')
-    : payloadHostBlockReason.value,
-)
-let previewRevision = 0
-
-function invalidatePreview() {
-  previewRevision += 1
-  transaction.value = null
-  review.value = null
-  reviewProfileId.value = null
-  schemaDetail.value = null
-  payloadConsent.value = false
-  payloadConsentToken.value = null
-  issuerTrustAcknowledgementToken.value = null
-  result.value = null
-}
-
-watch(
-  [issuer, schemaUid, action, linkedProfileId, linkedGenerationId, linkedAction],
-  invalidatePreview,
-)
-watch(
-  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
-  invalidatePreview,
-)
-watch(
-  () => [
-    route.query.issuer,
-    route.query.schema,
-    route.query.profile,
-    route.query.generation,
-    route.query.action,
-  ],
-  ([nextIssuer, nextSchema, nextProfile, nextGeneration, nextAction]) => {
-    issuer.value = singleRouteQueryValue(nextIssuer)
-    schemaUid.value = singleRouteQueryValue(nextSchema)
-    linkedProfileId.value = singleRouteQueryValue(nextProfile)
-    linkedGenerationId.value = singleRouteQueryValue(nextGeneration)
-    linkedAction.value = singleRouteQueryValue(nextAction)
-    action.value = linkedSubjectAction(linkedAction.value)
-  },
-)
-
-function setPayloadConsent(granted: boolean) {
-  if (!granted) {
-    payloadConsent.value = false
-    payloadConsentToken.value = null
-    if (transaction.value === null) return
-    previewRevision += 1
-    transaction.value = null
-    return
-  }
-
-  try {
-    if (!acceptanceReview.value) throw new Error('CREDENTIAL_PAYLOAD_CONSENT_REQUIRED')
-    payloadConsentToken.value = createPayloadFetchConsentToken(acceptanceReview.value)
-    payloadConsent.value = true
-    message.value = ''
-  } catch (error) {
-    payloadConsent.value = false
-    payloadConsentToken.value = null
-    message.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-function setIssuerTrustAcknowledgement(granted: boolean) {
-  if (!granted) {
-    issuerTrustAcknowledgementToken.value = null
-    if (transaction.value === null) return
-    previewRevision += 1
-    transaction.value = null
-    result.value = null
-    return
-  }
-
-  try {
-    if (!acceptanceReview.value) throw new Error('CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED')
-    if (!reviewProfileId.value) throw new Error('CREDENTIAL_ISSUER_TRUST_ACK_PROFILE_REQUIRED')
-    issuerTrustAcknowledgementToken.value = createIssuerTrustAcknowledgementToken(
-      acceptanceReview.value,
-      reviewProfileId.value,
-    )
-    message.value = ''
-  } catch (error) {
-    issuerTrustAcknowledgementToken.value = null
-    message.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-function clearStalePayloadConsent(error: unknown): void {
-  if (!(error instanceof Error) || error.message !== 'CREDENTIAL_PAYLOAD_CONSENT_STALE') return
-  payloadConsent.value = false
-  payloadConsentToken.value = null
-  issuerTrustAcknowledgementToken.value = null
-  review.value = null
-  reviewProfileId.value = null
-  schemaDetail.value = null
-  previewRevision += 1
-  transaction.value = null
-  result.value = null
-}
-
-function clearInvalidIssuerTrustAcknowledgement(error: unknown): void {
-  if (
-    !(error instanceof Error) ||
-    ![
-      'CREDENTIAL_ISSUER_NOT_TRUSTED',
-      'CREDENTIAL_ISSUER_TRUST_ACK_REQUIRED',
-      'CREDENTIAL_ISSUER_TRUST_ACK_STALE',
-      'CREDENTIAL_ISSUER_TRUST_CHANGED_AFTER_SIGNATURE',
-      'CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE',
-      'CREDENTIAL_GENERATION_CHANGED_AFTER_SIGNATURE',
-      'CREDENTIAL_REVIEW_CHANGED_AFTER_SIGNATURE',
-      'CREDENTIAL_STATE_CHANGED_AFTER_SIGNATURE',
-      'CREDENTIAL_LINK_GENERATION_MISMATCH',
-      'NETWORK_PROFILE_CHANGED_AFTER_SIGNATURE',
-    ].includes(error.message)
-  ) {
-    return
-  }
-  issuerTrustAcknowledgementToken.value = null
-  previewRevision += 1
-  transaction.value = null
-  result.value = null
-}
-
-async function fetchExactReview(input: {
-  issuer: string
-  subject: string
-  schemaUid: string
-  profileId: string
-  payloadConsent?: PayloadFetchConsentToken | undefined
-  expectedGenerationId?: string | undefined
-}): Promise<{ credentialReview: CredentialReview; schema: ApiSchemaDetail | null }> {
-  await assertLinkedGenerationCoordinates(input)
-  const [credential, metadataReport, schemaResult] = await Promise.all([
-    getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
-    verify(
-      {
-        issuer: input.issuer,
-        subject: input.subject,
-        schemaUid: input.schemaUid,
-        resolvePayload: false,
-      },
-      input.profileId,
-    ),
-    getSchema(input.schemaUid, input.profileId).then(
-      (schema) => ({ schema }),
-      (error: unknown) => ({ error }),
-    ),
-  ])
-  if ('error' in schemaResult && input.payloadConsent) throw schemaResult.error
-  const schema = 'schema' in schemaResult ? schemaResult.schema : null
-  const reviewOptions = {
-    credential,
-    report: metadataReport,
-    issuer: input.issuer,
-    subject: input.subject,
-    schemaUid: input.schemaUid,
-    ...(schema ? { schema: schema.resolved } : {}),
-    payloadReader: localPayloadStore.readPayload,
-  }
-  const metadataReview = await loadCredentialReview(reviewOptions)
-  assertLinkGeneration(input.expectedGenerationId, metadataReview.generationId)
-  if (!input.payloadConsent) return { credentialReview: metadataReview, schema }
-  assertPayloadFetchConsentCurrent(metadataReview, input.payloadConsent)
-  const localReview = await loadCredentialReview({ ...reviewOptions, fetchPayload: true })
-  if (localReview.payload === undefined) throw new Error('CREDENTIAL_PAYLOAD_REVIEW_FAILED')
-
-  // The API validates the already-consented, locally parsed object. It never
-  // resolves the issuer URI, so the server-side URL resolver may stay disabled.
-  const verifiedReport = await verify(
-    {
-      issuer: input.issuer,
-      subject: input.subject,
-      schemaUid: input.schemaUid,
-      payload: localReview.payload,
-    },
-    input.profileId,
-  )
-  const verifiedMetadata = await loadCredentialReview({
-    credential,
-    report: verifiedReport,
-    issuer: input.issuer,
-    subject: input.subject,
-    schemaUid: input.schemaUid,
-  })
-  return {
-    schema,
-    credentialReview: {
-      ...verifiedMetadata,
-      payload: localReview.payload,
-      claims: localReview.claims,
-      payloadDigestHex: localReview.payloadDigestHex,
-      payloadByteLength: localReview.payloadByteLength,
-      payloadCheckedAt: localReview.payloadCheckedAt,
-    },
-  }
-}
-
-async function fetchExactMutationReview(input: {
-  issuer: string
-  subject: string
-  schemaUid: string
-  profileId: string
-  expectedGenerationId?: string | undefined
-}): Promise<CredentialMutationReview> {
-  await assertLinkedGenerationCoordinates(input)
-  const credentialReview = loadCredentialMutationReview(
-    await getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
-    {
-      issuer: input.issuer,
-      subject: input.subject,
-      schemaUid: input.schemaUid,
-    },
-  )
-  assertLinkGeneration(input.expectedGenerationId, credentialReview.generationId)
-  return credentialReview
-}
-
-async function assertLinkedGenerationCoordinates(input: {
-  issuer: string
-  subject: string
-  schemaUid: string
-  profileId: string
-  expectedGenerationId?: string | undefined
-}): Promise<void> {
-  if (!input.expectedGenerationId) return
-  const detail = await getCredentialGeneration(input.expectedGenerationId, input.profileId)
-  const generation = detail.generation
-  assertLinkGeneration(input.expectedGenerationId, generation.generationId)
-  if (generation.issuer !== input.issuer) throw new Error('CREDENTIAL_LINK_ISSUER_MISMATCH')
-  if (generation.schemaUid.toLowerCase() !== input.schemaUid.toLowerCase()) {
-    throw new Error('CREDENTIAL_LINK_SCHEMA_MISMATCH')
-  }
-  if (generation.subject !== input.subject) {
-    throw new Error('CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH')
-  }
-}
-
-async function buildPreview() {
-  previewRevision += 1
-  transaction.value = null
-  message.value = ''
-  result.value = null
-  if (!account.value) return void (message.value = 'WALLET_NOT_CONNECTED')
-
-  reviewBusy.value = true
-  const revision = previewRevision
-  const subjectAddress = account.value.address
-  const issuerAddress = issuer.value
-  const normalizedSchemaUid = schemaUid.value.toLowerCase()
-  const selectedAction = action.value
-  const consent = selectedAction === 'accept' ? payloadConsentToken.value : null
-  const trustAcknowledgement =
-    selectedAction === 'accept' ? issuerTrustAcknowledgementToken.value : null
-  try {
-    assertLinkedActionValid(linkedAction.value)
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
-    const linkedGeneration = linkedGenerationId.value
-      ? { expectedGenerationId: linkedGenerationId.value }
-      : {}
-    const loaded =
-      selectedAction === 'accept'
-        ? await fetchExactReview({
-            issuer: issuerAddress,
-            subject: subjectAddress,
-            schemaUid: normalizedSchemaUid,
-            profileId: profile.profileId,
-            ...linkedGeneration,
-            ...(consent ? { payloadConsent: consent } : {}),
-          })
-        : {
-            credentialReview: await fetchExactMutationReview({
-              issuer: issuerAddress,
-              subject: subjectAddress,
-              schemaUid: normalizedSchemaUid,
-              profileId: profile.profileId,
-              ...linkedGeneration,
-            }),
-            schema: null,
-          }
-    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
-
-    review.value = loaded.credentialReview
-    reviewProfileId.value = profile.profileId
-    schemaDetail.value = loaded.schema
-    if (selectedAction === 'accept' && !consent) {
-      message.value = payloadHostBlockReason.value ?? 'CREDENTIAL_PAYLOAD_CONSENT_REQUIRED'
-      return
-    }
-    const reason = credentialActionBlockReason(
-      loaded.credentialReview,
-      selectedAction,
-      trustAcknowledgement ?? undefined,
-      profile.profileId,
-    )
-    if (reason) throw new Error(reason)
-
-    const raw =
-      selectedAction === 'accept'
-        ? buildCredentialAccept({
-            subject: subjectAddress,
-            issuer: issuerAddress,
-            schemaUid: normalizedSchemaUid,
-          })
-        : buildCredentialDelete({
-            account: subjectAddress,
-            issuer: issuerAddress,
-            subject: subjectAddress,
-            schemaUid: normalizedSchemaUid,
-          })
-    const prepared = (await prepare(raw, profile)) as CredentialAccept | CredentialDelete
-    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_BUILD')
-    transaction.value = prepared
-  } catch (error) {
-    clearStalePayloadConsent(error)
-    clearInvalidIssuerTrustAcknowledgement(error)
-    transaction.value = null
-    message.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    reviewBusy.value = false
-  }
-}
-
-async function submit() {
-  const preparedTransaction = transaction.value
-  const expectedReview = review.value
-  const expectedSubject = account.value?.address
-  const expectedIssuer = issuer.value
-  const expectedSchemaUid = schemaUid.value.toLowerCase()
-  const expectedAction = action.value
-  const expectedPayloadConsent = payloadConsentToken.value
-  const expectedIssuerTrustAcknowledgement = issuerTrustAcknowledgementToken.value
-  const expectedLinkedProfileId = linkedProfileId.value
-  const expectedLinkedGenerationId = linkedGenerationId.value
-  const expectedLinkedAction = linkedAction.value
-  const expectedRevision = previewRevision
-  if (!preparedTransaction || !expectedReview || !expectedSubject) {
-    message.value = 'TRANSACTION_PREVIEW_REQUIRED'
-    return
-  }
-
-  reviewBusy.value = true
-  message.value = ''
-  try {
-    const assertCurrent = () => {
-      if (
-        previewRevision !== expectedRevision ||
-        transaction.value !== preparedTransaction ||
-        account.value?.address !== expectedSubject ||
-        issuer.value !== expectedIssuer ||
-        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
-        action.value !== expectedAction ||
-        payloadConsentToken.value !== expectedPayloadConsent ||
-        issuerTrustAcknowledgementToken.value !== expectedIssuerTrustAcknowledgement ||
-        linkedProfileId.value !== expectedLinkedProfileId ||
-        linkedGenerationId.value !== expectedLinkedGenerationId ||
-        linkedAction.value !== expectedLinkedAction
-      ) {
-        throw new Error('CREDENTIAL_REVIEW_CHANGED_BEFORE_SIGNATURE')
-      }
-    }
-    assertCurrent()
-    assertLinkedActionValid(expectedLinkedAction)
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(expectedLinkedProfileId || undefined, profile.profileId)
-    const linkedGeneration = expectedLinkedGenerationId
-      ? { expectedGenerationId: expectedLinkedGenerationId }
-      : {}
-    const loaded =
-      expectedAction === 'accept'
-        ? await (async () => {
-            if (!expectedPayloadConsent) throw new Error('CREDENTIAL_PAYLOAD_CONSENT_REQUIRED')
-            return fetchExactReview({
-              issuer: expectedIssuer,
-              subject: expectedSubject,
-              schemaUid: expectedSchemaUid,
-              profileId: profile.profileId,
-              ...linkedGeneration,
-              payloadConsent: expectedPayloadConsent,
-            })
-          })()
-        : {
-            credentialReview: await fetchExactMutationReview({
-              issuer: expectedIssuer,
-              subject: expectedSubject,
-              schemaUid: expectedSchemaUid,
-              profileId: profile.profileId,
-              ...linkedGeneration,
-            }),
-            schema: null,
-          }
-    assertCurrent()
-    if (loaded.credentialReview.generationId !== expectedReview.generationId) {
-      throw new Error('CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE')
-    }
-    if (expectedAction === 'accept') {
-      if (!('report' in expectedReview) || !('report' in loaded.credentialReview)) {
-        throw new Error('CREDENTIAL_ACCEPTANCE_REVIEW_REQUIRED')
-      }
-      assertCredentialAcceptanceReviewCurrent(
-        expectedReview,
-        loaded.credentialReview,
-        profile.profileId,
-        profile.profileId,
-        expectedIssuerTrustAcknowledgement ?? undefined,
-      )
-    } else {
-      if ('report' in expectedReview || 'report' in loaded.credentialReview) {
-        throw new Error('CREDENTIAL_MUTATION_REVIEW_REQUIRED')
-      }
-      assertCredentialSubjectMutationReviewCurrent(
-        expectedReview,
-        loaded.credentialReview,
-        profile.profileId,
-        profile.profileId,
-        expectedAction,
-      )
-    }
-    review.value = loaded.credentialReview
-    reviewProfileId.value = profile.profileId
-    schemaDetail.value = loaded.schema
-    const reason = credentialActionBlockReason(
-      loaded.credentialReview,
-      expectedAction,
-      expectedIssuerTrustAcknowledgement ?? undefined,
-      profile.profileId,
-    )
-    if (reason) throw new Error(reason)
-
-    const revalidateSubjectActionAfterSignature = async () => {
-      assertCurrent()
-      const latestProfile = await getActiveNetworkProfile()
-      assertLinkProfile(expectedLinkedProfileId || undefined, latestProfile.profileId)
-      if (expectedAction === 'accept') {
-        if (!('report' in loaded.credentialReview)) {
-          throw new Error('CREDENTIAL_ACCEPTANCE_REVIEW_REQUIRED')
-        }
-        const latest = await fetchExactReview({
-          issuer: expectedIssuer,
-          subject: expectedSubject,
-          schemaUid: expectedSchemaUid,
-          profileId: latestProfile.profileId,
-          ...linkedGeneration,
-        })
-        assertCurrent()
-        assertCredentialAcceptanceReviewCurrent(
-          loaded.credentialReview,
-          latest.credentialReview,
-          profile.profileId,
-          latestProfile.profileId,
-          expectedIssuerTrustAcknowledgement ?? undefined,
-        )
-      } else {
-        if ('report' in loaded.credentialReview) {
-          throw new Error('CREDENTIAL_MUTATION_REVIEW_REQUIRED')
-        }
-        const latest = await fetchExactMutationReview({
-          issuer: expectedIssuer,
-          subject: expectedSubject,
-          schemaUid: expectedSchemaUid,
-          profileId: latestProfile.profileId,
-          ...linkedGeneration,
-        })
-        assertCurrent()
-        assertCredentialSubjectMutationReviewCurrent(
-          loaded.credentialReview,
-          latest,
-          profile.profileId,
-          latestProfile.profileId,
-          expectedAction,
-        )
-      }
-    }
-
-    const response = await signAndSubmit(
-      preparedTransaction,
-      {
-        action:
-          expectedAction === 'accept'
-            ? 'credential-accept'
-            : expectedAction === 'reject'
-              ? 'credential-reject'
-              : 'credential-remove',
-        issuer: expectedIssuer,
-        subject: expectedSubject,
-        schemaUid: expectedSchemaUid,
-        generationId: loaded.credentialReview.generationId,
-        ...('payloadDigestHex' in loaded.credentialReview &&
-        loaded.credentialReview.payloadDigestHex
-          ? { payloadDigestHex: loaded.credentialReview.payloadDigestHex }
-          : {}),
-      },
-      assertCurrent,
-      revalidateSubjectActionAfterSignature,
-      (validated) => {
-        result.value = { ...validated }
-      },
-    )
-    result.value = response
-    transaction.value = null
-  } catch (error) {
-    clearStalePayloadConsent(error)
-    clearInvalidIssuerTrustAcknowledgement(error)
-    message.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    reviewBusy.value = false
-  }
-}
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      eyebrow="Credential subject"
-      :title="$t('accept.title')"
-      :lead="$t('accept.description')"
-    />
-    <StatusBox tone="warning">{{ $t('accept.notTruth') }}</StatusBox>
-
-    <UCard class="mb-6">
-      <div class="grid gap-5">
-        <UFormField :label="$t('accept.action')">
-          <USelect
-            id="subject-action"
-            v-model="action"
-            :items="[
-              { label: $t('accept.acceptAction'), value: 'accept' },
-              { label: $t('accept.rejectAction'), value: 'reject' },
-              { label: $t('accept.removeAction'), value: 'remove' },
-            ]"
-            :disabled="busy"
-          />
-        </UFormField>
-        <UFormField label="Issuer">
-          <UInput id="issuer" v-model.trim="issuer" placeholder="r…" :disabled="busy" />
-        </UFormField>
-        <UFormField label="Schema UID">
-          <UInput
-            id="accept-schema"
-            v-model.trim="schemaUid"
-            pattern="[0-9a-fA-F]{64}"
-            :disabled="busy"
-          />
-        </UFormField>
-        <div>
-          <UButton :disabled="busy" @click="buildPreview">
-            {{
-              busy
-                ? $t('common.working')
-                : action === 'accept' && review && payloadConsent
-                  ? $t('accept.fetchAndPrepare')
-                  : $t('accept.review')
-            }}
-          </UButton>
-        </div>
-      </div>
-    </UCard>
-
-    <StatusBox v-if="message" tone="error" data-testid="accept-error" :title="messageDisplay">
-      <p v-if="messageIsLocalized">
-        <code>{{ message }}</code>
-      </p>
-    </StatusBox>
-
-    <UCard v-if="review" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('accept.exactCredential') }}</h2>
-      </template>
-      <MetadataList>
-        <dt>Issuer</dt>
-        <dd>
-          <code>{{ review.issuer }}</code>
-        </dd>
-        <dt>Subject</dt>
-        <dd>
-          <code>{{ review.subject }}</code>
-        </dd>
-        <dt>Schema</dt>
-        <dd>
-          <strong v-if="schemaDetail">{{ schemaDetail.name }}</strong>
-          <code>{{ review.schemaUid }}</code>
-        </dd>
-        <dt>{{ $t('accept.expiration') }}</dt>
-        <dd>{{ review.expiration ?? $t('accept.noExpiration') }}</dd>
-        <dt>URI</dt>
-        <dd>
-          <code>{{ review.uri ?? '—' }}</code>
-        </dd>
-        <dt>{{ $t('accept.generation') }}</dt>
-        <dd>
-          <code>{{ review.generationId }}</code>
-        </dd>
-        <dt>{{ $t('accept.state') }}</dt>
-        <dd><StatusPill :value="review.state" /></dd>
-        <dt>{{ $t('accept.acceptedFlag') }}</dt>
-        <dd>
-          <code>{{ review.accepted }}</code>
-        </dd>
-      </MetadataList>
-
-      <!-- The legacy accept verification grid had no trust note. -->
-      <VerificationGrid v-if="acceptanceReview" :report="acceptanceReview.report" :note="false" />
-
-      <StatusBox v-if="action === 'accept' && !acceptanceReview?.claims" tone="warning">
-        <p>
-          {{
-            $t(
-              payloadUsesLocalStore
-                ? 'accept.localPayloadConsentIntro'
-                : 'accept.payloadConsentIntro',
-              { host: payloadHost ?? '—' },
-            )
-          }}
-        </p>
-        <StatusBox v-if="payloadHostBlockReason" tone="error">
-          {{ payloadHostBlockMessage }}
-        </StatusBox>
-        <UCheckbox
-          v-else
-          data-testid="payload-consent"
-          :model-value="payloadConsent"
-          :disabled="busy"
-          :label="
-            $t(payloadUsesLocalStore ? 'accept.localPayloadConsent' : 'accept.payloadConsent')
-          "
-          @update:model-value="setPayloadConsent(Boolean($event))"
-        />
-      </StatusBox>
-      <StatusBox
-        v-if="action === 'accept' && acceptanceReview?.report.issuerTrust === 'unknown'"
-        tone="warning"
-        data-testid="issuer-trust-acknowledgement"
-      >
-        <p>{{ $t('accept.issuerUnknown') }}</p>
-        <UCheckbox
-          :model-value="issuerTrustAcknowledgementToken !== null"
-          :disabled="busy"
-          :label="$t('accept.issuerAcknowledgement')"
-          @update:model-value="setIssuerTrustAcknowledgement(Boolean($event))"
-        />
-      </StatusBox>
-      <template v-if="action === 'accept'">
-        <h2 class="mt-6 mb-2 text-xl font-semibold">{{ $t('accept.publicClaims') }}</h2>
-        <JsonBlock
-          v-if="acceptanceReview?.claims"
-          :code="JSON.stringify(acceptanceReview.claims, null, 2)"
-        />
-        <StatusBox v-else-if="acceptanceReview?.payloadReviewError" tone="error">
-          {{ $t('accept.payloadUnavailable') }}
-          <code>{{ acceptanceReview.payloadReviewError }}</code>
-        </StatusBox>
-        <p v-if="acceptanceReview?.payloadDigestHex" class="text-sm break-words text-muted">
-          {{ acceptanceReview.payloadByteLength }} bytes ·
-          <code>{{ acceptanceReview.payloadDigestHex }}</code>
-        </p>
-      </template>
-      <StatusBox v-if="blockReasonMessage" tone="error">{{ blockReasonMessage }}</StatusBox>
-      <StatusBox v-else-if="action === 'reject'" tone="warning">
-        {{ $t('accept.rejectSafety') }}
-      </StatusBox>
-      <StatusBox v-else-if="action === 'remove'" tone="warning">
-        {{ $t('accept.removeSafety') }}
-      </StatusBox>
-    </UCard>
-
-    <TransactionPreview :transaction="transaction" :busy="busy" @confirm="submit" />
-    <BusinessFinality
-      v-if="result"
-      :tx-hash="result.txHash"
-      :engine-result="result.transactionResult"
-      :ledger-index="result.ledgerIndex"
-      :business-confirmation="result.businessConfirmation"
-      :business-evidence="result.businessEvidence"
-    />
-    <UButton
-      v-if="resultCredentialLink"
-      color="neutral"
-      variant="outline"
-      data-testid="subject-result-permalink"
-      :to="localePath(resultCredentialLink)"
-    >
-      {{ $t('accept.openPermalink') }}
-    </UButton>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/account.vue b/apps/web/app/pages/account.vue
new file mode 100644
index 0000000..a26f81d
--- /dev/null
+++ b/apps/web/app/pages/account.vue
@@ -0,0 +1,312 @@
+<script setup lang="ts">
+import { useWallet as useXrplConnectWallet } from '@xrpl-commons/xrpl-connect-vue'
+import { signWalletLinkChallenge } from '~/utils/walletLinkProof'
+import { supportsWalletLinkProof, walletLinkReturnPath } from '~/utils/roleJourney'
+
+definePageMeta({ middleware: ['auth'] })
+const { locale, t } = useI18n()
+const localePath = useLocalePath()
+const route = useRoute()
+const onboarding = computed(() => route.query.returnTo !== undefined)
+const returnPath = computed(() => walletLinkReturnPath(route.query.returnTo, locale.value))
+const issuerOnboarding = computed(() => returnPath.value.startsWith(localePath('/issuer')))
+const auth = useAuth()
+const { user, expiresAt, absoluteExpiresAt } = auth
+const wallet = import.meta.client ? useXrplConnectWallet() : undefined
+const { account: walletAccount } = useWallet()
+const busy = ref(false)
+const mounted = ref(false)
+onMounted(() => {
+  mounted.value = true
+})
+const error = ref('')
+const notice = ref('')
+const canLink = computed(() => {
+  // Read Vue's account ref before the SDK's plain getters can short-circuit tracking.
+  const current = walletAccount.value
+  return Boolean(
+    current?.network.id === 'testnet' &&
+    wallet?.manager.connected &&
+    supportsWalletLinkProof(wallet.manager.wallet?.id ?? '') &&
+    wallet.manager.supports('signMessage'),
+  )
+})
+const isLinked = computed(() =>
+  user.value?.wallets.some(
+    (link) => link.address === walletAccount.value?.address && link.networkId === 1,
+  ),
+)
+const hasLinkedWallet = computed(
+  () => user.value?.wallets.some((link) => link.networkId === 1) === true,
+)
+const prepared = ref(!onboarding.value)
+watch(
+  hasLinkedWallet,
+  (linked) => {
+    if (linked) prepared.value = true
+  },
+  { immediate: true },
+)
+const walletStage = computed<'prepare' | 'connect' | 'prove' | 'ready'>(() => {
+  if (hasLinkedWallet.value) return 'ready'
+  if (canLink.value) return 'prove'
+  return prepared.value ? 'connect' : 'prepare'
+})
+const formatDate = (value?: string) =>
+  value
+    ? new Intl.DateTimeFormat(locale.value, {
+        dateStyle: 'medium',
+        timeStyle: 'short',
+        timeZone: 'UTC',
+      }).format(new Date(value))
+    : '—'
+
+async function action(work: () => Promise<void>, success?: string): Promise<void> {
+  if (busy.value) return
+  busy.value = true
+  error.value = ''
+  notice.value = ''
+  try {
+    await work()
+    if (success) notice.value = t(success)
+  } catch (cause) {
+    const code = cause instanceof Error ? cause.message : ''
+    error.value = t(
+      code.startsWith('WALLET_LINK_SESSION_CHANGED') ? 'auth.walletChanged' : 'auth.actionFailed',
+    )
+  } finally {
+    busy.value = false
+  }
+}
+
+async function link(): Promise<void> {
+  const current = walletAccount.value
+  const manager = wallet?.manager
+  if (!current || !manager || !canLink.value) throw new Error('WALLET_LINK_UNSUPPORTED')
+  const challenge = await auth.createWalletChallenge(current.address)
+  const proof = await signWalletLinkChallenge(
+    manager,
+    { address: current.address, networkId: 'testnet' },
+    challenge.message,
+  )
+  await auth.linkWallet(challenge.id, proof)
+}
+
+async function logout(): Promise<void> {
+  await auth.logout()
+  await navigateTo(localePath('/auth/login'))
+}
+
+useSeoMeta({ title: () => `${t('auth.account')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader
+      :title="$t(onboarding ? 'roleJourney.walletTitle' : 'auth.account')"
+      :lead="
+        $t(
+          onboarding
+            ? issuerOnboarding
+              ? 'portal.walletProgress.issuerIntro'
+              : 'roleJourney.walletIntro'
+            : 'auth.accountIntro',
+        )
+      "
+    />
+    <StatusBox v-if="error" tone="error" class="mb-5" role="alert">{{ error }}</StatusBox>
+    <StatusBox v-if="notice" tone="success" class="mb-5" role="status">{{ notice }}</StatusBox>
+    <template v-if="user">
+      <UCard v-if="!onboarding">
+        <h2 class="text-xl font-semibold">{{ $t('auth.profile') }}</h2>
+        <MetadataList class="mt-4">
+          <dt>{{ $t('auth.name') }}</dt>
+          <dd>{{ user.displayName ?? '—' }}</dd>
+          <dt>{{ $t('auth.email') }}</dt>
+          <dd>{{ user.email ?? '—' }}</dd>
+          <dt>{{ $t('auth.personalRoles') }}</dt>
+          <dd>{{ user.roles.map((role) => $t(`auth.roles.${role}`)).join(', ') || '—' }}</dd>
+          <dt>{{ $t('auth.sessionExpires') }}</dt>
+          <dd>{{ formatDate(expiresAt) }} UTC</dd>
+          <dt>{{ $t('auth.sessionMaximum') }}</dt>
+          <dd>{{ formatDate(absoluteExpiresAt) }} UTC</dd>
+        </MetadataList>
+        <div class="mt-5 flex flex-wrap gap-3">
+          <UButton
+            :disabled="!mounted || busy"
+            @click="action(auth.refresh, 'auth.sessionExtended')"
+            >{{ $t('auth.extendSession') }}</UButton
+          >
+          <UButton
+            :disabled="!mounted || busy"
+            color="neutral"
+            variant="outline"
+            data-testid="auth-logout"
+            @click="action(logout)"
+            >{{ $t('auth.signOut') }}</UButton
+          >
+        </div>
+        <p class="mt-3 text-sm text-muted">{{ $t('auth.signOutHelp') }}</p>
+      </UCard>
+
+      <section v-if="!onboarding" class="mt-8" aria-labelledby="account-organizations">
+        <h2 id="account-organizations" class="text-2xl font-semibold">
+          {{ $t('auth.organizations') }}
+        </h2>
+        <p v-if="!user.organizations.length" class="mt-3 text-muted">
+          {{ $t('auth.noOrganizations') }}
+        </p>
+        <ul v-else class="mt-4 grid gap-3 sm:grid-cols-2">
+          <li v-for="organization in user.organizations" :key="organization.id">
+            <UCard>
+              <h3 class="font-semibold">{{ organization.name }}</h3>
+              <p class="mt-1 text-sm text-muted">
+                {{ organization.roles.map((role) => $t(`auth.roles.${role}`)).join(', ') }}
+              </p>
+            </UCard>
+          </li>
+        </ul>
+        <UButton v-if="auth.hasRole('issuer')" class="mt-4" :to="localePath('/issuer')">{{
+          $t('auth.issuerSpace')
+        }}</UButton>
+      </section>
+
+      <section class="mt-8" aria-labelledby="account-wallets">
+        <h2 id="account-wallets" class="text-2xl font-semibold">{{ $t('auth.linkedWallets') }}</h2>
+        <WalletProgress v-if="onboarding" class="mt-5" :stage="walletStage" />
+        <StatusBox v-if="hasLinkedWallet" class="mt-6" tone="success">{{
+          $t('roleJourney.walletReady')
+        }}</StatusBox>
+        <UButton
+          v-if="hasLinkedWallet"
+          :to="returnPath"
+          class="mt-3"
+          data-testid="wallet-link-continue"
+          >{{
+            $t(
+              issuerOnboarding
+                ? 'portal.walletProgress.continueIssuer'
+                : 'roleJourney.continueRecipient',
+            )
+          }}</UButton
+        >
+
+        <details
+          class="my-5 rounded border border-default p-5"
+          :open="!hasLinkedWallet && !canLink"
+          aria-labelledby="wallet-onboarding"
+        >
+          <summary id="wallet-onboarding" class="cursor-pointer text-lg font-semibold">
+            {{ $t('roleJourney.walletGuide') }}
+          </summary>
+          <ol class="mt-4 list-decimal space-y-4 pl-5">
+            <li>
+              <strong>{{ $t('roleJourney.setupTitle') }}</strong>
+              <p class="mt-1 text-sm text-muted">{{ $t('roleJourney.setupHelp') }}</p>
+            </li>
+            <li>
+              <strong>{{ $t('roleJourney.backupTitle') }}</strong>
+              <p class="mt-1 text-sm text-muted">{{ $t('roleJourney.backupHelp') }}</p>
+            </li>
+            <li>
+              <strong>{{ $t('roleJourney.networkTitle') }}</strong>
+              <p class="mt-1 text-sm text-muted">{{ $t('roleJourney.networkHelp') }}</p>
+            </li>
+            <li>
+              <strong>{{ $t('roleJourney.proofTitle') }}</strong>
+              <p class="mt-1 text-sm text-muted">{{ $t('auth.walletLinkHelp') }}</p>
+            </li>
+          </ol>
+        </details>
+        <UButton
+          v-if="onboarding && !hasLinkedWallet && !prepared"
+          class="mt-5"
+          @click="prepared = true"
+          >{{ $t('portal.walletProgress.prepared') }}</UButton
+        >
+        <ClientOnly v-if="prepared"
+          ><div class="mt-5"><WalletButton proof-only test-id-prefix="wallet-link" /></div
+        ></ClientOnly>
+        <p v-if="prepared && !canLink && !hasLinkedWallet" class="mt-3 text-sm text-muted">
+          {{ $t('roleJourney.walletSelectionHelp') }}
+        </p>
+        <p class="mt-3 text-toned">{{ $t('auth.walletLinkHelp') }}</p>
+        <details class="mt-2 text-sm text-muted">
+          <summary class="cursor-pointer">{{ $t('simpleRecipient.walletCompatibility') }}</summary>
+          <p class="mt-2">{{ $t('auth.masterKeyOnly') }}</p>
+        </details>
+        <p v-if="!user.wallets.length" class="mt-4 text-muted">{{ $t('auth.noWallets') }}</p>
+        <details v-else class="mt-4 rounded border border-default p-4">
+          <summary class="cursor-pointer font-semibold">
+            {{ $t('simpleRecipient.manageWallet') }}
+          </summary>
+          <div class="mt-3 overflow-x-auto">
+            <table class="w-full text-left text-sm" data-testid="linked-wallets">
+              <caption class="sr-only">
+                {{
+                  $t('auth.linkedWallets')
+                }}
+              </caption>
+              <thead>
+                <tr class="border-b border-default">
+                  <th class="p-3" scope="col">{{ $t('auth.walletAddress') }}</th>
+                  <th class="p-3" scope="col">{{ $t('auth.network') }}</th>
+                  <th class="p-3" scope="col">{{ $t('auth.verifiedAt') }}</th>
+                  <th class="p-3" scope="col">{{ $t('auth.actions') }}</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr v-for="linked in user.wallets" :key="linked.id" class="border-b border-default">
+                  <td class="p-3 font-mono break-all">{{ linked.address }}</td>
+                  <td class="p-3">
+                    {{ linked.networkId === 1 ? 'XRPL Testnet' : linked.networkId }}
+                  </td>
+                  <td class="p-3">{{ formatDate(linked.verifiedAt) }} UTC</td>
+                  <td class="p-3">
+                    <UButton
+                      :disabled="!mounted || busy"
+                      color="neutral"
+                      variant="outline"
+                      :aria-label="$t('auth.unlinkAddress', { address: linked.address })"
+                      @click="action(() => auth.unlinkWallet(linked.id), 'auth.walletUnlinked')"
+                      >{{ $t('auth.unlink') }}</UButton
+                    >
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </details>
+        <ClientOnly v-if="prepared">
+          <div class="mt-5">
+            <details v-if="walletAccount && !isLinked" class="mb-3 text-sm">
+              <summary class="cursor-pointer">{{ $t('simpleRecipient.walletDetails') }}</summary>
+              <p class="mt-2 break-all font-mono">{{ walletAccount.address }}</p>
+            </details>
+            <p v-if="!walletAccount" class="mb-3 text-muted">
+              {{ $t('roleJourney.connectFirst') }}
+            </p>
+            <p v-else-if="!canLink" class="mb-3 text-muted">{{ $t('auth.walletUnsupported') }}</p>
+            <p v-else-if="isLinked" class="mb-3 text-muted">{{ $t('auth.alreadyLinked') }}</p>
+            <UButton
+              :disabled="!mounted || busy || !canLink || isLinked"
+              :loading="busy"
+              data-testid="auth-link-wallet"
+              @click="action(link, 'auth.walletLinked')"
+              >{{ $t('auth.linkCurrentWallet') }}</UButton
+            >
+          </div>
+        </ClientOnly>
+        <UButton
+          v-if="onboarding"
+          :to="localePath('/account')"
+          color="neutral"
+          variant="link"
+          class="mt-3 ml-3"
+          >{{ $t('auth.account') }}</UButton
+        >
+      </section>
+    </template>
+    <UButton v-else :to="localePath('/auth/login')">{{ $t('auth.signIn') }}</UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/admin/applications/[id]/[role].vue b/apps/web/app/pages/admin/applications/[id]/[role].vue
new file mode 100644
index 0000000..10e83d9
--- /dev/null
+++ b/apps/web/app/pages/admin/applications/[id]/[role].vue
@@ -0,0 +1,377 @@
+<script setup lang="ts">
+import type {
+  AdminAction,
+  AdminApplication,
+  AdminDecisionRequest,
+  AdminDetail,
+} from '~/composables/useAdminApi'
+
+definePageMeta({ middleware: ['auth', 'role'], requiredRole: 'admin', key: (route) => route.path })
+const route = useRoute()
+const localePath = useLocalePath()
+const { t } = useI18n()
+const api = useAdminApi()
+const path = `applications/${encodeURIComponent(String(route.params.id))}/${encodeURIComponent(String(route.params.role))}`
+const { data, status, error, refresh } = await useAsyncData(`admin-${path}`, () =>
+  api.get<AdminDetail>(path),
+)
+const action = ref<AdminAction | null>(null)
+const reason = ref('')
+const validation = ref(false)
+const busy = ref(false)
+const actionError = ref<unknown>(null)
+const conflict = ref<Pick<
+  AdminApplication,
+  'status' | 'revision' | 'review_reason' | 'reviewed_at'
+> | null>(null)
+// Keep the exact request across navigation/retries when the HTTP outcome is unknown.
+const pending = useState<AdminDecisionRequest | null>(`admin-pending-${path}`, () => null)
+const documentError = ref<unknown>(null)
+const documentBusy = ref<string | null>(null)
+const failedDocument = ref<string | null>(null)
+const documentLinks = ref<Record<string, { url: string; expiresAt: string }>>({})
+const requiredReason = computed(() => action.value === 'reject' || action.value === 'suspend')
+const checklist = computed(() => {
+  if (!data.value) return []
+  return [
+    { label: t('admin.checklist.organization'), complete: Boolean(data.value.application.name) },
+    { label: t('admin.checklist.role'), complete: Boolean(data.value.application.role) },
+    {
+      label: t('admin.checklist.responsible'),
+      complete: Boolean(data.value.application.responsible_name),
+    },
+    { label: t('admin.checklist.documents'), complete: data.value.documents.length > 0 },
+    { label: t('admin.checklist.wallet'), complete: data.value.wallets.length > 0 },
+    { label: t('admin.checklist.history'), complete: true },
+  ]
+})
+const actions = computed<AdminAction[]>(() => {
+  const application = data.value?.application
+  if (!application || conflict.value) return []
+  if (application.status === 'pending') return ['approve', 'reject']
+  if (application.role === 'verifier' && application.status === 'approved') return ['suspend']
+  if (application.role === 'verifier' && application.status === 'suspended') return ['restore']
+  return []
+})
+const back = computed(() => ({
+  path: localePath(route.query.from === 'verifiers' ? '/admin/verifiers' : '/admin'),
+  query: {
+    page: String(route.query.page ?? '1'),
+    ...(['issuer', 'verifier'].includes(String(route.query.role))
+      ? { role: String(route.query.role) }
+      : {}),
+  },
+}))
+
+function choose(value: AdminAction) {
+  action.value = value
+  validation.value = false
+  actionError.value = null
+}
+
+async function decide() {
+  if (busy.value || conflict.value) return
+  if (!pending.value) {
+    if (!data.value || !action.value) return
+    if (requiredReason.value && !reason.value.trim()) {
+      validation.value = true
+      return
+    }
+    pending.value = {
+      action: action.value,
+      revision: data.value.application.revision,
+      reason: reason.value.trim(),
+      idempotencyKey: crypto.randomUUID(),
+    }
+  }
+  busy.value = true
+  actionError.value = null
+  try {
+    await api.post(`${path}/decisions`, { ...pending.value })
+    pending.value = null
+    await navigateTo({ ...back.value, query: { ...back.value.query, decided: '1' } })
+  } catch (cause) {
+    const failure = cause as {
+      statusCode?: number
+      status?: number
+      data?: { current?: typeof conflict.value; data?: { current?: typeof conflict.value } }
+    }
+    const code = failure.statusCode ?? failure.status
+    actionError.value = cause
+    if (code === 409) {
+      conflict.value =
+        failure.data?.current ?? failure.data?.data?.current ?? data.value?.application ?? null
+      pending.value = null
+      action.value = null
+    } else if (code && code >= 400 && code < 500 && code !== 408 && code !== 429) {
+      pending.value = null
+    }
+    if (code === 401 || code === 403) clear()
+  } finally {
+    busy.value = false
+  }
+}
+
+function clear() {
+  data.value = undefined
+  documentLinks.value = {}
+}
+
+async function reviewCurrent() {
+  await refresh()
+  if (!error.value) {
+    conflict.value = null
+    action.value = null
+    reason.value = ''
+    actionError.value = null
+  }
+}
+
+async function prepareDocument(id: string) {
+  if (documentBusy.value) return
+  documentBusy.value = id
+  failedDocument.value = id
+  documentError.value = null
+  try {
+    const link = await api.post<{ url: string; expiresAt: string }>(
+      `documents/${encodeURIComponent(id)}/link`,
+    )
+    const url = new URL(link.url, window.location.origin)
+    if (url.origin !== window.location.origin || !url.pathname.startsWith('/api/admin/documents/'))
+      throw new Error('INVALID_DOCUMENT_LINK')
+    documentLinks.value[id] = link
+    failedDocument.value = null
+  } catch (cause) {
+    documentError.value = cause
+    const code = (cause as { statusCode?: number }).statusCode
+    if (code === 401 || code === 403) clear()
+  } finally {
+    documentBusy.value = null
+  }
+}
+
+useSeoMeta({ title: () => `${t('admin.reviewTitle')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('admin.reviewTitle')" :lead="$t('admin.reviewIntro')" />
+    <AdminNav />
+    <UButton class="mb-6" :to="back" color="neutral" variant="outline">{{
+      $t('admin.back')
+    }}</UButton>
+    <AdminError :error="error" @retry="refresh()" />
+    <AdminError
+      v-if="!conflict"
+      :error="actionError"
+      @retry="pending ? decide() : reviewCurrent()"
+    />
+    <AdminError
+      v-if="!data"
+      :error="documentError"
+      @retry="failedDocument && prepareDocument(failedDocument)"
+    />
+    <StatusBox v-if="conflict" tone="warning" role="alert">
+      <p>{{ $t('admin.errors.conflict') }}</p>
+      <p>
+        {{ $t('admin.currentStatus') }}: {{ $t(`admin.status.${conflict.status}`) }} ·
+        {{ api.date(conflict.reviewed_at) }}
+      </p>
+      <p v-if="conflict.review_reason" class="whitespace-pre-wrap">{{ conflict.review_reason }}</p>
+      <UButton color="neutral" variant="outline" @click="reviewCurrent">{{
+        $t('admin.reviewCurrent')
+      }}</UButton>
+    </StatusBox>
+    <StatusBox v-if="pending && !busy" tone="warning">
+      <p>{{ $t('admin.ambiguousDecision') }}</p>
+      <p>{{ $t(`admin.actions.${pending.action}`) }} · {{ pending.reason }}</p>
+      <UButton @click="decide">{{ $t('admin.retryDecision') }}</UButton>
+    </StatusBox>
+    <EmptyState v-if="status === 'pending' && !data" loading />
+    <template v-else-if="!error && data">
+      <div class="grid gap-6 lg:grid-cols-[2fr_1fr]">
+        <div class="space-y-6">
+          <UCard>
+            <h2 class="text-xl font-semibold">{{ $t('admin.checklist.title') }}</h2>
+            <ul class="mt-4 grid gap-3 sm:grid-cols-2">
+              <li
+                v-for="item in checklist"
+                :key="item.label"
+                class="flex items-center gap-3 rounded border border-default p-3"
+              >
+                <span aria-hidden="true">{{ item.complete ? '✓' : '!' }}</span>
+                <span>{{ item.label }}</span>
+                <span class="sr-only">{{
+                  $t(item.complete ? 'admin.checklist.complete' : 'admin.checklist.attention')
+                }}</span>
+              </li>
+            </ul>
+          </UCard>
+          <UCard>
+            <div class="flex flex-wrap items-center justify-between gap-3">
+              <h2 class="text-2xl font-semibold">{{ data.application.name }}</h2>
+              <UBadge color="neutral">{{ $t(`admin.status.${data.application.status}`) }}</UBadge>
+            </div>
+            <MetadataList class="mt-5">
+              <dt>{{ $t('admin.role') }}</dt>
+              <dd>{{ $t(`auth.roles.${data.application.role}`) }}</dd>
+              <dt>{{ $t('admin.submitted') }}</dt>
+              <dd>{{ api.date(data.application.submitted_at) }}</dd>
+              <dt>{{ $t('admin.website') }}</dt>
+              <dd class="break-all">{{ data.application.website || '—' }}</dd>
+              <dt>{{ $t('admin.contact') }}</dt>
+              <dd>{{ data.application.contact || '—' }}</dd>
+              <dt>{{ $t('admin.jurisdiction') }}</dt>
+              <dd>{{ data.application.jurisdiction || '—' }}</dd>
+              <dt>{{ $t('admin.responsible') }}</dt>
+              <dd>{{ data.application.responsible_name || '—' }}</dd>
+              <dt>{{ $t('auth.email') }}</dt>
+              <dd>{{ data.application.responsible_email || $t('admin.noEmail') }}</dd>
+            </MetadataList>
+            <h3 class="mt-5 font-semibold">{{ $t('admin.description') }}</h3>
+            <p class="mt-2 whitespace-pre-wrap text-sm">
+              {{ data.application.description || '—' }}
+            </p>
+            <h3 class="mt-5 font-semibold">{{ $t('admin.purpose') }}</h3>
+            <p class="mt-2 whitespace-pre-wrap text-sm">{{ data.application.purpose || '—' }}</p>
+          </UCard>
+          <UCard>
+            <h2 class="text-xl font-semibold">{{ $t('admin.documents') }}</h2>
+            <p class="mt-2 text-sm text-muted">{{ $t('admin.documentHelp') }}</p>
+            <AdminError
+              class="mt-3"
+              :error="documentError"
+              @retry="failedDocument && prepareDocument(failedDocument)"
+            />
+            <p v-if="documentError" class="text-sm">{{ $t('admin.documentFailure') }}</p>
+            <EmptyState v-if="!data.documents.length">{{ $t('admin.noDocuments') }}</EmptyState>
+            <ul v-else class="mt-4 space-y-4">
+              <li v-for="(document, index) in data.documents" :key="document.id">
+                <p class="text-sm">
+                  {{ $t('admin.document', { number: index + 1 }) }} · {{ document.mime_type }} ·
+                  {{ $t('admin.bytes', { count: document.byte_length }) }}
+                </p>
+                <div class="mt-2 flex flex-wrap gap-3">
+                  <UButton
+                    size="sm"
+                    variant="outline"
+                    color="neutral"
+                    :loading="documentBusy === document.id"
+                    :disabled="documentBusy !== null"
+                    @click="prepareDocument(document.id)"
+                    >{{
+                      $t(documentLinks[document.id] ? 'admin.renewLink' : 'admin.prepareDocument')
+                    }}</UButton
+                  >
+                  <UButton
+                    v-if="documentLinks[document.id]"
+                    size="sm"
+                    :href="documentLinks[document.id]!.url"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    >{{ $t('admin.openDocument') }}</UButton
+                  >
+                </div>
+                <p v-if="documentLinks[document.id]" class="mt-2 text-xs text-muted">
+                  {{
+                    $t('admin.linkExpires', {
+                      date: api.date(documentLinks[document.id]!.expiresAt),
+                    })
+                  }}
+                </p>
+              </li>
+            </ul>
+          </UCard>
+          <UCard>
+            <h2 class="text-xl font-semibold">{{ $t('auth.linkedWallets') }}</h2>
+            <p class="mt-2 text-sm text-muted">{{ $t('admin.walletCaveat') }}</p>
+            <EmptyState v-if="!data.wallets.length">{{ $t('auth.noWallets') }}</EmptyState>
+            <ul v-else class="mt-4 space-y-3">
+              <li v-for="wallet in data.wallets" :key="`${wallet.network_id}:${wallet.address}`">
+                <p class="break-all font-mono text-sm">{{ wallet.address }}</p>
+                <p class="mt-1 text-xs text-muted">
+                  {{ $t('auth.network') }} {{ wallet.network_id }} · {{ $t('auth.verifiedAt') }}
+                  {{ api.date(wallet.verified_at) }}
+                </p>
+              </li>
+            </ul>
+          </UCard>
+        </div>
+        <div class="lg:sticky lg:top-6 lg:self-start">
+          <UCard>
+            <h2 class="text-xl font-semibold">{{ $t('admin.decision') }}</h2>
+            <dl class="mt-4 grid gap-2 text-sm">
+              <div class="flex justify-between gap-4">
+                <dt>{{ $t('admin.currentStatus') }}</dt>
+                <dd class="font-semibold">{{ $t(`admin.status.${data.application.status}`) }}</dd>
+              </div>
+              <div class="flex justify-between gap-4">
+                <dt>{{ $t('admin.revision') }}</dt>
+                <dd>{{ data.application.revision }}</dd>
+              </div>
+              <div v-if="data.application.review_reason">
+                <dt class="font-semibold">{{ $t('admin.lastReason') }}</dt>
+                <dd class="mt-1 whitespace-pre-wrap">{{ data.application.review_reason }}</dd>
+              </div>
+            </dl>
+            <p class="mt-3 text-sm">{{ $t('admin.approvalCaveat') }}</p>
+            <p class="mt-3 text-sm text-muted">{{ $t('admin.privateClaims') }}</p>
+            <div v-if="actions.length" class="mt-5 flex flex-wrap gap-3">
+              <UButton
+                v-for="value in actions"
+                :key="value"
+                :color="['reject', 'suspend'].includes(value) ? 'error' : 'primary'"
+                :variant="action === value ? 'solid' : 'outline'"
+                :disabled="busy || pending !== null"
+                @click="choose(value)"
+                >{{ $t(`admin.actions.${value}`) }}</UButton
+              >
+            </div>
+            <form v-if="action && !pending" class="mt-5 space-y-4" @submit.prevent="decide">
+              <p class="text-sm font-medium">
+                {{
+                  $t('admin.confirmDecision', {
+                    action: $t(`admin.actions.${action}`),
+                    role: $t(`auth.roles.${data.application.role}`),
+                    name: data.application.name,
+                  })
+                }}
+              </p>
+              <UFormField
+                :label="$t(requiredReason ? 'admin.reasonRequired' : 'admin.reasonOptional')"
+                :required="requiredReason"
+                :error="validation ? $t('admin.missingReason') : undefined"
+              >
+                <UTextarea
+                  v-model="reason"
+                  class="w-full"
+                  :rows="4"
+                  :maxlength="2000"
+                  :disabled="busy"
+                  :aria-invalid="validation"
+                  @update:model-value="validation = false"
+                />
+              </UFormField>
+              <UButton
+                type="submit"
+                :loading="busy"
+                :disabled="busy"
+                data-testid="admin-confirm-decision"
+                >{{ $t('admin.confirm') }}</UButton
+              >
+            </form>
+            <p v-if="!actions.length && !conflict" class="mt-4 text-sm text-muted">
+              {{ $t('admin.noDecision') }}
+            </p>
+          </UCard>
+        </div>
+      </div>
+      <section class="mt-8" aria-labelledby="application-history">
+        <h2 id="application-history" class="mb-4 text-2xl font-semibold">
+          {{ $t('admin.applicationHistory') }}
+        </h2>
+        <AdminHistory :items="data.history" @retried="refresh()" />
+      </section>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/admin/audit.vue b/apps/web/app/pages/admin/audit.vue
new file mode 100644
index 0000000..608e098
--- /dev/null
+++ b/apps/web/app/pages/admin/audit.vue
@@ -0,0 +1,32 @@
+<script setup lang="ts">
+import type { AdminAudit, AdminPage } from '~/composables/useAdminApi'
+definePageMeta({ middleware: ['auth', 'role'], requiredRole: 'admin' })
+const { t } = useI18n()
+const route = useRoute()
+const api = useAdminApi()
+const page = computed(() => Math.max(1, Math.floor(Number(route.query.page) || 1)))
+const { data, status, error, refresh } = await useAsyncData(
+  'admin-audit',
+  () => api.get<AdminPage<AdminAudit>>('audit', { page: page.value }),
+  { watch: [page] },
+)
+useSeoMeta({ title: () => `${t('admin.audit')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('admin.audit')" :lead="$t('admin.auditIntro')" />
+    <AdminNav />
+    <AdminError :error="error" @retry="refresh()" />
+    <EmptyState v-if="status === 'pending' && !data" loading />
+    <template v-else-if="!error && data">
+      <AdminHistory :items="data.items" @retried="refresh()" />
+      <AdminPager
+        :page="page"
+        :page-size="data.pageSize"
+        :total="data.total"
+        @change="navigateTo({ path: route.path, query: { page: $event } })"
+      />
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/admin/index.vue b/apps/web/app/pages/admin/index.vue
new file mode 100644
index 0000000..3d24bd4
--- /dev/null
+++ b/apps/web/app/pages/admin/index.vue
@@ -0,0 +1,13 @@
+<script setup lang="ts">
+definePageMeta({ middleware: ['auth', 'role'], requiredRole: 'admin' })
+const { t } = useI18n()
+useSeoMeta({ title: () => `${t('admin.queue')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('admin.queue')" :lead="$t('admin.queueIntro')" />
+    <AdminNav />
+    <AdminApplications />
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/admin/verifiers.vue b/apps/web/app/pages/admin/verifiers.vue
new file mode 100644
index 0000000..d1c1047
--- /dev/null
+++ b/apps/web/app/pages/admin/verifiers.vue
@@ -0,0 +1,14 @@
+<script setup lang="ts">
+definePageMeta({ middleware: ['auth', 'role'], requiredRole: 'admin' })
+const { t } = useI18n()
+useSeoMeta({ title: () => `${t('admin.verifiers')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('admin.verifiers')" :lead="$t('admin.verifiersIntro')" />
+    <AdminNav />
+    <StatusBox>{{ $t('admin.privateClaims') }}</StatusBox>
+    <AdminApplications verifiers />
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/auth/login.vue b/apps/web/app/pages/auth/login.vue
new file mode 100644
index 0000000..55b4f1a
--- /dev/null
+++ b/apps/web/app/pages/auth/login.vue
@@ -0,0 +1,32 @@
+<script setup lang="ts">
+import { authReturnPath } from '~/utils/portalRoutes'
+const { t } = useI18n()
+const localePath = useLocalePath()
+const route = useRoute()
+const { load, enabled, user, unavailable } = useAuth()
+await load()
+const returnTo = computed(() => authReturnPath(route.query.returnTo ?? localePath('/account')))
+if (user.value) await navigateTo(returnTo.value, { replace: true })
+const loginUrl = computed(() => `/api/auth/login?returnTo=${encodeURIComponent(returnTo.value)}`)
+useSeoMeta({ title: () => `${t('auth.signIn')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('auth.signIn')" :lead="$t('auth.loginIntro')" />
+    <StatusBox v-if="unavailable" tone="error">{{ $t('auth.unavailable') }}</StatusBox>
+    <StatusBox v-else-if="!enabled" tone="notice">{{ $t('auth.disabled') }}</StatusBox>
+    <template v-else>
+      <StatusBox v-if="route.query.error" tone="error" class="mb-5">{{
+        $t('auth.loginFailed')
+      }}</StatusBox>
+      <UButton :href="loginUrl" external data-testid="auth-signin">{{
+        $t('auth.continue')
+      }}</UButton>
+    </template>
+    <p class="mt-6 text-sm text-muted">{{ $t('auth.walletSeparate') }}</p>
+    <UButton class="mt-4" :to="localePath('/')" color="neutral" variant="link">{{
+      $t('auth.backHome')
+    }}</UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/auth/not-authorized.vue b/apps/web/app/pages/auth/not-authorized.vue
new file mode 100644
index 0000000..91154fc
--- /dev/null
+++ b/apps/web/app/pages/auth/not-authorized.vue
@@ -0,0 +1,21 @@
+<script setup lang="ts">
+const { t } = useI18n()
+const route = useRoute()
+const localePath = useLocalePath()
+useSeoMeta({ title: () => `${t('auth.notAuthorized')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="py-10 sm:py-14">
+    <PageHeader :title="$t('auth.notAuthorized')" />
+    <StatusBox :tone="route.query.reason === 'unavailable' ? 'error' : 'warning'">
+      {{ $t(route.query.reason === 'unavailable' ? 'auth.unavailable' : 'auth.notAuthorizedHelp') }}
+    </StatusBox>
+    <div class="mt-6 flex flex-wrap gap-3">
+      <UButton :to="localePath('/account')">{{ $t('auth.account') }}</UButton>
+      <UButton :to="localePath('/')" color="neutral" variant="outline">{{
+        $t('auth.backHome')
+      }}</UButton>
+    </div>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/credentials/[generationId].vue b/apps/web/app/pages/credentials/[generationId].vue
index 9f0b6f8..de33eed 100644
--- a/apps/web/app/pages/credentials/[generationId].vue
+++ b/apps/web/app/pages/credentials/[generationId].vue
@@ -14,12 +14,7 @@ import {
   type PayloadFetchConsentToken,
 } from '~/utils/credentialReview'
 import { decodeUtf8HexForDisplay, displayXrplTime } from '~/utils/explorer'
-import {
-  assertLinkProfile,
-  buildCredentialAcceptLink,
-  credentialPermalinkSubjectAction,
-  singleRouteQueryValue,
-} from '~/utils/operationLinks'
+import { assertLinkProfile, singleRouteQueryValue } from '~/utils/operationLinks'
 import { LOCAL_PAYLOAD_LOCATION } from '~/utils/localPayloadStore'
 
 interface ExactCredentialEvidence {
@@ -180,26 +175,6 @@ const claimRows = computed(() => {
   const schema = data.value?.schema.resolved
   return claims && schema ? credentialClaimsToRows(schema, claims) : []
 })
-const subjectActionLink = computed(() => {
-  const evidence = data.value
-  if (!evidence?.currentGeneration) return null
-  const state = evidence.detail.state
-  const generation = evidence.detail.generation
-  const action = credentialPermalinkSubjectAction({
-    currentGeneration: evidence.currentGeneration,
-    accepted: generation.accepted,
-    state,
-  })
-  if (action === null) return null
-  return buildCredentialAcceptLink({
-    profileId: evidence.profileId,
-    issuer: generation.issuer,
-    schemaUid: generation.schemaUid,
-    generationId: generation.generationId,
-    action,
-  })
-})
-
 function clearPayloadReview(): void {
   verificationRevision += 1
   payloadConsentToken.value = null
@@ -410,24 +385,6 @@ useSeoMeta({
         <span v-else-if="copyState === 'error'" class="text-sm text-error" role="status">
           {{ $t('credential.copyFailed') }}
         </span>
-        <UButton
-          v-if="subjectActionLink"
-          color="neutral"
-          variant="outline"
-          size="sm"
-          data-testid="credential-subject-action"
-          :to="localePath(subjectActionLink)"
-        >
-          {{
-            $t(
-              data.detail.generation.accepted
-                ? 'credential.removeCredential'
-                : data.detail.state === 'expired'
-                  ? 'credential.rejectExpired'
-                  : 'credential.managePending',
-            )
-          }}
-        </UButton>
       </div>
 
       <MetadataList data-testid="explorer-metadata">
diff --git a/apps/web/app/pages/credentials/index.vue b/apps/web/app/pages/credentials/index.vue
new file mode 100644
index 0000000..e64876e
--- /dev/null
+++ b/apps/web/app/pages/credentials/index.vue
@@ -0,0 +1,164 @@
+<script setup lang="ts">
+import { connectAndValidateNetwork } from '#xcs/sdk/index.js'
+import {
+  loadWalletCredentialCandidates,
+  resolveWalletCredentialInbox,
+  type WalletCredentialInboxItem,
+} from '~/utils/credentialInbox'
+import { displayDate, httpStatusFromError } from '~/utils/explorer'
+import { assertPublicRpcUrl } from '~/utils/publicRpcUrl'
+
+const { t, locale } = useI18n()
+const localePath = useLocalePath()
+const { $xrplClientFactory } = useNuxtApp()
+const { account } = useWallet()
+const { getActiveNetworkProfile, getCredential } = useXcsApi()
+const credentials = shallowRef<WalletCredentialInboxItem[]>([])
+const profileId = ref('')
+const loading = ref(false)
+const errorCode = ref('')
+let requestRevision = 0
+
+const subject = computed(() => account.value?.address ?? '')
+
+function expirationLabel(credential: WalletCredentialInboxItem): string {
+  if (credential.expiration === null) return t('walletSpace.noExpiration')
+  return displayDate(credential.expiration, locale.value) ?? credential.expiration
+}
+
+async function refresh(): Promise<void> {
+  const request = ++requestRevision
+  const expectedSubject = subject.value
+  credentials.value = []
+  profileId.value = ''
+  errorCode.value = ''
+  if (!expectedSubject) {
+    loading.value = false
+    return
+  }
+
+  loading.value = true
+  const config = useRuntimeConfig()
+  const client = $xrplClientFactory(assertPublicRpcUrl(config.public.rpcUrl))
+  try {
+    const profile = await getActiveNetworkProfile()
+    await connectAndValidateNetwork(client, profile)
+    const candidates = await loadWalletCredentialCandidates(client, expectedSubject)
+    const pendingCredentials = await resolveWalletCredentialInbox(candidates, async (candidate) => {
+      try {
+        return await getCredential(
+          candidate.issuer,
+          candidate.subject,
+          candidate.schemaUid,
+          profile.profileId,
+        )
+      } catch (error) {
+        // A native 32-byte CredentialType is only XCS when the exact projection
+        // recognizes its schema and generation. Non-XCS tuples are omitted.
+        if (httpStatusFromError(error) === 404) return undefined
+        throw error
+      }
+    })
+    if (request !== requestRevision || subject.value !== expectedSubject) return
+    profileId.value = profile.profileId
+    credentials.value = pendingCredentials
+  } catch (error) {
+    if (request !== requestRevision || subject.value !== expectedSubject) return
+    errorCode.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    if (client.isConnected()) await client.disconnect().catch(() => undefined)
+    if (request === requestRevision) loading.value = false
+  }
+}
+
+watch(subject, () => void refresh(), { immediate: true })
+onBeforeUnmount(() => {
+  requestRevision += 1
+})
+
+useSeoMeta({
+  title: () => `${t('walletSpace.title')} — XCS`,
+  description: () => t('walletSpace.description'),
+  robots: 'noindex,nofollow',
+})
+</script>
+
+<template>
+  <UContainer class="py-8 sm:py-12">
+    <PageHeader
+      eyebrow="Wallet · XRPL Testnet"
+      :title="$t('walletSpace.title')"
+      :lead="$t('walletSpace.description')"
+    >
+      <template #actions>
+        <UButton
+          v-if="account"
+          color="neutral"
+          variant="outline"
+          :disabled="loading"
+          data-testid="wallet-inbox-refresh"
+          @click="refresh"
+        >
+          {{ $t('walletSpace.refresh') }}
+        </UButton>
+      </template>
+    </PageHeader>
+    <EmptyState v-if="!account" data-testid="wallet-inbox-disconnected">{{
+      $t('walletSpace.connectFirst')
+    }}</EmptyState>
+    <template v-else>
+      <StatusBox>
+        <strong>{{ $t('walletSpace.address') }}</strong>
+        <code class="block">{{ account.address }}</code>
+      </StatusBox>
+      <p class="mb-6 text-sm text-muted">{{ $t('walletSpace.privacy') }}</p>
+      <p v-if="loading" class="py-8 text-muted" role="status">{{ $t('walletSpace.loading') }}</p>
+      <StatusBox v-else-if="errorCode" tone="error" :title="$t('walletSpace.error')">
+        <p>
+          <code>{{ errorCode }}</code>
+        </p>
+        <UButton color="neutral" variant="outline" @click="refresh">{{
+          $t('common.retry')
+        }}</UButton>
+      </StatusBox>
+      <EmptyState v-else-if="credentials.length === 0" data-testid="wallet-inbox-empty">{{
+        $t('walletSpace.empty')
+      }}</EmptyState>
+      <div v-else class="grid gap-6" data-testid="wallet-inbox-list">
+        <UCard
+          v-for="credential in credentials"
+          :key="credential.ledgerObjectId"
+          data-testid="wallet-inbox-credential"
+        >
+          <template #header>
+            <div class="flex flex-wrap items-center justify-between gap-4">
+              <div>
+                <p class="text-xs font-semibold tracking-[0.2em] text-muted uppercase">
+                  {{ $t(`walletSpace.states.${credential.state}`) }}
+                </p>
+                <h2 class="text-xl font-semibold">{{ $t('walletSpace.credential') }}</h2>
+              </div>
+              <UButton :to="localePath('/recipient')">{{ $t('recipient.title') }}</UButton>
+            </div>
+          </template>
+          <MetadataList>
+            <dt>{{ $t('walletSpace.issuer') }}</dt>
+            <dd>
+              <code>{{ credential.issuer }}</code>
+            </dd>
+            <dt>{{ $t('walletSpace.schema') }}</dt>
+            <dd>
+              <code>{{ credential.schemaUid }}</code>
+            </dd>
+            <dt>{{ $t('walletSpace.expiration') }}</dt>
+            <dd>{{ expirationLabel(credential) }}</dd>
+            <dt>{{ $t('walletSpace.generation') }}</dt>
+            <dd>
+              <code>{{ credential.generationId }}</code>
+            </dd>
+          </MetadataList>
+        </UCard>
+      </div>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/developers.vue b/apps/web/app/pages/developers.vue
index 806ab93..838bb47 100644
--- a/apps/web/app/pages/developers.vue
+++ b/apps/web/app/pages/developers.vue
@@ -26,7 +26,6 @@ interface DeveloperEvidence {
 const localePath = useLocalePath()
 const { t } = useI18n()
 const { getActiveNetworkProfile, getCredentialGeneration, getSchema, verify } = useXcsApi()
-// The read API is served by this application, so its base is this origin.
 const apiBaseUrl = normalizeDeveloperApiBaseUrl(useRequestURL().origin)
 const apiDocumentationUrl = computed(() => `${apiBaseUrl}/documentation`)
 
diff --git a/apps/web/app/pages/index.vue b/apps/web/app/pages/index.vue
index f4f9a54..2b7302d 100644
--- a/apps/web/app/pages/index.vue
+++ b/apps/web/app/pages/index.vue
@@ -2,24 +2,73 @@
 const { getStats } = useXcsApi()
 const { locale, t } = useI18n()
 const localePath = useLocalePath()
+const auth = useAuth()
+const issuerEnabled = String(useRuntimeConfig().public.issuerEnabled) === '1'
+await auth.load()
+const simpleNavigation = computed(() => issuerEnabled && auth.enabled.value)
+const actions = computed(() => [
+  { name: 'receive', to: '/recipient', icon: 'i-lucide-inbox' },
+  {
+    name: 'issue',
+    to: auth.hasRole('issuer') ? '/issuer' : '/issuer/application',
+    icon: 'i-lucide-send',
+  },
+  { name: 'verify', to: '/presentations', icon: 'i-lucide-badge-check' },
+])
 const {
   data: stats,
   pending,
   error,
   refresh,
-} = await useAsyncData('explorer-stats', () => getStats())
+} = await useAsyncData('explorer-stats', () => getStats(), {
+  immediate: !simpleNavigation.value,
+})
 
 const numberFormat = computed(() => new Intl.NumberFormat(locale.value))
 
 useSeoMeta({
-  title: () => t('home.metaTitle'),
-  description: () => t('home.description'),
+  title: () => t(simpleNavigation.value ? 'simpleNavigation.metaTitle' : 'home.metaTitle'),
+  description: () =>
+    t(simpleNavigation.value ? 'simpleNavigation.description' : 'home.description'),
   robots: 'index,follow',
 })
 </script>
 
 <template>
-  <div>
+  <div v-if="simpleNavigation" data-testid="simple-home">
+    <UContainer class="py-16 sm:py-24">
+      <div class="max-w-3xl">
+        <p class="mb-4 text-sm font-semibold text-muted">{{ $t('simpleNavigation.eyebrow') }}</p>
+        <h1 class="text-4xl leading-tight tracking-tight sm:text-5xl">
+          {{ $t('simpleNavigation.title') }}
+        </h1>
+        <p class="mt-6 max-w-2xl text-lg text-toned">{{ $t('simpleNavigation.description') }}</p>
+      </div>
+      <nav
+        class="mt-12 grid gap-5 md:grid-cols-3"
+        :aria-label="$t('simpleNavigation.actionsLabel')"
+      >
+        <NuxtLink
+          v-for="action in actions"
+          :key="action.name"
+          :to="localePath(action.to)"
+          class="group rounded-xl border border-default bg-elevated p-6 text-default no-underline transition-colors hover:bg-accented focus-visible:outline-2 focus-visible:outline-offset-4 focus-visible:outline-primary"
+        >
+          <UIcon :name="action.icon" class="mb-5 size-7" aria-hidden="true" />
+          <h2 class="text-2xl font-semibold">{{ $t(`simpleNavigation.${action.name}`) }}</h2>
+          <p class="mt-3 text-sm leading-relaxed text-toned">
+            {{ $t(`simpleNavigation.${action.name}Description`) }}
+          </p>
+          <span class="mt-6 inline-flex items-center gap-2 font-semibold">
+            {{ $t(`simpleNavigation.${action.name}Action`) }}
+            <UIcon name="i-lucide-arrow-right" class="size-4" aria-hidden="true" />
+          </span>
+        </NuxtLink>
+      </nav>
+      <p class="mt-8 max-w-2xl text-sm text-muted">{{ $t('simpleNavigation.walletHelp') }}</p>
+    </UContainer>
+  </div>
+  <div v-else>
     <section
       class="relative isolate overflow-hidden bg-neutral-950 text-neutral-50"
       aria-labelledby="landing-title"
@@ -53,7 +102,7 @@ useSeoMeta({
           </h1>
           <p class="mt-6 max-w-2xl text-lg text-neutral-200">{{ $t('home.description') }}</p>
           <div class="mt-8 flex flex-wrap gap-3">
-            <UButton :to="localePath('/studio')" color="neutral" variant="outline" size="lg">
+            <UButton :to="localePath('/issuer')" color="neutral" variant="outline" size="lg">
               <span class="font-mono" aria-hidden="true">&gt;_</span>
               {{ $t('home.start') }}
             </UButton>
diff --git a/apps/web/app/pages/issue.vue b/apps/web/app/pages/issue.vue
index 42a4b9e..d659e56 100644
--- a/apps/web/app/pages/issue.vue
+++ b/apps/web/app/pages/issue.vue
@@ -1,730 +1,11 @@
 <script setup lang="ts">
-import {
-  createHttpsPayloadUri,
-  createIpfsPayloadUri,
-  encodeCredentialPayload,
-} from '#xcs/core/index.js'
-import { buildCredentialCreate } from '#xcs/sdk/index.js'
-import type { CredentialCreate } from 'xrpl'
-import type { WalletSubmissionResult } from '~/composables/useWallet'
-import { LocalPayloadPiiFieldError, type LocalPayloadPublication } from '~/utils/localPayloadStore'
-import {
-  claimsObjectToGuidedClaims,
-  guidedClaimsToJson,
-  guidedClaimsToPartialObject,
-  resolvedSchemaToGuidedClaims,
-  type GuidedClaimField,
-} from '~/utils/claimAuthoring'
-import { buildCredentialAcceptLink, buildCredentialPermalink } from '~/utils/operationLinks'
-import {
-  verifyHttpsPayloadPublication,
-  type PayloadPublicationProof,
-} from '~/utils/payloadPublication'
-import { parseWalletCredentialTransactionError } from '~/utils/walletCompatibility'
-import { parseJson } from '~/utils/serialization'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const route = useRoute()
-const localePath = useLocalePath()
-const { t } = useI18n()
-const { account, busy, prepare, signAndSubmit } = useWallet()
-const { getActiveNetworkProfile, getSchema } = useXcsApi()
-const localPayloadStore = useLocalPayloadStore()
-const localPayloadStoreEnabled = localPayloadStore.enabled
-
-const schemaUid = ref(typeof route.query.schema === 'string' ? route.query.schema : '')
-const subject = ref('')
-const claimsEditorMode = ref<'guided' | 'json'>('guided')
-const guidedClaims = ref<GuidedClaimField[]>([])
-const guidedClaimsError = ref('')
-const loadedSchemaUid = ref('')
-const loadedSchemaName = ref('')
-const schemaLoadBusy = ref(false)
-const claimsText = ref('{}')
-const storageMode = ref<'https' | 'local-test'>('https')
-const localStoreAcknowledged = ref(false)
-const localStoreNotice = ref('')
-const localPublication = shallowRef<LocalPayloadPublication | null>(null)
-const httpsUrl = ref('')
-const expiration = ref('')
-const publicationProof = ref<PayloadPublicationProof | null>(null)
-const publicationCheckBusy = ref(false)
-const flowBusy = ref(false)
-const canonicalPayload = ref('')
-const credentialUri = ref('')
-const transaction = shallowRef<CredentialCreate | null>(null)
-const preparedProfileId = ref('')
-const formError = ref('')
-const rejectedPiiFieldPath = ref('')
-const result = shallowRef<WalletSubmissionResult | null>(null)
-const issuedLinkInputs = shallowRef<{
-  profileId: string
-  issuer: string
-  subject: string
-  schemaUid: string
-} | null>(null)
-const submissionBusy = computed(() => busy.value || flowBusy.value)
-let previewRevision = 0
-
-const formErrorMessage = computed(() => {
-  const walletTransactionError = parseWalletCredentialTransactionError(formError.value)
-  if (walletTransactionError) {
-    return t('wallet.errors.credentialUnsupported', {
-      wallet: walletTransactionError.walletName,
-      transactionType: walletTransactionError.transactionType,
-    })
-  }
-  if (formError.value === 'PAYLOAD_HTTPS_URL_REQUIRED') {
-    return t('issue.errors.httpsUrlRequired')
-  }
-  if (formError.value === 'PAYLOAD_HTTPS_URL_PLACEHOLDER') {
-    return t('issue.errors.httpsUrlPlaceholder')
-  }
-  if (formError.value === 'PAYLOAD_FETCH_FAILED') {
-    return t('issue.errors.payloadFetchFailed')
-  }
-  if (formError.value === 'LOCAL_PAYLOAD_STORE_ACK_REQUIRED') {
-    return t('issue.localStore.errors.ackRequired')
-  }
-  if (formError.value === 'LOCAL_PAYLOAD_PII_FIELD_REJECTED') {
-    return t('issue.localStore.errors.pii', { field: rejectedPiiFieldPath.value })
-  }
-  if (formError.value === 'LOCAL_PAYLOAD_STORE_QUOTA_EXCEEDED') {
-    return t('issue.localStore.errors.quota')
-  }
-  if (formError.value === 'LOCAL_PAYLOAD_SIZE_INVALID') {
-    return t('issue.localStore.errors.size')
-  }
-  if (
-    formError.value === 'LOCAL_PAYLOAD_STORE_DISABLED' ||
-    formError.value === 'LOCAL_PAYLOAD_STORE_UNAVAILABLE' ||
-    formError.value === 'LOCAL_PAYLOAD_STORE_WRITE_FAILED'
-  ) {
-    return t('issue.localStore.errors.unavailable')
-  }
-  if (
-    formError.value === 'LOCAL_PAYLOAD_STORE_RECORD_INVALID' ||
-    formError.value === 'LOCAL_PAYLOAD_DIGEST_MISMATCH' ||
-    formError.value === 'LOCAL_PAYLOAD_BYTES_MISMATCH' ||
-    formError.value === 'PUBLISHED_PAYLOAD_BYTES_MISMATCH'
-  ) {
-    return t('issue.localStore.errors.integrity')
-  }
-  if (
-    formError.value === 'LOCAL_PAYLOAD_NOT_FOUND' ||
-    formError.value === 'LOCAL_PAYLOAD_EXPIRED'
-  ) {
-    return t('issue.localStore.errors.missing')
-  }
-  return formError.value
-})
-
-const formErrorIsLocalized = computed(
-  () => formError.value.length > 0 && formErrorMessage.value !== formError.value,
-)
-
-function assertPayloadHttpsUrlIsConfigured(value: string): void {
-  if (value.length === 0) throw new Error('PAYLOAD_HTTPS_URL_REQUIRED')
-
-  let url: URL
-  try {
-    url = new URL(value)
-  } catch {
-    throw new Error('PAYLOAD_HTTPS_URL_REQUIRED')
-  }
-  const hostname = url.hostname.toLowerCase().replace(/\.$/u, '')
-  if (hostname === 'example' || hostname.endsWith('.example')) {
-    throw new Error('PAYLOAD_HTTPS_URL_PLACEHOLDER')
-  }
-}
-
-function invalidatePreview() {
-  previewRevision += 1
-  publicationProof.value = null
-  localPublication.value = null
-  localStoreNotice.value = ''
-  canonicalPayload.value = ''
-  credentialUri.value = ''
-  transaction.value = null
-  preparedProfileId.value = ''
-  result.value = null
-  issuedLinkInputs.value = null
-}
-
-watch([schemaUid, subject, claimsText, httpsUrl, expiration], invalidatePreview)
-watch(claimsEditorMode, invalidatePreview)
-watch([storageMode, localStoreAcknowledged], invalidatePreview)
-watch(
-  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
-  invalidatePreview,
-)
-watch(schemaUid, (value) => {
-  if (value.toLowerCase() === loadedSchemaUid.value) return
-  guidedClaims.value = []
-  guidedClaimsError.value = ''
-  loadedSchemaUid.value = ''
-  loadedSchemaName.value = ''
-})
-watch(
-  guidedClaims,
-  (fields) => {
-    if (claimsEditorMode.value !== 'guided') return
-    invalidatePreview()
-    try {
-      claimsText.value = JSON.stringify(guidedClaimsToPartialObject(fields), null, 2)
-      guidedClaimsToJson(fields)
-      guidedClaimsError.value = ''
-    } catch (error) {
-      guidedClaimsError.value = error instanceof Error ? error.message : String(error)
-    }
-  },
-  { deep: true },
-)
-
-async function loadGuidedClaimForm() {
-  const requestedUid = schemaUid.value.toLowerCase()
-  formError.value = ''
-  if (!/^[0-9a-f]{64}$/.test(requestedUid)) {
-    formError.value = 'SCHEMA_UID_INVALID'
-    return
-  }
-  schemaLoadBusy.value = true
-  try {
-    const profile = await getActiveNetworkProfile()
-    const schema = await getSchema(requestedUid, profile.profileId)
-    if (schemaUid.value.toLowerCase() !== requestedUid) {
-      throw new Error('SCHEMA_CHANGED_DURING_LOAD')
-    }
-    guidedClaims.value = claimsObjectToGuidedClaims(
-      resolvedSchemaToGuidedClaims(schema.resolved),
-      parseJson(claimsText.value),
-    )
-    loadedSchemaUid.value = requestedUid
-    loadedSchemaName.value = schema.name
-    invalidatePreview()
-    claimsEditorMode.value = 'guided'
-    guidedClaimsError.value = ''
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    schemaLoadBusy.value = false
-  }
-}
-
-function selectClaimsEditorMode(mode: 'guided' | 'json') {
-  if (mode === claimsEditorMode.value) return
-  formError.value = ''
-  if (mode === 'json') {
-    claimsText.value = JSON.stringify(guidedClaimsToPartialObject(guidedClaims.value), null, 2)
-    claimsEditorMode.value = mode
-    return
-  }
-  if (loadedSchemaUid.value !== schemaUid.value.toLowerCase() || guidedClaims.value.length === 0) {
-    formError.value = 'GUIDED_CLAIMS_SCHEMA_REQUIRED'
-    return
-  }
-  let convertedClaims: GuidedClaimField[]
-  try {
-    convertedClaims = claimsObjectToGuidedClaims(guidedClaims.value, parseJson(claimsText.value))
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-    return
-  }
-  invalidatePreview()
-  guidedClaims.value = convertedClaims
-  claimsEditorMode.value = mode
-}
-
-function downloadPayload() {
-  const blob = new Blob([canonicalPayload.value], { type: 'application/json' })
-  const url = URL.createObjectURL(blob)
-  const anchor = document.createElement('a')
-  anchor.href = url
-  anchor.download = 'xcs-credential.json'
-  anchor.click()
-  URL.revokeObjectURL(url)
-}
-
-function clearLocalPayloadStore() {
-  formError.value = ''
-  try {
-    const removed = localPayloadStore.clear()
-    invalidatePreview()
-    localStoreNotice.value = t('issue.localStore.cleared', { count: removed })
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function buildPreview() {
-  invalidatePreview()
-  formError.value = ''
-  rejectedPiiFieldPath.value = ''
-  result.value = null
-  if (!account.value) return void (formError.value = 'WALLET_NOT_CONNECTED')
-  const revision = previewRevision
-  const issuerAddress = account.value.address
-  const normalizedSchemaUid = schemaUid.value.toLowerCase()
-  const subjectAddress = subject.value
-  let claimsInput = claimsText.value
-  const payloadUrl = httpsUrl.value
-  const expirationInput = expiration.value
-  const selectedStorageMode = storageMode.value
-  const localStoreConsent = localStoreAcknowledged.value
-  try {
-    if (claimsEditorMode.value === 'guided') {
-      if (loadedSchemaUid.value !== normalizedSchemaUid) {
-        throw new Error('GUIDED_CLAIMS_SCHEMA_REQUIRED')
-      }
-      claimsInput = guidedClaimsToJson(guidedClaims.value)
-      claimsText.value = claimsInput
-    }
-    if (selectedStorageMode === 'https') {
-      assertPayloadHttpsUrlIsConfigured(payloadUrl)
-    } else {
-      if (!localPayloadStore.enabled.value) throw new Error('LOCAL_PAYLOAD_STORE_DISABLED')
-      if (!localStoreConsent) throw new Error('LOCAL_PAYLOAD_STORE_ACK_REQUIRED')
-    }
-    const profile = await getActiveNetworkProfile()
-    const schema = await getSchema(normalizedSchemaUid, profile.profileId)
-    if (revision !== previewRevision) throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_BUILD')
-    const claims = parseJson(claimsInput)
-    const canonical = encodeCredentialPayload(claims, {
-      issuer: issuerAddress,
-      subject: subjectAddress,
-      schemaUid: normalizedSchemaUid,
-      fields: schema.resolved.fields,
-    }).json
-    canonicalPayload.value = canonical
-    credentialUri.value =
-      selectedStorageMode === 'local-test'
-        ? createIpfsPayloadUri(canonical)
-        : createHttpsPayloadUri(payloadUrl, canonical)
-    const raw = buildCredentialCreate({
-      issuer: issuerAddress,
-      subject: subjectAddress,
-      schemaUid: normalizedSchemaUid,
-      uri: credentialUri.value,
-      ...(expirationInput ? { expiration: new Date(expirationInput).toISOString() } : {}),
-    })
-    const prepared = (await prepare(raw, profile)) as CredentialCreate
-    if (revision !== previewRevision) throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_BUILD')
-    if (selectedStorageMode === 'local-test') {
-      const stored = localPayloadStore.publish(canonical, {
-        nonPersonalTestDataAcknowledged: localStoreConsent,
-      })
-      if (stored.credentialUri !== credentialUri.value) {
-        throw new Error('LOCAL_PAYLOAD_DIGEST_MISMATCH')
-      }
-      localPublication.value = stored
-    }
-    transaction.value = prepared
-    preparedProfileId.value = profile.profileId
-  } catch (error) {
-    transaction.value = null
-    if (error instanceof LocalPayloadPiiFieldError) {
-      rejectedPiiFieldPath.value = error.fieldPath
-    }
-    formError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function submit() {
-  const preparedTransaction = transaction.value
-  const expectedPayload = canonicalPayload.value
-  const expectedUri = credentialUri.value
-  const expectedIssuer = account.value?.address
-  const expectedSubject = subject.value
-  const expectedSchemaUid = schemaUid.value.toLowerCase()
-  const expectedClaims = claimsText.value
-  const expectedClaimsEditorMode = claimsEditorMode.value
-  const expectedGuidedClaims = JSON.stringify(guidedClaims.value)
-  const expectedHttpsUrl = httpsUrl.value
-  const expectedStorageMode = storageMode.value
-  const expectedLocalStoreAcknowledged = localStoreAcknowledged.value
-  const expectedLocalPublication = localPublication.value
-  const expectedExpiration = expiration.value
-  const expectedProfileId = preparedProfileId.value
-  const expectedRevision = previewRevision
-  if (
-    !preparedTransaction ||
-    !expectedPayload ||
-    !expectedUri ||
-    !expectedIssuer ||
-    !expectedProfileId
-  ) {
-    formError.value = 'TRANSACTION_PREVIEW_REQUIRED'
-    return
-  }
-
-  flowBusy.value = true
-  publicationCheckBusy.value = true
-  publicationProof.value = null
-  formError.value = ''
-  try {
-    const assertCurrent = () => {
-      if (
-        previewRevision !== expectedRevision ||
-        transaction.value !== preparedTransaction ||
-        canonicalPayload.value !== expectedPayload ||
-        credentialUri.value !== expectedUri ||
-        account.value?.address !== expectedIssuer ||
-        subject.value !== expectedSubject ||
-        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
-        claimsText.value !== expectedClaims ||
-        claimsEditorMode.value !== expectedClaimsEditorMode ||
-        JSON.stringify(guidedClaims.value) !== expectedGuidedClaims ||
-        httpsUrl.value !== expectedHttpsUrl ||
-        storageMode.value !== expectedStorageMode ||
-        localStoreAcknowledged.value !== expectedLocalStoreAcknowledged ||
-        localPublication.value !== expectedLocalPublication ||
-        expiration.value !== expectedExpiration ||
-        preparedProfileId.value !== expectedProfileId
-      ) {
-        throw new Error('ISSUANCE_PREVIEW_CHANGED_DURING_PUBLICATION_CHECK')
-      }
-    }
-    const proof =
-      expectedStorageMode === 'local-test'
-        ? await localPayloadStore.verifyPublication({
-            canonicalPayload: expectedPayload,
-            credentialUri: expectedUri,
-          })
-        : await verifyHttpsPayloadPublication({
-            canonicalPayload: expectedPayload,
-            credentialUri: expectedUri,
-          })
-    assertCurrent()
-    publicationProof.value = proof
-    publicationCheckBusy.value = false
-    const normalizedExpiration = expectedExpiration
-      ? new Date(expectedExpiration).toISOString()
-      : undefined
-    const response = await signAndSubmit(
-      preparedTransaction,
-      {
-        action: 'credential-issue',
-        issuer: expectedIssuer,
-        subject: expectedSubject,
-        schemaUid: expectedSchemaUid,
-        credentialUri: expectedUri,
-        payloadDigestHex: proof.digestHex,
-        ...(normalizedExpiration ? { expiration: normalizedExpiration } : {}),
-      },
-      assertCurrent,
-      undefined,
-      (validated) => {
-        issuedLinkInputs.value = {
-          profileId: expectedProfileId,
-          issuer: expectedIssuer,
-          subject: expectedSubject,
-          schemaUid: expectedSchemaUid,
-        }
-        result.value = { ...validated }
-      },
-    )
-    result.value = response
-    transaction.value = null
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    publicationCheckBusy.value = false
-    flowBusy.value = false
-  }
-}
-
-const acceptLink = computed(() => {
-  const generationId = result.value?.businessEvidence?.generationId
-  if (
-    result.value?.businessConfirmation !== 'confirmed' ||
-    !generationId ||
-    !issuedLinkInputs.value
-  ) {
-    return null
-  }
-  return buildCredentialAcceptLink({ ...issuedLinkInputs.value, generationId })
-})
-
-const credentialLink = computed(() => {
-  const generationId = result.value?.businessEvidence?.generationId
-  if (
-    result.value?.businessConfirmation !== 'confirmed' ||
-    !generationId ||
-    !issuedLinkInputs.value
-  ) {
-    return null
-  }
-  return buildCredentialPermalink({
-    profileId: issuedLinkInputs.value.profileId,
-    generationId,
-  })
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/issue', locale.value), {
+  replace: true,
+  redirectCode: 308,
 })
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      eyebrow="Credential issuer"
-      :title="$t('issue.title')"
-      :lead="$t('issue.description')"
-    />
-    <StatusBox tone="warning">{{ $t('issue.noPii') }}</StatusBox>
-
-    <UCard class="mb-6">
-      <div class="grid gap-5">
-        <UFormField label="Schema UID">
-          <UInput
-            id="schema-uid"
-            v-model.trim="schemaUid"
-            required
-            pattern="[0-9a-fA-F]{64}"
-            :disabled="submissionBusy"
-          />
-        </UFormField>
-        <UFormField label="Subject">
-          <UInput
-            id="subject"
-            v-model.trim="subject"
-            required
-            placeholder="r…"
-            :disabled="submissionBusy"
-          />
-        </UFormField>
-
-        <div class="flex flex-wrap gap-3">
-          <UButton
-            size="sm"
-            color="neutral"
-            :variant="claimsEditorMode === 'guided' ? 'solid' : 'outline'"
-            type="button"
-            :aria-pressed="claimsEditorMode === 'guided'"
-            :disabled="submissionBusy"
-            @click="selectClaimsEditorMode('guided')"
-          >
-            {{ $t('issue.guidedClaims') }}
-          </UButton>
-          <UButton
-            size="sm"
-            color="neutral"
-            :variant="claimsEditorMode === 'json' ? 'solid' : 'outline'"
-            type="button"
-            :aria-pressed="claimsEditorMode === 'json'"
-            :disabled="submissionBusy"
-            @click="selectClaimsEditorMode('json')"
-          >
-            {{ $t('issue.jsonClaims') }}
-          </UButton>
-          <UButton
-            size="sm"
-            color="neutral"
-            variant="outline"
-            type="button"
-            :disabled="submissionBusy || schemaLoadBusy"
-            @click="loadGuidedClaimForm"
-          >
-            {{ $t('issue.loadSchema') }}
-          </UButton>
-        </div>
-
-        <template v-if="claimsEditorMode === 'guided'">
-          <p v-if="loadedSchemaName" class="text-sm text-muted">
-            {{ $t('issue.loadedSchema', { name: loadedSchemaName }) }}
-          </p>
-          <div v-if="guidedClaims.length" class="grid gap-4">
-            <UFormField
-              v-for="field in guidedClaims"
-              :key="field.name"
-              :label="field.name"
-              :hint="`${field.type} · ${$t(field.optional ? 'issue.optionalField' : 'issue.requiredField')}`"
-            >
-              <USelect
-                v-if="field.type === 'bool'"
-                :id="`claim-${field.name}`"
-                v-model="field.value"
-                :items="[
-                  { label: '—', value: undefined },
-                  { label: 'true', value: 'true' },
-                  { label: 'false', value: 'false' },
-                ]"
-                :required="!field.optional"
-                :disabled="submissionBusy"
-              />
-              <UInput
-                v-else
-                :id="`claim-${field.name}`"
-                v-model="field.value"
-                :required="!field.optional"
-                :inputmode="field.type === 'uint' || field.type === 'int' ? 'numeric' : 'text'"
-                :disabled="submissionBusy"
-                autocomplete="off"
-              />
-            </UFormField>
-          </div>
-          <p v-else class="text-sm text-muted">{{ $t('issue.advancedClaimsHint') }}</p>
-          <StatusBox v-if="guidedClaimsError && guidedClaims.length" tone="error">
-            {{ guidedClaimsError }}
-          </StatusBox>
-        </template>
-        <template v-else>
-          <UFormField label="Claims JSON">
-            <UTextarea
-              id="claims"
-              v-model="claimsText"
-              :rows="12"
-              spellcheck="false"
-              :disabled="submissionBusy"
-            />
-          </UFormField>
-        </template>
-
-        <template v-if="localPayloadStoreEnabled">
-          <!-- Native select: the pilot suite drives this control with selectOption(). -->
-          <div class="grid gap-1.5">
-            <label for="payload-storage-mode" class="text-sm font-semibold text-default">
-              {{ $t('issue.storage') }}
-            </label>
-            <select
-              id="payload-storage-mode"
-              v-model="storageMode"
-              :disabled="submissionBusy"
-              class="w-full rounded-[0.5rem] bg-default px-3 py-2 text-sm ring-1 ring-accented focus:outline-2 focus:outline-offset-2 focus:outline-primary disabled:opacity-60"
-            >
-              <option value="https">{{ $t('issue.localStore.httpsMode') }}</option>
-              <option value="local-test">{{ $t('issue.localStore.mode') }}</option>
-            </select>
-          </div>
-          <StatusBox
-            v-if="storageMode === 'local-test'"
-            tone="warning"
-            data-testid="local-payload-store-controls"
-            :title="$t('issue.localStore.title')"
-          >
-            <p>{{ $t('issue.localStore.warning') }}</p>
-            <UCheckbox
-              v-model="localStoreAcknowledged"
-              :disabled="submissionBusy"
-              :label="$t('issue.localStore.acknowledgement')"
-            />
-            <div>
-              <UButton
-                size="sm"
-                color="neutral"
-                variant="outline"
-                type="button"
-                :disabled="submissionBusy"
-                @click="clearLocalPayloadStore"
-              >
-                {{ $t('issue.localStore.clear') }}
-              </UButton>
-            </div>
-            <p v-if="localStoreNotice" class="text-sm text-muted" data-testid="local-store-notice">
-              {{ localStoreNotice }}
-            </p>
-          </StatusBox>
-        </template>
-
-        <UFormField
-          v-if="storageMode === 'https'"
-          :label="$t('issue.httpsUrlLabel')"
-          :help="$t('issue.httpsProof')"
-        >
-          <UInput
-            id="https-url"
-            v-model.trim="httpsUrl"
-            type="url"
-            required
-            autocomplete="off"
-            :placeholder="$t('issue.httpsUrlPlaceholder')"
-            :disabled="submissionBusy"
-          />
-        </UFormField>
-        <p v-else class="text-sm text-muted">{{ $t('issue.localStore.flow') }}</p>
-
-        <UFormField :label="$t('issue.expiration')">
-          <UInput
-            id="expiration"
-            v-model="expiration"
-            type="datetime-local"
-            :disabled="submissionBusy"
-          />
-        </UFormField>
-        <div>
-          <UButton type="button" :disabled="submissionBusy" @click="buildPreview">
-            {{ $t('issue.prepare') }}
-          </UButton>
-        </div>
-      </div>
-    </UCard>
-
-    <StatusBox
-      v-if="formError"
-      tone="error"
-      data-testid="issue-error"
-      :title="formErrorMessage"
-      role="alert"
-    >
-      <p v-if="formErrorIsLocalized">
-        <code>{{ formError }}</code>
-      </p>
-    </StatusBox>
-
-    <UCard v-if="canonicalPayload" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('issue.payload') }}</h2>
-      </template>
-      <JsonBlock :code="canonicalPayload" />
-      <p class="text-sm break-all">
-        <code>{{ credentialUri }}</code>
-      </p>
-      <div class="my-4">
-        <UButton color="neutral" variant="outline" type="button" @click="downloadPayload">
-          {{ $t('issue.download') }}
-        </UButton>
-      </div>
-      <p v-if="storageMode === 'https'" class="text-sm break-words text-muted">
-        {{ $t('issue.publishBeforeSigning', { url: httpsUrl }) }}
-      </p>
-      <StatusBox v-else-if="localPublication" tone="success" data-testid="local-payload-stored">
-        {{ $t('issue.localStore.stored', { expiresAt: localPublication.expiresAt }) }}
-      </StatusBox>
-      <StatusBox v-if="publicationCheckBusy" tone="notice">{{ $t('issue.checking') }}</StatusBox>
-      <StatusBox v-else-if="publicationProof" tone="success">
-        <p class="break-all">
-          {{
-            $t(storageMode === 'local-test' ? 'issue.localStore.checked' : 'issue.checked', {
-              bytes: publicationProof.byteLength,
-            })
-          }}
-          <code>{{ publicationProof.digestHex }}</code>
-        </p>
-      </StatusBox>
-    </UCard>
-
-    <TransactionPreview :transaction="transaction" :busy="submissionBusy" @confirm="submit" />
-    <BusinessFinality
-      v-if="result"
-      :tx-hash="result.txHash"
-      :engine-result="result.transactionResult"
-      :ledger-index="result.ledgerIndex"
-      :business-confirmation="result.businessConfirmation"
-      :business-evidence="result.businessEvidence"
-    />
-    <UCard v-if="acceptLink && credentialLink" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('issue.links') }}</h2>
-      </template>
-      <div class="flex flex-wrap gap-3">
-        <UButton
-          color="neutral"
-          variant="outline"
-          data-testid="issue-credential-link"
-          :to="localePath(credentialLink)"
-        >
-          {{ $t('issue.credentialLink') }}
-        </UButton>
-        <UButton color="neutral" variant="outline" :to="localePath(acceptLink)">
-          {{ $t('issue.acceptLink') }}
-        </UButton>
-      </div>
-    </UCard>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/issuer/application.vue b/apps/web/app/pages/issuer/application.vue
new file mode 100644
index 0000000..b305511
--- /dev/null
+++ b/apps/web/app/pages/issuer/application.vue
@@ -0,0 +1,43 @@
+<script setup lang="ts">
+definePageMeta({ middleware: ['auth'] })
+const { t } = useI18n()
+const localePath = useLocalePath()
+const { data, error, refresh } = useIssuerWorkspace()
+useSeoMeta({ title: () => `${t('issuer.application')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="max-w-3xl py-10">
+    <PageHeader :title="$t('issuer.application')" :lead="$t('issuer.approvalMeaning')" />
+    <StatusBox v-if="error" tone="error" role="alert"
+      >{{ $t('issuer.error')
+      }}<UButton class="ml-3" @click="refresh()">{{ $t('issuer.retry') }}</UButton></StatusBox
+    >
+    <p v-if="data && !data.organizations.length" class="mb-5">{{ $t('issuer.noApplications') }}</p>
+    <ul class="grid gap-5">
+      <li v-for="org in data?.organizations" :key="org.id">
+        <UCard>
+          <h2 class="text-xl font-semibold">{{ org.name }}</h2>
+          <p class="mt-2">{{ $t(`issuer.states.${org.applicationStatus}`) }}</p>
+          <p v-if="org.reviewReason" class="mt-2 whitespace-pre-wrap">{{ org.reviewReason }}</p>
+          <p v-if="org.applicationStatus === 'pending'" class="mt-3 text-muted">
+            {{ $t('issuer.pendingHelp') }}
+          </p>
+          <p
+            v-if="org.applicationStatus === 'rejected' || org.applicationStatus === 'suspended'"
+            class="mt-3 text-muted"
+          >
+            {{ $t('issuer.declinedHelp') }}
+          </p>
+          <UButton
+            v-if="org.status === 'active' && org.applicationStatus === 'approved'"
+            :to="{ path: localePath('/issuer/schemas'), query: { organizationId: org.id } }"
+            class="mt-5"
+            >{{ $t('issuer.openWorkspace') }}</UButton
+          >
+        </UCard>
+      </li>
+    </ul>
+    <UButton :to="localePath('/issuer/apply')" class="mt-5">{{ $t('issuer.apply') }}</UButton>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/issuer/apply.vue b/apps/web/app/pages/issuer/apply.vue
new file mode 100644
index 0000000..53681c9
--- /dev/null
+++ b/apps/web/app/pages/issuer/apply.vue
@@ -0,0 +1,9 @@
+<script setup lang="ts">
+definePageMeta({ middleware: ['auth'] })
+const { t } = useI18n()
+useSeoMeta({ title: () => `${t('simpleIssuer.applyTitle')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <OrganizationApplicationForm role="issuer" />
+</template>
diff --git a/apps/web/app/pages/issuer/credentials/[generationId].vue b/apps/web/app/pages/issuer/credentials/[generationId].vue
new file mode 100644
index 0000000..f1d50e1
--- /dev/null
+++ b/apps/web/app/pages/issuer/credentials/[generationId].vue
@@ -0,0 +1,108 @@
+<script setup lang="ts">
+import { rippleTimeToIso } from '#xcs/core/index.js'
+import {
+  assertIssuerWallet,
+  type IssuerCredentialDetail,
+  type IssuerRevokeEngineContext,
+} from '~/utils/issuerEngine'
+
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+const route = useRoute()
+const { t } = useI18n()
+const localePath = useLocalePath()
+const api = useIssuerEngineApi()
+const auth = useAuth()
+const { busy: walletBusy } = useWallet()
+const detail = shallowRef<IssuerCredentialDetail | null>(null)
+const error = ref('')
+const generationId = String(route.params.generationId)
+const profileId = typeof route.query.profile === 'string' ? route.query.profile : ''
+const recovery = useIssuerEngineRecovery(() => ({
+  key: `revoke:${auth.user.value?.id}:${profileId}:${generationId}`,
+  profileId,
+  async beforeSign() {},
+  async record(receipt) {
+    await api.reconcileRevocation(profileId, generationId, receipt.transactionHash)
+    await reload()
+  },
+}))
+async function reload() {
+  detail.value = await api.credential(profileId, generationId)
+}
+try {
+  await reload()
+} catch (cause) {
+  error.value = cause instanceof Error ? cause.message : String(cause)
+}
+const context = computed<IssuerRevokeEngineContext | undefined>(() => {
+  const current = detail.value
+  if (!current || current.status.accepted === null || current.status.deletedLedgerIndex !== null)
+    return undefined
+  return {
+    profileId: current.profileId,
+    generationId: current.generationId,
+    schemaUid: current.schemaUid,
+    schemaName: current.schema.name,
+    issuerAddress: current.issuerAddress,
+    subjectAddress: current.subjectAddress,
+    recipientLabel: current.recipient?.displayName ?? t('simpleIssuer.recipientFallback'),
+    async beforeSign(publisher) {
+      await auth.load(true)
+      await auth.checkRole('issuer', current.organizationId)
+      assertIssuerWallet(auth.user.value?.wallets ?? [], publisher)
+      const latest = await api.credential(current.profileId, current.generationId)
+      if (
+        latest.status.deletedLedgerIndex !== null ||
+        latest.issuerAddress !== publisher ||
+        latest.subjectAddress !== current.subjectAddress ||
+        latest.schemaUid !== current.schemaUid
+      )
+        throw new Error('ISSUER_CONTEXT_CHANGED')
+    },
+    onSigned: (transactionHash) => recovery.stash({ transactionHash }),
+    afterConfirmed: (result) => recovery.finish(result),
+  }
+})
+const credentialState = computed(() => {
+  const status = detail.value?.status
+  if (!status || status.accepted === null) return 'unknown'
+  if (status.deletedLedgerIndex !== null) return 'deleted'
+  if (status.expiration !== null && Date.parse(rippleTimeToIso(status.expiration)) <= Date.now())
+    return 'expired'
+  return status.accepted ? 'active' : 'pending'
+})
+useSeoMeta({ robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <div>
+    <UContainer class="pt-8">
+      <UButton :to="localePath('/issuer')" color="neutral" variant="outline">{{
+        $t('issuer.engine.back')
+      }}</UButton>
+      <StatusBox v-if="error" tone="error">{{ $t('simpleIssuer.error') }}</StatusBox>
+      <IssuerEngineRecovery
+        :pending="recovery.pending.value"
+        :saved="recovery.saved.value"
+        :busy="recovery.saving.value || walletBusy"
+        :error="recovery.error.value"
+        :can-restart="recovery.canRestart.value"
+        @restart="recovery.restart"
+        @retry="recovery.retry"
+      />
+      <UCard v-if="detail" class="mt-5">
+        <h1 class="text-xl font-semibold">{{ detail.schema.name }}</h1>
+        <p class="mt-3">
+          {{ $t('simpleIssuer.recipient') }}:
+          {{ detail.recipient?.displayName ?? $t('simpleIssuer.recipientFallback') }}
+        </p>
+        <p>{{ $t('simpleIssuer.visibility') }}: {{ $t(`simpleIssuer.${detail.visibility}`) }}</p>
+        <AttestationStatus :value="credentialState" />
+      </UCard>
+    </UContainer>
+    <CredentialRevokeForm
+      v-if="context && !recovery.pending.value && !recovery.saved.value"
+      :issuer-context="context"
+    />
+  </div>
+</template>
diff --git a/apps/web/app/pages/issuer/credentials/index.vue b/apps/web/app/pages/issuer/credentials/index.vue
new file mode 100644
index 0000000..16a0099
--- /dev/null
+++ b/apps/web/app/pages/issuer/credentials/index.vue
@@ -0,0 +1,7 @@
+<script setup lang="ts">
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+</script>
+
+<template>
+  <IssuerWorkspace section="credentials" />
+</template>
diff --git a/apps/web/app/pages/issuer/index.vue b/apps/web/app/pages/issuer/index.vue
new file mode 100644
index 0000000..8ed2b7c
--- /dev/null
+++ b/apps/web/app/pages/issuer/index.vue
@@ -0,0 +1,138 @@
+<script setup lang="ts">
+import { issuerNextAction } from '~/utils/portalPresenters'
+
+definePageMeta({ middleware: ['auth'] })
+const localePath = useLocalePath()
+const { t } = useI18n()
+const auth = useAuth()
+const { data, error, status, refresh } = useIssuerWorkspace()
+const nextAction = computed(() =>
+  data.value ? issuerNextAction(data.value, auth.user.value) : null,
+)
+const organization = computed(() =>
+  data.value?.organizations.find((item) => item.id === data.value?.selectedOrganizationId),
+)
+const hasWallet = computed(
+  () => auth.user.value?.wallets.some((wallet) => wallet.networkId === 1) === true,
+)
+const actionTarget = computed(() => {
+  const action = nextAction.value
+  if (!action || !('to' in action)) return null
+  if (action.kind === 'linkWallet') {
+    return {
+      path: localePath(action.to),
+      query: { returnTo: localePath(action.returnTo) },
+    }
+  }
+  if (action.kind === 'createTemplate' || action.kind === 'invite') {
+    return {
+      path: localePath(action.to),
+      query: { organizationId: action.organizationId },
+    }
+  }
+  return localePath(action.to)
+})
+
+async function selectOrganization(event: Event) {
+  await navigateTo({
+    path: localePath('/issuer'),
+    query: { organizationId: (event.target as HTMLSelectElement).value },
+  })
+}
+
+useSeoMeta({ title: () => `${t('portal.issuer.title')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <UContainer class="max-w-5xl py-10">
+    <PageHeader :title="$t('portal.issuer.title')" :lead="$t('portal.issuer.lead')" />
+    <StatusBox v-if="error" tone="error" role="alert">
+      <p>{{ $t('portal.errors.unavailable') }}</p>
+      <p class="mt-2 text-sm">{{ $t('portal.errors.unchanged') }}</p>
+      <UButton class="mt-3" :loading="status === 'pending'" @click="refresh()">{{
+        $t('portal.retry')
+      }}</UButton>
+    </StatusBox>
+    <p v-else-if="status === 'pending'" role="status" aria-live="polite">
+      {{ $t('issuer.loading') }}
+    </p>
+    <template v-else-if="data && nextAction">
+      <label v-if="data.organizations.length > 1" class="mb-6 block font-semibold">
+        {{ $t('issuer.organization') }}
+        <select
+          :value="data.selectedOrganizationId"
+          class="mt-2 w-full rounded border border-default bg-default p-3"
+          @change="selectOrganization"
+        >
+          <option v-for="item in data.organizations" :key="item.id" :value="item.id">
+            {{ item.name }}
+          </option>
+        </select>
+      </label>
+
+      <UCard data-testid="issuer-next-action" aria-live="polite">
+        <p class="text-sm font-semibold text-muted">{{ $t('portal.nextAction') }}</p>
+        <h2 class="mt-2 text-2xl font-semibold">
+          {{ $t(`portal.actions.${nextAction.kind}.title`) }}
+        </h2>
+        <p class="mt-3 text-toned">{{ $t(`portal.actions.${nextAction.kind}.help`) }}</p>
+        <p v-if="organization" class="mt-3 font-semibold">{{ organization.name }}</p>
+        <WalletProgress
+          v-if="nextAction.kind === 'linkWallet'"
+          class="mt-5"
+          :stage="hasWallet ? 'ready' : 'prepare'"
+        />
+        <UButton v-if="actionTarget" class="mt-5" :to="actionTarget">
+          {{ $t(`portal.actions.${nextAction.kind}.cta`) }}
+        </UButton>
+        <UButton
+          v-else-if="nextAction.kind === 'awaitApproval' || nextAction.kind === 'awaitRecipient'"
+          class="mt-5"
+          @click="refresh()"
+        >
+          {{ $t('portal.retry') }}
+        </UButton>
+        <UButton
+          v-else-if="nextAction.kind === 'done'"
+          class="mt-5"
+          :to="{
+            path: localePath('/issuer/recipients'),
+            query: organization ? { organizationId: organization.id } : {},
+          }"
+        >
+          {{ $t('portal.actions.done.cta') }}
+        </UButton>
+      </UCard>
+
+      <nav
+        v-if="organization?.applicationStatus === 'approved'"
+        class="mt-8 grid gap-3 sm:grid-cols-3"
+      >
+        <UButton
+          :to="{ path: localePath('/issuer/schemas'), query: { organizationId: organization.id } }"
+          color="neutral"
+          variant="outline"
+          >{{ $t('simpleIssuer.sections.schemas') }}</UButton
+        >
+        <UButton
+          :to="{
+            path: localePath('/issuer/recipients'),
+            query: { organizationId: organization.id },
+          }"
+          color="neutral"
+          variant="outline"
+          >{{ $t('simpleIssuer.sections.recipients') }}</UButton
+        >
+        <UButton
+          :to="{
+            path: localePath('/issuer/credentials'),
+            query: { organizationId: organization.id },
+          }"
+          color="neutral"
+          variant="outline"
+          >{{ $t('simpleIssuer.sections.credentials') }}</UButton
+        >
+      </nav>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/issuer/issue/[inviteId].vue b/apps/web/app/pages/issuer/issue/[inviteId].vue
new file mode 100644
index 0000000..f983680
--- /dev/null
+++ b/apps/web/app/pages/issuer/issue/[inviteId].vue
@@ -0,0 +1,131 @@
+<script setup lang="ts">
+import {
+  assertIssuanceContextUnchanged,
+  type IssuerIssuanceContext,
+  type IssuerIssueEngineContext,
+} from '~/utils/issuerEngine'
+
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+const route = useRoute()
+const localePath = useLocalePath()
+const { locale, t } = useI18n()
+const api = useIssuerEngineApi()
+const { user } = useAuth()
+const inviteId = String(route.params.inviteId)
+const issuance = shallowRef<IssuerIssuanceContext | null>(null)
+const subjectAddress = ref('')
+const error = ref('')
+const engineBusy = ref(false)
+const savedLink = ref('')
+const hasIssuerWallet = computed(
+  () => user.value?.wallets.some((wallet) => wallet.networkId === 1) === true,
+)
+try {
+  issuance.value = await api.issuance(inviteId)
+  if (issuance.value.existingCredential) {
+    const existing = issuance.value.existingCredential
+    savedLink.value = `/issuer/credentials/${existing.generationId}?profile=${encodeURIComponent(existing.profileId)}`
+  }
+  subjectAddress.value =
+    issuance.value.recipient.wallets.find((wallet) => wallet.networkId === 1)?.address ?? ''
+} catch (cause) {
+  error.value = cause instanceof Error ? cause.message : String(cause)
+}
+const wallets = computed(
+  () => issuance.value?.recipient.wallets.filter((wallet) => wallet.networkId === 1) ?? [],
+)
+const selectedWallet = computed(() =>
+  wallets.value.find((wallet) => wallet.address === subjectAddress.value),
+)
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium', timeStyle: 'short' }).format(
+    new Date(value),
+  )
+const context = computed<IssuerIssueEngineContext | undefined>(() => {
+  const initial = issuance.value
+  const subject = subjectAddress.value
+  if (!initial || !wallets.value.some((wallet) => wallet.address === subject)) return undefined
+  return {
+    key: `issue:${user.value?.id}:${inviteId}`,
+    inviteId,
+    existingCredential: initial.existingCredential ?? null,
+    profileId: initial.invite.profileId,
+    schemaUid: initial.schema.schemaUid,
+    schemaName: initial.schema.name,
+    subjectAddress: subject,
+    recipientLabel: initial.recipient.displayName ?? t('simpleIssuer.recipientFallback'),
+    async beforeSign(publisher) {
+      assertIssuanceContextUnchanged(initial, await api.issuance(inviteId), subject, publisher)
+    },
+    preparePayload: (canonicalPayload, setting) =>
+      api.preparePayload(inviteId, subject, canonicalPayload, setting),
+    async record(receipt) {
+      const saved = await api.recordCredential(inviteId, receipt)
+      savedLink.value = `/issuer/credentials/${saved.generationId}?profile=${encodeURIComponent(saved.profileId)}`
+    },
+  }
+})
+useSeoMeta({ robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <div>
+    <UContainer class="pt-8">
+      <UButton :to="localePath('/issuer')" color="neutral" variant="outline">{{
+        $t('issuer.engine.back')
+      }}</UButton>
+      <StatusBox v-if="error" tone="error"
+        ><p>{{ $t('simpleIssuer.error') }}</p>
+        <details>
+          <summary>{{ $t('simpleIssuer.technical') }}</summary>
+          <code>{{ error }}</code>
+        </details></StatusBox
+      >
+      <StatusBox v-else-if="!hasIssuerWallet" tone="warning">
+        <p>{{ $t('portal.walletRequired') }}</p>
+        <UButton
+          class="mt-3"
+          :to="{
+            path: localePath('/account'),
+            query: { returnTo: localePath(`/issuer/issue/${inviteId}`) },
+          }"
+          >{{ $t('portal.actions.linkWallet.cta') }}</UButton
+        >
+      </StatusBox>
+      <StatusBox v-else-if="!wallets.length" tone="warning">{{
+        $t('issuer.engine.walletRequired')
+      }}</StatusBox>
+      <UCard v-if="issuance" class="mt-4">
+        <p>
+          <strong>{{ $t('simpleIssuer.contactEmail') }} :</strong>
+          {{ issuance.invite.deliveryEmail ?? '—' }}
+        </p>
+        <p class="mt-2 text-sm text-muted">{{ $t('simpleIssuer.contactHelp') }}</p>
+        <p v-if="selectedWallet?.verifiedAt" class="mt-3">
+          {{ $t('roleJourney.walletVerifiedAt', { date: date(selectedWallet.verifiedAt) }) }}
+        </p>
+      </UCard>
+      <UFormField v-if="wallets.length > 1" class="mt-4" :label="$t('issuer.engine.chooseWallet')">
+        <USelect
+          v-model="subjectAddress"
+          :disabled="engineBusy"
+          :items="
+            wallets.map((wallet) => ({
+              label: `${wallet.address.slice(0, 6)}…${wallet.address.slice(-4)}`,
+              value: wallet.address,
+            }))
+          "
+        />
+      </UFormField>
+      <UButton v-if="savedLink" class="mt-4" :to="localePath(savedLink)">{{
+        $t('issuer.engine.openCredential')
+      }}</UButton>
+    </UContainer>
+    <CredentialIssueForm
+      v-if="context && hasIssuerWallet"
+      :key="`${context.key}:${context.subjectAddress}`"
+      :issuer-context="context"
+      @busy="engineBusy = $event"
+    />
+  </div>
+</template>
diff --git a/apps/web/app/pages/issuer/recipients.vue b/apps/web/app/pages/issuer/recipients.vue
new file mode 100644
index 0000000..19baeb6
--- /dev/null
+++ b/apps/web/app/pages/issuer/recipients.vue
@@ -0,0 +1,7 @@
+<script setup lang="ts">
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+</script>
+
+<template>
+  <IssuerWorkspace section="recipients" />
+</template>
diff --git a/apps/web/app/pages/issuer/schemas/index.vue b/apps/web/app/pages/issuer/schemas/index.vue
new file mode 100644
index 0000000..5fea444
--- /dev/null
+++ b/apps/web/app/pages/issuer/schemas/index.vue
@@ -0,0 +1,7 @@
+<script setup lang="ts">
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+</script>
+
+<template>
+  <IssuerWorkspace section="schemas" />
+</template>
diff --git a/apps/web/app/pages/issuer/schemas/new.vue b/apps/web/app/pages/issuer/schemas/new.vue
new file mode 100644
index 0000000..85ec439
--- /dev/null
+++ b/apps/web/app/pages/issuer/schemas/new.vue
@@ -0,0 +1,89 @@
+<script setup lang="ts">
+import { assertIssuerWallet, type IssuerSchemaEngineContext } from '~/utils/issuerEngine'
+
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+const route = useRoute()
+const localePath = useLocalePath()
+const auth = useAuth()
+const api = useIssuerEngineApi()
+const { getActiveNetworkProfile } = useXcsApi()
+const organizations = computed(
+  () => auth.user.value?.organizations.filter((item) => item.roles.includes('issuer')) ?? [],
+)
+const organizationId = ref(
+  typeof route.query.organizationId === 'string'
+    ? route.query.organizationId
+    : (organizations.value[0]?.id ?? ''),
+)
+const profileId = ref('')
+const error = ref('')
+const engineBusy = ref(false)
+const hasIssuerWallet = computed(
+  () => auth.user.value?.wallets.some((wallet) => wallet.networkId === 1) === true,
+)
+try {
+  profileId.value = (await getActiveNetworkProfile()).profileId
+} catch (cause) {
+  error.value = cause instanceof Error ? cause.message : String(cause)
+}
+const context = computed<IssuerSchemaEngineContext | undefined>(() => {
+  if (!profileId.value || !organizations.value.some((item) => item.id === organizationId.value))
+    return undefined
+  const selectedId = organizationId.value
+  const selectedProfile = profileId.value
+  return {
+    key: `schema:${auth.user.value?.id}:${selectedId}:${selectedProfile}`,
+    profileId: selectedProfile,
+    async beforeSign(publisher) {
+      await auth.load(true)
+      await auth.checkRole('issuer', selectedId)
+      assertIssuerWallet(auth.user.value?.wallets ?? [], publisher)
+    },
+    async record(receipt) {
+      await api.recordSchema(selectedId, selectedProfile, receipt)
+    },
+  }
+})
+useSeoMeta({ robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <div>
+    <UContainer class="pt-8">
+      <UButton :to="localePath('/issuer')" color="neutral" variant="outline">{{
+        $t('issuer.engine.back')
+      }}</UButton>
+      <USelect
+        v-if="organizations.length > 1"
+        v-model="organizationId"
+        :disabled="engineBusy"
+        class="mt-4"
+        :items="organizations.map((item) => ({ label: item.name, value: item.id }))"
+      />
+      <StatusBox v-if="error" tone="error"
+        ><p>{{ $t('simpleIssuer.error') }}</p>
+        <details>
+          <summary>{{ $t('simpleIssuer.technical') }}</summary>
+          <code>{{ error }}</code>
+        </details></StatusBox
+      >
+    </UContainer>
+    <StatusBox v-if="!hasIssuerWallet" class="mt-5" tone="warning">
+      <p>{{ $t('portal.walletRequired') }}</p>
+      <UButton
+        class="mt-3"
+        :to="{
+          path: localePath('/account'),
+          query: { returnTo: localePath('/issuer/schemas/new') },
+        }"
+        >{{ $t('portal.actions.linkWallet.cta') }}</UButton
+      >
+    </StatusBox>
+    <SchemaRegistrationForm
+      v-if="context && hasIssuerWallet"
+      :key="context.key"
+      :issuer-context="context"
+      @busy="engineBusy = $event"
+    />
+  </div>
+</template>
diff --git a/apps/web/app/pages/issuer/settings.vue b/apps/web/app/pages/issuer/settings.vue
new file mode 100644
index 0000000..f7130b3
--- /dev/null
+++ b/apps/web/app/pages/issuer/settings.vue
@@ -0,0 +1,13 @@
+<script setup lang="ts">
+definePageMeta({ layout: 'issuer', middleware: ['auth', 'role'], requiredRole: 'issuer' })
+const localePath = useLocalePath()
+</script>
+<template>
+  <div>
+    <PageHeader :title="$t('issuer.settings')" :lead="$t('issuer.settingsHelp')" />
+    <div class="flex flex-wrap gap-4">
+      <UButton :to="localePath('/issuer/application')">{{ $t('issuer.application') }}</UButton>
+      <UButton :to="localePath('/account')">{{ $t('auth.linkedWallets') }}</UButton>
+    </div>
+  </div>
+</template>
diff --git a/apps/web/app/pages/operations.vue b/apps/web/app/pages/operations.vue
index 743cf22..e2fd8e1 100644
--- a/apps/web/app/pages/operations.vue
+++ b/apps/web/app/pages/operations.vue
@@ -1,324 +1,11 @@
 <script setup lang="ts">
-import {
-  canAbandonOperation,
-  canReconfirmOperation,
-  canRetryOperation,
-  operationBusinessEvidence,
-  operationBusinessConfirmation,
-  serializeOperationReceipts,
-  type StoredOperation,
-} from '~/utils/operationJournal'
-import { buildCredentialAcceptLink, buildCredentialPermalink } from '~/utils/operationLinks'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const localePath = useLocalePath()
-const { operations, busy, loadOperations, retryOperation, reconfirmOperation, abandonOperation } =
-  useWallet()
-const pageError = ref('')
-const resultMessage = ref('')
-const resultTone = ref<'success' | 'notice' | 'error'>('notice')
-
-async function refresh() {
-  pageError.value = ''
-  try {
-    await loadOperations()
-  } catch (error) {
-    pageError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function retry(operationId: string) {
-  pageError.value = ''
-  resultMessage.value = ''
-  resultTone.value = 'notice'
-  try {
-    const result = await retryOperation(operationId)
-    resultMessage.value = `XRPL_VALIDATED:${result.txHash} XCS:${result.businessConfirmation ?? 'pending'}`
-    resultTone.value =
-      result.businessConfirmation === 'confirmed'
-        ? 'success'
-        : result.businessConfirmation === 'mismatch' || result.businessConfirmation === 'rejected'
-          ? 'error'
-          : 'notice'
-  } catch (error) {
-    pageError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function abandon(operationId: string) {
-  pageError.value = ''
-  resultMessage.value = ''
-  resultTone.value = 'notice'
-  try {
-    await abandonOperation(operationId)
-    resultMessage.value = 'OPERATION_ABANDONED'
-    resultTone.value = 'success'
-  } catch (error) {
-    pageError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function reconfirm(operationId: string) {
-  pageError.value = ''
-  resultMessage.value = ''
-  resultTone.value = 'notice'
-  try {
-    const confirmation = await reconfirmOperation(operationId)
-    resultMessage.value = `BUSINESS_CONFIRMATION:${confirmation}`
-    resultTone.value =
-      confirmation === 'confirmed'
-        ? 'success'
-        : confirmation === 'mismatch' || confirmation === 'rejected'
-          ? 'error'
-          : 'notice'
-  } catch (error) {
-    pageError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-function formatDate(value: string): string {
-  return new Intl.DateTimeFormat(undefined, { dateStyle: 'medium', timeStyle: 'medium' }).format(
-    new Date(value),
-  )
-}
-
-function downloadReceipts() {
-  const content = serializeOperationReceipts(operations.value)
-  const blob = new Blob([content], { type: 'application/json' })
-  const url = URL.createObjectURL(blob)
-  const anchor = document.createElement('a')
-  anchor.href = url
-  anchor.download = `xcs-operation-receipts-${new Date().toISOString().slice(0, 10)}.json`
-  anchor.click()
-  URL.revokeObjectURL(url)
-}
-
-function operationAcceptLink(operation: StoredOperation): string | null {
-  const business = operation.business
-  const evidence = operationBusinessEvidence(operation)
-  if (
-    operationBusinessConfirmation(operation) !== 'confirmed' ||
-    business?.action !== 'credential-issue' ||
-    !evidence?.generationId
-  ) {
-    return null
-  }
-  return buildCredentialAcceptLink({
-    profileId: operation.profileId,
-    issuer: business.issuer,
-    schemaUid: business.schemaUid,
-    generationId: evidence.generationId,
-  })
-}
-
-function operationCredentialLink(operation: StoredOperation): string | null {
-  if (operationBusinessConfirmation(operation) !== 'confirmed') return null
-  const generationId = operationBusinessEvidence(operation)?.generationId
-  return generationId
-    ? buildCredentialPermalink({ profileId: operation.profileId, generationId })
-    : null
-}
-
-onMounted(refresh)
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/operations', locale.value), {
+  replace: true,
+  redirectCode: 308,
+})
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      eyebrow="XRPL submission journal"
-      :title="$t('operations.title')"
-      :lead="$t('operations.description')"
-    >
-      <template #actions>
-        <UButton
-          color="neutral"
-          variant="outline"
-          :disabled="busy || operations.length === 0"
-          @click="downloadReceipts"
-        >
-          {{ $t('operations.export') }}
-        </UButton>
-        <UButton color="neutral" variant="outline" :disabled="busy" @click="refresh">
-          {{ $t('operations.refresh') }}
-        </UButton>
-      </template>
-    </PageHeader>
-
-    <StatusBox tone="warning">{{ $t('operations.localOnly') }}</StatusBox>
-    <StatusBox v-if="pageError" tone="error">{{ pageError }}</StatusBox>
-    <StatusBox
-      v-if="resultMessage"
-      :tone="resultTone === 'error' ? 'error' : resultTone === 'success' ? 'success' : 'notice'"
-    >
-      {{ resultMessage }}
-    </StatusBox>
-    <EmptyState v-if="operations.length === 0">{{ $t('operations.empty') }}</EmptyState>
-
-    <div v-else class="grid gap-4">
-      <UCard
-        v-for="operation in operations"
-        :key="operation.operationId"
-        class="min-w-0"
-        data-testid="operation-card"
-      >
-        <template #header>
-          <div class="flex flex-wrap items-start justify-between gap-3">
-            <div class="min-w-0">
-              <p class="text-xs tracking-wide text-muted uppercase">
-                {{ operation.transactionType }}
-              </p>
-              <h2 class="text-xl font-semibold break-words">{{ operation.stage }}</h2>
-            </div>
-            <div class="flex flex-wrap gap-3">
-              <UButton
-                v-if="canRetryOperation(operation)"
-                color="neutral"
-                variant="solid"
-                :disabled="busy"
-                @click="retry(operation.operationId)"
-              >
-                {{ $t('operations.retry') }}
-              </UButton>
-              <UButton
-                v-if="canReconfirmOperation(operation)"
-                color="neutral"
-                variant="outline"
-                data-testid="operation-reconfirm"
-                :disabled="busy"
-                @click="reconfirm(operation.operationId)"
-              >
-                {{ $t('operations.reconfirm') }}
-              </UButton>
-              <UButton
-                v-if="canAbandonOperation(operation)"
-                color="neutral"
-                variant="outline"
-                :disabled="busy"
-                @click="abandon(operation.operationId)"
-              >
-                {{ $t('operations.abandon') }}
-              </UButton>
-            </div>
-          </div>
-        </template>
-        <MetadataList>
-          <dt>{{ $t('operations.hash') }}</dt>
-          <dd>
-            <code>{{ operation.txHash ?? '—' }}</code>
-          </dd>
-          <dt>{{ $t('operations.profile') }}</dt>
-          <dd>
-            <code>{{ operation.profileId }}</code>
-          </dd>
-          <dt>{{ $t('operations.updated') }}</dt>
-          <dd>{{ formatDate(operation.updatedAt) }}</dd>
-          <dt>{{ $t('operations.lastLedger') }}</dt>
-          <dd>{{ operation.lastLedgerSequence ?? '—' }}</dd>
-          <dt>{{ $t('operations.result') }}</dt>
-          <dd>
-            <code>{{ operation.engineResult ?? '—' }}</code>
-          </dd>
-          <template v-if="operation.business">
-            <dt>{{ $t('operations.action') }}</dt>
-            <dd>
-              <code>{{ operation.business.action }}</code>
-            </dd>
-            <template v-if="operation.business.action === 'schema-register'">
-              <dt>Publisher</dt>
-              <dd>
-                <code>{{ operation.business.publisher ?? '—' }}</code>
-              </dd>
-              <dt>{{ $t('operations.schemaHash') }}</dt>
-              <dd>
-                <code>{{ operation.business.schemaDigestHex ?? '—' }}</code>
-              </dd>
-              <dt>{{ $t('operations.memoBytes') }}</dt>
-              <dd>{{ operation.business.memoByteLength ?? '—' }}</dd>
-            </template>
-            <template v-else>
-              <dt>Issuer</dt>
-              <dd>
-                <code>{{ operation.business.issuer }}</code>
-              </dd>
-              <dt>Subject</dt>
-              <dd>
-                <code>{{ operation.business.subject }}</code>
-              </dd>
-              <dt>Schema UID</dt>
-              <dd>
-                <code>{{ operation.business.schemaUid }}</code>
-              </dd>
-              <template v-if="operation.business.action !== 'credential-issue'">
-                <dt>Generation ID</dt>
-                <dd>
-                  <code>{{ operation.business.generationId }}</code>
-                </dd>
-              </template>
-              <template v-else>
-                <dt>URI</dt>
-                <dd>
-                  <code>{{ operation.business.credentialUri ?? '—' }}</code>
-                </dd>
-                <dt>{{ $t('operations.expiration') }}</dt>
-                <dd>{{ operation.business.expiration ?? '—' }}</dd>
-              </template>
-              <dt>{{ $t('operations.payloadHash') }}</dt>
-              <dd>
-                <code>{{ operation.business.payloadDigestHex ?? '—' }}</code>
-              </dd>
-            </template>
-            <dt>{{ $t('operations.xcsResult') }}</dt>
-            <dd data-testid="operation-xcs-result">
-              <code>{{ operationBusinessConfirmation(operation) ?? '—' }}</code>
-            </dd>
-          </template>
-          <dt>{{ $t('operations.ledger') }}</dt>
-          <dd>{{ operation.ledgerIndex ?? '—' }}</dd>
-          <template v-if="operationBusinessEvidence(operation)">
-            <dt>{{ $t('operations.proofLedgerHash') }}</dt>
-            <dd>
-              <code>{{ operationBusinessEvidence(operation)?.ledgerHash }}</code>
-            </dd>
-            <dt>{{ $t('operations.proofTransactionIndex') }}</dt>
-            <dd>{{ operationBusinessEvidence(operation)?.transactionIndex }}</dd>
-            <dt v-if="operationBusinessEvidence(operation)?.schemaUid">Schema UID</dt>
-            <dd v-if="operationBusinessEvidence(operation)?.schemaUid">
-              <code>{{ operationBusinessEvidence(operation)?.schemaUid }}</code>
-            </dd>
-            <dt v-if="operationBusinessEvidence(operation)?.generationId">Generation ID</dt>
-            <dd v-if="operationBusinessEvidence(operation)?.generationId">
-              <code>{{ operationBusinessEvidence(operation)?.generationId }}</code>
-            </dd>
-            <dt v-if="operationBusinessEvidence(operation)?.reasonCode">
-              {{ $t('operations.reason') }}
-            </dt>
-            <dd v-if="operationBusinessEvidence(operation)?.reasonCode">
-              <code>{{ operationBusinessEvidence(operation)?.reasonCode }}</code>
-            </dd>
-          </template>
-        </MetadataList>
-        <div class="mt-4 flex flex-wrap gap-3">
-          <UButton
-            v-if="operationAcceptLink(operation)"
-            color="neutral"
-            variant="outline"
-            :to="localePath(operationAcceptLink(operation) ?? '/accept')"
-          >
-            {{ $t('operations.acceptLink') }}
-          </UButton>
-          <UButton
-            v-if="operationCredentialLink(operation)"
-            color="neutral"
-            variant="outline"
-            data-testid="operation-credential-link"
-            :to="localePath(operationCredentialLink(operation) ?? '/')"
-          >
-            {{ $t('operations.credentialLink') }}
-          </UButton>
-        </div>
-        <p v-if="operation.message" class="mt-3 text-sm break-words text-muted">
-          {{ operation.message }}
-        </p>
-      </UCard>
-    </div>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/presentations.vue b/apps/web/app/pages/presentations.vue
new file mode 100644
index 0000000..c82d948
--- /dev/null
+++ b/apps/web/app/pages/presentations.vue
@@ -0,0 +1,228 @@
+<script setup lang="ts">
+import type { ResolvedPresentationView } from '~/types/portal'
+import { purgePrivateLinkFragment } from '~/utils/privateLinkHistory'
+import { presentationTokenFromLink } from '~/utils/presentationView'
+
+const auth = useAuth()
+const handoff = usePrivateLinkHandoff()
+const localePath = useLocalePath()
+const route = useRoute()
+const { t } = useI18n()
+const token = ref('')
+const ready = ref(false)
+const busy = ref(false)
+type PresentationFailure = 'invalid' | 'revoked' | 'holderProof' | 'unavailable'
+const failed = ref<PresentationFailure | null>(null)
+const result = shallowRef<ResolvedPresentationView | null>(null)
+const receivedLink = ref('')
+const invalidLink = ref(false)
+let revision = 0
+let activeRequest = 0
+let disposed = false
+function clearResult() {
+  revision += 1
+  result.value = null
+}
+function hideResult() {
+  if (document.visibilityState === 'hidden') clearResult()
+}
+function captureFragment() {
+  const fragment = window.location.hash
+  if (!fragment) return
+  purgePrivateLinkFragment()
+  activeRequest += 1
+  busy.value = false
+  clearResult()
+  token.value = fragment.slice(1)
+  failed.value = /^[A-Za-z0-9_-]{43}$/.test(token.value) ? null : 'invalid'
+  if (ready.value && !failed.value) void open()
+}
+// Native fragment navigation and Vue Router navigation can reuse this component.
+// Read the current URL so both listeners cannot consume the same fragment twice.
+watch(
+  () => route.hash,
+  () => {
+    if (import.meta.client) captureFragment()
+  },
+)
+onMounted(async () => {
+  window.addEventListener('hashchange', captureFragment)
+  document.addEventListener('visibilitychange', hideResult)
+  captureFragment()
+  await auth.load(true)
+  if (disposed) return
+  if (!token.value && auth.user.value) {
+    const handoffRevision = revision
+    try {
+      const restoredToken = await handoff.consume('presentation')
+      if (disposed) return
+      if (handoffRevision === revision) token.value = restoredToken ?? ''
+    } catch {
+      if (handoffRevision === revision) failed.value = 'unavailable'
+    }
+  }
+  if (token.value && !failed.value && !/^[A-Za-z0-9_-]{43}$/.test(token.value))
+    failed.value = 'invalid'
+  ready.value = true
+  if (token.value && !failed.value) await open()
+})
+onBeforeUnmount(() => {
+  disposed = true
+  activeRequest += 1
+  token.value = ''
+  receivedLink.value = ''
+  clearResult()
+  document.removeEventListener('visibilitychange', hideResult)
+  window.removeEventListener('hashchange', captureFragment)
+})
+watch(() => auth.user.value?.id, clearResult)
+async function openReceivedLink() {
+  if (busy.value || !ready.value) return
+  invalidLink.value = false
+  try {
+    token.value = presentationTokenFromLink(window.location.origin, receivedLink.value)
+  } catch {
+    invalidLink.value = true
+    return
+  } finally {
+    receivedLink.value = ''
+  }
+  await open()
+}
+async function open() {
+  if (busy.value || !ready.value || !/^[A-Za-z0-9_-]{43}$/.test(token.value)) return
+  busy.value = true
+  failed.value = null
+  clearResult()
+  const requestId = ++activeRequest
+  const attempt = revision
+  const requestToken = token.value
+  let identity = auth.user.value?.id
+  try {
+    await auth.load(true)
+    if (disposed || attempt !== revision || requestId !== activeRequest) return
+    identity = auth.user.value?.id
+    const resolved = await $fetch<ResolvedPresentationView>('/api/presentations/resolve', {
+      method: 'POST',
+      body: { token: requestToken },
+      ...(auth.csrfToken.value ? { headers: { 'x-xcs-csrf': auth.csrfToken.value } } : {}),
+    })
+    if (
+      !disposed &&
+      requestId === activeRequest &&
+      attempt === revision &&
+      identity === auth.user.value?.id &&
+      document.visibilityState === 'visible'
+    )
+      result.value = resolved
+  } catch (cause) {
+    if (
+      !disposed &&
+      attempt === revision &&
+      requestId === activeRequest &&
+      identity === auth.user.value?.id
+    )
+      failed.value = (() => {
+        const error = cause as { statusCode?: number; data?: { error?: string } }
+        if (error.data?.error === 'PRESENTATION_REVOKED') return 'revoked'
+        if (error.data?.error === 'PRESENTATION_HOLDER_PROOF_INVALID') return 'holderProof'
+        if (error.data?.error === 'PRESENTATION_INVALID' || error.statusCode === 404)
+          return 'invalid'
+        return 'unavailable'
+      })()
+  } finally {
+    if (requestId === activeRequest) busy.value = false
+  }
+}
+async function signIn() {
+  if (busy.value || !token.value) return
+  busy.value = true
+  const requestId = ++activeRequest
+  try {
+    await handoff.save('presentation', token.value)
+    if (disposed || requestId !== activeRequest) return
+    await navigateTo({
+      path: localePath('/auth/login'),
+      query: { returnTo: localePath('/presentations') },
+    })
+  } catch {
+    if (!disposed && requestId === activeRequest) failed.value = 'unavailable'
+  } finally {
+    if (requestId === activeRequest) busy.value = false
+  }
+}
+useSeoMeta({
+  title: () => `${t('presentation.title')} — XCS`,
+  robots: 'noindex,nofollow',
+  referrer: 'no-referrer',
+})
+</script>
+<template>
+  <UContainer class="max-w-4xl py-8">
+    <p v-if="!ready">{{ $t('issuer.loading') }}</p>
+    <template v-else>
+      <PresentationResult v-if="result" :result="result" />
+      <template v-else>
+        <h1 class="text-2xl font-bold">
+          {{ failed ? $t(`presentation.headlines.${failed}`) : $t('presentation.title') }}
+        </h1>
+        <p class="mt-3 text-muted">
+          {{ $t(failed ? `presentation.failureHelp.${failed}` : 'presentation.openHelp') }}
+        </p>
+      </template>
+      <StatusBox v-if="failed === 'unavailable'" class="mt-5" tone="error">{{
+        $t('presentation.unavailableHelp')
+      }}</StatusBox>
+      <form
+        v-if="!token || failed === 'invalid' || failed === 'revoked'"
+        class="mt-5 grid gap-4"
+        @submit.prevent="openReceivedLink"
+      >
+        <label for="received-presentation-link" class="font-semibold">{{
+          $t('simpleUi.receivedLink')
+        }}</label>
+        <input
+          id="received-presentation-link"
+          v-model="receivedLink"
+          type="text"
+          inputmode="url"
+          autocomplete="off"
+          autocapitalize="none"
+          :spellcheck="false"
+          :disabled="busy"
+          required
+          class="w-full min-w-0 rounded border border-default bg-default p-3"
+          aria-describedby="received-link-help"
+        />
+        <p id="received-link-help" class="text-sm text-muted">
+          {{ $t('simpleUi.receivedLinkHelp') }}
+        </p>
+        <StatusBox v-if="invalidLink" tone="error" role="alert">{{
+          $t('simpleUi.invalidLink')
+        }}</StatusBox>
+        <UButton type="submit" :loading="busy" :disabled="busy">{{
+          $t('simpleUi.verifyLink')
+        }}</UButton>
+      </form>
+      <div
+        v-if="token && failed !== 'invalid' && failed !== 'revoked'"
+        class="mt-5 flex flex-wrap gap-3"
+      >
+        <UButton :loading="busy" :disabled="busy" @click="open">{{
+          $t(result ? 'presentation.checkAgain' : 'presentation.open')
+        }}</UButton>
+        <UButton
+          v-if="!auth.user.value"
+          :disabled="busy"
+          color="neutral"
+          variant="outline"
+          @click="signIn"
+          >{{ $t('auth.signIn') }}</UButton
+        >
+        <UButton v-else :to="localePath('/verifier')" color="neutral" variant="outline">{{
+          $t('verifier.title')
+        }}</UButton>
+      </div>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/recipient/credentials/[generationId]/index.vue b/apps/web/app/pages/recipient/credentials/[generationId]/index.vue
new file mode 100644
index 0000000..bf269aa
--- /dev/null
+++ b/apps/web/app/pages/recipient/credentials/[generationId]/index.vue
@@ -0,0 +1,158 @@
+<script setup lang="ts">
+import type { RecipientCredentialDetail, RecipientPayloadView } from '~/types/portal'
+import { recipientCredentialPath } from '~/utils/presentationView'
+import { singleRouteQueryValue } from '~/utils/operationLinks'
+
+definePageMeta({ middleware: ['auth'] })
+const route = useRoute()
+const localePath = useLocalePath()
+const { t } = useI18n()
+const request = useRequestFetch()
+const auth = useAuth()
+const generationId = computed(() => String(route.params.generationId))
+const profileId = computed(() => singleRouteQueryValue(route.query.profile))
+const {
+  data: detail,
+  error,
+  status,
+  refresh,
+} = useAsyncData(
+  () => `recipient-credential:${profileId.value}:${generationId.value}`,
+  () =>
+    request<RecipientCredentialDetail>(
+      recipientCredentialPath(profileId.value, generationId.value),
+    ),
+)
+const shareLink = computed(() => ({
+  path: localePath(`/recipient/credentials/${generationId.value}/present`),
+  query: { profile: profileId.value },
+}))
+const content = shallowRef<RecipientPayloadView | null>(null)
+const contentBusy = ref(false)
+const contentError = ref(false)
+let contentRevision = 0
+let disposed = false
+function clearContent() {
+  contentRevision += 1
+  content.value = null
+}
+function hideContent() {
+  if (document.visibilityState === 'hidden') clearContent()
+}
+watch([profileId, generationId, () => auth.user.value?.id], clearContent)
+onMounted(() => document.addEventListener('visibilitychange', hideContent))
+onBeforeUnmount(() => {
+  disposed = true
+  clearContent()
+  document.removeEventListener('visibilitychange', hideContent)
+})
+async function readContent() {
+  if (contentBusy.value) return
+  contentBusy.value = true
+  contentError.value = false
+  clearContent()
+  const revision = contentRevision
+  const identity = auth.user.value?.id
+  try {
+    const payload = await request<RecipientPayloadView>(
+      `${recipientCredentialPath(profileId.value, generationId.value)}/payload`,
+    )
+    if (
+      !disposed &&
+      revision === contentRevision &&
+      identity === auth.user.value?.id &&
+      document.visibilityState === 'visible'
+    )
+      content.value = payload
+  } catch {
+    contentError.value = true
+  } finally {
+    contentBusy.value = false
+  }
+}
+useSeoMeta({
+  title: () => `${detail.value?.schemaName ?? t('recipient.credential')} — XCS`,
+  robots: 'noindex,nofollow',
+})
+</script>
+<template>
+  <div>
+    <UContainer class="max-w-5xl py-8">
+      <UButton :to="localePath('/recipient')" color="neutral" variant="outline">{{
+        $t('recipient.back')
+      }}</UButton>
+      <StatusBox v-if="error" class="mt-5" tone="error" role="alert">{{
+        $t('recipient.error')
+      }}</StatusBox>
+      <p v-else-if="status === 'pending'" class="mt-5">{{ $t('issuer.loading') }}</p>
+      <template v-else-if="detail">
+        <PageHeader
+          class="mt-5"
+          :title="detail.schemaName ?? $t('recipient.credential')"
+          :lead="detail.organizationName"
+        />
+        <AttestationStatus :value="detail.status.state" />
+        <p class="mt-3 text-muted">{{ $t(`recipient.visibility.${detail.visibility}`) }}</p>
+        <section
+          v-if="detail.visibility === 'private'"
+          class="mt-4"
+          :aria-label="$t('presentation.publicFields')"
+        >
+          <h2 class="font-semibold">{{ $t('presentation.publicFields') }}</h2>
+          <ul v-if="detail.disclosure.publicFields.length" class="mt-2 list-inside list-disc">
+            <li v-for="field in detail.disclosure.publicFields" :key="field">{{ field }}</li>
+          </ul>
+          <p v-else class="mt-2 text-sm text-muted">{{ $t('presentation.noFields') }}</p>
+        </section>
+        <p v-if="detail.status.state === 'pending'" class="mt-3">
+          {{ $t('recipient.reviewHelp') }}
+        </p>
+        <UButton v-if="detail.status.state === 'active'" :to="shareLink" class="mt-5">{{
+          $t('recipient.present')
+        }}</UButton>
+        <p v-else-if="detail.status.state !== 'pending'" class="mt-4 text-muted">
+          {{ $t('recipient.inactiveHelp') }}
+        </p>
+        <StatusBox class="mt-5">
+          {{ $t(`portal.admission.${detail.issuerAdmission ?? 'unknown'}`) }}
+        </StatusBox>
+        <section v-if="detail.status.accepted" class="mt-5">
+          <p class="text-sm text-muted">{{ $t('recipient.readHelp') }}</p>
+          <UButton
+            class="mt-3"
+            :disabled="contentBusy"
+            :loading="contentBusy"
+            @click="readContent"
+            >{{ $t('recipient.readContent') }}</UButton
+          >
+          <StatusBox v-if="contentError" tone="error" class="mt-4">{{
+            $t('recipient.readError')
+          }}</StatusBox>
+          <template v-if="content">
+            <AttestationFields class="mt-5" :claims="content.claims" />
+            <details class="mt-5 rounded border border-default p-4">
+              <summary class="cursor-pointer font-semibold">
+                {{ $t('simpleRecipient.verificationDetails') }}
+              </summary>
+              <VerificationGrid class="mt-3" :report="content.verification" />
+            </details>
+          </template>
+        </section>
+      </template>
+    </UContainer>
+    <CredentialSubjectAction
+      v-if="
+        detail &&
+        !error &&
+        (detail.status.accepted
+          ? ['active', 'expired'].includes(detail.status.state)
+          : ['pending', 'expired'].includes(detail.status.state))
+      "
+      :fixed-credential="detail"
+      :initial-action="
+        detail.status.accepted ? 'remove' : detail.status.state === 'expired' ? 'reject' : 'accept'
+      "
+      @reconciled="refresh()"
+    />
+  </div>
+</template>
diff --git a/apps/web/app/pages/recipient/credentials/[generationId]/present.vue b/apps/web/app/pages/recipient/credentials/[generationId]/present.vue
new file mode 100644
index 0000000..b535e2b
--- /dev/null
+++ b/apps/web/app/pages/recipient/credentials/[generationId]/present.vue
@@ -0,0 +1,308 @@
+<script setup lang="ts">
+import type {
+  CreatedPresentationView,
+  PresentationView,
+  RecipientCredentialDetail,
+} from '~/types/portal'
+import { presentationLink, recipientCredentialPath } from '~/utils/presentationView'
+import { singleRouteQueryValue } from '~/utils/operationLinks'
+import { useWallet as useXrplConnectWallet } from '@xrpl-commons/xrpl-connect-vue'
+import { signWalletLinkChallenge } from '~/utils/walletLinkProof'
+import { supportsWalletLinkProof } from '~/utils/roleJourney'
+
+definePageMeta({ middleware: ['auth'] })
+const route = useRoute()
+const auth = useAuth()
+const { t, locale } = useI18n()
+const localePath = useLocalePath()
+const request = useRequestFetch()
+const wallet = import.meta.client ? useXrplConnectWallet() : undefined
+const { account } = useWallet()
+const generationId = computed(() => String(route.params.generationId))
+const profileId = computed(() => singleRouteQueryValue(route.query.profile))
+const scope = ref<'public' | 'full'>('public')
+const verifierOrganizationId = ref('')
+const busy = ref(false)
+const mutationError = ref<'limit' | 'failed' | 'proof' | null>(null)
+const created = shallowRef<{ id: string; url: string } | null>(null)
+const { data, error, status, refresh } = useAsyncData(
+  () => `recipient-sharing:${profileId.value}:${generationId.value}`,
+  async () => {
+    const [credential, verifiers, presentations] = await Promise.all([
+      request<RecipientCredentialDetail>(
+        recipientCredentialPath(profileId.value, generationId.value),
+      ),
+      request<{ verifiers: { id: string; name: string }[] }>('/api/recipient/verifiers'),
+      request<{ presentations: PresentationView[] }>('/api/recipient/presentations', {
+        query: { profileId: profileId.value, generationId: generationId.value },
+      }),
+    ])
+    return {
+      credential,
+      verifiers: verifiers.verifiers,
+      presentations: presentations.presentations,
+    }
+  },
+)
+const selectedVerifier = computed(() =>
+  data.value?.verifiers.find((item) => item.id === verifierOrganizationId.value),
+)
+const fields = computed(() =>
+  scope.value === 'full'
+    ? (data.value?.credential.disclosure.fields ?? [])
+    : (data.value?.credential.disclosure.publicFields ?? []),
+)
+const canCreate = computed(
+  () =>
+    data.value?.credential.status.state === 'active' &&
+    (scope.value === 'public' || Boolean(selectedVerifier.value)),
+)
+const walletReady = computed(() => {
+  const current = account.value
+  return (
+    current?.address === data.value?.credential.subjectAddress &&
+    current?.network.id === 'testnet' &&
+    wallet?.manager.connected === true &&
+    supportsWalletLinkProof(wallet.manager.wallet?.id ?? '') &&
+    wallet.manager.supports('signMessage')
+  )
+})
+let formRevision = 0
+watch([profileId, generationId, scope, verifierOrganizationId, () => auth.user.value?.id], () => {
+  formRevision += 1
+  created.value = null
+})
+onBeforeUnmount(() => {
+  formRevision += 1
+  created.value = null
+})
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium', timeStyle: 'short' }).format(
+    new Date(value),
+  )
+watch([profileId, generationId], () => {
+  created.value = null
+  scope.value = 'public'
+  verifierOrganizationId.value = ''
+})
+async function create() {
+  if (busy.value || !canCreate.value || !walletReady.value || !wallet) return
+  busy.value = true
+  mutationError.value = null
+  created.value = null
+  const attempt = formRevision
+  const input = {
+    profileId: profileId.value,
+    generationId: generationId.value,
+    scope: scope.value,
+    ...(scope.value === 'full' ? { verifierOrganizationId: verifierOrganizationId.value } : {}),
+  }
+  try {
+    const challenge = await auth.mutateApplication<{
+      id: string
+      address: string
+      networkId: number
+      message: string
+      expiresAt: string
+    }>('/api/recipient/presentation-challenges', input)
+    if (
+      attempt !== formRevision ||
+      challenge.address !== data.value?.credential.subjectAddress ||
+      challenge.networkId !== 1 ||
+      !walletReady.value
+    )
+      throw new Error('PRESENTATION_PROOF_CONTEXT_CHANGED')
+    const proof = await signWalletLinkChallenge(
+      wallet.manager,
+      { address: challenge.address, networkId: 'testnet' },
+      challenge.message,
+    )
+    if (attempt !== formRevision) throw new Error('PRESENTATION_PROOF_CONTEXT_CHANGED')
+    const result = await auth.mutateApplication<CreatedPresentationView>(
+      '/api/recipient/presentations',
+      {
+        ...input,
+        proof: { challengeId: challenge.id, ...proof },
+      },
+    )
+    if (attempt !== formRevision) return
+    created.value = {
+      id: result.id,
+      url: presentationLink(window.location.origin, localePath('/presentations'), result.token),
+    }
+    await refresh()
+  } catch (cause) {
+    if (attempt !== formRevision) return
+    const code = (cause as { data?: { error?: string } }).data?.error
+    mutationError.value =
+      code === 'RECIPIENT_PRESENTATION_LIMIT'
+        ? 'limit'
+        : code?.startsWith('RECIPIENT_PROOF_') ||
+            (cause instanceof Error && cause.message.startsWith('WALLET_'))
+          ? 'proof'
+          : 'failed'
+  } finally {
+    busy.value = false
+  }
+}
+async function revoke(id: string) {
+  if (busy.value) return
+  busy.value = true
+  mutationError.value = null
+  try {
+    await auth.mutateApplication(
+      `/api/recipient/presentations/${encodeURIComponent(id)}/revoke`,
+      {},
+    )
+    if (created.value?.id === id) created.value = null
+    await refresh()
+  } catch {
+    mutationError.value = 'failed'
+  } finally {
+    busy.value = false
+  }
+}
+useSeoMeta({
+  title: () => `${t('presentation.createTitle')} — XCS`,
+  robots: 'noindex,nofollow',
+  referrer: 'no-referrer',
+})
+</script>
+<template>
+  <UContainer class="max-w-4xl py-10">
+    <UButton
+      :to="{
+        path: localePath(`/recipient/credentials/${generationId}`),
+        query: { profile: profileId },
+      }"
+      color="neutral"
+      variant="outline"
+      class="mb-5"
+      >{{ $t('recipient.open') }}</UButton
+    >
+    <PageHeader :title="$t('presentation.createTitle')" :lead="$t('presentation.createHelp')" />
+    <StatusBox v-if="error || mutationError" tone="error" role="alert" class="mb-5">{{
+      $t(
+        mutationError === 'limit'
+          ? 'presentation.limit'
+          : mutationError === 'proof'
+            ? 'roleJourney.proofFailed'
+            : 'presentation.actionError',
+      )
+    }}</StatusBox>
+    <p v-if="status === 'pending'">{{ $t('issuer.loading') }}</p>
+    <template v-else-if="data && !error">
+      <h2 class="mb-4 text-xl font-semibold">
+        {{ data.credential.schemaName ?? $t('recipient.credential') }}
+      </h2>
+      <StatusBox v-if="data.credential.status.state !== 'active'" tone="warning">{{
+        $t('recipient.inactiveHelp')
+      }}</StatusBox>
+      <form v-else class="grid gap-5" @submit.prevent="create">
+        <fieldset class="grid gap-3">
+          <legend class="mb-3 font-semibold">{{ $t('presentation.scope') }}</legend>
+          <label class="flex gap-3"
+            ><input v-model="scope" type="radio" value="public" :disabled="busy" />{{
+              $t('presentation.public')
+            }}</label
+          >
+          <label class="flex gap-3"
+            ><input v-model="scope" type="radio" value="full" :disabled="busy" />{{
+              $t('presentation.full')
+            }}</label
+          >
+        </fieldset>
+        <label v-if="scope === 'full'" class="font-semibold">
+          {{ $t('presentation.verifier') }}
+          <select
+            v-model="verifierOrganizationId"
+            required
+            :disabled="busy"
+            class="mt-2 block w-full rounded border border-default bg-default p-3"
+          >
+            <option value="">{{ $t('presentation.chooseVerifier') }}</option>
+            <option v-for="verifier in data.verifiers" :key="verifier.id" :value="verifier.id">
+              {{ verifier.name }}
+            </option>
+          </select>
+          <span v-if="!data.verifiers.length" class="mt-2 block text-sm font-normal text-muted">{{
+            $t('presentation.noVerifiers')
+          }}</span>
+        </label>
+        <section class="rounded border border-default p-4" :aria-label="$t('presentation.preview')">
+          <h3 class="font-semibold">{{ $t('presentation.preview') }}</h3>
+          <p class="mt-2">
+            {{
+              scope === 'full'
+                ? $t('presentation.fullAudience', {
+                    verifier: selectedVerifier?.name ?? $t('presentation.chooseVerifier'),
+                  })
+                : $t('presentation.publicAudience')
+            }}
+          </p>
+          <p v-if="scope === 'full'" class="mt-2 text-sm text-muted">
+            {{ $t('presentation.publicStillVisible') }}
+          </p>
+          <p class="mt-3 text-sm font-semibold">{{ $t('presentation.fields') }}</p>
+          <ul v-if="fields.length" class="mt-2 list-inside list-disc">
+            <li v-for="field in fields" :key="field">{{ field }}</li>
+          </ul>
+          <p v-else class="mt-2 text-sm text-muted">{{ $t('presentation.noFields') }}</p>
+        </section>
+        <p class="text-sm text-muted">{{ $t('presentation.duration') }}</p>
+        <section
+          class="rounded border border-default p-4"
+          :aria-label="$t('roleJourney.shareProofTitle')"
+        >
+          <h3 class="font-semibold">{{ $t('roleJourney.shareProofTitle') }}</h3>
+          <p class="mt-2 text-sm text-muted">{{ $t('roleJourney.shareProofHelp') }}</p>
+          <ClientOnly
+            ><div class="mt-3"><WalletButton proof-only test-id-prefix="presentation-wallet" /></div
+          ></ClientOnly>
+          <p v-if="!walletReady" class="mt-3 text-sm text-muted">
+            {{ $t('roleJourney.shareConnectWallet') }}
+          </p>
+        </section>
+
+        <UButton type="submit" :disabled="busy || !canCreate || !walletReady" :loading="busy">{{
+          $t('presentation.create')
+        }}</UButton>
+      </form>
+      <PresentationLink v-if="created" :url="created.url" />
+      <section class="mt-10" aria-labelledby="recipient-presentations">
+        <h2 id="recipient-presentations" class="text-xl font-semibold">
+          {{ $t('presentation.existing') }}
+        </h2>
+        <p class="mt-2 text-sm text-muted">{{ $t('presentation.revokeHelp') }}</p>
+        <p v-if="!data.presentations.length" class="mt-4 text-muted">
+          {{ $t('presentation.none') }}
+        </p>
+        <ul v-else class="mt-4 grid gap-3">
+          <li
+            v-for="item in data.presentations"
+            :key="item.id"
+            class="rounded border border-default p-4"
+          >
+            <p class="font-semibold">
+              {{ $t(`presentation.${item.scope}`)
+              }}<span v-if="item.verifierOrganizationName">
+                · {{ item.verifierOrganizationName }}</span
+              >
+            </p>
+            <p class="mt-2 text-sm text-muted">{{ date(item.createdAt) }}</p>
+            <p v-if="item.revokedAt" class="mt-2">{{ $t('presentation.revoked') }}</p>
+            <UButton
+              v-else
+              :disabled="busy"
+              class="mt-3"
+              color="neutral"
+              variant="outline"
+              @click="revoke(item.id)"
+              >{{ $t('presentation.revoke') }}</UButton
+            >
+          </li>
+        </ul>
+      </section>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/recipient/index.vue b/apps/web/app/pages/recipient/index.vue
new file mode 100644
index 0000000..8e4b5cb
--- /dev/null
+++ b/apps/web/app/pages/recipient/index.vue
@@ -0,0 +1,152 @@
+<script setup lang="ts">
+import type { RecipientCredentialCard } from '~/types/portal'
+
+definePageMeta({ middleware: ['auth'] })
+const { t, locale } = useI18n()
+const auth = useAuth()
+const hasLinkedWallet = computed(
+  () => auth.user.value?.wallets.some((wallet) => wallet.networkId === 1) === true,
+)
+const localePath = useLocalePath()
+const { data, error, status, refresh } = useRecipientWorkspace()
+const groups = computed(() => [
+  {
+    key: 'ready',
+    credentials: data.value?.credentials.filter((item) => item.status.state === 'pending') ?? [],
+  },
+  {
+    key: 'accepted',
+    credentials: data.value?.credentials.filter((item) => item.status.state === 'active') ?? [],
+  },
+  {
+    key: 'inactive',
+    credentials:
+      data.value?.credentials.filter(
+        (item) => !['active', 'pending'].includes(item.status.state),
+      ) ?? [],
+  },
+])
+const waiting = computed(() => data.value?.invitations.filter((item) => !item.generationId) ?? [])
+function credentialLink(item: Pick<RecipientCredentialCard, 'generationId' | 'profileId'>) {
+  return {
+    path: localePath(`/recipient/credentials/${item.generationId}`),
+    query: { profile: item.profileId },
+  }
+}
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium' }).format(new Date(value))
+useSeoMeta({ title: () => `${t('recipient.title')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+<template>
+  <UContainer class="max-w-5xl py-10">
+    <PageHeader :title="$t('recipient.title')" :lead="$t('recipient.intro')">
+      <template #actions>
+        <UButton
+          :to="{ path: localePath('/account'), query: { returnTo: localePath('/recipient') } }"
+          color="neutral"
+          variant="outline"
+          >{{
+            $t(hasLinkedWallet ? 'simpleRecipient.manageWallet' : 'roleJourney.prepareWallet')
+          }}</UButton
+        >
+        <UButton :loading="status === 'pending'" @click="refresh()">{{
+          $t('recipient.refresh')
+        }}</UButton>
+      </template>
+    </PageHeader>
+    <StatusBox v-if="error" tone="error" role="alert">{{ $t('recipient.error') }}</StatusBox>
+    <p v-else-if="status === 'pending'">{{ $t('issuer.loading') }}</p>
+    <template v-else-if="data">
+      <section
+        v-if="data.notifications.length"
+        class="mb-8"
+        aria-labelledby="recipient-notifications"
+      >
+        <h2 id="recipient-notifications" class="text-xl font-semibold">
+          {{ $t('recipient.notifications') }}
+        </h2>
+        <ul class="mt-3 grid gap-2">
+          <li
+            v-for="notice in data.notifications"
+            :key="notice.id"
+            class="rounded border border-default p-3"
+          >
+            <NuxtLink :to="credentialLink(notice)">{{
+              $t(`recipient.notification.${notice.kind}`, { issuer: notice.organizationName })
+            }}</NuxtLink>
+            <time :datetime="notice.createdAt" class="ml-3 text-sm text-muted">{{
+              date(notice.createdAt)
+            }}</time>
+          </li>
+        </ul>
+      </section>
+      <p v-if="!data.invitations.length && !data.credentials.length" class="mb-6 text-muted">
+        {{ $t('recipient.empty') }}
+      </p>
+      <section v-if="waiting.length" class="mb-8" aria-labelledby="recipient-waiting">
+        <h2 id="recipient-waiting" class="text-xl font-semibold">{{ $t('recipient.waiting') }}</h2>
+        <ul class="mt-3 grid gap-3 sm:grid-cols-2">
+          <li v-for="invite in waiting" :key="invite.id">
+            <UCard>
+              <h3 class="font-semibold">{{ invite.schemaName ?? $t('recipient.credential') }}</h3>
+              <p class="mt-1">{{ invite.organizationName }}</p>
+              <p class="mt-3 text-sm text-muted">
+                {{
+                  $t(
+                    invite.revokedAt
+                      ? 'recipient.invitationInactive'
+                      : hasLinkedWallet
+                        ? 'recipient.waitingHelp'
+                        : 'roleJourney.walletRequiredBeforeIssuance',
+                  )
+                }}
+              </p>
+              <UButton
+                v-if="!invite.revokedAt && !hasLinkedWallet"
+                class="mt-4"
+                :to="{
+                  path: localePath('/account'),
+                  query: { returnTo: localePath('/recipient') },
+                }"
+                >{{ $t('roleJourney.prepareWallet') }}</UButton
+              >
+            </UCard>
+          </li>
+        </ul>
+      </section>
+      <section
+        v-for="group in groups"
+        :key="group.key"
+        class="mb-8"
+        :aria-labelledby="`recipient-${group.key}`"
+      >
+        <h2 :id="`recipient-${group.key}`" class="text-xl font-semibold">
+          {{ $t(`recipient.${group.key}`) }} ({{ group.credentials.length }})
+        </h2>
+        <p v-if="!group.credentials.length" class="mt-3 text-sm text-muted">
+          {{ $t('recipient.noItems') }}
+        </p>
+        <ul v-else class="mt-3 grid gap-3 sm:grid-cols-2">
+          <li
+            v-for="credential in group.credentials"
+            :key="`${credential.profileId}:${credential.generationId}`"
+          >
+            <UCard>
+              <h3 class="font-semibold">
+                {{ credential.schemaName ?? $t('recipient.credential') }}
+              </h3>
+              <p class="mt-1">{{ credential.organizationName }}</p>
+              <AttestationStatus class="mt-3" :value="credential.status.state" />
+              <p class="mt-3 text-sm text-muted">
+                {{ $t(`recipient.visibility.${credential.visibility}`) }}
+              </p>
+              <UButton :to="credentialLink(credential)" class="mt-4">{{
+                $t(group.key === 'ready' ? 'simpleRecipient.reviewAttestation' : 'recipient.open')
+              }}</UButton>
+            </UCard>
+          </li>
+        </ul>
+      </section>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/recipient/invitations.vue b/apps/web/app/pages/recipient/invitations.vue
new file mode 100644
index 0000000..59eb96a
--- /dev/null
+++ b/apps/web/app/pages/recipient/invitations.vue
@@ -0,0 +1,193 @@
+<script setup lang="ts">
+import { purgePrivateLinkFragment } from '~/utils/privateLinkHistory'
+
+const auth = useAuth()
+const handoff = usePrivateLinkHandoff()
+const localePath = useLocalePath()
+const route = useRoute()
+const { t } = useI18n()
+const token = ref('')
+const usableToken = computed(() => /^[A-Za-z0-9_-]{43}$/.test(token.value))
+const loaded = ref(false)
+const failed = ref(false)
+const busy = ref(false)
+const claimed = ref(false)
+const hasLinkedWallet = computed(
+  () => auth.user.value?.wallets.some((wallet) => wallet.networkId === 1) === true,
+)
+const preview = ref<{ organizationName?: string; schemaName?: string } | null>(null)
+let revision = 0
+let initialized = false
+let disposed = false
+function resetView() {
+  revision += 1
+  preview.value = null
+  claimed.value = false
+  failed.value = false
+  busy.value = false
+  loaded.value = false
+}
+function current(attempt: number, identity?: string) {
+  return !disposed && attempt === revision && identity === auth.user.value?.id
+}
+async function loadPreview(refreshSession: boolean) {
+  const attempt = revision
+  if (refreshSession) await auth.load(true)
+  if (disposed || attempt !== revision) return
+  const identity = auth.user.value?.id
+  const requestToken = token.value
+  if (!/^[A-Za-z0-9_-]{43}$/.test(requestToken)) {
+    failed.value = true
+    loaded.value = true
+    return
+  }
+  if (!identity) {
+    loaded.value = true
+    return
+  }
+  try {
+    const result = await auth.mutateApplication<{ organizationName?: string; schemaName?: string }>(
+      '/api/issuer/invitations/preview',
+      { token: requestToken },
+    )
+    if (current(attempt, identity)) preview.value = result
+  } catch {
+    if (current(attempt, identity)) failed.value = true
+  } finally {
+    if (current(attempt, identity)) loaded.value = true
+  }
+}
+function captureFragment() {
+  const fragment = window.location.hash
+  if (!fragment) return
+  // Native and router hash navigation can reuse this page. Reading the live URL prevents
+  // duplicate consumption; clearing the prior revision prevents late preview/claim responses.
+  purgePrivateLinkFragment()
+  resetView()
+  token.value = fragment.slice(1)
+  if (initialized) void loadPreview(true)
+}
+watch(
+  () => route.hash,
+  () => {
+    if (import.meta.client) captureFragment()
+  },
+)
+watch(
+  () => auth.user.value?.id,
+  () => {
+    if (!initialized || disposed) return
+    resetView()
+    void loadPreview(false)
+  },
+)
+onMounted(async () => {
+  window.addEventListener('hashchange', captureFragment)
+  captureFragment()
+  await auth.load(true)
+  if (disposed) return
+  if (auth.user.value && !token.value) {
+    const attempt = revision
+    const identity = auth.user.value.id
+    try {
+      const restored = await handoff.consume('invitation')
+      if (current(attempt, identity)) token.value = restored ?? ''
+    } catch {
+      if (current(attempt, identity)) failed.value = true
+    }
+  }
+  if (disposed) return
+  initialized = true
+  await loadPreview(false)
+})
+onBeforeUnmount(() => {
+  disposed = true
+  resetView()
+  token.value = ''
+  window.removeEventListener('hashchange', captureFragment)
+})
+async function signIn() {
+  if (busy.value || !loaded.value || !/^[A-Za-z0-9_-]{43}$/.test(token.value)) return
+  busy.value = true
+  const attempt = revision
+  const identity = auth.user.value?.id
+  const requestToken = token.value
+  try {
+    await handoff.save('invitation', requestToken)
+    if (!current(attempt, identity)) return
+    await navigateTo({
+      path: localePath('/auth/login'),
+      query: { returnTo: localePath('/recipient/invitations') },
+    })
+  } catch {
+    if (current(attempt, identity)) failed.value = true
+  } finally {
+    if (current(attempt, identity)) busy.value = false
+  }
+}
+async function claim() {
+  if (busy.value || !preview.value || !auth.user.value || !/^[A-Za-z0-9_-]{43}$/.test(token.value))
+    return
+  busy.value = true
+  const attempt = revision
+  const identity = auth.user.value.id
+  const requestToken = token.value
+  try {
+    await auth.mutateApplication('/api/issuer/invitations/claim', { token: requestToken })
+    if (!current(attempt, identity)) return
+    claimed.value = true
+    token.value = ''
+  } catch {
+    if (current(attempt, identity)) failed.value = true
+  } finally {
+    if (current(attempt, identity)) busy.value = false
+  }
+}
+useSeoMeta({
+  title: () => `${t('issuer.claimTitle')} — XCS`,
+  robots: 'noindex,nofollow',
+  referrer: 'no-referrer',
+})
+</script>
+<template>
+  <UContainer class="max-w-2xl py-10">
+    <PageHeader :title="$t('issuer.claimTitle')" :lead="$t('issuer.claimHelp')" />
+    <p v-if="!loaded">{{ $t('issuer.loading') }}</p>
+    <template v-else-if="!auth.user.value">
+      <p class="mb-4">{{ $t('issuer.claimLogin') }}</p>
+      <StatusBox v-if="failed" tone="error">{{ $t('issuer.claimUnavailable') }}</StatusBox>
+      <UButton :loading="busy" :disabled="busy || !usableToken" @click="signIn">{{
+        $t('auth.signIn')
+      }}</UButton>
+    </template>
+    <StatusBox v-else-if="failed" tone="error">{{ $t('issuer.claimUnavailable') }}</StatusBox>
+    <template v-else-if="claimed">
+      <StatusBox tone="success">{{
+        $t(hasLinkedWallet ? 'simpleRecipient.invitationReady' : 'issuer.claimedHelp')
+      }}</StatusBox>
+      <UButton v-if="hasLinkedWallet" class="mt-5" :to="localePath('/recipient')">{{
+        $t('roleJourney.continueRecipient')
+      }}</UButton>
+      <UButton
+        v-else
+        class="mt-5"
+        :to="{ path: localePath('/account'), query: { returnTo: localePath('/recipient') } }"
+        >{{ $t('roleJourney.prepareWallet') }}</UButton
+      >
+      <UButton
+        v-if="!hasLinkedWallet"
+        class="mt-5 ml-3"
+        :to="localePath('/recipient')"
+        variant="outline"
+        >{{ $t('recipient.title') }}</UButton
+      >
+    </template>
+    <template v-else-if="preview">
+      <h2 class="text-xl font-semibold">{{ preview.schemaName }}</h2>
+      <p class="mt-2">{{ preview.organizationName }}</p>
+      <UButton class="mt-5" :loading="busy" :disabled="busy" @click="claim">{{
+        $t('issuer.claim')
+      }}</UButton>
+    </template>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/revoke.vue b/apps/web/app/pages/revoke.vue
index 377bc91..97c85a0 100644
--- a/apps/web/app/pages/revoke.vue
+++ b/apps/web/app/pages/revoke.vue
@@ -1,339 +1,11 @@
 <script setup lang="ts">
-import { rippleTimeToIso } from '#xcs/core/index.js'
-import { buildCredentialDelete } from '#xcs/sdk/index.js'
-import type { CredentialDelete } from 'xrpl'
-import type { WalletSubmissionResult } from '~/composables/useWallet'
-import {
-  credentialRevocationBlockReason,
-  parseApiCredentialDetail,
-  parseVerificationDimensions,
-  type ApiCredentialDetail,
-  type VerificationDimensions,
-} from '~/utils/credentialReview'
-import {
-  assertLinkGeneration,
-  assertLinkProfile,
-  buildCredentialPermalink,
-  singleRouteQueryValue,
-} from '~/utils/operationLinks'
-import { parseWalletCredentialTransactionError } from '~/utils/walletCompatibility'
-import { decodeHexUtf8 } from '~/utils/serialization'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const route = useRoute()
-const localePath = useLocalePath()
-const { t } = useI18n()
-const { account, busy: walletBusy, prepare, signAndSubmit } = useWallet()
-const { getActiveNetworkProfile, getCredential, verify } = useXcsApi()
-const subject = ref(singleRouteQueryValue(route.query.subject))
-const schemaUid = ref(singleRouteQueryValue(route.query.schema))
-const linkedProfileId = ref(singleRouteQueryValue(route.query.profile))
-const linkedGenerationId = ref(singleRouteQueryValue(route.query.generation))
-const transaction = shallowRef<CredentialDelete | null>(null)
-const credential = shallowRef<ApiCredentialDetail | null>(null)
-const report = shallowRef<VerificationDimensions | null>(null)
-const reviewProfileId = ref<string | null>(null)
-const reviewBusy = ref(false)
-const message = ref('')
-const result = shallowRef<WalletSubmissionResult | null>(null)
-const busy = computed(() => walletBusy.value || reviewBusy.value)
-const messageDisplay = computed(() => {
-  const walletTransactionError = parseWalletCredentialTransactionError(message.value)
-  return walletTransactionError
-    ? t('wallet.errors.credentialUnsupported', {
-        wallet: walletTransactionError.walletName,
-        transactionType: walletTransactionError.transactionType,
-      })
-    : message.value
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/revoke', locale.value), {
+  replace: true,
+  redirectCode: 308,
 })
-const messageIsLocalized = computed(
-  () => message.value.length > 0 && messageDisplay.value !== message.value,
-)
-const resultCredentialLink = computed(() => {
-  const generationId = result.value?.businessEvidence?.generationId
-  if (
-    result.value?.businessConfirmation !== 'confirmed' ||
-    !generationId ||
-    !reviewProfileId.value
-  ) {
-    return null
-  }
-  return buildCredentialPermalink({
-    profileId: reviewProfileId.value,
-    generationId,
-  })
-})
-const decodedUri = computed(() => {
-  if (!credential.value?.uriHex) return null
-  try {
-    return decodeHexUtf8(credential.value.uriHex)
-  } catch {
-    return null
-  }
-})
-const expiration = computed(() =>
-  credential.value?.expiration === null || credential.value?.expiration === undefined
-    ? null
-    : rippleTimeToIso(credential.value.expiration),
-)
-let previewRevision = 0
-
-function invalidatePreview() {
-  previewRevision += 1
-  transaction.value = null
-  credential.value = null
-  report.value = null
-  reviewProfileId.value = null
-  result.value = null
-}
-
-watch([subject, schemaUid, linkedProfileId, linkedGenerationId], invalidatePreview)
-watch(
-  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
-  invalidatePreview,
-)
-watch(
-  () => [route.query.subject, route.query.schema, route.query.profile, route.query.generation],
-  ([nextSubject, nextSchema, nextProfile, nextGeneration]) => {
-    subject.value = singleRouteQueryValue(nextSubject)
-    schemaUid.value = singleRouteQueryValue(nextSchema)
-    linkedProfileId.value = singleRouteQueryValue(nextProfile)
-    linkedGenerationId.value = singleRouteQueryValue(nextGeneration)
-  },
-)
-
-async function fetchExactCredential(input: {
-  issuer: string
-  subject: string
-  schemaUid: string
-  profileId: string
-  expectedGenerationId?: string | undefined
-}) {
-  const [rawCredential, rawReport] = await Promise.all([
-    getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
-    verify(
-      {
-        issuer: input.issuer,
-        subject: input.subject,
-        schemaUid: input.schemaUid,
-        resolvePayload: false,
-      },
-      input.profileId,
-    ),
-  ])
-  const exactCredential = parseApiCredentialDetail(rawCredential, input)
-  assertLinkGeneration(input.expectedGenerationId, exactCredential.generationId)
-  const dimensions = parseVerificationDimensions(rawReport)
-  if (exactCredential.state !== dimensions.onChain) {
-    throw new Error('CREDENTIAL_REVIEW_STATE_MISMATCH')
-  }
-  if (dimensions.generationId && dimensions.generationId !== exactCredential.generationId) {
-    throw new Error('CREDENTIAL_REVIEW_GENERATION_MISMATCH')
-  }
-  const reason = credentialRevocationBlockReason(exactCredential)
-  if (reason) throw new Error(reason)
-  return { exactCredential, dimensions }
-}
-
-async function buildPreview() {
-  invalidatePreview()
-  message.value = ''
-  if (!account.value) return void (message.value = 'WALLET_NOT_CONNECTED')
-
-  reviewBusy.value = true
-  const revision = previewRevision
-  const issuerAddress = account.value.address
-  const subjectAddress = subject.value
-  const normalizedSchemaUid = schemaUid.value.toLowerCase()
-  try {
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
-    const loaded = await fetchExactCredential({
-      issuer: issuerAddress,
-      subject: subjectAddress,
-      schemaUid: normalizedSchemaUid,
-      profileId: profile.profileId,
-      ...(linkedGenerationId.value ? { expectedGenerationId: linkedGenerationId.value } : {}),
-    })
-    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
-    credential.value = loaded.exactCredential
-    report.value = loaded.dimensions
-    reviewProfileId.value = profile.profileId
-    const raw = buildCredentialDelete({
-      account: issuerAddress,
-      issuer: issuerAddress,
-      subject: subjectAddress,
-      schemaUid: normalizedSchemaUid,
-    })
-    const prepared = (await prepare(raw, profile)) as CredentialDelete
-    if (revision !== previewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_BUILD')
-    transaction.value = prepared
-  } catch (error) {
-    transaction.value = null
-    message.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    reviewBusy.value = false
-  }
-}
-
-async function submit() {
-  const preparedTransaction = transaction.value
-  const expectedCredential = credential.value
-  const expectedIssuer = account.value?.address
-  const expectedSubject = subject.value
-  const expectedSchemaUid = schemaUid.value.toLowerCase()
-  const expectedLinkedProfileId = linkedProfileId.value
-  const expectedLinkedGenerationId = linkedGenerationId.value
-  const expectedReviewProfileId = reviewProfileId.value
-  const expectedRevision = previewRevision
-  if (!preparedTransaction || !expectedCredential || !expectedIssuer) {
-    message.value = 'TRANSACTION_PREVIEW_REQUIRED'
-    return
-  }
-
-  reviewBusy.value = true
-  message.value = ''
-  try {
-    const assertCurrent = () => {
-      if (
-        previewRevision !== expectedRevision ||
-        transaction.value !== preparedTransaction ||
-        account.value?.address !== expectedIssuer ||
-        subject.value !== expectedSubject ||
-        schemaUid.value.toLowerCase() !== expectedSchemaUid ||
-        linkedProfileId.value !== expectedLinkedProfileId ||
-        linkedGenerationId.value !== expectedLinkedGenerationId ||
-        reviewProfileId.value !== expectedReviewProfileId
-      ) {
-        throw new Error('CREDENTIAL_REVIEW_CHANGED_BEFORE_SIGNATURE')
-      }
-    }
-    assertCurrent()
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(expectedLinkedProfileId || undefined, profile.profileId)
-    assertLinkProfile(expectedReviewProfileId ?? undefined, profile.profileId)
-    const loaded = await fetchExactCredential({
-      issuer: expectedIssuer,
-      subject: expectedSubject,
-      schemaUid: expectedSchemaUid,
-      profileId: profile.profileId,
-      ...(expectedLinkedGenerationId ? { expectedGenerationId: expectedLinkedGenerationId } : {}),
-    })
-    assertCurrent()
-    if (loaded.exactCredential.generationId !== expectedCredential.generationId) {
-      throw new Error('CREDENTIAL_GENERATION_CHANGED_BEFORE_SIGNATURE')
-    }
-    credential.value = loaded.exactCredential
-    report.value = loaded.dimensions
-    const response = await signAndSubmit(
-      preparedTransaction,
-      {
-        action: 'credential-revoke',
-        issuer: expectedIssuer,
-        subject: expectedSubject,
-        schemaUid: expectedSchemaUid,
-        generationId: loaded.exactCredential.generationId,
-      },
-      assertCurrent,
-      undefined,
-      (validated) => {
-        result.value = { ...validated }
-      },
-    )
-    result.value = response
-    transaction.value = null
-  } catch (error) {
-    message.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    reviewBusy.value = false
-  }
-}
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      eyebrow="Credential issuer"
-      :title="$t('revoke.title')"
-      :lead="$t('revoke.description')"
-    />
-    <StatusBox tone="warning">{{ $t('revoke.warning') }}</StatusBox>
-
-    <UCard class="mb-6">
-      <div class="grid gap-5">
-        <UFormField label="Subject">
-          <UInput id="revoke-subject" v-model.trim="subject" placeholder="r…" :disabled="busy" />
-        </UFormField>
-        <UFormField label="Schema UID">
-          <UInput
-            id="revoke-schema"
-            v-model.trim="schemaUid"
-            pattern="[0-9a-fA-F]{64}"
-            :disabled="busy"
-          />
-        </UFormField>
-        <div>
-          <UButton :disabled="busy" @click="buildPreview">
-            {{ busy ? $t('common.working') : $t('revoke.review') }}
-          </UButton>
-        </div>
-      </div>
-    </UCard>
-
-    <StatusBox v-if="message" tone="error" data-testid="revoke-error" :title="messageDisplay">
-      <p v-if="messageIsLocalized">
-        <code>{{ message }}</code>
-      </p>
-    </StatusBox>
-
-    <UCard v-if="credential && report" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('revoke.exactCredential') }}</h2>
-      </template>
-      <MetadataList>
-        <dt>Issuer</dt>
-        <dd>
-          <code>{{ credential.issuer }}</code>
-        </dd>
-        <dt>Subject</dt>
-        <dd>
-          <code>{{ credential.subject }}</code>
-        </dd>
-        <dt>Schema UID</dt>
-        <dd>
-          <code>{{ credential.schemaUid }}</code>
-        </dd>
-        <dt>{{ $t('revoke.state') }}</dt>
-        <dd><StatusPill :value="credential.state" /></dd>
-        <dt>{{ $t('revoke.expiration') }}</dt>
-        <dd>{{ expiration ?? $t('revoke.noExpiration') }}</dd>
-        <dt>URI</dt>
-        <dd>
-          <code>{{ decodedUri ?? '—' }}</code>
-        </dd>
-        <dt>{{ $t('revoke.generation') }}</dt>
-        <dd>
-          <code>{{ credential.generationId }}</code>
-        </dd>
-      </MetadataList>
-    </UCard>
-
-    <TransactionPreview :transaction="transaction" :busy="busy" @confirm="submit" />
-    <BusinessFinality
-      v-if="result"
-      :tx-hash="result.txHash"
-      :engine-result="result.transactionResult"
-      :ledger-index="result.ledgerIndex"
-      :business-confirmation="result.businessConfirmation"
-      :business-evidence="result.businessEvidence"
-    />
-    <UButton
-      v-if="resultCredentialLink"
-      color="neutral"
-      variant="outline"
-      data-testid="revoke-result-permalink"
-      :to="localePath(resultCredentialLink)"
-    >
-      {{ $t('revoke.openPermalink') }}
-    </UButton>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/schemas/[uid].vue b/apps/web/app/pages/schemas/[uid].vue
index d5c6831..92cdb10 100644
--- a/apps/web/app/pages/schemas/[uid].vue
+++ b/apps/web/app/pages/schemas/[uid].vue
@@ -87,7 +87,7 @@ useSeoMeta({
       </template>
       <h2 class="mt-8 mb-3 text-xl font-semibold">{{ $t('schemas.definition') }}</h2>
       <JsonBlock :code="JSON.stringify(data.definition, null, 2)" />
-      <UButton :to="localePath(`/issue?schema=${data.uid}`)" color="neutral" variant="solid">
+      <UButton :to="localePath('/issuer/recipients')" color="neutral" variant="solid">
         {{ $t('schemas.use') }}
       </UButton>
     </template>
diff --git a/apps/web/app/pages/schemas/index.vue b/apps/web/app/pages/schemas/index.vue
index 6e4d45d..e97bb61 100644
--- a/apps/web/app/pages/schemas/index.vue
+++ b/apps/web/app/pages/schemas/index.vue
@@ -27,7 +27,7 @@ useSeoMeta({
   <UContainer class="py-10 sm:py-14">
     <PageHeader eyebrow="Registry" :title="$t('schemas.title')">
       <template #actions>
-        <UButton :to="localePath('/schemas/register')" color="neutral" variant="solid">
+        <UButton :to="localePath('/issuer/schemas/new')" color="neutral" variant="solid">
           {{ $t('schemas.register') }}
         </UButton>
       </template>
diff --git a/apps/web/app/pages/schemas/register.vue b/apps/web/app/pages/schemas/register.vue
index 945e02c..43015be 100644
--- a/apps/web/app/pages/schemas/register.vue
+++ b/apps/web/app/pages/schemas/register.vue
@@ -1,364 +1,11 @@
 <script setup lang="ts">
-import { buildSchemaRegistrationPayment } from '#xcs/sdk/index.js'
-import type { Payment } from 'xrpl'
-import type { WalletSubmissionResult } from '~/composables/useWallet'
-import {
-  GUIDED_SCHEMA_FIELD_TYPES,
-  createCourseCompletionDraft,
-  createDiplomaDraft,
-  createEmptyGuidedField,
-  guidedSchemaToJson,
-  schemaDefinitionToGuidedDraft,
-  type GuidedSchemaDraft,
-} from '~/utils/schemaAuthoring'
-import { encodeUtf8, parseJson, sha256Hex } from '~/utils/serialization'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const { account, busy, prepare, signAndSubmit } = useWallet()
-const { getActiveNetworkProfile } = useXcsApi()
-const editorMode = ref<'guided' | 'json'>('guided')
-const guidedDraft = ref<GuidedSchemaDraft>(createCourseCompletionDraft())
-const guidedError = ref('')
-const schemaText = ref(guidedSchemaToJson(guidedDraft.value))
-const transaction = shallowRef<Payment | null>(null)
-const canonicalSchema = ref('')
-const schemaDigestHex = ref('')
-const memoByteLength = ref<number | null>(null)
-const formError = ref('')
-const result = shallowRef<WalletSubmissionResult | null>(null)
-const submitting = ref(false)
-const pageBusy = computed(() => busy.value || submitting.value)
-let previewRevision = 0
-
-function invalidatePreview() {
-  previewRevision += 1
-  transaction.value = null
-  canonicalSchema.value = ''
-  schemaDigestHex.value = ''
-  memoByteLength.value = null
-  result.value = null
-}
-
-watch(schemaText, invalidatePreview)
-watch(
-  [() => account.value?.address ?? '', () => account.value?.network.id ?? ''],
-  invalidatePreview,
-)
-watch(
-  guidedDraft,
-  (draft) => {
-    if (editorMode.value !== 'guided') return
-    invalidatePreview()
-    try {
-      schemaText.value = guidedSchemaToJson(draft)
-      guidedError.value = ''
-    } catch (error) {
-      guidedError.value = error instanceof Error ? error.message : String(error)
-    }
-  },
-  { deep: true },
-)
-
-function applyTemplate(factory: () => GuidedSchemaDraft) {
-  editorMode.value = 'guided'
-  guidedDraft.value = factory()
-  formError.value = ''
-}
-
-function addField() {
-  guidedDraft.value.fields.push(createEmptyGuidedField())
-}
-
-function removeField(index: number) {
-  if (guidedDraft.value.fields.length === 1) {
-    guidedDraft.value.fields[0] = createEmptyGuidedField()
-    return
-  }
-  guidedDraft.value.fields.splice(index, 1)
-}
-
-function selectEditorMode(mode: 'guided' | 'json') {
-  if (mode === editorMode.value) return
-  formError.value = ''
-  if (mode === 'json') {
-    if (guidedError.value) {
-      formError.value = guidedError.value
-      return
-    }
-    editorMode.value = mode
-    return
-  }
-
-  try {
-    guidedDraft.value = schemaDefinitionToGuidedDraft(parseJson(schemaText.value))
-    editorMode.value = mode
-    guidedError.value = ''
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-  }
-}
-
-async function buildPreview() {
-  invalidatePreview()
-  formError.value = ''
-  result.value = null
-  if (editorMode.value === 'guided' && guidedError.value) {
-    formError.value = guidedError.value
-    return
-  }
-  if (!account.value) {
-    formError.value = 'WALLET_NOT_CONNECTED'
-    return
-  }
-  const revision = previewRevision
-  const publisher = account.value.address
-  const schemaInput = schemaText.value
-  try {
-    const profile = await getActiveNetworkProfile()
-    const built = buildSchemaRegistrationPayment({
-      publisher,
-      profile,
-      schema: parseJson(schemaInput),
-    })
-    const prepared = (await prepare(built.transaction, profile)) as Payment
-    if (revision !== previewRevision) throw new Error('SCHEMA_PREVIEW_CHANGED_DURING_BUILD')
-    canonicalSchema.value = built.canonicalSchema
-    schemaDigestHex.value = sha256Hex(encodeUtf8(built.canonicalSchema))
-    memoByteLength.value = built.memoByteLength
-    transaction.value = prepared
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-    transaction.value = null
-  }
-}
-
-async function submit() {
-  const preparedTransaction = transaction.value
-  const expectedPublisher = account.value?.address
-  const expectedSchema = schemaText.value
-  const expectedCanonical = canonicalSchema.value
-  const expectedDigest = schemaDigestHex.value
-  const expectedMemoByteLength = memoByteLength.value
-  const expectedRevision = previewRevision
-  if (
-    !preparedTransaction ||
-    !expectedPublisher ||
-    !expectedCanonical ||
-    !expectedDigest ||
-    expectedMemoByteLength === null
-  ) {
-    formError.value = 'TRANSACTION_PREVIEW_REQUIRED'
-    return
-  }
-  submitting.value = true
-  try {
-    const assertCurrent = () => {
-      if (
-        previewRevision !== expectedRevision ||
-        transaction.value !== preparedTransaction ||
-        account.value?.address !== expectedPublisher ||
-        schemaText.value !== expectedSchema ||
-        canonicalSchema.value !== expectedCanonical ||
-        schemaDigestHex.value !== expectedDigest ||
-        memoByteLength.value !== expectedMemoByteLength
-      ) {
-        throw new Error('SCHEMA_PREVIEW_CHANGED_BEFORE_SIGNATURE')
-      }
-    }
-    const response = await signAndSubmit(
-      preparedTransaction,
-      {
-        action: 'schema-register',
-        publisher: expectedPublisher,
-        schemaDigestHex: expectedDigest,
-        memoByteLength: expectedMemoByteLength,
-      },
-      assertCurrent,
-      undefined,
-      (validated) => {
-        result.value = { ...validated }
-      },
-    )
-    result.value = response
-    transaction.value = null
-  } catch (error) {
-    formError.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    submitting.value = false
-  }
-}
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/schemas/register', locale.value), {
+  replace: true,
+  redirectCode: 308,
+})
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      eyebrow="Schema publisher"
-      :title="$t('register.title')"
-      :lead="$t('register.description')"
-    />
-
-    <UCard class="mb-6">
-      <div class="grid gap-5">
-        <div class="flex flex-wrap gap-3" role="group" :aria-label="$t('register.schema')">
-          <UButton
-            size="sm"
-            color="neutral"
-            :variant="editorMode === 'guided' ? 'solid' : 'outline'"
-            type="button"
-            :aria-pressed="editorMode === 'guided'"
-            :disabled="pageBusy"
-            @click="selectEditorMode('guided')"
-          >
-            {{ $t('register.guidedMode') }}
-          </UButton>
-          <UButton
-            size="sm"
-            color="neutral"
-            :variant="editorMode === 'json' ? 'solid' : 'outline'"
-            type="button"
-            :aria-pressed="editorMode === 'json'"
-            :disabled="pageBusy"
-            @click="selectEditorMode('json')"
-          >
-            {{ $t('register.jsonMode') }}
-          </UButton>
-        </div>
-
-        <template v-if="editorMode === 'guided'">
-          <div class="flex flex-wrap gap-3">
-            <UButton
-              color="neutral"
-              variant="link"
-              class="px-0"
-              type="button"
-              :disabled="pageBusy"
-              @click="applyTemplate(createCourseCompletionDraft)"
-            >
-              {{ $t('register.courseTemplate') }}
-            </UButton>
-            <UButton
-              color="neutral"
-              variant="link"
-              class="px-0"
-              type="button"
-              :disabled="pageBusy"
-              @click="applyTemplate(createDiplomaDraft)"
-            >
-              {{ $t('register.diplomaTemplate') }}
-            </UButton>
-          </div>
-
-          <UFormField :label="$t('register.schemaName')">
-            <UInput id="schema-name" v-model="guidedDraft.name" :disabled="pageBusy" />
-          </UFormField>
-          <UFormField :label="$t('register.schemaDescription')">
-            <UTextarea
-              id="schema-description"
-              v-model="guidedDraft.description"
-              :rows="3"
-              :disabled="pageBusy"
-            />
-          </UFormField>
-
-          <fieldset class="grid gap-3 rounded-[0.8rem] p-4 ring-1 ring-default">
-            <legend class="px-1 font-semibold">{{ $t('register.fields') }}</legend>
-            <div
-              v-for="(field, index) in guidedDraft.fields"
-              :key="index"
-              class="grid gap-3 border-b border-default pb-3 sm:grid-cols-[1fr_10rem_auto_auto] sm:items-end"
-            >
-              <UFormField :label="$t('register.fieldName')">
-                <UInput v-model="field.name" :disabled="pageBusy" autocomplete="off" />
-              </UFormField>
-              <UFormField :label="$t('register.fieldType')">
-                <USelect
-                  v-model="field.type"
-                  :items="GUIDED_SCHEMA_FIELD_TYPES.map((type) => ({ label: type, value: type }))"
-                  :disabled="pageBusy"
-                />
-              </UFormField>
-              <UCheckbox
-                v-model="field.optional"
-                class="sm:pb-2"
-                :disabled="pageBusy"
-                :label="$t('register.optional')"
-              />
-              <UButton
-                color="neutral"
-                variant="link"
-                class="px-0 sm:pb-2"
-                type="button"
-                :disabled="pageBusy"
-                @click="removeField(index)"
-              >
-                {{ $t('register.removeField') }}
-              </UButton>
-            </div>
-            <div>
-              <UButton
-                size="sm"
-                color="neutral"
-                variant="outline"
-                type="button"
-                :disabled="pageBusy"
-                @click="addField"
-              >
-                {{ $t('register.addField') }}
-              </UButton>
-            </div>
-          </fieldset>
-          <p class="text-sm text-muted">{{ $t('register.advancedHint') }}</p>
-          <StatusBox v-if="guidedError" tone="error">{{ guidedError }}</StatusBox>
-        </template>
-
-        <template v-else>
-          <UFormField :label="$t('register.schema')">
-            <UTextarea
-              id="schema-json"
-              v-model="schemaText"
-              :rows="18"
-              spellcheck="false"
-              :disabled="pageBusy"
-            />
-          </UFormField>
-        </template>
-
-        <StatusBox tone="warning">{{ $t('register.irreversible') }}</StatusBox>
-        <div>
-          <UButton type="button" :disabled="pageBusy" @click="buildPreview">
-            {{ $t('register.prepare') }}
-          </UButton>
-        </div>
-      </div>
-    </UCard>
-
-    <StatusBox v-if="formError" tone="error">{{ formError }}</StatusBox>
-
-    <UCard v-if="canonicalSchema" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('register.canonical') }}</h2>
-      </template>
-      <JsonBlock :code="canonicalSchema" />
-      <p class="text-sm break-all text-muted">
-        {{ memoByteLength }} bytes · <code>{{ schemaDigestHex }}</code>
-      </p>
-    </UCard>
-
-    <TransactionPreview :transaction="transaction" :busy="pageBusy" @confirm="submit" />
-    <BusinessFinality
-      v-if="result"
-      :tx-hash="result.txHash"
-      :engine-result="result.transactionResult"
-      :ledger-index="result.ledgerIndex"
-      :business-confirmation="result.businessConfirmation"
-      :business-evidence="result.businessEvidence"
-    />
-    <StatusBox
-      v-if="result?.businessConfirmation === 'confirmed' && result.businessEvidence?.schemaUid"
-      tone="success"
-    >
-      <NuxtLinkLocale :to="`/schemas/${result.businessEvidence.schemaUid}`">
-        {{ $t('register.openSchema') }}
-      </NuxtLinkLocale>
-    </StatusBox>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/studio.vue b/apps/web/app/pages/studio.vue
index b09e451..9338b7c 100644
--- a/apps/web/app/pages/studio.vue
+++ b/apps/web/app/pages/studio.vue
@@ -1,83 +1,11 @@
 <script setup lang="ts">
-const { t } = useI18n()
-const localePath = useLocalePath()
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-useSeoMeta({
-  title: () => `${t('studio.title')} — XCS`,
-  description: () => t('studio.description'),
-  robots: 'index,follow',
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/studio', locale.value), {
+  replace: true,
+  redirectCode: 308,
 })
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      :eyebrow="$t('nav.create')"
-      :title="$t('studio.title')"
-      :lead="$t('studio.description')"
-    />
-    <p class="mb-8 border-l-2 border-accented pl-3 text-sm text-toned">
-      {{ $t('studio.nonCustodial') }}
-    </p>
-
-    <div class="grid gap-4 sm:grid-cols-2">
-      <NuxtLink
-        :to="localePath('/schemas/register')"
-        data-testid="create-primary-card"
-        class="block min-w-0 rounded-[0.6rem] bg-elevated p-6 ring-1 ring-default hover:ring-accented"
-      >
-        <span class="block font-mono text-sm text-muted">01 / {{ $t('studio.schemaType') }}</span>
-        <h2 class="mt-2 text-2xl break-words">{{ $t('studio.schemaTitle') }}</h2>
-        <p class="mt-2 text-sm text-toned">{{ $t('studio.register') }}</p>
-        <strong class="mt-4 block text-sm"
-          >{{ $t('studio.schemaCta') }} <span aria-hidden="true">↗</span></strong
-        >
-      </NuxtLink>
-      <NuxtLink
-        :to="localePath('/issue')"
-        data-testid="create-primary-card"
-        class="block min-w-0 rounded-[0.6rem] bg-neutral-950 p-6 text-neutral-50 ring-1 ring-default hover:ring-accented"
-      >
-        <span class="block font-mono text-sm text-neutral-400"
-          >02 / {{ $t('studio.credentialType') }}</span
-        >
-        <h2 class="mt-2 text-2xl break-words">{{ $t('studio.credentialTitle') }}</h2>
-        <p class="mt-2 text-sm text-neutral-300">{{ $t('studio.issue') }}</p>
-        <strong class="mt-4 block text-sm"
-          >{{ $t('studio.credentialCta') }} <span aria-hidden="true">↗</span></strong
-        >
-      </NuxtLink>
-    </div>
-
-    <div class="mt-12 mb-6 flex flex-wrap items-end justify-between gap-4">
-      <div class="min-w-0">
-        <p class="text-xs font-semibold tracking-[0.2em] text-muted uppercase">
-          {{ $t('studio.manageEyebrow') }}
-        </p>
-        <h2 class="text-3xl break-words">{{ $t('studio.manageTitle') }}</h2>
-      </div>
-      <p class="max-w-xl text-sm text-toned">{{ $t('studio.manageDescription') }}</p>
-    </div>
-    <div class="grid gap-4 sm:grid-cols-3">
-      <NuxtLink
-        v-for="entry in [
-          { index: '03', to: '/accept', title: $t('nav.accept'), copy: $t('studio.accept') },
-          { index: '04', to: '/revoke', title: $t('nav.revoke'), copy: $t('studio.revoke') },
-          {
-            index: '05',
-            to: '/operations',
-            title: $t('nav.operations'),
-            copy: $t('studio.operations'),
-          },
-        ]"
-        :key="entry.to"
-        :to="localePath(entry.to)"
-        class="block min-w-0 rounded-[0.6rem] bg-elevated p-5 ring-1 ring-default hover:ring-accented"
-      >
-        <span class="block font-mono text-sm text-muted">{{ entry.index }}</span>
-        <h2 class="mt-1 text-xl break-words">{{ entry.title }}</h2>
-        <p class="mt-2 text-sm text-toned">{{ entry.copy }}</p>
-      </NuxtLink>
-    </div>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/pages/verifier/apply.vue b/apps/web/app/pages/verifier/apply.vue
new file mode 100644
index 0000000..d411b92
--- /dev/null
+++ b/apps/web/app/pages/verifier/apply.vue
@@ -0,0 +1,9 @@
+<script setup lang="ts">
+definePageMeta({ middleware: ['auth'] })
+const { t } = useI18n()
+useSeoMeta({ title: () => `${t('verifier.apply')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+
+<template>
+  <OrganizationApplicationForm role="verifier" />
+</template>
diff --git a/apps/web/app/pages/verifier/index.vue b/apps/web/app/pages/verifier/index.vue
new file mode 100644
index 0000000..09fc4bf
--- /dev/null
+++ b/apps/web/app/pages/verifier/index.vue
@@ -0,0 +1,200 @@
+<script setup lang="ts">
+import type { ResolvedPresentationView, VerifierWorkspaceView } from '~/types/portal'
+import { presentationHeadline } from '~/utils/presentationView'
+
+definePageMeta({ middleware: ['auth'] })
+const route = useRoute()
+const localePath = useLocalePath()
+const { locale, t } = useI18n()
+const request = useRequestFetch()
+const auth = useAuth()
+const organizationId = computed(() =>
+  typeof route.query.organizationId === 'string' ? route.query.organizationId : undefined,
+)
+const { data, error, status, refresh } = useAsyncData(
+  'verifier-workspace',
+  () =>
+    request<VerifierWorkspaceView>('/api/verifier/workspace', {
+      query: organizationId.value ? { organizationId: organizationId.value } : {},
+    }),
+  { watch: [organizationId] },
+)
+const selected = computed(() =>
+  data.value?.organizations.find((item) => item.id === data.value?.selectedOrganizationId),
+)
+const approved = computed(
+  () => selected.value?.applicationStatus === 'approved' && selected.value.status === 'active',
+)
+const csvUrl = computed(() =>
+  data.value?.selectedOrganizationId
+    ? `/api/verifier/history.csv?${new URLSearchParams({ organizationId: data.value.selectedOrganizationId })}`
+    : '',
+)
+const busy = ref(false)
+const openError = ref(false)
+const result = shallowRef<ResolvedPresentationView | null>(null)
+let revision = 0
+let disposed = false
+function clearResult() {
+  revision += 1
+  result.value = null
+}
+function hideResult() {
+  if (document.visibilityState === 'hidden') clearResult()
+}
+watch([organizationId, () => auth.user.value?.id], clearResult)
+onMounted(() => document.addEventListener('visibilitychange', hideResult))
+onBeforeUnmount(() => {
+  disposed = true
+  clearResult()
+  document.removeEventListener('visibilitychange', hideResult)
+})
+const date = (value: string) =>
+  new Intl.DateTimeFormat(locale.value, { dateStyle: 'medium', timeStyle: 'short' }).format(
+    new Date(value),
+  )
+async function chooseOrganization(event: Event) {
+  clearResult()
+  await navigateTo({
+    path: localePath('/verifier'),
+    query: { organizationId: (event.target as HTMLSelectElement).value },
+  })
+}
+async function reopen(id: string) {
+  if (busy.value) return
+  busy.value = true
+  openError.value = false
+  clearResult()
+  const attempt = revision
+  const identity = auth.user.value?.id
+  try {
+    await auth.load(true)
+    const current = await auth.mutateApplication<ResolvedPresentationView>(
+      `/api/verifier/history/${encodeURIComponent(id)}/presentation`,
+      {},
+    )
+    if (
+      !disposed &&
+      attempt === revision &&
+      identity === auth.user.value?.id &&
+      document.visibilityState === 'visible'
+    )
+      result.value = current
+  } catch {
+    openError.value = true
+  } finally {
+    busy.value = false
+  }
+}
+useSeoMeta({ title: () => `${t('verifier.title')} — XCS`, robots: 'noindex,nofollow' })
+</script>
+<template>
+  <UContainer class="max-w-5xl py-10">
+    <PageHeader :title="$t('verifier.title')" :lead="$t('verifier.intro')">
+      <template #actions
+        ><UButton :to="localePath('/verifier/apply')">{{ $t('verifier.apply') }}</UButton
+        ><UButton
+          color="neutral"
+          variant="outline"
+          :loading="status === 'pending'"
+          @click="refresh()"
+          >{{ $t('recipient.refresh') }}</UButton
+        ></template
+      >
+    </PageHeader>
+    <StatusBox v-if="error" tone="error" role="alert">{{ $t('verifier.error') }}</StatusBox>
+    <p v-else-if="status === 'pending'">{{ $t('issuer.loading') }}</p>
+    <template v-else-if="data">
+      <p class="mb-5 text-muted">{{ $t('verifier.approvalMeaning') }}</p>
+      <p v-if="!data.organizations.length">{{ $t('verifier.noApplications') }}</p>
+      <label v-else class="block font-semibold"
+        >{{ $t('issuer.organization') }}
+        <select
+          :value="data.selectedOrganizationId"
+          class="mt-2 w-full rounded border border-default bg-default p-3"
+          @change="chooseOrganization"
+        >
+          <option v-for="org in data.organizations" :key="org.id" :value="org.id">
+            {{ org.name }}
+          </option>
+        </select>
+      </label>
+      <UCard v-if="selected" class="mt-5">
+        <h2 class="text-xl font-semibold">{{ selected.name }}</h2>
+        <p class="mt-2">{{ $t(`issuer.states.${selected.applicationStatus}`) }}</p>
+        <p v-if="selected.reviewReason" class="mt-2 whitespace-pre-wrap">
+          {{ selected.reviewReason }}
+        </p>
+        <p v-if="selected.applicationStatus === 'pending'" class="mt-3 text-muted">
+          {{ $t('verifier.pendingHelp') }}
+        </p>
+        <p
+          v-if="
+            selected.applicationStatus === 'rejected' || selected.applicationStatus === 'suspended'
+          "
+          class="mt-3 text-muted"
+        >
+          {{ $t('issuer.declinedHelp') }}
+        </p>
+      </UCard>
+      <section v-if="approved" class="mt-8" aria-labelledby="verifier-history">
+        <h2 id="verifier-history" class="text-xl font-semibold">{{ $t('verifier.history') }}</h2>
+        <p class="mt-2 text-sm text-muted">{{ $t('verifier.historyHelp') }}</p>
+        <a
+          :href="csvUrl"
+          download="xcs-verification-history.csv"
+          class="mt-4 inline-block font-semibold underline"
+          >{{ $t('verifier.export') }}</a
+        >
+        <p v-if="!data.history.length" class="mt-5 text-muted">{{ $t('verifier.emptyHistory') }}</p>
+        <div v-else class="mt-4 overflow-x-auto">
+          <table class="w-full text-left text-sm">
+            <caption class="sr-only">
+              {{
+                $t('verifier.history')
+              }}
+            </caption>
+            <thead>
+              <tr class="border-b border-default">
+                <th scope="col" class="p-3">{{ $t('verifier.checkedAt') }}</th>
+                <th scope="col" class="p-3">{{ $t('verifier.previousResult') }}</th>
+                <th scope="col" class="p-3">{{ $t('presentation.scope') }}</th>
+                <th scope="col" class="p-3">{{ $t('auth.actions') }}</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-for="entry in data.history" :key="entry.id" class="border-b border-default">
+                <td class="p-3">
+                  <time :datetime="entry.checkedAt">{{ date(entry.checkedAt) }}</time>
+                </td>
+                <td class="p-3">
+                  {{
+                    $t(
+                      `presentation.headlines.${presentationHeadline(entry.verification, { usable: true, fresh: true })}`,
+                    )
+                  }}
+                </td>
+                <td class="p-3">{{ $t(`presentation.${entry.scope}`) }}</td>
+                <td class="p-3">
+                  <UButton :disabled="busy" @click="reopen(entry.id)">{{
+                    $t('verifier.reopen')
+                  }}</UButton>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </section>
+    </template>
+    <StatusBox v-if="openError" class="mt-5" tone="error">{{
+      $t('verifier.reopenError')
+    }}</StatusBox>
+    <section
+      v-if="result"
+      class="mt-8 rounded border border-default p-5"
+      :aria-label="$t('verifier.currentResult')"
+    >
+      <PresentationResult :result="result" />
+    </section>
+  </UContainer>
+</template>
diff --git a/apps/web/app/pages/verify.vue b/apps/web/app/pages/verify.vue
index 627a0af..1187540 100644
--- a/apps/web/app/pages/verify.vue
+++ b/apps/web/app/pages/verify.vue
@@ -1,417 +1,11 @@
 <script setup lang="ts">
-import type { ApiSchemaDetail } from '~/composables/useXcsApi'
-import {
-  assertPayloadFetchConsentCurrent,
-  createPayloadFetchConsentToken,
-  loadCredentialReview,
-  loadCredentialReviewWithConsent,
-  type CredentialReview,
-  type PayloadFetchConsentToken,
-} from '~/utils/credentialReview'
-import {
-  assertLinkGeneration,
-  assertLinkProfile,
-  singleRouteQueryValue,
-} from '~/utils/operationLinks'
-import { LOCAL_PAYLOAD_LOCATION } from '~/utils/localPayloadStore'
-import { normalizedHex256 } from '~/utils/explorer'
+import { legacyPortalDestination } from '~/utils/portalRoutes'
 
-const route = useRoute()
-const localePath = useLocalePath()
-const { t } = useI18n()
-const { getActiveNetworkProfile, getCredential, getSchema, verify } = useXcsApi()
-const localPayloadStore = useLocalPayloadStore()
-const issuer = ref(singleRouteQueryValue(route.query.issuer))
-const subject = ref(singleRouteQueryValue(route.query.subject))
-const schemaUid = ref(singleRouteQueryValue(route.query.schema))
-const linkedProfileId = ref(singleRouteQueryValue(route.query.profile))
-const linkedGenerationId = ref(singleRouteQueryValue(route.query.generation))
-const generationLookup = ref(singleRouteQueryValue(route.query.generation))
-const generationLookupError = ref('')
-const busy = ref(false)
-const error = ref('')
-const review = shallowRef<CredentialReview | null>(null)
-const schemaDetail = shallowRef<ApiSchemaDetail | null>(null)
-const payloadConsent = ref(false)
-const payloadConsentToken = shallowRef<PayloadFetchConsentToken | null>(null)
-let reviewRevision = 0
-
-const payloadHost = computed(() => {
-  if (!review.value?.uri) return null
-  try {
-    return localPayloadStore.inspectPayloadLocation(review.value.uri)
-  } catch {
-    return null
-  }
-})
-const payloadUsesLocalStore = computed(() => payloadHost.value === LOCAL_PAYLOAD_LOCATION)
-const payloadHostError = computed(() => {
-  if (!review.value?.uri) return 'CREDENTIAL_URI_REQUIRED'
-  try {
-    localPayloadStore.inspectPayloadLocation(review.value.uri)
-    return ''
-  } catch (caught) {
-    return caught instanceof Error ? caught.message : String(caught)
-  }
-})
-const payloadHostErrorMessage = computed(() =>
-  payloadHostError.value === 'LOCAL_PAYLOAD_NOT_AVAILABLE_IN_BROWSER'
-    ? t('verify.localPayloadUnavailable')
-    : payloadHostError.value,
-)
-
-function invalidateReview() {
-  reviewRevision += 1
-  review.value = null
-  schemaDetail.value = null
-  payloadConsent.value = false
-  payloadConsentToken.value = null
-}
-
-watch([issuer, subject, schemaUid, linkedProfileId, linkedGenerationId], invalidateReview)
-watch(
-  () => [
-    route.query.issuer,
-    route.query.subject,
-    route.query.schema,
-    route.query.profile,
-    route.query.generation,
-  ],
-  ([nextIssuer, nextSubject, nextSchema, nextProfile, nextGeneration]) => {
-    issuer.value = singleRouteQueryValue(nextIssuer)
-    subject.value = singleRouteQueryValue(nextSubject)
-    schemaUid.value = singleRouteQueryValue(nextSchema)
-    linkedProfileId.value = singleRouteQueryValue(nextProfile)
-    linkedGenerationId.value = singleRouteQueryValue(nextGeneration)
-    generationLookup.value = singleRouteQueryValue(nextGeneration)
-  },
-)
-
-async function openGeneration(): Promise<void> {
-  generationLookupError.value = ''
-  const normalized = normalizedHex256(generationLookup.value)
-  if (normalized === undefined) {
-    generationLookupError.value = t('verify.generationError')
-    return
-  }
-  await navigateTo(localePath(`/credentials/${normalized}`))
-}
-
-async function loadExactMetadata(input: {
-  issuer: string
-  subject: string
-  schemaUid: string
-  profileId: string
-  requireSchema: boolean
-}): Promise<{ credentialReview: CredentialReview; schema: ApiSchemaDetail | null }> {
-  const [credential, metadataReport, schemaResult] = await Promise.all([
-    getCredential(input.issuer, input.subject, input.schemaUid, input.profileId),
-    verify(
-      {
-        issuer: input.issuer,
-        subject: input.subject,
-        schemaUid: input.schemaUid,
-        resolvePayload: false,
-      },
-      input.profileId,
-    ),
-    getSchema(input.schemaUid, input.profileId).then(
-      (schema) => ({ schema }),
-      (caught: unknown) => ({ error: caught }),
-    ),
-  ])
-  if ('error' in schemaResult && input.requireSchema) throw schemaResult.error
-  const schema = 'schema' in schemaResult ? schemaResult.schema : null
-  const credentialReview = await loadCredentialReview({
-    credential,
-    report: metadataReport,
-    issuer: input.issuer,
-    subject: input.subject,
-    schemaUid: input.schemaUid,
-    ...(schema ? { schema: schema.resolved } : {}),
-  })
-  assertLinkGeneration(linkedGenerationId.value || undefined, credentialReview.generationId)
-  return { credentialReview, schema }
-}
-
-async function loadMetadata() {
-  invalidateReview()
-  busy.value = true
-  error.value = ''
-  const revision = reviewRevision
-  const expected = {
-    issuer: issuer.value,
-    subject: subject.value,
-    schemaUid: schemaUid.value.toLowerCase(),
-  }
-  try {
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
-    const loaded = await loadExactMetadata({
-      ...expected,
-      profileId: profile.profileId,
-      requireSchema: false,
-    })
-    if (revision !== reviewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
-    review.value = loaded.credentialReview
-    schemaDetail.value = loaded.schema
-  } catch (caught) {
-    error.value = caught instanceof Error ? caught.message : String(caught)
-  } finally {
-    busy.value = false
-  }
-}
-
-function setPayloadConsent(granted: boolean) {
-  if (!granted) {
-    payloadConsent.value = false
-    payloadConsentToken.value = null
-    return
-  }
-  try {
-    if (!review.value) throw new Error('CREDENTIAL_PAYLOAD_CONSENT_REQUIRED')
-    payloadConsentToken.value = createPayloadFetchConsentToken(review.value)
-    payloadConsent.value = true
-    error.value = ''
-  } catch (caught) {
-    payloadConsent.value = false
-    payloadConsentToken.value = null
-    error.value = caught instanceof Error ? caught.message : String(caught)
-  }
-}
-
-async function verifyPayload() {
-  const displayedReview = review.value
-  const consent = payloadConsentToken.value
-  if (!displayedReview || !consent) {
-    error.value = 'CREDENTIAL_PAYLOAD_CONSENT_REQUIRED'
-    return
-  }
-  busy.value = true
-  error.value = ''
-  const revision = reviewRevision
-  const expected = {
-    issuer: issuer.value,
-    subject: subject.value,
-    schemaUid: schemaUid.value.toLowerCase(),
-  }
-  try {
-    const profile = await getActiveNetworkProfile()
-    assertLinkProfile(linkedProfileId.value || undefined, profile.profileId)
-    const loaded = await loadExactMetadata({
-      ...expected,
-      profileId: profile.profileId,
-      requireSchema: true,
-    })
-    if (revision !== reviewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_LOAD')
-    assertPayloadFetchConsentCurrent(loaded.credentialReview, consent)
-    if (!loaded.schema) throw new Error('CREDENTIAL_SCHEMA_UNAVAILABLE')
-
-    // Generation/profile/link checks happen above, before this browser contacts the issuer host.
-    const localReview = await loadCredentialReviewWithConsent({
-      credential: await getCredential(
-        expected.issuer,
-        expected.subject,
-        expected.schemaUid,
-        profile.profileId,
-      ),
-      report: await verify({ ...expected, resolvePayload: false }, profile.profileId),
-      ...expected,
-      schema: loaded.schema.resolved,
-      consent,
-      payloadReader: localPayloadStore.readPayload,
-    })
-    if (revision !== reviewRevision) throw new Error('CREDENTIAL_REVIEW_CHANGED_DURING_FETCH')
-    if (!localReview.payload) throw new Error('CREDENTIAL_PAYLOAD_REVIEW_FAILED')
-
-    // The API validates the parsed object only; it never receives a request to resolve the URI.
-    const verifiedReport = await verify(
-      { ...expected, payload: localReview.payload },
-      profile.profileId,
-    )
-    const verifiedMetadata = await loadCredentialReview({
-      credential: await getCredential(
-        expected.issuer,
-        expected.subject,
-        expected.schemaUid,
-        profile.profileId,
-      ),
-      report: verifiedReport,
-      ...expected,
-    })
-    assertPayloadFetchConsentCurrent(verifiedMetadata, consent)
-    if (verifiedMetadata.generationId !== displayedReview.generationId) {
-      throw new Error('CREDENTIAL_GENERATION_CHANGED_DURING_VERIFICATION')
-    }
-    review.value = {
-      ...verifiedMetadata,
-      payload: localReview.payload,
-      claims: localReview.claims,
-      payloadDigestHex: localReview.payloadDigestHex,
-      payloadByteLength: localReview.payloadByteLength,
-      payloadCheckedAt: localReview.payloadCheckedAt,
-    }
-    schemaDetail.value = loaded.schema
-  } catch (caught) {
-    error.value = caught instanceof Error ? caught.message : String(caught)
-  } finally {
-    busy.value = false
-  }
-}
-
-useSeoMeta({
-  title: () => `${t('verify.title')} — XCS`,
-  description: () => t('verify.description'),
-  robots: 'index,follow',
+const { locale } = useI18n()
+await navigateTo(legacyPortalDestination('/verify', locale.value), {
+  replace: true,
+  redirectCode: 308,
 })
 </script>
 
-<template>
-  <UContainer class="py-10 sm:py-14">
-    <PageHeader
-      :eyebrow="$t('nav.verify')"
-      :title="$t('verify.title')"
-      :lead="$t('verify.description')"
-    />
-
-    <UCard as="form" class="mb-6" novalidate @submit.prevent="openGeneration">
-      <UFormField
-        :label="$t('verify.generationLabel')"
-        :help="$t('verify.generationHint')"
-        :error="Boolean(generationLookupError)"
-      >
-        <div class="flex flex-wrap items-center gap-2">
-          <UInput
-            id="verify-generation"
-            v-model.trim="generationLookup"
-            name="generation"
-            inputmode="text"
-            autocomplete="off"
-            pattern="[0-9a-fA-F]{64}"
-            class="min-w-0 flex-1"
-            :placeholder="$t('verify.generationPlaceholder')"
-            :aria-describedby="generationLookupError ? 'verify-generation-error' : undefined"
-          />
-          <UButton type="submit">{{ $t('verify.openGeneration') }}</UButton>
-        </div>
-        <p
-          v-if="generationLookupError"
-          id="verify-generation-error"
-          role="alert"
-          class="mt-2 text-sm text-error"
-        >
-          {{ generationLookupError }}
-        </p>
-      </UFormField>
-    </UCard>
-
-    <UCollapsible :default-open="Boolean(issuer || subject || schemaUid)" class="mb-6">
-      <UButton color="neutral" variant="ghost" trailing-icon="i-lucide-chevron-down" block>
-        <span class="min-w-0 text-left">
-          {{ $t('verify.advancedTitle') }}
-          <small class="text-muted">{{ $t('verify.advancedDescription') }}</small>
-        </span>
-      </UButton>
-      <template #content>
-        <UCard class="mt-3">
-          <div class="grid gap-5">
-            <UFormField label="Issuer">
-              <UInput id="verify-issuer" v-model.trim="issuer" placeholder="r…" :disabled="busy" />
-            </UFormField>
-            <UFormField label="Subject">
-              <UInput
-                id="verify-subject"
-                v-model.trim="subject"
-                placeholder="r…"
-                :disabled="busy"
-              />
-            </UFormField>
-            <UFormField label="Schema UID">
-              <UInput
-                id="verify-schema"
-                v-model.trim="schemaUid"
-                pattern="[0-9a-fA-F]{64}"
-                :disabled="busy"
-              />
-            </UFormField>
-            <div>
-              <UButton :disabled="busy" @click="loadMetadata">
-                {{ busy ? $t('common.working') : $t('verify.loadMetadata') }}
-              </UButton>
-            </div>
-          </div>
-        </UCard>
-      </template>
-    </UCollapsible>
-
-    <StatusBox v-if="error" tone="error">{{ error }}</StatusBox>
-
-    <UCard v-if="review" class="mb-6">
-      <template #header>
-        <h2 class="text-xl font-semibold">{{ $t('verify.metadata') }}</h2>
-      </template>
-      <MetadataList>
-        <dt>Issuer</dt>
-        <dd>
-          <code>{{ review.issuer }}</code>
-        </dd>
-        <dt>Subject</dt>
-        <dd>
-          <code>{{ review.subject }}</code>
-        </dd>
-        <dt>Schema</dt>
-        <dd>
-          <strong v-if="schemaDetail">{{ schemaDetail.name }}</strong>
-          <code>{{ review.schemaUid }}</code>
-        </dd>
-        <dt>Generation ID</dt>
-        <dd>
-          <code>{{ review.generationId }}</code>
-        </dd>
-        <dt>URI</dt>
-        <dd>
-          <code>{{ review.uri ?? '—' }}</code>
-        </dd>
-      </MetadataList>
-
-      <VerificationGrid :report="review.report" />
-
-      <StatusBox v-if="!review.payload" tone="warning">
-        <p>
-          {{
-            $t(
-              payloadUsesLocalStore
-                ? 'verify.localPayloadConsentIntro'
-                : 'verify.payloadConsentIntro',
-              { host: payloadHost ?? '—' },
-            )
-          }}
-        </p>
-        <StatusBox v-if="payloadHostError" tone="error">{{ payloadHostErrorMessage }}</StatusBox>
-        <UCheckbox
-          v-else-if="payloadHost"
-          data-testid="payload-consent"
-          :model-value="payloadConsent"
-          :disabled="busy"
-          :label="
-            $t(payloadUsesLocalStore ? 'verify.localPayloadConsent' : 'verify.payloadConsent')
-          "
-          @update:model-value="setPayloadConsent(Boolean($event))"
-        />
-        <UButton
-          data-testid="payload-fetch"
-          color="neutral"
-          variant="outline"
-          :disabled="busy || !payloadConsent"
-          @click="verifyPayload"
-        >
-          {{ $t(payloadUsesLocalStore ? 'verify.localFetch' : 'verify.fetch') }}
-        </UButton>
-      </StatusBox>
-      <StatusBox v-else tone="success">
-        {{ $t('verify.payloadChecked', { bytes: review.payloadByteLength ?? 0 }) }}
-        <code>{{ review.payloadDigestHex }}</code>
-      </StatusBox>
-    </UCard>
-  </UContainer>
-</template>
+<template><div /></template>
diff --git a/apps/web/app/plugins/invitation-scroll.client.ts b/apps/web/app/plugins/invitation-scroll.client.ts
new file mode 100644
index 0000000..a1087c5
--- /dev/null
+++ b/apps/web/app/plugins/invitation-scroll.client.ts
@@ -0,0 +1,25 @@
+import routerOptions from '#build/router.options.mjs'
+import type { RouterOptions } from 'vue-router'
+import { privateLinkHistoryState } from '~/utils/privateLinkHistory'
+
+export default defineNuxtPlugin(() => {
+  const router = useRouter()
+  const generatedOptions = routerOptions as Pick<RouterOptions, 'scrollBehavior'>
+  const defaultScrollBehavior = generatedOptions.scrollBehavior
+  // Nuxt restores this generated options object after its initial navigation.
+  // Updating only router.options is overwritten during hydration.
+  generatedOptions.scrollBehavior = (to, from, savedPosition) => {
+    // Invitation and presentation fragments are bearer tokens, not DOM selectors. Vue Router's
+    // missing-selector warning would otherwise print the token to the console.
+    if (/^\/(?:fr\/)?(?:recipient\/invitations|presentations)\/?$/.test(to.path)) {
+      return savedPosition ?? { left: 0, top: 0 }
+    }
+    return defaultScrollBehavior?.(to, from, savedPosition)
+  }
+  router.options.scrollBehavior = generatedOptions.scrollBehavior
+  router.afterEach(() => {
+    // Router navigation can reintroduce the previous fragment in back/forward.
+    // Preserve the live URL so the destination page can still consume its bearer.
+    window.history.replaceState(privateLinkHistoryState(window.history.state), '')
+  })
+})
diff --git a/apps/web/app/plugins/wallet.client.ts b/apps/web/app/plugins/wallet.client.ts
index f55232f..f88b90f 100644
--- a/apps/web/app/plugins/wallet.client.ts
+++ b/apps/web/app/plugins/wallet.client.ts
@@ -1,37 +1,47 @@
+import { createXrplConnect } from '@xrpl-commons/xrpl-connect-vue'
 import { Client } from 'xrpl'
-import { WalletManager } from 'xrpl-connect'
+import type { WalletAdapter } from 'xrpl-connect'
 import { resolveBrowserE2eClientMode } from '~/utils/browserE2eMode'
 import { createXrplConnectAdapters } from '~/utils/walletAdapters'
 
-export default defineNuxtPlugin(async () => {
+export default defineNuxtPlugin(async (nuxtApp) => {
   const config = useRuntimeConfig()
   const browserE2e = resolveBrowserE2eClientMode(config.public.browserE2eMode, import.meta.dev)
+  let adapters: WalletAdapter[]
   if (import.meta.dev && browserE2e) {
-    const { createBrowserE2eLedgerClient, createBrowserE2eWalletManager } =
+    const { createBrowserE2eLedgerClient, createBrowserE2eWalletAdapters } =
       await import('~/utils/browserE2eHarness')
+    adapters = createBrowserE2eWalletAdapters()
+    nuxtApp.vueApp.use(
+      createXrplConnect({
+        adapters,
+        network: 'testnet',
+        autoConnect: false,
+        logger: { level: 'error' },
+      }),
+    )
     return {
       provide: {
-        walletManager: createBrowserE2eWalletManager(),
         xrplClientFactory: () => createBrowserE2eLedgerClient(),
       },
     }
   }
 
-  const adapters = createXrplConnectAdapters({
+  adapters = createXrplConnectAdapters({
     xamanApiKey: config.public.xamanApiKey,
-    xamanRedirectUrl: config.public.xamanRedirectUrl,
     walletConnectProjectId: config.public.walletConnectProjectId,
   })
-  const walletManager = new WalletManager({
-    adapters,
-    network: 'testnet',
-    autoConnect: false,
-    logger: { level: import.meta.dev ? 'warn' : 'error' },
-  })
+  nuxtApp.vueApp.use(
+    createXrplConnect({
+      adapters,
+      network: 'testnet',
+      autoConnect: false,
+      logger: { level: import.meta.dev ? 'warn' : 'error' },
+    }),
+  )
 
   return {
     provide: {
-      walletManager,
       xrplClientFactory: (rpcUrl: string) => new Client(rpcUrl),
     },
   }
diff --git a/apps/web/app/types/nuxt.d.ts b/apps/web/app/types/nuxt.d.ts
index 7d95ebd..f9ecb64 100644
--- a/apps/web/app/types/nuxt.d.ts
+++ b/apps/web/app/types/nuxt.d.ts
@@ -1,16 +1,13 @@
 import type { Client } from 'xrpl'
-import type { WalletManager } from 'xrpl-connect'
 
 declare module '#app' {
   interface NuxtApp {
-    $walletManager: WalletManager
     $xrplClientFactory: (rpcUrl: string) => Client
   }
 }
 
 declare module 'vue' {
   interface ComponentCustomProperties {
-    $walletManager: WalletManager
     $xrplClientFactory: (rpcUrl: string) => Client
   }
 }
diff --git a/apps/web/app/types/portal.ts b/apps/web/app/types/portal.ts
new file mode 100644
index 0000000..0ec402d
--- /dev/null
+++ b/apps/web/app/types/portal.ts
@@ -0,0 +1,223 @@
+import type { VerificationDimensions } from '~/utils/credentialReview'
+
+export type PortalClaims = Record<string, unknown>
+
+export type PersonalRole = 'admin' | 'recipient'
+export type OrganizationRole = 'issuer' | 'verifier'
+export type AppRole = PersonalRole | OrganizationRole
+
+export interface PortalAccount {
+  id: string
+  email: string | null
+  displayName: string | null
+  roles: PersonalRole[]
+  organizations: { id: string; name: string; roles: OrganizationRole[] }[]
+  wallets: { id: string; address: string; networkId: number; verifiedAt: string }[]
+}
+
+export interface PortalOrganization {
+  id: string
+  name: string
+  status: 'active' | 'suspended' | 'closed'
+  applicationStatus: 'pending' | 'approved' | 'rejected' | 'suspended'
+  reviewReason: string | null
+  revision: number
+}
+
+export interface IssuerSchemaCard {
+  profileId: string
+  schemaUid: string
+  displayName: string | null
+  category: string | null
+  name: string | null
+  publisher: string | null
+  registrationTransactionHash: string
+}
+
+export interface IssuerInvitationCard {
+  id: string
+  organizationId: string
+  profileId: string
+  schemaUid: string
+  email: string | null
+  createdAt: string
+  expiresAt: string
+  claimedBy: string | null
+  claimedAt: string | null
+  revokedAt: string | null
+  deliveryStatus: 'sending' | 'sent' | 'failed' | 'uncertain' | 'cancelled' | null
+  deliveryError: string | null
+  recipientStatus?: 'invited' | 'wallet_required' | 'ready' | 'issued' | 'unavailable'
+  recipientDisplayName?: string | null
+  recipientWalletVerifiedAt?: string | null
+}
+
+export interface IssuerCredentialCard {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  organizationId: string
+  inviteId: string | null
+  recipientUserId: string
+  issuerAddress: string
+  subjectAddress: string
+  visibility: 'public' | 'private'
+  publicFields: string[]
+  payloadId: string | null
+  creationTransactionHash: string
+  createdAt: string
+  status: {
+    accepted: boolean | null
+    expiration: number | null
+    deletedLedgerIndex: number | null
+    deletionCause: string | null
+  }
+}
+
+export interface IssuerWorkspaceView {
+  organizations: PortalOrganization[]
+  selectedOrganizationId: string | null
+  schemas: IssuerSchemaCard[]
+  invites: IssuerInvitationCard[]
+  credentials: IssuerCredentialCard[]
+}
+
+export interface RecipientCredentialCard {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  schemaName: string | null
+  organizationId: string
+  organizationName: string
+  issuerAddress: string
+  subjectAddress: string
+  networkId: number
+  visibility: 'public' | 'private'
+  createdAt: string
+  creationTransactionHash: string
+  status: {
+    state: 'pending' | 'active' | 'expired' | 'deleted' | 'unknown'
+    accepted: boolean | null
+    expiration: number | null
+    deletedLedgerIndex: number | null
+    deletionCause: string | null
+  }
+}
+
+export interface RecipientInvitationCard {
+  id: string
+  organizationId: string
+  organizationName: string
+  profileId: string
+  schemaUid: string
+  schemaName: string | null
+  claimedAt: string
+  expiresAt: string
+  revokedAt: string | null
+  generationId: string | null
+}
+
+export interface RecipientWorkspaceView {
+  invitations: RecipientInvitationCard[]
+  credentials: RecipientCredentialCard[]
+  notifications: {
+    id: string
+    kind: 'issued' | 'revoked'
+    profileId: string
+    generationId: string
+    organizationName: string
+    createdAt: string
+  }[]
+}
+
+export interface RecipientCredentialDetail extends RecipientCredentialCard {
+  issuerAdmission: 'approved' | 'suspended' | 'not_approved' | 'unknown'
+  disclosure: { publicFields: string[]; fields: string[] }
+  events: {
+    transactionHash: string
+    eventType: 'created' | 'accepted' | 'deleted'
+    ledgerIndex: number
+    deletionCause: string | null
+  }[]
+}
+
+export interface RecipientPayloadView {
+  scope: 'full'
+  claims: PortalClaims
+  verification: VerificationDimensions
+}
+
+export interface PresentationView {
+  id: string
+  profileId: string
+  generationId: string
+  scope: 'public' | 'full'
+  verifierOrganizationId: string | null
+  verifierOrganizationName: string | null
+  createdAt: string
+  revokedAt: string | null
+}
+
+export interface CreatedPresentationView extends PresentationView {
+  token: string
+  url: string
+}
+
+export type HolderProofView =
+  | { status: 'not_provided' | 'invalid' }
+  | {
+      status: 'verified'
+      address: string
+      networkId: number
+      verifiedAt: string
+      message: string
+      purpose: 'presentation_authorization'
+      keyAuthority: 'master_key_address_only'
+      signature: string
+      publicKey: string
+      scheme: 'ripple' | 'otsu'
+    }
+
+export interface ResolvedPresentationView {
+  presentation: PresentationView
+  credential: RecipientCredentialCard
+  scope: 'public' | 'full'
+  claims: PortalClaims
+  verification: VerificationDimensions
+  requiresAuthorization: boolean
+  issuerAdmission: {
+    status: 'approved' | 'suspended' | 'not_approved' | 'unknown'
+    organizationId: string
+    checkedAt: string
+    reviewedAt: string | null
+  }
+  holderProof: HolderProofView
+}
+
+export interface VerifierWorkspaceView {
+  organizations: PortalOrganization[]
+  selectedOrganizationId: string | null
+  history: {
+    id: string
+    organizationId: string
+    presentationId: string
+    profileId: string
+    generationId: string
+    scope: 'public' | 'full'
+    checkedAt: string
+    verification: VerificationDimensions
+  }[]
+}
+
+export type PortalNextAction =
+  | { kind: 'apply'; to: '/issuer/apply' | '/verifier/apply' }
+  | { kind: 'awaitApproval' }
+  | { kind: 'linkWallet'; to: '/account'; returnTo: string }
+  | { kind: 'createTemplate'; to: '/issuer/schemas/new'; organizationId: string }
+  | { kind: 'invite'; to: '/issuer/recipients'; organizationId: string }
+  | { kind: 'awaitRecipient' }
+  | { kind: 'issue'; to: string; inviteId: string }
+  | { kind: 'review'; to: string }
+  | { kind: 'accept'; to: string }
+  | { kind: 'share'; to: string }
+  | { kind: 'done' }
diff --git a/apps/web/app/utils/browserE2eHarness.ts b/apps/web/app/utils/browserE2eHarness.ts
index 135bb27..b427667 100644
--- a/apps/web/app/utils/browserE2eHarness.ts
+++ b/apps/web/app/utils/browserE2eHarness.ts
@@ -1,10 +1,12 @@
+import { sign as signMessageBytes } from 'ripple-keypairs'
 import { decode, hashes, Wallet, type Client, type SubmittableTransaction } from 'xrpl'
 import type {
   AccountInfo,
+  ConnectOptions,
+  NetworkInfo,
   SignedTransaction,
   Transaction,
   WalletAdapter,
-  WalletManager,
 } from 'xrpl-connect'
 
 export const BROWSER_E2E_WALLET_ID = 'xcs-browser-e2e'
@@ -12,6 +14,7 @@ export const BROWSER_E2E_ACCOUNT = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
 export const BROWSER_E2E_SUBJECT_WALLET_ID = 'xcs-browser-e2e-subject'
 export const BROWSER_E2E_SUBJECT_ACCOUNT = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
 export const BROWSER_E2E_GEMWALLET_ID = 'gemwallet'
+export const BROWSER_E2E_OTSU_WALLET_ID = 'otsu'
 
 interface BrowserE2eEffects {
   walletSignatures: number
@@ -19,7 +22,9 @@ interface BrowserE2eEffects {
 }
 
 interface BrowserE2eControls {
+  __xcsBrowserE2eAuthWallet?: boolean
   __xcsBrowserE2eWalletDiscoveryDelayMs?: number
+  __xcsBrowserE2eCredentialObjects?: Record<string, unknown>[]
 }
 
 function browserE2eEffects(): BrowserE2eEffects {
@@ -32,6 +37,7 @@ function browserE2eEffects(): BrowserE2eEffects {
 
 const NETWORK_ID = 1
 const LEDGER_INDEX = 100_001
+const LEDGER_HASH = 'cd'.repeat(32)
 const LAST_LEDGER_SEQUENCE = LEDGER_INDEX + 20
 
 const BROWSER_E2E_SIGNERS = new Map([
@@ -55,8 +61,6 @@ const BROWSER_E2E_SIGNERS = new Map([
   ],
 ])
 
-type WalletListener = (payload?: unknown) => void
-
 const BROWSER_E2E_WALLETS = [
   {
     id: BROWSER_E2E_WALLET_ID,
@@ -73,74 +77,79 @@ const BROWSER_E2E_WALLETS = [
     name: 'GemWallet',
     address: BROWSER_E2E_ACCOUNT,
   },
+  {
+    id: BROWSER_E2E_OTSU_WALLET_ID,
+    name: 'Otsu Wallet',
+    address: BROWSER_E2E_ACCOUNT,
+  },
 ] as const
 
-class BrowserE2eWalletManager {
-  private readonly listeners = new Map<string, Set<WalletListener>>()
-  private readonly walletAdapters = BROWSER_E2E_WALLETS.map(({ id, name }) => ({
-    id,
-    name,
-    isAvailable: async () => true,
-    fetchAccount: async () => this.cloneCurrentAccount(),
-  })) as unknown as WalletAdapter[]
+class BrowserE2eWalletAdapter implements WalletAdapter {
+  public readonly capabilities = { sign: true, signAndSubmit: false, signMessage: false }
   private currentAccount: AccountInfo | null = null
-  private currentWalletId: string | null = null
-
-  public get account(): AccountInfo | null {
-    return this.currentAccount
-  }
-
-  public get connected(): boolean {
-    return this.currentAccount !== null
-  }
-
-  public get wallet(): WalletAdapter | null {
-    return this.walletAdapters.find((wallet) => wallet.id === this.currentWalletId) ?? null
-  }
-
-  public get wallets(): WalletAdapter[] {
-    return [...this.walletAdapters]
-  }
-
-  public on(event: string, listener: WalletListener): this {
-    const listeners = this.listeners.get(event) ?? new Set<WalletListener>()
-    listeners.add(listener)
-    this.listeners.set(event, listeners)
-    return this
+  private staleOriginPermission: boolean
+
+  public constructor(
+    public readonly id: string,
+    public readonly name: string,
+    private readonly address: string,
+  ) {
+    this.staleOriginPermission = id === BROWSER_E2E_OTSU_WALLET_ID
+    if (
+      id === BROWSER_E2E_GEMWALLET_ID &&
+      (globalThis as typeof globalThis & BrowserE2eControls).__xcsBrowserE2eAuthWallet
+    ) {
+      const signer = Wallet.fromEntropy(Uint8Array.from({ length: 16 }, (_, i) => 31 - i))
+      this.address = signer.classicAddress
+      BROWSER_E2E_SIGNERS.set(this.address, signer)
+      this.capabilities.signMessage = true
+    }
   }
 
-  public async getAvailableWallets(): Promise<WalletAdapter[]> {
+  public async isAvailable(): Promise<boolean> {
     const delay = (globalThis as typeof globalThis & BrowserE2eControls)
       .__xcsBrowserE2eWalletDiscoveryDelayMs
     if (typeof delay === 'number' && delay > 0) {
       await new Promise((resolve) => setTimeout(resolve, delay))
     }
-    return [...this.walletAdapters]
+    return true
   }
 
-  public async connect(walletId: string, options?: { network?: string }): Promise<AccountInfo> {
-    const wallet = BROWSER_E2E_WALLETS.find((candidate) => candidate.id === walletId)
-    if (!wallet) throw new Error('BROWSER_E2E_WALLET_UNKNOWN')
+  public async connect(options?: ConnectOptions): Promise<AccountInfo> {
     if (options?.network !== undefined && options.network !== 'testnet') {
       throw new Error('BROWSER_E2E_TESTNET_REQUIRED')
     }
+    if (this.staleOriginPermission) {
+      throw new Error('BROWSER_E2E_OTSU_STALE_PERMISSION_NOT_REVOKED')
+    }
     this.currentAccount = {
-      address: wallet.address,
+      address: this.address,
       network: {
         id: 'testnet',
         name: 'XRPL Testnet (deterministic E2E)',
         wss: 'ws://127.0.0.1:1',
       },
     }
-    this.currentWalletId = walletId
-    this.emit('connect', this.currentAccount)
-    return this.currentAccount
+    return this.cloneCurrentAccount()!
   }
 
   public async disconnect(): Promise<void> {
     this.currentAccount = null
-    this.currentWalletId = null
-    this.emit('disconnect')
+    this.staleOriginPermission = false
+  }
+
+  public async getAccount(): Promise<AccountInfo | null> {
+    return this.cloneCurrentAccount()
+  }
+
+  public async getNetwork(): Promise<NetworkInfo> {
+    return (
+      this.currentAccount?.network ?? {
+        id: 'testnet',
+        name: 'XRPL Testnet (deterministic E2E)',
+        wss: 'ws://127.0.0.1:1',
+      }
+    )
   }
 
   public async fetchAccount(): Promise<AccountInfo | null> {
@@ -169,8 +178,23 @@ class BrowserE2eWalletManager {
     }
   }
 
-  private emit(event: string, payload?: unknown): void {
-    for (const listener of this.listeners.get(event) ?? []) listener(payload)
+  public async signAndSubmit(): Promise<never> {
+    throw new Error('BROWSER_E2E_SIGN_AND_SUBMIT_FORBIDDEN')
+  }
+
+  public async signMessage(message: string) {
+    if (!this.capabilities.signMessage || !this.currentAccount)
+      throw new Error('BROWSER_E2E_SIGN_MESSAGE_UNSUPPORTED')
+    const signer = BROWSER_E2E_SIGNERS.get(this.currentAccount.address)!
+    const bytes = Array.from(new TextEncoder().encode(message), (b) =>
+      b.toString(16).padStart(2, '0'),
+    ).join('')
+    return {
+      message,
+      signature: signMessageBytes(bytes, signer.privateKey),
+      publicKey: signer.publicKey,
+      signerAddress: this.currentAccount.address,
+    }
   }
 
   private cloneCurrentAccount(): AccountInfo | null {
@@ -260,6 +284,18 @@ class BrowserE2eLedgerClient implements BrowserE2eClientShape {
     if (request.command === 'ledger_current') {
       return { result: { ledger_current_index: LEDGER_INDEX } }
     }
+    if (request.command === 'account_objects') {
+      const controls = globalThis as typeof globalThis & BrowserE2eControls
+      return {
+        result: {
+          account: request.account,
+          account_objects: controls.__xcsBrowserE2eCredentialObjects ?? [],
+          ledger_hash: LEDGER_HASH,
+          ledger_index: LEDGER_INDEX,
+          validated: true,
+        },
+      }
+    }
     throw new Error(`BROWSER_E2E_XRPL_COMMAND_UNSUPPORTED:${String(request.command)}`)
   }
 
@@ -268,8 +304,10 @@ class BrowserE2eLedgerClient implements BrowserE2eClientShape {
   }
 }
 
-export function createBrowserE2eWalletManager(): WalletManager {
-  return new BrowserE2eWalletManager() as unknown as WalletManager
+export function createBrowserE2eWalletAdapters(): WalletAdapter[] {
+  return BROWSER_E2E_WALLETS.map(
+    ({ id, name, address }) => new BrowserE2eWalletAdapter(id, name, address),
+  )
 }
 
 export function createBrowserE2eLedgerClient(): Client {
diff --git a/apps/web/app/utils/credentialInbox.ts b/apps/web/app/utils/credentialInbox.ts
new file mode 100644
index 0000000..bc4747b
--- /dev/null
+++ b/apps/web/app/utils/credentialInbox.ts
@@ -0,0 +1,208 @@
+import { credentialTypeToSchemaUid } from '#xcs/sdk/index.js'
+import { isValidClassicAddress, type Client } from 'xrpl'
+import { loadCredentialMutationReview, type CredentialMutationReview } from './credentialReview'
+
+const ACCEPTED_CREDENTIAL_FLAG = 0x0001_0000
+const HASH = /^[0-9a-f]{64}$/iu
+const MAX_UINT32 = 0xffff_ffff
+const PAGE_LIMIT = 400
+const MAX_PAGES = 25
+const EXACT_LOOKUP_CONCURRENCY = 5
+
+export interface WalletCredentialCandidate {
+  readonly ledgerObjectId: string
+  readonly issuer: string
+  readonly subject: string
+  readonly schemaUid: string
+}
+
+export interface WalletCredentialInboxItem extends CredentialMutationReview {
+  readonly ledgerObjectId: string
+  readonly state: 'pending' | 'expired'
+}
+
+interface CredentialInboxPage {
+  readonly account: string
+  readonly account_objects: unknown[]
+  readonly ledger_hash: string
+  readonly ledger_index: number
+  readonly marker?: string | undefined
+  readonly validated: true
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function invalidResponse(): never {
+  throw new Error('CREDENTIAL_INBOX_RESPONSE_INVALID')
+}
+
+function parseHash(value: unknown): string {
+  if (typeof value !== 'string' || !HASH.test(value)) return invalidResponse()
+  return value.toLowerCase()
+}
+
+function parseUint32(value: unknown): number {
+  if (!Number.isSafeInteger(value) || (value as number) < 0 || (value as number) > MAX_UINT32) {
+    return invalidResponse()
+  }
+  return value as number
+}
+
+function parsePage(value: unknown, subject: string): CredentialInboxPage {
+  if (!isRecord(value) || value.validated !== true || value.account !== subject) {
+    return invalidResponse()
+  }
+  if (!Array.isArray(value.account_objects)) return invalidResponse()
+  const ledgerHash = parseHash(value.ledger_hash)
+  const ledgerIndex = parseUint32(value.ledger_index)
+  if (
+    value.marker !== undefined &&
+    (typeof value.marker !== 'string' || value.marker.length === 0)
+  ) {
+    return invalidResponse()
+  }
+  return {
+    account: subject,
+    account_objects: value.account_objects,
+    ledger_hash: ledgerHash,
+    ledger_index: ledgerIndex,
+    ...(value.marker === undefined ? {} : { marker: value.marker }),
+    validated: true,
+  }
+}
+
+function parseCandidate(value: unknown, subject: string): WalletCredentialCandidate | null {
+  if (!isRecord(value) || value.LedgerEntryType !== 'Credential') return invalidResponse()
+  if (typeof value.Subject !== 'string' || !isValidClassicAddress(value.Subject)) {
+    return invalidResponse()
+  }
+  // account_objects also returns Credentials owned by this account as issuer
+  // but addressed to another subject. They do not belong in the subject inbox.
+  if (value.Subject !== subject) return null
+  if (typeof value.Issuer !== 'string') return invalidResponse()
+  if (!isValidClassicAddress(value.Issuer)) return invalidResponse()
+  const flags = parseUint32(value.Flags)
+  if ((flags & ACCEPTED_CREDENTIAL_FLAG) !== 0) return null
+
+  if (
+    typeof value.CredentialType !== 'string' ||
+    !/^(?:[0-9a-f]{2}){1,64}$/iu.test(value.CredentialType)
+  ) {
+    return invalidResponse()
+  }
+  // Native XRPL CredentialType is application-defined. XCS reserves exactly
+  // 32 bytes for a schema UID; other valid lengths belong to other protocols.
+  if (value.CredentialType.length !== 64) return null
+  let schemaUid: string
+  try {
+    schemaUid = credentialTypeToSchemaUid(value.CredentialType)
+  } catch {
+    return invalidResponse()
+  }
+
+  return {
+    ledgerObjectId: parseHash(value.index),
+    issuer: value.Issuer,
+    subject,
+    schemaUid,
+  }
+}
+
+/**
+ * Reads the connected subject's raw Credential entries from a validated XRPL
+ * snapshot. Later pages are pinned to the first page's ledger hash so an inbox
+ * cannot combine objects from different ledgers.
+ */
+export async function loadWalletCredentialCandidates(
+  client: Client,
+  subject: string,
+): Promise<WalletCredentialCandidate[]> {
+  if (!isValidClassicAddress(subject)) throw new Error('CREDENTIAL_INBOX_SUBJECT_INVALID')
+  if (!client.isConnected()) throw new Error('CREDENTIAL_INBOX_CLIENT_NOT_CONNECTED')
+
+  const candidates: WalletCredentialCandidate[] = []
+  const seenObjects = new Set<string>()
+  const seenTuples = new Set<string>()
+  const seenMarkers = new Set<string>()
+  let snapshot: { readonly ledgerHash: string; readonly ledgerIndex: number } | undefined
+  let marker: string | undefined
+
+  for (let pageNumber = 0; pageNumber < MAX_PAGES; pageNumber += 1) {
+    const response = await client.request({
+      command: 'account_objects',
+      account: subject,
+      type: 'credential',
+      limit: PAGE_LIMIT,
+      ...(snapshot === undefined
+        ? { ledger_index: 'validated' as const }
+        : { ledger_hash: snapshot.ledgerHash }),
+      ...(marker === undefined ? {} : { marker }),
+    })
+    const page = parsePage(response.result, subject)
+
+    if (snapshot === undefined) {
+      snapshot = { ledgerHash: page.ledger_hash, ledgerIndex: page.ledger_index }
+    } else if (
+      page.ledger_hash !== snapshot.ledgerHash ||
+      page.ledger_index !== snapshot.ledgerIndex
+    ) {
+      return invalidResponse()
+    }
+
+    for (const object of page.account_objects) {
+      const candidate = parseCandidate(object, subject)
+      if (candidate === null) continue
+      if (seenObjects.has(candidate.ledgerObjectId)) return invalidResponse()
+      const tuple = `${candidate.issuer}:${candidate.subject}:${candidate.schemaUid}`
+      if (seenTuples.has(tuple)) return invalidResponse()
+      seenObjects.add(candidate.ledgerObjectId)
+      seenTuples.add(tuple)
+      candidates.push(candidate)
+      if (candidates.length > 100) throw new Error('CREDENTIAL_INBOX_TOO_LARGE')
+    }
+
+    if (page.marker === undefined) {
+      return candidates.sort(
+        (left, right) =>
+          left.issuer.localeCompare(right.issuer) || left.schemaUid.localeCompare(right.schemaUid),
+      )
+    }
+    if (seenMarkers.has(page.marker)) return invalidResponse()
+    seenMarkers.add(page.marker)
+    marker = page.marker
+  }
+
+  throw new Error('CREDENTIAL_INBOX_TOO_LARGE')
+}
+
+/** Resolves candidates in bounded batches without fetching payloads or trust reports. */
+export async function resolveWalletCredentialInbox(
+  candidates: readonly WalletCredentialCandidate[],
+  loadExactCredential: (candidate: WalletCredentialCandidate) => Promise<unknown | undefined>,
+): Promise<WalletCredentialInboxItem[]> {
+  const resolved: WalletCredentialInboxItem[] = []
+  for (let offset = 0; offset < candidates.length; offset += EXACT_LOOKUP_CONCURRENCY) {
+    const batch = candidates.slice(offset, offset + EXACT_LOOKUP_CONCURRENCY)
+    const results = await Promise.all(
+      batch.map(async (candidate) => {
+        const response = await loadExactCredential(candidate)
+        if (response === undefined) return null
+        const review = loadCredentialMutationReview(response, candidate)
+        const state = review.state
+        if (review.accepted || (state !== 'pending' && state !== 'expired')) return null
+        return { ...review, state, ledgerObjectId: candidate.ledgerObjectId }
+      }),
+    )
+    for (const result of results) {
+      if (result !== null) resolved.push(result)
+    }
+  }
+  return resolved.sort(
+    (left, right) =>
+      (left.state === right.state ? 0 : left.state === 'pending' ? -1 : 1) ||
+      left.issuer.localeCompare(right.issuer) ||
+      left.schemaUid.localeCompare(right.schemaUid),
+  )
+}
diff --git a/apps/web/app/utils/credentialReview.ts b/apps/web/app/utils/credentialReview.ts
index f13c054..16a2ef3 100644
--- a/apps/web/app/utils/credentialReview.ts
+++ b/apps/web/app/utils/credentialReview.ts
@@ -1,4 +1,5 @@
 import {
+  decodeHexUtf8,
   parseCredentialPayload,
   parsePayloadUri,
   rippleTimeToIso,
@@ -6,8 +7,6 @@ import {
   type ResolvedSchema,
 } from '#xcs/core/index.js'
 
-import { decodeHexUtf8 } from './serialization'
-
 import {
   inspectPilotHttpsPayloadHost,
   readCanonicalHttpsPayload,
diff --git a/apps/web/app/utils/crossmarkSession.ts b/apps/web/app/utils/crossmarkSession.ts
new file mode 100644
index 0000000..0608a98
--- /dev/null
+++ b/apps/web/app/utils/crossmarkSession.ts
@@ -0,0 +1,128 @@
+import { supportsFetchAccount, type AccountInfo, type WalletManager } from 'xrpl-connect'
+
+const CHANGE_EVENTS = ['user-change', 'network-change'] as const
+const REFRESH_TIMEOUT_MS = 10_000
+type Refresh = { rerun: boolean; cancel?: () => void }
+
+function sameIdentity(left: AccountInfo, right: AccountInfo | null): boolean {
+  return Boolean(
+    right &&
+    left.address === right.address &&
+    left.network.id === right.network.id &&
+    left.network.wss === right.network.wss &&
+    left.network.rpc === right.network.rpc,
+  )
+}
+
+/** Crossmark broadcasts profile/node initialization as well as actual changes. */
+export function bindCrossmarkSession(options: {
+  events: {
+    on(event: string, listener: () => void): unknown
+    off(event: string, listener: () => void): unknown
+  }
+  manager: Pick<WalletManager, 'connected' | 'wallet' | 'account' | 'on' | 'off'>
+  disconnect: () => Promise<void>
+  onError: (error: unknown) => void
+}): () => void {
+  let disposed = false
+  let epoch = 0
+  let disconnecting = false
+  let refresh: Refresh | undefined
+  const reset = () => {
+    epoch += 1
+    refresh?.cancel?.()
+    refresh = undefined
+  }
+  const isConnected = () =>
+    !disposed && options.manager.connected && options.manager.wallet?.id === 'crossmark'
+
+  const invalidate = (reason?: Error) => {
+    if (disconnecting || !isConnected()) return
+    reset()
+    if (reason) options.onError(reason)
+    disconnecting = true
+    void options
+      .disconnect()
+      .catch(options.onError)
+      .finally(() => {
+        disconnecting = false
+      })
+  }
+
+  const signout = () => invalidate()
+  const recheck = () => {
+    if (disconnecting || !isConnected()) return
+    if (refresh) {
+      refresh.rerun = true
+      return
+    }
+    const adapter = options.manager.wallet
+    const approved = options.manager.account
+    if (!adapter || !approved || !supportsFetchAccount(adapter)) {
+      invalidate(new Error('CROSSMARK_SESSION_REFRESH_UNAVAILABLE'))
+      return
+    }
+    const started = epoch
+    const job: Refresh = { rerun: false }
+    refresh = job
+    const current = () =>
+      isConnected() && epoch === started && options.manager.wallet === adapter && refresh === job
+    void (async () => {
+      try {
+        do {
+          job.rerun = false
+          let timer: ReturnType<typeof setTimeout> | undefined
+          const deadline = new Promise<never>((_, reject) => {
+            job.cancel = () => {
+              clearTimeout(timer)
+              reject(new Error('CROSSMARK_SESSION_REFRESH_CANCELLED'))
+            }
+            timer = setTimeout(
+              () => reject(new Error('CROSSMARK_SESSION_REFRESH_TIMEOUT')),
+              REFRESH_TIMEOUT_MS,
+            )
+          })
+          let account: AccountInfo | null
+          try {
+            account = await Promise.race([
+              Promise.resolve().then(() => adapter.fetchAccount()),
+              deadline,
+            ])
+          } finally {
+            clearTimeout(timer)
+            job.cancel = undefined
+          }
+          if (!current()) return
+          // A newer event arrived while reading: inspect its final state first.
+          if (job.rerun) continue
+          if (!sameIdentity(approved, account)) invalidate(new Error('CROSSMARK_SESSION_CHANGED'))
+        } while (job.rerun && current())
+      } catch (error) {
+        if (current())
+          invalidate(
+            new Error(
+              error instanceof Error && error.message === 'CROSSMARK_SESSION_REFRESH_TIMEOUT'
+                ? error.message
+                : 'CROSSMARK_SESSION_REFRESH_FAILED',
+            ),
+          )
+      } finally {
+        if (refresh === job) refresh = undefined
+      }
+    })()
+  }
+
+  options.manager.on('connect', reset)
+  options.manager.on('disconnect', reset)
+  options.events.on('signout', signout)
+  for (const event of CHANGE_EVENTS) options.events.on(event, recheck)
+
+  return () => {
+    disposed = true
+    reset()
+    options.manager.off('connect', reset)
+    options.manager.off('disconnect', reset)
+    options.events.off('signout', signout)
+    for (const event of CHANGE_EVENTS) options.events.off(event, recheck)
+  }
+}
diff --git a/apps/web/app/utils/developerQuickstart.ts b/apps/web/app/utils/developerQuickstart.ts
index b476208..c8edc24 100644
--- a/apps/web/app/utils/developerQuickstart.ts
+++ b/apps/web/app/utils/developerQuickstart.ts
@@ -1,6 +1,4 @@
-import type { JsonValue } from '#xcs/core/index.js'
-
-import { parseJson } from './serialization'
+import { parseJson, type JsonValue } from '#xcs/core/index.js'
 
 const GENERATION_ID_PATTERN = /^[0-9a-f]{64}$/u
 const PROFILE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,127}$/u
@@ -220,7 +218,7 @@ import {
   credentialHexToUri,
   parseCredentialPayload,
   verifyPayloadIntegrity,
-} from '#xcs/sdk/index.js'
+} from '@xcs-protocol/sdk'
 
 const API_BASE = ${typescriptLiteral(apiBaseUrl)}
 const PROFILE_ID = ${typescriptLiteral(profileId)}
@@ -322,7 +320,7 @@ printf '%s' "$cli_report" | jq '{onChain,schema,payload,issuerTrust}'`
   connectAndValidateNetwork,
   signPreparedAndSubmit,
   type Signer,
-} from '#xcs/sdk/index.js'
+} from '@xcs-protocol/sdk'
 
 await connectAndValidateNetwork(xrplClient, profile)
 const unsigned = buildCredentialCreate({ issuer, subject, schemaUid, uri })
diff --git a/apps/web/app/utils/gemWalletRawSigning.ts b/apps/web/app/utils/gemWalletRawSigning.ts
new file mode 100644
index 0000000..60a0214
--- /dev/null
+++ b/apps/web/app/utils/gemWalletRawSigning.ts
@@ -0,0 +1,83 @@
+import { assertSignedTransactionMatches, type SignerResult } from '#xcs/sdk/index.js'
+import { deriveAddress, encode, encodeForSigning, hashes, validate } from 'xrpl'
+import {
+  GemWalletAPI,
+  WalletError,
+  WalletErrorCode,
+  type AccountInfo,
+  type Transaction,
+} from 'xrpl-connect'
+import { isXcsCredentialTransactionType } from './walletCompatibility'
+
+export function requiresGemWalletRawSigning(walletId: string | undefined, type: unknown): boolean {
+  return walletId === 'gemwallet' && isXcsCredentialTransactionType(type)
+}
+
+/**
+ * GemWallet 3.8 cannot decode Credentials, but its public hex-message API signs
+ * XRPL signing bytes. Never call this without explicit raw-signing consent.
+ * Connection and network checks remain owned by XRPL Connect / useWallet.
+ */
+export async function signGemWalletCredential(
+  transaction: Transaction,
+  account: AccountInfo,
+): Promise<SignerResult> {
+  const prepared = structuredClone(transaction)
+  if (!isXcsCredentialTransactionType(prepared.TransactionType)) {
+    throw new Error('GEMWALLET_RAW_TRANSACTION_UNSUPPORTED')
+  }
+  if (account.network.id !== 'testnet') throw new Error('WALLET_TESTNET_REQUIRED')
+  if (
+    !account.publicKey ||
+    !/^(?:02|03|ED)[0-9A-F]{64}$/iu.test(account.publicKey) ||
+    deriveAddress(account.publicKey) !== account.address ||
+    prepared.Account !== account.address
+  ) {
+    throw new Error('GEMWALLET_RAW_SIGNER_MISMATCH')
+  }
+  if (
+    prepared.Signers !== undefined ||
+    prepared.TxnSignature !== undefined ||
+    prepared.SigningPubKey
+  ) {
+    throw new Error('GEMWALLET_RAW_UNSIGNED_TRANSACTION_REQUIRED')
+  }
+  if (
+    !Number.isSafeInteger(prepared.Sequence) ||
+    prepared.Sequence! < 0 ||
+    !Number.isSafeInteger(prepared.LastLedgerSequence) ||
+    prepared.LastLedgerSequence! <= 0 ||
+    prepared.Fee === undefined
+  ) {
+    throw new Error('GEMWALLET_RAW_PREPARED_TRANSACTION_REQUIRED')
+  }
+  const unsigned = { ...prepared, SigningPubKey: account.publicKey }
+  validate(unsigned)
+  // rc.2's adapter.signMessage converts bytes to UTF-8 and drops isHex. Use
+  // the official API exported by that same package, not a replacement provider.
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(
+      () =>
+        reject(
+          new Error('GemWallet signing timed out. Close its pending request before retrying.'),
+        ),
+      90_000,
+    )
+  })
+  let response: Awaited<ReturnType<typeof GemWalletAPI.signMessage>>
+  try {
+    response = await Promise.race([
+      GemWalletAPI.signMessage(encodeForSigning(unsigned), true),
+      deadline,
+    ])
+  } finally {
+    clearTimeout(timer)
+  }
+  if (response.type === 'reject' || !response.result?.signedMessage) {
+    throw new WalletError(WalletErrorCode.SIGN_REJECTED, 'GemWallet raw signing was rejected.')
+  }
+  const txBlob = encode({ ...unsigned, TxnSignature: response.result.signedMessage })
+  assertSignedTransactionMatches(prepared, txBlob)
+  return { txBlob, hash: hashes.hashSignedTx(txBlob) }
+}
diff --git a/apps/web/app/utils/hostedPayload.ts b/apps/web/app/utils/hostedPayload.ts
new file mode 100644
index 0000000..eefe003
--- /dev/null
+++ b/apps/web/app/utils/hostedPayload.ts
@@ -0,0 +1,138 @@
+import { createHttpsPayloadUri, parsePayloadUri, payloadDigest } from '#xcs/core/index.js'
+import { inspectPilotHttpsPayloadHost, verifyHttpsPayloadPublication } from './payloadPublication'
+
+export const HOSTED_PAYLOAD_LOCATOR_HEX_LENGTH = 18
+// The hosted API's decoded byte limit, not the protocol's larger payload limit.
+export const HOSTED_PAYLOAD_MAX_BYTES = 64 * 1024
+
+export function assertHostedPayloadSize(canonicalPayload: string): void {
+  const size = new TextEncoder().encode(canonicalPayload).byteLength
+  if (size === 0 || size > HOSTED_PAYLOAD_MAX_BYTES) throw new Error('PAYLOAD_SIZE_INVALID')
+}
+
+/** Reachability only: publication and exact-byte verification still follow ledger success. */
+export async function assertHostedPayloadReachable(
+  credentialUri: string,
+  fetchImpl: typeof fetch = globalThis.fetch,
+): Promise<void> {
+  inspectPilotHttpsPayloadHost(credentialUri)
+  const uri = parsePayloadUri(credentialUri)
+  if (uri.kind !== 'https') throw new Error('PAYLOAD_SERVICE_HTTPS_REQUIRED')
+  try {
+    const response = await fetchImpl(uri.fetchUrl, {
+      method: 'HEAD',
+      cache: 'no-store',
+      credentials: 'omit',
+      redirect: 'error',
+      signal: AbortSignal.timeout(10_000),
+    })
+    // A new content-addressed object does not exist until the signed credential
+    // is published. An unreachable origin, expired tunnel or server error is not
+    // that expected absence and must block signing.
+    if (!response.ok && response.status !== 404) throw new Error(`HTTP ${response.status}`)
+  } catch (cause) {
+    throw new Error('PAYLOAD_HOST_UNREACHABLE_BEFORE_SIGNING', { cause })
+  }
+}
+
+export interface HostedPayloadLocation {
+  readonly locator: string
+  readonly fetchUrl: string
+  readonly credentialUri: string
+  readonly digestHex: string
+}
+
+export function createHostedPayloadLocation(
+  publicBaseUrl: string,
+  canonicalPayload: string,
+): HostedPayloadLocation {
+  assertHostedPayloadSize(canonicalPayload)
+  let base: URL
+  try {
+    base = new URL(publicBaseUrl)
+  } catch {
+    throw new Error('PAYLOAD_SERVICE_NOT_CONFIGURED')
+  }
+  if (
+    base.protocol !== 'https:' ||
+    base.username !== '' ||
+    base.password !== '' ||
+    base.origin !== publicBaseUrl
+  ) {
+    throw new Error('PAYLOAD_SERVICE_HTTPS_REQUIRED')
+  }
+
+  const digestHex = payloadDigest(canonicalPayload)
+  const locator = digestHex.slice(0, HOSTED_PAYLOAD_LOCATOR_HEX_LENGTH)
+  const fetchUrl = `${publicBaseUrl}/p/${locator}`
+  const credentialUri = createHttpsPayloadUri(fetchUrl, canonicalPayload)
+  if (new TextEncoder().encode(credentialUri).byteLength > 128) {
+    throw new Error('PAYLOAD_SERVICE_URL_TOO_LONG')
+  }
+  return { locator, fetchUrl, credentialUri, digestHex }
+}
+
+export function encodePayloadBase64(canonicalPayload: string): string {
+  assertHostedPayloadSize(canonicalPayload)
+  const bytes = new TextEncoder().encode(canonicalPayload)
+  let binary = ''
+  for (const byte of bytes) binary += String.fromCharCode(byte)
+  return btoa(binary)
+}
+
+export interface PendingHostedPayload {
+  readonly network: string
+  readonly locator: string
+  readonly canonicalPayload: string
+  readonly credentialUri: string
+  readonly signedTransactionBlob: string
+  readonly transactionHash: string
+}
+
+interface HostedPayloadReceipt {
+  readonly uri: string
+  readonly fetchUrl: string
+  readonly digestHex: string
+  readonly byteLength: number
+  readonly transactionHash: string
+}
+
+/** Called only after ledger success. Retrying publishes the same signed credential. */
+export async function publishHostedPayloadAndVerify(
+  pending: PendingHostedPayload,
+  publish: (input: {
+    network: string
+    locator: string
+    payloadBase64: string
+    signedTransactionBlob: string
+  }) => Promise<HostedPayloadReceipt>,
+  fetchImpl?: typeof fetch,
+) {
+  let receipt: HostedPayloadReceipt
+  try {
+    receipt = await publish({
+      network: pending.network,
+      locator: pending.locator,
+      payloadBase64: encodePayloadBase64(pending.canonicalPayload),
+      signedTransactionBlob: pending.signedTransactionBlob,
+    })
+  } catch (error) {
+    const code = (error as { data?: { error?: unknown } } | null)?.data?.error
+    if (typeof code === 'string') throw new Error(code, { cause: error })
+    throw error
+  }
+  if (
+    receipt.uri !== pending.credentialUri ||
+    receipt.fetchUrl !== pending.credentialUri.split('#')[0] ||
+    receipt.digestHex !== payloadDigest(pending.canonicalPayload) ||
+    receipt.byteLength !== new TextEncoder().encode(pending.canonicalPayload).byteLength ||
+    receipt.transactionHash.toLowerCase() !== pending.transactionHash.toLowerCase()
+  ) {
+    throw new Error('SIGNED_TRANSACTION_PAYLOAD_MISMATCH')
+  }
+  return verifyHttpsPayloadPublication({
+    canonicalPayload: pending.canonicalPayload,
+    credentialUri: pending.credentialUri,
+    ...(fetchImpl ? { fetchImpl } : {}),
+  })
+}
diff --git a/apps/web/app/utils/hostedPublicationQueue.ts b/apps/web/app/utils/hostedPublicationQueue.ts
new file mode 100644
index 0000000..d7cf2d4
--- /dev/null
+++ b/apps/web/app/utils/hostedPublicationQueue.ts
@@ -0,0 +1,166 @@
+import { canonicalJson, parseJson } from '#xcs/core/index.js'
+import {
+  createHostedPayloadLocation,
+  publishHostedPayloadAndVerify,
+  type PendingHostedPayload,
+} from './hostedPayload'
+import type { StoredOperation } from './operationJournal'
+
+const PREFIX = 'xcs-hosted-publication-v1:'
+const MAX_ENTRIES = 20
+const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+export interface HostedPublicationJob {
+  readonly id: string
+  readonly createdAt: string
+  readonly payload: PendingHostedPayload
+}
+
+type PublicationDraft = Omit<PendingHostedPayload, 'signedTransactionBlob' | 'transactionHash'>
+
+/** The journal is written first. Recover from it if the second storage write was interrupted. */
+export function recoverPublicationSignatures(
+  jobs: HostedPublicationJob[],
+  operations: StoredOperation[],
+): HostedPublicationJob[] {
+  return jobs.map((job) => {
+    if (job.payload.transactionHash) return job
+    const operation = operations.find(
+      (item) =>
+        item.business?.action === 'credential-issue' &&
+        item.business.publicationJobId === job.id &&
+        item.profileId === job.payload.network &&
+        item.business.credentialUri === job.payload.credentialUri &&
+        item.txHash &&
+        item.txBlob,
+    )
+    return operation?.txHash && operation.txBlob
+      ? validate({
+          ...job,
+          payload: {
+            ...job.payload,
+            transactionHash: operation.txHash,
+            signedTransactionBlob: operation.txBlob,
+          },
+        })
+      : job
+  })
+}
+
+function validate(job: HostedPublicationJob): HostedPublicationJob {
+  if (!job || !ID.test(job.id) || !Number.isFinite(Date.parse(job.createdAt))) {
+    throw new Error('PAYLOAD_RECOVERY_INVALID')
+  }
+  const payload = job.payload
+  if (!payload || typeof payload.network !== 'string' || !payload.network.length) {
+    throw new Error('PAYLOAD_RECOVERY_INVALID')
+  }
+  const parsed = parseJson(payload.canonicalPayload)
+  if (canonicalJson(parsed) !== payload.canonicalPayload)
+    throw new Error('PAYLOAD_RECOVERY_INVALID')
+  const location = createHostedPayloadLocation(
+    new URL(payload.credentialUri).origin,
+    payload.canonicalPayload,
+  )
+  if (payload.locator !== location.locator || payload.credentialUri !== location.credentialUri) {
+    throw new Error('PAYLOAD_RECOVERY_INVALID')
+  }
+  const unsigned = payload.signedTransactionBlob === '' && payload.transactionHash === ''
+  if (
+    !unsigned &&
+    (!/^[0-9a-f]{64}$/i.test(payload.transactionHash) ||
+      !/^(?:[0-9a-f]{2}){1,65536}$/i.test(payload.signedTransactionBlob))
+  ) {
+    throw new Error('PAYLOAD_RECOVERY_INVALID')
+  }
+  return job
+}
+
+/** Per-job keys avoid overwriting another tab's queue. Never evict unpublished data. */
+export function createHostedPublicationQueue(storage: Storage) {
+  function inspect(): { jobs: HostedPublicationJob[]; invalidKeys: string[] } {
+    const jobs: HostedPublicationJob[] = []
+    const invalidKeys: string[] = []
+    for (let index = 0; index < storage.length; index += 1) {
+      const key = storage.key(index)
+      if (!key?.startsWith(PREFIX)) continue
+      const item = storage.getItem(key)
+      if (item === null) continue
+      try {
+        const job = validate(JSON.parse(item) as HostedPublicationJob)
+        if (key !== PREFIX + job.id) throw new Error('PAYLOAD_RECOVERY_INVALID')
+        jobs.push(job)
+      } catch {
+        invalidKeys.push(key)
+      }
+    }
+    return { jobs: jobs.sort((a, b) => a.createdAt.localeCompare(b.createdAt)), invalidKeys }
+  }
+
+  function list(): HostedPublicationJob[] {
+    return inspect().jobs
+  }
+
+  function save(job: HostedPublicationJob): HostedPublicationJob {
+    validate(job)
+    try {
+      storage.setItem(PREFIX + job.id, JSON.stringify(job))
+    } catch (cause) {
+      throw new Error('PAYLOAD_RECOVERY_STORAGE_UNAVAILABLE', { cause })
+    }
+    return job
+  }
+
+  function begin(payload: PublicationDraft): HostedPublicationJob {
+    const { jobs, invalidKeys } = inspect()
+    if (jobs.length + invalidKeys.length >= MAX_ENTRIES)
+      throw new Error('PAYLOAD_RECOVERY_QUEUE_FULL')
+    // Save the consented public bytes before invoking the wallet. If storage is
+    // disabled or full, do not allow an irreversible ledger submission.
+    return save({
+      id: crypto.randomUUID(),
+      createdAt: new Date().toISOString(),
+      payload: { ...payload, transactionHash: '', signedTransactionBlob: '' },
+    })
+  }
+
+  function signed(id: string, signature: { txHash: string; txBlob: string }): HostedPublicationJob {
+    const job = list().find((item) => item.id === id)
+    if (!job) throw new Error('PAYLOAD_RECOVERY_NOT_FOUND')
+    return save({
+      ...job,
+      payload: {
+        ...job.payload,
+        transactionHash: signature.txHash,
+        signedTransactionBlob: signature.txBlob,
+      },
+    })
+  }
+
+  function remove(id: string): void {
+    if (!ID.test(id)) throw new Error('PAYLOAD_RECOVERY_INVALID')
+    storage.removeItem(PREFIX + id)
+  }
+
+  function removeInvalid(key: string): void {
+    if (!inspect().invalidKeys.includes(key)) throw new Error('PAYLOAD_RECOVERY_INVALID')
+    storage.removeItem(key)
+  }
+
+  async function publish(
+    id: string,
+    publisher: Parameters<typeof publishHostedPayloadAndVerify>[1],
+    fetchImpl?: typeof fetch,
+    operations: StoredOperation[] = [],
+  ) {
+    const job = recoverPublicationSignatures(list(), operations).find((item) => item.id === id)
+    if (!job?.payload.transactionHash) throw new Error('PAYLOAD_RECOVERY_SIGNATURE_MISSING')
+    // This only uploads. The API independently requires a validated, indexed
+    // CredentialCreate. Never submit a transaction or ask for a new signature.
+    const proof = await publishHostedPayloadAndVerify(job.payload, publisher, fetchImpl)
+    remove(id)
+    return proof
+  }
+
+  return { list, inspect, begin, signed, remove, removeInvalid, publish }
+}
diff --git a/apps/web/app/utils/issuerEngine.ts b/apps/web/app/utils/issuerEngine.ts
new file mode 100644
index 0000000..45ed094
--- /dev/null
+++ b/apps/web/app/utils/issuerEngine.ts
@@ -0,0 +1,261 @@
+import {
+  parsePayloadUri,
+  payloadDigest,
+  type ResolvedSchema,
+  type SchemaDefinition,
+} from '#xcs/core/index.js'
+import type { WalletSubmissionResult } from '../composables/useWallet'
+import type { StoredOperation } from './operationJournal'
+
+export interface IssuerWallet {
+  address: string
+  networkId: number
+  verifiedAt?: string | null
+}
+export interface IssuerIssuanceContext {
+  existingCredential?: { profileId: string; generationId: string } | null
+  invite: {
+    id: string
+    organizationId: string
+    profileId: string
+    schemaUid: string
+    claimedBy: string
+    expiresAt: string
+    revokedAt: string | null
+    deliveryEmail?: string | null
+  }
+  schema: {
+    schemaUid: string
+    profileId: string
+    name: string
+    definition: SchemaDefinition
+    resolvedDefinition: ResolvedSchema
+    publisher: string
+  }
+  recipient: { id: string; displayName: string | null; wallets: IssuerWallet[] }
+  organization: { id: string; name: string }
+  issuerWallets: IssuerWallet[]
+}
+export interface IssuerCredentialDetail {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  organizationId: string
+  inviteId: string
+  recipientUserId: string
+  recipient?: { id: string; displayName: string | null }
+  issuerAddress: string
+  subjectAddress: string
+  visibility: 'public' | 'private'
+  publicFields: string[]
+  payloadId: string | null
+  creationTransactionHash: string
+  status: {
+    accepted: boolean | null
+    expiration: number | null
+    deletedLedgerIndex: number | null
+    deletionCause: string | null
+  }
+  schema: { name: string }
+}
+export interface IssuerVisibility {
+  visibility: 'public' | 'private'
+  publicFields: string[]
+}
+export interface IssuerPayloadReceipt {
+  payloadId: string
+  credentialUri: string
+  payloadDigest: string
+}
+
+export function assertIssuerPayloadReceipt(
+  receipt: IssuerPayloadReceipt,
+  canonicalPayload: string,
+): void {
+  const uri = parsePayloadUri(receipt.credentialUri)
+  const digest = payloadDigest(canonicalPayload)
+  if (
+    uri.kind !== 'https' ||
+    uri.digestHex !== digest ||
+    receipt.payloadDigest !== digest ||
+    new TextEncoder().encode(receipt.credentialUri).byteLength > 128
+  ) {
+    throw new Error('ISSUER_PAYLOAD_DIGEST_MISMATCH')
+  }
+}
+export interface IssuerEngineRecord {
+  transactionHash: string
+  payloadId?: string
+  visibility?: 'public' | 'private'
+  publicFields?: string[]
+}
+export interface IssuerSchemaEngineContext {
+  key: string
+  profileId: string
+  beforeSign: (publisher: string) => Promise<void>
+  record: (receipt: IssuerEngineRecord) => Promise<void>
+}
+export interface IssuerIssueEngineContext extends IssuerSchemaEngineContext {
+  inviteId: string
+  existingCredential?: { profileId: string; generationId: string } | null
+  schemaUid: string
+  schemaName: string
+  subjectAddress: string
+  recipientLabel: string
+  preparePayload: (
+    canonicalPayload: string,
+    visibility: IssuerVisibility,
+  ) => Promise<IssuerPayloadReceipt>
+}
+export interface IssuerRevokeEngineContext {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  schemaName: string
+  issuerAddress: string
+  subjectAddress: string
+  recipientLabel: string
+  beforeSign: (publisher: string) => Promise<void>
+  onSigned?: (transactionHash: string) => void
+  afterConfirmed?: (result: WalletSubmissionResult) => Promise<void>
+}
+
+export function assertIssuerWallet(wallets: readonly IssuerWallet[], address: string): void {
+  if (!wallets.some((wallet) => wallet.address === address && wallet.networkId === 1)) {
+    throw new Error('ISSUER_VERIFIED_WALLET_REQUIRED')
+  }
+}
+
+/** Recheck server-owned recipient and schema bindings; email delivery is not identity proof. */
+export function assertIssuanceContextUnchanged(
+  expected: IssuerIssuanceContext,
+  current: IssuerIssuanceContext,
+  subject: string,
+  publisher: string,
+): void {
+  if (current.existingCredential) throw new Error('ISSUER_INVITE_ALREADY_ISSUED')
+  if (
+    current.invite.id !== expected.invite.id ||
+    current.invite.organizationId !== expected.invite.organizationId ||
+    current.invite.profileId !== expected.invite.profileId ||
+    current.invite.schemaUid !== expected.invite.schemaUid ||
+    current.invite.claimedBy !== expected.invite.claimedBy ||
+    current.recipient.id !== expected.recipient.id ||
+    current.schema.schemaUid !== expected.schema.schemaUid ||
+    current.invite.revokedAt !== null ||
+    !current.recipient.wallets.some(
+      (wallet) => wallet.address === subject && wallet.networkId === 1,
+    )
+  ) {
+    throw new Error('ISSUER_CONTEXT_CHANGED')
+  }
+  assertIssuerWallet(current.issuerWallets, publisher)
+}
+
+export function claimPublicPointer(name: string): string {
+  return `/${name.replaceAll('~', '~0').replaceAll('/', '~1')}`
+}
+
+/** The editor offers whole top-level fields; nested selector validation remains server-owned. */
+export function issuerVisibilityPreview(
+  claims: Record<string, unknown>,
+  setting: IssuerVisibility,
+): { public: Record<string, unknown>; private: Record<string, unknown> } {
+  const visible = Object.create(null) as Record<string, unknown>
+  const hidden = Object.create(null) as Record<string, unknown>
+  for (const [name, value] of Object.entries(claims)) {
+    const target =
+      setting.visibility === 'public' || setting.publicFields.includes(claimPublicPointer(name))
+        ? visible
+        : hidden
+    target[name] = value
+  }
+  return { public: visible, private: hidden }
+}
+
+const HASH = /^[0-9a-f]{64}$/i
+/** Store only transaction/object references, never claims, delivery contacts or bearer tokens. */
+export function saveIssuerEngineRecord(
+  storage: Pick<Storage, 'setItem'>,
+  key: string,
+  receipt: IssuerEngineRecord,
+): void {
+  if (!HASH.test(receipt.transactionHash)) throw new Error('ISSUER_TRANSACTION_HASH_INVALID')
+  storage.setItem(
+    `xcs-issuer-engine:${key}`,
+    JSON.stringify({
+      transactionHash: receipt.transactionHash,
+      ...(receipt.payloadId === undefined ? {} : { payloadId: receipt.payloadId }),
+      ...(receipt.visibility === undefined ? {} : { visibility: receipt.visibility }),
+      ...(receipt.publicFields === undefined ? {} : { publicFields: receipt.publicFields }),
+    }),
+  )
+}
+export function readIssuerEngineRecord(
+  storage: Pick<Storage, 'getItem'>,
+  key: string,
+): IssuerEngineRecord | null {
+  try {
+    const raw: unknown = JSON.parse(storage.getItem(`xcs-issuer-engine:${key}`) ?? 'null')
+    if (!raw || typeof raw !== 'object') return null
+    const record = raw as Record<string, unknown>
+    if (typeof record.transactionHash !== 'string' || !HASH.test(record.transactionHash))
+      return null
+    if (
+      record.payloadId !== undefined &&
+      (typeof record.payloadId !== 'string' || !/^[0-9a-f-]{36}$/i.test(record.payloadId))
+    )
+      return null
+    if (
+      record.visibility !== undefined &&
+      record.visibility !== 'private' &&
+      record.visibility !== 'public'
+    )
+      return null
+    if (
+      record.publicFields !== undefined &&
+      (!Array.isArray(record.publicFields) ||
+        record.publicFields.some((field) => typeof field !== 'string'))
+    )
+      return null
+    return {
+      transactionHash: record.transactionHash,
+      ...(typeof record.payloadId === 'string' ? { payloadId: record.payloadId } : {}),
+      ...(record.visibility === 'private' || record.visibility === 'public'
+        ? { visibility: record.visibility }
+        : {}),
+      ...(Array.isArray(record.publicFields)
+        ? { publicFields: record.publicFields as string[] }
+        : {}),
+    }
+  } catch {
+    return null
+  }
+}
+export function clearIssuerEngineRecord(storage: Pick<Storage, 'removeItem'>, key: string): void {
+  storage.removeItem(`xcs-issuer-engine:${key}`)
+}
+
+/** A timeout, rejected RPC call or generic failed stage does not prove ledger absence. */
+export function issuerOperationDefinitelyFailed(
+  receipt: IssuerEngineRecord,
+  profileId: string,
+  operations: readonly StoredOperation[],
+): boolean {
+  return operations.some((operation) => {
+    if (
+      operation.txHash?.toLowerCase() !== receipt.transactionHash.toLowerCase() ||
+      operation.profileId !== profileId
+    )
+      return false
+    if (operation.stage === 'expired')
+      return Number.isSafeInteger(operation.lastLedgerSequence) && operation.lastLedgerSequence! > 0
+    return (
+      operation.stage === 'validated' &&
+      typeof operation.engineResult === 'string' &&
+      /^tec[A-Z_]+$/.test(operation.engineResult) &&
+      Number.isSafeInteger(operation.ledgerIndex) &&
+      operation.ledgerIndex! > 0
+    )
+  })
+}
diff --git a/apps/web/app/utils/issuerWorkspace.ts b/apps/web/app/utils/issuerWorkspace.ts
new file mode 100644
index 0000000..e1a6c89
--- /dev/null
+++ b/apps/web/app/utils/issuerWorkspace.ts
@@ -0,0 +1,22 @@
+import type { IssuerCredentialCard, IssuerInvitationCard } from '~/types/portal'
+
+export function issuerCredentialState(credential: IssuerCredentialCard, now = Date.now()): string {
+  const state = credential.status
+  if (state.accepted === null) return 'unavailable'
+  if (state.deletedLedgerIndex !== null) {
+    return state.deletionCause === 'issuer_revoked'
+      ? 'revoked'
+      : state.deletionCause === 'subject_rejected'
+        ? 'declined'
+        : 'inactive'
+  }
+  if (state.expiration !== null && (state.expiration + 946684800) * 1000 <= now) return 'expired'
+  return state.accepted ? 'accepted' : 'issued'
+}
+
+export function issuerInvitationState(invite: IssuerInvitationCard, now = Date.now()): string {
+  if (invite.revokedAt) return 'revoked'
+  // Expiry bounds claiming; it does not erase an already-bound recipient.
+  if (invite.claimedAt) return 'claimed'
+  return new Date(invite.expiresAt).getTime() <= now ? 'expired' : 'unclaimed'
+}
diff --git a/apps/web/app/utils/localPayloadStore.ts b/apps/web/app/utils/localPayloadStore.ts
index 86188a7..707ed85 100644
--- a/apps/web/app/utils/localPayloadStore.ts
+++ b/apps/web/app/utils/localPayloadStore.ts
@@ -1,6 +1,10 @@
-import { createIpfsPayloadUri, parsePayloadUri, verifyPayloadIntegrity } from '#xcs/core/index.js'
-
-import { canonicalJson, parseJson } from './serialization'
+import {
+  canonicalJson,
+  createIpfsPayloadUri,
+  parseJson,
+  parsePayloadUri,
+  verifyPayloadIntegrity,
+} from '#xcs/core/index.js'
 
 export const LOCAL_PAYLOAD_STORE_MAX_BYTES = 64 * 1024
 export const LOCAL_PAYLOAD_STORE_MAX_ENTRIES = 20
diff --git a/apps/web/app/utils/operationJournal.ts b/apps/web/app/utils/operationJournal.ts
index e442f1a..7e19020 100644
--- a/apps/web/app/utils/operationJournal.ts
+++ b/apps/web/app/utils/operationJournal.ts
@@ -59,6 +59,10 @@ export type OperationBusinessContext =
       readonly credentialUri?: string | undefined
       readonly payloadDigestHex?: string | undefined
       readonly expiration?: string | undefined
+      /** Links consented hosted-payload bytes to this exact signed operation. */
+      readonly publicationJobId?: string | undefined
+      /** Portal invitation UUID; never its bearer token. Adds cross-tab exclusion across wallets. */
+      readonly issuerInviteId?: string | undefined
     }
   | {
       readonly action:
@@ -82,6 +86,7 @@ export interface StoredOperation extends OperationSeed {
   readonly message?: string | undefined
   readonly businessConfirmation?: BusinessConfirmation | undefined
   readonly businessEvidence?: BusinessEvidence | undefined
+  readonly publicationCompleted?: boolean | undefined
 }
 
 export interface SignedOperationRecord {
@@ -119,6 +124,7 @@ const CREDENTIAL_ACTIONS = new Set([
   'credential-revoke',
 ])
 const TRANSACTION_HASH = /^[0-9a-f]{64}$/i
+const PUBLICATION_JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 const REASON_CODE = /^[A-Z0-9_]{1,128}$/
 const BUSINESS_DELETION_CAUSES = new Set<BusinessDeletionCause>([
   'issuer_revoked',
@@ -214,6 +220,20 @@ export function validateOperationBusinessContext(input: unknown): OperationBusin
       }
     }
     const expiration = optionalExpiration(candidate.expiration)
+    const publicationJobId = candidate.publicationJobId
+    const issuerInviteId = candidate.issuerInviteId
+    if (
+      issuerInviteId !== undefined &&
+      (typeof issuerInviteId !== 'string' || !PUBLICATION_JOB_ID.test(issuerInviteId))
+    ) {
+      throw new Error('OPERATION_ISSUER_INVITE_ID_INVALID')
+    }
+    if (
+      publicationJobId !== undefined &&
+      (typeof publicationJobId !== 'string' || !PUBLICATION_JOB_ID.test(publicationJobId))
+    ) {
+      throw new Error('OPERATION_PUBLICATION_JOB_ID_INVALID')
+    }
     return {
       action,
       issuer: candidate.issuer,
@@ -222,6 +242,12 @@ export function validateOperationBusinessContext(input: unknown): OperationBusin
       ...(typeof credentialUri === 'string' ? { credentialUri } : {}),
       ...(payloadDigestHex ? { payloadDigestHex } : {}),
       ...(expiration ? { expiration } : {}),
+      ...(typeof publicationJobId === 'string'
+        ? { publicationJobId: publicationJobId.toLowerCase() }
+        : {}),
+      ...(typeof issuerInviteId === 'string'
+        ? { issuerInviteId: issuerInviteId.toLowerCase() }
+        : {}),
     }
   }
   return {
@@ -521,12 +547,16 @@ export function applyJournalEntry(
 ): StoredOperation {
   if (['validated', 'expired', 'failed'].includes(operation.stage)) return operation
   const terminal = ['validated', 'expired', 'failed'].includes(entry.stage)
+  const publicationPending =
+    operation.business?.action === 'credential-issue' &&
+    operation.business.publicationJobId !== undefined &&
+    operation.publicationCompleted !== true
   return {
     ...operation,
     updatedAt: entry.at,
     stage: entry.stage,
     txHash: entry.txHash ?? operation.txHash,
-    txBlob: terminal ? undefined : operation.txBlob,
+    txBlob: terminal && !publicationPending ? undefined : operation.txBlob,
     lastLedgerSequence: entry.lastLedgerSequence ?? operation.lastLedgerSequence,
     engineResult: entry.engineResult ?? operation.engineResult,
     ledgerIndex: entry.ledgerIndex ?? operation.ledgerIndex,
@@ -534,6 +564,27 @@ export function applyJournalEntry(
   }
 }
 
+/** Publication verification and ledger reconciliation can finish in either order. */
+export function completeOperationPublication(
+  operation: StoredOperation,
+  jobId: string,
+): StoredOperation {
+  if (!PUBLICATION_JOB_ID.test(jobId)) throw new Error('OPERATION_PUBLICATION_JOB_ID_INVALID')
+  if (
+    operation.business?.action !== 'credential-issue' ||
+    operation.business.publicationJobId !== jobId.toLowerCase()
+  )
+    return operation
+  return {
+    ...operation,
+    publicationCompleted: true,
+    // Keep nonterminal recovery until the SDK reconciles its final ledger state.
+    txBlob: ['validated', 'expired', 'failed'].includes(operation.stage)
+      ? undefined
+      : operation.txBlob,
+  }
+}
+
 export function canRetryOperation(operation: StoredOperation): boolean {
   const hasRecoveryMaterial =
     typeof operation.txBlob === 'string' &&
@@ -614,6 +665,35 @@ function holdsBusinessLock(operation: StoredOperation): boolean {
   return confirmation === 'pending' || confirmation === 'timeout'
 }
 
+/** Preserve public tuple locks, with an additional invitation lock for the managed issuer flow. */
+export function operationConflictsWith(
+  existing: StoredOperation,
+  candidate: OperationSeed,
+): boolean {
+  if (existing.profileId !== candidate.profileId) return false
+  const previous = sanitizeOperationBusinessContext(existing.business)
+  const next = sanitizeOperationBusinessContext(candidate.business)
+  const key = operationBusinessKey(candidate.profileId, next)
+  if (
+    key &&
+    holdsBusinessLock(existing) &&
+    operationBusinessKey(existing.profileId, previous) === key
+  )
+    return true
+  if (
+    previous?.action !== 'credential-issue' ||
+    next?.action !== 'credential-issue' ||
+    !previous.issuerInviteId ||
+    previous.issuerInviteId !== next.issuerInviteId
+  )
+    return false
+  // A confirmed issue consumes this invitation even before portal metadata has been saved.
+  return (
+    holdsBusinessLock(existing) ||
+    (existing.stage === 'validated' && existing.engineResult === 'tesSUCCESS')
+  )
+}
+
 export class IndexedDbOperationJournal implements OperationJournal {
   readonly #factory: IDBFactory
   #databasePromise: Promise<IDBDatabase> | undefined
@@ -641,17 +721,7 @@ export class IndexedDbOperationJournal implements OperationJournal {
           if (existing.some((operation) => operation.operationId === seed.operationId)) {
             throw new Error('OPERATION_ID_ALREADY_EXISTS')
           }
-          const businessKey = operationBusinessKey(seed.profileId, business)
-          if (
-            businessKey &&
-            existing.some((operation) => {
-              const existingBusiness = sanitizeOperationBusinessContext(operation.business)
-              return (
-                holdsBusinessLock(operation) &&
-                operationBusinessKey(operation.profileId, existingBusiness) === businessKey
-              )
-            })
-          ) {
+          if (existing.some((operation) => operationConflictsWith(operation, normalizedSeed))) {
             throw new Error('OPERATION_BUSINESS_LOCKED')
           }
           store.put({
@@ -686,18 +756,11 @@ export class IndexedDbOperationJournal implements OperationJournal {
           )
           if (!existing) throw new Error('OPERATION_NOT_FOUND')
           if (existing.stage !== 'prepared') throw new Error('OPERATION_LOCK_OWNERSHIP_LOST')
-          const business = sanitizeOperationBusinessContext(existing.business)
-          const businessKey = operationBusinessKey(existing.profileId, business)
           if (
-            businessKey &&
             operations.some(
               (operation) =>
                 operation.operationId !== existing.operationId &&
-                holdsBusinessLock(operation) &&
-                operationBusinessKey(
-                  operation.profileId,
-                  sanitizeOperationBusinessContext(operation.business),
-                ) === businessKey,
+                operationConflictsWith(operation, existing),
             )
           ) {
             throw new Error('OPERATION_LOCK_OWNERSHIP_LOST')
@@ -809,6 +872,23 @@ export class IndexedDbOperationJournal implements OperationJournal {
     })
   }
 
+  /** Call only after both the hosted receipt and public payload bytes are verified. */
+  public async completePublication(jobId: string): Promise<void> {
+    if (!PUBLICATION_JOB_ID.test(jobId)) throw new Error('OPERATION_PUBLICATION_JOB_ID_INVALID')
+    const operations = await this.list()
+    for (const operation of operations) {
+      if (
+        operation.business?.action !== 'credential-issue' ||
+        operation.business.publicationJobId !== jobId.toLowerCase()
+      )
+        continue
+      await this.#mutate(operation.operationId, (existing) => {
+        if (!existing) throw new Error('OPERATION_NOT_FOUND')
+        return completeOperationPublication(existing, jobId)
+      })
+    }
+  }
+
   public async list(): Promise<StoredOperation[]> {
     const database = await this.#open()
     return new Promise((resolve, reject) => {
@@ -828,20 +908,11 @@ export class IndexedDbOperationJournal implements OperationJournal {
     const operations = await this.list()
     const existing = operations.find((operation) => operation.operationId === operationId)
     if (!existing || !holdsBusinessLock(existing)) throw new Error('OPERATION_LOCK_OWNERSHIP_LOST')
-    const businessKey = operationBusinessKey(
-      existing.profileId,
-      sanitizeOperationBusinessContext(existing.business),
-    )
     if (
-      businessKey &&
       operations.some(
         (operation) =>
           operation.operationId !== existing.operationId &&
-          holdsBusinessLock(operation) &&
-          operationBusinessKey(
-            operation.profileId,
-            sanitizeOperationBusinessContext(operation.business),
-          ) === businessKey,
+          operationConflictsWith(operation, existing),
       )
     ) {
       throw new Error('OPERATION_LOCK_OWNERSHIP_LOST')
diff --git a/apps/web/app/utils/payloadPublication.ts b/apps/web/app/utils/payloadPublication.ts
index 2b41951..f379749 100644
--- a/apps/web/app/utils/payloadPublication.ts
+++ b/apps/web/app/utils/payloadPublication.ts
@@ -1,6 +1,10 @@
-import { parsePayloadUri, verifyPayloadIntegrity } from '#xcs/core/index.js'
-
-import { canonicalJson, decodeUtf8, parseJson } from './serialization'
+import {
+  canonicalJson,
+  decodeUtf8,
+  parseJson,
+  parsePayloadUri,
+  verifyPayloadIntegrity,
+} from '#xcs/core/index.js'
 
 export const MAX_PILOT_PAYLOAD_BYTES = 1024 * 1024
 export const DEFAULT_PAYLOAD_FETCH_TIMEOUT_MS = 10_000
@@ -68,7 +72,17 @@ export function assertPilotPublicPayloadHostname(hostname: string): void {
 export function inspectPilotHttpsPayloadHost(credentialUri: string): string {
   const parsedUri = parsePayloadUri(credentialUri)
   if (parsedUri.kind !== 'https') throw new Error('PILOT_HTTPS_PAYLOAD_REQUIRED')
-  const hostname = new URL(parsedUri.fetchUrl).hostname
+  const url = new URL(parsedUri.fetchUrl)
+  const hostname = url.hostname
+  // A local HTTPS deployment can read its own immutable payload endpoint.
+  // Never extend this to another origin, arbitrary local URLs, or redirects.
+  if (
+    typeof window !== 'undefined' &&
+    url.origin === window.location.origin &&
+    url.search === '' &&
+    /^(?:\/p\/(?:[0-9a-f]{18}|[0-9a-f]{20})|\/q\/[0-9a-f]{18})$/u.test(url.pathname)
+  )
+    return hostname
   assertPilotPublicPayloadHostname(hostname)
   return hostname
 }
@@ -172,6 +186,12 @@ export async function readCanonicalHttpsPayload(
     if (!isJsonContentType(response.headers.get('content-type'))) {
       throw new Error('PAYLOAD_CONTENT_TYPE_INVALID')
     }
+    // A deliberately filtered view cannot establish the full payload's digest.
+    // Keep it unavailable to this public reader; never escalate to credentialed access.
+    if (response.headers.get('x-xcs-claim-scope') === 'public') {
+      await response.body?.cancel().catch(() => undefined)
+      throw new Error('PAYLOAD_SCOPE_RESTRICTED')
+    }
 
     let bytes: Uint8Array
     try {
diff --git a/apps/web/app/utils/portalPresenters.ts b/apps/web/app/utils/portalPresenters.ts
new file mode 100644
index 0000000..307b057
--- /dev/null
+++ b/apps/web/app/utils/portalPresenters.ts
@@ -0,0 +1,87 @@
+import type {
+  IssuerInvitationCard,
+  IssuerWorkspaceView,
+  PortalAccount,
+  PortalNextAction,
+  RecipientCredentialCard,
+} from '~/types/portal'
+
+export interface InvitationProgress {
+  email: 'complete' | 'attention'
+  claimed: 'complete' | 'current' | 'pending'
+  wallet: 'complete' | 'current' | 'pending'
+  issuance: 'complete' | 'current' | 'pending'
+}
+
+export function issuerNextAction(
+  workspace: IssuerWorkspaceView,
+  account: Pick<PortalAccount, 'wallets'> | null,
+): PortalNextAction {
+  const organization = workspace.organizations.find(
+    (item) => item.id === workspace.selectedOrganizationId,
+  )
+  if (!organization) return { kind: 'apply', to: '/issuer/apply' }
+  if (organization.status !== 'active' || organization.applicationStatus !== 'approved') {
+    return { kind: 'awaitApproval' }
+  }
+  if (!account?.wallets.some((wallet) => wallet.networkId === 1)) {
+    return { kind: 'linkWallet', to: '/account', returnTo: '/issuer' }
+  }
+  if (workspace.schemas.length === 0) {
+    return {
+      kind: 'createTemplate',
+      to: '/issuer/schemas/new',
+      organizationId: organization.id,
+    }
+  }
+  if (workspace.invites.length === 0) {
+    return { kind: 'invite', to: '/issuer/recipients', organizationId: organization.id }
+  }
+  const ready = workspace.invites.find(
+    (invite) => !invite.revokedAt && invite.recipientStatus === 'ready',
+  )
+  if (ready) return { kind: 'issue', to: `/issuer/issue/${ready.id}`, inviteId: ready.id }
+  if (
+    workspace.invites.some(
+      (invite) =>
+        !invite.revokedAt &&
+        (invite.recipientStatus === 'invited' || invite.recipientStatus === 'wallet_required'),
+    )
+  ) {
+    return { kind: 'awaitRecipient' }
+  }
+  return { kind: 'done' }
+}
+
+export function invitationProgress(invite: IssuerInvitationCard): InvitationProgress {
+  const email = invite.deliveryStatus === 'sent' ? 'complete' : 'attention'
+  const claimed = invite.claimedAt ? 'complete' : 'current'
+  const wallet = invite.recipientWalletVerifiedAt
+    ? 'complete'
+    : invite.claimedAt
+      ? 'current'
+      : 'pending'
+  const issuance =
+    invite.recipientStatus === 'issued'
+      ? 'complete'
+      : invite.recipientStatus === 'ready'
+        ? 'current'
+        : 'pending'
+  return { email, claimed, wallet, issuance }
+}
+
+export function recipientNextAction(credential: RecipientCredentialCard): PortalNextAction {
+  if (credential.status.state === 'pending') {
+    return {
+      kind: 'review',
+      to: `/recipient/credentials/${credential.generationId}?profile=${encodeURIComponent(credential.profileId)}`,
+    }
+  }
+  if (credential.status.state === 'active') {
+    return {
+      kind: 'share',
+      to: `/recipient/credentials/${credential.generationId}/present?profile=${encodeURIComponent(credential.profileId)}`,
+    }
+  }
+  return { kind: 'done' }
+}
diff --git a/apps/web/app/utils/portalProblem.ts b/apps/web/app/utils/portalProblem.ts
new file mode 100644
index 0000000..ae91431
--- /dev/null
+++ b/apps/web/app/utils/portalProblem.ts
@@ -0,0 +1,43 @@
+export type PortalProblemAction = 'retry' | 'signIn' | 'linkWallet' | 'goBack' | 'none'
+
+export interface PortalProblem {
+  code: string
+  recoverable: boolean
+  action: PortalProblemAction
+  stateUnchanged: boolean
+}
+
+function errorCode(error: unknown): string {
+  if (typeof error === 'object' && error !== null) {
+    const data = (error as { data?: unknown }).data
+    if (
+      typeof data === 'object' &&
+      data !== null &&
+      typeof (data as { error?: unknown }).error === 'string'
+    ) {
+      return (data as { error: string }).error
+    }
+    if (typeof (error as { message?: unknown }).message === 'string') {
+      return (error as { message: string }).message
+    }
+  }
+  return 'PORTAL_UNAVAILABLE'
+}
+
+/** Convert transport/internal failures to a bounded UI state without exposing raw codes. */
+export function portalProblem(error: unknown): PortalProblem {
+  const code = errorCode(error)
+  if (code === 'AUTH_REQUIRED') {
+    return { code, recoverable: true, action: 'signIn', stateUnchanged: true }
+  }
+  if (code.includes('WALLET_REQUIRED') || code.includes('WALLET_LINK')) {
+    return { code, recoverable: true, action: 'linkWallet', stateUnchanged: true }
+  }
+  if (code.includes('UNAVAILABLE') || code.includes('RATE_LIMITED') || code.includes('TIMEOUT')) {
+    return { code, recoverable: true, action: 'retry', stateUnchanged: true }
+  }
+  if (code.includes('INVALID') || code.includes('EXPIRED') || code.includes('REVOKED')) {
+    return { code, recoverable: false, action: 'goBack', stateUnchanged: true }
+  }
+  return { code, recoverable: true, action: 'retry', stateUnchanged: false }
+}
diff --git a/apps/web/app/utils/portalRoutes.ts b/apps/web/app/utils/portalRoutes.ts
new file mode 100644
index 0000000..5ed68c3
--- /dev/null
+++ b/apps/web/app/utils/portalRoutes.ts
@@ -0,0 +1,102 @@
+const AUTH_DESTINATIONS = new Set([
+  '/account',
+  '/admin',
+  '/admin/audit',
+  '/admin/verifiers',
+  '/issuer',
+  '/issuer/apply',
+  '/issuer/application',
+  '/issuer/credentials',
+  '/issuer/recipients',
+  '/issuer/schemas',
+  '/issuer/schemas/new',
+  '/issuer/settings',
+  '/recipient',
+  '/recipient/invitations',
+  '/presentations',
+  '/verifier',
+  '/verifier/apply',
+])
+
+const UUID = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+const PROFILE_ID = /^[a-z0-9][a-z0-9._-]{0,127}$/u
+const CREDENTIAL_DESTINATION_PATTERNS = [
+  /^\/issuer\/credentials\/[0-9a-f]{64}$/u,
+  /^\/recipient\/credentials\/[0-9a-f]{64}(?:\/present)?$/u,
+]
+const AUTH_DESTINATION_PATTERNS = [
+  new RegExp(`^/admin/applications/${UUID}/(?:issuer|verifier)$`, 'u'),
+  new RegExp(`^/issuer/issue/${UUID}$`, 'u'),
+  ...CREDENTIAL_DESTINATION_PATTERNS,
+]
+
+const WALLET_DESTINATIONS = [
+  new RegExp(`^/issuer(?:/(?:schemas/new|recipients|issue/${UUID}))?$`, 'u'),
+  /^\/recipient(?:\/credentials\/[0-9a-f]{64})?$/u,
+]
+
+function localizedPath(path: string, locale: string): string {
+  return locale === 'fr' ? `/fr${path}` : path
+}
+
+function unlocalizedPath(value: string): string {
+  return value.startsWith('/fr/') ? value.slice(3) : value
+}
+
+/** A fixed in-app auth destination, never a bearer, fragment or nested redirect. */
+export function authReturnPath(value: unknown): string {
+  if (typeof value !== 'string' || value.includes('#')) return '/account'
+  let target: URL
+  try {
+    target = new URL(value, 'https://xcs.invalid')
+  } catch {
+    return '/account'
+  }
+  if (target.origin !== 'https://xcs.invalid' || !value.startsWith('/')) return '/account'
+  const path = unlocalizedPath(target.pathname)
+  if (target.search) {
+    const entries = [...target.searchParams.entries()]
+    const profile = target.searchParams.get('profile')
+    return CREDENTIAL_DESTINATION_PATTERNS.some((pattern) => pattern.test(path)) &&
+      entries.length === 1 &&
+      entries[0]?.[0] === 'profile' &&
+      profile !== null &&
+      PROFILE_ID.test(profile)
+      ? value
+      : '/account'
+  }
+  return AUTH_DESTINATIONS.has(path) ||
+    AUTH_DESTINATION_PATTERNS.some((pattern) => pattern.test(path))
+    ? value
+    : '/account'
+}
+
+/** Wallet onboarding may return only to the exact role screen that initiated it. */
+export function walletReturnPath(value: unknown, locale: string, fallback = '/recipient'): string {
+  if (typeof value !== 'string' || value.includes('?') || value.includes('#')) {
+    return localizedPath(fallback, locale)
+  }
+  const path = unlocalizedPath(value)
+  return WALLET_DESTINATIONS.some((pattern) => pattern.test(path))
+    ? value
+    : localizedPath(fallback, locale)
+}
+
+export const LEGACY_PORTAL_REDIRECTS = {
+  '/studio': '/',
+  '/schemas/register': '/issuer/schemas/new',
+  '/issue': '/issuer/recipients',
+  '/accept': '/recipient',
+  '/revoke': '/issuer/credentials',
+  '/verify': '/presentations',
+  '/operations': '/account',
+} as const
+
+export function legacyPortalDestination(
+  path: keyof typeof LEGACY_PORTAL_REDIRECTS,
+  locale: string,
+) {
+  // A non-empty sentinel replaces any incoming fragment across the HTTP
+  // redirect. app.vue removes it before the redirected page is used.
+  return `${localizedPath(LEGACY_PORTAL_REDIRECTS[path], locale)}#xcs-legacy-redirect`
+}
diff --git a/apps/web/app/utils/presentationView.ts b/apps/web/app/utils/presentationView.ts
new file mode 100644
index 0000000..bf22e10
--- /dev/null
+++ b/apps/web/app/utils/presentationView.ts
@@ -0,0 +1,71 @@
+import type { VerificationDimensions } from './credentialReview'
+
+export type PresentationHeadline =
+  | 'unusable'
+  | 'unavailable'
+  | 'pending'
+  | 'notFound'
+  | 'expired'
+  | 'deleted'
+  | 'schemaInvalid'
+  | 'tampered'
+  | 'contentInvalid'
+  | 'untrusted'
+  | 'schemaUnknown'
+  | 'contentUnavailable'
+  | 'partial'
+  | 'unknownIssuer'
+  | 'passed'
+
+/** Known failures take priority over incomplete checks; approval is never issuer trust. */
+export function presentationHeadline(
+  report: VerificationDimensions | null,
+  options: { usable: boolean; fresh: boolean },
+): PresentationHeadline {
+  if (!options.usable) return 'unusable'
+  if (!options.fresh || !report) return 'unavailable'
+  if (report.onChain === 'not_found') return 'notFound'
+  if (report.onChain !== 'active') return report.onChain
+  if (report.schema === 'invalid') return 'schemaInvalid'
+  if (report.payload === 'tampered') return 'tampered'
+  if (report.payload === 'invalid') return 'contentInvalid'
+  if (report.issuerTrust === 'untrusted') return 'untrusted'
+  if (report.schema === 'unknown') return 'schemaUnknown'
+  if (report.payload === 'unavailable') return 'contentUnavailable'
+  if (report.payload === 'not_checked') return 'partial'
+  if (report.issuerTrust === 'unknown') return 'unknownIssuer'
+  return 'passed'
+}
+
+export function recipientCredentialPath(profileId: string, generationId: string): string {
+  return `/api/recipient/credentials/${encodeURIComponent(profileId)}/${encodeURIComponent(generationId)}`
+}
+
+/** Accept a complete link from this portal, never fetch a pasted foreign URL. */
+export function presentationTokenFromLink(origin: string, input: string): string {
+  const link = new URL(input.trim())
+  if (
+    link.origin !== new URL(origin).origin ||
+    link.username ||
+    link.password ||
+    link.search ||
+    !/^\/(?:fr\/)?presentations$/.test(link.pathname) ||
+    !/^#[A-Za-z0-9_-]{43}$/.test(link.hash)
+  )
+    throw new Error('PRESENTATION_LINK_INVALID')
+  return link.hash.slice(1)
+}
+
+/** The bearer is only part of a browser fragment; it is never a route or query parameter. */
+export function presentationLink(origin: string, pagePath: string, token: string): string {
+  if (!/^[A-Za-z0-9_-]{43}$/.test(token)) throw new Error('PRESENTATION_TOKEN_INVALID')
+  const location = new URL(pagePath, origin)
+  if (
+    location.origin !== new URL(origin).origin ||
+    !/^\/(?:fr\/)?presentations$/.test(location.pathname)
+  )
+    throw new Error('PRESENTATION_LOCATION_INVALID')
+  location.search = ''
+  location.hash = token
+  return location.href
+}
diff --git a/apps/web/app/utils/privateLinkHistory.ts b/apps/web/app/utils/privateLinkHistory.ts
new file mode 100644
index 0000000..66836f6
--- /dev/null
+++ b/apps/web/app/utils/privateLinkHistory.ts
@@ -0,0 +1,24 @@
+/** Preserve router indices and unrelated state while removing bearer route fragments. */
+export function privateLinkHistoryState(state: unknown): unknown {
+  if (state === null || typeof state !== 'object' || Array.isArray(state)) return state
+  const sanitized = { ...(state as Record<string, unknown>) }
+  for (const key of ['current', 'back', 'forward']) {
+    const value = sanitized[key]
+    if (typeof value !== 'string') continue
+    const hash = value.indexOf('#')
+    if (hash === -1) continue
+    const destination = value.slice(0, hash)
+    const pathname = destination.split('?')[0] ?? ''
+    if (/^\/(?:fr\/)?(?:presentations|recipient\/invitations)\/?$/.test(pathname))
+      sanitized[key] = destination
+  }
+  return sanitized
+}
+
+export function purgePrivateLinkFragment(): void {
+  window.history.replaceState(
+    privateLinkHistoryState(window.history.state),
+    '',
+    window.location.pathname + window.location.search,
+  )
+}
diff --git a/apps/web/app/utils/recipientPayload.ts b/apps/web/app/utils/recipientPayload.ts
new file mode 100644
index 0000000..78c3b12
--- /dev/null
+++ b/apps/web/app/utils/recipientPayload.ts
@@ -0,0 +1,27 @@
+import { parsePayloadUri } from '#xcs/core/index.js'
+import { readCanonicalHttpsPayload, type ReadPayloadOptions } from './payloadPublication'
+
+/** Explicit private review can send the session only to this site's managed /q object. */
+export function readRecipientPayload(options: ReadPayloadOptions, siteOrigin: string) {
+  const uri = parsePayloadUri(options.credentialUri)
+  if (uri.kind !== 'https') throw new Error('RECIPIENT_PRIVATE_PAYLOAD_ORIGIN')
+  const url = new URL(uri.fetchUrl)
+  const origin = new URL(siteOrigin)
+  if (
+    origin.protocol !== 'https:' ||
+    url.origin !== origin.origin ||
+    url.username ||
+    url.password ||
+    url.search ||
+    !/^\/q\/[0-9a-f]{18}$/.test(url.pathname)
+  )
+    throw new Error('RECIPIENT_PRIVATE_PAYLOAD_ORIGIN')
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch
+  return readCanonicalHttpsPayload({
+    ...options,
+    fetchImpl: async (input, init) => {
+      if (String(input) !== uri.fetchUrl) throw new Error('RECIPIENT_PRIVATE_PAYLOAD_ORIGIN')
+      return fetchImpl(input, { ...init, credentials: 'same-origin', mode: 'same-origin' })
+    },
+  })
+}
diff --git a/apps/web/app/utils/roleJourney.ts b/apps/web/app/utils/roleJourney.ts
new file mode 100644
index 0000000..15011fb
--- /dev/null
+++ b/apps/web/app/utils/roleJourney.ts
@@ -0,0 +1,11 @@
+import { walletReturnPath } from './portalRoutes'
+
+/** Backward-compatible name for the recipient wallet onboarding return. */
+export function walletLinkReturnPath(value: unknown, locale: string): string {
+  return walletReturnPath(value, locale)
+}
+
+/** Keep the guided picker aligned with the existing supported ownership proof schemes. */
+export function supportsWalletLinkProof(walletId: string): boolean {
+  return ['gemwallet', 'metamask-snap', 'otsu'].includes(walletId)
+}
diff --git a/apps/web/app/utils/walletAdapters.ts b/apps/web/app/utils/walletAdapters.ts
index c7a2ad4..6eee26d 100644
--- a/apps/web/app/utils/walletAdapters.ts
+++ b/apps/web/app/utils/walletAdapters.ts
@@ -8,277 +8,29 @@ import {
   XamanAdapter,
   XyraAdapter,
   adapterSupports,
-  type AccountInfo,
-  type ConnectOptions,
-  type SignedTransaction,
-  type Transaction,
   type WalletAdapter,
-  type XamanAdapterOptions,
-  type XamanConnectOptions,
 } from 'xrpl-connect'
 
-const XAMAN_OAUTH_ORIGIN = 'https://oauth2.xumm.app'
-const XAMAN_OAUTH_PATHS = new Set(['/auth', '/authorize', '/oauth/auth', '/oauth/authorize'])
-const XAMAN_SESSION_STORAGE_KEY = 'XummPkceJwt'
-const XRPL_TESTNET_NETWORK_ID = 1
-
-interface XamanSessionStorage {
-  getItem(key: string): string | null
-  removeItem(key: string): void
-}
-
 export interface XrplConnectAdapterConfig {
   readonly xamanApiKey?: string | undefined
-  readonly xamanRedirectUrl?: string | undefined
   readonly walletConnectProjectId?: string | undefined
 }
 
-interface XcsXamanAdapterOptions extends XamanAdapterOptions {
-  readonly redirectUrl?: string | undefined
-}
-
 function configuredValue(value: string | undefined): string | undefined {
   const normalized = value?.trim()
   return normalized ? normalized : undefined
 }
 
-function canonicalNetworkId(value: unknown): number | undefined {
-  if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0) return value
-  if (typeof value !== 'string' || !/^(0|[1-9]\d*)$/.test(value)) return undefined
-  const parsed = Number(value)
-  return Number.isSafeInteger(parsed) ? parsed : undefined
-}
-
-function cachedXamanNetworkId(value: string): number | undefined {
-  try {
-    const session = JSON.parse(value) as {
-      readonly me?: { readonly networkId?: unknown } | undefined
-      readonly jwt?: unknown
-    }
-    const userInfoNetworkId = canonicalNetworkId(session.me?.networkId)
-    if (userInfoNetworkId !== undefined) return userInfoNetworkId
-    if (typeof session.jwt !== 'string') return undefined
-
-    const payload = session.jwt.split('.')[1]
-    if (!payload) return undefined
-    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')
-    const claims = JSON.parse(atob(padded)) as { readonly network_id?: unknown }
-    return canonicalNetworkId(claims.network_id)
-  } catch {
-    return undefined
-  }
-}
-
-export function clearMismatchedXamanSession(
-  storage: XamanSessionStorage,
-  expectedNetworkId: number,
-): void {
-  try {
-    const stored = storage.getItem(XAMAN_SESSION_STORAGE_KEY)
-    if (stored && cachedXamanNetworkId(stored) !== expectedNetworkId) {
-      storage.removeItem(XAMAN_SESSION_STORAGE_KEY)
-    }
-  } catch {
-    // Xaman handles unavailable browser storage itself; forcing the OAuth URL
-    // still protects the new session when storage access is denied.
-  }
-}
-
-export function forceXamanOAuthNetwork(value: string | URL | undefined): string | URL | undefined {
-  return configureXamanOAuthRequest(value)
-}
-
-export function configureXamanOAuthRequest(
-  value: string | URL | undefined,
-  redirectUrl?: string,
-): string | URL | undefined {
-  if (value === undefined) return undefined
-  try {
-    const url = new URL(value)
-    if (
-      url.origin !== XAMAN_OAUTH_ORIGIN ||
-      url.username ||
-      url.password ||
-      !XAMAN_OAUTH_PATHS.has(url.pathname)
-    ) {
-      return value
-    }
-    url.searchParams.set('force_network', 'TESTNET')
-    if (redirectUrl) url.searchParams.set('redirect_uri', redirectUrl)
-    return url.href
-  } catch {
-    return value
-  }
-}
-
-function isLoopbackHostname(hostname: string): boolean {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
 /**
- * Xaman requires the exact OAuth redirect URL to be registered for the public
- * application key. Use one callback per application origin instead of binding
- * authentication to whichever XCS route happened to open the wallet menu.
- */
-export function resolveXamanRedirectUrl(
-  configuredRedirectUrl: string | undefined,
-  applicationLocation: string,
-): string {
-  let applicationUrl: URL
-  try {
-    applicationUrl = new URL(applicationLocation)
-  } catch {
-    throw new Error('Xaman requires a valid browser application URL')
-  }
-
-  if (
-    !['http:', 'https:'].includes(applicationUrl.protocol) ||
-    applicationUrl.username ||
-    applicationUrl.password
-  ) {
-    throw new Error('Xaman requires an HTTP(S) browser application URL without credentials')
-  }
-  if (applicationUrl.protocol !== 'https:' && !isLoopbackHostname(applicationUrl.hostname)) {
-    throw new Error('Xaman requires HTTPS outside local loopback development')
-  }
-
-  const configured = configuredValue(configuredRedirectUrl)
-  let redirectUrl: URL
-  try {
-    redirectUrl = configured ? new URL(configured) : new URL('/', applicationUrl.origin)
-  } catch {
-    throw new Error('NUXT_PUBLIC_XAMAN_REDIRECT_URL must be an absolute HTTP(S) URL')
-  }
-
-  if (
-    !['http:', 'https:'].includes(redirectUrl.protocol) ||
-    redirectUrl.username ||
-    redirectUrl.password
-  ) {
-    throw new Error('NUXT_PUBLIC_XAMAN_REDIRECT_URL must be an HTTP(S) URL without credentials')
-  }
-  if (redirectUrl.origin !== applicationUrl.origin) {
-    throw new Error('NUXT_PUBLIC_XAMAN_REDIRECT_URL must use the current application origin')
-  }
-  if (redirectUrl.protocol !== 'https:' && !isLoopbackHostname(redirectUrl.hostname)) {
-    throw new Error(
-      'NUXT_PUBLIC_XAMAN_REDIRECT_URL must use HTTPS outside local loopback development',
-    )
-  }
-  if (redirectUrl.pathname !== '/' || redirectUrl.search || redirectUrl.hash) {
-    throw new Error(
-      'NUXT_PUBLIC_XAMAN_REDIRECT_URL must be the application origin with a trailing slash',
-    )
-  }
-
-  return redirectUrl.href
-}
-
-/**
- * Xaman opens its sign request in a browser-owned popup or tab. Once the SDK
- * has received the result, close that auxiliary window and return focus to the
- * application that is continuing the submission flow.
- */
-export async function withXamanSignWindow<T>(
-  browserWindow: Window,
-  action: () => Promise<T>,
-): Promise<T> {
-  const originalOpen = browserWindow.open
-  const signWindow: { current: Window | null } = { current: null }
-  const interceptedOpen: typeof window.open = (url, target, features) => {
-    const opened = originalOpen.call(browserWindow, url, target, features)
-    if (opened) signWindow.current = opened
-    return opened
-  }
-  browserWindow.open = interceptedOpen
-  try {
-    return await action()
-  } finally {
-    if (browserWindow.open === interceptedOpen) browserWindow.open = originalOpen
-    try {
-      if (signWindow.current && !signWindow.current.closed) signWindow.current.close()
-    } catch {
-      // Cross-origin popup policies may deny inspection or close; focus still
-      // returns to the opener when the browser permits it.
-    }
-    try {
-      browserWindow.focus()
-    } catch {
-      // Focus is a UX enhancement and must never mask the signing result.
-    }
-  }
-}
-
-function requestsXrplTestnet(network: ConnectOptions<XamanConnectOptions>['network']): boolean {
-  if (network === 'testnet') return true
-  if (!network || typeof network !== 'object') return false
-  const normalizedId = network.id.toLowerCase().replace(/[\s_-]/g, '')
-  return normalizedId === 'testnet' || normalizedId === 'xrpltestnet'
-}
-
-class XcsXamanAdapter extends XamanAdapter {
-  readonly #redirectUrl: string | undefined
-
-  public constructor(options: XcsXamanAdapterOptions = {}) {
-    const { redirectUrl, ...xamanOptions } = options
-    super(xamanOptions)
-    this.#redirectUrl = redirectUrl
-  }
-
-  public override async connect(
-    options?: ConnectOptions<XamanConnectOptions>,
-  ): Promise<AccountInfo> {
-    if (!requestsXrplTestnet(options?.network) || typeof window === 'undefined') {
-      return super.connect(options)
-    }
-
-    clearMismatchedXamanSession(window.localStorage, XRPL_TESTNET_NETWORK_ID)
-    const redirectUrl = resolveXamanRedirectUrl(this.#redirectUrl, window.location.href)
-    const originalOpen = window.open
-    const interceptedOpen: typeof window.open = (url, target, features) =>
-      originalOpen.call(window, configureXamanOAuthRequest(url, redirectUrl), target, features)
-    window.open = interceptedOpen
-    try {
-      return await super.connect(options)
-    } finally {
-      if (window.open === interceptedOpen) window.open = originalOpen
-    }
-  }
-
-  public override async sign(transaction: Transaction): Promise<SignedTransaction> {
-    if (typeof window === 'undefined') return super.sign(transaction)
-    return withXamanSignWindow(window, () => super.sign(transaction))
-  }
-}
-
-/**
- * The published 1.0.0 RC reports Otsu as available in every browser. Keep the
- * adapter surface intact while applying the same provider marker check already
- * used by its connect path (fixed upstream after the RC).
- */
-class XcsOtsuAdapter extends OtsuAdapter {
-  public override async isAvailable(): Promise<boolean> {
-    const runtime = globalThis as typeof globalThis & {
-      xrpl?: { readonly isOtsu?: boolean }
-    }
-    return runtime.xrpl?.isOtsu === true
-  }
-}
-
-/**
- * Register every xrpl-connect adapter that can be initialized with the
- * deployment's public configuration. Xaman and WalletConnect need public app
- * identifiers; the other adapters are self-contained and detect availability
- * in the browser.
+ * Build the adapters documented by XRPL Connect. Credentials needed for modal
+ * discovery are supplied on the adapter constructors. The pinned Crossmark
+ * network-response fix is applied by pnpm; no SDK is mocked at runtime.
  */
 export function createXrplConnectAdapters(config: XrplConnectAdapterConfig = {}): WalletAdapter[] {
   const xamanApiKey = configuredValue(config.xamanApiKey)
   const walletConnectProjectId = configuredValue(config.walletConnectProjectId)
   const adapters: WalletAdapter[] = [
-    ...(xamanApiKey
-      ? [new XcsXamanAdapter({ apiKey: xamanApiKey, redirectUrl: config.xamanRedirectUrl })]
-      : []),
+    ...(xamanApiKey ? [new XamanAdapter({ apiKey: xamanApiKey })] : []),
     new CrossmarkAdapter(),
     new GemWalletAdapter(),
     ...(walletConnectProjectId
@@ -293,11 +45,10 @@ export function createXrplConnectAdapters(config: XrplConnectAdapterConfig = {})
       : []),
     new LedgerAdapter(),
     new XyraAdapter(),
-    new XcsOtsuAdapter(),
+    new OtsuAdapter(),
     new MetaMaskSnapAdapter(),
   ]
 
-  // XCS never falls back to signAndSubmit: the application must validate and
-  // persist the signed transaction before it owns the only submission effect.
+  // XCS validates and journals the signed blob before submitting it itself.
   return adapters.filter((adapter) => adapterSupports(adapter, 'sign'))
 }
diff --git a/apps/web/app/utils/walletCompatibility.ts b/apps/web/app/utils/walletCompatibility.ts
index 14669e0..f6eb776 100644
--- a/apps/web/app/utils/walletCompatibility.ts
+++ b/apps/web/app/utils/walletCompatibility.ts
@@ -1,3 +1,5 @@
+import { isWalletError, WalletErrorCode, type WalletAdapter } from 'xrpl-connect'
+
 export const XCS_CREDENTIAL_TRANSACTION_TYPES = [
   'CredentialCreate',
   'CredentialAccept',
@@ -5,7 +7,7 @@ export const XCS_CREDENTIAL_TRANSACTION_TYPES = [
 ] as const
 
 export type XcsCredentialTransactionType = (typeof XCS_CREDENTIAL_TRANSACTION_TYPES)[number]
-export type WalletCredentialSupport = 'supported' | 'unsupported' | 'unverified'
+export type WalletCredentialSupport = 'supported' | 'raw' | 'unverified'
 
 export interface WalletIdentity {
   readonly id: string
@@ -18,7 +20,10 @@ export interface WalletCredentialTransactionErrorDetails {
   readonly transactionType: XcsCredentialTransactionType
 }
 
+type WalletErrorTranslator = (key: string, parameters?: Record<string, string>) => string
+
 const ERROR_PREFIX = 'WALLET_CREDENTIAL_TRANSACTION_UNSUPPORTED'
+export const OTSU_SIGNING_ACCOUNT_UNAVAILABLE = 'OTSU_SIGNING_ACCOUNT_UNAVAILABLE'
 const SAFE_WALLET_ID_PATTERN = /^[a-z0-9-]{1,64}$/u
 const CREDENTIAL_TRANSACTION_TYPE_SET = new Set<string>(XCS_CREDENTIAL_TRANSACTION_TYPES)
 const WALLET_NAMES: Readonly<Record<string, string>> = {
@@ -75,7 +80,7 @@ export function isXcsCredentialTransactionType(
  */
 export function walletCredentialSupport(walletId: string): WalletCredentialSupport {
   const normalized = safeWalletId(walletId)
-  if (normalized === 'gemwallet') return 'unsupported'
+  if (normalized === 'gemwallet') return 'raw'
   if (normalized === 'xaman') return 'supported'
   return 'unverified'
 }
@@ -94,26 +99,32 @@ export function walletCredentialTransactionError(
   return cause === undefined ? new Error(code) : new Error(code, { cause })
 }
 
-export function assertWalletSupportsXcsTransaction(
-  wallet: WalletIdentity | null | undefined,
-  transactionType: unknown,
-): void {
-  if (!wallet || !isXcsCredentialTransactionType(transactionType)) return
-  if (walletCredentialSupport(wallet.id) === 'unsupported') {
-    throw walletCredentialTransactionError(wallet, transactionType)
-  }
-}
-
 /**
  * Some adapters wrap the wallet's original validation error. Map only the
  * exact pre-XLS-70 codec error for the transaction being signed so unrelated
  * wallet failures and user rejections retain their original diagnostics.
  */
-export function normalizeWalletTransactionError(
+export async function normalizeWalletTransactionError(
   error: unknown,
-  wallet: WalletIdentity | null | undefined,
+  wallet: WalletAdapter | null | undefined,
   transactionType: unknown,
-): Error {
+): Promise<Error> {
+  // xrpl-connect rc.2 maps every Otsu error containing "not found" to
+  // WALLET_NOT_INSTALLED. Otsu also uses "Account not found" when its
+  // persisted public account is no longer present in the unlocked keyring.
+  // Prove that the provider is still installed before correcting that false
+  // diagnostic; a genuinely missing extension keeps the upstream error.
+  if (
+    wallet?.id === 'otsu' &&
+    isWalletError(error) &&
+    error.code === WalletErrorCode.WALLET_NOT_INSTALLED
+  ) {
+    const installed = await wallet.isAvailable().catch(() => false)
+    if (installed) {
+      return new Error(OTSU_SIGNING_ACCOUNT_UNAVAILABLE, { cause: error })
+    }
+  }
+
   if (wallet && isXcsCredentialTransactionType(transactionType)) {
     const unsupportedMessage = `Invalid field TransactionType: ${transactionType}`
     if (errorMessages(error).some((message) => message.trim() === unsupportedMessage)) {
@@ -142,3 +153,19 @@ export function parseWalletCredentialTransactionError(
     transactionType,
   }
 }
+
+/** Return a user-facing message only for wallet errors XCS can identify exactly. */
+export function walletTransactionErrorMessage(
+  value: string,
+  translate: WalletErrorTranslator,
+): string | null {
+  if (value === OTSU_SIGNING_ACCOUNT_UNAVAILABLE) {
+    return translate('wallet.errors.otsuSigningAccountUnavailable')
+  }
+  const unsupported = parseWalletCredentialTransactionError(value)
+  if (!unsupported) return null
+  return translate('wallet.errors.credentialUnsupported', {
+    wallet: unsupported.walletName,
+    transactionType: unsupported.transactionType,
+  })
+}
diff --git a/apps/web/app/utils/walletConnection.ts b/apps/web/app/utils/walletConnection.ts
new file mode 100644
index 0000000..69c3425
--- /dev/null
+++ b/apps/web/app/utils/walletConnection.ts
@@ -0,0 +1,130 @@
+import type { AccountInfo, WalletAdapter, WalletManager } from 'xrpl-connect'
+
+type ConnectionManager = Pick<WalletManager, 'connected' | 'connectingWallet' | 'wallets'>
+
+/**
+ * Otsu persists a dApp permission by origin and otherwise resolves connect()
+ * from that cached address without showing a fresh approval. XCS deliberately
+ * requires an explicit wallet approval for each new application connection,
+ * so revoke that stale provider permission before handing control back to the
+ * official XRPL Connect manager.
+ */
+export async function prepareExplicitWalletConnection(
+  manager: ConnectionManager,
+  walletId: string,
+): Promise<void> {
+  if (manager.connected || manager.connectingWallet) {
+    throw new Error('WALLET_CONNECTION_ALREADY_ACTIVE')
+  }
+  if (walletId !== 'otsu') return
+
+  const adapter: WalletAdapter | undefined = manager.wallets.find(
+    (candidate) => candidate.id === walletId,
+  )
+  if (!adapter) throw new Error('WALLET_ADAPTER_NOT_REGISTERED')
+  await adapter.disconnect()
+}
+
+export const WALLET_CONNECTION_CANCELLED = 'WALLET_CONNECTION_CANCELLED'
+export const WALLET_CONNECTION_TIMEOUT = 'WALLET_CONNECTION_TIMEOUT'
+
+interface WalletConnection {
+  readonly manager: ConnectionManager
+  connect(walletId: string, options: { network: 'testnet' }): Promise<AccountInfo>
+  disconnect(): Promise<void>
+}
+
+export const WALLET_REFRESH_TIMEOUT = 'WALLET_REFRESH_TIMEOUT'
+
+/** Invalidate timed-out reads before a late extension reply can update the session. */
+export async function refreshWalletAccount(
+  wallet: {
+    readonly manager: Pick<WalletManager, 'fetchAccount' | 'on' | 'off'>
+    disconnect(): Promise<void>
+  },
+  timeoutMs = 10_000,
+): Promise<AccountInfo | null> {
+  let stopped: Error | undefined
+  let rejectRead!: (error: Error) => void
+  const interrupted = new Promise<never>((_, reject) => {
+    rejectRead = reject
+  })
+  const stop = (message: string) => {
+    if (stopped) return
+    stopped = new Error(message)
+    rejectRead(stopped)
+  }
+  const sessionChanged = () => stop('WALLET_CHANGED_AFTER_PREVIEW')
+  wallet.manager.on('connect', sessionChanged)
+  wallet.manager.on('disconnecting', sessionChanged)
+  wallet.manager.on('disconnect', sessionChanged)
+  const timer = setTimeout(() => {
+    if (stopped) return
+    stop(WALLET_REFRESH_TIMEOUT)
+    // The manager invalidates its session generation immediately; extension
+    // teardown must not hold the failed read open.
+    void wallet.disconnect().catch(() => {
+      console.warn('Wallet teardown failed after an account refresh timeout.')
+    })
+  }, timeoutMs)
+  try {
+    return await Promise.race([wallet.manager.fetchAccount(), interrupted])
+  } catch (cause) {
+    throw stopped ?? cause
+  } finally {
+    clearTimeout(timer)
+    wallet.manager.off('connect', sessionChanged)
+    wallet.manager.off('disconnecting', sessionChanged)
+    wallet.manager.off('disconnect', sessionChanged)
+  }
+}
+
+/** Bound the SDK wait without letting a late wallet approval create a session. */
+export async function connectWallet(
+  wallet: WalletConnection,
+  walletId: string,
+  signal: AbortSignal,
+  timeoutMs = 90_000,
+  onDisconnectFailure: () => void = () => {
+    console.warn('Wallet cleanup failed. Close its pending request before reconnecting.')
+  },
+): Promise<AccountInfo> {
+  if (signal.aborted) throw new Error(WALLET_CONNECTION_CANCELLED)
+  let stopped: Error | undefined
+  let rejectAttempt: (error: Error) => void = () => undefined
+  const interrupted = new Promise<never>((_, reject) => {
+    rejectAttempt = reject
+  })
+  const stop = (code: string) => {
+    if (stopped) return
+    stopped = new Error(code)
+    // The public Vue disconnect API clears its pending state and invalidates
+    // the manager's connection generation before a delayed SDK response arrives.
+    // Teardown may wait for an extension window indefinitely. Start it to
+    // invalidate the attempt, but do not make cancellation depend on it.
+    void wallet.disconnect().catch(onDisconnectFailure)
+    rejectAttempt(stopped)
+  }
+  const cancel = () => stop(WALLET_CONNECTION_CANCELLED)
+  signal.addEventListener('abort', cancel, { once: true })
+  const timer = setTimeout(() => stop(WALLET_CONNECTION_TIMEOUT), timeoutMs)
+  try {
+    const account = await Promise.race([
+      (async () => {
+        await prepareExplicitWalletConnection(wallet.manager, walletId)
+        if (stopped) throw stopped
+        return wallet.connect(walletId, { network: 'testnet' })
+      })(),
+      interrupted,
+    ])
+    if (stopped) throw stopped
+    return account
+  } catch (cause) {
+    // Disconnect can also reject the SDK request. Keep the actual user action
+    // or timeout as the outcome instead of showing a spurious NOT_CONNECTED.
+    throw stopped ?? cause
+  } finally {
+    clearTimeout(timer)
+    signal.removeEventListener('abort', cancel)
+  }
+}
diff --git a/apps/web/app/utils/walletDiscovery.ts b/apps/web/app/utils/walletDiscovery.ts
new file mode 100644
index 0000000..b9c4042
--- /dev/null
+++ b/apps/web/app/utils/walletDiscovery.ts
@@ -0,0 +1,44 @@
+import type { WalletAdapter, WalletManager } from 'xrpl-connect'
+
+/** Subscribe before taking the snapshot: Crossmark detects injected providers asynchronously. */
+export function observeWalletAvailability(options: {
+  manager: Pick<WalletManager, 'getAvailableWallets'>
+  events: {
+    on(event: string, listener: () => void): unknown
+    off(event: string, listener: () => void): unknown
+  }
+  onChange: (wallets: WalletAdapter[]) => void
+  onError: (error: unknown) => void
+}): () => void {
+  let disposed = false
+  let reading = false
+  let rerun = false
+  const refresh = async () => {
+    if (disposed) return
+    if (reading) {
+      rerun = true
+      return
+    }
+    reading = true
+    try {
+      do {
+        rerun = false
+        const wallets = await options.manager.getAvailableWallets()
+        if (disposed) return
+        // Detection during a read makes that snapshot potentially stale.
+        if (!rerun) options.onChange(wallets)
+      } while (rerun && !disposed)
+    } catch (cause) {
+      if (!disposed) options.onError(cause)
+    } finally {
+      reading = false
+    }
+  }
+  const detected = () => void refresh()
+  options.events.on('detected', detected)
+  void refresh()
+  return () => {
+    disposed = true
+    options.events.off('detected', detected)
+  }
+}
diff --git a/apps/web/app/utils/walletLinkProof.ts b/apps/web/app/utils/walletLinkProof.ts
new file mode 100644
index 0000000..1af8215
--- /dev/null
+++ b/apps/web/app/utils/walletLinkProof.ts
@@ -0,0 +1,99 @@
+import { deriveAddress } from 'xrpl'
+import type { AccountInfo, WalletEvent, WalletManager } from 'xrpl-connect'
+
+export type WalletProofManager = Pick<
+  WalletManager,
+  'connected' | 'account' | 'wallet' | 'supports' | 'fetchAccount' | 'signMessage' | 'on' | 'off'
+>
+
+export interface WalletLinkProof {
+  signature: string
+  publicKey: string
+  scheme: 'ripple' | 'otsu'
+}
+
+/**
+ * Link only a master-key address. Regular keys and multisign accounts need a separate
+ * authorization protocol. Xaman/Crossmark/WalletConnect/Ledger lack message proofs;
+ * Xyra's signature encoding is unverified, so connection alone never enables linking.
+ */
+export async function signWalletLinkChallenge(
+  manager: WalletProofManager,
+  expectedAccount: { address: string; networkId?: string },
+  message: string,
+): Promise<WalletLinkProof> {
+  const adapter = manager.wallet
+  if (
+    !adapter ||
+    !['gemwallet', 'metamask-snap', 'otsu'].includes(adapter.id) ||
+    !manager.supports('signMessage')
+  ) {
+    throw new Error('WALLET_LINK_UNSUPPORTED')
+  }
+  if (!message || new TextEncoder().encode(message).length > 8192) {
+    throw new Error('WALLET_LINK_CHALLENGE_INVALID')
+  }
+  const networkId = expectedAccount.networkId ?? manager.account?.network.id
+  let changed = false
+  const assertAccount = (account: AccountInfo | null) => {
+    if (
+      changed ||
+      !manager.connected ||
+      manager.wallet !== adapter ||
+      !account ||
+      account.address !== expectedAccount.address ||
+      account.network.id !== networkId
+    ) {
+      throw new Error('WALLET_LINK_SESSION_CHANGED')
+    }
+  }
+  assertAccount(manager.account)
+  const invalidate = () => {
+    changed = true
+  }
+  const events: WalletEvent[] = [
+    'connect',
+    'disconnecting',
+    'disconnect',
+    'accountChanged',
+    'networkChanged',
+  ]
+  for (const event of events) manager.on(event, invalidate)
+  try {
+    assertAccount(await manager.fetchAccount())
+    assertAccount(manager.account)
+    // The Snap passes its argument straight to ripple-keypairs, which expects hex.
+    const signingMessage =
+      adapter.id === 'metamask-snap'
+        ? Array.from(new TextEncoder().encode(message), (byte) =>
+            byte.toString(16).padStart(2, '0'),
+          ).join('')
+        : message
+    const signed = await manager.signMessage(signingMessage)
+    assertAccount(manager.account)
+    assertAccount(await manager.fetchAccount())
+    assertAccount(manager.account)
+    if (
+      signed.message !== signingMessage ||
+      signed.signerAddress !== expectedAccount.address ||
+      !/^(?:02|03|ED)[0-9a-f]{64}$/iu.test(signed.publicKey) ||
+      !/^(?:[0-9a-f]{2}){64,72}$/iu.test(signed.signature) ||
+      deriveAddress(signed.publicKey.toUpperCase()) !== expectedAccount.address
+    ) {
+      throw new Error('WALLET_LINK_PROOF_INVALID')
+    }
+    if (
+      adapter.id === 'otsu' &&
+      (!/^(?:02|03)/u.test(signed.publicKey) || signed.signature.length !== 128)
+    ) {
+      throw new Error('WALLET_LINK_PROOF_INVALID')
+    }
+    return {
+      signature: signed.signature,
+      publicKey: signed.publicKey,
+      scheme: adapter.id === 'otsu' ? 'otsu' : 'ripple',
+    }
+  } finally {
+    for (const event of events) manager.off(event, invalidate)
+  }
+}
diff --git a/apps/web/app/utils/walletOperationCleanup.ts b/apps/web/app/utils/walletOperationCleanup.ts
new file mode 100644
index 0000000..4c370ed
--- /dev/null
+++ b/apps/web/app/utils/walletOperationCleanup.ts
@@ -0,0 +1,30 @@
+interface DisconnectableClient {
+  isConnected(): boolean
+  disconnect(): Promise<void>
+}
+
+export async function closeWalletRpc(client?: DisconnectableClient): Promise<void> {
+  try {
+    if (client?.isConnected()) await client.disconnect()
+  } catch {
+    console.warn('Could not close the wallet operation RPC connection.')
+  }
+}
+
+/** Cleanup must not replace a transaction result or leave the UI locked. */
+export async function finishWalletOperation(
+  busy: { value: boolean },
+  refreshOperations: () => Promise<unknown>,
+  client?: DisconnectableClient,
+): Promise<void> {
+  try {
+    try {
+      await refreshOperations()
+    } catch {
+      console.warn('Could not refresh the wallet operation history.')
+    }
+    await closeWalletRpc(client)
+  } finally {
+    busy.value = false
+  }
+}
diff --git a/apps/web/app/utils/walletSubmission.ts b/apps/web/app/utils/walletSubmission.ts
index 2029aef..98b90df 100644
--- a/apps/web/app/utils/walletSubmission.ts
+++ b/apps/web/app/utils/walletSubmission.ts
@@ -17,6 +17,20 @@ export interface StoredRecoveryMaterial {
   readonly networkId: number
 }
 
+/**
+ * Xaman may autofill LastLedgerSequence while signing. Do not ask it to retain
+ * an application-filled value that its signing service is documented to own;
+ * XCS still validates the returned blob and permits only that field to change.
+ */
+export function transactionForWalletSigning(
+  transaction: Transaction,
+  walletId: string | undefined,
+): Transaction {
+  if (walletId !== 'xaman' || transaction.LastLedgerSequence === undefined) return transaction
+  const { LastLedgerSequence: _lastLedgerSequence, ...request } = transaction
+  return request as Transaction
+}
+
 /**
  * Treat persisted browser recovery state as untrusted input before it can
  * influence terminal reconciliation or create a new XRPL side effect.
diff --git a/apps/web/e2e/admin.spec.ts b/apps/web/e2e/admin.spec.ts
new file mode 100644
index 0000000..edc41c5
--- /dev/null
+++ b/apps/web/e2e/admin.spec.ts
@@ -0,0 +1,358 @@
+import { expect, test, type Page } from '@playwright/test'
+
+const application = {
+  organization_id: '00000000-0000-4000-8000-000000000030',
+  role: 'verifier',
+  status: 'pending',
+  revision: 0,
+  name: 'Synthetic review organization',
+  submitted_at: '2026-09-20T08:00:00Z',
+  reviewed_at: null,
+  review_reason: null,
+  responsible_name: 'Synthetic applicant',
+  responsible_email: 'review@example.test',
+  description: 'Local browser test fixture',
+  jurisdiction: 'FR',
+  purpose: 'Review credentials',
+}
+const audit = {
+  id: 'decision-1',
+  organization_id: application.organization_id,
+  role: 'verifier',
+  organization_name: application.name,
+  actor_name: 'Synthetic administrator',
+  actor_id: '00000000-0000-4000-8000-000000000031',
+  action: 'approve',
+  before_status: 'pending',
+  after_status: 'approved',
+  reason: null,
+  created_at: '2026-09-23T08:00:00Z',
+  notification_id: 'mail-1',
+  notification_status: 'failed',
+}
+
+async function mockAdmin(page: Page) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        csrfToken: 'synthetic-csrf',
+        user: {
+          id: 'admin-1',
+          displayName: 'Synthetic administrator',
+          email: 'admin@example.test',
+          roles: ['admin'],
+          organizations: [],
+          wallets: [],
+        },
+      },
+    }),
+  )
+  await page.route('**/api/auth/access?**', (route) => route.fulfill({ json: { allowed: true } }))
+  await page.route('**/api/admin/**', (route) => {
+    const url = new URL(route.request().url())
+    if (url.pathname.endsWith('/audit'))
+      return route.fulfill({ json: { items: [audit], total: 1, page: 1, pageSize: 20 } })
+    if (url.pathname.endsWith('/retry')) return route.fulfill({ json: { status: 'pending' } })
+    if (url.pathname.endsWith('/link'))
+      return route.fulfill({ status: 404, json: { error: 'ADMIN_DOCUMENT_MISSING' } })
+    if (url.pathname.endsWith('/decisions'))
+      return route.fulfill({ json: { decision: audit, replayed: false } })
+    if (url.pathname.endsWith('/verifier'))
+      return route.fulfill({
+        json: {
+          application,
+          wallets: [
+            {
+              address: 'rSyntheticResponsibleWallet',
+              network_id: 1,
+              verified_at: '2026-09-20T08:00:00Z',
+            },
+          ],
+          documents: [{ id: 'document-1', mime_type: 'application/pdf', byte_length: 300 }],
+          history: [],
+        },
+      })
+    return route.fulfill({
+      json: {
+        items: [
+          {
+            ...application,
+            ...(url.pathname.endsWith('/verifiers') ? { status: 'approved' } : {}),
+          },
+        ],
+        total: 1,
+        page: 1,
+        pageSize: 20,
+        counts: { issuer: 0, verifier: 1 },
+      },
+    })
+  })
+}
+
+// Start on a public page so mocked browser API responses drive client middleware.
+// Direct SSR access is tested separately below against the real server boundary.
+async function enter(page: Page, path = '/admin') {
+  await page.goto(path.startsWith('/fr/') ? '/fr' : '/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, path)
+}
+
+test('reviews, requires refusal reason, submits CSRF, navigates verifiers and retries only notification', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  const decisions: unknown[] = []
+  await page.route('**/decisions', (route) => {
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-csrf')
+    decisions.push(route.request().postDataJSON())
+    return route.fulfill({ json: { decision: audit, replayed: false } })
+  })
+  await enter(page)
+  await expect(page.getByRole('heading', { name: 'Applications', exact: true })).toBeVisible()
+  await page.getByRole('link', { name: `Review ${application.name}` }).click()
+  await expect(
+    page.getByText('These wallets belong to the responsible person.', { exact: false }),
+  ).toBeVisible()
+  await page.getByRole('button', { name: 'Prepare secure link' }).click()
+  await expect(page.getByText('The document could not be opened.', { exact: false })).toBeVisible()
+  await page.getByRole('button', { name: 'Decline access', exact: true }).click()
+  await page.getByTestId('admin-confirm-decision').click()
+  await expect(page.getByText('Enter a reason before confirming.')).toBeVisible()
+  expect(decisions).toHaveLength(0)
+  await page.getByRole('textbox', { name: 'Reason (required)' }).fill('Insufficient evidence')
+  await page.getByTestId('admin-confirm-decision').click()
+  await expect(page.getByText('Decision recorded.', { exact: false })).toBeVisible()
+  expect(decisions).toHaveLength(1)
+  await page
+    .getByRole('navigation', { name: 'Administrator navigation' })
+    .getByRole('link', { name: 'Verifier access' })
+    .click()
+  await expect(page.getByRole('heading', { name: 'Verifier access', exact: true })).toBeVisible()
+  await page
+    .getByRole('navigation', { name: 'Administrator navigation' })
+    .getByRole('link', { name: 'Audit history' })
+    .click()
+  await page.getByRole('button', { name: 'Retry notification' }).click()
+  await expect(page.getByText('Notification queued for delivery.', { exact: false })).toBeVisible()
+  expect(decisions).toHaveLength(1)
+})
+
+test('preserves an ambiguous decision body and displays a concurrent decision', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  const requests: unknown[] = []
+  await page.route('**/decisions', (route) => {
+    requests.push(route.request().postDataJSON())
+    if (requests.length === 1) return route.abort('connectionfailed')
+    return route.fulfill({
+      status: 409,
+      json: {
+        error: 'ADMIN_CONFLICT',
+        current: {
+          status: 'rejected',
+          revision: 1,
+          review_reason: 'Already reviewed by another administrator',
+          reviewed_at: '2026-09-23T08:00:00Z',
+        },
+      },
+    })
+  })
+  await enter(page, `/admin/applications/${application.organization_id}/verifier`)
+  await page.getByRole('button', { name: 'Approve access', exact: true }).click()
+  await page.getByTestId('admin-confirm-decision').click()
+  await page.getByRole('button', { name: 'Retry the same decision' }).click()
+  expect(requests).toHaveLength(2)
+  expect(requests[1]).toEqual(requests[0])
+  await expect(page.getByText('Already reviewed by another administrator')).toBeVisible()
+  await expect(page.getByRole('button', { name: 'Approve access', exact: true })).toHaveCount(0)
+  await expect(
+    page.getByRole('button', { name: 'Reload and review the current decision' }),
+  ).toBeVisible()
+})
+
+test('French queue, empty state, unavailable state and uncertain SMTP delivery', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  await page.route('**/api/admin/applications?**', (route) =>
+    route.fulfill({
+      json: { items: [], total: 0, page: 1, pageSize: 20, counts: { issuer: 0, verifier: 0 } },
+    }),
+  )
+  await enter(page, '/fr/admin')
+  await expect(page.getByRole('heading', { name: 'Candidatures', exact: true })).toBeVisible()
+  await expect(page.getByText('Aucune demande à examiner.')).toBeVisible()
+  await page.route('**/api/admin/verifiers?**', (route) =>
+    route.fulfill({ status: 503, json: { error: 'ADMIN_UNAVAILABLE' } }),
+  )
+  await page
+    .getByRole('navigation', { name: 'Navigation administrateur' })
+    .getByRole('link', { name: 'Accès des vérificateurs' })
+    .click()
+  await expect(
+    page.getByText('Le service d’administration est temporairement indisponible.', {
+      exact: false,
+    }),
+  ).toBeVisible()
+  await page.route('**/api/admin/audit?**', (route) =>
+    route.fulfill({
+      json: {
+        items: [{ ...audit, notification_status: 'uncertain' }],
+        total: 1,
+        page: 1,
+        pageSize: 20,
+      },
+    }),
+  )
+  await page
+    .getByRole('navigation', { name: 'Navigation administrateur' })
+    .getByRole('link', { name: 'Historique des décisions' })
+    .click()
+  await expect(
+    page.getByText('L’envoi a pu aboutir avant une interruption.', { exact: false }),
+  ).toBeVisible()
+  await expect(page.getByRole('button', { name: 'Réessayer la notification' })).toHaveCount(0)
+})
+
+test('protects direct anonymous navigation and rejects a revoked administrator role', async ({
+  page,
+}) => {
+  const protectedPath = `/admin/applications/${application.organization_id}/verifier`
+  await page.goto(protectedPath)
+  await expect(page).toHaveURL(
+    (url) => url.pathname === '/auth/login' && url.searchParams.get('returnTo') === protectedPath,
+  )
+  await mockAdmin(page)
+  await page.route('**/api/auth/access?**', (route) =>
+    route.fulfill({ status: 403, json: { error: 'AUTH_FORBIDDEN' } }),
+  )
+  await enter(page)
+  await expect(page).toHaveURL(/\/auth\/not-authorized$/)
+  await expect(page.getByText(application.name)).toHaveCount(0)
+})
+
+test('suspends and restores verifier access with an explicit reason and confirmation', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  let currentStatus = 'approved'
+  let revision = 1
+  const decisions: { action: string; revision: number; reason: string }[] = []
+  await page.route(`**/api/admin/applications/${application.organization_id}/verifier`, (route) =>
+    route.fulfill({
+      json: {
+        application: { ...application, status: currentStatus, revision },
+        wallets: [],
+        documents: [],
+        history: [],
+      },
+    }),
+  )
+  await page.route('**/decisions', (route) => {
+    const request = route.request().postDataJSON()
+    decisions.push(request)
+    currentStatus = request.action === 'suspend' ? 'suspended' : 'approved'
+    revision++
+    return route.fulfill({
+      json: { decision: { ...audit, after_status: currentStatus }, replayed: false },
+    })
+  })
+  await enter(page, '/admin/verifiers')
+  await page.getByRole('link', { name: `Review ${application.name}` }).click()
+  await page.getByRole('button', { name: 'Suspend access', exact: true }).click()
+  await page.getByTestId('admin-confirm-decision').click()
+  await expect(page.getByText('Enter a reason before confirming.')).toBeVisible()
+  await page.getByRole('textbox', { name: 'Reason (required)' }).fill('Evidence expired')
+  await page.getByTestId('admin-confirm-decision').click()
+  await expect(page).toHaveURL(/\/admin\/verifiers\?/)
+  expect(decisions[0]).toMatchObject({ action: 'suspend', reason: 'Evidence expired', revision: 1 })
+  await page.getByRole('link', { name: `Review ${application.name}` }).click()
+  await page.getByRole('button', { name: 'Restore access', exact: true }).click()
+  await page.getByTestId('admin-confirm-decision').click()
+  await expect(page).toHaveURL(/\/admin\/verifiers\?/)
+  expect(decisions[1]).toMatchObject({ action: 'restore', revision: 2 })
+})
+
+test('filters and paginates applications, then handles session expiry without showing records', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  await page.route('**/api/admin/applications?**', (route) => {
+    const params = new URL(route.request().url()).searchParams
+    if (params.get('page') === '2')
+      return route.fulfill({ status: 401, json: { error: 'AUTH_REQUIRED' } })
+    return route.fulfill({
+      json: {
+        items: [application],
+        total: 21,
+        page: 1,
+        pageSize: 20,
+        counts: { issuer: 0, verifier: 21 },
+      },
+    })
+  })
+  await enter(page)
+  await page.getByRole('button', { name: 'Verifier (21)', exact: true }).click()
+  await expect(page).toHaveURL(/role=verifier/)
+  await page.getByRole('button', { name: 'Next', exact: true }).click()
+  await expect(page.getByText('Your session has expired.', { exact: false })).toBeVisible()
+  await expect(page.getByTestId('admin-applications')).toHaveCount(0)
+})
+
+test('shows document access revocation and removes the previously loaded profile', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  await page.route('**/api/admin/documents/*/link', (route) =>
+    route.fulfill({ status: 403, json: { error: 'AUTH_FORBIDDEN' } }),
+  )
+  await enter(page, `/admin/applications/${application.organization_id}/verifier`)
+  await page.getByRole('button', { name: 'Prepare secure link' }).click()
+  await expect(page.getByText('Access denied.', { exact: false })).toBeVisible()
+  await expect(page.getByRole('heading', { name: application.name })).toHaveCount(0)
+})
+
+test('keeps previous-page navigation after the final application is decided and identifies an unnamed actor', async ({
+  page,
+}) => {
+  await mockAdmin(page)
+  await page.route('**/api/admin/applications?**', (route) =>
+    route.fulfill({
+      json: {
+        items: [],
+        total: 20,
+        page: 2,
+        pageSize: 20,
+        counts: { issuer: 0, verifier: 20 },
+      },
+    }),
+  )
+  await enter(page, '/admin?page=2&decided=1')
+  await expect(page.getByText('No applications to review.')).toBeVisible()
+  await page.getByRole('button', { name: 'Previous', exact: true }).click()
+  await expect(page).toHaveURL(/page=1/)
+  await page.route('**/api/admin/audit?**', (route) =>
+    route.fulfill({
+      json: {
+        items: [{ ...audit, actor_name: null }],
+        total: 1,
+        page: 1,
+        pageSize: 20,
+      },
+    }),
+  )
+  await page
+    .getByRole('navigation', { name: 'Administrator navigation' })
+    .getByRole('link', { name: 'Audit history' })
+    .click()
+  await expect(page.getByText(audit.actor_id, { exact: false })).toBeVisible()
+})
diff --git a/apps/web/e2e/auth.spec.ts b/apps/web/e2e/auth.spec.ts
new file mode 100644
index 0000000..170373a
--- /dev/null
+++ b/apps/web/e2e/auth.spec.ts
@@ -0,0 +1,73 @@
+import { expect, test, type Route } from '@playwright/test'
+
+test('signs in through OIDC, persists a session, opens issuer onboarding, links and unlinks a wallet, then signs out', async ({
+  page,
+  context,
+}) => {
+  await page.addInitScript(() => {
+    ;(
+      globalThis as typeof globalThis & { __xcsBrowserE2eAuthWallet?: boolean }
+    ).__xcsBrowserE2eAuthWallet = true
+  })
+  await page.goto('/auth/login')
+  await page.getByTestId('auth-signin').click()
+  await expect(page).toHaveURL(/\/account$/)
+  await expect(page.getByRole('heading', { name: 'My XCS account', exact: true })).toBeVisible()
+  await expect(page.getByText('Test recipient', { exact: true })).toBeVisible()
+  const sessionCookie = (await context.cookies()).find((c) => c.name === '__Host-xcs-session')!
+  expect(sessionCookie).toMatchObject({ httpOnly: true, secure: true, sameSite: 'Lax' })
+  expect(await page.evaluate(() => localStorage.getItem('access_token'))).toBeNull()
+  await page.reload()
+  await expect(page.getByText('Test recipient', { exact: true })).toBeVisible()
+  await page.goto('/issuer')
+  await expect(page).toHaveURL(/\/issuer$/)
+  await expect(page.getByRole('heading', { name: 'Issuer portal', exact: true })).toBeVisible()
+  await page.goto('/account')
+  await page.getByTestId('wallet-toggle').click()
+  await page.locator('[data-wallet-id="gemwallet"]').click()
+  await expect(page.getByTestId('auth-link-wallet')).toBeEnabled()
+  await page.getByTestId('auth-link-wallet').click()
+  await expect(page.getByTestId('linked-wallets').locator('tbody tr')).toHaveCount(1)
+  await expect(page.getByTestId('wallet-link-continue')).toHaveAttribute('href', '/recipient')
+  await expect(page).toHaveURL(/\/account$/)
+  // Hold hydration deterministically: SSR mutation buttons must remain disabled
+  // until their click listeners are attached, even when the account is visible.
+  let releaseScripts!: () => void
+  const scriptsReady = new Promise<void>((resolve) => {
+    releaseScripts = resolve
+  })
+  const holdScripts = async (route: Route) => {
+    if (route.request().resourceType() === 'script') await scriptsReady
+    await route.continue()
+  }
+  await page.route('**/*', holdScripts)
+  try {
+    await page.reload({ waitUntil: 'commit' })
+    await expect(page.getByTestId('linked-wallets').locator('tbody tr')).toHaveCount(1)
+    await expect(
+      page.getByTestId('linked-wallets').getByRole('button', { includeHidden: true }),
+    ).toBeDisabled()
+    await expect(page.getByTestId('auth-logout')).toBeDisabled()
+  } finally {
+    releaseScripts()
+    await page.unrouteAll({ behavior: 'wait' })
+  }
+  await page.locator('summary').filter({ hasText: 'Manage my wallet' }).click()
+  await page.getByTestId('linked-wallets').getByRole('button').click()
+  await expect(page.getByTestId('linked-wallets')).toHaveCount(0)
+  await expect(page.getByTestId('wallet-link-continue')).toHaveCount(0)
+  await page.getByTestId('auth-logout').click()
+  await expect(page).toHaveURL(/\/auth\/login$/)
+  await page.goto('/account')
+  await expect(page).toHaveURL(/\/auth\/login\?returnTo=\/account$/)
+  await page.goto('/schemas')
+  await expect(page).toHaveURL(/\/schemas$/)
+})
+
+test('offers French sign-in and account copy', async ({ page }) => {
+  await page.goto('/fr/auth/login')
+  await page.getByTestId('auth-signin').click()
+  await expect(page).toHaveURL(/\/fr\/account$/)
+  await expect(page.getByRole('heading', { name: 'Mon compte XCS', exact: true })).toBeVisible()
+  await expect(page.getByTestId('auth-logout')).toHaveText('Se déconnecter de XCS')
+})
diff --git a/apps/web/e2e/crossmark.production.spec.ts b/apps/web/e2e/crossmark.production.spec.ts
new file mode 100644
index 0000000..0d284c2
--- /dev/null
+++ b/apps/web/e2e/crossmark.production.spec.ts
@@ -0,0 +1,194 @@
+import { expect, test, type Page } from '@playwright/test'
+
+test.beforeEach(async ({ page }) => {
+  await page.addInitScript(() => {
+    const state = {
+      address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+      network: {
+        label: 'xrp ledger',
+        protocol: 'XRPL',
+        type: 'testnet',
+        wss: 'wss://s.altnet.rippletest.net:51233',
+      },
+      backgroundNetworkEmpty: false,
+      requests: [] as string[],
+      responses: [] as string[],
+    }
+    Object.assign(window, { xrpl: { isCrossmark: true }, __crossmarkTransport: state })
+    window.addEventListener('message', (event) => {
+      if (event.source !== window || event.origin !== location.origin) return
+      const request = event.data
+      if (request?.response?.type === 'response' && request?.request?.app === 'crossmark') {
+        state.responses.push(request.request.command)
+        return
+      }
+      if (request?.app !== 'crossmark' || request?.type !== 'request') return
+      state.requests.push(request.command)
+      let data: unknown
+      switch (request.command) {
+        case 'sign':
+          if (request.data?.tx?.TransactionType !== 'SignIn')
+            throw new Error('Unexpected transaction request')
+          data = { address: state.address, network: { ...state.network } }
+          break
+        case 'address':
+          data = { address: state.address }
+          break
+        case 'network':
+          data = { network: state.backgroundNetworkEmpty ? {} : state.network }
+          break
+        case 'user':
+          data = { user: { username: 'Fixture user' } }
+          break
+        default:
+          return
+      }
+      // Match Crossmark 0.2.19's content-script message sequence. Do not stub
+      // SDK methods: exercise its correlation, session and event handlers too.
+      const response = { app: 'crossmark', type: 'response', id: request.id, data }
+      window.postMessage(response, location.origin)
+      window.postMessage(
+        { request, response, createdAt: Date.now(), resolvedAt: Date.now() },
+        location.origin,
+      )
+    })
+  })
+  await page.goto('/learn')
+  await page.locator('[data-client-ready="true"]').waitFor()
+  // Let the real SDK finish its one-time detection query before approval.
+  await expect
+    .poll(() =>
+      page.evaluate(() =>
+        (
+          window as unknown as { __crossmarkTransport: { responses: string[] } }
+        ).__crossmarkTransport.responses.includes('address'),
+      ),
+    )
+    .toBe(true)
+})
+
+async function connectCrossmark(page: Page) {
+  await page.getByTestId('wallet-toggle').click()
+  await page.locator('button[data-wallet-id="crossmark"]').click()
+}
+
+async function expectConnected(page: Page) {
+  await connectCrossmark(page)
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
+  await expect(page.getByTestId('wallet-toggle')).toContainText('Crossmark')
+}
+
+test('retains approval across duplicate user/network initialization notifications', async ({
+  page,
+}) => {
+  await expectConnected(page)
+  await page.evaluate(() => {
+    window.postMessage(
+      { type: 'event', event: 'user-change', data: { user: { username: 'Fixture user' } } },
+      location.origin,
+    )
+    window.postMessage(
+      {
+        type: 'event',
+        event: 'network-change',
+        data: {
+          network: {
+            label: 'xrp ledger',
+            protocol: 'XRPL',
+            type: 'testnet',
+            wss: 'wss://s.altnet.rippletest.net:51233',
+          },
+        },
+      },
+      location.origin,
+    )
+  })
+  // The old handler disconnects instead of requesting authoritative account
+  // confirmation. Wait for the full transport roundtrip, not a guessed sleep.
+  await expect
+    .poll(() =>
+      page.evaluate(() => {
+        const state = (window as unknown as { __crossmarkTransport: { responses: string[] } })
+          .__crossmarkTransport
+        return state.responses.filter((command) => command === 'address').length
+      }),
+    )
+    .toBeGreaterThanOrEqual(3)
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
+  await expect(page.getByTestId('wallet-toggle')).toContainText('rHb9CJ')
+})
+
+test('clears approval when the actual selected account changes', async ({ page }) => {
+  await expectConnected(page)
+  await page.evaluate(() => {
+    const state = (window as unknown as { __crossmarkTransport: { address: string } })
+      .__crossmarkTransport
+    state.address = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
+    window.postMessage(
+      { type: 'event', event: 'user-change', data: { user: { username: 'Another fixture user' } } },
+      location.origin,
+    )
+  })
+  await expect(page.getByTestId('wallet-status')).toHaveCount(0)
+  await expect(page.getByTestId('wallet-toggle')).toHaveText('Connect wallet')
+})
+
+test('shows a failed network confirmation without scrolling and allows retry', async ({ page }) => {
+  await page.setViewportSize({ width: 1440, height: 800 })
+  await page.evaluate(() => {
+    const state = (window as unknown as { __crossmarkTransport: { network: { type: string } } })
+      .__crossmarkTransport
+    state.network.type = 'mainnet'
+  })
+  await connectCrossmark(page)
+  const error = page.locator('#wallet-menu [role="alert"]')
+  await expect(error).toContainText(/network|Testnet/i)
+  await expect(error).toBeInViewport({ ratio: 1 })
+  await expect(page.getByTestId('wallet-status')).toHaveCount(0)
+  await expect(page.getByTestId('wallet-toggle')).toBeEnabled()
+
+  await page.evaluate(() => {
+    const state = (window as unknown as { __crossmarkTransport: { network: { type: string } } })
+      .__crossmarkTransport
+    state.network.type = 'testnet'
+  })
+  await page.locator('button[data-wallet-id="crossmark"]').click()
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
+  await expect(page.getByTestId('wallet-toggle')).toContainText('Crossmark')
+})
+
+test('uses the approved network when Crossmark background state is not hydrated', async ({
+  page,
+}) => {
+  await page.evaluate(() => {
+    const state = (
+      window as unknown as { __crossmarkTransport: { backgroundNetworkEmpty: boolean } }
+    ).__crossmarkTransport
+    state.backgroundNetworkEmpty = true
+  })
+  await expectConnected(page)
+  await expect(page.getByTestId('wallet-status')).toContainText('Testnet')
+})
+
+test('prepares a schema against the real API and Testnet with an empty background network', async ({
+  page,
+}) => {
+  await page.evaluate(() => {
+    ;(
+      window as unknown as { __crossmarkTransport: { backgroundNetworkEmpty: boolean } }
+    ).__crossmarkTransport.backgroundNetworkEmpty = true
+  })
+  await expectConnected(page)
+  await page
+    .getByRole('navigation', { name: 'Main navigation' })
+    .getByRole('link', { name: 'Create', exact: true })
+    .click()
+  await page.locator('a[href="/schemas/register"]').click()
+  await page.getByRole('button', { name: 'Course completion template', exact: true }).click()
+  await page.getByRole('button', { name: 'Review the template', exact: true }).click()
+  await expect(page.getByTestId('transaction-sign')).toBeVisible({
+    timeout: 30000,
+  })
+  // Do not sign or submit using the test transport. The preview is read-only.
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
+})
diff --git a/apps/web/e2e/developers.spec.ts b/apps/web/e2e/developers.spec.ts
index 848d151..2d89915 100644
--- a/apps/web/e2e/developers.spec.ts
+++ b/apps/web/e2e/developers.spec.ts
@@ -4,8 +4,9 @@ import {
   computeSchemaUid,
   type JsonValue,
   type SchemaDefinition,
-} from '#xcs/core/index.js'
+} from '../app/lib/xcs/core/index.js'
 
+const API_PREFIX = ''
 const PROFILE_ID = 'xrpl-testnet-xcs-browser-e2e'
 const ISSUER = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
 const SUBJECT = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
@@ -76,14 +77,14 @@ test('runs the privacy-explicit exact-generation quickstart and shows four dimen
   page.on('request', (request) => {
     const url = new URL(request.url())
     if (url.hostname === 'issuer.xcs.invalid') issuerHostRequests += 1
-    if (!url.pathname.startsWith('/v1/')) return
-    apiPaths.push(url.pathname)
-    if (request.method() === 'POST' && url.pathname === '/v1/verify') {
+    if (!url.pathname.startsWith(`${API_PREFIX}/v1/`)) return
+    apiPaths.push(url.pathname.slice(API_PREFIX.length))
+    if (request.method() === 'POST' && url.pathname === `${API_PREFIX}/v1/verify`) {
       verifyBodies.push(request.postDataJSON() as Record<string, unknown>)
     }
   })
 
-  await page.goto('/en/developers')
+  await page.goto('/developers')
   await page.locator('[data-client-ready="true"]').waitFor()
   await expect(page.getByTestId('developer-api-base')).toHaveText(new URL(page.url()).origin)
   await expect(page.getByTestId('developer-profile-id')).toHaveText(PROFILE_ID)
@@ -143,7 +144,7 @@ test('never restores a stale report when the payload changes during verification
     releaseResponse = resolve
   })
 
-  await page.route('**/v1/verify', async (route) => {
+  await page.route(`**${API_PREFIX}/v1/verify`, async (route) => {
     const body = route.request().postDataJSON() as Record<string, unknown>
     if (Object.hasOwn(body, 'payload')) {
       signalRequestStarted()
@@ -152,7 +153,7 @@ test('never restores a stale report when the payload changes during verification
     await route.continue()
   })
 
-  await page.goto('/en/developers')
+  await page.goto('/developers')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.getByTestId('developer-generation-input').fill(GENERATION_ID)
   await page.getByTestId('developer-load-generation').click()
@@ -176,12 +177,12 @@ test('keeps a generation without a URI metadata-only', async ({ page }) => {
   const verifyBodies: Record<string, unknown>[] = []
   page.on('request', (request) => {
     const url = new URL(request.url())
-    if (request.method() === 'POST' && url.pathname === '/v1/verify') {
+    if (request.method() === 'POST' && url.pathname === `${API_PREFIX}/v1/verify`) {
       verifyBodies.push(request.postDataJSON() as Record<string, unknown>)
     }
   })
 
-  await page.goto('/en/developers')
+  await page.goto('/developers')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.getByTestId('developer-generation-input').fill(NO_URI_GENERATION_ID)
   await page.getByTestId('developer-load-generation').click()
@@ -201,12 +202,12 @@ test('fails closed before payload input when an exact generation was replaced',
   const verifyBodies: Record<string, unknown>[] = []
   page.on('request', (request) => {
     const url = new URL(request.url())
-    if (request.method() === 'POST' && url.pathname === '/v1/verify') {
+    if (request.method() === 'POST' && url.pathname === `${API_PREFIX}/v1/verify`) {
       verifyBodies.push(request.postDataJSON() as Record<string, unknown>)
     }
   })
 
-  await page.goto('/en/developers')
+  await page.goto('/developers')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.getByTestId('developer-generation-input').fill(HISTORICAL_GENERATION_ID)
   await page.getByTestId('developer-load-generation').click()
diff --git a/apps/web/e2e/guided-portal.spec.ts b/apps/web/e2e/guided-portal.spec.ts
new file mode 100644
index 0000000..f4d4205
--- /dev/null
+++ b/apps/web/e2e/guided-portal.spec.ts
@@ -0,0 +1,56 @@
+import { expect, test } from '@playwright/test'
+
+test('routes the public navigation to the guided verifier and issuer entries', async ({ page }) => {
+  await page.goto('/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible()
+
+  const navigation = page.getByTestId('primary-nav')
+  await expect(navigation.getByRole('link', { name: 'Verify', exact: true })).toHaveAttribute(
+    'href',
+    '/presentations',
+  )
+  await expect(page.getByRole('link', { name: 'Start building', exact: true })).toHaveAttribute(
+    'href',
+    '/issuer',
+  )
+  await expect(navigation.getByRole('link', { name: 'Create', exact: true })).toHaveCount(0)
+})
+
+for (const legacy of [
+  ['/studio?schema=discarded#secret', '/'],
+  ['/schemas/register?uid=discarded', '/issuer/schemas/new'],
+  ['/issue?subject=discarded', '/issuer/recipients'],
+  ['/accept?generation=discarded', '/recipient'],
+  ['/revoke?generation=discarded', '/issuer/credentials'],
+  ['/verify?hash=discarded#secret', '/presentations'],
+  ['/operations?profile=discarded', '/account'],
+] as const) {
+  test(`redirects ${legacy[0].split('?')[0]} without retaining technical input`, async ({
+    request,
+  }) => {
+    const response = await request.get(legacy[0], { maxRedirects: 0 })
+    expect(response.status()).toBe(308)
+    expect(response.headers().location).toBe(`${legacy[1]}#xcs-legacy-redirect`)
+    expect(response.headers().location).not.toContain('discarded')
+  })
+}
+
+test('replaces and then removes a fragment on a public compatibility redirect', async ({
+  page,
+}) => {
+  await page.goto('/studio?schema=discarded#secret')
+  await expect(page).toHaveURL(/\/$/)
+  expect(page.url()).not.toContain('discarded')
+  expect(new URL(page.url()).hash).toBe('')
+})
+
+test('preserves the French locale and fits the verifier entry at 390px', async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 })
+  await page.goto('/fr/verify?hash=discarded#secret')
+  await expect(page).toHaveURL(/\/fr\/presentations$/)
+  await expect(page.locator('html')).toHaveAttribute('lang', 'fr-FR')
+  expect(new URL(page.url()).hash).toBe('')
+  await expect
+    .poll(() => page.evaluate(() => document.documentElement.scrollWidth))
+    .toBeLessThanOrEqual(390)
+})
diff --git a/apps/web/e2e/issuer-journal.spec.ts b/apps/web/e2e/issuer-journal.spec.ts
new file mode 100644
index 0000000..cd53bcc
--- /dev/null
+++ b/apps/web/e2e/issuer-journal.spec.ts
@@ -0,0 +1,126 @@
+import { createRequire } from 'node:module'
+import { resolve } from 'node:path'
+import { test, expect, type Page } from '@playwright/test'
+import type { IndexedDbOperationJournal, OperationSeed } from '../app/utils/operationJournal'
+
+// Bundle the actual journal, then exercise native IndexedDB in two independent tabs.
+// This test needs no Nuxt build, development server or ledger fixture.
+const require = createRequire(import.meta.url)
+const viteRequire = createRequire(
+  createRequire(require.resolve('vitest/package.json')).resolve('vite'),
+)
+const { build } = viteRequire('esbuild') as {
+  build: (options: Record<string, unknown>) => Promise<{ outputFiles: { text: string }[] }>
+}
+let bundle = ''
+test.beforeAll(async () => {
+  const result = await build({
+    entryPoints: [resolve('app/utils/operationJournal.ts')],
+    bundle: true,
+    write: false,
+    platform: 'browser',
+    format: 'iife',
+    globalName: 'XcsJournal',
+    tsconfigRaw: { compilerOptions: {} },
+    alias: {
+      '#xcs/core/index.js': resolve('app/lib/xcs/core/index.ts'),
+      '#xcs/sdk/index.js': resolve('app/lib/xcs/sdk/index.ts'),
+    },
+  })
+  bundle = result.outputFiles[0]!.text
+})
+
+async function openJournal(page: Page) {
+  await page.goto('https://journal.test/')
+  await page.addScriptTag({ content: bundle })
+}
+async function create(page: Page, seed: OperationSeed) {
+  return page.evaluate(async (input) => {
+    const runtime = globalThis as unknown as {
+      XcsJournal: { IndexedDbOperationJournal: new () => IndexedDbOperationJournal }
+    }
+    try {
+      await new runtime.XcsJournal.IndexedDbOperationJournal().create(input)
+      return 'ready-to-sign'
+    } catch (cause) {
+      return cause instanceof Error ? cause.message : String(cause)
+    }
+  }, seed)
+}
+const first: OperationSeed = {
+  operationId: 'first',
+  account: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+  profileId: 'xrpl-testnet',
+  networkId: 1,
+  transactionType: 'CredentialCreate',
+  createdAt: '2026-09-24T00:00:00Z',
+  business: {
+    action: 'credential-issue',
+    issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+    subject: 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59',
+    schemaUid: 'a'.repeat(64),
+    credentialUri: `https://x.test/q/123456789012345678#xcs-sha256=${'a'.repeat(64)}`,
+    payloadDigestHex: 'a'.repeat(64),
+    issuerInviteId: '12345678-1234-4234-8234-123456789abc',
+  },
+}
+const second: OperationSeed = {
+  ...first,
+  operationId: 'second',
+  business: {
+    ...first.business!,
+    action: 'credential-issue',
+    issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+    subject: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+    schemaUid: 'a'.repeat(64),
+  },
+}
+
+test('one invitation excludes a second wallet before signing across tabs and after reload', async ({
+  context,
+}) => {
+  await context.route('https://journal.test/**', (route) =>
+    route.fulfill({ contentType: 'text/html', body: '<!DOCTYPE html><title>Journal</title>' }),
+  )
+  const tab1 = await context.newPage(),
+    tab2 = await context.newPage()
+  await Promise.all([openJournal(tab1), openJournal(tab2)])
+  const outcomes = await Promise.all([create(tab1, first), create(tab2, second)])
+  expect(outcomes.sort()).toEqual(['OPERATION_BUSINESS_LOCKED', 'ready-to-sign'])
+  const operationId = await tab1.evaluate(async () => {
+    const runtime = globalThis as unknown as {
+      XcsJournal: { IndexedDbOperationJournal: new () => IndexedDbOperationJournal }
+    }
+    const journal = new runtime.XcsJournal.IndexedDbOperationJournal()
+    const operation = (await journal.list())[0]!
+    await journal.persistSigned({
+      operationId: operation.operationId,
+      txHash: 'a'.repeat(64),
+      txBlob: 'AA',
+      lastLedgerSequence: 100,
+      at: '2026-09-24T00:00:01Z',
+    })
+    await journal.assertBusinessLockOwned(operation.operationId)
+    return operation.operationId
+  })
+  await tab2.reload()
+  await tab2.addScriptTag({ content: bundle })
+  expect(await create(tab2, { ...second, operationId: 'after-reload' })).toBe(
+    'OPERATION_BUSINESS_LOCKED',
+  )
+  await tab1.evaluate(async (id) => {
+    const runtime = globalThis as unknown as {
+      XcsJournal: { IndexedDbOperationJournal: new () => IndexedDbOperationJournal }
+    }
+    await new runtime.XcsJournal.IndexedDbOperationJournal().append({
+      operationId: id,
+      stage: 'expired',
+      txHash: 'a'.repeat(64),
+      lastLedgerSequence: 100,
+      at: '2026-09-24T00:00:02Z',
+    })
+  }, operationId)
+  expect(await create(tab2, { ...second, operationId: 'after-proven-expiry' })).toBe(
+    'ready-to-sign',
+  )
+})
diff --git a/apps/web/e2e/issuer.spec.ts b/apps/web/e2e/issuer.spec.ts
new file mode 100644
index 0000000..207ae57
--- /dev/null
+++ b/apps/web/e2e/issuer.spec.ts
@@ -0,0 +1,474 @@
+import { expect, test, type Page } from '@playwright/test'
+
+const organizationId = '00000000-0000-4000-8000-000000000031'
+const inviteId = '00000000-0000-4000-8000-000000000032'
+const schema = {
+  organizationId,
+  profileId: 'xrpl-testnet-xcs-browser-e2e',
+  schemaUid: 'a'.repeat(64),
+  name: 'Synthetic qualification',
+  displayName: 'School qualification',
+  category: 'Education',
+}
+const organization = {
+  id: organizationId,
+  name: 'Synthetic issuer school',
+  status: 'active',
+  applicationStatus: 'approved',
+  reviewReason: null as string | null,
+}
+const invitation = {
+  id: inviteId,
+  organizationId,
+  profileId: schema.profileId,
+  schemaUid: schema.schemaUid,
+  email: 'learner@example.test',
+  message: null,
+  claimedAt: null,
+  revokedAt: null,
+  expiresAt: '2099-09-23T12:00:00Z',
+  deliveryStatus: 'sent',
+}
+
+function workspace(overrides: Record<string, unknown> = {}) {
+  return {
+    organizations: [organization],
+    selectedOrganizationId: organizationId,
+    schemas: [schema],
+    invites: [],
+    credentials: [],
+    ...overrides,
+  }
+}
+
+async function mockIssuer(page: Page, state: () => unknown = () => workspace()) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        csrfToken: 'synthetic-issuer-csrf',
+        user: {
+          id: '00000000-0000-4000-8000-000000000033',
+          displayName: 'Synthetic responsible person',
+          email: 'responsible@example.test',
+          roles: ['recipient'],
+          organizations: [{ id: organizationId, name: organization.name, roles: ['issuer'] }],
+          wallets: [
+            {
+              id: '00000000-0000-4000-8000-000000000035',
+              address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+              networkId: 1,
+              verifiedAt: '2026-09-24T10:00:00Z',
+            },
+          ],
+        },
+      },
+    }),
+  )
+  await page.route('**/api/auth/access?**', (route) => route.fulfill({ json: { allowed: true } }))
+  await page.route('**/api/issuer/workspace**', (route) => route.fulfill({ json: state() }))
+}
+
+// Browser fixtures drive client middleware. These tests do not exercise real OIDC,
+// PostgreSQL authorization, mail delivery or wallet/ledger submission.
+async function enter(page: Page, path: string) {
+  await page.goto(path.startsWith('/fr/') ? '/fr' : '/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, path)
+}
+
+async function fillInvitation(page: Page) {
+  await page
+    .getByRole('textbox', { name: 'Email address for the invitation', exact: true })
+    .fill(invitation.email)
+  await page
+    .getByRole('combobox', { name: 'Attestation template', exact: true })
+    .selectOption({ label: schema.displayName })
+}
+
+test('shows organization schemas and invites recipients by named schema without a UID input', async ({
+  page,
+}) => {
+  await mockIssuer(page)
+  await enter(page, '/issuer')
+  await expect(page).toHaveURL(/\/issuer$/)
+  await expect(page.getByRole('heading', { name: 'Issuer portal', exact: true })).toBeVisible()
+  const nextAction = page.getByTestId('issuer-next-action')
+  await expect(nextAction).toContainText('Invite a recipient')
+  await expect(nextAction.getByRole('link', { name: 'Invite a recipient' })).toHaveAttribute(
+    'href',
+    `/issuer/recipients?organizationId=${organizationId}`,
+  )
+  await nextAction.getByRole('link', { name: 'Invite a recipient', exact: true }).click()
+  await expect(page.getByRole('heading', { name: 'Recipients', exact: true })).toBeVisible()
+  await expect(
+    page
+      .getByRole('combobox', { name: 'Attestation template', exact: true })
+      .getByRole('option', { name: schema.displayName }),
+  ).toHaveCount(1)
+  await expect(page.getByRole('textbox', { name: /uid/i })).toHaveCount(0)
+  await expect(page.getByRole('textbox', { name: /message/i })).toHaveCount(0)
+  await expect(page.getByText('No invitations yet.', { exact: true })).toBeVisible()
+})
+
+test('shows pending and declined application states without exposing an issuing action', async ({
+  page,
+}) => {
+  await mockIssuer(page, () =>
+    workspace({
+      organizations: [
+        { ...organization, applicationStatus: 'pending' },
+        {
+          ...organization,
+          id: '00000000-0000-4000-8000-000000000034',
+          name: 'Declined school',
+          applicationStatus: 'rejected',
+          reviewReason: 'Supporting evidence was incomplete.',
+        },
+      ],
+      schemas: [],
+    }),
+  )
+  await enter(page, '/issuer/application')
+  await expect(page.getByText('Pending review', { exact: true })).toBeVisible()
+  await expect(page.getByText('Declined', { exact: true })).toBeVisible()
+  await expect(page.getByText('Supporting evidence was incomplete.', { exact: true })).toBeVisible()
+  await expect(
+    page.getByText(
+      'An administrator will review your application. Issuance remains unavailable while it is pending.',
+      { exact: true },
+    ),
+  ).toBeVisible()
+  await expect(page.getByRole('link', { name: 'Open issuer workspace', exact: true })).toHaveCount(
+    0,
+  )
+  await expect(page.getByRole('link', { name: 'Apply as an issuer', exact: true })).toBeVisible()
+})
+
+test('submits a private application document with CSRF then displays pending review', async ({
+  page,
+}) => {
+  let submitted = false
+  const bodies: Record<string, unknown>[] = []
+  await mockIssuer(page, () =>
+    workspace({
+      organizations: submitted ? [{ ...organization, applicationStatus: 'pending' }] : [],
+      schemas: [],
+    }),
+  )
+  await page.route('**/api/issuer/applications', (route) => {
+    expect(route.request().method()).toBe('POST')
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-issuer-csrf')
+    bodies.push(route.request().postDataJSON())
+    submitted = true
+    return route.fulfill({ json: { organizationId } })
+  })
+  await enter(page, '/issuer/apply')
+  await page
+    .getByRole('textbox', { name: 'Organization name', exact: true })
+    .fill(organization.name)
+  await page
+    .getByRole('textbox', { name: 'Website', exact: true })
+    .fill('https://school.example.test')
+  await page
+    .getByRole('textbox', { name: 'Contact email', exact: true })
+    .fill('responsible@example.test')
+  await page
+    .getByRole('textbox', { name: 'Country or territory of registration', exact: true })
+    .fill('France')
+  await page
+    .getByRole('textbox', { name: 'What does your organization do?', exact: true })
+    .fill('A synthetic school for a browser test.')
+  await page
+    .getByRole('textbox', { name: 'What attestations would you like to issue?', exact: true })
+    .fill('Award training qualifications.')
+  const document = Buffer.from('%PDF-1.4\nSynthetic application evidence\n')
+  await page
+    .locator('input[type="file"]')
+    .setInputFiles({ name: 'evidence.pdf', mimeType: 'application/pdf', buffer: document })
+  await page.getByRole('button', { name: 'Send for review', exact: true }).click()
+  await expect(page).toHaveURL(
+    new RegExp(`/issuer/application\\?organizationId=${organizationId}$`),
+  )
+  await expect(page.getByText('Pending review', { exact: true })).toBeVisible()
+  expect(bodies).toHaveLength(1)
+  expect(bodies[0]).toMatchObject({
+    name: organization.name,
+    documents: [{ mimeType: 'application/pdf', base64: document.toString('base64') }],
+  })
+})
+
+test('sends an invitation and resends only after explicit link replacement confirmation', async ({
+  page,
+}) => {
+  let sent = false
+  const deliveries: { path: string; body: unknown }[] = []
+  await mockIssuer(page, () => workspace({ invites: sent ? [invitation] : [] }))
+  await page.route('**/api/issuer/invites**', (route) => {
+    expect(route.request().method()).toBe('POST')
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-issuer-csrf')
+    deliveries.push({
+      path: new URL(route.request().url()).pathname,
+      body: route.request().postDataJSON(),
+    })
+    sent = true
+    return route.fulfill({ json: { id: inviteId, deliveryStatus: 'sent' } })
+  })
+  await enter(page, '/issuer/recipients')
+  await fillInvitation(page)
+  await page.getByRole('button', { name: 'Send invitation', exact: true }).click()
+  await expect(page.getByRole('heading', { name: invitation.email, exact: true })).toBeVisible()
+  expect(deliveries).toHaveLength(1)
+  expect(deliveries[0]).toMatchObject({
+    path: '/api/issuer/invites',
+    body: {
+      organizationId,
+      profileId: schema.profileId,
+      schemaUid: schema.schemaUid,
+      email: invitation.email,
+    },
+  })
+  await page.getByRole('button', { name: 'Replace and resend link', exact: true }).click()
+  await expect(
+    page.getByText('Replace the previous link and send a new invitation?', { exact: true }),
+  ).toBeVisible()
+  expect(deliveries).toHaveLength(1)
+  await page.getByRole('button', { name: 'Cancel', exact: true }).click()
+  expect(deliveries).toHaveLength(1)
+  await page.getByRole('button', { name: 'Replace and resend link', exact: true }).click()
+  await page.getByRole('button', { name: 'Confirm', exact: true }).click()
+  await expect(page.getByText('Update saved.', { exact: true })).toBeVisible()
+  expect(deliveries).toHaveLength(2)
+  expect(deliveries[1]).toEqual({ path: `/api/issuer/invites/${inviteId}/resend`, body: {} })
+})
+
+test('surfaces a server refusal without reporting a successful invitation', async ({ page }) => {
+  await mockIssuer(page)
+  let requests = 0
+  await page.route('**/api/issuer/invites', (route) => {
+    requests++
+    return route.fulfill({ status: 403, json: { error: 'ISSUER_FORBIDDEN' } })
+  })
+  await enter(page, '/issuer/recipients')
+  await fillInvitation(page)
+  await page.getByRole('button', { name: 'Send invitation', exact: true }).click()
+  await expect(page.getByRole('alert')).toContainText('This action could not be completed.')
+  await expect(page.getByText('Update saved.', { exact: true })).toHaveCount(0)
+  await expect(page.getByRole('heading', { name: invitation.email, exact: true })).toHaveCount(0)
+  expect(requests).toBe(1)
+})
+
+test('keeps the invitation bearer out of URLs and browser storage and claims only on confirmation', async ({
+  page,
+}) => {
+  const token = 'A'.repeat(43)
+  const urls: string[] = []
+  const consoleMessages: string[] = []
+  const bodies: { path: string; body: unknown }[] = []
+  page.on('request', (request) => urls.push(request.url()))
+  page.on('console', (message) => consoleMessages.push(message.text()))
+  await mockIssuer(page)
+  await page.route('**/api/issuer/invitations/**', (route) => {
+    expect(route.request().method()).toBe('POST')
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-issuer-csrf')
+    const path = new URL(route.request().url()).pathname
+    bodies.push({ path, body: route.request().postDataJSON() })
+    return route.fulfill({
+      json: path.endsWith('/preview')
+        ? { organizationName: organization.name, schemaName: schema.displayName }
+        : { claimed: true },
+    })
+  })
+  for (const navigation of ['client', 'direct']) {
+    bodies.length = 0
+    if (navigation === 'client') await enter(page, `/recipient/invitations#${token}`)
+    else {
+      await page.goto('/')
+      await page.goto(`/recipient/invitations#${token}`)
+    }
+    await expect(page.getByRole('heading', { name: schema.displayName, exact: true })).toBeVisible()
+    await expect(page).toHaveURL(/\/recipient\/invitations$/)
+    expect(bodies).toEqual([{ path: '/api/issuer/invitations/preview', body: { token } }])
+    await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+    await expect(page.getByText('Your wallet is already linked', { exact: false })).toBeVisible()
+    expect(bodies).toEqual([
+      { path: '/api/issuer/invitations/preview', body: { token } },
+      { path: '/api/issuer/invitations/claim', body: { token } },
+    ])
+    expect(urls.every((url) => !url.includes(token))).toBe(true)
+    const stored = await page.evaluate(() =>
+      JSON.stringify({
+        local: { ...localStorage },
+        session: { ...sessionStorage },
+        history: history.state,
+      }),
+    )
+    expect(stored).not.toContain(token)
+    expect(consoleMessages.join('\n')).not.toContain(token)
+  }
+})
+
+test('replaces a claimed invitation with successive native and router links in the same tab', async ({
+  page,
+}) => {
+  const first = 'B'.repeat(43),
+    second = 'C'.repeat(43),
+    third = 'D'.repeat(43)
+  const names = {
+    [first]: 'First invitation',
+    [second]: 'Second invitation',
+    [third]: 'Third invitation',
+  }
+  const claims: string[] = []
+  await mockIssuer(page)
+  await page.route('**/api/issuer/invitations/**', (route) => {
+    const { token } = route.request().postDataJSON() as { token: string }
+    if (route.request().url().endsWith('/claim')) {
+      claims.push(token)
+      return route.fulfill({ json: { claimed: true } })
+    }
+    return route.fulfill({
+      json: { organizationName: organization.name, schemaName: names[token] },
+    })
+  })
+  await enter(page, `/recipient/invitations#${first}`)
+  await expect(page.getByRole('heading', { name: names[first], exact: true })).toBeVisible()
+  await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+  await expect(page.getByText('Your wallet is already linked', { exact: false })).toBeVisible()
+  await page.evaluate((token) => {
+    window.location.hash = token
+  }, second)
+  await expect(page.getByRole('heading', { name: names[second], exact: true })).toBeVisible()
+  await expect(page).toHaveURL(/\/recipient\/invitations$/)
+  expect(claims).toEqual([first])
+  await page.evaluate(async (token) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(`/recipient/invitations#${token}`)
+  }, third)
+  await expect(page.getByRole('heading', { name: names[third], exact: true })).toBeVisible()
+  await expect(page.getByRole('heading', { name: names[second], exact: true })).toHaveCount(0)
+  await expect(page).toHaveURL(/\/recipient\/invitations$/)
+  expect(claims).toEqual([first])
+  await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+  await expect.poll(() => claims).toEqual([first, third])
+  for (const value of [first, second, third])
+    expect(await page.evaluate(() => JSON.stringify(history.state))).not.toContain(value)
+  await page.evaluate(async () => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push('/')
+  })
+  for (const value of [first, second, third])
+    expect(await page.evaluate(() => JSON.stringify(history.state))).not.toContain(value)
+})
+
+test('ignores an old claim response after a different invitation arrived in the same tab', async ({
+  page,
+}) => {
+  const first = 'E'.repeat(43),
+    second = 'F'.repeat(43)
+  const claims: string[] = []
+  let claimStarted!: () => void, releaseClaim!: () => Promise<void>
+  const started = new Promise<void>((resolve) => {
+    claimStarted = resolve
+  })
+  await mockIssuer(page)
+  await page.route('**/api/issuer/invitations/**', (route) => {
+    const { token } = route.request().postDataJSON() as { token: string }
+    if (route.request().url().endsWith('/claim')) {
+      claims.push(token)
+      if (token === first) {
+        releaseClaim = () => route.fulfill({ json: { claimed: true } })
+        claimStarted()
+        return
+      }
+      return route.fulfill({ json: { claimed: true } })
+    }
+    return route.fulfill({
+      json: {
+        organizationName: organization.name,
+        schemaName: token === first ? 'Delayed claim invitation' : 'Current unclaimed invitation',
+      },
+    })
+  })
+  await enter(page, `/recipient/invitations#${first}`)
+  await expect(
+    page.getByRole('heading', { name: 'Delayed claim invitation', exact: true }),
+  ).toBeVisible()
+  await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+  await started
+  await page.evaluate((token) => {
+    window.location.hash = token
+  }, second)
+  await expect(
+    page.getByRole('heading', { name: 'Current unclaimed invitation', exact: true }),
+  ).toBeVisible()
+  const response = page.waitForResponse((response) =>
+    response.url().endsWith('/api/issuer/invitations/claim'),
+  )
+  await releaseClaim()
+  await (await response).finished()
+  await page.evaluate(
+    () =>
+      new Promise<void>((resolve) =>
+        requestAnimationFrame(() => requestAnimationFrame(() => resolve())),
+      ),
+  )
+  await expect(
+    page.getByRole('heading', { name: 'Current unclaimed invitation', exact: true }),
+  ).toBeVisible()
+  await expect(
+    page.getByText(
+      'Invitation claimed. Link your wallet in your account so the issuer can review it before issuing.',
+      { exact: true },
+    ),
+  ).toHaveCount(0)
+  expect(claims).toEqual([first])
+  await expect(
+    page.getByRole('button', { name: 'Claim with this account', exact: true }),
+  ).toBeEnabled()
+  await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+  await expect.poll(() => claims).toEqual([first, second])
+  for (const value of [first, second])
+    expect(await page.evaluate(() => JSON.stringify(history.state))).not.toContain(value)
+  await expect(page.getByText('Your wallet is already linked', { exact: false })).toBeVisible()
+})
+
+test('renders the issuer navigation and unconfirmed delivery guidance in French', async ({
+  page,
+}) => {
+  await mockIssuer(page, () =>
+    workspace({ invites: [{ ...invitation, deliveryStatus: 'uncertain' }] }),
+  )
+  await enter(page, '/fr/issuer/recipients')
+  await expect(page.getByRole('heading', { name: 'Destinataires', exact: true })).toBeVisible()
+  await expect(page.getByRole('navigation', { name: 'Navigation émetteur' })).toBeVisible()
+  await expect(
+    page.getByRole('button', { name: 'Envoyer l’invitation', exact: true }),
+  ).toBeVisible()
+  await page.getByText('Détails de l’envoi de l’email', { exact: true }).click()
+  await expect(page.getByText('Livraison de l’email: Non confirmé', { exact: true })).toBeVisible()
+  await expect(
+    page.getByText('La livraison n’a pas pu être confirmée.', { exact: false }),
+  ).toBeVisible()
+  await page.getByRole('button', { name: 'Remplacer et renvoyer le lien', exact: true }).click()
+  await expect(
+    page.getByText('Remplacer le lien précédent et envoyer une nouvelle invitation ?', {
+      exact: true,
+    }),
+  ).toBeVisible()
+})
diff --git a/apps/web/e2e/pilot.spec.ts b/apps/web/e2e/pilot.spec.ts
deleted file mode 100644
index fd57243..0000000
--- a/apps/web/e2e/pilot.spec.ts
+++ /dev/null
@@ -1,1742 +0,0 @@
-import { expect, test, type Download, type Page } from '@playwright/test'
-import {
-  canonicalJson,
-  computeSchemaUid,
-  createHttpsPayloadUri,
-  createIpfsPayloadUri,
-  encodeUtf8,
-  encodeHexUtf8,
-  sha256Hex,
-  parseSchema,
-  type JsonValue,
-  type NetworkProfile,
-  type SchemaDefinition,
-} from '#xcs/core/index.js'
-import { hashes, Wallet } from 'xrpl'
-
-const PROFILE_ID = 'xrpl-testnet-xcs-browser-e2e'
-const ISSUER = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
-const SUBJECT = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
-const ISSUER_WALLET_ID = 'xcs-browser-e2e'
-const SUBJECT_WALLET_ID = 'xcs-browser-e2e-subject'
-const GEMWALLET_ID = 'gemwallet'
-const LEDGER_HASH = 'cd'.repeat(32)
-const SCHEMA: SchemaDefinition = {
-  xcsVersion: '0.1',
-  name: 'Diploma Award',
-  description: 'Attests one deterministic browser test diploma award.',
-  fields: {
-    programId: { type: 'string' },
-    programName: { type: 'string' },
-    awardedAt: { type: 'string' },
-    diplomaId: { type: 'string' },
-    prenom: { type: 'string' },
-    honors: { type: 'string', optional: true },
-  },
-}
-const SCHEMA_UID = computeSchemaUid({
-  schema: parseSchema(SCHEMA),
-  networkId: 1,
-  ledgerHash: LEDGER_HASH,
-  ledgerIndex: 100_001,
-  transactionIndex: 1,
-  publisher: ISSUER,
-})
-const CLAIMS = {
-  programId: 'xcs-protocol-engineering-2026',
-  programName: 'Protocol Engineering',
-  awardedAt: '2026-08-25T10:00:00Z',
-  diplomaId: 'DIP-2026-0042',
-  prenom: 'Personne Test',
-  honors: 'with distinction',
-}
-const PAYLOAD_URL = 'https://issuer.xcs.invalid/diploma.json'
-const PERMALINK_GENERATION_ID = '34'.repeat(32)
-const PERMALINK_ACCEPTED_TRANSACTION_HASH = '78'.repeat(32)
-const HISTORICAL_GENERATION_ID = '56'.repeat(32)
-const CANONICAL_PAYLOAD = canonicalJson({
-  xcsVersion: '0.1',
-  issuer: ISSUER,
-  subject: SUBJECT,
-  schema: SCHEMA_UID,
-  claims: CLAIMS,
-} as JsonValue)
-const CREDENTIAL_URI = createHttpsPayloadUri(PAYLOAD_URL, CANONICAL_PAYLOAD)
-const RECOVERY_OPERATION_ID = 'browser-recovery-after-reload'
-const RECOVERY_LAST_LEDGER_SEQUENCE = 100_021
-const RECOVERY_SIGNER = Wallet.fromEntropy(
-  Uint8Array.from({ length: 16 }, (_, index) => index + 1),
-  { masterAddress: ISSUER },
-)
-const RECOVERY_TX_BLOB = RECOVERY_SIGNER.sign({
-  TransactionType: 'Payment',
-  Account: ISSUER,
-  Destination: SUBJECT,
-  Amount: '1',
-  Fee: '12',
-  Sequence: 1,
-  LastLedgerSequence: RECOVERY_LAST_LEDGER_SEQUENCE,
-}).tx_blob
-const RECOVERY_TX_HASH = hashes.hashSignedTx(RECOVERY_TX_BLOB).toUpperCase()
-const PROFILE: NetworkProfile = {
-  profileId: PROFILE_ID,
-  xcsVersion: '0.1',
-  networkId: 1,
-  requiredAmendment: 'ab'.repeat(32).toUpperCase(),
-  registryAddress: SUBJECT,
-  registrationAmountDrops: '1',
-  activationLedgerIndex: 1,
-  activationLedgerHash: 'ef'.repeat(32),
-}
-
-interface ApiMockOptions {
-  readonly schemaDigestHex?: string
-  readonly credentialEvidence?: () => 'confirmed' | 'mismatch'
-  readonly credentialLifecycle?: BrowserCredentialLifecycle
-  readonly credentialUri?: string
-  readonly networksUnavailable?: boolean
-  readonly pendingCredentialRejection?: boolean
-  readonly credentialDeletionCause?: 'issuer_revoked' | 'subject_rejected' | 'subject_removed'
-  readonly signingReadiness?: () => 'ready' | 'unavailable' | 'malformed'
-}
-
-interface BrowserCredentialLifecycle {
-  generationId: string | null
-  state: 'pending' | 'active' | 'expired' | 'deleted'
-  accepted: boolean
-  acceptedTransactionHash: string | null
-  removedTransactionHash?: string | null
-}
-
-const browserErrors = new WeakMap<Page, string[]>()
-
-test.beforeEach(({ page }) => {
-  const errors: string[] = []
-  browserErrors.set(page, errors)
-  page.on('pageerror', (error) => errors.push(`pageerror:${error.message}`))
-  page.on('console', (message) => {
-    if (message.type() === 'error') errors.push(`console:${message.text()}`)
-  })
-  page.on('requestfailed', (request) => {
-    errors.push(`requestfailed:${request.method()} ${request.url()}`)
-  })
-})
-
-test.afterEach(({ page }) => {
-  expect(browserErrors.get(page) ?? []).toEqual([])
-})
-
-function consumeExpectedHttpFailure(page: Page, status: string): void {
-  const errors = browserErrors.get(page) ?? []
-  expect(errors.length).toBeGreaterThan(0)
-  expect(
-    errors.every(
-      (entry) =>
-        entry ===
-        `console:Failed to load resource: the server responded with a status of ${status}`,
-    ),
-  ).toBe(true)
-  errors.length = 0
-}
-
-async function installApiMock(page: Page, options: ApiMockOptions = {}): Promise<void> {
-  await page.route('**/v1/**', async (route) => {
-    const url = new URL(route.request().url())
-    const path = url.pathname
-    if (route.request().method() === 'POST' && path === '/v1/verify') {
-      const body = route.request().postDataJSON() as Record<string, unknown>
-      const lifecycle = options.credentialLifecycle
-      if (
-        lifecycle?.generationId === null ||
-        body.network !== PROFILE_ID ||
-        body.issuer !== ISSUER ||
-        body.subject !== SUBJECT ||
-        body.schemaUid !== SCHEMA_UID ||
-        body.resolvePayload === true
-      ) {
-        await route.fulfill({ status: 400, json: { error: 'BROWSER_E2E_VERIFY_INPUT_INVALID' } })
-        return
-      }
-      if (
-        Object.hasOwn(body, 'payload') &&
-        canonicalJson(body.payload as JsonValue) !== CANONICAL_PAYLOAD
-      ) {
-        await route.fulfill({ status: 400, json: { error: 'BROWSER_E2E_VERIFY_PAYLOAD_INVALID' } })
-        return
-      }
-      await route.fulfill({
-        json: {
-          onChain: lifecycle?.state ?? 'pending',
-          schema: 'valid',
-          payload: Object.hasOwn(body, 'payload') ? 'valid' : 'not_checked',
-          issuerTrust: 'unknown',
-          ...(lifecycle?.generationId ? { generationId: lifecycle.generationId } : {}),
-        },
-      })
-      return
-    }
-    if (route.request().method() !== 'GET') {
-      await route.fulfill({ status: 405, json: { error: 'BROWSER_E2E_METHOD_NOT_ALLOWED' } })
-      return
-    }
-    if (path === '/v1/networks') {
-      if (options.networksUnavailable) {
-        await route.fulfill({
-          status: 503,
-          json: { error: 'INDEXER_STALE', message: 'Synthetic unavailable projection.' },
-        })
-        return
-      }
-      await route.fulfill({ json: { items: [PROFILE] } })
-      return
-    }
-    if (path === `/v1/networks/${PROFILE_ID}/readiness`) {
-      const readiness = options.signingReadiness?.() ?? 'ready'
-      if (readiness === 'unavailable') {
-        await route.fulfill({
-          status: 503,
-          json: { error: 'INDEXER_STALE', message: 'Synthetic stale indexer.' },
-        })
-        return
-      }
-      if (readiness === 'malformed') {
-        await route.fulfill({ json: { profileId: 'wrong-profile', status: 'ready' } })
-        return
-      }
-      await route.fulfill({
-        json: {
-          profileId: PROFILE_ID,
-          status: 'ready',
-          checkpoint: {
-            ledgerIndex: 100_001,
-            ledgerHash: LEDGER_HASH,
-            closeTime: 838_857_600,
-            transactionRoot: 'cd'.repeat(32),
-          },
-        },
-      })
-      return
-    }
-    if (path === `/v1/networks/${PROFILE_ID}/stats`) {
-      await route.fulfill({
-        json: {
-          network: PROFILE_ID,
-          schemas: { total: 12, publishers: 4 },
-          credentialGenerations: {
-            total: 27,
-            pending: 3,
-            active: 20,
-            expired: 2,
-            deleted: 2,
-          },
-          checkpoint: {
-            ledgerIndex: 100_001,
-            ledgerHash: LEDGER_HASH,
-            closeTime: 838_857_600,
-            transactionRoot: 'cd'.repeat(32),
-          },
-        },
-      })
-      return
-    }
-    if (path === `/v1/networks/${PROFILE_ID}/search`) {
-      await route.fulfill({
-        json: {
-          items: [
-            {
-              type: 'schema',
-              schemaUid: SCHEMA_UID,
-              name: SCHEMA.name,
-              description: SCHEMA.description,
-              publisher: ISSUER,
-              parentUid: null,
-              supersedesUid: null,
-              registrationTransactionHash: '56'.repeat(32),
-              ledgerIndex: 100_001,
-              transactionIndex: 1,
-            },
-          ],
-          hasMore: false,
-        },
-      })
-      return
-    }
-    if (path === `/v1/networks/${PROFILE_ID}/schemas/${SCHEMA_UID}`) {
-      await route.fulfill({
-        json: {
-          schemaUid: SCHEMA_UID,
-          name: SCHEMA.name,
-          description: SCHEMA.description,
-          publisher: ISSUER,
-          parentUid: null,
-          supersedesUid: null,
-          definition: SCHEMA,
-          resolvedDefinition: { definition: SCHEMA, fields: SCHEMA.fields, lineage: [] },
-          registrationTransactionHash: '56'.repeat(32),
-          ledgerIndex: 100_001,
-          transactionIndex: 1,
-        },
-      })
-      return
-    }
-    const generationMatch = path.match(
-      new RegExp(`^/v1/networks/${PROFILE_ID}/credential-generations/([0-9a-f]{64})$`, 'u'),
-    )
-    if (generationMatch) {
-      const lifecycle = options.credentialLifecycle
-      const requestedGenerationId = generationMatch[1]!
-      if (
-        !lifecycle?.generationId ||
-        requestedGenerationId !== lifecycle.generationId ||
-        !options.credentialUri
-      ) {
-        await route.fulfill({ status: 404, json: { error: 'CREDENTIAL_GENERATION_NOT_FOUND' } })
-        return
-      }
-      const createdEvent = {
-        transactionHash: lifecycle.generationId,
-        nodeIndex: 0,
-        generationId: lifecycle.generationId,
-        ledgerIndex: 100_001,
-        ledgerHash: LEDGER_HASH,
-        transactionIndex: 2,
-        eventType: 'created',
-        issuer: ISSUER,
-        subject: SUBJECT,
-        schemaUid: SCHEMA_UID,
-        accepted: false,
-        deletionCause: null,
-      }
-      const acceptedEvent = {
-        transactionHash: lifecycle.acceptedTransactionHash ?? PERMALINK_ACCEPTED_TRANSACTION_HASH,
-        nodeIndex: 0,
-        generationId: lifecycle.generationId,
-        ledgerIndex: 100_002,
-        ledgerHash: 'de'.repeat(32),
-        transactionIndex: 1,
-        eventType: 'accepted',
-        issuer: ISSUER,
-        subject: SUBJECT,
-        schemaUid: SCHEMA_UID,
-        accepted: true,
-        deletionCause: null,
-      }
-      const removedEvent = {
-        transactionHash: lifecycle.removedTransactionHash,
-        nodeIndex: 0,
-        generationId: lifecycle.generationId,
-        ledgerIndex: 100_003,
-        ledgerHash: 'fa'.repeat(32),
-        transactionIndex: 1,
-        eventType: 'deleted',
-        issuer: ISSUER,
-        subject: SUBJECT,
-        schemaUid: SCHEMA_UID,
-        accepted: lifecycle.accepted,
-        deletionCause:
-          options.credentialDeletionCause ??
-          (lifecycle.accepted ? 'subject_removed' : 'subject_rejected'),
-      }
-      await route.fulfill({
-        json: {
-          generation: {
-            generationId: lifecycle.generationId,
-            ledgerObjectId: '90'.repeat(32),
-            issuer: ISSUER,
-            subject: SUBJECT,
-            schemaUid: SCHEMA_UID,
-            uriHex: encodeHexUtf8(options.credentialUri),
-            expiration: null,
-            accepted: lifecycle.accepted,
-            createdLedgerIndex: 100_001,
-            createdTransactionIndex: 2,
-            lastLedgerIndex:
-              lifecycle.state === 'deleted'
-                ? 100_003
-                : lifecycle.state === 'active' || lifecycle.state === 'expired'
-                  ? 100_002
-                  : 100_001,
-            deletedLedgerIndex: lifecycle.state === 'deleted' ? 100_003 : null,
-            deletionCause:
-              lifecycle.state === 'deleted'
-                ? (options.credentialDeletionCause ??
-                  (lifecycle.accepted ? 'subject_removed' : 'subject_rejected'))
-                : null,
-          },
-          state: lifecycle.state,
-          timeline:
-            lifecycle.state === 'deleted'
-              ? lifecycle.accepted
-                ? [createdEvent, acceptedEvent, removedEvent]
-                : [createdEvent, removedEvent]
-              : lifecycle.state === 'active' || lifecycle.state === 'expired'
-                ? [createdEvent, acceptedEvent]
-                : [createdEvent],
-        },
-      })
-      return
-    }
-    const registrationMatch = path.match(
-      new RegExp(`^/v1/networks/${PROFILE_ID}/schema-registrations/([0-9a-f]{64})$`, 'u'),
-    )
-    if (registrationMatch) {
-      const txHash = registrationMatch[1]!
-      await route.fulfill({
-        json: {
-          transactionHash: txHash,
-          registration: {
-            status: 'accepted',
-            publisher: ISSUER,
-            ledgerIndex: 100_001,
-            ledgerHash: LEDGER_HASH,
-            transactionIndex: 1,
-            schemaUid: SCHEMA_UID,
-            schemaDigestHex: options.schemaDigestHex,
-            reasonCode: null,
-          },
-        },
-      })
-      return
-    }
-    const credentialPath = `/v1/networks/${PROFILE_ID}/credentials/${ISSUER}/${SUBJECT}/${SCHEMA_UID}`
-    if (path === credentialPath) {
-      const lifecycle = options.credentialLifecycle
-      if (!lifecycle?.generationId || !options.credentialUri) {
-        await route.fulfill({ status: 404, json: { error: 'CREDENTIAL_NOT_FOUND' } })
-        return
-      }
-      await route.fulfill({
-        json: {
-          generationId: lifecycle.generationId,
-          issuer: ISSUER,
-          subject: SUBJECT,
-          schemaUid: SCHEMA_UID,
-          uriHex: encodeHexUtf8(options.credentialUri),
-          expiration: null,
-          accepted: lifecycle.accepted,
-          state: lifecycle.state,
-        },
-      })
-      return
-    }
-    const credentialEventMatch = path.match(
-      new RegExp(
-        `^/v1/networks/${PROFILE_ID}/credentials/${ISSUER}/${SUBJECT}/${SCHEMA_UID}/events/([0-9a-f]{64})$`,
-        'u',
-      ),
-    )
-    if (credentialEventMatch) {
-      const txHash = credentialEventMatch[1]!
-      const lifecycle = options.credentialLifecycle
-      const lifecycleEvent = Boolean(
-        lifecycle !== undefined &&
-        lifecycle.generationId !== null &&
-        lifecycle.generationId !== txHash,
-      )
-      const deletionEvent =
-        lifecycleEvent &&
-        (lifecycle.state !== 'pending' || options.pendingCredentialRejection === true)
-      const acceptanceEvent = lifecycleEvent && !deletionEvent
-      const evidenceConfirmed = options.credentialEvidence?.() === 'confirmed'
-      const generationId = lifecycleEvent
-        ? lifecycle.generationId!
-        : evidenceConfirmed
-          ? txHash
-          : '34'.repeat(32)
-      if (!lifecycleEvent && evidenceConfirmed && lifecycle) lifecycle.generationId = txHash
-      if (acceptanceEvent && lifecycle) {
-        lifecycle.state = 'active'
-        lifecycle.accepted = true
-        lifecycle.acceptedTransactionHash = txHash
-      }
-      if (deletionEvent && lifecycle) {
-        lifecycle.state = 'deleted'
-        lifecycle.removedTransactionHash = txHash
-      }
-      await route.fulfill({
-        json: {
-          transactionHash: txHash,
-          event: {
-            transactionHash: txHash,
-            nodeIndex: 0,
-            issuer: ISSUER,
-            subject: SUBJECT,
-            schemaUid: SCHEMA_UID,
-            generationId,
-            ledgerIndex: 100_001,
-            ledgerHash: LEDGER_HASH,
-            transactionIndex: 2,
-            eventType: deletionEvent ? 'deleted' : acceptanceEvent ? 'accepted' : 'created',
-            accepted: lifecycle?.accepted ?? false,
-            deletionCause: deletionEvent
-              ? (options.credentialDeletionCause ??
-                (lifecycle?.accepted ? 'subject_removed' : 'subject_rejected'))
-              : null,
-          },
-        },
-      })
-      return
-    }
-    await route.fulfill({
-      status: 501,
-      json: { error: 'UNEXPECTED_BROWSER_E2E_API_REQUEST', path },
-    })
-  })
-}
-
-async function connectSyntheticWallet(
-  page: Page,
-  actor: 'issuer' | 'subject' | 'gemwallet' = 'issuer',
-): Promise<void> {
-  const walletId =
-    actor === 'subject'
-      ? SUBJECT_WALLET_ID
-      : actor === 'gemwallet'
-        ? GEMWALLET_ID
-        : ISSUER_WALLET_ID
-  const account = actor === 'subject' ? SUBJECT : ISSUER
-  await page.locator('[data-client-ready="true"]').waitFor()
-  const trigger = page.getByTestId('wallet-toggle')
-  await trigger.click()
-  await expect(trigger).toHaveAttribute('aria-expanded', 'true')
-  await page.locator(`[data-wallet-id="${walletId}"]`).click()
-  await expect(page.getByTestId('wallet-toggle')).toContainText(account.slice(0, 6))
-}
-
-test('explains GemWallet Credential incompatibility before preview or wallet interaction', async ({
-  page,
-}) => {
-  await installApiMock(page)
-  await page.goto('/issue')
-  await connectSyntheticWallet(page, 'gemwallet')
-  await page.locator('#schema-uid').fill(SCHEMA_UID)
-  await page.locator('#subject').fill(SUBJECT)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#claims').fill(JSON.stringify(CLAIMS, null, 2))
-  await page.locator('#https-url').fill(PAYLOAD_URL)
-
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-
-  const issueError = page.getByTestId('issue-error')
-  await expect(issueError).toContainText('GemWallet ne peut pas signer CredentialCreate')
-  await expect(issueError).toContainText(
-    'WALLET_CREDENTIAL_TRANSACTION_UNSUPPORTED:gemwallet:CredentialCreate',
-  )
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-})
-
-async function downloadText(download: Download): Promise<string> {
-  const stream = await download.createReadStream()
-  const chunks: Buffer[] = []
-  for await (const chunk of stream) {
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
-  }
-  return Buffer.concat(chunks).toString('utf8')
-}
-
-async function browserE2eEffects(page: Page): Promise<{
-  walletSignatures: number
-  ledgerSubmissions: number
-}> {
-  return page.evaluate(() => {
-    const runtime = globalThis as typeof globalThis & {
-      __xcsBrowserE2eEffects?: { walletSignatures: number; ledgerSubmissions: number }
-    }
-    return runtime.__xcsBrowserE2eEffects ?? { walletSignatures: 0, ledgerSubmissions: 0 }
-  })
-}
-
-async function browserOperationPersistence(page: Page): Promise<
-  {
-    stage: unknown
-    hasTxBlob: boolean
-    hasTxHash: boolean
-  }[]
-> {
-  return page.evaluate(
-    () =>
-      new Promise((resolve, reject) => {
-        const request = indexedDB.open('xcs-wallet-journal', 1)
-        request.onerror = () => reject(request.error ?? new Error('INDEXED_DB_OPEN_FAILED'))
-        request.onsuccess = () => {
-          const database = request.result
-          const transaction = database.transaction('operations', 'readonly')
-          const rows = transaction.objectStore('operations').getAll()
-          rows.onerror = () => reject(rows.error ?? new Error('INDEXED_DB_READ_FAILED'))
-          rows.onsuccess = () => {
-            resolve(
-              (rows.result as Record<string, unknown>[]).map((row) => ({
-                stage: row.stage,
-                hasTxBlob: typeof row.txBlob === 'string' && row.txBlob.length > 0,
-                hasTxHash: typeof row.txHash === 'string' && row.txHash.length > 0,
-                ...(typeof row.message === 'string' ? { message: row.message } : {}),
-              })),
-            )
-          }
-        }
-      }),
-  )
-}
-
-async function seedSignedRecoveryOperation(
-  page: Page,
-  overrides: { readonly lastLedgerSequence?: number; readonly txHash?: string } = {},
-): Promise<void> {
-  const lastLedgerSequence = overrides.lastLedgerSequence ?? RECOVERY_LAST_LEDGER_SEQUENCE
-  const txHash = overrides.txHash ?? RECOVERY_TX_HASH
-  await page.goto('/operations')
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await page.evaluate(
-    ({ operationId, txBlob, txHash, lastLedgerSequence, profileId, account }) =>
-      new Promise<void>((resolve, reject) => {
-        const request = indexedDB.open('xcs-wallet-journal', 1)
-        request.onupgradeneeded = () => {
-          if (!request.result.objectStoreNames.contains('operations')) {
-            request.result.createObjectStore('operations', { keyPath: 'operationId' })
-          }
-        }
-        request.onerror = () => reject(request.error ?? new Error('INDEXED_DB_OPEN_FAILED'))
-        request.onsuccess = () => {
-          const database = request.result
-          const transaction = database.transaction('operations', 'readwrite')
-          transaction.objectStore('operations').put({
-            operationId,
-            account,
-            profileId,
-            networkId: 1,
-            transactionType: 'Payment',
-            createdAt: '2026-08-30T12:00:00.000Z',
-            updatedAt: '2026-08-30T12:00:00.000Z',
-            stage: 'signed',
-            txBlob,
-            txHash,
-            lastLedgerSequence,
-          })
-          transaction.oncomplete = () => {
-            database.close()
-            resolve()
-          }
-          transaction.onerror = () =>
-            reject(transaction.error ?? new Error('INDEXED_DB_WRITE_FAILED'))
-          transaction.onabort = () =>
-            reject(transaction.error ?? new Error('INDEXED_DB_WRITE_ABORTED'))
-        }
-      }),
-    {
-      operationId: RECOVERY_OPERATION_ID,
-      txBlob: RECOVERY_TX_BLOB,
-      txHash,
-      lastLedgerSequence,
-      profileId: PROFILE_ID,
-      account: ISSUER,
-    },
-  )
-  await page.reload()
-  await page.locator('[data-client-ready="true"]').waitFor()
-}
-
-async function browserStoredRecoveryOperation(page: Page): Promise<{
-  stage: unknown
-  txBlob: unknown
-  txHash: unknown
-  lastLedgerSequence: unknown
-}> {
-  return page.evaluate(
-    (operationId) =>
-      new Promise((resolve, reject) => {
-        const request = indexedDB.open('xcs-wallet-journal', 1)
-        request.onerror = () => reject(request.error ?? new Error('INDEXED_DB_OPEN_FAILED'))
-        request.onsuccess = () => {
-          const database = request.result
-          const transaction = database.transaction('operations', 'readonly')
-          const row = transaction.objectStore('operations').get(operationId)
-          row.onerror = () => reject(row.error ?? new Error('INDEXED_DB_READ_FAILED'))
-          row.onsuccess = () => {
-            const operation = row.result as Record<string, unknown>
-            resolve({
-              stage: operation.stage,
-              txBlob: operation.txBlob,
-              txHash: operation.txHash,
-              lastLedgerSequence: operation.lastLedgerSequence,
-            })
-          }
-        }
-      }),
-    RECOVERY_OPERATION_ID,
-  )
-}
-
-function consumeExpectedReadiness503(page: Page): void {
-  const errors = browserErrors.get(page) ?? []
-  const expected =
-    'console:Failed to load resource: the server responded with a status of 503 (Service Unavailable)'
-  const index = errors.indexOf(expected)
-  expect(index).toBeGreaterThanOrEqual(0)
-  errors.splice(index, 1)
-}
-
-test('discovers a schema from aggregate stats and global search', async ({ page }) => {
-  await installApiMock(page)
-
-  await page.goto('/')
-  const schemaCount = page.getByText('12', { exact: true })
-  await expect(schemaCount).toBeVisible()
-  await expect(page.getByText(/schémas valides|valid schemas/u)).toBeVisible()
-
-  await page.locator('[data-client-ready="true"]').waitFor()
-  const search = page
-    .getByTestId('explorer-search')
-    .filter({ has: page.locator('#explorer-search') })
-  await search.getByRole('searchbox').fill('Diploma')
-  await expect(search.getByRole('button')).toBeEnabled()
-  await search.getByRole('button').click()
-  await expect(page).toHaveURL(/\/(?:en\/)?search\?q=Diploma$/u)
-  const result = page.getByTestId('result-card').filter({ hasText: SCHEMA.name })
-  await expect(result).toContainText(SCHEMA_UID)
-  await result.click()
-  await expect(page.getByRole('heading', { level: 1, name: SCHEMA.name })).toBeVisible()
-})
-
-test('exposes the simplified create, verify and docs navigation', async ({ page }) => {
-  await installApiMock(page)
-
-  await page.goto('/')
-  await expect(
-    page.getByRole('heading', {
-      level: 1,
-      name: /L’infrastructure des credentials vérifiables|Credential infrastructure for verifiable data/u,
-    }),
-  ).toBeVisible()
-
-  const navigation = page.getByTestId('primary-nav')
-  await expect(navigation.getByRole('link', { name: 'Explorer', exact: true })).toHaveAttribute(
-    'href',
-    /^\/(?:en\/)?schemas$/u,
-  )
-  await expect(
-    navigation.getByRole('link', { name: /Créer|Create/u, exact: true }),
-  ).toHaveAttribute('href', /^\/(?:en\/)?studio$/u)
-  await expect(
-    navigation.getByRole('link', { name: /Vérifier|Verify/u, exact: true }),
-  ).toHaveAttribute('href', /^\/(?:en\/)?verify$/u)
-  await expect(navigation.getByRole('link', { name: 'Docs', exact: true })).toHaveAttribute(
-    'href',
-    /^\/(?:en\/)?developers$/u,
-  )
-
-  await page.getByRole('link', { name: /Commencer à créer|Start building/u }).click()
-  await expect(page).toHaveURL(/\/(?:en\/)?studio$/u)
-  await expect(
-    page.locator('[data-testid="create-primary-card"][href$="/schemas/register"]'),
-  ).toBeVisible()
-  await expect(page.locator('[data-testid="create-primary-card"][href$="/issue"]')).toBeVisible()
-})
-
-test('keeps the complete landing hero inside a desktop viewport', async ({ page }) => {
-  await page.setViewportSize({ width: 1536, height: 893 })
-  await installApiMock(page)
-
-  await page.goto('/')
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await page
-    .getByTestId('landing-art')
-    .locator('img')
-    .evaluate(async (image) => {
-      await (image as HTMLImageElement).decode()
-    })
-
-  const viewport = page.viewportSize()
-  const hero = await page.getByTestId('landing-hero').boundingBox()
-  const primaryAction = await page
-    .getByRole('link', { name: /Commencer à créer|Start building/u })
-    .boundingBox()
-  const installCommand = await page.getByTestId('install-command').boundingBox()
-
-  expect(viewport).not.toBeNull()
-  expect(hero).not.toBeNull()
-  expect(primaryAction).not.toBeNull()
-  expect(installCommand).not.toBeNull()
-  expect(hero!.y + hero!.height).toBeLessThanOrEqual(viewport!.height + 1)
-  expect(primaryAction!.y + primaryAction!.height).toBeLessThanOrEqual(viewport!.height)
-  expect(installCommand!.y + installCommand!.height).toBeLessThanOrEqual(viewport!.height)
-  expect(await page.evaluate(() => document.documentElement.scrollWidth)).toBeLessThanOrEqual(
-    viewport!.width,
-  )
-})
-
-test('opens an exact credential verification from its generation ID', async ({ page }) => {
-  await installApiMock(page, {
-    credentialLifecycle: {
-      generationId: PERMALINK_GENERATION_ID,
-      state: 'active',
-      accepted: true,
-      acceptedTransactionHash: PERMALINK_ACCEPTED_TRANSACTION_HASH,
-    },
-    credentialUri: CREDENTIAL_URI,
-  })
-
-  await page.goto('/verify')
-  await page.locator('[data-client-ready="true"]').waitFor()
-  const generationInput = page.getByLabel(/Identifiant de génération|Credential generation ID/u)
-  const openVerification = page.getByRole('button', {
-    name: /Ouvrir la vérification|Open verification/u,
-  })
-  await generationInput.fill('not-a-generation')
-  await openVerification.click()
-  await expect(page.locator('#verify-generation-error')).toBeVisible()
-  await expect(page).toHaveURL(/\/(?:en\/)?verify$/u)
-
-  await generationInput.fill(PERMALINK_GENERATION_ID)
-  await openVerification.click()
-
-  await expect(page).toHaveURL(new RegExp(`/(?:en/)?credentials/${PERMALINK_GENERATION_ID}$`, 'u'))
-  await expect(page.getByRole('heading', { level: 1, name: SCHEMA.name })).toBeVisible()
-  await expect(page.getByTestId('credential-dimension-on-chain')).toContainText('active')
-})
-
-test('fails closed when an exact generation permalink targets another network profile', async ({
-  page,
-}) => {
-  await installApiMock(page, {
-    credentialLifecycle: {
-      generationId: PERMALINK_GENERATION_ID,
-      state: 'active',
-      accepted: true,
-      acceptedTransactionHash: PERMALINK_ACCEPTED_TRANSACTION_HASH,
-    },
-    credentialUri: CREDENTIAL_URI,
-  })
-
-  await page.goto(`/credentials/${PERMALINK_GENERATION_ID}?profile=another-network`)
-  await page.locator('[data-client-ready="true"]').waitFor()
-
-  await expect(page.getByTestId('explorer-error')).toBeVisible()
-  await expect(page.getByRole('heading', { level: 1, name: SCHEMA.name })).toHaveCount(0)
-})
-
-test('fails closed when an exact credential generation does not exist', async ({ page }) => {
-  await installApiMock(page)
-  const unknownGenerationId = '99'.repeat(32)
-
-  await page.goto('/verify')
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await page
-    .getByLabel(/Identifiant de génération|Credential generation ID/u)
-    .fill(unknownGenerationId)
-  await page.getByRole('button', { name: /Ouvrir la vérification|Open verification/u }).click()
-
-  await expect(page).toHaveURL(new RegExp(`/(?:en/)?credentials/${unknownGenerationId}$`, 'u'))
-  await expect(page.getByTestId('explorer-error')).toContainText(
-    /ressource XCS est introuvable|XCS resource could not be found/u,
-  )
-  consumeExpectedHttpFailure(page, '404 (Not Found)')
-})
-
-test('fails closed when the exact credential projection is unavailable', async ({ page }) => {
-  await installApiMock(page, { networksUnavailable: true })
-  const generationId = '98'.repeat(32)
-
-  await page.goto('/verify')
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await page.getByLabel(/Identifiant de génération|Credential generation ID/u).fill(generationId)
-  await page.getByRole('button', { name: /Ouvrir la vérification|Open verification/u }).click()
-
-  await expect(page).toHaveURL(new RegExp(`/(?:en/)?credentials/${generationId}$`, 'u'))
-  await expect(page.getByTestId('explorer-error')).toContainText(
-    /ne peut pas répondre de façon fiable|cannot answer reliably/u,
-  )
-  await expect(page.getByTestId('explorer-error')).toContainText(
-    /échoue volontairement en mode fermé|deliberately fails closed/u,
-  )
-  consumeExpectedHttpFailure(page, '503 (Service Unavailable)')
-})
-
-test('registers a schema through XRPL validation and exact indexed XCS finality', async ({
-  page,
-}) => {
-  const validatedSchema = parseSchema(SCHEMA)
-  const canonicalSchema = canonicalJson(validatedSchema as unknown as JsonValue)
-  const schemaDigestHex = sha256Hex(encodeUtf8(canonicalSchema))
-  await installApiMock(page, { schemaDigestHex })
-
-  await page.goto('/schemas/register')
-  await connectSyntheticWallet(page)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#schema-json').fill(JSON.stringify(SCHEMA, null, 2))
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-
-  await expect(page.getByTestId('transaction-preview')).toContainText('Payment')
-  await page.getByTestId('transaction-sign').click()
-
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  await expect(page.getByRole('link', { name: 'Ouvrir le schéma confirmé' })).toHaveAttribute(
-    'href',
-    `/schemas/${SCHEMA_UID}`,
-  )
-})
-
-test('does not open the wallet when profile readiness is unavailable', async ({ page }) => {
-  let readinessRequests = 0
-  await installApiMock(page, {
-    signingReadiness: () => {
-      readinessRequests += 1
-      return 'unavailable'
-    },
-  })
-
-  await page.goto('/schemas/register')
-  await connectSyntheticWallet(page)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#schema-json').fill(JSON.stringify(SCHEMA, null, 2))
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('transaction-preview')).toContainText('Payment')
-
-  await page.getByTestId('transaction-sign').click()
-
-  await expect(page.getByTestId('status-error')).toContainText(
-    'INDEXER_SIGNING_READINESS_UNAVAILABLE',
-  )
-  await expect(page.getByTestId('xrpl-finality')).toHaveCount(0)
-  consumeExpectedReadiness503(page)
-  expect(readinessRequests).toBe(1)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-})
-
-test('retains but does not submit a signature when readiness disappears after signing', async ({
-  page,
-}) => {
-  let readinessRequests = 0
-  await installApiMock(page, {
-    signingReadiness: () => {
-      readinessRequests += 1
-      return readinessRequests === 1 ? 'ready' : 'unavailable'
-    },
-  })
-
-  await page.goto('/schemas/register')
-  await connectSyntheticWallet(page)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#schema-json').fill(JSON.stringify(SCHEMA, null, 2))
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('transaction-preview')).toContainText('Payment')
-
-  await page.getByTestId('transaction-sign').click()
-
-  await expect(page.getByTestId('status-error')).toContainText(
-    'INDEXER_SIGNING_READINESS_UNAVAILABLE',
-  )
-  await expect(page.getByTestId('xrpl-finality')).toHaveCount(0)
-  consumeExpectedReadiness503(page)
-  expect(readinessRequests).toBe(2)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 1, ledgerSubmissions: 0 })
-  expect(await browserOperationPersistence(page)).toEqual([
-    {
-      stage: 'signed',
-      hasTxBlob: true,
-      hasTxHash: true,
-      message: 'Final pre-submission validation failed; signed transaction retained for retry.',
-    },
-  ])
-})
-
-test('resumes a signed operation after reload without asking the wallet to sign again', async ({
-  page,
-}) => {
-  let readinessRequests = 0
-  await installApiMock(page, {
-    signingReadiness: () => {
-      readinessRequests += 1
-      return 'ready'
-    },
-  })
-  await seedSignedRecoveryOperation(page)
-
-  const operation = page.getByTestId('operation-card').filter({ hasText: RECOVERY_TX_HASH }).first()
-  await expect(operation).toContainText('signed')
-  await operation.getByRole('button', { name: /Reprendre|Resume/u }).click()
-
-  await expect(operation).toContainText('validated')
-  await expect(operation).toContainText('tesSUCCESS')
-  expect(readinessRequests).toBe(1)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 1 })
-  expect(await browserOperationPersistence(page)).toEqual([
-    { stage: 'validated', hasTxBlob: false, hasTxHash: true },
-  ])
-})
-
-test('keeps a signed recovery operation when readiness is unavailable after reload', async ({
-  page,
-}) => {
-  let readinessRequests = 0
-  await installApiMock(page, {
-    signingReadiness: () => {
-      readinessRequests += 1
-      return 'unavailable'
-    },
-  })
-  await seedSignedRecoveryOperation(page)
-
-  const operation = page.getByTestId('operation-card').filter({ hasText: RECOVERY_TX_HASH }).first()
-  await expect(operation).toContainText('signed')
-  await operation.getByRole('button', { name: /Reprendre|Resume/u }).click()
-
-  await expect(page.getByTestId('status-error')).toContainText(
-    'INDEXER_SIGNING_READINESS_UNAVAILABLE',
-  )
-  consumeExpectedReadiness503(page)
-  expect(readinessRequests).toBe(1)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-  expect(await browserStoredRecoveryOperation(page)).toEqual({
-    stage: 'signed',
-    txBlob: RECOVERY_TX_BLOB,
-    txHash: RECOVERY_TX_HASH,
-    lastLedgerSequence: RECOVERY_LAST_LEDGER_SEQUENCE,
-  })
-})
-
-test('rejects inconsistent signed recovery metadata without losing the blob', async ({ page }) => {
-  let readinessRequests = 0
-  await installApiMock(page, {
-    signingReadiness: () => {
-      readinessRequests += 1
-      return 'ready'
-    },
-  })
-  await seedSignedRecoveryOperation(page, { lastLedgerSequence: 1 })
-
-  const operation = page.getByTestId('operation-card').filter({ hasText: RECOVERY_TX_HASH }).first()
-  await expect(operation).toContainText('signed')
-  await operation.getByRole('button', { name: /Reprendre|Resume/u }).click()
-
-  await expect(page.getByTestId('status-error')).toContainText(
-    'OPERATION_RECOVERY_LAST_LEDGER_SEQUENCE_MISMATCH',
-  )
-  expect(readinessRequests).toBe(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-  expect(await browserStoredRecoveryOperation(page)).toEqual({
-    stage: 'signed',
-    txBlob: RECOVERY_TX_BLOB,
-    txHash: RECOVERY_TX_HASH,
-    lastLedgerSequence: 1,
-  })
-})
-
-test('blocks issuance before the wallet when the published payload cannot be fetched', async ({
-  page,
-}) => {
-  await installApiMock(page)
-  await page.goto('/issue')
-  await expect(page.locator('#https-url')).toHaveValue('')
-  await connectSyntheticWallet(page)
-  await page.locator('#schema-uid').fill(SCHEMA_UID)
-  await page.locator('#subject').fill(SUBJECT)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#claims').fill(JSON.stringify(CLAIMS, null, 2))
-
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('issue-error')).toContainText(
-    'Indiquez d’abord l’URL HTTPS publique définitive',
-  )
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-
-  await page.locator('#https-url').fill('https://issuer.example/credentials/replace-me.json')
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('issue-error')).toContainText(
-    'issuer.example est un exemple, pas un hébergement',
-  )
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-
-  await page.locator('#https-url').fill(PAYLOAD_URL)
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialCreate')
-
-  await page.evaluate((payloadUrl) => {
-    const browserFetch = window.fetch.bind(window)
-    window.fetch = async (input, init) => {
-      const requestUrl =
-        typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
-      if (requestUrl === payloadUrl) throw new TypeError('Failed to fetch')
-      return browserFetch(input, init)
-    }
-  }, PAYLOAD_URL)
-
-  await page.getByTestId('transaction-sign').click()
-
-  const issueError = page.getByTestId('issue-error')
-  await expect(issueError).toContainText('Le navigateur n’a pas pu relire le payload')
-  await expect(issueError).toContainText('PAYLOAD_FETCH_FAILED')
-  await expect(page.getByTestId('transaction-preview')).toBeVisible()
-  await expect(page.getByTestId('transaction-sign')).toBeEnabled()
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-})
-
-test('stores, issues and reviews an IPFS-addressed payload in the local test browser', async ({
-  page,
-}) => {
-  const canonicalPayload = canonicalJson({
-    xcsVersion: '0.1',
-    issuer: ISSUER,
-    subject: SUBJECT,
-    schema: SCHEMA_UID,
-    claims: CLAIMS,
-  } as JsonValue)
-  const credentialUri = createIpfsPayloadUri(canonicalPayload)
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: null,
-    state: 'pending',
-    accepted: false,
-    acceptedTransactionHash: null,
-  }
-  await installApiMock(page, {
-    credentialEvidence: () => 'confirmed',
-    credentialLifecycle,
-    credentialUri,
-  })
-
-  await page.goto('/issue')
-  await connectSyntheticWallet(page)
-  await page.locator('#schema-uid').fill(SCHEMA_UID)
-  await page.locator('#subject').fill(SUBJECT)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#claims').fill(JSON.stringify(CLAIMS, null, 2))
-  await page.locator('#payload-storage-mode').selectOption('local-test')
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('issue-error')).toContainText(
-    'Confirmez l’avertissement du stockage local',
-  )
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-  await page
-    .getByLabel(/Je confirme que ce payload de test ne contient aucune donnée personnelle/u)
-    .check()
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-
-  await expect(page.getByTestId('local-payload-stored')).toBeVisible()
-  await expect(page.getByText(credentialUri, { exact: true })).toBeVisible()
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialCreate')
-  expect(
-    await page.evaluate(
-      () =>
-        Object.keys(localStorage).filter((key) => key.startsWith('xcs:local-test-payload:v1:'))
-          .length,
-    ),
-  ).toBe(1)
-
-  await page.evaluate(() => {
-    for (const key of Object.keys(localStorage)) {
-      if (key.startsWith('xcs:local-test-payload:v1:')) localStorage.removeItem(key)
-    }
-  })
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('issue-error')).toContainText(
-    'Ce payload local est absent ou expiré',
-  )
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-  await expect(page.getByTestId('local-payload-stored')).toBeVisible()
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 1, ledgerSubmissions: 1 })
-
-  const generationId = credentialLifecycle.generationId
-  if (!generationId) throw new Error('BROWSER_E2E_GENERATION_ID_MISSING')
-  await expect(page.getByTestId('issue-credential-link')).toHaveAttribute(
-    'href',
-    `/credentials/${generationId}?profile=${PROFILE_ID}`,
-  )
-
-  const acceptHref = await page
-    .getByRole('link', { name: /acceptation du sujet|subject acceptance/iu })
-    .getAttribute('href')
-  expect(acceptHref).not.toBeNull()
-  await page.getByTestId('wallet-toggle').click()
-  await page.goto(acceptHref!)
-  await connectSyntheticWallet(page, 'subject')
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-  await expect(page.getByText(/conservé dans ce navigateur/u)).toBeVisible()
-  await page.getByTestId('payload-consent').check()
-  await page.getByTestId('issuer-trust-acknowledgement').getByRole('checkbox').check()
-  await page
-    .getByRole('button', { name: /Charger le payload et préparer|Fetch payload and prepare/u })
-    .click()
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialAccept')
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  expect(credentialLifecycle.state).toBe('active')
-  expect(credentialLifecycle.accepted).toBe(true)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 1, ledgerSubmissions: 1 })
-
-  await page.getByTestId('subject-result-permalink').click()
-  await expect(page).toHaveURL(`/credentials/${generationId}?profile=${PROFILE_ID}`)
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await expect(page.getByTestId('credential-consent')).toBeVisible()
-  await page.getByTestId('credential-consent').getByRole('checkbox').check()
-  await page.getByTestId('credential-consent').getByRole('button').click()
-  await expect(page.getByTestId('credential-dimension-payload')).toContainText('valid')
-  await expect(page.getByTestId('credential-payload-checked')).toContainText(
-    sha256Hex(encodeUtf8(canonicalPayload)),
-  )
-})
-
-test('does not mislabel an unavailable external IPFS CID as browser-local', async ({ page }) => {
-  const canonicalPayload = canonicalJson({
-    xcsVersion: '0.1',
-    issuer: ISSUER,
-    subject: SUBJECT,
-    schema: SCHEMA_UID,
-    claims: CLAIMS,
-  } as JsonValue)
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: PERMALINK_GENERATION_ID,
-    state: 'pending',
-    accepted: false,
-    acceptedTransactionHash: null,
-  }
-  await installApiMock(page, {
-    credentialLifecycle,
-    credentialUri: createIpfsPayloadUri(canonicalPayload),
-  })
-
-  await page.goto(
-    `/accept?profile=${PROFILE_ID}&issuer=${ISSUER}&schema=${SCHEMA_UID}&generation=${PERMALINK_GENERATION_ID}`,
-  )
-  await connectSyntheticWallet(page, 'subject')
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-
-  await expect(
-    page.getByText(/Ce CID IPFS n’est pas disponible|This IPFS CID is unavailable/u),
-  ).toBeVisible()
-  await expect(page.getByText(/conservé dans ce navigateur|stored in this browser/u)).toHaveCount(0)
-  await expect(page.getByTestId('payload-consent')).toHaveCount(0)
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-})
-
-test('rejects the issuer wallet before looking up a subject-owned credential', async ({ page }) => {
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: PERMALINK_GENERATION_ID,
-    state: 'pending',
-    accepted: false,
-    acceptedTransactionHash: null,
-  }
-  await installApiMock(page, {
-    credentialLifecycle,
-    credentialUri: CREDENTIAL_URI,
-  })
-  let wrongTupleRequests = 0
-  page.on('request', (request) => {
-    if (
-      new URL(request.url()).pathname.includes(`/credentials/${ISSUER}/${ISSUER}/${SCHEMA_UID}`)
-    ) {
-      wrongTupleRequests += 1
-    }
-  })
-
-  await page.goto(
-    `/accept?profile=${PROFILE_ID}&issuer=${ISSUER}&schema=${SCHEMA_UID}&generation=${PERMALINK_GENERATION_ID}&action=accept`,
-  )
-  await connectSyntheticWallet(page, 'issuer')
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-
-  await expect(page.getByTestId('accept-error')).toContainText(
-    /wallet connecté n’est pas le sujet|connected wallet is not the subject/u,
-  )
-  expect(wrongTupleRequests).toBe(0)
-  expect(await browserE2eEffects(page)).toEqual({ walletSignatures: 0, ledgerSubmissions: 0 })
-})
-
-test('issues, reconfirms, then accepts a credential with exact indexed evidence', async ({
-  page,
-}) => {
-  let evidence: 'confirmed' | 'mismatch' = 'mismatch'
-  const canonicalPayload = canonicalJson({
-    xcsVersion: '0.1',
-    issuer: ISSUER,
-    subject: SUBJECT,
-    schema: SCHEMA_UID,
-    claims: CLAIMS,
-  } as JsonValue)
-  const credentialUri = createHttpsPayloadUri(PAYLOAD_URL, canonicalPayload)
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: null,
-    state: 'pending',
-    accepted: false,
-    acceptedTransactionHash: null,
-  }
-  await installApiMock(page, {
-    credentialEvidence: () => evidence,
-    credentialLifecycle,
-    credentialUri,
-  })
-  let payloadRequestCount = 0
-  await page.route(PAYLOAD_URL, async (route) => {
-    payloadRequestCount += 1
-    await route.fulfill({
-      body: canonicalPayload,
-      contentType: 'application/json',
-      headers: { 'access-control-allow-origin': '*' },
-    })
-  })
-
-  await page.goto('/issue')
-  await connectSyntheticWallet(page)
-  await page.locator('#schema-uid').fill(SCHEMA_UID)
-  await page.locator('#subject').fill(SUBJECT)
-  await page.getByRole('button', { name: 'Mode JSON' }).click()
-  await page.locator('#claims').fill(JSON.stringify(CLAIMS, null, 2))
-  await page.locator('#https-url').fill(PAYLOAD_URL)
-  await page.getByRole('button', { name: 'Valider et préparer' }).click()
-
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialCreate')
-  await page.getByTestId('transaction-sign').click()
-
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-mismatch')).toBeVisible()
-
-  evidence = 'confirmed'
-  await page.goto('/operations')
-  const operation = page
-    .getByTestId('operation-card')
-    .filter({ hasText: 'CredentialCreate' })
-    .first()
-  await expect(operation.getByTestId('operation-xcs-result')).toContainText('mismatch')
-  await operation.getByTestId('operation-reconfirm').click()
-  await expect(operation.getByTestId('operation-xcs-result')).toContainText('confirmed')
-  await expect(operation).toContainText('Generation ID')
-  const payloadRequestsAfterIssuance = payloadRequestCount
-
-  await page.getByTestId('wallet-toggle').click()
-  await operation.getByRole('link', { name: /Acceptation du sujet|Subject acceptance/u }).click()
-  await expect(page).toHaveURL(
-    new RegExp(
-      `/accept\\?profile=${PROFILE_ID}&issuer=${ISSUER}&schema=${SCHEMA_UID}&generation=[0-9a-f]{64}$`,
-      'u',
-    ),
-  )
-  await connectSyntheticWallet(page, 'subject')
-
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-  await expect(
-    page.getByRole('heading', {
-      name: /Relecture du credential exact|Exact credential review/u,
-    }),
-  ).toBeVisible()
-  expect(payloadRequestCount).toBe(payloadRequestsAfterIssuance)
-
-  const payloadConsent = page.getByLabel(
-    /Je consens explicitement au chargement|I explicitly consent to fetching/u,
-  )
-  const trustAcknowledgement = page
-    .getByTestId('issuer-trust-acknowledgement')
-    .getByRole('checkbox')
-  await expect(payloadConsent).not.toBeChecked()
-  await expect(trustAcknowledgement).not.toBeChecked()
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  await payloadConsent.check()
-  await page
-    .getByRole('button', { name: /Charger le payload et préparer|Fetch payload and prepare/u })
-    .click()
-  await expect(page.getByTestId('transaction-preview')).toHaveCount(0)
-  await expect(page.getByTestId('transaction-sign')).toHaveCount(0)
-  await expect(
-    page.getByText(/Confirmez votre propre décision de confiance|Confirm your own trust decision/u),
-  ).toBeVisible()
-  await trustAcknowledgement.check()
-  await page
-    .getByRole('button', { name: /Charger le payload et préparer|Fetch payload and prepare/u })
-    .click()
-
-  const preview = page.getByTestId('transaction-preview')
-  await expect(preview).toContainText('CredentialAccept')
-  await expect(preview).toContainText(SUBJECT)
-  await expect(preview).toContainText(ISSUER)
-  await expect(preview).toContainText(SCHEMA_UID.toUpperCase())
-  expect(payloadRequestCount).toBeGreaterThan(payloadRequestsAfterIssuance)
-  const payloadRequestsBeforeSign = payloadRequestCount
-  await page.getByTestId('transaction-sign').click()
-
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  expect(payloadRequestCount).toBe(payloadRequestsBeforeSign + 1)
-  expect(credentialLifecycle.state).toBe('active')
-  expect(credentialLifecycle.acceptedTransactionHash).toMatch(/^[0-9a-f]{64}$/u)
-
-  await page.goto('/operations')
-  const acceptanceOperation = page
-    .getByTestId('operation-card')
-    .filter({ hasText: 'CredentialAccept' })
-    .first()
-  await expect(acceptanceOperation.getByTestId('operation-xcs-result')).toContainText('confirmed')
-  const downloadPromise = page.waitForEvent('download')
-  await page
-    .getByRole('button', { name: /Exporter les reçus minimisés|Export sanitized receipts/u })
-    .click()
-  const exportedReceipts = await downloadText(await downloadPromise)
-  expect(exportedReceipts).not.toContain('"claims"')
-  expect(exportedReceipts).not.toContain('"txBlob"')
-  expect(exportedReceipts).not.toContain('"issuerTrust"')
-  expect(exportedReceipts).not.toContain(canonicalPayload)
-  const receiptExport = JSON.parse(exportedReceipts) as {
-    receipts: Array<Record<string, unknown>>
-  }
-  const acceptanceReceipt = receiptExport.receipts.find(
-    (receipt) => receipt.transactionType === 'CredentialAccept',
-  )
-  expect(acceptanceReceipt).toMatchObject({
-    account: SUBJECT,
-    transactionType: 'CredentialAccept',
-    businessConfirmation: 'confirmed',
-    business: {
-      action: 'credential-accept',
-      issuer: ISSUER,
-      subject: SUBJECT,
-      schemaUid: SCHEMA_UID,
-      generationId: credentialLifecycle.generationId,
-    },
-    businessEvidence: {
-      transactionHash: credentialLifecycle.acceptedTransactionHash,
-      generationId: credentialLifecycle.generationId,
-      eventType: 'accepted',
-      accepted: true,
-    },
-  })
-
-  await acceptanceOperation.getByTestId('operation-credential-link').click()
-  await expect(page).toHaveURL(
-    `/credentials/${credentialLifecycle.generationId}?profile=${PROFILE_ID}`,
-  )
-  await page.locator('[data-client-ready="true"]').waitFor()
-  const removeLink = page.getByTestId('credential-subject-action')
-  await expect(removeLink).toContainText(/Retirer cette génération|Remove this generation/u)
-  await expect(removeLink).toHaveAttribute(
-    'href',
-    `/accept?profile=${PROFILE_ID}&issuer=${ISSUER}&schema=${SCHEMA_UID}&generation=${credentialLifecycle.generationId}&action=remove`,
-  )
-
-  let subjectMutationVerifyRequests = 0
-  page.on('request', (request) => {
-    const url = new URL(request.url())
-    if (request.method() === 'POST' && url.pathname === '/v1/verify') {
-      subjectMutationVerifyRequests += 1
-    }
-  })
-  const payloadRequestsBeforeRemoval = payloadRequestCount
-  await removeLink.click()
-  await expect(page).toHaveURL(/action=remove$/u)
-  await connectSyntheticWallet(page, 'subject')
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-
-  const removalPreview = page.getByTestId('transaction-preview')
-  await expect(removalPreview).toContainText('CredentialDelete')
-  await expect(removalPreview).toContainText(SUBJECT)
-  await expect(removalPreview).toContainText(ISSUER)
-  await expect(page.getByTestId('issuer-trust-acknowledgement')).toHaveCount(0)
-  await expect(page.getByLabel(/consens|consent/iu)).toHaveCount(0)
-  expect(subjectMutationVerifyRequests).toBe(0)
-  expect(payloadRequestCount).toBe(payloadRequestsBeforeRemoval)
-
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('xrpl-finality')).toContainText('tesSUCCESS')
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  await expect(page.getByTestId('business-finality')).toContainText('deleted')
-  await expect(page.getByTestId('business-finality')).toContainText('subject_removed')
-  expect(subjectMutationVerifyRequests).toBe(0)
-  expect(payloadRequestCount).toBe(payloadRequestsBeforeRemoval)
-  expect(credentialLifecycle.state).toBe('deleted')
-  expect(credentialLifecycle.removedTransactionHash).toMatch(/^[0-9a-f]{64}$/u)
-
-  await page.getByTestId('subject-result-permalink').click()
-  await expect(page).toHaveURL(
-    `/credentials/${credentialLifecycle.generationId}?profile=${PROFILE_ID}`,
-  )
-  await expect(page.getByText('deleted', { exact: true }).first()).toBeVisible()
-  await expect(page.getByText('subject_removed', { exact: true })).toBeVisible()
-  await expect(page.getByTestId('credential-subject-action')).toHaveCount(0)
-  expect(payloadRequestCount).toBe(payloadRequestsBeforeRemoval)
-
-  await page.goto('/operations')
-  const removalOperation = page
-    .getByTestId('operation-card')
-    .filter({ hasText: 'credential-remove' })
-    .first()
-  await expect(removalOperation.getByTestId('operation-xcs-result')).toContainText('confirmed')
-  const removalDownloadPromise = page.waitForEvent('download')
-  await page
-    .getByRole('button', { name: /Exporter les reçus minimisés|Export sanitized receipts/u })
-    .click()
-  const removalExport = JSON.parse(await downloadText(await removalDownloadPromise)) as {
-    receipts: Array<Record<string, unknown>>
-  }
-  const removalReceipt = removalExport.receipts.find(
-    (receipt) =>
-      (receipt.business as { action?: string } | undefined)?.action === 'credential-remove',
-  )
-  expect(removalReceipt).toMatchObject({
-    receiptVersion: '0.2',
-    account: SUBJECT,
-    transactionType: 'CredentialDelete',
-    businessConfirmation: 'confirmed',
-    business: {
-      action: 'credential-remove',
-      issuer: ISSUER,
-      subject: SUBJECT,
-      schemaUid: SCHEMA_UID,
-      generationId: credentialLifecycle.generationId,
-    },
-    businessEvidence: {
-      transactionHash: credentialLifecycle.removedTransactionHash,
-      generationId: credentialLifecycle.generationId,
-      eventType: 'deleted',
-      accepted: true,
-      deletionCause: 'subject_removed',
-    },
-  })
-})
-
-test('rejects a pending credential without loading payload or trust', async ({ page }) => {
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: PERMALINK_GENERATION_ID,
-    state: 'pending',
-    accepted: false,
-    acceptedTransactionHash: null,
-  }
-  await installApiMock(page, {
-    credentialLifecycle,
-    credentialUri: CREDENTIAL_URI,
-    pendingCredentialRejection: true,
-  })
-  let payloadRequestCount = 0
-  let verifyRequestCount = 0
-  await page.route(PAYLOAD_URL, async (route) => {
-    payloadRequestCount += 1
-    await route.abort('blockedbyclient')
-  })
-  page.on('request', (request) => {
-    if (request.method() === 'POST' && new URL(request.url()).pathname === '/v1/verify') {
-      verifyRequestCount += 1
-    }
-  })
-
-  await page.goto(
-    `/accept?profile=${PROFILE_ID}&issuer=${ISSUER}&schema=${SCHEMA_UID}&generation=${PERMALINK_GENERATION_ID}&action=reject`,
-  )
-  await connectSyntheticWallet(page, 'subject')
-  await page
-    .getByRole('button', { name: /Charger, relire et préparer|Load, review and prepare/u })
-    .click()
-
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialDelete')
-  await expect(page.getByTestId('issuer-trust-acknowledgement')).toHaveCount(0)
-  await expect(page.getByLabel(/consens|consent/iu)).toHaveCount(0)
-  expect(payloadRequestCount).toBe(0)
-  expect(verifyRequestCount).toBe(0)
-
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  await expect(page.getByTestId('business-finality')).toContainText('deleted')
-  await expect(page.getByTestId('business-finality')).toContainText('subject_rejected')
-  expect(payloadRequestCount).toBe(0)
-  expect(verifyRequestCount).toBe(0)
-  expect(credentialLifecycle.state).toBe('deleted')
-})
-
-test('returns an issuer revocation to the exact deleted generation', async ({ page }) => {
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: PERMALINK_GENERATION_ID,
-    state: 'active',
-    accepted: true,
-    acceptedTransactionHash: PERMALINK_ACCEPTED_TRANSACTION_HASH,
-  }
-  await installApiMock(page, {
-    credentialLifecycle,
-    credentialUri: CREDENTIAL_URI,
-    credentialDeletionCause: 'issuer_revoked',
-  })
-
-  await page.goto(
-    `/revoke?profile=${PROFILE_ID}&subject=${SUBJECT}&schema=${SCHEMA_UID}&generation=${PERMALINK_GENERATION_ID}`,
-  )
-  await connectSyntheticWallet(page)
-  await page
-    .getByRole('button', { name: /Charger et préparer la révocation|Load and prepare revocation/u })
-    .click()
-  await expect(page.getByTestId('transaction-preview')).toContainText('CredentialDelete')
-
-  await page.getByTestId('transaction-sign').click()
-  await expect(page.getByTestId('xcs-confirmed')).toBeVisible()
-  await expect(page.getByTestId('business-finality')).toContainText('issuer_revoked')
-  expect(credentialLifecycle.state).toBe('deleted')
-
-  const permalink = page.getByTestId('revoke-result-permalink')
-  await expect(permalink).toHaveAttribute(
-    'href',
-    `/credentials/${PERMALINK_GENERATION_ID}?profile=${PROFILE_ID}`,
-  )
-  await permalink.click()
-  await expect(page).toHaveURL(`/credentials/${PERMALINK_GENERATION_ID}?profile=${PROFILE_ID}`)
-  await expect(page.getByText('deleted', { exact: true }).first()).toBeVisible()
-  await expect(page.getByText('issuer_revoked', { exact: true })).toBeVisible()
-})
-
-test('reveals an exact diploma permalink only after bound payload consent', async ({ page }) => {
-  const credentialLifecycle: BrowserCredentialLifecycle = {
-    generationId: PERMALINK_GENERATION_ID,
-    state: 'active',
-    accepted: true,
-    acceptedTransactionHash: PERMALINK_ACCEPTED_TRANSACTION_HASH,
-  }
-  await installApiMock(page, {
-    credentialLifecycle,
-    credentialUri: CREDENTIAL_URI,
-  })
-
-  let payloadRequestCount = 0
-  const requestTrace: string[] = []
-  const verifyBodies: Record<string, unknown>[] = []
-  page.on('request', (request) => {
-    const url = new URL(request.url())
-    if (url.href === PAYLOAD_URL) {
-      requestTrace.push('issuer')
-      return
-    }
-    if (!url.pathname.startsWith('/v1/')) return
-    const apiPath = url.pathname
-    if (apiPath === '/v1/networks') requestTrace.push('networks')
-    if (apiPath.includes('/credential-generations/')) requestTrace.push('generation')
-    if (apiPath.includes('/schemas/')) requestTrace.push('schema')
-    if (apiPath === '/v1/verify') {
-      const body = request.postDataJSON() as Record<string, unknown>
-      verifyBodies.push(body)
-      requestTrace.push(Object.hasOwn(body, 'payload') ? 'verify:payload' : 'verify:metadata')
-    }
-  })
-  await page.route(PAYLOAD_URL, async (route) => {
-    payloadRequestCount += 1
-    await route.fulfill({
-      body: CANONICAL_PAYLOAD,
-      contentType: 'application/json',
-      headers: { 'access-control-allow-origin': '*' },
-    })
-  })
-
-  await page.goto(`/credentials/${PERMALINK_GENERATION_ID}`)
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await expect(page.getByRole('heading', { level: 1, name: SCHEMA.name })).toBeVisible()
-  await expect(page.locator('meta[name="robots"]')).toHaveAttribute('content', 'noindex,nofollow')
-  await expect(page.getByTestId('credential-dimension-on-chain')).toContainText('active')
-  await expect(page.getByTestId('credential-dimension-schema')).toContainText('valid')
-  await expect(page.getByTestId('credential-dimension-payload')).toContainText('not_checked')
-  await expect(page.getByTestId('credential-dimension-trust')).toContainText('unknown')
-  await expect(page.getByTestId('credential-claims')).toHaveCount(0)
-  expect(payloadRequestCount).toBe(0)
-
-  const consent = page
-    .getByTestId('credential-consent')
-    .getByRole('checkbox', { name: /Je consens au chargement|I consent to fetching/u })
-  await expect(consent).not.toBeChecked()
-  await consent.check()
-  expect(payloadRequestCount).toBe(0)
-  const postConsentTraceStart = requestTrace.length
-  await page
-    .getByRole('button', {
-      name: /Charger et vérifier le payload public|Fetch and verify public payload/u,
-    })
-    .click()
-
-  await expect(page.getByTestId('credential-payload-checked')).toBeVisible()
-  await expect(page.getByTestId('credential-claims')).toBeVisible()
-  expect(payloadRequestCount).toBe(1)
-  const postConsentTrace = requestTrace.slice(postConsentTraceStart)
-  const issuerIndex = postConsentTrace.indexOf('issuer')
-  expect(issuerIndex).toBeGreaterThan(-1)
-  for (const metadataRequest of ['networks', 'generation', 'schema', 'verify:metadata']) {
-    const metadataIndex = postConsentTrace.indexOf(metadataRequest)
-    expect(metadataIndex, `${metadataRequest} must be re-read before issuer fetch`).toBeGreaterThan(
-      -1,
-    )
-    expect(metadataIndex).toBeLessThan(issuerIndex)
-  }
-  expect(postConsentTrace.indexOf('verify:payload')).toBeGreaterThan(issuerIndex)
-  expect(verifyBodies.some((body) => body.resolvePayload === true)).toBe(false)
-  const payloadVerifications = verifyBodies.filter((body) => Object.hasOwn(body, 'payload'))
-  expect(payloadVerifications).toHaveLength(1)
-  expect(payloadVerifications[0]).toEqual({
-    network: PROFILE_ID,
-    issuer: ISSUER,
-    subject: SUBJECT,
-    schemaUid: SCHEMA_UID,
-    payload: JSON.parse(CANONICAL_PAYLOAD),
-  })
-
-  for (const [name, type, value] of [
-    ['programId', 'string', CLAIMS.programId],
-    ['programName', 'string', CLAIMS.programName],
-    ['awardedAt', 'string', CLAIMS.awardedAt],
-    ['diplomaId', 'string', CLAIMS.diplomaId],
-    ['prenom', 'string', CLAIMS.prenom],
-    ['honors', 'string', CLAIMS.honors],
-  ] as const) {
-    const row = page.getByTestId(`credential-claim-${name}`)
-    await expect(row).toContainText(type)
-    await expect(row).toContainText(value)
-  }
-  await expect(page.getByTestId('credential-dimension-on-chain')).toContainText('active')
-  await expect(page.getByTestId('credential-dimension-schema')).toContainText('valid')
-  await expect(page.getByTestId('credential-dimension-payload')).toContainText('valid')
-  await expect(page.getByTestId('credential-dimension-trust')).toContainText('unknown')
-})
-
-test('keeps a replaced historical generation readable without payload consent', async ({
-  page,
-}) => {
-  await installApiMock(page, {
-    credentialLifecycle: {
-      generationId: PERMALINK_GENERATION_ID,
-      state: 'active',
-      accepted: true,
-      acceptedTransactionHash: PERMALINK_ACCEPTED_TRANSACTION_HASH,
-    },
-    credentialUri: CREDENTIAL_URI,
-  })
-  let payloadRequestCount = 0
-  await page.route(PAYLOAD_URL, async (route) => {
-    payloadRequestCount += 1
-    await route.fulfill({
-      body: CANONICAL_PAYLOAD,
-      contentType: 'application/json',
-      headers: { 'access-control-allow-origin': '*' },
-    })
-  })
-
-  await page.goto(`/credentials/${HISTORICAL_GENERATION_ID}`)
-  await page.locator('[data-client-ready="true"]').waitFor()
-  await expect(page.getByRole('heading', { level: 1, name: SCHEMA.name })).toBeVisible()
-  await expect(
-    page.getByTestId('explorer-metadata').getByText(HISTORICAL_GENERATION_ID, { exact: true }),
-  ).toBeVisible()
-  await expect(page.getByTestId('credential-verification-unavailable')).toBeVisible()
-  await expect(page.getByTestId('credential-consent')).toHaveCount(0)
-  await expect(page.getByTestId('credential-dimensions')).toHaveCount(0)
-  await expect(page.getByTestId('credential-subject-action')).toHaveCount(0)
-  await expect(page.getByText('issuer_revoked', { exact: true })).toBeVisible()
-  expect(payloadRequestCount).toBe(0)
-})
diff --git a/apps/web/e2e/recipient-verifier.spec.ts b/apps/web/e2e/recipient-verifier.spec.ts
new file mode 100644
index 0000000..a7e7584
--- /dev/null
+++ b/apps/web/e2e/recipient-verifier.spec.ts
@@ -0,0 +1,656 @@
+import { expect, test, type Page } from '@playwright/test'
+import { Wallet } from 'xrpl'
+import { sign as signMessage, verify as verifyMessage } from 'ripple-keypairs'
+
+const profileId = 'xrpl-testnet-xcs-browser-e2e'
+const generationId = 'b'.repeat(64)
+const organizationId = '00000000-0000-4000-8000-000000000071'
+const presentationId = '00000000-0000-4000-8000-000000000072'
+const token = 'r'.repeat(43)
+const proofWallet = Wallet.fromEntropy(Uint8Array.from({ length: 16 }, (_, index) => 31 - index))
+const credential = {
+  profileId,
+  generationId,
+  schemaUid: 'a'.repeat(64),
+  schemaName: 'Synthetic course completion',
+  organizationId,
+  organizationName: 'Synthetic school',
+  issuerAddress: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+  subjectAddress: proofWallet.classicAddress,
+  networkId: 1,
+  visibility: 'private',
+  createdAt: '2026-09-24T10:00:00Z',
+  creationTransactionHash: 'c'.repeat(64),
+  status: {
+    state: 'active',
+    accepted: true,
+    expiration: null,
+    deletedLedgerIndex: null,
+    deletionCause: null,
+  },
+  events: [],
+  disclosure: { publicFields: ['course'], fields: ['course', 'name'] },
+}
+const presentation = {
+  id: presentationId,
+  profileId,
+  generationId,
+  scope: 'full',
+  verifierOrganizationId: organizationId,
+  verifierOrganizationName: 'Synthetic verifier',
+  createdAt: '2026-09-24T10:00:00Z',
+  revokedAt: null,
+}
+const report = {
+  onChain: 'active',
+  schema: 'valid',
+  payload: 'not_checked',
+  issuerTrust: 'unknown',
+}
+const publicResult = {
+  presentation,
+  credential,
+  scope: 'public',
+  claims: { course: 'Synthetic course' },
+  verification: report,
+  requiresAuthorization: true,
+  issuerAdmission: {
+    status: 'approved',
+    organizationId,
+    checkedAt: '2026-09-24T10:00:00Z',
+    reviewedAt: '2026-09-23T10:00:00Z',
+  },
+  holderProof: { status: 'not_provided' },
+}
+
+async function prepareProofWallet(page: Page) {
+  await page.addInitScript(() => {
+    ;(
+      globalThis as typeof globalThis & { __xcsBrowserE2eAuthWallet?: boolean }
+    ).__xcsBrowserE2eAuthWallet = true
+  })
+  const challenges: { id: string; message: string }[] = []
+  await page.route('**/api/recipient/presentation-challenges', (route) => {
+    const input = route.request().postDataJSON()
+    const challenge = {
+      id: `00000000-0000-4000-8000-${String(challenges.length + 1).padStart(12, '0')}`,
+      message: `Synthetic presentation ownership proof ${challenges.length + 1}: ${JSON.stringify(input)}`,
+    }
+    challenges.push(challenge)
+    return route.fulfill({
+      json: {
+        ...challenge,
+        presentationId,
+        address: credential.subjectAddress,
+        networkId: 1,
+        expiresAt: '2099-09-24T10:00:00Z',
+      },
+    })
+  })
+  return challenges
+}
+async function connectProofWallet(page: Page) {
+  await page.getByTestId('presentation-wallet-toggle').click()
+  await page.getByTestId('presentation-wallet-menu').locator('[data-wallet-id="gemwallet"]').click()
+  await expect(page.getByTestId('presentation-wallet-status')).toContainText('Connected')
+}
+
+async function session(page: Page, signedIn = true) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        ...(signedIn ? { csrfToken: 'synthetic-recipient-csrf' } : {}),
+        user: signedIn
+          ? {
+              id: '00000000-0000-4000-8000-000000000073',
+              displayName: 'Synthetic person',
+              email: 'synthetic@example.test',
+              roles: ['recipient'],
+              organizations: [
+                { id: organizationId, name: 'Synthetic verifier', roles: ['verifier'] },
+              ],
+              wallets: [],
+            }
+          : null,
+      },
+    }),
+  )
+}
+async function enter(page: Page, path: string) {
+  await page.goto(path.startsWith('/fr/') ? '/fr' : '/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, path)
+}
+
+// Synthetic browser fixtures check visible consent and disclosure, not PostgreSQL authorization or real wallets.
+test('opens automatically, keeps the bearer out of URLs and reports a public subset as partial on mobile', async ({
+  page,
+}) => {
+  const consoleMessages: string[] = []
+  page.on('console', (message) => consoleMessages.push(message.text()))
+  await page.setViewportSize({ width: 390, height: 844 })
+  await session(page, false)
+  let opens = 0
+  await page.route('**/api/presentations/resolve', (route) => {
+    opens += 1
+    expect(route.request().method()).toBe('POST')
+    expect(route.request().postDataJSON()).toEqual({ token })
+    expect(route.request().url()).not.toContain(token)
+    return route.fulfill({ json: publicResult })
+  })
+  await enter(page, `/presentations#${token}`)
+  expect(page.url()).not.toContain(token)
+  expect(await page.evaluate(() => JSON.stringify(window.history.state))).not.toContain(token)
+  await expect(page.getByRole('heading', { name: 'Partially checked', exact: true })).toBeVisible()
+  expect(opens).toBe(1)
+  await expect(page.getByText('Synthetic course', { exact: true })).toBeVisible()
+  await expect(page.getByText('Synthetic private person')).toHaveCount(0)
+  await expect(page.getByRole('region', { name: 'Who issued it?', exact: true })).toContainText(
+    'Issuer organization approved for this portal',
+  )
+  await expect(
+    page.getByRole('region', { name: 'Has it been accepted?', exact: true }),
+  ).toContainText('The recipient accepted this attestation with their wallet.')
+  await expect(
+    page.getByText('No signed wallet proof was provided for this link.', { exact: true }),
+  ).toBeVisible()
+  await expect(
+    page.getByText('Only the shared information is shown.', { exact: false }),
+  ).toBeVisible()
+  const limitation = page.getByText('These checks confirm the available records and signatures.', {
+    exact: false,
+  })
+  expect(
+    (await limitation.boundingBox())!.y + (await limitation.boundingBox())!.height,
+  ).toBeLessThan(844)
+  expect(
+    await page.evaluate(
+      (value) => JSON.stringify({ ...localStorage, ...sessionStorage }).includes(value),
+      token,
+    ),
+  ).toBe(false)
+  expect(consoleMessages.join('\n')).not.toContain(token)
+})
+
+test('distinguishes Commons approval, ledger acceptance and a dated wallet signature from technical issuer trust', async ({
+  page,
+}) => {
+  await session(page, false)
+  const message = 'Synthetic presentation authorization bound to this recipient and link'
+  await page.route('**/api/presentations/resolve', (route) =>
+    route.fulfill({
+      json: {
+        ...publicResult,
+        requiresAuthorization: false,
+        verification: { ...report, payload: 'valid' },
+        holderProof: {
+          status: 'verified',
+          address: credential.subjectAddress,
+          networkId: 1,
+          verifiedAt: '2026-09-24T10:00:00Z',
+          message,
+          signature: signMessage(Buffer.from(message).toString('hex'), proofWallet.privateKey),
+          publicKey: proofWallet.publicKey,
+          scheme: 'ripple',
+          purpose: 'presentation_authorization',
+          keyAuthority: 'master_key_address_only',
+        },
+      },
+    }),
+  )
+  await enter(page, `/presentations#${token}`)
+  await expect(
+    page.getByRole('heading', { name: 'Issuer trust not established', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByRole('region', { name: 'Who issued it?', exact: true })).toContainText(
+    'Issuer organization approved for this portal',
+  )
+  const ledger = page.getByRole('region', {
+    name: 'Has it been accepted?',
+    exact: true,
+  })
+  await expect(ledger).toContainText('The recipient accepted this attestation with their wallet.')
+  await expect(ledger).toContainText('accepted')
+  const proof = page.getByRole('region', {
+    name: 'Who authorized this link?',
+    exact: true,
+  })
+  await expect(proof).toContainText('Wallet signature verified when this link was authorized')
+  await expect(proof).toContainText('2026')
+  await expect(proof).not.toContainText('No signed wallet proof')
+  await expect(page.getByText(message, { exact: false })).not.toBeVisible()
+})
+
+test('clears previously disclosed claims when a presentation is revoked', async ({ page }) => {
+  await session(page)
+  let opens = 0
+  await page.route('**/api/presentations/resolve', (route) => {
+    opens += 1
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-recipient-csrf')
+    return opens === 1
+      ? route.fulfill({
+          json: {
+            ...publicResult,
+            scope: 'full',
+            claims: { name: 'Synthetic private person' },
+            requiresAuthorization: false,
+            verification: { ...report, payload: 'valid' },
+          },
+        })
+      : route.fulfill({ status: 410, json: { error: 'PRESENTATION_REVOKED' } })
+  })
+  await enter(page, `/presentations#${token}`)
+  await expect(page.getByText('Synthetic private person', { exact: true })).toBeVisible()
+  await expect(
+    page.getByRole('heading', { name: 'Issuer trust not established', exact: true }),
+  ).toBeVisible()
+  await page.getByRole('button', { name: 'Check again', exact: true }).click()
+  await expect(
+    page.getByRole('heading', { name: 'Sharing link revoked', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByText('Synthetic private person', { exact: true })).toHaveCount(0)
+})
+
+test('opens successive native and router fragment links in the same component without retaining the previous result', async ({
+  page,
+}) => {
+  await session(page, false)
+  const tokens = [token, 's'.repeat(43), 't'.repeat(43)]
+  const requested: string[] = []
+  const consoleMessages: string[] = []
+  page.on('console', (message) => consoleMessages.push(message.text()))
+  await page.route('**/api/presentations/resolve', (route) => {
+    const currentToken = route.request().postDataJSON().token as string
+    requested.push(currentToken)
+    return route.fulfill({
+      json: {
+        ...publicResult,
+        claims: { course: `Synthetic course ${tokens.indexOf(currentToken)}` },
+      },
+    })
+  })
+  await enter(page, `/presentations#${tokens[0]}`)
+  await expect(page.getByText('Synthetic course 0', { exact: true })).toBeVisible()
+  await page.goto(`/presentations#${tokens[1]}`)
+  await expect(page.getByText('Synthetic course 0', { exact: true })).toHaveCount(0)
+  expect(new URL(page.url()).hash).toBe('')
+  await expect(page.getByText('Synthetic course 1', { exact: true })).toBeVisible()
+  expect(requested).toEqual(tokens.slice(0, 2))
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, `/presentations#${tokens[2]}`)
+  await expect(page.getByText('Synthetic course 1', { exact: true })).toHaveCount(0)
+  expect(new URL(page.url()).hash).toBe('')
+  await expect(page.getByText('Synthetic course 2', { exact: true })).toBeVisible()
+  expect(requested).toEqual(tokens)
+  for (const currentToken of tokens)
+    expect(await page.evaluate(() => JSON.stringify(window.history.state))).not.toContain(
+      currentToken,
+    )
+  await page.evaluate(async () => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push('/learn')
+  })
+  await expect(page).toHaveURL(/\/learn$/)
+  for (const currentToken of tokens)
+    expect(await page.evaluate(() => JSON.stringify(window.history.state))).not.toContain(
+      currentToken,
+    )
+  await page.goBack()
+  await expect(page).toHaveURL(/\/presentations$/)
+  for (const currentToken of tokens)
+    expect(await page.evaluate(() => JSON.stringify(window.history.state))).not.toContain(
+      currentToken,
+    )
+  for (const currentToken of tokens) expect(consoleMessages.join('\n')).not.toContain(currentToken)
+})
+
+test('ignores an older link response arriving after a new fragment was opened', async ({
+  page,
+}) => {
+  await session(page, false)
+  const nextToken = 's'.repeat(43)
+  let release: (() => void) | undefined
+  const delayed = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  let started = false
+  await page.route('**/api/presentations/resolve', async (route) => {
+    if (route.request().postDataJSON().token === token) {
+      started = true
+      await delayed
+      await route.fulfill({ status: 404, json: { error: 'PRESENTATION_NOT_FOUND' } })
+    } else
+      await route.fulfill({
+        json: { ...publicResult, claims: { course: 'Newest synthetic course' } },
+      })
+  })
+  await enter(page, `/presentations#${token}`)
+  await expect.poll(() => started).toBe(true)
+  await page.goto(`/presentations#${nextToken}`)
+  await expect(page.getByText('Newest synthetic course', { exact: true })).toBeVisible()
+  const oldResponse = page.waitForResponse(
+    (response) =>
+      response.url().endsWith('/api/presentations/resolve') && response.status() === 404,
+  )
+  release!()
+  await oldResponse
+  await expect(page.getByText('Newest synthetic course', { exact: true })).toBeVisible()
+  await expect(
+    page.getByRole('heading', { name: 'Presentation unavailable', exact: true }),
+  ).toHaveCount(0)
+})
+
+test('does not redisplay private claims when a delayed request finishes after the page was hidden', async ({
+  page,
+}) => {
+  await session(page)
+  let release: (() => void) | undefined
+  const delayed = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  let started = false
+  await page.route('**/api/presentations/resolve', async (route) => {
+    started = true
+    await delayed
+    await route.fulfill({
+      json: {
+        ...publicResult,
+        scope: 'full',
+        claims: { name: 'Synthetic private person' },
+        requiresAuthorization: false,
+        verification: { ...report, payload: 'valid' },
+      },
+    })
+  })
+  await enter(page, `/presentations#${token}`)
+  await expect.poll(() => started).toBe(true)
+  await page.evaluate(() => {
+    Object.defineProperty(document, 'visibilityState', { configurable: true, get: () => 'hidden' })
+    document.dispatchEvent(new Event('visibilitychange'))
+    Object.defineProperty(document, 'visibilityState', { configurable: true, get: () => 'visible' })
+    document.dispatchEvent(new Event('visibilitychange'))
+  })
+  release!()
+  await expect(page.getByRole('button', { name: 'Open presentation', exact: true })).toBeEnabled()
+  await expect(page.getByTestId('presentation-result')).toHaveCount(0)
+  await expect(page.getByText('Synthetic private person', { exact: true })).toHaveCount(0)
+})
+
+test('defaults to public sharing and requires a named audience before creating a private QR link', async ({
+  page,
+}) => {
+  await session(page)
+  const challenges = await prepareProofWallet(page)
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({ json: credential }),
+  )
+  await page.route('**/api/recipient/verifiers', (route) =>
+    route.fulfill({ json: { verifiers: [{ id: organizationId, name: 'Synthetic verifier' }] } }),
+  )
+  const grants: unknown[] = []
+  await page.route('**/api/recipient/presentations**', (route) => {
+    if (route.request().method() === 'POST') {
+      expect(route.request().postDataJSON()).toMatchObject({
+        scope: 'full',
+        verifierOrganizationId: organizationId,
+        profileId,
+        generationId,
+      })
+      const proof = route.request().postDataJSON().proof
+      const challenge = challenges.find((item) => item.id === proof.challengeId)!
+      expect(
+        verifyMessage(
+          Buffer.from(challenge.message).toString('hex'),
+          proof.signature,
+          proof.publicKey,
+        ),
+      ).toBe(true)
+      grants.push(presentation)
+      return route.fulfill({ json: { ...presentation, token, url: `/presentations#${token}` } })
+    }
+    return route.fulfill({ json: { presentations: grants } })
+  })
+  await enter(page, `/recipient/credentials/${generationId}/present?profile=${profileId}`)
+  await connectProofWallet(page)
+  await expect(page.getByRole('radio', { name: 'Public fields only', exact: true })).toBeChecked()
+  await expect(page.getByRole('img', { name: 'QR code for this sharing link' })).toHaveCount(0)
+  await page.getByRole('radio', { name: 'Complete content for one verifier', exact: true }).check()
+  await expect(
+    page.getByRole('button', { name: 'Create sharing link', exact: true }),
+  ).toBeDisabled()
+  await page
+    .getByRole('combobox', { name: 'Designated verifier organization', exact: true })
+    .selectOption(organizationId)
+  await page.getByRole('button', { name: 'Create sharing link', exact: true }).click()
+  await expect(page.getByRole('img', { name: 'QR code for this sharing link' })).toBeVisible()
+  await expect(page.getByRole('textbox', { name: 'Sharing link', exact: true })).toHaveValue(
+    new RegExp(`/presentations#${token}$`),
+  )
+  await expect(page.getByText('Sharing has no automatic expiry.', { exact: false })).toBeVisible()
+  await page.getByRole('button', { name: 'Create sharing link', exact: true }).click()
+  await expect.poll(() => grants.length).toBe(2)
+  expect(challenges).toHaveLength(2)
+  expect(challenges[0]!.message).not.toBe(challenges[1]!.message)
+})
+
+test('shows the French recipient waiting state and notifications without reading payloads', async ({
+  page,
+}) => {
+  await session(page)
+  let payloadReads = 0
+  await page.route('**/api/recipient/**/payload', (route) => {
+    payloadReads += 1
+    return route.abort()
+  })
+  await page.route('**/api/recipient/workspace', (route) =>
+    route.fulfill({
+      json: {
+        credentials: [credential],
+        invitations: [
+          {
+            id: organizationId,
+            ...credential,
+            claimedAt: '2026-09-24T10:00:00Z',
+            expiresAt: '2099-09-24T10:00:00Z',
+            revokedAt: null,
+            generationId: null,
+          },
+        ],
+        notifications: [
+          {
+            id: presentationId,
+            kind: 'issued',
+            profileId,
+            generationId,
+            organizationName: 'Synthetic school',
+            createdAt: credential.createdAt,
+          },
+        ],
+      },
+    }),
+  )
+  await enter(page, '/fr/recipient')
+  await expect(page.getByRole('heading', { name: 'Mes attestations', exact: true })).toBeVisible()
+  await expect(
+    page.getByRole('heading', { name: 'En attente d’émission', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByRole('heading', { name: 'Acceptées (1)', exact: true })).toBeVisible()
+  expect(payloadReads).toBe(0)
+})
+
+test('explains the active presentation limit without issuing another link', async ({ page }) => {
+  await session(page)
+  await prepareProofWallet(page)
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({ json: credential }),
+  )
+  await page.route('**/api/recipient/verifiers', (route) =>
+    route.fulfill({ json: { verifiers: [] } }),
+  )
+  await page.route('**/api/recipient/presentations**', (route) =>
+    route.request().method() === 'POST'
+      ? route.fulfill({
+          status: 409,
+          json: { error: 'RECIPIENT_PRESENTATION_LIMIT' },
+        })
+      : route.fulfill({ json: { presentations: [presentation] } }),
+  )
+  await enter(page, `/fr/recipient/credentials/${generationId}/present?profile=${profileId}`)
+  await page.getByTestId('presentation-wallet-toggle').click()
+  await page.getByTestId('presentation-wallet-menu').locator('[data-wallet-id="gemwallet"]').click()
+  await page.getByRole('button', { name: 'Créer le lien de partage', exact: true }).click()
+  await expect(page.getByRole('alert')).toContainText(
+    'Révoquez une présentation active avant d’en créer une autre (limite : 200).',
+  )
+  await expect(page.getByRole('img', { name: 'Code QR de ce lien de partage' })).toHaveCount(0)
+  await expect(page.getByRole('button', { name: 'Révoquer ce lien', exact: true })).toBeVisible()
+})
+
+test('shows exact public fields and permits removal of an accepted private attestation without reading content', async ({
+  page,
+}) => {
+  await session(page)
+  let payloadReads = 0
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({ json: credential }),
+  )
+  await page.route('**/api/recipient/**/payload', (route) => {
+    payloadReads += 1
+    return route.abort()
+  })
+  await enter(page, `/recipient/credentials/${generationId}?profile=${profileId}`)
+  const publicFields = page.getByRole('region', { name: 'Public fields', exact: true })
+  await expect(publicFields.getByRole('listitem')).toHaveText(['course'])
+  await expect(page.locator('#subject-action')).toContainText(
+    'Remove the accepted active or expired credential',
+  )
+  expect(payloadReads).toBe(0)
+})
+
+test('reopens verifier history through a record reference and removes old claims on failure', async ({
+  page,
+}) => {
+  await session(page)
+  await page.route('**/api/verifier/workspace**', (route) =>
+    route.fulfill({
+      json: {
+        organizations: [
+          {
+            id: organizationId,
+            name: 'Synthetic verifier',
+            status: 'active',
+            applicationStatus: 'approved',
+            reviewReason: null,
+          },
+        ],
+        selectedOrganizationId: organizationId,
+        history: [
+          {
+            id: presentationId,
+            organizationId,
+            presentationId,
+            profileId,
+            generationId,
+            scope: 'full',
+            checkedAt: credential.createdAt,
+            verification: report,
+          },
+        ],
+      },
+    }),
+  )
+  let opens = 0
+  await page.route(`**/api/verifier/history/${presentationId}/presentation`, (route) => {
+    opens += 1
+    expect(route.request().method()).toBe('POST')
+    expect(route.request().postDataJSON()).toEqual({})
+    expect(route.request().headers()['x-xcs-csrf']).toBe('synthetic-recipient-csrf')
+    expect(route.request().url()).not.toContain(token)
+    return opens === 1
+      ? route.fulfill({ json: publicResult })
+      : route.fulfill({ status: 404, json: {} })
+  })
+  await enter(page, '/verifier')
+  await expect(
+    page.getByRole('link', { name: 'Export history as CSV', exact: true }),
+  ).toHaveAttribute('href', `/api/verifier/history.csv?organizationId=${organizationId}`)
+  await page.getByRole('button', { name: 'Check again', exact: true }).click()
+  await expect(page.getByTestId('presentation-result')).toBeVisible()
+  await page.getByRole('button', { name: 'Check again', exact: true }).click()
+  await expect(page.getByTestId('presentation-result')).toHaveCount(0)
+  await expect(page.getByText('This record could not be reopened.', { exact: false })).toBeVisible()
+})
+
+for (const locale of ['en', 'fr'] as const) {
+  test(`opens a pasted sharing link without identifiers and hides technical evidence (${locale})`, async ({
+    page,
+  }) => {
+    await session(page, false)
+    let opens = 0
+    await page.route('**/api/presentations/resolve', (route) => {
+      opens += 1
+      expect(route.request().postDataJSON()).toEqual({ token })
+      return route.fulfill({
+        json: {
+          ...publicResult,
+          claims: {
+            course: 'Human readable course',
+            passed: true,
+            modules: ['First module', 'Second module'],
+          },
+        },
+      })
+    })
+    await enter(page, locale === 'fr' ? '/fr/presentations' : '/presentations')
+    const input = page.locator('#received-presentation-link')
+    await expect(input).toBeVisible()
+    await input.fill('https://foreign.example/presentations#' + token)
+    await page
+      .getByRole('button', {
+        name: locale === 'fr' ? 'Vérifier l’attestation' : 'Verify the attestation',
+        exact: true,
+      })
+      .click()
+    await expect(page.getByRole('alert')).toBeVisible()
+    expect(opens).toBe(0)
+    await input.fill(new URL(`/presentations#${token}`, page.url()).href)
+    await page
+      .getByRole('button', {
+        name: locale === 'fr' ? 'Vérifier l’attestation' : 'Verify the attestation',
+        exact: true,
+      })
+      .click()
+    const result = page.getByTestId('presentation-result')
+    await expect(result.getByText('Human readable course', { exact: true })).toBeVisible()
+    await expect(result.getByText(locale === 'fr' ? 'Oui' : 'Yes', { exact: true })).toBeVisible()
+    await expect(result.getByText('First module', { exact: true })).toBeVisible()
+    await expect(result.getByText(credential.subjectAddress, { exact: true })).not.toBeVisible()
+    await expect(result.getByText(generationId, { exact: true })).not.toBeVisible()
+    await expect(result.locator('details')).toHaveCount(0)
+    expect(new URL(page.url()).hash).toBe('')
+    expect(
+      await page.evaluate(() =>
+        JSON.stringify({ ...localStorage, ...sessionStorage, history: history.state }),
+      ),
+    ).not.toContain(token)
+    expect(opens).toBe(1)
+  })
+}
diff --git a/apps/web/e2e/role-journey.spec.ts b/apps/web/e2e/role-journey.spec.ts
new file mode 100644
index 0000000..77eba03
--- /dev/null
+++ b/apps/web/e2e/role-journey.spec.ts
@@ -0,0 +1,179 @@
+import { expect, test, type Page } from '@playwright/test'
+import { BROWSER_E2E_WALLET_ID } from '../app/utils/browserE2eHarness'
+
+const linkedWallet = {
+  id: '00000000-0000-4000-8000-000000000081',
+  address: 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59',
+  networkId: 1,
+  verifiedAt: '2026-09-24T10:00:00Z',
+}
+async function mockSession(page: Page, linked = false) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        csrfToken: 'synthetic-wallet-onboarding',
+        user: {
+          id: '00000000-0000-4000-8000-000000000082',
+          displayName: 'Synthetic recipient',
+          email: 'synthetic@example.test',
+          roles: ['recipient'],
+          organizations: [],
+          wallets: linked ? [linkedWallet] : [],
+        },
+      },
+    }),
+  )
+}
+async function enter(page: Page, path: string) {
+  await page.goto(path.startsWith('/fr/') ? '/fr' : '/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, path)
+}
+
+test('guides a recipient without a wallet and limits the local chooser to supported ownership proofs', async ({
+  page,
+}) => {
+  await mockSession(page)
+  await enter(page, '/account?returnTo=%2Frecipient')
+  await expect(
+    page.getByRole('heading', { name: 'Prepare your recipient wallet', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByText('Never enter them in XCS', { exact: false })).toBeVisible()
+  await expect(
+    page.getByText('Linking the wallet here sends no transaction', { exact: false }),
+  ).toBeVisible()
+  await expect(page.getByTestId('wallet-link-continue')).toHaveCount(0)
+  await page.getByRole('button', { name: 'I have prepared my wallet', exact: true }).click()
+  await page.getByTestId('wallet-link-toggle').click()
+  const choices = await page
+    .getByTestId('wallet-link-menu')
+    .locator('[data-wallet-choice]')
+    .evaluateAll((elements) =>
+      elements.map((element) => element.getAttribute('data-wallet-choice')),
+    )
+  expect(choices.length).toBeGreaterThan(0)
+  expect(choices.every((id) => ['gemwallet', 'metamask-snap', 'otsu'].includes(id!))).toBe(true)
+  await page.keyboard.press('Escape')
+  await page.getByTestId('wallet-toggle').click()
+  await expect(
+    page.getByTestId('wallet-menu').locator(`[data-wallet-choice="${BROWSER_E2E_WALLET_ID}"]`),
+  ).toBeVisible()
+})
+
+test('offers the French recipient continuation after a verified wallet and rejects an external return destination', async ({
+  page,
+}) => {
+  await mockSession(page, true)
+  await enter(page, '/fr/account?returnTo=https%3A%2F%2Foutside.test')
+  await expect(page.getByTestId('linked-wallets')).toContainText(linkedWallet.address)
+  await expect(page.getByTestId('wallet-link-continue')).toHaveAttribute('href', '/fr/recipient')
+  await expect(
+    page.getByText('Un wallet Testnet est lié à votre compte.', { exact: false }),
+  ).toBeVisible()
+})
+
+test('explains wallet readiness before issuer preparation when the recipient has no linked wallet', async ({
+  page,
+}) => {
+  await mockSession(page)
+  await page.route('**/api/recipient/workspace', (route) =>
+    route.fulfill({
+      json: {
+        credentials: [],
+        notifications: [],
+        invitations: [
+          {
+            id: 'synthetic-invitation',
+            organizationName: 'Synthetic school',
+            schemaName: 'Synthetic course',
+            generationId: null,
+            revokedAt: null,
+          },
+        ],
+      },
+    }),
+  )
+  await enter(page, '/recipient')
+  await expect(
+    page.getByText('Link a wallet before your issuer can issue this attestation.', {
+      exact: false,
+    }),
+  ).toBeVisible()
+  await expect(
+    page
+      .getByRole('region', { name: 'Waiting for issuance', exact: true })
+      .getByRole('link', { name: 'Prepare or manage my wallet', exact: true }),
+  ).toHaveAttribute('href', '/account?returnTo=/recipient')
+})
+
+test('allows issuance only when the claimed recipient has a verified wallet ready', async ({
+  page,
+}) => {
+  await mockSession(page)
+  await page.route('**/api/auth/access?**', (route) => route.fulfill({ json: { allowed: true } }))
+  const organizationId = '00000000-0000-4000-8000-000000000083'
+  const invite = {
+    organizationId,
+    profileId: 'xrpl-testnet-xcs-browser-e2e',
+    schemaUid: 'a'.repeat(64),
+    claimedAt: '2026-09-24T10:00:00Z',
+    revokedAt: null,
+    expiresAt: '2099-09-24T10:00:00Z',
+    deliveryStatus: 'sent',
+    recipientDisplayName: 'Synthetic claimant',
+  }
+  await page.route('**/api/issuer/workspace**', (route) =>
+    route.fulfill({
+      json: {
+        organizations: [
+          {
+            id: organizationId,
+            name: 'Synthetic school',
+            status: 'active',
+            applicationStatus: 'approved',
+            reviewReason: null,
+          },
+        ],
+        selectedOrganizationId: organizationId,
+        schemas: [],
+        credentials: [],
+        invites: [
+          {
+            ...invite,
+            id: 'waiting-wallet',
+            email: 'waiting@example.test',
+            recipientStatus: 'wallet_required',
+            recipientWalletVerifiedAt: null,
+          },
+          {
+            ...invite,
+            id: 'ready-wallet',
+            email: 'ready@example.test',
+            recipientStatus: 'ready',
+            recipientWalletVerifiedAt: linkedWallet.verifiedAt,
+          },
+          { ...invite, id: 'legacy-unknown', email: 'unknown@example.test' },
+        ],
+      },
+    }),
+  )
+  await enter(page, '/issuer/recipients')
+  await expect(page.getByText('Recipient must link a wallet', { exact: true })).toBeVisible()
+  await expect(
+    page.getByText('Recipient ready to receive the attestation', { exact: true }),
+  ).toBeVisible()
+  await expect(
+    page.getByRole('link', { name: 'Prepare the attestation', exact: true }),
+  ).toHaveCount(1)
+  await expect(
+    page.getByRole('link', { name: 'Prepare the attestation', exact: true }),
+  ).toHaveAttribute('href', '/issuer/issue/ready-wallet')
+})
diff --git a/apps/web/e2e/security.production.spec.ts b/apps/web/e2e/security.production.spec.ts
index 59f2176..f3a5f92 100644
--- a/apps/web/e2e/security.production.spec.ts
+++ b/apps/web/e2e/security.production.spec.ts
@@ -58,6 +58,9 @@ test('serves production assets without applying an HTML CSP to them', async ({ r
     expect(asset.status(), assetPath).toBe(200)
     expectNonHtmlDefensiveHeaders(asset)
     expect(asset.headers()['cache-control'], assetPath).toBe('public, max-age=31536000, immutable')
+    if (assetPath.endsWith('.js')) {
+      expect(await asset.text(), assetPath).not.toContain('xcs-browser-e2e')
+    }
   }
 })
 
@@ -67,11 +70,12 @@ test('keeps the browser E2E fixtures out of the production build', async ({ requ
   expect(live.headers()['cache-control']).toBe('no-store')
   await expect(live.json()).resolves.toEqual({ status: 'ok' })
 
-  // The production build configures an unreachable database, so the real read
-  // API must fail rather than answer with the browser end-to-end fixtures.
+  // A deliberately unreachable database must fail through the real same-origin API,
+  // not return deterministic fixture data or an absent-route HTML document.
   const networks = await request.get('/v1/networks')
   expect(networks.status()).toBe(500)
   const body = (await networks.json()) as Record<string, unknown>
   expect(body.error).toBe('INTERNAL_ERROR')
   expect(body).not.toHaveProperty('items')
+  expectNonHtmlDefensiveHeaders(networks)
 })
diff --git a/apps/web/e2e/securityAssertions.ts b/apps/web/e2e/securityAssertions.ts
index c57e47e..176b251 100644
--- a/apps/web/e2e/securityAssertions.ts
+++ b/apps/web/e2e/securityAssertions.ts
@@ -4,7 +4,7 @@ const STRICT_DIRECTIVES = {
   'default-src': ["'none'"],
   'base-uri': ["'none'"],
   'font-src': ["'self'"],
-  'form-action': ["'self'"],
+  'form-action': ["'self'", 'https://account.xrpl.in'],
   'frame-ancestors': ["'none'"],
   'frame-src': ["'none'"],
   'img-src': ["'self'", 'data:'],
diff --git a/apps/web/e2e/simple-issuer.spec.ts b/apps/web/e2e/simple-issuer.spec.ts
new file mode 100644
index 0000000..d4ed5ab
--- /dev/null
+++ b/apps/web/e2e/simple-issuer.spec.ts
@@ -0,0 +1,243 @@
+import { expect, test, type Page } from '@playwright/test'
+
+const organizationId = '00000000-0000-4000-8000-000000000091'
+const inviteId = '00000000-0000-4000-8000-000000000092'
+const profileId = 'xrpl-testnet-xcs-browser-e2e'
+const schemaUid = 'a'.repeat(64)
+const subject = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
+const schema = {
+  organizationId,
+  profileId,
+  schemaUid,
+  name: 'Course achievement',
+  displayName: 'Course achievement',
+  category: 'Education',
+}
+
+// UI fixtures prove wording and preserved form values, not live authorization or signatures.
+async function setup(page: Page, invitations: () => unknown[] = () => [], linked = true) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        csrfToken: 'synthetic-csrf',
+        user: {
+          id: '00000000-0000-4000-8000-000000000093',
+          displayName: 'Issuer',
+          email: 'issuer@example.test',
+          roles: ['recipient'],
+          wallets: linked
+            ? [
+                {
+                  id: '00000000-0000-4000-8000-000000000095',
+                  address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+                  networkId: 1,
+                  verifiedAt: '2026-09-24T10:00:00Z',
+                },
+              ]
+            : [],
+          organizations: [{ id: organizationId, name: 'Learning school', roles: ['issuer'] }],
+        },
+      },
+    }),
+  )
+  await page.route('**/api/auth/access?**', (route) => route.fulfill({ json: { allowed: true } }))
+  await page.route('**/api/issuer/workspace**', (route) =>
+    route.fulfill({
+      json: {
+        organizations: [
+          {
+            id: organizationId,
+            name: 'Learning school',
+            status: 'active',
+            applicationStatus: 'approved',
+          },
+        ],
+        selectedOrganizationId: organizationId,
+        schemas: [schema],
+        invites: invitations(),
+        credentials: [],
+      },
+    }),
+  )
+  await page.route('**/v1/networks', (route) =>
+    route.fulfill({ json: { items: [{ profileId, networkId: 1 }] } }),
+  )
+}
+
+async function enter(page: Page, path: string) {
+  await page.goto('/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (destination) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(destination)
+  }, path)
+}
+
+test('inviting from a named template keeps that selection without requesting an identifier', async ({
+  page,
+}) => {
+  await setup(page)
+  await enter(page, '/issuer/schemas')
+  await expect(
+    page.getByRole('heading', { name: 'Attestation templates', exact: true }),
+  ).toBeVisible()
+  await page.getByRole('link', { name: 'Invite a recipient', exact: true }).click()
+  await expect(
+    page.getByRole('combobox', { name: 'Attestation template', exact: true }),
+  ).toHaveValue(`${profileId}:${schemaUid}`)
+  expect(await page.locator('main').innerText()).not.toContain(schemaUid)
+  await expect(page.getByRole('textbox', { name: /uid|hash|identifier/i })).toHaveCount(0)
+})
+
+test('template creation exposes readable fields without a JSON editor', async ({ page }) => {
+  await setup(page)
+  await enter(page, `/issuer/schemas/new?organizationId=${organizationId}`)
+  await expect(
+    page.getByRole('heading', { name: 'Create an attestation template', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByRole('textbox', { name: 'Template name', exact: true })).toBeVisible()
+  await expect(page.getByRole('button', { name: 'Edit JSON', exact: true })).not.toBeVisible()
+  const visible = await page.locator('main').innerText()
+  expect(visible).not.toMatch(/UTF-8|canonical|\buint\b|\bbool\b/)
+  await expect(page.getByText('Advanced options', { exact: true })).toHaveCount(0)
+  await expect(page.locator('#schema-json')).toHaveCount(0)
+})
+
+test('managed issuance names the recipient and keeps full account references out of the main form', async ({
+  page,
+}) => {
+  await setup(page)
+  const definition = {
+    xcsVersion: '0.1',
+    name: schema.name,
+    description: 'Completed training',
+    fields: { course: { type: 'string' }, internalNote: { type: 'string' } },
+  }
+  await page.route(`**/v1/networks/${profileId}/schemas/${schemaUid}`, (route) =>
+    route.fulfill({ json: { ...schema, resolvedDefinition: definition, definition } }),
+  )
+  await page.route(`**/api/issuer/invites/${inviteId}/issuance`, (route) =>
+    route.fulfill({
+      json: {
+        invite: {
+          id: inviteId,
+          organizationId,
+          profileId,
+          schemaUid,
+          claimedBy: 'recipient-id',
+          expiresAt: '2099-01-01T00:00:00Z',
+          revokedAt: null,
+          deliveryEmail: 'contact@example.test',
+        },
+        schema: { ...schema, definition, resolvedDefinition: definition, publisher: subject },
+        recipient: {
+          id: 'recipient-id',
+          displayName: 'Camille Martin',
+          wallets: [{ address: subject, networkId: 1, verifiedAt: '2026-09-24T10:00:00Z' }],
+        },
+        organization: { id: organizationId, name: 'Learning school' },
+        issuerWallets: [],
+      },
+    }),
+  )
+  await enter(page, `/issuer/issue/${inviteId}`)
+  await expect(
+    page.getByRole('heading', { name: 'Prepare an attestation', exact: true }),
+  ).toBeVisible()
+  await expect(page.locator('main')).toContainText('Camille Martin')
+  await expect(page.locator('#claim-course')).toBeVisible()
+  await page.locator('#claim-course').fill('First aid')
+  await page.locator('#claim-internalNote').fill('Private review note')
+  expect(await page.locator('main').innerText()).not.toContain(subject)
+  expect(await page.locator('main').innerText()).not.toContain(schemaUid)
+  await expect(
+    page.getByRole('button', { name: 'Review before sending', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByText('Verified account details', { exact: true })).toHaveCount(0)
+  await expect(page.getByText(subject, { exact: true })).toHaveCount(0)
+})
+
+for (const deliveryStatus of ['failed', 'uncertain', 'sent'] as const) {
+  test(`invitation creation reports ${deliveryStatus} delivery without implying unconfirmed success`, async ({
+    page,
+  }) => {
+    let created = false
+    await setup(page, () =>
+      created
+        ? [
+            {
+              id: inviteId,
+              organizationId,
+              profileId,
+              schemaUid,
+              email: 'recipient@example.test',
+              deliveryStatus,
+              expiresAt: '2099-01-01T00:00:00Z',
+              claimedAt: null,
+              revokedAt: null,
+              recipientStatus: 'invited',
+            },
+          ]
+        : [],
+    )
+    await page.route('**/api/issuer/invites', (route) => {
+      expect(route.request().method()).toBe('POST')
+      created = true
+      return route.fulfill({ json: { id: inviteId, deliveryStatus } })
+    })
+    await enter(page, '/issuer/recipients')
+    await page
+      .getByRole('textbox', { name: 'Email address for the invitation', exact: true })
+      .fill('recipient@example.test')
+    await page.getByRole('button', { name: 'Send invitation', exact: true }).click()
+    await expect(
+      page.getByRole('heading', { name: 'recipient@example.test', exact: true }),
+    ).toBeVisible()
+    const sentNotice = page.getByText('Invitation sent. Follow the recipient’s response below.', {
+      exact: true,
+    })
+    if (deliveryStatus === 'sent') {
+      await expect(sentNotice).toBeVisible()
+    } else {
+      await expect(sentNotice).toHaveCount(0)
+      await expect(
+        page.getByText('Invitation created. Email delivery has not been confirmed.', {
+          exact: true,
+        }),
+      ).toBeVisible()
+      const warning =
+        deliveryStatus === 'failed'
+          ? 'The invitation email could not be sent. Check the address before trying again.'
+          : 'Delivery could not be confirmed. Check the mailbox before resending; a resend replaces the previous claim link.'
+      await expect(page.getByText(warning, { exact: true })).toBeVisible()
+      await expect(
+        page.getByRole('button', { name: 'Replace and resend link', exact: true }),
+      ).toBeVisible()
+    }
+    await expect(
+      page
+        .locator('details')
+        .filter({ has: page.getByText('Email delivery details', { exact: true }) }),
+    ).not.toHaveAttribute('open', '')
+  })
+}
+
+test('template creation requires a linked issuer wallet before showing the form', async ({
+  page,
+}) => {
+  await setup(page, () => [], false)
+  await enter(page, `/issuer/schemas/new?organizationId=${organizationId}`)
+  await expect(
+    page.getByText('Link an issuer wallet before continuing.', { exact: true }),
+  ).toBeVisible()
+  await expect(
+    page.getByRole('link', { name: 'Prepare the issuer wallet', exact: true }),
+  ).toHaveAttribute('href', '/account?returnTo=/issuer/schemas/new')
+  await expect(page.getByRole('textbox', { name: 'Template name', exact: true })).toHaveCount(0)
+  await expect(page.getByRole('button', { name: 'Edit JSON', exact: true })).toHaveCount(0)
+})
diff --git a/apps/web/e2e/simple-navigation.spec.ts b/apps/web/e2e/simple-navigation.spec.ts
new file mode 100644
index 0000000..635ca7c
--- /dev/null
+++ b/apps/web/e2e/simple-navigation.spec.ts
@@ -0,0 +1,92 @@
+import { expect, test, type Page } from '@playwright/test'
+
+const issuerEnabled = Boolean(process.env.NUXT_ISSUER_DATABASE_URL?.trim())
+
+async function navigate(page: Page, path: string) {
+  await page.evaluate(async (target) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(target)
+  }, path)
+}
+
+// Client fixtures cover navigation only. Real OIDC/permissions have separate runtime tests.
+async function enterHome(page: Page, locale: 'en' | 'fr', signedIn: boolean) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        user: signedIn
+          ? {
+              id: '00000000-0000-4000-8000-000000000099',
+              displayName: 'Synthetic administrator',
+              email: 'navigation@example.test',
+              roles: ['admin', 'recipient'],
+              organizations: [
+                {
+                  id: '00000000-0000-4000-8000-000000000098',
+                  name: 'Synthetic organization',
+                  roles: ['issuer', 'verifier'],
+                },
+              ],
+              wallets: [],
+            }
+          : null,
+      },
+    }),
+  )
+  const prefix = locale === 'fr' ? '/fr' : ''
+  await page.goto(prefix || '/')
+  await page.locator('[data-client-ready="true"]').waitFor()
+  // Auth middleware reloads the session through the browser route fixture.
+  await navigate(page, `${prefix}/account`)
+  await navigate(page, prefix || '/')
+}
+
+for (const locale of ['en', 'fr'] as const) {
+  for (const signedIn of [false, true]) {
+    test(`simple ${locale} homepage for ${signedIn ? 'a multi-role account' : 'a visitor'}`, async ({
+      page,
+    }) => {
+      test.skip(!issuerEnabled, 'Run with a complete issuer contract for portal navigation.')
+      await page.setViewportSize({ width: 1440, height: 1000 })
+      await enterHome(page, locale, signedIn)
+      const home = page.getByTestId('simple-home')
+      await expect(home).toBeVisible()
+      await expect(home.getByRole('link')).toHaveCount(3)
+      const prefix = locale === 'fr' ? '/fr' : ''
+      await expect(home.locator(`a[href="${prefix}/recipient"]`)).toBeVisible()
+      await expect(home.locator(`a[href="${prefix}/presentations"]`)).toBeVisible()
+      await expect(
+        home.locator(`a[href="${prefix}${signedIn ? '/issuer' : '/issuer/application'}"]`),
+      ).toBeVisible()
+      await expect(page.getByTestId('install-command')).toHaveCount(0)
+      await expect(page.getByRole('searchbox')).toHaveCount(0)
+      await expect(
+        page.getByRole('button', { name: /Connect wallet|Connecter un portefeuille/ }),
+      ).toHaveCount(0)
+      const primary = page.getByTestId('primary-nav')
+      await expect(primary.locator('a[href$="/admin"]')).not.toBeVisible()
+      await primary
+        .getByRole('button', { name: locale === 'fr' ? 'Plus' : 'More', exact: true })
+        .click()
+      await expect(primary.locator(`a[href="${prefix}/schemas"]`)).toBeVisible()
+      await expect(primary.locator(`a[href="${prefix}/developers"]`)).toBeVisible()
+      await expect(primary.locator(`a[href="${prefix}/verify"]`)).toHaveCount(0)
+      if (signedIn) await expect(primary.locator(`a[href="${prefix}/admin"]`)).toBeVisible()
+      else await expect(primary.locator(`a[href="${prefix}/admin"]`)).toHaveCount(0)
+    })
+  }
+}
+
+test('keeps the protocol homepage when issuer portals are disabled', async ({ page }) => {
+  test.skip(issuerEnabled, 'Run without an issuer contract for protocol compatibility.')
+  await enterHome(page, 'en', false)
+  await expect(page.getByTestId('landing-hero')).toBeVisible()
+  await expect(page.getByTestId('install-command')).toContainText('pnpm install')
+  await expect(page.getByTestId('simple-home')).toHaveCount(0)
+  await expect(page.getByTestId('primary-nav').locator('a[href="/schemas"]')).toBeVisible()
+})
diff --git a/apps/web/e2e/simple-recipient.spec.ts b/apps/web/e2e/simple-recipient.spec.ts
new file mode 100644
index 0000000..0d02f94
--- /dev/null
+++ b/apps/web/e2e/simple-recipient.spec.ts
@@ -0,0 +1,234 @@
+import { expect, test, type Page } from '@playwright/test'
+
+const profileId = 'xrpl-testnet-xcs-browser-e2e'
+const generationId = 'd'.repeat(64)
+const subjectAddress = 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59'
+const credential = {
+  profileId,
+  generationId,
+  schemaUid: 'e'.repeat(64),
+  schemaName: 'Synthetic first aid certificate',
+  organizationId: '00000000-0000-4000-8000-000000000181',
+  organizationName: 'Synthetic academy',
+  issuerAddress: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+  subjectAddress,
+  networkId: 1,
+  visibility: 'private',
+  createdAt: '2026-09-24T10:00:00Z',
+  creationTransactionHash: 'f'.repeat(64),
+  status: {
+    state: 'active',
+    accepted: true,
+    expiration: null,
+    deletedLedgerIndex: null,
+    deletionCause: null,
+  },
+  events: [],
+  disclosure: { publicFields: ['course'], fields: ['course', 'result'] },
+}
+
+async function session(page: Page, linked = true) {
+  await page.route('**/api/auth/session', (route) =>
+    route.fulfill({
+      json: {
+        enabled: true,
+        csrfToken: 'synthetic-simple-recipient',
+        user: {
+          id: '00000000-0000-4000-8000-000000000182',
+          email: 'synthetic@example.test',
+          displayName: 'Synthetic recipient',
+          roles: ['recipient'],
+          organizations: [],
+          wallets: linked
+            ? [
+                {
+                  id: '00000000-0000-4000-8000-000000000183',
+                  address: subjectAddress,
+                  networkId: 1,
+                  verifiedAt: '2026-09-24T10:00:00Z',
+                },
+              ]
+            : [],
+        },
+      },
+    }),
+  )
+}
+
+async function enter(page: Page, path: string) {
+  await page.goto('/')
+  await expect(page.locator('[data-client-ready="true"]')).toBeVisible({ timeout: 15_000 })
+  await page.evaluate(async (path) => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $router: { push: (path: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$router.push(path)
+  }, path)
+}
+
+test('continues a claimed invitation directly when a wallet is already linked', async ({
+  page,
+}) => {
+  await session(page)
+  let claims = 0
+  await page.route('**/api/issuer/invitations/preview', (route) =>
+    route.fulfill({
+      json: { organizationName: 'Synthetic academy', schemaName: 'Synthetic course' },
+    }),
+  )
+  await page.route('**/api/issuer/invitations/claim', (route) => {
+    claims += 1
+    return route.fulfill({ json: { ok: true } })
+  })
+  await enter(page, `/recipient/invitations#${'s'.repeat(43)}`)
+  await expect(
+    page.getByRole('button', { name: 'Claim with this account', exact: true }),
+  ).toBeVisible()
+  expect(claims).toBe(0)
+  await expect(page).toHaveURL(/\/recipient\/invitations$/)
+  await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+  await expect(page.getByText('Your wallet is already linked', { exact: false })).toBeVisible()
+  await expect(
+    page.getByRole('link', { name: 'Continue to my attestations', exact: true }),
+  ).toHaveAttribute('href', '/recipient')
+  await expect(
+    page.getByRole('link', { name: 'Prepare or manage my wallet', exact: true }),
+  ).toHaveCount(0)
+  expect(claims).toBe(1)
+})
+
+test('puts continuation before optional setup and wallet references for a returning recipient', async ({
+  page,
+}) => {
+  await session(page)
+  await enter(page, '/account?returnTo=%2Frecipient')
+  await expect(page.getByTestId('wallet-link-continue')).toBeVisible()
+  await expect(page.getByTestId('wallet-link-continue')).toHaveAttribute('href', '/recipient')
+  await expect(page.getByTestId('linked-wallets')).not.toBeVisible()
+  await expect(page.getByText(subjectAddress, { exact: true })).not.toBeVisible()
+  await page.getByText('Manage my wallet', { exact: true }).click()
+  await expect(page.getByTestId('linked-wallets')).toBeVisible()
+  await expect(page.getByTestId('linked-wallets')).toContainText(subjectAddress)
+})
+
+test('reads nested attestation content only on request and keeps references secondary', async ({
+  page,
+}) => {
+  await session(page)
+  let payloadReads = 0
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({ json: credential }),
+  )
+  await page.route('**/api/recipient/**/payload', (route) => {
+    payloadReads += 1
+    return route.fulfill({
+      json: {
+        scope: 'full',
+        claims: { course: 'Synthetic first aid', result: { grade: 'Synthetic distinction' } },
+        verification: {
+          onChain: 'active',
+          schema: 'valid',
+          payload: 'match',
+          issuerTrust: 'unknown',
+        },
+      },
+    })
+  })
+  await enter(page, `/recipient/credentials/${generationId}?profile=${profileId}`)
+  await expect(
+    page.getByRole('link', { name: 'Share this attestation', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByText(generationId, { exact: true })).not.toBeVisible()
+  await expect(page.locator('#subject-action')).toContainText('Remove the accepted')
+  await expect(
+    page.getByRole('button', {
+      name: 'Remove the accepted active or expired credential',
+      exact: true,
+    }),
+  ).not.toBeVisible()
+  expect(payloadReads).toBe(0)
+  await page.getByRole('button', { name: 'Read attestation content', exact: true }).click()
+  await expect(page.getByText('Synthetic distinction', { exact: true })).toBeVisible()
+  await expect(page.locator('main pre')).toHaveCount(0)
+  await expect(page.getByText(generationId, { exact: true })).not.toBeVisible()
+  expect(payloadReads).toBe(1)
+})
+
+test('updates the available action after the same page receives an accepted credential', async ({
+  page,
+}) => {
+  await session(page)
+  let accepted = false
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({
+      json: {
+        ...credential,
+        status: { ...credential.status, accepted, state: accepted ? 'active' : 'pending' },
+      },
+    }),
+  )
+  await enter(page, `/recipient/credentials/${generationId}?profile=${profileId}`)
+  await expect(page.getByRole('button', { name: 'Review credential', exact: true })).toBeVisible()
+  await expect(page.locator('#subject-action')).toContainText('Reject the unaccepted')
+  accepted = true
+  await page.evaluate(async () => {
+    const root = document.querySelector('#__nuxt') as Element & {
+      __vue_app__: {
+        config: { globalProperties: { $nuxt: { callHook: (hook: string) => Promise<void> } } }
+      }
+    }
+    await root.__vue_app__.config.globalProperties.$nuxt.callHook('app:data:refresh')
+  })
+  await expect(
+    page.getByRole('link', { name: 'Share this attestation', exact: true }),
+  ).toBeVisible()
+  await expect(page.getByRole('button', { name: 'Review credential', exact: true })).toHaveCount(0)
+  await expect(page.locator('#subject-action')).toContainText('Remove the accepted')
+  await expect(page.locator('#subject-action')).not.toContainText('Reject the unaccepted')
+})
+
+test('chooses disclosure before the wallet proof and never requests a signature without an audience', async ({
+  page,
+}) => {
+  await session(page)
+  let challenges = 0
+  await page.route(`**/api/recipient/credentials/${profileId}/${generationId}`, (route) =>
+    route.fulfill({ json: credential }),
+  )
+  await page.route('**/api/recipient/verifiers', (route) =>
+    route.fulfill({ json: { verifiers: [] } }),
+  )
+  await page.route('**/api/recipient/presentations?**', (route) =>
+    route.fulfill({ json: { presentations: [] } }),
+  )
+  await page.route('**/api/recipient/presentation-challenges', (route) => {
+    challenges += 1
+    return route.abort()
+  })
+  await enter(page, `/recipient/credentials/${generationId}/present?profile=${profileId}`)
+  await expect(page.getByRole('radio', { name: 'Public fields only', exact: true })).toBeChecked()
+  await expect(page.getByText(subjectAddress, { exact: true })).not.toBeVisible()
+  const scope = page.getByRole('group', { name: 'Disclosure scope', exact: true })
+  const proof = page.getByRole('region', {
+    name: 'Authorize this link with your wallet',
+    exact: true,
+  })
+  await expect(scope).toBeVisible()
+  expect(
+    await scope.evaluate((element) =>
+      Boolean(
+        element.compareDocumentPosition(
+          document.querySelector('[aria-label="Authorize this link with your wallet"]')!,
+        ) & Node.DOCUMENT_POSITION_FOLLOWING,
+      ),
+    ),
+  ).toBe(true)
+  await expect(proof).toBeVisible()
+  await page.getByRole('radio', { name: 'Complete content for one verifier', exact: true }).check()
+  await expect(
+    page.getByRole('button', { name: 'Create sharing link', exact: true }),
+  ).toBeDisabled()
+  expect(challenges).toBe(0)
+})
diff --git a/apps/web/e2e/wallet-menu.spec.ts b/apps/web/e2e/wallet-menu.spec.ts
index 4acbad7..0b9ef30 100644
--- a/apps/web/e2e/wallet-menu.spec.ts
+++ b/apps/web/e2e/wallet-menu.spec.ts
@@ -27,11 +27,13 @@ test('reopens the wallet chooser after disconnecting and navigating', async ({ p
   await expect(trigger).toHaveAttribute('aria-expanded', 'true')
   await page.locator('[data-wallet-id="xcs-browser-e2e"]').click()
   await expect(trigger).toContainText('rHb9CJ')
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
 
   await trigger.click()
   await expect(trigger).toContainText(/Connecter un wallet|Connect wallet/u)
+  await expect(page.getByTestId('wallet-status')).toHaveCount(0)
 
-  await page.goto('/accept')
+  await page.goto('/schemas')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.getByTestId('wallet-toggle').click()
   await expect(page.getByTestId('wallet-toggle')).toHaveAttribute('aria-expanded', 'true')
@@ -43,7 +45,7 @@ test('reopens the wallet chooser after disconnecting and navigating', async ({ p
 })
 
 test('keeps a dismissed wallet chooser closed after slow discovery', async ({ page }) => {
-  await page.goto('/studio')
+  await page.goto('/learn')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.evaluate(() => {
     const controls = globalThis as typeof globalThis & {
@@ -62,24 +64,63 @@ test('keeps a dismissed wallet chooser closed after slow discovery', async ({ pa
   await expect(trigger).toBeFocused()
 })
 
+test('shows pending approval, prevents duplicate connections and then shows the account', async ({
+  page,
+}) => {
+  await page.goto('/learn')
+  await page.locator('[data-client-ready="true"]').waitFor()
+  const trigger = page.getByTestId('wallet-toggle')
+  await trigger.click()
+  // Use one browser-clock timeline: host Date.now() can already be behind the
+  // installed clock by the time Playwright delivers pauseAt to the browser.
+  await page.clock.install({ time: new Date('2026-01-01T12:00:00Z') })
+  await page.clock.pauseAt(new Date('2026-01-01T12:01:00Z'))
+  await page.evaluate(() => {
+    ;(
+      globalThis as typeof globalThis & { __xcsBrowserE2eWalletDiscoveryDelayMs?: number }
+    ).__xcsBrowserE2eWalletDiscoveryDelayMs = 500
+  })
+  await page.locator('[data-wallet-id="xcs-browser-e2e"]').click()
+  await expect(trigger).toContainText('Connecting to')
+  await expect(page.getByTestId('wallet-pending')).toBeVisible()
+  await expect(page.getByRole('button', { name: 'Cancel connection', exact: true })).toBeEnabled()
+  await expect(page.locator('[data-wallet-id="xcs-browser-e2e-subject"]')).toBeDisabled()
+  await page.clock.runFor(600)
+  await expect(page.getByTestId('wallet-status')).toContainText('Connected')
+  await expect(trigger).toContainText('rHb9CJ')
+})
+
 test('shows transaction-specific Credential compatibility in the wallet chooser', async ({
   page,
 }) => {
-  await page.goto('/studio')
+  await page.goto('/learn')
   await page.locator('[data-client-ready="true"]').waitFor()
   await page.getByTestId('wallet-toggle').click()
 
   await expect(page.locator('[data-wallet-choice="gemwallet"]')).toContainText(
-    /Schémas uniquement|Schemas only/u,
+    /Credentials via raw signing — explicit approval required/u,
   )
   await expect(page.locator('[data-credential-support="unverified"]').first()).toContainText(
     /non validée|not validated/u,
   )
 })
 
+test('revokes a stale Otsu origin permission before the first explicit connection', async ({
+  page,
+}) => {
+  await page.goto('/learn')
+  await page.locator('[data-client-ready="true"]').waitFor()
+
+  const trigger = page.getByTestId('wallet-toggle')
+  await trigger.click()
+  await page.locator('[data-wallet-id="otsu"]').click()
+
+  await expect(trigger).toContainText('rHb9CJ')
+})
+
 test('keeps the wallet chooser inside a 320px viewport', async ({ page }) => {
   await page.setViewportSize({ width: 320, height: 720 })
-  await page.goto('/studio')
+  await page.goto('/learn')
   await page.locator('[data-client-ready="true"]').waitFor()
 
   await page.getByTestId('wallet-toggle').click()
diff --git a/apps/web/eslint.config.mjs b/apps/web/eslint.config.mjs
index d6dcc3d..f4cd90a 100644
--- a/apps/web/eslint.config.mjs
+++ b/apps/web/eslint.config.mjs
@@ -5,7 +5,7 @@ import withNuxt from './.nuxt/eslint.config.mjs'
 export default withNuxt(
   eslintConfigPrettier,
   {
-    ignores: ['.output/**', 'playwright-report/**', 'test-results/**'],
+    ignores: ['dist/**', '.output/**', 'playwright-report/**', 'test-results/**'],
   },
   {
     // The protocol code under `app/lib/xcs` and its suite under `test/lib/xcs`
diff --git a/apps/web/i18n/locales/en.json b/apps/web/i18n/locales/en.json
index 0942420..c36a2a1 100644
--- a/apps/web/i18n/locales/en.json
+++ b/apps/web/i18n/locales/en.json
@@ -1,4 +1,56 @@
 {
+  "auth": {
+    "account": "My XCS account",
+    "signIn": "Sign in to XCS",
+    "loginIntro": "Sign in with your organization’s identity provider to access your XCS account.",
+    "continue": "Continue to sign in",
+    "walletSeparate": "Your XCS account and your wallet connection are separate. Connecting a wallet does not sign you in to XCS.",
+    "disabled": "XCS account sign-in is not enabled on this deployment.",
+    "unavailable": "Account access is temporarily unavailable. Please try again later.",
+    "loginFailed": "Sign-in was not completed. Start a new sign-in request to try again.",
+    "backHome": "Back to Explorer",
+    "notAuthorized": "Access not authorized",
+    "notAuthorizedHelp": "Your account does not have the required organization role. Contact your organization administrator.",
+    "accountIntro": "Manage your identity, organization access and linked wallets.",
+    "profile": "Profile and session",
+    "name": "Name",
+    "email": "Email",
+    "personalRoles": "Account roles",
+    "sessionExpires": "Session expires",
+    "sessionMaximum": "Maximum session duration ends",
+    "extendSession": "Extend my session",
+    "sessionExtended": "Your session has been extended within its maximum duration.",
+    "signOut": "Sign out of XCS",
+    "signOutHelp": "This ends this XCS session. Your identity-provider session and wallet connection remain independent.",
+    "organizations": "Approved organizations",
+    "noOrganizations": "You do not currently have an approved organization membership.",
+    "issuerSpace": "Issuer space",
+    "issuerIntro": "Organizations where your account has an approved issuer role.",
+    "linkedWallets": "Linked wallets",
+    "walletLinkHelp": "Link a wallet by signing a one-time ownership message. This does not submit a transaction or grant an organization role.",
+    "masterKeyOnly": "XRPL Testnet only. GemWallet, MetaMask XRP Snap and Otsu are supported for linking. The signing key must derive the wallet address; regular-key and multisign accounts are not supported.",
+    "noWallets": "No wallets are linked to this account.",
+    "walletAddress": "Wallet address",
+    "network": "Network",
+    "verifiedAt": "Verified",
+    "actions": "Actions",
+    "unlink": "Unlink",
+    "unlinkAddress": "Unlink wallet {address}",
+    "walletUnlinked": "The wallet has been unlinked from your XCS account.",
+    "walletLinked": "The wallet has been linked to your XCS account.",
+    "connectFirst": "Connect a supported wallet using the wallet button above, then link it here.",
+    "walletUnsupported": "This wallet cannot provide a supported ownership proof on XRPL Testnet. Use GemWallet, MetaMask XRP Snap or Otsu.",
+    "alreadyLinked": "This Testnet wallet is already linked to your account.",
+    "linkCurrentWallet": "Link the connected wallet",
+    "walletChanged": "The wallet account, network or connection changed. Review the current wallet and try again.",
+    "actionFailed": "The action could not be completed. Check your session and wallet, then try again.",
+    "roles": {
+      "admin": "Administrator",
+      "recipient": "Recipient",
+      "issuer": "Issuer",
+      "verifier": "Verifier"
+    }
+  },
   "nav": {
     "main": "Main navigation",
     "skip": "Skip to main content",
@@ -15,6 +67,7 @@
     "accept": "Accept",
     "revoke": "Revoke",
     "verify": "Verify",
+    "wallet": "My credentials",
     "operations": "Operations",
     "learn": "Learn",
     "language": "Language"
@@ -28,6 +81,16 @@
   },
   "wallet": {
     "connect": "Connect wallet",
+    "connecting": "Connecting to {wallet}…",
+    "connected": "Connected",
+    "sessionChanged": "Crossmark changed the selected account or network. Reconnect to approve the new selection.",
+    "sessionRefreshFailed": "Crossmark could not confirm the current account and network. Unlock the wallet, select XRPL Testnet and reconnect.",
+    "disconnect": "Disconnect",
+    "approvalPending": "Approve the connection in {wallet}. Waiting for the wallet to confirm your account and Testnet network.",
+    "cancelConnection": "Cancel connection",
+    "disconnectFailed": "The wallet could not close its session. Close its pending request and reload this page before reconnecting.",
+    "connectionTimeout": "The wallet did not finish connecting. Close its pending request, unlock it, select XRPL Testnet and try again.",
+    "networkMismatch": "Connection not completed: select XRP Ledger Testnet in your wallet, then click Connect again. Wallet permission alone does not connect this site.",
     "choose": "Choose a compatible wallet",
     "available": "Available",
     "unavailable": "Not detected",
@@ -35,15 +98,42 @@
     "setup": "Install or open",
     "none": "No XRPL Connect adapter is configured.",
     "credentials": {
+      "raw": "Credentials via raw signing — explicit approval required",
       "supported": "Credential transactions supported",
-      "unsupported": "Schemas only — Credential transactions unsupported",
       "unverified": "Credential compatibility not validated"
     },
     "errors": {
-      "credentialUnsupported": "{wallet} cannot sign {transactionType}: its current version does not recognize XRPL Credential transactions yet. Reconnect with a wallet that supports them, such as Xaman when configured."
+      "credentialUnsupported": "{wallet} cannot sign {transactionType}: its current version does not recognize XRPL Credential transactions yet. Reconnect with a wallet that supports them, such as Xaman when configured.",
+      "otsuSigningAccountUnavailable": "Otsu is installed, but it cannot access the selected account’s signing key. Open and unlock Otsu, then reconnect it before retrying."
+    }
+  },
+  "walletSpace": {
+    "title": "My credentials",
+    "description": "Review credentials issued to the connected wallet and accept them from the existing subject workflow.",
+    "connectFirst": "Connect the recipient wallet to see credentials awaiting its decision.",
+    "address": "Connected subject",
+    "privacy": "This page reads Credential ledger objects directly from XRPL. The configured RPC sees the queried address and browser network metadata. Commons receives only exact XCS lookups; no payload claims are fetched.",
+    "loading": "Reading the connected wallet’s validated XRPL credentials…",
+    "error": "The wallet’s credentials could not be read reliably.",
+    "empty": "No unaccepted Credential is associated with this wallet on the validated ledger.",
+    "refresh": "Refresh",
+    "credential": "Credential awaiting a decision",
+    "reviewPending": "Review and accept",
+    "reviewExpired": "Review and reject",
+    "issuer": "Issuer",
+    "schema": "Schema UID",
+    "expiration": "Expiration",
+    "noExpiration": "No expiration",
+    "generation": "Generation ID",
+    "states": {
+      "pending": "Awaiting acceptance",
+      "expired": "Expired without acceptance"
     }
   },
   "transaction": {
+    "rawWarning": "GemWallet will display a coded message. Signing it authorizes this Testnet action and its fee; it is not a sign-in request. Review the action above before continuing.",
+    "rawConsent": "I reviewed this action and authorize its signature and displayed fee.",
+    "rawSign": "Raw sign and submit",
     "preview": "Review before signing",
     "confirmWarning": "Check the network, account, destination, fee and every field in your wallet.",
     "sign": "Sign and submit"
@@ -155,6 +245,9 @@
     "diplomaTemplate": "Diploma template",
     "schemaName": "Schema name",
     "schemaDescription": "Schema description",
+    "textBytes": "Required · {count}/{max} UTF-8 bytes · single line. Accents and emoji use multiple bytes.",
+    "descriptionInvalid": "Description is required: use a single line of 1–256 UTF-8 bytes. Remove line breaks or shorten the text; accents and emoji use multiple bytes.",
+    "nameInvalid": "Schema name is required: use a single line of 1–64 UTF-8 bytes.",
     "fields": "Fields",
     "fieldName": "Field name",
     "fieldType": "Field type",
@@ -189,6 +282,25 @@
     "requiredField": "Required field",
     "optionalField": "Optional field",
     "advancedClaimsHint": "Switch to JSON mode to review or enter the complete claims object directly.",
+    "hosted": {
+      "title": "Commons public payload storage",
+      "description": "The exact canonical payload will be served publicly from {origin}. Never include personal data, secrets or production data.",
+      "consent": "I approve publishing the exact payload displayed above at {url}, and keeping a recovery copy in this browser until publication succeeds or I remove it.",
+      "confirmExactPublication": "Publish this exact payload publicly at {url}?\n\n{payload}",
+      "publishAfterSignature": "After the credential is validated and indexed, its payload is published here and checked over public HTTPS.",
+      "publicationPending": "The signature and payload are saved in this browser. Publication requires ledger validation and indexing. You can return to Issue or Operations after reloading; retrying never creates another credential.",
+      "retryPublication": "Finish publication",
+      "recoveryTitle": "Attestations awaiting publication",
+      "recoveryDescription": "These public contents are saved in this browser. Retry once your transaction is confirmed. This does not request another signature or create another attestation.",
+      "recoveryUnavailable": "Payload recovery storage is unavailable, full or corrupted. Check browser storage and pending publications before signing again.",
+      "corruptRecovery": "One recovery copy is damaged and cannot be published. Other copies are unaffected. You can remove this damaged copy explicitly.",
+      "retryFailed": "Publication could not be completed. The recovery copy is retained.",
+      "journalCleanupFailed": "The payload is published and verified. Browser journal cleanup failed; the signed transaction may still be retained locally.",
+      "signatureMissing": "No signature was recorded. Check your wallet and activity history before issuing again; your content is saved here.",
+      "discardRecovery": "Remove recovery copy",
+      "discardConfirm": "Remove this browser recovery copy? This does not revoke a credential or delete a published payload. If publication is incomplete, keep the downloaded payload before removing it.",
+      "downloadRecovery": "Download saved content"
+    },
     "localStore": {
       "title": "Local demonstration storage",
       "mode": "Local test storage (this browser)",
@@ -211,6 +323,14 @@
       }
     },
     "errors": {
+      "hostedSize": "Public storage accepts at most 64 KiB of canonical UTF-8 payload. Reduce the claims before signing.",
+      "hostedConsent": "Explicitly approve the exact public payload and destination before continuing.",
+      "hostedUnavailable": "The public payload service is unavailable or is not configured with a valid HTTPS origin.",
+      "hostedBeforeSigning": "The payload host is unreachable. No signature was requested. Configure a working, fixed HTTPS address before issuing this credential.",
+      "hostedIntegrity": "The signed transaction, public URL and canonical payload do not match exactly.",
+      "hostedPii": "This public storage refuses claims whose field names look like personal data.",
+      "hostedQuota": "This wallet or network address reached the public payload publication limit.",
+      "hostedNotIndexed": "The signed CredentialCreate is not yet present in the authoritative index. Wait for ledger confirmation, then retry publication.",
       "httpsUrlRequired": "First enter the final public HTTPS URL where this payload will be published.",
       "httpsUrlPlaceholder": "issuer.example is an example address, not a hosting service. Replace it with a public HTTPS URL controlled by your organization.",
       "payloadFetchFailed": "The browser could not fetch the payload. Publish the downloaded JSON file unchanged at this public HTTPS URL with the application/json type, CORS allowed for this site and no redirect, then try again."
@@ -432,11 +552,17 @@
   },
   "accept": {
     "title": "Accept or remove a credential",
-    "description": "The subject accepts an unaccepted pending credential, rejects an unaccepted pending or expired credential, and removes an accepted active or expired credential.",
-    "notTruth": "Acceptance means retaining the Credential on your account; it does not certify that its claims are true.",
+    "description": "Review what was issued to your wallet, then accept or remove it.",
+    "notTruth": "Accepting adds this credential to your account. It does not prove its claims are true.",
     "action": "Action",
     "prepare": "Prepare transaction",
-    "review": "Load, review and prepare",
+    "review": "Review credential",
+    "checking": "Checking credential details…",
+    "acceptInWallet": "Accept in wallet",
+    "walletNext": "Your wallet will ask you to sign. Nothing is accepted until you confirm there.",
+    "technicalDetails": "Technical details",
+    "retry": "Retry verification",
+    "payloadMismatch": "These details do not match the credential. Acceptance is blocked; ask the issuer to check them.",
     "fetchAndPrepare": "Fetch payload and prepare",
     "acceptAction": "Accept the pending credential",
     "rejectAction": "Reject the unaccepted pending or expired credential",
@@ -445,18 +571,18 @@
     "expiration": "Expiration",
     "noExpiration": "No expiration",
     "generation": "Generation ID",
-    "state": "Re-read indexed state",
+    "state": "Status",
     "acceptedFlag": "Re-read accepted flag",
-    "publicClaims": "Public claims",
-    "payloadConsentIntro": "The next step contacts {host} directly from this browser. That host can observe your IP address and request time.",
-    "localPayloadConsentIntro": "The next step reads the demonstration payload stored in this browser. No external host is contacted, but the content is neither public nor available on another device.",
-    "payloadConsent": "I explicitly consent to fetching this public payload from the displayed host.",
-    "localPayloadConsent": "I explicitly consent to reading and verifying this demonstration payload in this browser.",
+    "publicClaims": "Credential details",
+    "payloadConsentIntro": "Details are hosted on {host}. Loading them shares your IP address and request time with that host.",
+    "localPayloadConsentIntro": "These test details are stored only in this browser.",
+    "payloadConsent": "Load and verify these details",
+    "localPayloadConsent": "Load and verify these test details",
     "localPayloadUnavailable": "This IPFS CID is unavailable in this browser’s demonstration store. Acceptance is blocked here.",
-    "payloadUnavailable": "The payload cannot be safely reviewed. Acceptance is blocked, but a pending credential may still be rejected.",
-    "issuerUnknown": "XCS has no trust decision for this issuer. Unknown does not mean trusted or untrusted.",
-    "issuerAcknowledgement": "I independently recognize the displayed issuer address and choose to accept this exact credential generation.",
-    "issuerAcknowledgementRequired": "Confirm your own trust decision for this exact unknown issuer generation before accepting.",
+    "payloadUnavailable": "The credential details could not be verified. Retry, or ask the issuer to check the link.",
+    "issuerUnknown": "XCS has not verified this issuer’s identity.",
+    "issuerAcknowledgement": "I recognize this issuer and want to accept this credential.",
+    "issuerAcknowledgementRequired": "Confirm that you recognize the issuer to continue.",
     "issuerAcknowledgementStale": "The issuer trust context changed. Review it and confirm your decision again.",
     "issuerUntrusted": "This verifier's local policy marks the issuer as untrusted. Acceptance is blocked.",
     "subjectWalletMismatch": "The connected wallet is not the subject of this credential. Disconnect it and connect the recipient wallet before accepting, rejecting or removing this generation.",
@@ -536,5 +662,722 @@
   "footer": {
     "summary": "XCS v0.1 — open standard and MIT reference implementation.",
     "navigation": "Footer links"
+  },
+  "admin": {
+    "navigation": "Administrator navigation",
+    "queue": "Applications",
+    "queueIntro": "Review pending organization applications, oldest first.",
+    "verifiers": "Verifier access",
+    "verifiersIntro": "Manage approved and suspended verifier access to the application.",
+    "audit": "Audit history",
+    "auditIntro": "Decisions, their authors and notification delivery. Decisions remain recorded even when email delivery fails.",
+    "reviewTitle": "Review application",
+    "reviewIntro": "Review the organization and its evidence before granting application access.",
+    "organization": "Organization",
+    "role": "Requested role",
+    "currentStatus": "Current status",
+    "submitted": "Submitted",
+    "filterRole": "Filter by role",
+    "allRoles": "All roles",
+    "review": "Review",
+    "reviewNamed": "Review {name}",
+    "manage": "Manage access",
+    "emptyQueue": "No applications to review.",
+    "emptyVerifiers": "No approved or suspended verifiers.",
+    "emptyHistory": "No decisions recorded.",
+    "operatorAction": "Operator action",
+    "pagination": "Application pagination",
+    "previous": "Previous",
+    "next": "Next",
+    "page": "Page {page} of {total}",
+    "retry": "Try again",
+    "back": "Back to list",
+    "website": "Website",
+    "contact": "Contact",
+    "jurisdiction": "Jurisdiction",
+    "responsible": "Responsible person",
+    "description": "Organization profile",
+    "purpose": "Intended use",
+    "noEmail": "No verified email available",
+    "documents": "Supporting documents",
+    "documentHelp": "PDF, PNG and JPEG only. Authorized links are tied to your session and expire after five minutes.",
+    "document": "Document {number}",
+    "bytes": "{count} bytes",
+    "noDocuments": "No supporting documents.",
+    "prepareDocument": "Prepare secure link",
+    "renewLink": "Renew secure link",
+    "openDocument": "Open document (new tab)",
+    "linkExpires": "Link expires: {date}",
+    "documentFailure": "The document could not be opened. It may be missing, invalid or no longer authorized. Your application review is preserved; retry the document separately.",
+    "walletCaveat": "These wallets belong to the responsible person. A wallet ownership proof does not establish the identity of the organization. No XRPL transaction is needed for this review.",
+    "approvalCaveat": "Approval grants the selected application role. It does not endorse the organization’s claims.",
+    "privateClaims": "Private claims remain under recipient control. Administrator access and verifier approval do not grant access to private claims.",
+    "decision": "Access decision",
+    "revision": "Decision revision",
+    "lastReason": "Latest reason",
+    "checklist": {
+      "title": "Review checklist",
+      "organization": "Organization",
+      "role": "Requested role",
+      "responsible": "Responsible person",
+      "documents": "Supporting documents",
+      "wallet": "Declared wallet",
+      "history": "Decision history",
+      "complete": "Available",
+      "attention": "Needs attention"
+    },
+    "applicationHistory": "Application history",
+    "reasonRequired": "Reason (required)",
+    "reasonOptional": "Reason (optional)",
+    "missingReason": "Enter a reason before confirming.",
+    "confirm": "Confirm decision",
+    "confirmDecision": "Confirm “{action}” for {name}, role: {role}.",
+    "noDecision": "No further decision is available for this application.",
+    "decisionRecorded": "Decision recorded. Email delivery is tracked separately in audit history.",
+    "reviewCurrent": "Reload and review the current decision",
+    "ambiguousDecision": "The outcome of this request is unknown. Retry the same decision to retrieve or complete it safely. Its original details and request identifier are preserved.",
+    "retryDecision": "Retry the same decision",
+    "notification": "Notification",
+    "notificationQueued": "Notification queued for delivery. The original decision is unchanged.",
+    "retryNotification": "Retry notification",
+    "blockedHelp": "Delivery is blocked until the responsible person has a verified email. Do not repeat the decision.",
+    "uncertainHelp": "Delivery may have succeeded before an interruption. An operator must check the SMTP delivery record before any further send. Automatic retry is disabled.",
+    "status": {
+      "pending": "Pending",
+      "approved": "Approved",
+      "rejected": "Declined",
+      "suspended": "Suspended"
+    },
+    "actions": {
+      "approve": "Approve access",
+      "reject": "Decline access",
+      "suspend": "Suspend access",
+      "restore": "Restore access"
+    },
+    "notifications": {
+      "pending": "Pending",
+      "sending": "Sending",
+      "sent": "Sent",
+      "failed": "Failed",
+      "blocked": "Blocked: no verified email",
+      "uncertain": "Delivery uncertain"
+    },
+    "errors": {
+      "session": "Your session has expired. Sign in again to continue.",
+      "forbidden": "Access denied. Your account no longer has the administrator permission required for this action.",
+      "missing": "This application or document is unavailable.",
+      "conflict": "Another decision was already recorded. Review the current decision before taking any further action.",
+      "unavailable": "The administration service is temporarily unavailable. Try again later.",
+      "generic": "The request could not be completed. Check the connection and try again."
+    },
+    "title": "Administration"
+  },
+  "issuer": {
+    "navigation": "Issuer navigation",
+    "schemas": "Schemas",
+    "recipients": "Recipients",
+    "credentials": "Credentials",
+    "settings": "Settings",
+    "intro": "Manage your organization’s attestations.",
+    "organization": "Organization",
+    "error": "This action could not be completed. Refresh to check the current state before trying again.",
+    "retry": "Refresh",
+    "loading": "Loading…",
+    "approvalRequired": "Current organization approval is required.",
+    "application": "Application status",
+    "publishSchema": "Publish a schema",
+    "noSchemas": "No schemas published by this organization yet.",
+    "invite": "Invite a recipient",
+    "inviteHelp": "Anyone holding the invitation may claim it after signing in. Review the actual claimant and linked wallet before issuing.",
+    "email": "Delivery email",
+    "chooseSchema": "Choose one of your schemas",
+    "message": "Optional message",
+    "sendInvite": "Send invitation",
+    "noInvites": "No invitations yet.",
+    "delivery": "Email delivery",
+    "uncertain": "Delivery could not be confirmed. Check the mailbox before resending; a resend replaces the previous claim link.",
+    "reviewRecipient": "Review recipient and issue",
+    "resend": "Replace and resend link",
+    "revokeInvite": "Revoke invitation",
+    "resendConfirm": "Replace the previous link and send a new invitation?",
+    "revokeConfirm": "Revoke this invitation? This does not revoke a credential already on the ledger.",
+    "confirm": "Confirm",
+    "cancel": "Cancel",
+    "noCredentials": "No credentials issued yet.",
+    "attestation": "Attestation",
+    "open": "Open details",
+    "recorded": "Action recorded. Check delivery and ledger status below.",
+    "apply": "Apply as an issuer",
+    "applyHelp": "Describe your organization and provide supporting documents for review.",
+    "documents": "Supporting documents",
+    "documentsHelp": "One to three PDF, PNG or JPEG files, up to 5 MiB each.",
+    "reviewPrivacy": "These documents are private and available to administrators for application review. They are not credential claims.",
+    "submit": "Submit application",
+    "applicationError": "Application not submitted. Check the fields and document formats, then refresh your application status before trying again.",
+    "approvalMeaning": "Approval grants portal access. It does not endorse an organization’s claims.",
+    "noApplications": "You have no issuer application yet.",
+    "pendingHelp": "An administrator will review your application. Issuance remains unavailable while it is pending.",
+    "declinedHelp": "Review the decision above. This organization cannot issue through the portal.",
+    "openWorkspace": "Open issuer workspace",
+    "settingsHelp": "Review your application and manage the wallets linked to your account.",
+    "claimTitle": "Claim an invitation",
+    "claimHelp": "Claiming connects this invitation to your account. It neither issues nor accepts an XRPL credential.",
+    "claimLogin": "Sign in to continue. This invitation will open again automatically after sign-in.",
+    "claimUnavailable": "This invitation is unavailable, expired, revoked or already claimed. Ask the issuer for a new link if needed.",
+    "claimedHelp": "Invitation claimed. Link your wallet in your account so the issuer can review it before issuing.",
+    "claim": "Claim with this account",
+    "fields": {
+      "name": "Organization name",
+      "website": "Website",
+      "contact": "Contact email",
+      "jurisdiction": "Jurisdiction",
+      "description": "About the organization",
+      "purpose": "Purpose of issuing"
+    },
+    "states": {
+      "pending": "Pending review",
+      "approved": "Approved",
+      "rejected": "Declined",
+      "suspended": "Suspended",
+      "revoked": "Revoked",
+      "claimed": "Claimed",
+      "expired": "Expired",
+      "unclaimed": "Waiting for recipient",
+      "issued": "Issued, waiting for acceptance",
+      "accepted": "Accepted",
+      "unavailable": "State unavailable",
+      "inactive": "Inactive",
+      "declined": "Declined by recipient"
+    },
+    "deliveryStates": {
+      "pending": "Pending",
+      "sending": "Sending",
+      "sent": "Sent",
+      "failed": "Failed",
+      "blocked": "Blocked",
+      "uncertain": "Unconfirmed",
+      "superseded": "Replaced",
+      "cancelled": "Cancelled"
+    },
+    "engine": {
+      "schema": "Schema",
+      "recipient": "Actual claimant",
+      "deliveryContact": "Invitation delivery contact",
+      "linkedWallet": "Verified recipient wallet",
+      "visibility": "Who can see the claims?",
+      "private": "Private",
+      "public": "Public",
+      "publicWarning": "Public claims can be copied by anyone and cannot be made private later.",
+      "publicFields": "Fields visible to anyone",
+      "publicPreview": "Anyone with the link",
+      "privatePreview": "Authorized people",
+      "onChainPublic": "Ledger metadata and the payload digest remain public.",
+      "savePending": "The ledger transaction succeeded. Save its application record without signing again.",
+      "retrySave": "Retry recording",
+      "saved": "Application record saved",
+      "openCredential": "Open the credential",
+      "confirmRevoke": "Confirm revocation of “{schema}” for {recipient}",
+      "walletRequired": "The recipient must link a wallet before issuance.",
+      "loading": "Loading…",
+      "back": "Back to workspace",
+      "error": "The operation could not be completed. Refresh and review its current status.",
+      "chooseWallet": "Choose a verified wallet",
+      "visibilityReviewed": "I reviewed these public and private fields",
+      "restartFailedOperation": "Start again after confirmed failure",
+      "failedOperation": "The original transaction expired or failed on the validated ledger. A new wallet approval is required."
+    },
+    "visibility": {
+      "public": "Public",
+      "private": "Private"
+    }
+  },
+  "recipient": {
+    "title": "My attestations",
+    "intro": "Receive, review and share attestations linked to your XCS account.",
+    "refresh": "Refresh",
+    "error": "Your attestations could not be loaded. Check your session and try again; signing is unavailable until current evidence can be checked.",
+    "notifications": "Recent updates",
+    "notification": {
+      "issued": "{issuer} issued an attestation for you.",
+      "revoked": "An attestation from {issuer} is no longer active."
+    },
+    "empty": "No attestations yet. Open an invitation from your issuer to get started.",
+    "waiting": "Waiting for issuance",
+    "waitingHelp": "Your issuer is preparing the attestation. Keep your wallet linked; you do not need to claim the invitation again.",
+    "invitationInactive": "This invitation is no longer active. Contact your issuer.",
+    "credential": "Attestation",
+    "ready": "Ready to accept",
+    "accepted": "Accepted",
+    "inactive": "Inactive or unavailable",
+    "noItems": "No attestations in this section.",
+    "visibility": {
+      "public": "This attestation was published publicly.",
+      "private": "Private content is restricted to authorized viewers."
+    },
+    "open": "Open attestation",
+    "back": "Back to my attestations",
+    "reviewHelp": "Read the issuer and wallet details first. Reading the content requires your consent. You may decline without opening the content.",
+    "present": "Share this attestation",
+    "inactiveHelp": "Sharing is available only for an active, accepted attestation. Review the current lifecycle before taking action.",
+    "evidence": "Ledger evidence",
+    "issuerWallet": "Issuer wallet",
+    "subjectWallet": "Recipient wallet",
+    "generation": "Attestation reference",
+    "readContent": "Read attestation content",
+    "readHelp": "This explicitly requests the complete content from this portal. Your account must still own this attestation.",
+    "readError": "Content could not be checked. Try again when current evidence is available."
+  },
+  "presentation": {
+    "title": "Shared attestation",
+    "createTitle": "Share deliberately",
+    "createHelp": "Choose which fields to disclose and who may access the private details.",
+    "actionError": "Sharing could not be updated. Refresh the attestation and check your session before trying again.",
+    "scope": "Disclosure scope",
+    "public": "Public fields only",
+    "full": "Complete content for one verifier",
+    "verifier": "Designated verifier organization",
+    "chooseVerifier": "Choose an approved verifier",
+    "noVerifiers": "No approved verifier is available. You can still share the public fields.",
+    "preview": "Sharing preview",
+    "fullAudience": "Complete content will be accessible only to the approved verifier: {verifier}.",
+    "publicAudience": "Anyone opening this link may see the public fields.",
+    "publicStillVisible": "Other visitors may still see the public fields. A forwarded link does not authorize another verifier to see private details.",
+    "fields": "Fields included in this scope",
+    "noFields": "No fields are disclosed in this view.",
+    "duration": "Sharing has no automatic expiry. You can revoke the link at any time. Credential expiry and verifier approval still apply.",
+    "create": "Create sharing link",
+    "existing": "Your sharing grants",
+    "none": "No sharing grants yet.",
+    "revoke": "Revoke this link",
+    "revoked": "Link revoked",
+    "revokeHelp": "Revoking a link stops future access. It does not revoke the attestation or erase copies someone has already seen.",
+    "shareLink": "Sharing link",
+    "copyOnce": "Copy this link before leaving the page; it is shown only once. Send it to the person who needs to check your attestation.",
+    "qrAlt": "QR code for this sharing link",
+    "copy": "Copy link",
+    "share": "Share link",
+    "copied": "Link copied.",
+    "shared": "Link shared.",
+    "copyFailed": "Copying was unavailable. Select the link and copy it manually.",
+    "limitation": "These checks confirm the available records and signatures. They do not guarantee that the issuer’s statements are true.",
+    "partialHelp": "Only the shared information is shown. The complete content has not been independently checked in this view.",
+    "fullFields": "Authorized complete content",
+    "publicFields": "Public fields",
+    "authorizationHelp": "Private details require both an approved verifier organization and a sharing grant addressed to that organization. Signing in or receiving approval alone does not grant access.",
+    "audienceIncorrect": "You are signed in, but your organization is not the approved audience for the private content. The public fields remain visible.",
+    "openHelp": "Open a sharing link to request its current evidence and the fields you are allowed to see.",
+    "open": "Open presentation",
+    "checkAgain": "Check again",
+    "unusableHelp": "This link is unavailable or has been revoked. Ask the recipient for a new link.",
+    "unavailableHelp": "Current evidence could not be checked. No earlier result should be treated as current.",
+    "failureHelp": {
+      "invalid": "This sharing link is invalid. Ask the recipient for a new complete link.",
+      "revoked": "The recipient revoked this sharing link. Ask them to create a new one.",
+      "holderProof": "The recipient wallet proof for this link is missing or invalid. Ask the recipient to create a new link.",
+      "unavailable": "Current evidence could not be checked. Retry without pasting the link again."
+    },
+    "headlines": {
+      "invalid": "Invalid sharing link",
+      "revoked": "Sharing link revoked",
+      "holderProof": "Recipient proof unavailable",
+      "unavailable": "Cannot verify now",
+      "pending": "Not yet accepted",
+      "notFound": "Attestation not found",
+      "expired": "Attestation expired",
+      "deleted": "Attestation no longer active",
+      "schemaInvalid": "Attestation format invalid",
+      "tampered": "Content mismatch",
+      "contentInvalid": "Invalid content",
+      "untrusted": "Issuer not trusted",
+      "schemaUnknown": "Attestation format not verified",
+      "contentUnavailable": "Content unavailable",
+      "partial": "Partially checked",
+      "unknownIssuer": "Issuer trust not established",
+      "passed": "Checks passed"
+    },
+    "limit": "Revoke an active presentation before creating another (limit: 200)."
+  },
+  "verifier": {
+    "title": "Verifier space",
+    "intro": "Follow your application and revisit your organization’s verification records.",
+    "apply": "Apply as a verifier",
+    "applyHelp": "Describe your organization and why it needs to inspect shared attestations.",
+    "approvalMeaning": "Approval permits this organization to act as a verifier in the portal. It is not issuer endorsement and does not grant access to private claims without the recipient’s designated sharing grant.",
+    "pendingHelp": "Your application is awaiting administrator review. After approval, a recipient must still designate your organization when sharing private content.",
+    "noApplications": "You have no verifier applications yet. Public evidence remains available without an approved verifier role.",
+    "error": "The verifier workspace could not be loaded. Check your session and try again.",
+    "history": "Verification history",
+    "historyHelp": "These are past results, not current proof. Reopening checks the link, your authorization and current ledger evidence again. This history stores no claims or reusable sharing tokens.",
+    "export": "Export history as CSV",
+    "emptyHistory": "No checks recorded. Open a sharing link to verify an attestation.",
+    "checkedAt": "Checked at",
+    "previousResult": "Result at that time",
+    "reopen": "Check again",
+    "reopenError": "This record could not be reopened. The link or your authorization may have changed, or current evidence is unavailable.",
+    "currentResult": "Current verification result"
+  },
+  "roleJourney": {
+    "walletTitle": "Prepare your recipient wallet",
+    "walletIntro": "Link a wallet you control so your issuer can send the attestation to the correct address.",
+    "walletGuide": "From a new wallet to an attestation",
+    "setupTitle": "Choose and set up a compatible wallet",
+    "setupHelp": "Use the chooser below and its installation link if needed. Create or open your wallet in its own application, then return here. GemWallet, MetaMask XRP Snap and Otsu support this ownership proof.",
+    "backupTitle": "Keep your recovery information private",
+    "backupHelp": "Follow the wallet’s backup instructions and keep its recovery phrase or private key in a safe place. Never enter them in XCS or send them to your issuer. XCS only asks your wallet to sign a message.",
+    "networkTitle": "Select XRPL Testnet and prepare for fees",
+    "networkHelp": "Select Testnet in your wallet. Attestation acceptance needs test XRP for ledger fees and reserves; use your wallet’s Testnet funding instructions if needed. Linking the wallet here sends no transaction and transfers no funds.",
+    "proofTitle": "Connect, then prove control",
+    "chooseCompatibleWallet": "Choose a wallet for this proof",
+    "walletSelectionHelp": "Connecting and linking are separate steps. If another wallet is connected, disconnect it before choosing one of the compatible wallets.",
+    "connectFirst": "Connect a compatible wallet with the chooser above, then sign the ownership message below.",
+    "walletReady": "A Testnet wallet is linked to your account. Your issuer can now review this verified address before issuing.",
+    "continueRecipient": "Continue to my attestations",
+    "prepareWallet": "Prepare or manage my wallet",
+    "walletRequiredBeforeIssuance": "Link a wallet before your issuer can issue this attestation. Choose “Prepare or manage my wallet” above; you do not need to claim this invitation again.",
+    "shareProofTitle": "Authorize this link with your wallet",
+    "shareProofHelp": "Each new sharing link requires a fresh ownership message signed by the attestation’s recipient wallet. The message identifies this attestation, the selected scope and its audience. This does not submit a transaction or transfer funds.",
+    "shareConnectWallet": "Connect the recipient wallet shown above with GemWallet, MetaMask XRP Snap or Otsu before creating the link.",
+    "proofFailed": "The wallet proof was cancelled, expired or could not be verified. Check the wallet, scope and audience, then create a new request. No link is shown until its creation is confirmed.",
+    "recipientStates": {
+      "invited": "Waiting for the recipient to claim",
+      "wallet_required": "Recipient must link a wallet",
+      "ready": "Recipient ready to receive the attestation",
+      "issued": "Attestation already issued",
+      "unavailable": "Recipient readiness unavailable — refresh before issuing"
+    },
+    "walletVerifiedAt": "Wallet control verified on {date}",
+    "deliveryIsContact": "This email delivers the invitation; it is not proof of the claimant’s identity. Check the actual recipient and verified wallet before signing.",
+    "admissionTitle": "Who issued it?",
+    "admissionStatuses": {
+      "approved": "Issuer organization approved for this portal",
+      "suspended": "Issuer portal approval suspended",
+      "not_approved": "Issuer organization is not currently approved",
+      "unknown": "Issuer portal approval could not be established"
+    },
+    "admissionReviewedAt": "Application decision: {date}",
+    "checkedAt": "Checked on {date}",
+    "admissionMeaning": "Approval allows this organization to issue here. It does not guarantee the accuracy of its attestations.",
+    "holderProofTitle": "Who authorized this link?",
+    "holderVerifiedAt": "Wallet signature verified when this link was authorized on {date}",
+    "holderProofMissing": "No signed wallet proof was provided for this link.",
+    "holderProofMeaning": "This proves control of the recipient’s wallet when the link was signed. It does not identify the person opening the link today.",
+    "signedProofDetails": "Signed ownership evidence",
+    "ledgerRecipientTitle": "Has it been accepted?",
+    "ledgerStatuses": {
+      "active": "The recipient accepted this attestation with their wallet.",
+      "pending": "The recipient has not yet accepted this attestation.",
+      "expired": "This attestation has expired.",
+      "deleted": "This attestation is no longer active.",
+      "unknown": "Current ledger evidence is unavailable."
+    },
+    "holderProofRecreate": "Ask the recipient to create a new link with a fresh wallet signature.",
+    "holderKeyLimit": "The signing public key derives this wallet address. This is a master-key address check; it does not establish whether master-key signing was enabled on the ledger at that time. It does not prove a civil identity."
+  },
+  "portal": {
+    "nextAction": "Your next action",
+    "retry": "Retry",
+    "walletRequired": "Link an issuer wallet before continuing.",
+    "issuer": {
+      "title": "Issuer portal",
+      "lead": "Continue from the one action that currently moves your organization forward."
+    },
+    "errors": {
+      "unavailable": "This space is temporarily unavailable.",
+      "unchanged": "When this failure is reported, no portal state was changed."
+    },
+    "actions": {
+      "apply": {
+        "title": "Apply to the Commons",
+        "help": "Describe your organization and provide its review documents.",
+        "cta": "Start the application"
+      },
+      "awaitApproval": {
+        "title": "Wait for the Commons decision",
+        "help": "Your application is under review. Refresh this page after you receive the decision.",
+        "cta": "Refresh"
+      },
+      "linkWallet": {
+        "title": "Link the issuer wallet",
+        "help": "Prove control of the Testnet wallet your organization will use to sign issuance actions.",
+        "cta": "Prepare the issuer wallet"
+      },
+      "createTemplate": {
+        "title": "Create an attestation template",
+        "help": "Give the template a business name, category and readable fields.",
+        "cta": "Create the first template"
+      },
+      "invite": {
+        "title": "Invite a recipient",
+        "help": "Choose a template and send one secure invitation by email.",
+        "cta": "Invite a recipient"
+      },
+      "awaitRecipient": {
+        "title": "Wait for the recipient",
+        "help": "The recipient must claim the invitation and prove control of their wallet before issuance.",
+        "cta": "Refresh"
+      },
+      "issue": {
+        "title": "Prepare the attestation",
+        "help": "The recipient is ready. Review the readable content and visibility before asking your wallet to sign.",
+        "cta": "Prepare the attestation"
+      },
+      "review": {
+        "title": "Review the attestation",
+        "help": "Check the issuer, content and visibility before taking a wallet action.",
+        "cta": "Review"
+      },
+      "accept": {
+        "title": "Accept the attestation",
+        "help": "Your wallet will show the action before you approve it.",
+        "cta": "Accept"
+      },
+      "share": {
+        "title": "Share the attestation",
+        "help": "Choose public or complete data and, for complete data, its recipient organization.",
+        "cta": "Share"
+      },
+      "done": {
+        "title": "Current issuer work is complete",
+        "help": "You can invite another recipient or review existing attestations.",
+        "cta": "Invite another recipient"
+      }
+    },
+    "walletProgress": {
+      "title": "Wallet preparation progress",
+      "prepare": "Prepare the wallet",
+      "connect": "Connect it",
+      "prove": "Prove control",
+      "ready": "Ready",
+      "prepared": "I have prepared my wallet",
+      "issuerIntro": "Link the Testnet wallet your organization controls. XCS never asks for or stores its private key.",
+      "continueIssuer": "Continue to the issuer portal"
+    },
+    "invitationProgress": {
+      "title": "Invitation progress",
+      "email": "Email sent",
+      "claimed": "Link claimed",
+      "wallet": "Wallet verified",
+      "issuance": "Attestation issued"
+    },
+    "progress": {
+      "complete": "Complete",
+      "current": "Current step",
+      "pending": "Pending",
+      "attention": "Needs attention"
+    },
+    "recipient": {
+      "showAndVerify": "Show and verify the content",
+      "shareNow": "Share this attestation"
+    },
+    "admission": {
+      "approved": "Currently admitted by the Commons",
+      "suspended": "Commons admission suspended",
+      "not_approved": "Not currently admitted by the Commons",
+      "unknown": "Commons admission unavailable"
+    }
+  },
+  "simpleUi": {
+    "technicalDetails": "Technical details",
+    "notProvided": "Not provided",
+    "yes": "Yes",
+    "no": "No",
+    "issuedBy": "Issued by {name}",
+    "walletWillAsk": "Your wallet will ask you to approve this action. Check the information you reviewed before confirming.",
+    "testNetwork": "Test network — no real XRP",
+    "checkNetwork": "Check the selected network in your wallet.",
+    "fee": "Network fee: {fee} XRP",
+    "feeUnknown": "Network fee unavailable. Check the complete request before signing.",
+    "signActions": {
+      "issue": "Send this attestation to the selected recipient",
+      "accept": "Accept this attestation in your wallet",
+      "remove": "Remove this attestation from the recipient’s wallet",
+      "payment": "Authorize the payment shown below",
+      "other": "Authorize the reviewed action"
+    },
+    "finalityTitle": "Progress",
+    "recorded": "Your signature has been recorded",
+    "completed": "Completed — your change is available",
+    "rejected": "The request could not be completed",
+    "mismatch": "The result does not match your request",
+    "processing": "Finishing your request…",
+    "noRepeat": "Your signature was received. Do not sign again; the application is checking the result.",
+    "rejectedHelp": "Check the result before trying again. The signed transaction was recorded, but the attestation update was not accepted.",
+    "receivedLink": "Link received from the recipient",
+    "receivedLinkHelp": "Paste the complete sharing link. You do not need an address, reference number or wallet to see its public information.",
+    "invalidLink": "Use a complete sharing link from this XCS site. Ask the recipient for a new link if needed.",
+    "verifyLink": "Verify the attestation",
+    "paymentAmount": "Payment: {amount} XRP",
+    "states": {
+      "active": "Accepted",
+      "pending": "Awaiting acceptance",
+      "expired": "Expired",
+      "deleted": "No longer active",
+      "not_found": "Not found",
+      "unknown": "Unable to check"
+    },
+    "attestationType": "Type of attestation",
+    "saveError": "Saving could not be completed. Check the request’s status before trying again.",
+    "pendingPublication": "Attestation to finish publishing ({number})",
+    "signedPublicationPending": "Your signature is saved. Publication still needs confirmation."
+  },
+  "simpleIssuer": {
+    "sections": {
+      "schemas": "Attestation templates",
+      "recipients": "Recipients",
+      "credentials": "Attestations",
+      "settings": "Settings"
+    },
+    "nav": {
+      "schemas": "Templates",
+      "recipients": "Recipients",
+      "credentials": "Attestations",
+      "settings": "Settings"
+    },
+    "model": "Attestation template",
+    "createModel": "Create a template",
+    "modelTitle": "Create an attestation template",
+    "modelLead": "Choose the information that each attestation will contain. You can reuse this template for other recipients.",
+    "guided": "Edit the form",
+    "advanced": "Advanced options",
+    "technical": "Technical details",
+    "editJson": "Edit JSON",
+    "modelName": "Template name",
+    "modelDescription": "What does this template attest?",
+    "shortName": "Use a short name on one line.",
+    "shortDescription": "Write a brief description on one line.",
+    "nameInvalid": "Enter a shorter template name on a single line.",
+    "descriptionInvalid": "Enter a shorter description on a single line.",
+    "fields": "Information to include",
+    "fieldName": "Information name",
+    "fieldType": "Answer format",
+    "optional": "Optional",
+    "addField": "Add information",
+    "removeField": "Remove",
+    "fieldsInvalid": "Check the information names and formats. Each name must be unique.",
+    "fieldTypes": {
+      "string": "Text",
+      "bool": "Yes or no",
+      "uint": "Whole number, zero or above",
+      "int": "Whole number",
+      "bytes": "Binary data",
+      "address": "Account address",
+      "array": "List",
+      "object": "Group of information"
+    },
+    "reviewModel": "Review the template",
+    "publishModel": "Sign and publish the template",
+    "modelReview": "Check your template",
+    "publicModel": "This template will be public. Once published, changes require a new template. Do not include personal information.",
+    "openModels": "View my templates",
+    "noModels": "Create a template before inviting your first recipient.",
+    "issueTitle": "Prepare an attestation",
+    "issueLead": "Check the recipient, fill in the information and choose who can see it.",
+    "recipient": "Recipient",
+    "recipientFallback": "Recipient who claimed this invitation",
+    "accountDetails": "Verified account details",
+    "information": "Attestation information",
+    "reviewIssue": "Review before sending",
+    "sendIssue": "Sign and send the attestation",
+    "reviewTitle": "Check the information to be sent",
+    "visibility": "Who can read this information?",
+    "private": "Recipient and authorized people",
+    "public": "Everyone",
+    "publicFields": "Information visible on a public sharing link",
+    "publicPreview": "Visible to everyone with the link",
+    "privatePreview": "Only for authorized people",
+    "publicWarning": "Anyone can copy public information. It cannot be made private afterwards.",
+    "publicMetadata": "The existence of the attestation and the issuer and recipient accounts remain public.",
+    "visibilityReviewed": "I have checked who can see each piece of information.",
+    "expiration": "Valid until (optional)",
+    "download": "Download a technical copy",
+    "sendSuccess": "Attestation sent",
+    "nextAcceptance": "The recipient can now review and accept it.",
+    "openAttestation": "View the attestation",
+    "error": "This action could not be completed. Check the current state before trying again.",
+    "fieldError": "Check the information entered before continuing.",
+    "invite": "Invite a recipient",
+    "inviteHelp": "Send an invitation, then check who has claimed it before sending the attestation.",
+    "contactEmail": "Email address for the invitation",
+    "chooseModel": "Choose a template",
+    "invitationSent": "Invitation sent. Follow the recipient’s response below.",
+    "deliveryDetails": "Email delivery details",
+    "contactHelp": "This email is used to deliver the invitation. The recipient shown below is the person who claimed it.",
+    "readyAction": "Prepare the attestation",
+    "waitingRecipient": "Waiting for the recipient",
+    "createFirst": "Create an attestation template first.",
+    "cancelInvitation": "Cancel the invitation",
+    "cancelInvitationConfirm": "Cancel this invitation? An attestation already issued remains unchanged.",
+    "recorded": "Update saved.",
+    "revokeTitle": "Revoke an attestation",
+    "revokeLead": "Check the attestation and its recipient before revoking it.",
+    "reviewRevoke": "Review the revocation",
+    "revoke": "Sign and revoke the attestation",
+    "revokeWarning": "After confirmation, this attestation will no longer be valid. Information already shared cannot be recalled.",
+    "applyTitle": "Register your organization",
+    "applyLead": "Tell us about your organization so an administrator can review your request to issue attestations.",
+    "applySubmit": "Send for review",
+    "applicationPrivacy": "Your supporting documents are private. Only the administrators reviewing your request can access them.",
+    "applicationFields": {
+      "name": "Organization name",
+      "website": "Website",
+      "contact": "Contact email",
+      "jurisdiction": "Country or territory of registration",
+      "description": "What does your organization do?",
+      "purpose": "What attestations would you like to issue?"
+    },
+    "documentError": "Choose one to three PDF, PNG or JPEG files, no larger than 5 MB each.",
+    "documentsReady": "Files selected",
+    "applicationNext": "After approval, you can create a template and invite recipients.",
+    "currentState": "Current status",
+    "confirmedRecipient": "Recipient account verified",
+    "modelNext": "Use this template to invite a recipient.",
+    "yes": "Yes",
+    "no": "No",
+    "fieldNameHint": "Start with a letter. Use unaccented letters, numbers or underscores, without spaces.",
+    "invitationCreated": "Invitation created. Email delivery has not been confirmed.",
+    "deliveryFailed": "The invitation email could not be sent. Check the address before trying again.",
+    "modelInvalid": "This template could not be read. Check its format in the advanced editor."
+  },
+  "simpleRecipient": {
+    "invitationReady": "Invitation confirmed. Your wallet is already linked; your issuer can now prepare your attestation.",
+    "manageWallet": "Manage my wallet",
+    "reviewAttestation": "Review this attestation",
+    "verificationDetails": "Verification details",
+    "walletDetails": "Wallet address",
+    "walletCompatibility": "Supported wallets and proof limitations",
+    "otherActions": "Other actions",
+    "reviewStep": "1. Review the attestation",
+    "signStep": "2. Confirm in your wallet",
+    "reviewIntro": "Check who issued this attestation and its content before accepting. You can also decline without reading the content.",
+    "reviewIssuer": "Issued by",
+    "reviewSubject": "Recipient wallet",
+    "yourWallet": "Your connected wallet",
+    "credentialDetails": "Attestation references",
+    "acceptedActions": "This attestation is already accepted. You can read it or share it above.",
+    "removeIntro": "Removing an attestation requires your wallet approval. It does not erase copies already shared.",
+    "walletIdentity": "Check the wallet address",
+    "confirmReject": "Review this refusal",
+    "confirmRemove": "Review this removal",
+    "actionUnavailable": "This action could not be completed. Check your wallet connection, then try again. Your approval is still required."
+  },
+  "simpleNavigation": {
+    "metaTitle": "Your attestations — XCS",
+    "eyebrow": "Your attestations, in one place",
+    "title": "Receive, issue and verify attestations",
+    "description": "Keep the attestations you receive, share them when you choose, or check an attestation someone has shared with you.",
+    "actionsLabel": "What would you like to do?",
+    "receive": "Receive",
+    "receiveDescription": "Find your invitations and attestations. Review them before accepting or sharing them.",
+    "receiveAction": "My attestations",
+    "issue": "Issue",
+    "issueDescription": "Send attestations on behalf of your organization. Apply for access if you are getting started.",
+    "issueAction": "My organization",
+    "verify": "Verify",
+    "verifyDescription": "Open a sharing link to see an attestation and its verification result.",
+    "verifyAction": "Check an attestation",
+    "walletHelp": "You will be guided through sign-in and wallet confirmation when an action needs them.",
+    "more": "More",
+    "protocolVerify": "Advanced verification",
+    "footer": "Receive, share and check attestations."
   }
 }
diff --git a/apps/web/i18n/locales/fr.json b/apps/web/i18n/locales/fr.json
index 39ca7a9..275c400 100644
--- a/apps/web/i18n/locales/fr.json
+++ b/apps/web/i18n/locales/fr.json
@@ -1,4 +1,56 @@
 {
+  "auth": {
+    "account": "Mon compte XCS",
+    "signIn": "Se connecter à XCS",
+    "loginIntro": "Connectez-vous avec le fournisseur d’identité de votre organisation pour accéder à votre compte XCS.",
+    "continue": "Continuer la connexion",
+    "walletSeparate": "Votre compte XCS et la connexion de votre portefeuille sont distincts. Connecter un portefeuille ne vous connecte pas à XCS.",
+    "disabled": "La connexion aux comptes XCS n’est pas activée sur ce déploiement.",
+    "unavailable": "L’accès au compte est temporairement indisponible. Réessayez plus tard.",
+    "loginFailed": "La connexion n’a pas abouti. Lancez une nouvelle demande pour réessayer.",
+    "backHome": "Retour à l’explorateur",
+    "notAuthorized": "Accès non autorisé",
+    "notAuthorizedHelp": "Votre compte ne possède pas le rôle requis dans l’organisation. Contactez son administrateur.",
+    "accountIntro": "Gérez votre identité, vos accès aux organisations et vos portefeuilles liés.",
+    "profile": "Profil et session",
+    "name": "Nom",
+    "email": "Adresse e-mail",
+    "personalRoles": "Rôles du compte",
+    "sessionExpires": "Expiration de la session",
+    "sessionMaximum": "Fin de la durée maximale de session",
+    "extendSession": "Prolonger ma session",
+    "sessionExtended": "Votre session a été prolongée dans la limite de sa durée maximale.",
+    "signOut": "Se déconnecter de XCS",
+    "signOutHelp": "Cette action termine cette session XCS. La session du fournisseur d’identité et la connexion du portefeuille restent indépendantes.",
+    "organizations": "Organisations approuvées",
+    "noOrganizations": "Vous n’avez actuellement aucune appartenance approuvée à une organisation.",
+    "issuerSpace": "Espace émetteur",
+    "issuerIntro": "Organisations dans lesquelles votre compte possède un rôle d’émetteur approuvé.",
+    "linkedWallets": "Portefeuilles liés",
+    "walletLinkHelp": "Liez un portefeuille en signant un message de preuve à usage unique. Cette action ne soumet aucune transaction et n’accorde aucun rôle dans une organisation.",
+    "masterKeyOnly": "XRPL Testnet uniquement. GemWallet, MetaMask XRP Snap et Otsu permettent la liaison. La clé de signature doit correspondre à l’adresse du portefeuille ; les comptes utilisant une clé régulière ou plusieurs signataires ne sont pas pris en charge.",
+    "noWallets": "Aucun portefeuille n’est lié à ce compte.",
+    "walletAddress": "Adresse du portefeuille",
+    "network": "Réseau",
+    "verifiedAt": "Vérifié le",
+    "actions": "Actions",
+    "unlink": "Délier",
+    "unlinkAddress": "Délier le portefeuille {address}",
+    "walletUnlinked": "Le portefeuille a été délié de votre compte XCS.",
+    "walletLinked": "Le portefeuille a été lié à votre compte XCS.",
+    "connectFirst": "Connectez un portefeuille compatible avec le bouton ci-dessus, puis liez-le ici.",
+    "walletUnsupported": "Ce portefeuille ne fournit pas de preuve compatible sur XRPL Testnet. Utilisez GemWallet, MetaMask XRP Snap ou Otsu.",
+    "alreadyLinked": "Ce portefeuille Testnet est déjà lié à votre compte.",
+    "linkCurrentWallet": "Lier le portefeuille connecté",
+    "walletChanged": "Le compte, le réseau ou la connexion du portefeuille a changé. Vérifiez le portefeuille sélectionné et réessayez.",
+    "actionFailed": "L’action n’a pas abouti. Vérifiez votre session et votre portefeuille, puis réessayez.",
+    "roles": {
+      "admin": "Administrateur",
+      "recipient": "Bénéficiaire",
+      "issuer": "Émetteur",
+      "verifier": "Vérificateur"
+    }
+  },
   "nav": {
     "main": "Navigation principale",
     "skip": "Aller au contenu principal",
@@ -15,6 +67,7 @@
     "accept": "Accepter",
     "revoke": "Révoquer",
     "verify": "Vérifier",
+    "wallet": "Mes credentials",
     "operations": "Opérations",
     "learn": "Comprendre",
     "language": "Langue"
@@ -28,6 +81,16 @@
   },
   "wallet": {
     "connect": "Connecter un wallet",
+    "connecting": "Connexion à {wallet}…",
+    "connected": "Connecté",
+    "sessionChanged": "Le compte ou réseau sélectionné dans Crossmark a changé. Reconnectez-vous pour approuver cette sélection.",
+    "sessionRefreshFailed": "Crossmark n’a pas confirmé le compte et réseau actuels. Déverrouillez le wallet, sélectionnez XRPL Testnet et reconnectez-vous.",
+    "disconnect": "Déconnecter",
+    "approvalPending": "Approuvez la connexion dans {wallet}. En attente de la confirmation du compte et du réseau Testnet par le wallet.",
+    "cancelConnection": "Annuler la connexion",
+    "disconnectFailed": "Le wallet n’a pas pu fermer sa session. Fermez sa demande en attente et rechargez cette page avant de vous reconnecter.",
+    "connectionTimeout": "Le wallet n’a pas terminé la connexion. Fermez sa demande en attente, déverrouillez-le, sélectionnez XRPL Testnet et réessayez.",
+    "networkMismatch": "Connexion non établie : sélectionnez XRP Ledger Testnet dans votre wallet, puis cliquez à nouveau sur Connecter. L’autorisation seule ne connecte pas ce site.",
     "choose": "Choisissez un wallet compatible",
     "available": "Disponible",
     "unavailable": "Non détecté",
@@ -35,15 +98,42 @@
     "setup": "Installer ou ouvrir",
     "none": "Aucun adaptateur XRPL Connect n’est configuré.",
     "credentials": {
+      "raw": "Credentials par signature brute — accord explicite requis",
       "supported": "Transactions Credential prises en charge",
-      "unsupported": "Schémas uniquement — transactions Credential non prises en charge",
       "unverified": "Compatibilité Credential non validée"
     },
     "errors": {
-      "credentialUnsupported": "{wallet} ne peut pas signer {transactionType} : sa version actuelle ne reconnaît pas encore les transactions Credentials XRPL. Reconnectez-vous avec un wallet qui les prend en charge, par exemple Xaman lorsqu’il est configuré."
+      "credentialUnsupported": "{wallet} ne peut pas signer {transactionType} : sa version actuelle ne reconnaît pas encore les transactions Credentials XRPL. Reconnectez-vous avec un wallet qui les prend en charge, par exemple Xaman lorsqu’il est configuré.",
+      "otsuSigningAccountUnavailable": "Otsu est installé, mais il ne peut pas accéder à la clé de signature du compte sélectionné. Ouvrez et déverrouillez Otsu, puis reconnectez-le avant de réessayer."
+    }
+  },
+  "walletSpace": {
+    "title": "Mes credentials",
+    "description": "Relisez les credentials émis pour le wallet connecté et acceptez-les depuis le parcours sujet existant.",
+    "connectFirst": "Connectez le wallet destinataire pour voir les credentials qui attendent sa décision.",
+    "address": "Sujet connecté",
+    "privacy": "Cette page lit directement les objets Credential du ledger XRPL. Le RPC configuré voit l’adresse recherchée et les métadonnées réseau du navigateur. Commons ne reçoit que des recherches XCS exactes et aucun claim n’est chargé.",
+    "loading": "Lecture des credentials XRPL validés du wallet connecté…",
+    "error": "Les credentials du wallet ne peuvent pas être lus de façon fiable.",
+    "empty": "Aucun Credential non accepté n’est associé à ce wallet dans le ledger validé.",
+    "refresh": "Actualiser",
+    "credential": "Credential en attente de décision",
+    "reviewPending": "Relire et accepter",
+    "reviewExpired": "Relire et rejeter",
+    "issuer": "Émetteur",
+    "schema": "UID du schéma",
+    "expiration": "Expiration",
+    "noExpiration": "Sans expiration",
+    "generation": "Identifiant de génération",
+    "states": {
+      "pending": "En attente d’acceptation",
+      "expired": "Expiré sans acceptation"
     }
   },
   "transaction": {
+    "rawWarning": "GemWallet affichera un message codé. Le signer autorise cette action sur le réseau de test et ses frais ; ce n’est pas une connexion au site. Vérifiez l’action ci-dessus avant de continuer.",
+    "rawConsent": "J’ai vérifié cette action et j’autorise sa signature et les frais affichés.",
+    "rawSign": "Signer en brut et soumettre",
     "preview": "Vérification avant signature",
     "confirmWarning": "Contrôlez le réseau, le compte, la destination, les frais et chaque champ dans votre wallet.",
     "sign": "Signer et soumettre"
@@ -155,6 +245,9 @@
     "diplomaTemplate": "Modèle de diplôme",
     "schemaName": "Nom du schéma",
     "schemaDescription": "Description du schéma",
+    "textBytes": "Obligatoire · {count}/{max} octets UTF-8 · une seule ligne. Les accents et emoji utilisent plusieurs octets.",
+    "descriptionInvalid": "La description est obligatoire : une seule ligne de 1 à 256 octets UTF-8. Retirez les sauts de ligne ou raccourcissez le texte ; les accents et emoji utilisent plusieurs octets.",
+    "nameInvalid": "Le nom du schéma est obligatoire : une seule ligne de 1 à 64 octets UTF-8.",
     "fields": "Champs",
     "fieldName": "Nom du champ",
     "fieldType": "Type du champ",
@@ -189,6 +282,25 @@
     "requiredField": "Champ requis",
     "optionalField": "Champ facultatif",
     "advancedClaimsHint": "Passez en mode JSON pour relire ou saisir directement l’objet de claims complet.",
+    "hosted": {
+      "title": "Stockage public des payloads Commons",
+      "description": "Le payload canonique exact sera servi publiquement depuis {origin}. N’incluez jamais de données personnelles, de secrets ni de données de production.",
+      "consent": "J’autorise la publication du payload exact affiché ci-dessus à l’adresse {url} et sa conservation dans ce navigateur jusqu’à publication ou suppression de la copie de reprise.",
+      "confirmExactPublication": "Publier publiquement ce payload exact à l’adresse {url} ?\n\n{payload}",
+      "publishAfterSignature": "Après validation et indexation du credential, son payload est publié ici puis vérifié via HTTPS public.",
+      "publicationPending": "La signature et le payload sont sauvegardés dans ce navigateur. La publication attend la validation et l’indexation. Après rechargement, revenez sur Émettre ou Opérations ; réessayer ne crée jamais un autre credential.",
+      "retryPublication": "Terminer la publication",
+      "recoveryTitle": "Attestations à finir de publier",
+      "recoveryDescription": "Ces contenus publics sont conservés dans ce navigateur. Réessayez une fois votre transaction confirmée. Cela ne demande aucune nouvelle signature et ne crée pas une autre attestation.",
+      "recoveryUnavailable": "Le stockage de reprise est indisponible, plein ou corrompu. Vérifiez le stockage du navigateur et les publications en attente avant de signer à nouveau.",
+      "corruptRecovery": "Une copie de reprise est endommagée et ne peut pas être publiée. Les autres copies restent utilisables. Vous pouvez supprimer explicitement la copie endommagée.",
+      "retryFailed": "La publication n’a pas pu être terminée. La copie de reprise est conservée.",
+      "journalCleanupFailed": "Le payload est publié et vérifié. Le nettoyage du journal a échoué ; la transaction signée peut rester conservée dans ce navigateur.",
+      "signatureMissing": "Aucune signature enregistrée. Vérifiez votre wallet et l’historique des actions avant une nouvelle émission ; votre contenu est conservé ici.",
+      "discardRecovery": "Supprimer la copie de reprise",
+      "discardConfirm": "Supprimer cette copie locale de reprise ? Cela ne révoque pas le credential et ne supprime aucun payload publié. Si la publication est incomplète, téléchargez le payload avant de supprimer sa copie.",
+      "downloadRecovery": "Télécharger le contenu sauvegardé"
+    },
     "localStore": {
       "title": "Stockage local de démonstration",
       "mode": "Stockage local de test (ce navigateur)",
@@ -211,6 +323,14 @@
       }
     },
     "errors": {
+      "hostedSize": "Le stockage public accepte au maximum 64 Kio de payload canonique UTF-8. Réduisez les claims avant signature.",
+      "hostedConsent": "Autorisez explicitement le payload public exact et sa destination avant de continuer.",
+      "hostedUnavailable": "Le service public de payloads est indisponible ou n’est pas configuré avec une origine HTTPS valide.",
+      "hostedBeforeSigning": "L’hébergement du contenu est inaccessible. Aucune signature n’a été demandée. Configurez une adresse HTTPS fixe et fonctionnelle avant d’émettre ce credential.",
+      "hostedIntegrity": "La transaction signée, l’URL publique et le payload canonique ne correspondent pas exactement.",
+      "hostedPii": "Ce stockage public refuse les claims dont le nom de champ ressemble à une donnée personnelle.",
+      "hostedQuota": "Ce wallet ou cette adresse réseau a atteint la limite de publication des payloads publics.",
+      "hostedNotIndexed": "Le CredentialCreate signé n’est pas encore présent dans l’index autoritatif. Attendez sa confirmation ledger, puis relancez la publication.",
       "httpsUrlRequired": "Indiquez d’abord l’URL HTTPS publique définitive où ce payload sera publié.",
       "httpsUrlPlaceholder": "L’adresse issuer.example est un exemple, pas un hébergement. Remplacez-la par une URL HTTPS publique que votre organisation contrôle.",
       "payloadFetchFailed": "Le navigateur n’a pas pu relire le payload. Publiez le fichier JSON téléchargé, inchangé, à cette URL HTTPS publique avec le type application/json, CORS autorisé pour ce site et sans redirection, puis réessayez."
@@ -432,11 +552,17 @@
   },
   "accept": {
     "title": "Accepter ou retirer un credential",
-    "description": "Le sujet accepte un credential pending non accepté, rejette un credential non accepté pending ou expired, et retire un credential accepté active ou expired.",
-    "notTruth": "Accepter signifie conserver le Credential sur votre compte ; cela ne certifie pas que ses claims sont vrais.",
+    "description": "Consultez le credential reçu par votre wallet, puis acceptez-le ou retirez-le.",
+    "notTruth": "Accepter ajoute ce credential à votre compte, sans certifier la véracité de son contenu.",
     "action": "Action",
     "prepare": "Préparer la transaction",
-    "review": "Charger, relire et préparer",
+    "review": "Consulter le credential",
+    "checking": "Vérification du credential…",
+    "acceptInWallet": "Accepter dans mon wallet",
+    "walletNext": "Votre wallet vous demandera de signer. Rien n’est accepté avant votre confirmation.",
+    "technicalDetails": "Détails techniques",
+    "retry": "Réessayer la vérification",
+    "payloadMismatch": "Ce contenu ne correspond pas au credential. L’acceptation est bloquée ; demandez à l’émetteur de le vérifier.",
     "fetchAndPrepare": "Charger le payload et préparer",
     "acceptAction": "Accepter le credential pending",
     "rejectAction": "Rejeter le credential pending ou expired non accepté",
@@ -445,18 +571,18 @@
     "expiration": "Expiration",
     "noExpiration": "Sans expiration",
     "generation": "Identifiant de génération",
-    "state": "État indexé relu",
+    "state": "Statut",
     "acceptedFlag": "Flag accepted relu",
-    "publicClaims": "Claims publics",
-    "payloadConsentIntro": "L’étape suivante contacte {host} directement depuis ce navigateur. Cet hôte peut observer votre adresse IP et l’heure de la requête.",
-    "localPayloadConsentIntro": "L’étape suivante relit le payload de démonstration conservé dans ce navigateur. Aucun hôte externe n’est contacté, mais ce contenu n’est ni public ni disponible sur un autre appareil.",
-    "payloadConsent": "Je consens explicitement au chargement de ce payload public depuis l’hôte affiché.",
-    "localPayloadConsent": "Je consens explicitement à relire et vérifier ce payload de démonstration dans ce navigateur.",
+    "publicClaims": "Contenu du credential",
+    "payloadConsentIntro": "Le contenu est hébergé sur {host}. Le charger partage votre adresse IP et l’heure de la requête avec cet hôte.",
+    "localPayloadConsentIntro": "Ce contenu de test est stocké uniquement dans ce navigateur.",
+    "payloadConsent": "Charger et vérifier le contenu",
+    "localPayloadConsent": "Charger et vérifier ce contenu de test",
     "localPayloadUnavailable": "Ce CID IPFS n’est pas disponible dans le stockage de démonstration de ce navigateur. L’acceptation est bloquée ici.",
-    "payloadUnavailable": "Le payload ne peut pas être relu de façon sûre. L’acceptation est bloquée, mais un credential pending peut toujours être rejeté.",
-    "issuerUnknown": "XCS ne prend aucune décision de confiance sur cet émetteur. Inconnu ne signifie ni fiable ni non fiable.",
-    "issuerAcknowledgement": "Je reconnais indépendamment l’adresse de l’émetteur affichée et choisis d’accepter cette génération exacte du credential.",
-    "issuerAcknowledgementRequired": "Confirmez votre propre décision de confiance pour cette génération exacte d’un émetteur inconnu avant de l’accepter.",
+    "payloadUnavailable": "Le contenu n’a pas pu être vérifié. Réessayez ou demandez à l’émetteur de vérifier le lien.",
+    "issuerUnknown": "XCS n’a pas vérifié l’identité de cet émetteur.",
+    "issuerAcknowledgement": "Je reconnais cet émetteur et souhaite accepter ce credential.",
+    "issuerAcknowledgementRequired": "Confirmez que vous reconnaissez l’émetteur pour continuer.",
     "issuerAcknowledgementStale": "Le contexte de confiance de l’émetteur a changé. Relisez-le et confirmez de nouveau votre décision.",
     "issuerUntrusted": "La politique locale de ce vérificateur marque l’émetteur comme non fiable. L’acceptation est bloquée.",
     "subjectWalletMismatch": "Le wallet connecté n’est pas le sujet de ce credential. Déconnectez-le puis connectez le wallet du destinataire avant d’accepter, rejeter ou retirer cette génération.",
@@ -536,5 +662,722 @@
   "footer": {
     "summary": "XCS v0.1 — standard ouvert et implémentation de référence MIT.",
     "navigation": "Liens de pied de page"
+  },
+  "admin": {
+    "navigation": "Navigation administrateur",
+    "queue": "Candidatures",
+    "queueIntro": "Examinez les candidatures des organisations, de la plus ancienne à la plus récente.",
+    "verifiers": "Accès des vérificateurs",
+    "verifiersIntro": "Gérez les accès approuvés ou suspendus des vérificateurs à l’application.",
+    "audit": "Historique des décisions",
+    "auditIntro": "Décisions, auteurs et suivi des notifications. Une panne email ne supprime pas la décision enregistrée.",
+    "reviewTitle": "Examen de la candidature",
+    "reviewIntro": "Examinez l’organisation et ses justificatifs avant d’accorder un accès.",
+    "organization": "Organisation",
+    "role": "Rôle demandé",
+    "currentStatus": "État actuel",
+    "submitted": "Date de candidature",
+    "filterRole": "Filtrer par rôle",
+    "allRoles": "Tous les rôles",
+    "review": "Examiner",
+    "reviewNamed": "Examiner {name}",
+    "manage": "Gérer l’accès",
+    "emptyQueue": "Aucune demande à examiner.",
+    "emptyVerifiers": "Aucun vérificateur approuvé ou suspendu.",
+    "emptyHistory": "Aucune décision enregistrée.",
+    "operatorAction": "Opération administrative",
+    "pagination": "Pagination des candidatures",
+    "previous": "Précédent",
+    "next": "Suivant",
+    "page": "Page {page} sur {total}",
+    "retry": "Réessayer",
+    "back": "Retour à la liste",
+    "website": "Site web",
+    "contact": "Contact",
+    "jurisdiction": "Juridiction",
+    "responsible": "Responsable",
+    "description": "Présentation de l’organisation",
+    "purpose": "Usage prévu",
+    "noEmail": "Aucun email vérifié disponible",
+    "documents": "Justificatifs",
+    "documentHelp": "PDF, PNG et JPEG uniquement. Les liens autorisés sont liés à votre session et expirent après cinq minutes.",
+    "document": "Document {number}",
+    "bytes": "{count} octets",
+    "noDocuments": "Aucun justificatif.",
+    "prepareDocument": "Préparer un lien sécurisé",
+    "renewLink": "Renouveler le lien sécurisé",
+    "openDocument": "Ouvrir le document (nouvel onglet)",
+    "linkExpires": "Expiration du lien : {date}",
+    "documentFailure": "Impossible d’ouvrir le document. Il peut être absent, invalide ou ne plus être autorisé. Votre examen est conservé ; réessayez de consulter le document séparément.",
+    "walletCaveat": "Ces wallets appartiennent au responsable. Une preuve de possession de wallet ne prouve pas l’identité de l’organisation. Aucune transaction XRPL n’est nécessaire pour cet examen.",
+    "approvalCaveat": "L’approbation accorde le rôle applicatif sélectionné. Elle ne constitue pas une validation des claims de l’organisation.",
+    "privateClaims": "Les claims privés restent sous le contrôle du destinataire. Le rôle administrateur et l’approbation d’un vérificateur ne donnent pas accès aux claims privés.",
+    "decision": "Décision d’accès",
+    "revision": "Révision de la décision",
+    "lastReason": "Dernier motif",
+    "checklist": {
+      "title": "Checklist d’examen",
+      "organization": "Organisation",
+      "role": "Rôle demandé",
+      "responsible": "Responsable",
+      "documents": "Justificatifs",
+      "wallet": "Wallet déclaré",
+      "history": "Historique des décisions",
+      "complete": "Disponible",
+      "attention": "À vérifier"
+    },
+    "applicationHistory": "Historique de la candidature",
+    "reasonRequired": "Motif (obligatoire)",
+    "reasonOptional": "Motif (facultatif)",
+    "missingReason": "Saisissez un motif avant de confirmer.",
+    "confirm": "Confirmer la décision",
+    "confirmDecision": "Confirmer « {action} » pour {name}, rôle : {role}.",
+    "noDecision": "Aucune autre décision n’est disponible pour cette candidature.",
+    "decisionRecorded": "Décision enregistrée. L’envoi de l’email est suivi séparément dans l’historique.",
+    "reviewCurrent": "Recharger et examiner la décision actuelle",
+    "ambiguousDecision": "Le résultat de cette demande est inconnu. Réessayez la même décision pour la retrouver ou la terminer sans doublon. Son contenu et son identifiant d’origine sont conservés.",
+    "retryDecision": "Réessayer la même décision",
+    "notification": "Notification",
+    "notificationQueued": "Notification remise en attente d’envoi. La décision d’origine est conservée.",
+    "retryNotification": "Réessayer la notification",
+    "blockedHelp": "L’envoi reste bloqué tant que le responsable n’a pas d’email vérifié. Ne répétez pas la décision.",
+    "uncertainHelp": "L’envoi a pu aboutir avant une interruption. Un opérateur doit vérifier les traces SMTP avant tout nouvel envoi. La reprise automatique est désactivée.",
+    "status": {
+      "pending": "En attente",
+      "approved": "Approuvé",
+      "rejected": "Refusé",
+      "suspended": "Suspendu"
+    },
+    "actions": {
+      "approve": "Approuver l’accès",
+      "reject": "Refuser l’accès",
+      "suspend": "Suspendre l’accès",
+      "restore": "Rétablir l’accès"
+    },
+    "notifications": {
+      "pending": "En attente",
+      "sending": "Envoi en cours",
+      "sent": "Envoyée",
+      "failed": "Échec",
+      "blocked": "Bloquée : aucun email vérifié",
+      "uncertain": "Livraison incertaine"
+    },
+    "errors": {
+      "session": "Votre session a expiré. Reconnectez-vous pour continuer.",
+      "forbidden": "Accès refusé. Votre compte ne dispose plus du rôle administrateur nécessaire à cette action.",
+      "missing": "Cette candidature ou ce document est indisponible.",
+      "conflict": "Une autre décision a déjà été enregistrée. Examinez la décision actuelle avant toute nouvelle action.",
+      "unavailable": "Le service d’administration est temporairement indisponible. Réessayez plus tard.",
+      "generic": "La demande n’a pas abouti. Vérifiez la connexion puis réessayez."
+    },
+    "title": "Administration"
+  },
+  "issuer": {
+    "navigation": "Navigation émetteur",
+    "schemas": "Schémas",
+    "recipients": "Destinataires",
+    "credentials": "Attestations",
+    "settings": "Paramètres",
+    "intro": "Gérez les attestations de votre organisation.",
+    "organization": "Organisation",
+    "error": "Cette action n’a pas abouti. Actualisez pour vérifier l’état actuel avant de réessayer.",
+    "retry": "Actualiser",
+    "loading": "Chargement…",
+    "approvalRequired": "L’approbation actuelle de l’organisation est nécessaire.",
+    "application": "Suivi de la candidature",
+    "publishSchema": "Publier un schéma",
+    "noSchemas": "Cette organisation n’a pas encore publié de schéma.",
+    "invite": "Inviter un destinataire",
+    "inviteHelp": "Toute personne possédant le lien peut le réclamer après connexion. Vérifiez le bénéficiaire réel et son wallet lié avant d’émettre.",
+    "email": "Email de livraison",
+    "chooseSchema": "Choisir un de vos schémas",
+    "message": "Message facultatif",
+    "sendInvite": "Envoyer l’invitation",
+    "noInvites": "Aucune invitation pour le moment.",
+    "delivery": "Livraison de l’email",
+    "uncertain": "La livraison n’a pas pu être confirmée. Vérifiez la boîte mail avant de renvoyer : le renvoi remplace le lien précédent.",
+    "reviewRecipient": "Vérifier le destinataire et émettre",
+    "resend": "Remplacer et renvoyer le lien",
+    "revokeInvite": "Révoquer l’invitation",
+    "resendConfirm": "Remplacer le lien précédent et envoyer une nouvelle invitation ?",
+    "revokeConfirm": "Révoquer cette invitation ? Cela ne révoque pas une attestation déjà inscrite sur le ledger.",
+    "confirm": "Confirmer",
+    "cancel": "Annuler",
+    "noCredentials": "Aucune attestation émise pour le moment.",
+    "attestation": "Attestation",
+    "open": "Voir le détail",
+    "recorded": "Action enregistrée. Vérifiez ci-dessous l’état de livraison et du ledger.",
+    "apply": "Candidater comme émetteur",
+    "applyHelp": "Présentez votre organisation et transmettez les justificatifs pour examen.",
+    "documents": "Justificatifs",
+    "documentsHelp": "Un à trois fichiers PDF, PNG ou JPEG, de 5 Mio maximum chacun.",
+    "reviewPrivacy": "Ces documents sont privés et accessibles aux administrateurs pour examiner la candidature. Ils ne sont pas des claims d’attestation.",
+    "submit": "Envoyer la candidature",
+    "applicationError": "Candidature non envoyée. Vérifiez les champs et les documents, puis actualisez le suivi avant de réessayer.",
+    "approvalMeaning": "L’approbation autorise l’accès au portail. Elle ne certifie pas les affirmations de l’organisation.",
+    "noApplications": "Vous n’avez pas encore de candidature émetteur.",
+    "pendingHelp": "Un administrateur examinera votre candidature. L’émission reste indisponible pendant l’examen.",
+    "declinedHelp": "Consultez la décision ci-dessus. Cette organisation ne peut pas émettre via le portail.",
+    "openWorkspace": "Ouvrir l’espace émetteur",
+    "settingsHelp": "Consultez votre candidature et gérez les wallets liés à votre compte.",
+    "claimTitle": "Réclamer une invitation",
+    "claimHelp": "Réclamer lie cette invitation à votre compte. Cela n’émet ni n’accepte une attestation XRPL.",
+    "claimLogin": "Connectez-vous pour continuer. Cette invitation se rouvrira automatiquement après la connexion.",
+    "claimUnavailable": "Cette invitation est indisponible, expirée, révoquée ou déjà réclamée. Demandez un nouveau lien à l’émetteur si nécessaire.",
+    "claimedHelp": "Invitation réclamée. Liez votre wallet dans votre compte pour que l’émetteur le vérifie avant d’émettre.",
+    "claim": "Réclamer avec ce compte",
+    "fields": {
+      "name": "Nom de l’organisation",
+      "website": "Site web",
+      "contact": "Email de contact",
+      "jurisdiction": "Juridiction",
+      "description": "Présentation de l’organisation",
+      "purpose": "Objet des émissions"
+    },
+    "states": {
+      "pending": "En attente d’examen",
+      "approved": "Approuvée",
+      "rejected": "Refusée",
+      "suspended": "Suspendue",
+      "revoked": "Révoquée",
+      "claimed": "Réclamée",
+      "expired": "Expirée",
+      "unclaimed": "En attente du destinataire",
+      "issued": "Émise, en attente d’acceptation",
+      "accepted": "Acceptée",
+      "unavailable": "État indisponible",
+      "inactive": "Inactive",
+      "declined": "Refusée par le destinataire"
+    },
+    "deliveryStates": {
+      "pending": "En attente",
+      "sending": "En cours d’envoi",
+      "sent": "Envoyé",
+      "failed": "Échec",
+      "blocked": "Bloqué",
+      "uncertain": "Non confirmé",
+      "superseded": "Remplacé",
+      "cancelled": "Annulé"
+    },
+    "engine": {
+      "schema": "Schéma",
+      "recipient": "Bénéficiaire réel",
+      "deliveryContact": "Contact de livraison de l’invitation",
+      "linkedWallet": "Wallet vérifié du destinataire",
+      "visibility": "Qui peut voir les claims ?",
+      "private": "Privée",
+      "public": "Publique",
+      "publicWarning": "Les claims publics peuvent être copiés par tous et ne peuvent plus être rendus privés.",
+      "publicFields": "Champs visibles par tous",
+      "publicPreview": "Toute personne possédant le lien",
+      "privatePreview": "Personnes autorisées",
+      "onChainPublic": "Les métadonnées du ledger et le digest du payload restent publics.",
+      "savePending": "La transaction ledger a réussi. Enregistrez son suivi applicatif sans signer à nouveau.",
+      "retrySave": "Réessayer l’enregistrement",
+      "saved": "Suivi applicatif enregistré",
+      "openCredential": "Ouvrir l’attestation",
+      "confirmRevoke": "Confirmer la révocation de « {schema} » pour {recipient}",
+      "walletRequired": "Le destinataire doit lier un wallet avant l’émission.",
+      "loading": "Chargement…",
+      "back": "Retour à l’espace émetteur",
+      "error": "L’opération n’a pas abouti. Actualisez et vérifiez son état actuel.",
+      "chooseWallet": "Choisir un wallet vérifié",
+      "visibilityReviewed": "J’ai vérifié ces champs publics et privés",
+      "restartFailedOperation": "Recommencer après un échec confirmé",
+      "failedOperation": "La transaction initiale a expiré ou a échoué sur le ledger validé. Une nouvelle approbation du wallet est nécessaire."
+    },
+    "visibility": {
+      "public": "Publique",
+      "private": "Privée"
+    }
+  },
+  "recipient": {
+    "title": "Mes attestations",
+    "intro": "Recevez, examinez et partagez les attestations liées à votre compte XCS.",
+    "refresh": "Actualiser",
+    "error": "Vos attestations n’ont pas pu être chargées. Vérifiez votre session et réessayez ; la signature reste indisponible tant que les preuves actuelles ne peuvent pas être vérifiées.",
+    "notifications": "Actualités récentes",
+    "notification": {
+      "issued": "{issuer} a émis une attestation à votre intention.",
+      "revoked": "Une attestation de {issuer} n’est plus active."
+    },
+    "empty": "Aucune attestation pour le moment. Ouvrez une invitation de votre émetteur pour commencer.",
+    "waiting": "En attente d’émission",
+    "waitingHelp": "L’émetteur prépare l’attestation. Gardez votre wallet lié ; inutile de revendiquer à nouveau l’invitation.",
+    "invitationInactive": "Cette invitation n’est plus active. Contactez votre émetteur.",
+    "credential": "Attestation",
+    "ready": "À accepter",
+    "accepted": "Acceptées",
+    "inactive": "Inactives ou indisponibles",
+    "noItems": "Aucune attestation dans cette section.",
+    "visibility": {
+      "public": "Cette attestation a été publiée publiquement.",
+      "private": "Le contenu privé est réservé aux personnes autorisées."
+    },
+    "open": "Ouvrir l’attestation",
+    "back": "Retour à mes attestations",
+    "reviewHelp": "Vérifiez d’abord l’émetteur et les wallets. La lecture du contenu nécessite votre consentement. Vous pouvez refuser sans ouvrir le contenu.",
+    "present": "Partager cette attestation",
+    "inactiveHelp": "Le partage nécessite une attestation acceptée et active. Vérifiez son état actuel avant toute action.",
+    "evidence": "Preuves du registre",
+    "issuerWallet": "Wallet de l’émetteur",
+    "subjectWallet": "Wallet du destinataire",
+    "generation": "Référence de l’attestation",
+    "readContent": "Lire le contenu de l’attestation",
+    "readHelp": "Cette action demande explicitement le contenu complet au portail. Votre compte doit toujours être propriétaire de cette attestation.",
+    "readError": "Le contenu n’a pas pu être vérifié. Réessayez lorsque des preuves actuelles seront disponibles."
+  },
+  "presentation": {
+    "title": "Attestation partagée",
+    "createTitle": "Choisir son partage",
+    "createHelp": "Choisissez les champs à partager et l’organisation autorisée à consulter les détails privés.",
+    "actionError": "Le partage n’a pas pu être modifié. Actualisez l’attestation et vérifiez votre session avant de réessayer.",
+    "scope": "Contenu partagé",
+    "public": "Champs publics uniquement",
+    "full": "Contenu complet pour un vérificateur",
+    "verifier": "Organisation vérificatrice désignée",
+    "chooseVerifier": "Choisir un vérificateur approuvé",
+    "noVerifiers": "Aucun vérificateur approuvé n’est disponible. Vous pouvez partager les champs publics.",
+    "preview": "Aperçu du partage",
+    "fullAudience": "Le contenu complet sera accessible uniquement au vérificateur approuvé : {verifier}.",
+    "publicAudience": "Toute personne ouvrant ce lien pourra voir les champs publics.",
+    "publicStillVisible": "Les autres visiteurs pourront toujours voir les champs publics. Transférer le lien n’autorise pas un autre vérificateur à consulter les détails privés.",
+    "fields": "Champs inclus dans ce partage",
+    "noFields": "Aucun champ n’est communiqué dans cette vue.",
+    "duration": "Le partage n’expire pas automatiquement. Vous pouvez révoquer le lien à tout moment. L’expiration de l’attestation et l’agrément du vérificateur continuent de s’appliquer.",
+    "create": "Créer le lien de partage",
+    "existing": "Vos autorisations de partage",
+    "none": "Aucune autorisation de partage pour le moment.",
+    "revoke": "Révoquer ce lien",
+    "revoked": "Lien révoqué",
+    "revokeHelp": "Révoquer un lien empêche les accès futurs. Cela ne révoque pas l’attestation et n’efface pas les copies déjà consultées.",
+    "shareLink": "Lien de partage",
+    "copyOnce": "Copiez ce lien avant de quitter la page : il n’est affiché qu’une fois. Envoyez-le à la personne qui doit vérifier votre attestation.",
+    "qrAlt": "Code QR de ce lien de partage",
+    "copy": "Copier le lien",
+    "share": "Partager le lien",
+    "copied": "Lien copié.",
+    "shared": "Lien partagé.",
+    "copyFailed": "La copie est indisponible. Sélectionnez le lien et copiez-le manuellement.",
+    "limitation": "Ces vérifications confirment les enregistrements et signatures disponibles. Elles ne garantissent pas la véracité des déclarations de l’émetteur.",
+    "partialHelp": "Seules les informations partagées sont affichées. Le contenu complet n’a pas été vérifié indépendamment dans cette vue.",
+    "fullFields": "Contenu complet autorisé",
+    "publicFields": "Champs publics",
+    "authorizationHelp": "Les détails privés exigent une organisation vérificatrice approuvée et un partage destiné à cette organisation. La connexion ou l’agrément seuls ne donnent pas accès aux champs privés.",
+    "audienceIncorrect": "Vous êtes connecté, mais votre organisation n’est pas le destinataire autorisé du contenu privé. Les champs publics restent visibles.",
+    "openHelp": "Ouvrez un lien de partage pour demander ses preuves actuelles et les champs que vous êtes autorisé à consulter.",
+    "open": "Ouvrir la présentation",
+    "checkAgain": "Vérifier à nouveau",
+    "unusableHelp": "Ce lien est indisponible ou a été révoqué. Demandez un nouveau lien au destinataire.",
+    "unavailableHelp": "Les preuves actuelles n’ont pas pu être vérifiées. Aucun résultat antérieur ne doit être considéré comme actuel.",
+    "failureHelp": {
+      "invalid": "Ce lien de partage est invalide. Demandez au destinataire un nouveau lien complet.",
+      "revoked": "Le destinataire a révoqué ce lien de partage. Demandez-lui d’en créer un nouveau.",
+      "holderProof": "La preuve du wallet destinataire est absente ou invalide. Demandez au destinataire de créer un nouveau lien.",
+      "unavailable": "Les preuves actuelles n’ont pas pu être vérifiées. Réessayez sans recoller le lien."
+    },
+    "headlines": {
+      "invalid": "Lien de partage invalide",
+      "revoked": "Lien de partage révoqué",
+      "holderProof": "Preuve du destinataire indisponible",
+      "unavailable": "Impossible de vérifier maintenant",
+      "pending": "Pas encore acceptée",
+      "notFound": "Attestation introuvable",
+      "expired": "Attestation expirée",
+      "deleted": "Attestation inactive",
+      "schemaInvalid": "Format de l’attestation invalide",
+      "tampered": "Contenu altéré",
+      "contentInvalid": "Contenu invalide",
+      "untrusted": "Émetteur non fiable selon vos critères",
+      "schemaUnknown": "Format de l’attestation non vérifié",
+      "contentUnavailable": "Contenu indisponible",
+      "partial": "Vérification partielle",
+      "unknownIssuer": "Confiance dans l’émetteur non établie",
+      "passed": "Contrôles réussis"
+    },
+    "limit": "Révoquez une présentation active avant d’en créer une autre (limite : 200)."
+  },
+  "verifier": {
+    "title": "Espace vérificateur",
+    "intro": "Suivez votre candidature et retrouvez les vérifications de votre organisation.",
+    "apply": "Devenir vérificateur",
+    "applyHelp": "Présentez votre organisation et expliquez pourquoi elle doit consulter des attestations partagées.",
+    "approvalMeaning": "L’agrément permet à cette organisation d’agir comme vérificateur sur le portail. Il ne cautionne pas l’émetteur et ne donne aucun accès aux champs privés sans un partage destiné à cette organisation.",
+    "pendingHelp": "Votre candidature attend la décision d’un administrateur. Après agrément, un destinataire devra toujours désigner votre organisation pour partager un contenu privé.",
+    "noApplications": "Vous n’avez aucune candidature de vérificateur. Les preuves publiques restent accessibles sans agrément.",
+    "error": "L’espace vérificateur n’a pas pu être chargé. Vérifiez votre session et réessayez.",
+    "history": "Historique des vérifications",
+    "historyHelp": "Ces résultats passés ne constituent pas une preuve actuelle. La réouverture contrôle à nouveau le lien, vos autorisations et le registre. Cet historique ne conserve ni champs privés ni jetons de partage réutilisables.",
+    "export": "Exporter l’historique en CSV",
+    "emptyHistory": "Aucune vérification enregistrée. Ouvrez un lien de partage pour vérifier une attestation.",
+    "checkedAt": "Date du contrôle",
+    "previousResult": "Résultat à cette date",
+    "reopen": "Vérifier à nouveau",
+    "reopenError": "Cette vérification n’a pas pu être rouverte. Le lien ou vos autorisations ont pu changer, ou les preuves actuelles sont indisponibles.",
+    "currentResult": "Résultat actuel de la vérification"
+  },
+  "roleJourney": {
+    "walletTitle": "Préparer votre wallet destinataire",
+    "walletIntro": "Liez un wallet que vous contrôlez pour que l’émetteur envoie l’attestation à la bonne adresse.",
+    "walletGuide": "Du nouveau wallet à l’attestation",
+    "setupTitle": "Choisir et configurer un wallet compatible",
+    "setupHelp": "Utilisez le sélecteur ci-dessous et, si nécessaire, le lien d’installation proposé. Créez ou ouvrez votre wallet dans son application, puis revenez ici. GemWallet, MetaMask XRP Snap et Otsu prennent en charge cette preuve de contrôle.",
+    "backupTitle": "Garder vos informations de récupération privées",
+    "backupHelp": "Suivez les consignes de sauvegarde du wallet et conservez sa phrase de récupération ou sa clé privée dans un endroit sûr. Ne les saisissez jamais dans XCS et ne les envoyez pas à l’émetteur. XCS demande uniquement une signature à votre wallet.",
+    "networkTitle": "Choisir XRPL Testnet et prévoir les frais",
+    "networkHelp": "Sélectionnez Testnet dans votre wallet. Accepter une attestation nécessite des XRP de test pour les frais et réserves du registre ; utilisez si besoin les instructions de financement Testnet de votre wallet. Lier le wallet ici ne soumet aucune transaction et ne transfère aucun fonds.",
+    "proofTitle": "Se connecter, puis prouver le contrôle",
+    "chooseCompatibleWallet": "Choisir un wallet pour cette preuve",
+    "walletSelectionHelp": "Connexion et liaison sont deux étapes distinctes. Si un autre wallet est connecté, déconnectez-le avant de choisir un wallet compatible.",
+    "connectFirst": "Connectez un wallet compatible avec le sélecteur ci-dessus, puis signez le message de contrôle ci-dessous.",
+    "walletReady": "Un wallet Testnet est lié à votre compte. L’émetteur peut maintenant examiner cette adresse vérifiée avant d’émettre.",
+    "continueRecipient": "Continuer vers mes attestations",
+    "prepareWallet": "Préparer ou gérer mon wallet",
+    "walletRequiredBeforeIssuance": "Liez un wallet pour permettre l’émission. Choisissez « Préparer ou gérer mon wallet » ci-dessus ; inutile de revendiquer à nouveau cette invitation.",
+    "shareProofTitle": "Autoriser ce lien avec votre wallet",
+    "shareProofHelp": "Chaque nouveau lien exige un nouveau message de contrôle signé par le wallet destinataire de l’attestation. Le message identifie cette attestation, les champs partagés et leur destinataire. Il ne soumet aucune transaction et ne transfère aucun fonds.",
+    "shareConnectWallet": "Connectez le wallet destinataire affiché ci-dessus avec GemWallet, MetaMask XRP Snap ou Otsu avant de créer le lien.",
+    "proofFailed": "La preuve du wallet a été annulée, a expiré ou n’a pas pu être vérifiée. Vérifiez le wallet, le contenu partagé et le destinataire, puis recommencez. Aucun lien n’est affiché avant confirmation de sa création.",
+    "recipientStates": {
+      "invited": "En attente de revendication par le destinataire",
+      "wallet_required": "Le destinataire doit lier un wallet",
+      "ready": "Destinataire prêt à recevoir l’attestation",
+      "issued": "Attestation déjà émise",
+      "unavailable": "Disponibilité du destinataire inconnue — actualisez avant d’émettre"
+    },
+    "walletVerifiedAt": "Contrôle du wallet vérifié le {date}",
+    "deliveryIsContact": "Cet email sert à livrer l’invitation ; il ne prouve pas l’identité de la personne qui la revendique. Vérifiez le bénéficiaire réel et son wallet avant de signer.",
+    "admissionTitle": "Qui l’a émise ?",
+    "admissionStatuses": {
+      "approved": "Organisation émettrice approuvée sur ce portail",
+      "suspended": "Agrément émetteur suspendu sur ce portail",
+      "not_approved": "Organisation émettrice non approuvée actuellement",
+      "unknown": "Agrément émetteur non établi"
+    },
+    "admissionReviewedAt": "Décision sur la candidature : {date}",
+    "checkedAt": "Vérifié le {date}",
+    "admissionMeaning": "L’approbation autorise cette organisation à émettre ici. Elle ne garantit pas l’exactitude de ses attestations.",
+    "holderProofTitle": "Qui a autorisé ce lien ?",
+    "holderVerifiedAt": "Signature du wallet vérifiée lors de l’autorisation de ce lien le {date}",
+    "holderProofMissing": "Aucune preuve signée du wallet n’a été fournie pour ce lien.",
+    "holderProofMeaning": "Cela prouve le contrôle du portefeuille du destinataire au moment de la signature. Cela n’identifie pas la personne qui ouvre ce lien aujourd’hui.",
+    "signedProofDetails": "Preuve de contrôle signée",
+    "ledgerRecipientTitle": "A-t-elle été acceptée ?",
+    "ledgerStatuses": {
+      "active": "Le destinataire a accepté cette attestation avec son portefeuille.",
+      "pending": "Le destinataire n’a pas encore accepté cette attestation.",
+      "expired": "Cette attestation a expiré.",
+      "deleted": "Cette attestation n’est plus active.",
+      "unknown": "Les preuves actuelles du registre sont indisponibles."
+    },
+    "holderProofRecreate": "Demandez au destinataire de créer un nouveau lien avec une nouvelle signature de son wallet.",
+    "holderKeyLimit": "La clé publique signataire correspond à cette adresse de wallet. Ce contrôle porte sur l’adresse de la clé maître ; il ne prouve pas que sa signature était activée sur le registre à cette date. Il ne prouve pas une identité civile."
+  },
+  "portal": {
+    "nextAction": "Votre prochaine action",
+    "retry": "Réessayer",
+    "walletRequired": "Liez un wallet d’émission avant de continuer.",
+    "issuer": {
+      "title": "Portail émetteur",
+      "lead": "Reprenez à l’unique action qui fait actuellement avancer votre organisation."
+    },
+    "errors": {
+      "unavailable": "Cet espace est temporairement indisponible.",
+      "unchanged": "Lorsque cet échec est signalé, aucun état du portail n’a été modifié."
+    },
+    "actions": {
+      "apply": {
+        "title": "Déposer une candidature auprès de Commons",
+        "help": "Présentez votre organisation et fournissez ses documents d’examen.",
+        "cta": "Commencer la candidature"
+      },
+      "awaitApproval": {
+        "title": "Attendre la décision Commons",
+        "help": "Votre candidature est examinée. Actualisez cette page après réception de la décision.",
+        "cta": "Actualiser"
+      },
+      "linkWallet": {
+        "title": "Lier le wallet d’émission",
+        "help": "Prouvez le contrôle du wallet Testnet que votre organisation utilisera pour signer les émissions.",
+        "cta": "Préparer le wallet d’émission"
+      },
+      "createTemplate": {
+        "title": "Créer un modèle d’attestation",
+        "help": "Donnez-lui un nom métier, une catégorie et des champs lisibles.",
+        "cta": "Créer le premier modèle"
+      },
+      "invite": {
+        "title": "Inviter un destinataire",
+        "help": "Choisissez un modèle et envoyez une invitation sécurisée par e-mail.",
+        "cta": "Inviter un destinataire"
+      },
+      "awaitRecipient": {
+        "title": "Attendre le destinataire",
+        "help": "Le destinataire doit réclamer l’invitation et prouver le contrôle de son wallet avant l’émission.",
+        "cta": "Actualiser"
+      },
+      "issue": {
+        "title": "Préparer l’attestation",
+        "help": "Le destinataire est prêt. Vérifiez le contenu lisible et la visibilité avant de demander la signature du wallet.",
+        "cta": "Préparer l’attestation"
+      },
+      "review": {
+        "title": "Examiner l’attestation",
+        "help": "Vérifiez l’émetteur, le contenu et la visibilité avant toute action wallet.",
+        "cta": "Examiner"
+      },
+      "accept": {
+        "title": "Accepter l’attestation",
+        "help": "Votre wallet affichera l’action avant que vous ne l’approuviez.",
+        "cta": "Accepter"
+      },
+      "share": {
+        "title": "Partager l’attestation",
+        "help": "Choisissez les données publiques ou complètes et, pour les données complètes, l’organisation destinataire.",
+        "cta": "Partager"
+      },
+      "done": {
+        "title": "Le travail émetteur actuel est terminé",
+        "help": "Vous pouvez inviter un autre destinataire ou consulter les attestations existantes.",
+        "cta": "Inviter un autre destinataire"
+      }
+    },
+    "walletProgress": {
+      "title": "Progression de la préparation du wallet",
+      "prepare": "Préparer le wallet",
+      "connect": "Le connecter",
+      "prove": "Prouver le contrôle",
+      "ready": "Prêt",
+      "prepared": "J’ai préparé mon wallet",
+      "issuerIntro": "Liez le wallet Testnet contrôlé par votre organisation. XCS ne demande ni ne conserve jamais sa clé privée.",
+      "continueIssuer": "Continuer vers le portail émetteur"
+    },
+    "invitationProgress": {
+      "title": "Progression de l’invitation",
+      "email": "E-mail envoyé",
+      "claimed": "Lien réclamé",
+      "wallet": "Wallet vérifié",
+      "issuance": "Attestation émise"
+    },
+    "progress": {
+      "complete": "Terminé",
+      "current": "Étape actuelle",
+      "pending": "En attente",
+      "attention": "À vérifier"
+    },
+    "recipient": {
+      "showAndVerify": "Afficher et vérifier le contenu",
+      "shareNow": "Partager cette attestation"
+    },
+    "admission": {
+      "approved": "Actuellement admise par Commons",
+      "suspended": "Admission Commons suspendue",
+      "not_approved": "Non admise actuellement par Commons",
+      "unknown": "Admission Commons indisponible"
+    }
+  },
+  "simpleUi": {
+    "technicalDetails": "Détails techniques",
+    "notProvided": "Non renseigné",
+    "yes": "Oui",
+    "no": "Non",
+    "issuedBy": "Émise par {name}",
+    "walletWillAsk": "Votre portefeuille va vous demander d’approuver cette action. Vérifiez les informations présentées avant de confirmer.",
+    "testNetwork": "Réseau de test — aucun XRP réel",
+    "checkNetwork": "Vérifiez le réseau sélectionné dans votre portefeuille.",
+    "fee": "Frais de réseau : {fee} XRP",
+    "feeUnknown": "Frais indisponibles. Vérifiez la demande complète avant de signer.",
+    "signActions": {
+      "issue": "Envoyer cette attestation au destinataire choisi",
+      "accept": "Accepter cette attestation dans votre portefeuille",
+      "remove": "Retirer cette attestation du portefeuille du destinataire",
+      "payment": "Autoriser le paiement indiqué ci-dessous",
+      "other": "Autoriser l’action présentée"
+    },
+    "finalityTitle": "Avancement",
+    "recorded": "Votre signature a été enregistrée",
+    "completed": "Terminé — votre modification est disponible",
+    "rejected": "La demande n’a pas pu aboutir",
+    "mismatch": "Le résultat ne correspond pas à votre demande",
+    "processing": "Finalisation de votre demande…",
+    "noRepeat": "Votre signature a été reçue. Ne signez pas à nouveau : l’application vérifie le résultat.",
+    "rejectedHelp": "Vérifiez le résultat avant de réessayer. La transaction signée a été enregistrée, mais la mise à jour de l’attestation a été refusée.",
+    "receivedLink": "Lien reçu du destinataire",
+    "receivedLinkHelp": "Collez le lien de partage complet. Aucun numéro de référence, adresse ou portefeuille n’est nécessaire pour consulter ses informations publiques.",
+    "invalidLink": "Utilisez un lien de partage complet provenant de ce site XCS. Au besoin, demandez un nouveau lien au destinataire.",
+    "verifyLink": "Vérifier l’attestation",
+    "paymentAmount": "Paiement : {amount} XRP",
+    "states": {
+      "active": "Acceptée",
+      "pending": "À accepter",
+      "expired": "Expirée",
+      "deleted": "N’est plus active",
+      "not_found": "Introuvable",
+      "unknown": "Vérification indisponible"
+    },
+    "attestationType": "Type d’attestation",
+    "saveError": "L’enregistrement n’a pas pu aboutir. Vérifiez l’état de la demande avant de réessayer.",
+    "pendingPublication": "Attestation à finir de publier ({number})",
+    "signedPublicationPending": "Votre signature est enregistrée. La publication doit encore être confirmée."
+  },
+  "simpleIssuer": {
+    "sections": {
+      "schemas": "Modèles d’attestation",
+      "recipients": "Destinataires",
+      "credentials": "Attestations",
+      "settings": "Paramètres"
+    },
+    "nav": {
+      "schemas": "Modèles",
+      "recipients": "Destinataires",
+      "credentials": "Attestations",
+      "settings": "Paramètres"
+    },
+    "model": "Modèle d’attestation",
+    "createModel": "Créer un modèle",
+    "modelTitle": "Créer un modèle d’attestation",
+    "modelLead": "Choisissez les informations que chaque attestation contiendra. Vous pourrez réutiliser ce modèle pour d’autres destinataires.",
+    "guided": "Modifier le formulaire",
+    "advanced": "Options avancées",
+    "technical": "Détails techniques",
+    "editJson": "Modifier le JSON",
+    "modelName": "Nom du modèle",
+    "modelDescription": "Que certifie ce modèle ?",
+    "shortName": "Choisissez un nom court, sur une seule ligne.",
+    "shortDescription": "Rédigez une courte description sur une seule ligne.",
+    "nameInvalid": "Saisissez un nom de modèle plus court, sur une seule ligne.",
+    "descriptionInvalid": "Saisissez une description plus courte, sur une seule ligne.",
+    "fields": "Informations à renseigner",
+    "fieldName": "Nom de l’information",
+    "fieldType": "Format de la réponse",
+    "optional": "Facultatif",
+    "addField": "Ajouter une information",
+    "removeField": "Retirer",
+    "fieldsInvalid": "Vérifiez les noms et les formats des informations. Chaque nom doit être unique.",
+    "fieldTypes": {
+      "string": "Texte",
+      "bool": "Oui ou non",
+      "uint": "Nombre entier, zéro ou plus",
+      "int": "Nombre entier",
+      "bytes": "Données binaires",
+      "address": "Adresse de compte",
+      "array": "Liste",
+      "object": "Groupe d’informations"
+    },
+    "reviewModel": "Vérifier le modèle",
+    "publishModel": "Signer et publier le modèle",
+    "modelReview": "Vérifiez votre modèle",
+    "publicModel": "Ce modèle sera public. Après publication, toute modification nécessitera un nouveau modèle. N’y incluez pas d’informations personnelles.",
+    "openModels": "Voir mes modèles",
+    "noModels": "Créez un modèle avant d’inviter votre premier destinataire.",
+    "issueTitle": "Préparer une attestation",
+    "issueLead": "Vérifiez le destinataire, renseignez les informations et choisissez qui peut les consulter.",
+    "recipient": "Destinataire",
+    "recipientFallback": "Destinataire ayant réclamé cette invitation",
+    "accountDetails": "Détails du compte vérifié",
+    "information": "Informations de l’attestation",
+    "reviewIssue": "Vérifier avant l’envoi",
+    "sendIssue": "Signer et envoyer l’attestation",
+    "reviewTitle": "Vérifiez les informations à envoyer",
+    "visibility": "Qui peut consulter ces informations ?",
+    "private": "Destinataire et personnes autorisées",
+    "public": "Tout le monde",
+    "publicFields": "Informations visibles sur un lien de partage public",
+    "publicPreview": "Visibles par toute personne ayant le lien",
+    "privatePreview": "Réservées aux personnes autorisées",
+    "publicWarning": "Tout le monde pourra copier les informations publiques. Elles ne pourront plus être rendues privées.",
+    "publicMetadata": "L’existence de l’attestation et les comptes de l’émetteur et du destinataire restent publics.",
+    "visibilityReviewed": "J’ai vérifié qui peut consulter chaque information.",
+    "expiration": "Valable jusqu’au (facultatif)",
+    "download": "Télécharger une copie technique",
+    "sendSuccess": "Attestation envoyée",
+    "nextAcceptance": "Le destinataire peut maintenant la consulter et l’accepter.",
+    "openAttestation": "Voir l’attestation",
+    "error": "Cette action n’a pas abouti. Vérifiez l’état actuel avant de réessayer.",
+    "fieldError": "Vérifiez les informations saisies avant de continuer.",
+    "invite": "Inviter un destinataire",
+    "inviteHelp": "Envoyez une invitation, puis vérifiez qui l’a réclamée avant d’envoyer l’attestation.",
+    "contactEmail": "Adresse email pour l’invitation",
+    "chooseModel": "Choisir un modèle",
+    "invitationSent": "Invitation envoyée. Suivez la réponse du destinataire ci-dessous.",
+    "deliveryDetails": "Détails de l’envoi de l’email",
+    "contactHelp": "Cet email sert à transmettre l’invitation. Le destinataire indiqué ci-dessous est la personne qui l’a réclamée.",
+    "readyAction": "Préparer l’attestation",
+    "waitingRecipient": "En attente du destinataire",
+    "createFirst": "Créez d’abord un modèle d’attestation.",
+    "cancelInvitation": "Annuler l’invitation",
+    "cancelInvitationConfirm": "Annuler cette invitation ? Une attestation déjà émise reste inchangée.",
+    "recorded": "Modification enregistrée.",
+    "revokeTitle": "Révoquer une attestation",
+    "revokeLead": "Vérifiez l’attestation et son destinataire avant de la révoquer.",
+    "reviewRevoke": "Vérifier la révocation",
+    "revoke": "Signer et révoquer l’attestation",
+    "revokeWarning": "Après confirmation, cette attestation ne sera plus valide. Les informations déjà partagées ne pourront pas être rappelées.",
+    "applyTitle": "Inscrire votre organisation",
+    "applyLead": "Présentez votre organisation pour qu’un administrateur examine votre demande d’émission d’attestations.",
+    "applySubmit": "Envoyer pour examen",
+    "applicationPrivacy": "Vos justificatifs sont privés. Seuls les administrateurs qui examinent votre demande peuvent y accéder.",
+    "applicationFields": {
+      "name": "Nom de l’organisation",
+      "website": "Site web",
+      "contact": "Email de contact",
+      "jurisdiction": "Pays ou territoire d’enregistrement",
+      "description": "Que fait votre organisation ?",
+      "purpose": "Quelles attestations souhaitez-vous délivrer ?"
+    },
+    "documentError": "Choisissez un à trois fichiers PDF, PNG ou JPEG, de 5 Mo maximum chacun.",
+    "documentsReady": "Fichiers sélectionnés",
+    "applicationNext": "Après approbation, vous pourrez créer un modèle et inviter des destinataires.",
+    "currentState": "État actuel",
+    "confirmedRecipient": "Compte du destinataire vérifié",
+    "modelNext": "Utilisez ce modèle pour inviter un destinataire.",
+    "yes": "Oui",
+    "no": "Non",
+    "fieldNameHint": "Commencez par une lettre. Utilisez des lettres sans accent, des chiffres ou des tirets bas, sans espaces.",
+    "invitationCreated": "Invitation créée. L’envoi de l’email n’est pas confirmé.",
+    "deliveryFailed": "L’email d’invitation n’a pas pu être envoyé. Vérifiez l’adresse avant de réessayer.",
+    "modelInvalid": "Ce modèle n’a pas pu être lu. Vérifiez son format dans l’éditeur avancé."
+  },
+  "simpleRecipient": {
+    "invitationReady": "Invitation confirmée. Votre portefeuille est déjà lié ; l’émetteur peut maintenant préparer votre attestation.",
+    "manageWallet": "Gérer mon portefeuille",
+    "reviewAttestation": "Consulter cette attestation",
+    "verificationDetails": "Détails des vérifications",
+    "walletDetails": "Adresse du portefeuille",
+    "walletCompatibility": "Portefeuilles compatibles et limites de la preuve",
+    "otherActions": "Autres actions",
+    "reviewStep": "1. Consulter l’attestation",
+    "signStep": "2. Confirmer dans votre portefeuille",
+    "reviewIntro": "Vérifiez l’émetteur et le contenu de l’attestation avant de l’accepter. Vous pouvez aussi la refuser sans lire son contenu.",
+    "reviewIssuer": "Émise par",
+    "reviewSubject": "Portefeuille destinataire",
+    "yourWallet": "Votre portefeuille connecté",
+    "credentialDetails": "Références de l’attestation",
+    "acceptedActions": "Cette attestation est déjà acceptée. Vous pouvez la consulter ou la partager ci-dessus.",
+    "removeIntro": "Retirer une attestation demande votre accord dans le portefeuille. Cela n’efface pas les copies déjà partagées.",
+    "walletIdentity": "Vérifier l’adresse du portefeuille",
+    "confirmReject": "Vérifier ce refus",
+    "confirmRemove": "Vérifier ce retrait",
+    "actionUnavailable": "Cette action n’a pas pu aboutir. Vérifiez la connexion de votre portefeuille, puis réessayez. Votre accord reste nécessaire."
+  },
+  "simpleNavigation": {
+    "metaTitle": "Vos attestations — XCS",
+    "eyebrow": "Vos attestations, au même endroit",
+    "title": "Recevoir, émettre et vérifier des attestations",
+    "description": "Retrouvez les attestations que vous recevez, partagez-les quand vous le souhaitez ou consultez une attestation qui vous a été transmise.",
+    "actionsLabel": "Que souhaitez-vous faire ?",
+    "receive": "Recevoir",
+    "receiveDescription": "Retrouvez vos invitations et attestations. Consultez-les avant de les accepter ou de les partager.",
+    "receiveAction": "Mes attestations",
+    "issue": "Émettre",
+    "issueDescription": "Envoyez des attestations au nom de votre organisation. Demandez un accès si vous débutez.",
+    "issueAction": "Mon organisation",
+    "verify": "Vérifier",
+    "verifyDescription": "Ouvrez un lien de partage pour consulter une attestation et le résultat de sa vérification.",
+    "verifyAction": "Vérifier une attestation",
+    "walletHelp": "Nous vous guiderons pour vous connecter et confirmer avec votre portefeuille lorsque ce sera nécessaire.",
+    "more": "Plus",
+    "protocolVerify": "Vérification avancée",
+    "footer": "Recevoir, partager et vérifier des attestations."
   }
 }
diff --git a/apps/web/nuxt.config.ts b/apps/web/nuxt.config.ts
index 8c54ffa..c83d3d4 100644
--- a/apps/web/nuxt.config.ts
+++ b/apps/web/nuxt.config.ts
@@ -109,18 +109,24 @@ export default defineNuxtConfig({
       // Force a fresh pre-bundle on each server start so a changed dependency
       // cannot be replaced by Nuxt's persistent dependency cache.
       force: true,
-      // `xrpl-connect` is reached only from the lazily loaded wallet adapters,
+      // The wallet plugin and its adapters are reached only after hydration,
       // and `vendoredPrebundleDependencies` covers the vendored protocol code
       // under `app/lib/xcs` (see that module, and the test that keeps it
       // honest). Without pre-bundling, Vite discovers them after the first page
       // load and re-optimizes mid-run, which 504s the in-flight requests.
-      include: [...vendoredPrebundleDependencies, 'xrpl-connect'],
+      include: [
+        ...vendoredPrebundleDependencies,
+        '@xrpl-commons/xrpl-connect-vue',
+        'xrpl-connect',
+        'ripple-keypairs',
+        'uqr',
+      ],
       // Served unbundled so the CSS-injection strip above also runs in dev.
       exclude: ['vaul-vue'],
     },
   },
   i18n: {
-    defaultLocale: 'fr',
+    defaultLocale: 'en',
     strategy: 'prefix_except_default',
     locales: [
       { code: 'fr', language: 'fr-FR', name: 'Français', file: 'fr.json' },
@@ -133,10 +139,11 @@ export default defineNuxtConfig({
     browserE2eMode,
     localPayloadStoreMode,
     public: {
+      issuerEnabled: '0',
+      payloadBaseUrl: '',
       profileId: '',
       rpcUrl: 'wss://s.altnet.rippletest.net:51233',
       xamanApiKey: '',
-      xamanRedirectUrl: '',
       walletConnectProjectId: '',
       browserE2eMode,
       localPayloadStoreMode,
@@ -155,7 +162,7 @@ export default defineNuxtConfig({
         'base-uri': ["'none'"],
         'connect-src': cspConnectSources,
         'font-src': ["'self'"],
-        'form-action': ["'self'"],
+        'form-action': ["'self'", 'https://account.xrpl.in'],
         'frame-ancestors': ["'none'"],
         'frame-src': ["'none'"],
         'img-src': ["'self'", 'data:'],
diff --git a/apps/web/package.json b/apps/web/package.json
index d5e4965..f03fdb8 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -4,8 +4,8 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt build",
-    "clean": "rm -rf .nuxt .output coverage",
+    "build": "XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt build && tsup scripts/admin-notifier.ts --format esm --out-dir dist/admin --clean",
+    "clean": "rm -rf .nuxt .output dist coverage",
     "dev": "nuxt dev",
     "format:check": "prettier --check .",
     "lint": "NODE_ENV=development XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt prepare && eslint . && NODE_ENV=development XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt typecheck",
@@ -14,43 +14,60 @@
     "test:coverage": "vitest run --coverage",
     "test:e2e": "playwright test",
     "test:e2e:security": "playwright test --config playwright.security.config.ts",
-    "test:postgres": "NODE_ENV=development XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt prepare && XCS_REQUIRE_POSTGRES_TESTS=1 vitest run test/postgres.integration.test.ts",
+    "test:postgres": "NODE_ENV=development XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt prepare && XCS_REQUIRE_POSTGRES_TESTS=1 vitest run --no-file-parallelism test/postgres.integration.test.ts test/auth-postgres.integration.test.ts test/admin-postgres.integration.test.ts test/issuer-postgres.integration.test.ts test/recipient-postgres.integration.test.ts test/verifier-postgres.integration.test.ts test/role-journey-postgres.integration.test.ts",
     "typecheck": "NODE_ENV=development XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 nuxt typecheck",
-    "verify": "pnpm format:check && pnpm lint && pnpm test && pnpm build"
+    "verify": "pnpm format:check && pnpm lint && pnpm test && pnpm build",
+    "admin:notify": "tsx scripts/admin-notifier.ts",
+    "admin:fixtures": "tsx scripts/admin-fixtures.ts",
+    "test:e2e:auth": "playwright test --config playwright.auth.config.ts",
+    "test:runtime": "XCS_REQUIRE_RUNTIME_TESTS=1 XCS_ADMIN_RUNTIME_TEST=1 XCS_ISSUER_RUNTIME_TEST=1 XCS_RECIPIENT_RUNTIME_TEST=1 XCS_ROLE_JOURNEY_RUNTIME_TEST=1 vitest run --no-file-parallelism test/api/runtime.integration.test.ts test/admin-postgres.integration.test.ts test/issuer-runtime.integration.test.ts test/recipient-verifier-runtime.integration.test.ts test/role-journey-runtime.integration.test.ts --testNamePattern \"exempts Nitro|serves SSR, readiness|serves four real|uploads a private application|filters anonymous and wrong-audience views|connects approval, invitation\""
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1141.0",
     "@iconify-json/lucide": "^1.2.135",
     "@iconify-json/simple-icons": "^1.2.97",
     "@noble/hashes": "2.3.0",
     "@nuxt/ui": "^4.11.1",
     "@nuxtjs/i18n": "^10.0.6",
     "@scure/base": "2.3.0",
+    "@xrpl-commons/xrpl-connect-vue": "1.0.0-rc.2",
     "ajv": "^8.20.0",
     "canonicalize": "4.0.0",
     "drizzle-orm": "^0.45.2",
+    "fast-json-stringify": "^6.1.1",
+    "h3": "1.15.11",
     "ipaddr.js": "^2.2.0",
     "jsonc-parser": "3.3.1",
     "multiformats": "14.0.5",
+    "nodemailer": "10.0.10",
     "nuxt": "^4.5.2",
     "nuxt-security": "2.6.0",
+    "ofetch": "^1.5.1",
+    "openid-client": "6.8.8",
     "postgres": "^3.4.7",
+    "rate-limiter-flexible": "^7.3.1",
+    "ripple-keypairs": "3.0.0",
     "tr46": "4.1.1",
     "undici": "^7.13.0",
+    "uqr": "0.1.3",
     "vue": "^3.5.21",
     "vue-router": "^5.2.0",
     "xrpl": "^5.0.0",
-    "xrpl-connect": "1.0.0-rc.0"
+    "xrpl-connect": "1.0.0-rc.2"
   },
   "devDependencies": {
     "@nuxt/eslint": "^1.17.0",
     "@playwright/test": "^1.62.1",
     "@types/node": "^24.0.0",
+    "@types/nodemailer": "7.0.11",
     "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
-    "h3": "1.15.11",
+    "light-my-request": "^6.6.0",
     "node-mock-http": "1.0.5",
     "prettier": "^3.6.2",
+    "tsup": "^8.5.0",
+    "tsx": "^4.20.3",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
     "vue-tsc": "^3.1.2"
@@ -66,12 +83,23 @@
       "unrs-resolver"
     ],
     "overrides": {
+      "@simple-git/argv-parser@<2.0.1": "2.0.1",
       "js-yaml@>=4.0.0 <4.3.2": "^4.3.2",
+      "shell-quote@<1.11.0": "1.11.0",
+      "simple-git@<4.0.2": "4.0.2",
+      "source-map-js@<1.2.2": "1.2.2",
       "svgo@>=4.0.0 <4.1.0": ">=4.1.0"
     },
     "patchedDependencies": {
-      "xrpl-connect@1.0.0-rc.0": "patches/xrpl-connect@1.0.0-rc.0.patch",
-      "vaul-vue@0.4.1": "patches/vaul-vue@0.4.1.patch"
+      "xrpl-connect@1.0.0-rc.2": "patches/xrpl-connect@1.0.0-rc.2.patch",
+      "vaul-vue@0.4.1": "patches/vaul-vue@0.4.1.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+    },
+    "auditConfig": {
+      "ignoreCves": [
+        "CVE-2026-85393",
+        "CVE-2026-93687"
+      ]
     }
   }
 }
diff --git a/apps/web/patches/README.md b/apps/web/patches/README.md
new file mode 100644
index 0000000..4bc4489
--- /dev/null
+++ b/apps/web/patches/README.md
@@ -0,0 +1,26 @@
+# XRPL Connect rc.2 — Crossmark session network
+
+`xrpl-connect@1.0.0-rc.2.patch` changes only the package's ESM entry consumed by Nuxt and the
+web tests. CommonJS/UMD consumers are not patched. The package version stays pinned to rc.2;
+pnpm records the patch hash in the lockfile and Docker copies it before frozen installation.
+
+Crossmark 0.2.19's public extension source (`static/js/948.bundle.js`) constructs SignIn
+results with `network: repo.Node.getBasicNode(selectedNode)`. Its separate NETWORK command
+reads the background `services.state.Node.getBasicNode()`, gated on a signed-in app. That
+getter reads `Base.flat.user.node`, but background `Base.forceStateSet()` replaces `Base.state`
+without updating `flat`. The getter can therefore remain incomplete or stale after approval;
+this is not merely a slow response. rc.2 used that getter both for connecting and before signing.
+
+The patch parses the fresh approval network and retains the raw lookup only for legacy SignIn
+responses that omit it. Account refresh and pre-signature checks instead validate the
+[documented SDK session network](https://docs.crossmark.io/session), which the SDK updates from
+SignIn responses and network-change events. Address refresh still queries Crossmark, and the
+application's account/network-change invalidation remains active. A missing or malformed session
+network fails closed, including a late SDK detection response that overwrites it. There is no
+fallback to the adapter's previous network and no default Testnet value. Transaction signatures
+and exact requested fields are still verified before XCS submits through its validated RPC.
+
+`crossmarkNetwork.test.ts` and `crossmark.production.spec.ts` cover the protocol boundary.
+The latter runs the real SDK with isolated extension messages, not a real wallet approval, and
+checks schema preparation against the running API and public Testnet without submitting.
+Remove the patch when an upstream release handles the approval network and passes these gates.
diff --git a/apps/web/patches/node-forge@1.4.0.patch b/apps/web/patches/node-forge@1.4.0.patch
new file mode 100644
index 0000000..bec5ae8
--- /dev/null
+++ b/apps/web/patches/node-forge@1.4.0.patch
@@ -0,0 +1,17 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+index a4264822b4dcd6dca44ca3e59e410c982eed7183..43090545115be1b1ffc484a2a27ecf31f840437e 100644
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1171,5 +1171,10 @@
+-          // validate DigestInfo structure and element count
++          // validate DigestInfo structure and element counts (outer DigestInfo
++          // and nested DigestAlgorithm). asn1.validate ignores extra children,
++          // so length must be checked explicitly at each nesting level to
++          // prevent low-exponent PKCS#1 v1.5 signature forgery (CVE-2026-85393).
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            obj.value[0].value.length !==
++              (('parameters' in capture) ? 2 : 1)) {
diff --git a/apps/web/patches/xrpl-connect@1.0.0-rc.0.patch b/apps/web/patches/xrpl-connect@1.0.0-rc.0.patch
deleted file mode 100644
index 39b41ac..0000000
--- a/apps/web/patches/xrpl-connect@1.0.0-rc.0.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-diff --git a/xrpl-connect.mjs b/xrpl-connect.mjs
-index 09fbcfd0f8ef85d2b0d3960777e7a1819bb0e563..d5585eb7864d5891b2669b6698c4245772307115 100644
---- a/xrpl-connect.mjs
-+++ b/xrpl-connect.mjs
-@@ -8369,9 +8369,18 @@ var mn = se("[Xaman]"), hn = class {
- 			if (!this.currentAccount) return null;
- 			let i = r?.jwtData, a = typeof i?.sub == "string" ? i.sub : "";
- 			if (!a) return this.currentAccount = null, null;
--			let o = i?.network_endpoint, s = i?.network_id, c = this.currentAccount.network;
--			if (typeof o == "string" && typeof s == "number") c = this.parseNetwork(o, s);
--			else if (o !== void 0 || s !== void 0) throw Error("Xaman ping returned incomplete network information");
-+			let o = i?.network_endpoint, s = i?.network_id, c = this.currentAccount.network, l;
-+			if (typeof s == "number" && Number.isSafeInteger(s)) l = s;
-+			else if (typeof s == "string" && /^(0|[1-9]\d*)$/.test(s)) {
-+				let e = Number(s);
-+				Number.isSafeInteger(e) && (l = e);
-+			}
-+			if (o != null && (typeof o != "string" || o.length === 0) || s != null && l === void 0) throw Error("Xaman ping returned invalid network information");
-+			if (l !== void 0) {
-+				let e = this.parseNetwork(typeof o == "string" ? o : c.wss, l);
-+				if (e.id !== c.id) throw Error("Xaman ping returned inconsistent network information");
-+				typeof o == "string" && (c = e);
-+			}
- 			return this.currentAccount = {
- 				address: a,
- 				publicKey: void 0,
-@@ -8439,7 +8448,7 @@ var mn = se("[Xaman]"), hn = class {
- 			let v, y;
- 			try {
--				v = p(_.hex), y = g.hashSignedTx(_.hex), this.validateSignedTransaction(v, _.hex, i, o, _.account, _.multisign_account, a), this.validateRequestedTransaction(e, v);
-+				v = p(_.hex), y = g.hashSignedTx(_.hex), this.validateSignedTransaction(v, _.hex, i, o, _.account, _.multisign_account, a), this.validateSignedTransactionRequest(e, v);
- 			} catch (e) {
- 				let t = e instanceof Error ? e.message : String(e);
- 				throw Error(`Xaman returned an invalid signed transaction blob: ${t}`);
- 			}
-@@ -8535,7 +8544,7 @@ var mn = se("[Xaman]"), hn = class {
- 		if (!r) {
- 			if (Array.isArray(s) && s.length > 0) throw Error("Xaman returned unexpected multi-signatures");
- 			if (e.Account !== n || i !== n) throw Error("Xaman signed with an account other than the connected account");
--			if (a !== null) throw Error("Xaman returned unexpected multi-signing account data");
-+			if (a != null && a !== "") throw Error("Xaman returned unexpected multi-signing account data");
- 			if (!y(t)) throw Error("Xaman returned an invalid transaction signature");
- 			return;
- 		}
-@@ -8553,6 +8562,23 @@ var mn = se("[Xaman]"), hn = class {
- 	validateRequestedTransaction(e, t) {
- 		if (!t || !this.containsRequestedValue(e, t)) throw Error("Xaman returned a transaction that did not match the signing request");
- 	}
-+	validateSignedTransactionRequest(e, t) {
-+		let n = [];
-+		if (t) {
-+			let r = { ...e }, i = { ...t };
-+			for (let e of ["LastLedgerSequence", "Signers", "SigningPubKey", "TxnSignature"]) delete r[e], delete i[e];
-+			try {
-+				if (m(r) === m(i)) return;
-+			} catch {
-+				// Fall through to the same request-mismatch error as non-equivalent transactions.
-+			}
-+			n = [...new Set([...Object.keys(r), ...Object.keys(i)])]
-+				.filter((e) => JSON.stringify(r[e]) !== JSON.stringify(i[e]))
-+				.sort();
-+		}
-+		let r = n.length > 0 ? ` (different fields: ${n.join(", ")})` : "";
-+		throw Error(`Xaman returned a transaction that did not match the signing request${r}`);
-+	}
- 	containsRequestedValue(e, t, n) {
- 		if (n && un.has(n)) return !0;
- 		if (n === "Signers") return this.containsRequestedSigners(e, t);
-@@ -8631,8 +8657,8 @@ var mn = se("[Xaman]"), hn = class {
- 			if (!i) throw Error("Failed to retrieve the resolved Xaman payload");
- 			return i;
- 		} catch (e) {
--			if (!n || r.aborted || Date.now() >= a) throw e;
--			mn.debug("Unable to retrieve submitted Xaman payload; retrying", e);
-+			if (r.aborted || Date.now() >= a) throw e;
-+			mn.debug("Unable to retrieve resolved Xaman payload; retrying", e);
- 			let t = Math.min(i, a - Date.now());
- 			await this.waitForOperation(new Promise((e) => setTimeout(e, t)), r), i = Math.min(i * 2, cn);
- 		}
diff --git a/apps/web/patches/xrpl-connect@1.0.0-rc.2.patch b/apps/web/patches/xrpl-connect@1.0.0-rc.2.patch
new file mode 100644
index 0000000..ec6a828
--- /dev/null
+++ b/apps/web/patches/xrpl-connect@1.0.0-rc.2.patch
@@ -0,0 +1,59 @@
+diff --git a/xrpl-connect.mjs b/xrpl-connect.mjs
+index 0b6a7a43cdc52c2e1683db6b8c7ca68c52afd6ac..694a1ce8198c127b05e0448092e157ed2f777dc3 100644
+--- a/xrpl-connect.mjs
++++ b/xrpl-connect.mjs
+@@ -11113,7 +11113,11 @@ var Gn = class {
+ 			if (!a || !a.response || !a.response.data) throw Error("Failed to sign in with Crossmark");
+ 			let { address: o, publicKey: s } = a.response.data;
+ 			if (!o) throw Error("No address returned from Crossmark");
+-			let c = await this.getLiveNetwork();
++			// Crossmark 0.2.19 returns the selected node with this approval.
++			// Its separate background NETWORK replica may not be hydrated yet.
++			let c = a.response.data.network === void 0
++				? await this.getLiveNetwork()
++				: this.parseNetwork(a.response.data.network);
+ 			if (t !== this.connectionGeneration) throw L.notConnected();
+ 			if (r && r.id !== c.id) throw L.networkMismatch(r.id, c.id);
+ 			return this.currentAccount = {
+@@ -11144,7 +11148,7 @@ var Gn = class {
+ 		if (!this.currentAccount) return null;
+ 		let r = n.response?.data?.address;
+ 		if (!r) return this.currentAccount = null, null;
+-		let i = await this.getLiveNetwork();
++		let i = this.getSessionNetwork();
+ 		if (e !== this.connectionGeneration) throw L.notConnected();
+ 		if (t !== this.accountRefreshRevision) return this.currentAccount;
+ 		if (!this.currentAccount) return null;
+@@ -11162,8 +11166,13 @@ var Gn = class {
+ 		} catch (e) {
+ 			throw L.connectionFailed(this.name, e);
+ 		}
+-		let t = e?.response?.data?.network;
+-		if (!t?.type || !t.label || !t.wss) throw L.connectionFailed(this.name, /* @__PURE__ */ Error("Crossmark returned incomplete network information"));
++		return this.parseNetwork(e?.response?.data?.network);
++	}
++	parseNetwork(t) {
++		if (!t || typeof t !== "object" ||
++			![t.type, t.label, t.wss].every((value) => typeof value === "string" && value.trim().length > 0) ||
++			[t.protocol, t.rpc].some((value) => value !== void 0 && typeof value !== "string"))
++			throw L.connectionFailed(this.name, /* @__PURE__ */ Error("Crossmark returned incomplete network information"));
+ 		return this.toNetworkInfo({
+ 			protocol: t.protocol,
+ 			type: t.type,
+@@ -11172,9 +11181,15 @@ var Gn = class {
+ 			rpc: t.rpc
+ 		});
+ 	}
++	getSessionNetwork() {
++		// The SDK updates this from approval and network-change events.
++		// Crossmark 0.2.19's raw NETWORK getter reads a stale Base.flat.
++		// Never fall back to the adapter's previously approved network.
++		return this.parseNetwork(Bn.session.network);
++	}
+ 	async assertCurrentNetwork() {
+ 		if (!this.currentAccount) throw L.notConnected();
+-		let e = this.connectionGeneration, t = await this.getLiveNetwork();
++		let e = this.connectionGeneration, t = this.getSessionNetwork();
+ 		if (e !== this.connectionGeneration || !this.currentAccount) throw L.notConnected();
+ 		if (t.id !== this.currentAccount.network.id) throw L.networkMismatch(this.currentAccount.network.id, t.id);
+ 	}
diff --git a/apps/web/playwright.auth.config.ts b/apps/web/playwright.auth.config.ts
new file mode 100644
index 0000000..066e8c7
--- /dev/null
+++ b/apps/web/playwright.auth.config.ts
@@ -0,0 +1,40 @@
+import { fileURLToPath } from 'node:url'
+
+import { defineConfig, devices } from '@playwright/test'
+
+const port = process.env.XCS_AUTH_E2E_PORT ?? '3127'
+const baseURL = `http://127.0.0.1:${port}`
+export default defineConfig({
+  testDir: './e2e',
+  testMatch: 'auth.spec.ts',
+  outputDir: './test-results/auth',
+  fullyParallel: false,
+  workers: 1,
+  forbidOnly: Boolean(process.env.CI),
+  retries: process.env.CI ? 1 : 0,
+  use: {
+    ...devices['Desktop Chrome'],
+    baseURL,
+    screenshot: 'only-on-failure',
+    trace: 'retain-on-failure',
+  },
+  webServer: {
+    command: `pnpm dev --host 127.0.0.1 --port ${port}`,
+    url: baseURL,
+    reuseExistingServer: false,
+    timeout: 120000,
+    stdout: 'pipe',
+    stderr: 'pipe',
+    env: {
+      NUXT_IGNORE_LOCK: '1',
+      XCS_BROWSER_E2E: '1',
+      XCS_AUTH_BROWSER_E2E: '1',
+      XCS_AUTH_TEST_ORIGIN: baseURL,
+      XCS_LOCAL_PAYLOAD_STORE: '0',
+      XCS_NETWORK_PROFILE: fileURLToPath(
+        new URL('./test/fixtures/network-profiles/browser-e2e.json', import.meta.url),
+      ),
+      NUXT_PUBLIC_RPC_URL: 'ws://127.0.0.1:1',
+    },
+  },
+})
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 6053bdd..e791537 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -7,7 +7,7 @@ const baseURL = `http://127.0.0.1:${port}`
 
 export default defineConfig({
   testDir: './e2e',
-  testIgnore: 'security.production.spec.ts',
+  testIgnore: ['security.production.spec.ts', 'crossmark.production.spec.ts', 'auth.spec.ts'],
   outputDir: './test-results',
   fullyParallel: false,
   forbidOnly: Boolean(process.env.CI),
diff --git a/apps/web/playwright.crossmark.config.ts b/apps/web/playwright.crossmark.config.ts
new file mode 100644
index 0000000..84ba606
--- /dev/null
+++ b/apps/web/playwright.crossmark.config.ts
@@ -0,0 +1,19 @@
+import { defineConfig } from '@playwright/test'
+
+// Runs against an already-started production build. The extension transport
+// fixture exists only in Playwright's isolated browser, never in the website.
+export default defineConfig({
+  testDir: './e2e',
+  testMatch: 'crossmark.production.spec.ts',
+  workers: 1,
+  retries: 0,
+  use: {
+    baseURL: process.env.XCS_WALLET_TEST_URL ?? 'https://localhost:3443',
+    ignoreHTTPSErrors: false,
+    launchOptions: {
+      executablePath: process.env.XCS_BROWSER_EXECUTABLE,
+      chromiumSandbox: true,
+      ignoreDefaultArgs: ['--use-mock-keychain', '--password-store=basic'],
+    },
+  },
+})
diff --git a/apps/web/playwright.issuer-journal.config.ts b/apps/web/playwright.issuer-journal.config.ts
new file mode 100644
index 0000000..616d60e
--- /dev/null
+++ b/apps/web/playwright.issuer-journal.config.ts
@@ -0,0 +1,8 @@
+import { defineConfig, devices } from '@playwright/test'
+
+export default defineConfig({
+  testDir: './e2e',
+  testMatch: 'issuer-journal.spec.ts',
+  workers: 1,
+  use: { ...devices['Desktop Chrome'] },
+})
diff --git a/apps/web/playwright.security.config.ts b/apps/web/playwright.security.config.ts
index 693d661..f48e732 100644
--- a/apps/web/playwright.security.config.ts
+++ b/apps/web/playwright.security.config.ts
@@ -2,7 +2,8 @@ import { fileURLToPath } from 'node:url'
 
 import { defineConfig, devices } from '@playwright/test'
 
-const baseURL = 'http://127.0.0.1:3101'
+const port = process.env.XCS_SECURITY_E2E_PORT ?? '3101'
+const baseURL = `http://127.0.0.1:${port}`
 
 export default defineConfig({
   testDir: './e2e',
@@ -29,7 +30,10 @@ export default defineConfig({
     env: {
       NODE_ENV: 'production',
       NITRO_HOST: '127.0.0.1',
-      NITRO_PORT: '3101',
+      NITRO_PORT: port,
+      // Production uses the standalone API config, never the fixture repository.
+      XCS_DATABASE_URL: 'postgres://xcs_api@127.0.0.1:1/security-test',
+      XCS_ALLOWED_ORIGINS: baseURL,
       NUXT_BROWSER_E2E_MODE: 'disabled',
       NUXT_PUBLIC_BROWSER_E2E_MODE: 'disabled',
       // The browser-visible profile identifier is derived from this file's
@@ -39,10 +43,6 @@ export default defineConfig({
       ),
       XCS_BROWSER_E2E: '0',
       XCS_LOCAL_PAYLOAD_STORE: '0',
-      // The production build boots the real API context; the address is
-      // deliberately unreachable so the read routes answer 503 rather than data.
-      XCS_DATABASE_URL: 'postgres://127.0.0.1:1/xcs',
-      XCS_ALLOWED_ORIGINS: baseURL,
     },
   },
   projects: [{ name: 'chromium-security-production', use: { ...devices['Desktop Chrome'] } }],
diff --git a/apps/web/pnpm-lock.yaml b/apps/web/pnpm-lock.yaml
index 6547933..85e343e 100644
--- a/apps/web/pnpm-lock.yaml
+++ b/apps/web/pnpm-lock.yaml
@@ -5,21 +5,31 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  '@simple-git/argv-parser@<2.0.1': 2.0.1
   js-yaml@>=4.0.0 <4.3.2: ^4.3.2
+  shell-quote@<1.11.0: 1.11.0
+  simple-git@<4.0.2: 4.0.2
+  source-map-js@<1.2.2: 1.2.2
   svgo@>=4.0.0 <4.1.0: '>=4.1.0'
 
 patchedDependencies:
+  node-forge@1.4.0:
+    hash: 02907f52247711a7ef40888d32c1b81ba9d2978da8eb131d6e57149fc6475820
+    path: patches/node-forge@1.4.0.patch
   vaul-vue@0.4.1:
     hash: 745c51497acce22bbe96fcc248a7de7767e5f8beee0f24441d9d34c33e89faa0
     path: patches/vaul-vue@0.4.1.patch
-  xrpl-connect@1.0.0-rc.0:
-    hash: e2ed5ff5b3a2c073307e088b37dc70382b07d407935c719d8be11a4a04332989
-    path: patches/xrpl-connect@1.0.0-rc.0.patch
+  xrpl-connect@1.0.0-rc.2:
+    hash: fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a
+    path: patches/xrpl-connect@1.0.0-rc.2.patch
 
 importers:
 
   .:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.1141.0
+        version: 3.1141.0
       '@iconify-json/lucide':
         specifier: ^1.2.135
         version: 1.2.136
@@ -31,13 +41,16 @@ importers:
         version: 2.3.0
       '@nuxt/ui':
         specifier: ^4.11.1
-        version: 4.11.2(ec9dd9a06663e7a932dfb8f38752dddf)
+        version: 4.11.2(6d450da6065ab185a789c3389c81ae31)
       '@nuxtjs/i18n':
         specifier: ^10.0.6
-        version: 10.6.0(@vue/compiler-dom@3.5.43)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(magicast@0.5.5)(rolldown@1.2.10)(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+        version: 10.6.0(@vue/compiler-dom@3.5.43)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(magicast@0.5.5)(rolldown@1.2.10)(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       '@scure/base':
         specifier: 2.3.0
         version: 2.3.0
+      '@xrpl-commons/xrpl-connect-vue':
+        specifier: 1.0.0-rc.2
+        version: 1.0.0-rc.2(vue@3.5.43(typescript@5.9.3))(xrpl-connect@1.0.0-rc.2(patch_hash=fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)))(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10))
       ajv:
         specifier: ^8.20.0
         version: 8.20.0
@@ -47,6 +60,12 @@ importers:
       drizzle-orm:
         specifier: ^0.45.2
         version: 0.45.3(postgres@3.4.9)
+      fast-json-stringify:
+        specifier: ^6.1.1
+        version: 6.4.0
+      h3:
+        specifier: 1.15.11
+        version: 1.15.11
       ipaddr.js:
         specifier: ^2.2.0
         version: 2.5.0
@@ -56,67 +75,94 @@ importers:
       multiformats:
         specifier: 14.0.5
         version: 14.0.5
+      nodemailer:
+        specifier: 10.0.10
+        version: 10.0.10
       nuxt:
         specifier: ^4.5.2
-        version: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
+        version: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(tsx@4.23.12)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
       nuxt-security:
         specifier: 2.6.0
-        version: 2.6.0(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+        version: 2.6.0(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
+      ofetch:
+        specifier: ^1.5.1
+        version: 1.5.1
+      openid-client:
+        specifier: 6.8.8
+        version: 6.8.8
       postgres:
         specifier: ^3.4.7
         version: 3.4.9
+      rate-limiter-flexible:
+        specifier: ^7.3.1
+        version: 7.4.0
+      ripple-keypairs:
+        specifier: 3.0.0
+        version: 3.0.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
       tr46:
         specifier: 4.1.1
         version: 4.1.1
       undici:
         specifier: ^7.13.0
         version: 7.29.1
+      uqr:
+        specifier: 0.1.3
+        version: 0.1.3
       vue:
         specifier: ^3.5.21
         version: 3.5.43(typescript@5.9.3)
       vue-router:
         specifier: ^5.2.0
-        version: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+        version: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       xrpl:
         specifier: ^5.0.0
         version: 5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
       xrpl-connect:
-        specifier: 1.0.0-rc.0
-        version: 1.0.0-rc.0(patch_hash=e2ed5ff5b3a2c073307e088b37dc70382b07d407935c719d8be11a4a04332989)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10))
+        specifier: 1.0.0-rc.2
+        version: 1.0.0-rc.2(patch_hash=fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10))
     devDependencies:
       '@nuxt/eslint':
         specifier: ^1.17.0
-        version: 1.17.0(@typescript-eslint/utils@8.70.1(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(@vue/compiler-sfc@3.5.43)(crossws@0.4.12(srvx@0.11.22))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(srvx@0.11.22)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        version: 1.17.0(@typescript-eslint/utils@8.70.1(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(@vue/compiler-sfc@3.5.43)(crossws@0.4.12(srvx@0.11.22))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(srvx@0.11.22)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@playwright/test':
         specifier: ^1.62.1
         version: 1.62.1
       '@types/node':
         specifier: ^24.0.0
         version: 24.13.6
+      '@types/nodemailer':
+        specifier: 7.0.11
+        version: 7.0.11
       '@vitest/coverage-v8':
         specifier: ^3.2.4
-        version: 3.2.7(vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1))
+        version: 3.2.7(vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       eslint:
         specifier: ^9.39.4
         version: 9.39.5(jiti@2.7.0)
       eslint-config-prettier:
         specifier: ^10.1.8
         version: 10.1.8(eslint@9.39.5(jiti@2.7.0))
-      h3:
-        specifier: 1.15.11
-        version: 1.15.11
+      light-my-request:
+        specifier: ^6.6.0
+        version: 6.6.0
       node-mock-http:
         specifier: 1.0.5
         version: 1.0.5
       prettier:
         specifier: ^3.6.2
         version: 3.9.9
+      tsup:
+        specifier: ^8.5.0
+        version: 8.5.1(jiti@2.7.0)(postcss@8.5.28)(tsx@4.23.12)(typescript@5.9.3)(yaml@2.9.1)
+      tsx:
+        specifier: ^4.20.3
+        version: 4.23.12
       typescript:
         specifier: ^5.8.3
         version: 5.9.3
       vitest:
         specifier: ^3.2.4
-        version: 3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
+        version: 3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       vue-tsc:
         specifier: ^3.1.2
         version: 3.3.11(typescript@5.9.3)
@@ -140,6 +186,78 @@ packages:
     peerDependencies:
       '@types/json-schema': ^7.0.15
 
+  '@aws-sdk/checksums@3.1001.1':
+    resolution: {integrity: sha512-x12Q17KYlJAd3nKf8LV5LV0vt8sh8/6YfQLGPtrGnQf/tW4jqxPGq5GPpuVitpQYM3eUR4XB7CbxZf751NMbLw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/client-s3@3.1141.0':
+    resolution: {integrity: sha512-uOVH37xGLenAdJkCPCin/JJG2PgWrFcSsDnQ9+C9Zq8N9Oalo5ol4xmn5fG28iWAlA/b/9boQZgHbMh+UsIhcg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/core@3.978.1':
+    resolution: {integrity: sha512-LbY9aGsEiznDWmUc30Nwv3aIX/+dbwTx8KfS0yOC3NPYMO+O91e6jkT1azf34FwjOndq8/Q+RcVVZz5xnerwdg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-env@3.972.72':
+    resolution: {integrity: sha512-xTKO/FWJPozTIXbozVnVGoNBhaGba8TBcx+KyUjRVeOlXE+dUc7GTR1cLvu0uTdIdmemzaFbqqCshXeZA1fZew==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-http@3.972.74':
+    resolution: {integrity: sha512-u91E/hT8f4d1xy0Jl7VG4nVKJ3lxbrZkoBTeSVoJdWBiSEUMwMS/9+e0H/aJVQV//Lt5wuzP+E69v4aRSsNTmw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-ini@3.973.17':
+    resolution: {integrity: sha512-ged4KXdBkvIC81bLvNHHuQKdKak/VXhQTR1NWYTTqW0474nlmsxy9O/vlgTIohDDWH3xpBdtVMZRyjb+DnocDA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-login@3.972.79':
+    resolution: {integrity: sha512-L+Z85anONJd8MaiuraO4wRxATCdEejBZ3K3eymzWI5JPXa9sOS9CkIm72PBKqXKX+Z9p9NGMX5AIMXm0LEflgw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-node@3.972.84':
+    resolution: {integrity: sha512-oHt854odINVwzwsh+c5x69j0ajm4DbqqqVJ+O1ECsCIZeMDAbzFpXItaqP7UZstJj/ATdTk/KFSH0LaNAgV+kA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-process@3.972.72':
+    resolution: {integrity: sha512-rLIp2xbMjX/k9/od7APpqq1ZgXXnV0pOL1Th3ZsL8Wu0TRtBsDTVS8iPqcfRFcHakFxPvR04OSTv2ka2qOb/2A==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-sso@3.973.16':
+    resolution: {integrity: sha512-IGihaJfFZYacJJr/odqILCoK7W/mvrZ7cuK7ECn3sAu4vLC6u0V8bS7mCGbdugJ8Aum2tnvqmx0F2MRFp2rn9g==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-web-identity@3.972.78':
+    resolution: {integrity: sha512-/y9WvNtlcPBGLR0qc1a+9J/xtYZfVczvLUOuXaVWylzttH7ewsxwHtjmiJSolNrVSDorIxHGHMU61CbonRkmwA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-sdk-s3@3.972.77':
+    resolution: {integrity: sha512-E7W2UOeUoc+lg3uIfR/dM7ZwusHwhBQrKMnlkRv4EXRR+C0YtV1pg25xC7GdZIhXH+NAMgZPCbE7o5to2cjFiw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/nested-clients@3.997.46':
+    resolution: {integrity: sha512-oRxtBcka/JGHGs9l9p9IVajGoTP8vTPmoAzdHGy4Qcy9P5vPnDf6nhIeM/COQNY9k/OahImTRaLkHftoXvfcmQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/signature-v4-multi-region@3.996.47':
+    resolution: {integrity: sha512-Zk08macMvQTHzQJCLJVkOlviVoqwYMrpXv4lmLN7b7sAbiMoOK7Go0NYdR5UeF+MW8LIbRmwrNy9u/5VvX1U5g==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/token-providers@3.1138.0':
+    resolution: {integrity: sha512-GpyAr0DD63YOEmYFM6Df+gJuIgC92MMTiBK4FTKfxii5MJ9ge20epR7LyroulscYlG89J+ZB2ivFDPjvfQhzdw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/types@3.974.6':
+    resolution: {integrity: sha512-v/clNZzZnDxGyvpHMOGpJKVXFAExJzUNAAjaWGdcx8QAcXLGwTaOkw33p5SHAi0YAioK32xB3hWwOekRVfmfKg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/xml-builder@3.972.41':
+    resolution: {integrity: sha512-ctjVSyCMegrWfXlx6VqzSBFI6UqmQ5ZlnfMhdLIiWmhoH8UAQxSCP5N3OpG7X3k4LnS7ou74C4mt20+bfTW2aQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws/lambda-invoke-store@0.3.0':
+    resolution: {integrity: sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ==}
+    engines: {node: '>=18.0.0'}
+
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
@@ -878,6 +996,9 @@ packages:
     resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@fastify/merge-json-schemas@0.2.1':
+    resolution: {integrity: sha512-OA3KGBCy6KtIvLf8DINC5880o5iBlDX4SxzLQS8HorJAbqluzLRn80UXU0bxZn7UOFhFgpRJDasfwn9nG4FG4A==}
+
   '@floating-ui/core@1.8.0':
     resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==}
 
@@ -1045,6 +1166,9 @@ packages:
   '@jridgewell/source-map@0.3.11':
     resolution: {integrity: sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==}
 
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
   '@jridgewell/sourcemap-codec@1.6.0':
     resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
 
@@ -1772,139 +1896,277 @@ packages:
       rollup:
         optional: true
 
+  '@rollup/rollup-android-arm-eabi@4.62.4':
+    resolution: {integrity: sha512-RrPokAb7dmbxFoeO3TloqHyOjgye8RkBhSqmp4aJMIex4c9r46ZstPnleDQOq1t46VOVjwIuwNogIqbodV1Vvg==}
+    cpu: [arm]
+    os: [android]
+
   '@rollup/rollup-android-arm-eabi@4.63.4':
     resolution: {integrity: sha512-I+BSHzTAhKN2n7ZwGZsegGcZjDpLqFOMAtJz/u6uFGe0pUFbq56dEHjqJV/ZUdRJtNXNxA+hREUatZBvMR3Oiw==}
     cpu: [arm]
     os: [android]
 
+  '@rollup/rollup-android-arm64@4.62.4':
+    resolution: {integrity: sha512-JKuJc+pnpks2pjy7L/N3v/cAkZxYlnmuZoD840ldbMI5KDbC4iO9NKwPKYdjYFCMAIIlBzYSFHxIJVYzRo2/8A==}
+    cpu: [arm64]
+    os: [android]
+
   '@rollup/rollup-android-arm64@4.63.4':
     resolution: {integrity: sha512-pu3BdjS2LtEzRu2elmGzS3fIeWSZy4BMDIaLNwjorO76+k2d0LMluijhsDx3KQyQBQ/lLUZCQA9/s6csvUfuhw==}
     cpu: [arm64]
     os: [android]
 
+  '@rollup/rollup-darwin-arm64@4.62.4':
+    resolution: {integrity: sha512-krw5uS2STmvJ02x0uTXHbqQNuz+9eZ1iw+qXk9dmW2gvV4jV7O2hEoOnuhFrpOPiel1mBFtqbxYZZtC46hXLOw==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@rollup/rollup-darwin-arm64@4.63.4':
     resolution: {integrity: sha512-xfSrj9MHnWK9GaSqT9U0ImHtH/N8WZlHLx4cZHiuLcqs640hvZ3hLPd5UR2AZS57FaE8HrRUSpltbZdWRxHiDA==}
     cpu: [arm64]
     os: [darwin]
 
+  '@rollup/rollup-darwin-x64@4.62.4':
+    resolution: {integrity: sha512-wsTxtgApb4PrOsNJIm0FZ1h3WvCC+k9uxLJ4ad75hgoS4NiRes2SoJFlDAyMwiUY8IssDqGcHbXuN0sx1tfF1A==}
+    cpu: [x64]
+    os: [darwin]
+
   '@rollup/rollup-darwin-x64@4.63.4':
     resolution: {integrity: sha512-bqU99PLJb/dqb3S0GIMdeuyAEETSUgZBoqXYd3Sd+WCsV+MmPhnN6JrotWyir31+QgH7EvvE5/mwGJlEoci8Fw==}
     cpu: [x64]
     os: [darwin]
 
+  '@rollup/rollup-freebsd-arm64@4.62.4':
+    resolution: {integrity: sha512-GUOnQlyZe3yAXhWOtOMsn5Qkrv5E5mZXa0thbARWi5Ei2szlVXJFQhddZ4HbAzh8q92w5twp+CQvs/eFanz9YQ==}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@rollup/rollup-freebsd-arm64@4.63.4':
     resolution: {integrity: sha512-JinsFZ5G40oXQb+sUuiA5x689vhr6dDYK0H0NL+rwKdL6CqnmYN8PE4ZwfRSoIjrCxqTQG/SLfTtSvHeGxoVlw==}
     cpu: [arm64]
     os: [freebsd]
 
+  '@rollup/rollup-freebsd-x64@4.62.4':
+    resolution: {integrity: sha512-/Y7f3QuxjzPKsjA/rfEDa3+0vXqyjmJ50Ln8dPpCmWkKTrUoWHG1cWhTqaAMLob2m2nESWuC7yGrREz019Ztqg==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@rollup/rollup-freebsd-x64@4.63.4':
     resolution: {integrity: sha512-GAdA4UxpiNm27cLHr2GqXBpAD0x9FqwYBY7/YSP0Ss0/PNi4k8gbviqpIpYbVSRBaS2ZcegXEzgTQMbRNCwxCw==}
     cpu: [x64]
     os: [freebsd]
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
+    resolution: {integrity: sha512-81wiiX3v7aqy+T+bT61TJ78yJjRquqFFTTbAPt08imfQQzkPIW8t6aJbkTagtCCrXMNc9D66+geqlK7ydLPNqA==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-arm-gnueabihf@4.63.4':
     resolution: {integrity: sha512-qDd6NoA1znaLjp4jR5U/KWCdLAKDJNB8W9ChbbDaKbo0xA+Atln5HK6LFCZ4oJQpemtRZA288DCirFRjrspptw==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-arm-musleabihf@4.62.4':
+    resolution: {integrity: sha512-9kmDIvNZqdoHOBZgNtpTBeLWYO/LVipM3H/j62P8848/l/VPEQL6N3uxU9pvP1oZAsXyC2MEnFP3ovRjo7WYNQ==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-arm-musleabihf@4.63.4':
     resolution: {integrity: sha512-WtB5Tz5KTNINb8ZA+8sQ7bmjuS1JrRT7YverYIhUGdWWDlpzVWmIwuZE+jidkEXUn1l0zrEkaIMa8dHF3NGcsA==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-linux-arm64-gnu@4.62.4':
+    resolution: {integrity: sha512-CcnXHWnXg69g+DX5VWL3FHts3qMRN2uVEHX+BZvGLdd07/gXkn3ePjYtO1LDJvxkGKVHMclKBRa1QUTH+6toYQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-arm64-gnu@4.63.4':
     resolution: {integrity: sha512-VcQ3L1tjnkKzWjryAVaFhHEWcqOfICX9uxVVoDzm2t0DpgKRHd2zOpVrJc0xsWeBZcBFyYROCIBdyR/fS174pg==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-arm64-musl@4.62.4':
+    resolution: {integrity: sha512-iFOibiHnTRuhrWLlRsOQFdZJJIa7S8OwkneJr4ocALP16u5yk6lWLINFwhHaEqBFMsKDUZofLkGos7+CPzGB3g==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-arm64-musl@4.63.4':
     resolution: {integrity: sha512-6+ZQX6P5s0cMDN2Ypb8Lbm2+/sZYmZjdaYny992ujUU9UKi/4CWoJWsl1pNvjWJHNHGK51m+jKGLlh1ylb2ifQ==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-linux-loong64-gnu@4.62.4':
+    resolution: {integrity: sha512-XnWYMI7euHlb5a871xPja+Gm7DRCFU+FGRrtS2sMq9N8FvqtpagUy6gD4YOemC5MRk9xbh8+jYMEJbigFQwsgA==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-loong64-gnu@4.63.4':
     resolution: {integrity: sha512-D72ZnvkFkBXOfzMMQLcwfPLyGkKb7HZ9/mf97B7v6/P5Lbv4oFOtSY/uHbS8lH6uKUOxoKiuokdb50XZSzzbJw==}
     cpu: [loong64]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-loong64-musl@4.62.4':
+    resolution: {integrity: sha512-qGDAlO0U8xedCcsdRm9oaoQY8DAx/QT7uIxJWhCdx0ceIWX783UC9QSYkdpzAe29wNiVfp24+bZdQmn49o45SQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-loong64-musl@4.63.4':
     resolution: {integrity: sha512-piU6BxeqA3O9KSu3kRCIQQtNqFFaTu21SEV4FwaRZowpnj3bLaWPZHw+xFqCs0XlJ+aOH3PTRWGoglH+mKA/OA==}
     cpu: [loong64]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-linux-ppc64-gnu@4.62.4':
+    resolution: {integrity: sha512-ru4H6ezD7ysA5EiEK6qkkaEb4modH8CTej6kUy/gQi20u3kB3G7Zn8snXXkeJSCOFKG/rbPPtM/+9Wgas1961w==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-ppc64-gnu@4.63.4':
     resolution: {integrity: sha512-/5PGpHwqt2EEEOUs1XwzubE/ucr0dWDQ+to3zqi4Ds7EWpwtQ79wXc4JBoxqj/OwpawTsKWzJxHfSuBOq3DrWA==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-ppc64-musl@4.62.4':
+    resolution: {integrity: sha512-2W4MO5WQVJnbJaZdvDb9rhBDuFU1nKIepPFpJUBsTh2k1YY2g+ODViaWuyOAjQ5cOP7NvrvLzt3wvHOoiAvc7w==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-ppc64-musl@4.63.4':
     resolution: {integrity: sha512-cX3beZDLWt7G2oJF+nhChiT+qtaihs+S2xi7ziGmVB+2pwPng6D0Ed0HmElQOgv2UsUmSJJLGwpBao/3TDx3VA==}
     cpu: [ppc64]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-linux-riscv64-gnu@4.62.4':
+    resolution: {integrity: sha512-+fxjfuoAmVMCYV5QyjoIpu0cp5DOiOTeqYFk1AVaxGr+/ravWLX89XfQmptsoWcaVy/TGf2hexzbUOrCQIL1CQ==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-riscv64-gnu@4.63.4':
     resolution: {integrity: sha512-1uz2mGWHyptR7DgHHrlbdRAjXK7v7elGZ9lMja910/RP+ZYbX6xAmCiU9UZSX4hqmgtHMv6lr5l3kq1HIOpcag==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-riscv64-musl@4.62.4':
+    resolution: {integrity: sha512-jTn8JfHGL4djjFxPuM06LmNUJDsst2jeVlsd9OmIH6zc5sC9K6rIuO4YajXatLUpBmBKl6b35ro1QZocLi+tcA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-riscv64-musl@4.63.4':
     resolution: {integrity: sha512-nLS8topojxyz7SRpKR2IODRpQ0XPZ+xaOXvT3+hqK/Uy8Lo5HFgkkIBiIrCu5tL5YqzTvgovGw55PwpahTAGig==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-linux-s390x-gnu@4.62.4':
+    resolution: {integrity: sha512-oCJCJL4pXsoDcP2QZ+JVlPTIRc6266zsIaeJJsWImmF7HO0W8nb6HuSgZlMWxJwaPf8ehbSw8yo0EUw925hKsA==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-s390x-gnu@4.63.4':
     resolution: {integrity: sha512-gs7DRKotr3l3q+jGPQBjH0ng1FjlEDm5ueQrkw5JtQvtLyEIcLASqAEaor56BhkKRzk+IcQzrcanBdb/bBQn8g==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-x64-gnu@4.62.4':
+    resolution: {integrity: sha512-W69hukhZ3KKNRCaMIEzKvcFye42hh0FE1+YoYaf5+Ikacuftoco6yO/xouz0hc5d5W/s3yBro5jRiuEE/Q5vUw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@rollup/rollup-linux-x64-gnu@4.63.4':
     resolution: {integrity: sha512-791ET7W17NnScOZM7h4dX5hYspxE28htPFsb1awY/NRR8+PRNkS53e475rDdxXXDrP+kwnCcNWg9CX5ztn/Aqw==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
+  '@rollup/rollup-linux-x64-musl@4.62.4':
+    resolution: {integrity: sha512-qiXbGG2jkjXhzXpsFZSR2Xpb8DN/UaxYsbb/STbuR/6fpaDgRmmaq1B/LmtF2wQFOFOSsK2jdE0RZ3a0zHn4QA==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@rollup/rollup-linux-x64-musl@4.63.4':
     resolution: {integrity: sha512-iwZQRcmj7g88g3tzefIrQY7qvmuA/cfYwhrDtTBhsmukO4U2huVO5W+86XacUMRvdSFVAc6kZUZy21JaRwiB9w==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
+  '@rollup/rollup-openbsd-x64@4.62.4':
+    resolution: {integrity: sha512-nWeM//hxv8mIo6jD7Hu4o48DVmV9pbV6gsKaWU+4NFyqHoPKwrkRiZGLKUhOBk8qNmDmpwFtPKg80Bo/Tn4xiQ==}
+    cpu: [x64]
+    os: [openbsd]
+
   '@rollup/rollup-openbsd-x64@4.63.4':
     resolution: {integrity: sha512-dVHFp9gRWrdTpnqQuGfCwd7hOQDatK1VCP2iWhLY/cGrOQs/ucFzJ6A5SRqbXX12ZDI8EUuejSM5kwg+ja7Png==}
     cpu: [x64]
     os: [openbsd]
 
+  '@rollup/rollup-openharmony-arm64@4.62.4':
+    resolution: {integrity: sha512-s62SQ/vgsRSvMwDkOEfTqfgASF0f26ZNaQuTA6Aok5lrikf89yI2W0gFHvZb2Jpgc6N8JnOKZgCK2iciO3CsxQ==}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@rollup/rollup-openharmony-arm64@4.63.4':
     resolution: {integrity: sha512-t3NlauOW6gxZVVFcBEnO62Cb4wbyDFL416gTg1uFI/2tgqYQlf69FbSE115Ajre9I+c26Lk4mcmdFUsS/DGifQ==}
     cpu: [arm64]
     os: [openharmony]
 
+  '@rollup/rollup-win32-arm64-msvc@4.62.4':
+    resolution: {integrity: sha512-J6wGf8TVGbXJq+HH+ttTvrcfNKPbuZecV6KT1B8I18BC5IURUh5kl4Yl5OEP5eFIUoI5BWxCsyYMhFsDx8kekw==}
+    cpu: [arm64]
+    os: [win32]
+
   '@rollup/rollup-win32-arm64-msvc@4.63.4':
     resolution: {integrity: sha512-xWuIaSye5FWZF8+UYtVEcHtRJDN5kN9Kfgxx3Kq8XIov9KSKbc1fiqQCm90SKrgQbUXZelbnUhnlUJmfSE7P9A==}
     cpu: [arm64]
     os: [win32]
 
+  '@rollup/rollup-win32-ia32-msvc@4.62.4':
+    resolution: {integrity: sha512-zmfrQd/0wu6oJs8Vq8KwY/YtsKSsLtKe/HwAP4Wqy8LhWjeT55fHRAkOhYQ12wI3ayS4Tt12d5CDRD7N96SAYQ==}
+    cpu: [ia32]
+    os: [win32]
+
   '@rollup/rollup-win32-ia32-msvc@4.63.4':
     resolution: {integrity: sha512-9ALJJUOg/ZflMJepVo2PlgsGxSaxN7SQ4Z8GoZfVlarWr6r3rkHUNsd/zAio7p4YMtChSMXPionxej4Hkf6CXQ==}
     cpu: [ia32]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-gnu@4.62.4':
+    resolution: {integrity: sha512-qPzHqdj9rfUD+w79dtE07zi/kFwKyCJqplp5K5ygeLTp7jLpAoc16OAH39HSmRC9UpozaecsleI8uAdEj6v2yw==}
+    cpu: [x64]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-gnu@4.63.4':
     resolution: {integrity: sha512-blj9z5qx/Pv4WU0W1NMFDB97e0JH5ed+aZGywW8WCvp/NhWX/4PFAq5uu6Q0AebNn+Vo6KzUYDT++JzTT5ojlQ==}
     cpu: [x64]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-msvc@4.62.4':
+    resolution: {integrity: sha512-zD6NdeWEByGE9QF9vCrlJ5YQB4oq9q91kPZS37Jwj5hOkvR1lTBSpsKhKDw4IJtbQ35LsTS1HD9DZYGKIshU1Q==}
+    cpu: [x64]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-msvc@4.63.4':
     resolution: {integrity: sha512-Erx822VRBwLa124shbj+wNXe//BOgMEctDV0m1aqTQdNO1S69DgNUCFKC1RCeZfixs1J31l6igk1ziyXErbigQ==}
     cpu: [x64]
@@ -1922,11 +2184,11 @@ packages:
   '@scure/bip39@2.4.0':
     resolution: {integrity: sha512-82dxFbZUYboyOf0AXiydsQrFQ5Q4h9mX+O2UkE91ROYmsc0BKMGZLwDmy96Jpa2+vrtoxomjUhy1RPIgH/r2nA==}
 
-  '@simple-git/args-pathspec@1.0.3':
-    resolution: {integrity: sha512-ngJMaHlsWDTfjyq9F3VIQ8b7NXbBLq5j9i5bJ6XLYtD6qlDXT7fdKY2KscWWUF8t18xx052Y/PUO1K1TRc9yKA==}
+  '@simple-git/args-pathspec@1.0.4':
+    resolution: {integrity: sha512-EtMX6XjRWSastG2SdkmSQByPtJ9dx/NIjnHbpQPCYt62j4RmSx5rgLTGpw0YCjF5h191gZOmBfheOT23cRSFdw==}
 
-  '@simple-git/argv-parser@1.1.1':
-    resolution: {integrity: sha512-Q9lBcfQ+VQCpQqGJFHe5yooOS5hGdLFFbJ5R+R5aDsnkPCahtn1hSkMcORX65J2Z5lxSkD0lQorMsncuBQxYUw==}
+  '@simple-git/argv-parser@2.0.1':
+    resolution: {integrity: sha512-M++IaVWrN+vYalilOHfwvT2IL3wYZtVEBQpmX6DLSOJLtxbZ+SUeIDE3IiPogzhPACLajwtxfa5rp+ZX1FczzQ==}
 
   '@sindresorhus/base62@1.0.0':
     resolution: {integrity: sha512-TeheYy0ILzBEI/CO55CP6zJCSdSWeRtGnHy8U8dWSUH4I68iqTsy7HkMktR4xakThc9jotkPQUXT4ITdbV7cHA==}
@@ -1940,6 +2202,30 @@ packages:
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
 
+  '@smithy/core@3.35.0':
+    resolution: {integrity: sha512-zRMhfkByhT2snNdr1si24vJitU6Cr9ix2MikUfWmkAgp4jrNP0GcKSP5YvwQ+TlI8AZXER5QOGJn3JsVtSD9/A==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/credential-provider-imds@4.5.2':
+    resolution: {integrity: sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/fetch-http-handler@5.8.0':
+    resolution: {integrity: sha512-ycSJu3tFAQ4v04CBB0agqFMVsSQ1iG3yw+SpgxRqKfaURpQD4CZ8Wn0zPMmSnOuTpTh65Vz+EA0rMrw089wvkA==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/node-http-handler@4.12.1':
+    resolution: {integrity: sha512-ThMkboGeONWXAelq9FvGsuJC4rOi+qyC4/zhUF58xYpxUg5sQKx2VXZYJmtNjr4dSuBJ1HeJXETQILCz3wOHvw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/signature-v4@5.7.4':
+    resolution: {integrity: sha512-tHy0K0VtqNd5Y7Y41h0a0Lhh0L1GzC08dTWg0F7vRJWFtTENg7IZikf3wQkanYIRdb7ngoIPMTmqgUi401fEeQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/types@4.19.0':
+    resolution: {integrity: sha512-r7jh49VJxGerfAcTQA6gXcKc+98zOp/tqRwzYjgOE+iSQsP6cEU1hq2QzbuipmP68QtYdY9wKEhiCQZIzHgZ4Q==}
+    engines: {node: '>=18.0.0'}
+
   '@speed-highlight/core@1.2.24':
     resolution: {integrity: sha512-qeW2e1l78afw8VhRPfPQ1Gjj+KU5XFQ/OFV5ti6eTa9bruO7mJyZtA4vw0ofqmA3tKCkROE9xLk3VZoeRc98nw==}
 
@@ -2353,6 +2639,9 @@ packages:
   '@types/node@26.6.2':
     resolution: {integrity: sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==}
 
+  '@types/nodemailer@7.0.11':
+    resolution: {integrity: sha512-E+U4RzR2dKrx+u3N4DlsmLaDC6mMZOM/TPROxA0UAPiTgI0y4CEFBmZE+coGWTjakDriRsXG368lNk1u9Q0a2g==}
+
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
@@ -2817,6 +3106,14 @@ packages:
   '@walletconnect/types@2.25.0':
     resolution: {integrity: sha512-FByWQZ40GiFF4CDlz9jU5AN/Bzafwfj+hxnciukzUNUBhMxWTipCvjO5kcLuxVIqFaXkWut349K4Sofz5aG8uQ==}
 
+  '@xrpl-commons/xrpl-connect-vue@1.0.0-rc.2':
+    resolution: {integrity: sha512-NmCndkBmkLTIVovXolcE5WqRXSXyGFE1fA1Uw4SQJpPKZd2xdWT3wNhcgiLmgIc5qMCKjuSR2Pg8+Zuxp32MjA==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
+    peerDependencies:
+      vue: ^3.5.0
+      xrpl: ^3.0.0 || ^4.0.0
+      xrpl-connect: ^1.0.0-rc.2
+
   '@xrplf/isomorphic@1.0.2':
     resolution: {integrity: sha512-ncZUdMXr6VlSXtdoiDi0jTH+gBrgGxwVeEidhoegII3PmyErbQsyj6e+j7acmR4LW/lvBkPkzb9QzRfJH0n3rA==}
     engines: {node: '>=18.0.0'}
@@ -2862,6 +3159,14 @@ packages:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
 
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
   ajv@6.15.0:
     resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
 
@@ -2891,6 +3196,9 @@ packages:
     resolution: {integrity: sha512-9k3v7xcHwgdO/DruxGIg4HtjvlAZlcnsX/mzqUb1t3NkYnl9kK2UJ+Gq0io+vQf7iT//BD/HB/NBkUR1LWxoeA==}
     engines: {node: '>=14'}
 
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
   anymatch@3.1.3:
     resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
     engines: {node: '>= 8'}
@@ -3055,6 +3363,9 @@ packages:
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
+  bowser@2.14.1:
+    resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}
+
   brace-expansion@1.1.21:
     resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}
 
@@ -3108,6 +3419,12 @@ packages:
     resolution: {integrity: sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==}
     engines: {node: '>=18'}
 
+  bundle-require@5.1.0:
+    resolution: {integrity: sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+    peerDependencies:
+      esbuild: '>=0.18'
+
   c12@3.3.4:
     resolution: {integrity: sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA==}
     peerDependencies:
@@ -3166,6 +3483,10 @@ packages:
     resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
     engines: {node: '>= 16'}
 
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
   chokidar@5.0.0:
     resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
     engines: {node: '>= 20.19.0'}
@@ -3213,6 +3534,10 @@ packages:
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
   comment-parser@1.4.7:
     resolution: {integrity: sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==}
     engines: {node: '>= 12.0.0'}
@@ -3263,6 +3588,10 @@ packages:
   cookie-es@3.1.1:
     resolution: {integrity: sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==}
 
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
   core-js-compat@3.50.0:
     resolution: {integrity: sha512-XGpFGbMLHwSt74YLTKho7Ib242qi6O8MSX+sRokV4oz7iKXvQWGYZthjIhjRGMxjzVkAubBO512dKGYcefmX3Q==}
     engines: {node: '>=6.4.0'}
@@ -3445,6 +3774,10 @@ packages:
     resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
     engines: {node: '>= 0.8'}
 
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
   destr@2.0.5:
     resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
 
@@ -3975,6 +4308,9 @@ packages:
   fast-json-stable-stringify@2.1.0:
     resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
 
+  fast-json-stringify@6.4.0:
+    resolution: {integrity: sha512-ibRCQ0GZKJIQ+P3Et1h0LhPgp3PMTYk0MH8O+kW3lNYsvmaQww5Nn3f1jf73Q0jR1Yz3a1CDP4/NZD3vOajWJQ==}
+
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
@@ -4032,6 +4368,9 @@ packages:
     resolution: {integrity: sha512-JGG8pvDi2C+JxidYdIwQDyS/CgcrIdh18cvgxcBge3wSHRQOrooMD3GlFBcmMJAN9M42SAZjDp5zv1dglJjwww==}
     engines: {node: '>=20'}
 
+  fix-dts-default-cjs-exports@1.0.1:
+    resolution: {integrity: sha512-pVIECanWFC61Hzl2+oOCtoJ3F17kglZC/6N94eRWycFgBH35hHx0Li604ZIzhseh97mf2p0cv7vVrOZGoqhlEg==}
+
   flat-cache@4.0.1:
     resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
     engines: {node: '>=16'}
@@ -4471,6 +4810,10 @@ packages:
   jose@6.2.12:
     resolution: {integrity: sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==}
 
+  joycon@3.1.1:
+    resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
+    engines: {node: '>=10'}
+
   js-tokens@10.0.0:
     resolution: {integrity: sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==}
 
@@ -4500,6 +4843,9 @@ packages:
   json-buffer@3.0.1:
     resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
 
+  json-schema-ref-resolver@3.0.0:
+    resolution: {integrity: sha512-hOrZIVL5jyYFjzk7+y7n5JDzGlU8rfWDuYyHwGa2WA8/pcmMHezp2xsVwxrebD/Q9t8Nc5DboieySDpCp4WG4A==}
+
   json-schema-to-typescript-lite@15.0.0:
     resolution: {integrity: sha512-5mMORSQm9oTLyjM4mWnyNBi2T042Fhg1/0gCIB6X8U/LVpM2A+Nmj2yEyArqVouDmFThDxpEXcnTgSrjkGJRFA==}
 
@@ -4557,6 +4903,9 @@ packages:
     engines: {node: '>=16'}
     hasBin: true
 
+  light-my-request@6.6.0:
+    resolution: {integrity: sha512-CHYbu8RtboSIoVsHZ6Ye4cj4Aw/yg2oAFimlF7mNvfDV192LR7nDiKtSIfCuLT7KokPSTn/9kfVLm5OGN0A28A==}
+
   lightningcss-android-arm64@1.32.0:
     resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==}
     engines: {node: '>= 12.0.0'}
@@ -4709,6 +5058,9 @@ packages:
     resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
     engines: {node: '>=14'}
 
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
   linkifyjs@4.3.3:
     resolution: {integrity: sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==}
 
@@ -4721,6 +5073,10 @@ packages:
       '@parcel/watcher':
         optional: true
 
+  load-tsconfig@0.2.5:
+    resolution: {integrity: sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
   loader-utils@3.3.1:
     resolution: {integrity: sha512-FMJTLMXfCLMLfJxcX9PFqX5qD88Z5MRGaZCVzfuqeZSPsyiBzs+pahDQjbIWz2QIzPZz0NX9Zy4FX3lmK6YHIg==}
     engines: {node: '>= 12.13.0'}
@@ -4766,6 +5122,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.2.3:
+    resolution: {integrity: sha512-Bpb0W2TbLKOZ7vJnOUnVRGq3WL2p+ISV29M6hYPL1AFCpyKZpdr5ytiXoTSSxRVhg8YW7f65+6gbG8WG6PCa/g==}
+
   magic-string@1.4.2:
     resolution: {integrity: sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==}
 
@@ -4895,6 +5254,9 @@ packages:
   multiformats@14.0.5:
     resolution: {integrity: sha512-vbIm83F2yZ1pWJGS0yl0ysracIvv56LtbrIyiIQHoLdYDJOMoLfVFsXhh9DUH4SFdkdkFhucyWniihsNzVEjkQ==}
 
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
   nan@2.29.0:
     resolution: {integrity: sha512-GlGk3HIvitbvs+LT3g6XUP1kpirKNvmDFwF/bmo6XNWSb/eYEs/O4bfgIEIXCZ+lIOTS5xNwDvSGMw6FJdAhtA==}
 
@@ -4963,6 +5325,10 @@ packages:
     resolution: {integrity: sha512-kQK9LGGFiHtrWiNhZtA7Qbw17AQz+dmsEKODRIVTXA9+e5MS/2gZEBhYJt13GrAz5/IOZKddH/0Z3TP/Zgo+yw==}
     engines: {node: '>=18'}
 
+  nodemailer@10.0.10:
+    resolution: {integrity: sha512-He9XskOFms62SyAKkLu8CcGcYHAo+BSHSsORI8s4PJH8qZgZY4L4lDfvyN0twvmbpyG+eGrxpyBlskj9d9rJ8A==}
+    engines: {node: '>=20.0.0'}
+
   nopt@8.1.0:
     resolution: {integrity: sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==}
     engines: {node: ^18.17.0 || >=20.5.0}
@@ -5015,6 +5381,13 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  oauth4webapi@3.8.8:
+    resolution: {integrity: sha512-8N28E+a/oxfXWBgOMt+ZP/JUf/XR+IFbvkAEPP3gznXOMv9BpAAwiIj0TFNz3tGTPc0ZQ8zmWBNgN1nAys0gng==}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
   object-deep-merge@2.0.1:
     resolution: {integrity: sha512-aKttDKcU3pyZqKcCkDhsMn70WmZFG2JGDQLP9EcLyTSIFQRCPWLAmBZRLJnrVUrhPG1jETEEbfdgbNtJf1LyMg==}
 
@@ -5063,6 +5436,9 @@ packages:
     resolution: {integrity: sha512-++Zlftm0kVLPmzC06t6epuWmcRMDbI4z5P3NNX979WA/k23+NtSOynEGzsVfZwguKw2mi5umVgnBlJQMwRz4Pg==}
     engines: {node: '>=20'}
 
+  openid-client@6.8.8:
+    resolution: {integrity: sha512-ZsucJA5Ad04Uv7YN4ql+s4GXNmb9uAYQwyJTsJx7CH/MX3JZioLE2pVKi1SC+YrbSLA4Px3Gi30dMjgOZtb6pA==}
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -5187,6 +5563,10 @@ packages:
     resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
     engines: {node: '>=8.6'}
 
+  picomatch@4.0.5:
+    resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+    engines: {node: '>=12'}
+
   picomatch@4.0.7:
     resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
     engines: {node: '>=12'}
@@ -5201,6 +5581,10 @@ packages:
     resolution: {integrity: sha512-eI9pKwWEix40kfvSzqEP6ldqOoBIN7dwD/o91TY5z8vQI12sAffpR/pOqAD1IVVwIVHDpHjkq0joBPdJD0rafA==}
     hasBin: true
 
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
   pkce-challenge@5.0.1:
     resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
     engines: {node: '>=16.20.0'}
@@ -5271,6 +5655,24 @@ packages:
     peerDependencies:
       postcss: ^8.5.26
 
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
   postcss-merge-longhand@8.0.4:
     resolution: {integrity: sha512-ammolHhMvuTz/L9YN/ge1SWbUDcD3Y9o2gXlo3S6H4MCJHheyVPwcI/LAnSuNT4gcUmSF9pNTXo7+3M/2MFPAQ==}
     engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
@@ -5430,6 +5832,9 @@ packages:
   process-nextick-args@2.0.1:
     resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
 
+  process-warning@4.0.1:
+    resolution: {integrity: sha512-3c2LzQ3rY9d0hc1emcsHhfT9Jwz0cChib/QN89oME2R451w5fy3f0afAhERFZAwrbDU43wk12d0ORBpDVME50Q==}
+
   process-warning@5.1.0:
     resolution: {integrity: sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==}
 
@@ -5503,6 +5908,9 @@ packages:
     resolution: {integrity: sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==}
     engines: {node: '>= 0.6'}
 
+  rate-limiter-flexible@7.4.0:
+    resolution: {integrity: sha512-IJopePGO6HnMWVdeLCihnxXZ0WCW0mxXiU5LE3bZ00GHESsCaAvgD8hN/ATIJeZhnrVdU5cfRyS1uV63Vmc4zg==}
+
   rc9@3.1.0:
     resolution: {integrity: sha512-ufjkNVzbRHKcCOmTahZkmVsyc3W+MSk3jY03m+a7tGHkIsdVMG9l10/3HvFbWkkKzY5VFp3pkRsIo/UYgmFL7Q==}
 
@@ -5516,6 +5924,10 @@ packages:
   readdir-glob@1.1.3:
     resolution: {integrity: sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==}
 
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
   readdirp@5.1.1:
     resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==}
     engines: {node: '>= 20.19.0'}
@@ -5585,6 +5997,9 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
+  rfdc@1.4.1:
+    resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
+
   ripemd160@2.0.3:
     resolution: {integrity: sha512-5Di9UC0+8h1L6ZD2d7awM7E/T4uA1fJRlx6zk/NvdCCVEoAnFqvHmCuNeIKoCeIixBX/q8uM+6ycDvF8woqosA==}
     engines: {node: '>= 0.8'}
@@ -5613,6 +6028,10 @@ packages:
     resolution: {integrity: sha512-b5rfL2EZiffmklqZk1W+dvSy97v3V/C7936WxCCgDynaGPp7GE6R2XO7EU9O2LlM/z95rj870IylYnOQs+1Rag==}
     engines: {node: '>= 16'}
 
+  ripple-keypairs@3.0.0:
+    resolution: {integrity: sha512-lE69pD0E8hFNCqZoVXRyY45Yi8Ku+Qw7Rf1qRwPj4nOi34vp9NAuwzfiJH1IwXGWNCfEkwVfctG99CPTEoUf+g==}
+    engines: {node: '>= 18'}
+
   ripple-keypairs@3.1.0:
     resolution: {integrity: sha512-yeqN768gaHStQ76qwaJ2TGxIGMXA4c9tg32n1zMHUWbyfEKXA70XOUH8SQdnAnIQNCASd8hzBZ8Edoqcd+a+IA==}
     engines: {node: '>= 18'}
@@ -5644,6 +6063,11 @@ packages:
       rollup:
         optional: true
 
+  rollup@4.62.4:
+    resolution: {integrity: sha512-RXOqwaPsBGjMNMa4sQjDjHieHEZDFoj/Rdr46l2MU5DfEs16wHJPC2RPTPHWhNl+M3aI472LLqFkFKut4SblOg==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
   rollup@4.63.4:
     resolution: {integrity: sha512-4U0liVayNIoLp3GFl1FcI8561WepLnZ1rqfraGh7S9B3Ur5F9S283y8Futii7RUU2C/97tOBmBy7nYvhoiOpbQ==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
@@ -5715,6 +6139,9 @@ packages:
     resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
     engines: {node: '>= 18'}
 
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
   set-function-length@1.2.2:
     resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
     engines: {node: '>= 0.4'}
@@ -5735,8 +6162,8 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
-  shell-quote@1.10.0:
-    resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==}
+  shell-quote@1.11.0:
+    resolution: {integrity: sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g==}
     engines: {node: '>= 0.4'}
 
   siginfo@2.0.0:
@@ -5749,8 +6176,8 @@ packages:
     resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
     engines: {node: '>=14'}
 
-  simple-git@3.36.0:
-    resolution: {integrity: sha512-cGQjLjK8bxJw4QuYT7gxHw3/IouVESbhahSsHrX97MzCL1gu2u7oy38W6L2ZIGECEfIBG4BabsWDPjBxJENv9Q==}
+  simple-git@4.0.2:
+    resolution: {integrity: sha512-l0sIsv9VrPwovKELFDBOj/lhmIcbMvxBk2B+hRhsMM4/VL3gKtuZvYnBNixVo+N/0HnqQx2cBdLvxnAbygHpqA==}
 
   sirv@3.0.2:
     resolution: {integrity: sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==}
@@ -5773,8 +6200,8 @@ packages:
   sonic-boom@4.2.1:
     resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
 
-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
 
   source-map-support@0.5.21:
@@ -5895,6 +6322,11 @@ packages:
     peerDependencies:
       postcss: ^8.5.26
 
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
   super-regex@1.1.0:
     resolution: {integrity: sha512-WHkws2ZflZe41zj6AolvvmaTrWds/VuyeYr9iPVv/oQeaIoVxMKaushfFWpOGDT+GuBrM/sVqF8KUCYQlSSTdQ==}
     engines: {node: '>=18'}
@@ -5964,6 +6396,13 @@ packages:
   text-decoder@1.2.7:
     resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
 
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
   thread-stream@3.2.0:
     resolution: {integrity: sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==}
 
@@ -6042,18 +6481,49 @@ packages:
     resolution: {integrity: sha512-2lv/66T7e5yNyhAAC4NaKe5nVavzuGJQVVtRYLyQ2OI8tsJ61PMLlelehb0wi2Hx6+hT/OJUWZcw8MjlSRnxvw==}
     engines: {node: '>=14'}
 
+  tree-kill@1.2.2:
+    resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
+    hasBin: true
+
   ts-api-utils@2.5.0:
     resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
     engines: {node: '>=18.12'}
     peerDependencies:
       typescript: '>=4.8.4'
 
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
   tslib@1.14.1:
     resolution: {integrity: sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==}
 
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
+  tsup@8.5.1:
+    resolution: {integrity: sha512-xtgkqwdhpKWr3tKPmCkvYmS9xnQK3m3XgxZHwSUjvfTjp7YfXe5tT3GgWi0F2N+ZSMsOeWeZFh7ZZFg5iPhing==}
+    engines: {node: '>=18'}
+    hasBin: true
+    peerDependencies:
+      '@microsoft/api-extractor': ^7.36.0
+      '@swc/core': ^1
+      postcss: ^8.4.12
+      typescript: '>=4.5.0'
+    peerDependenciesMeta:
+      '@microsoft/api-extractor':
+        optional: true
+      '@swc/core':
+        optional: true
+      postcss:
+        optional: true
+      typescript:
+        optional: true
+
+  tsx@4.23.12:
+    resolution: {integrity: sha512-FDf4L4sYzKtzWYhU/Xm0AQFdTjdIxNo9ElTf2mxXM6k8YMHXzYUe4yODVaXP4V9uMFbVg8c0qyBccK2OOxb45Q==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -6622,8 +7092,8 @@ packages:
     resolution: {integrity: sha512-6b+PIXuKIy0ibVnF04GoijGKGIDwjlYSK7bCgicuQwPLivfjoLeCCK0bwbjyOdrStDTNPlyGFixIj0d0kZzwiQ==}
     engines: {node: '>=18'}
 
-  which-typed-array@1.1.24:
-    resolution: {integrity: sha512-wk4Mf4pR5mRP7eYuuTBCIQ9d0ud2Fv2jRLQpfgnRjbOxAFHmjKFValgTpitVKzJJS8ajnYQV2Du1SZ8j6b/EUQ==}
+  which-typed-array@1.1.22:
+    resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
     engines: {node: '>= 0.4'}
 
   which@2.0.2:
@@ -6680,8 +7150,8 @@ packages:
     resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
     engines: {node: '>=18'}
 
-  xrpl-connect@1.0.0-rc.0:
-    resolution: {integrity: sha512-mhJUGtrryTQ7ZT3KfS6sWSavsI2yEKVzCuE7f5mlQdZ36VK6ZU/v7M9chFWd7aelnL0GRplnFr1NrFmeeFyE1A==}
+  xrpl-connect@1.0.0-rc.2:
+    resolution: {integrity: sha512-QxtpbEgBjMFk2f7zjzaNYViNCUXSDDg1oALXpLeqy5PKh/yjQALXH/gD+3X+Rn7oiBYP7MzrlqT7melVEfxNFg==}
     engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     peerDependencies:
       xrpl: ^3.0.0 || ^4.0.0
@@ -6801,28 +7271,193 @@ snapshots:
       '@types/json-schema': 7.0.15
       js-yaml: 4.3.2
 
-  '@babel/code-frame@7.29.7':
+  '@aws-sdk/checksums@3.1001.1':
     dependencies:
-      '@babel/helper-validator-identifier': 7.29.7
-      js-tokens: 4.0.0
-      picocolors: 1.1.1
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
 
-  '@babel/compat-data@7.29.7': {}
+  '@aws-sdk/client-s3@3.1141.0':
+    dependencies:
+      '@aws-sdk/checksums': 3.1001.1
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/credential-provider-node': 3.972.84
+      '@aws-sdk/middleware-sdk-s3': 3.972.77
+      '@aws-sdk/signature-v4-multi-region': 3.996.47
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
 
-  '@babel/core@7.29.7':
+  '@aws-sdk/core@3.978.1':
     dependencies:
-      '@babel/code-frame': 7.29.7
-      '@babel/generator': 7.29.8
-      '@babel/helper-compilation-targets': 7.29.7
-      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
-      '@babel/helpers': 7.29.7
-      '@babel/parser': 7.29.9
-      '@babel/template': 7.29.7
-      '@babel/traverse': 7.29.8
-      '@babel/types': 7.29.8
-      '@jridgewell/remapping': 2.3.5
-      convert-source-map: 2.0.0
-      debug: 4.4.3
+      '@aws-sdk/types': 3.974.6
+      '@aws-sdk/xml-builder': 3.972.41
+      '@aws/lambda-invoke-store': 0.3.0
+      '@smithy/core': 3.35.0
+      '@smithy/signature-v4': 5.7.4
+      '@smithy/types': 4.19.0
+      bowser: 2.14.1
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-env@3.972.72':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-http@3.972.74':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-ini@3.973.17':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/credential-provider-env': 3.972.72
+      '@aws-sdk/credential-provider-http': 3.972.74
+      '@aws-sdk/credential-provider-login': 3.972.79
+      '@aws-sdk/credential-provider-process': 3.972.72
+      '@aws-sdk/credential-provider-sso': 3.973.16
+      '@aws-sdk/credential-provider-web-identity': 3.972.78
+      '@aws-sdk/nested-clients': 3.997.46
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/credential-provider-imds': 4.5.2
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-login@3.972.79':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/nested-clients': 3.997.46
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-node@3.972.84':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.72
+      '@aws-sdk/credential-provider-http': 3.972.74
+      '@aws-sdk/credential-provider-ini': 3.973.17
+      '@aws-sdk/credential-provider-process': 3.972.72
+      '@aws-sdk/credential-provider-sso': 3.973.16
+      '@aws-sdk/credential-provider-web-identity': 3.972.78
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/credential-provider-imds': 4.5.2
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-process@3.972.72':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-sso@3.973.16':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/nested-clients': 3.997.46
+      '@aws-sdk/token-providers': 3.1138.0
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-web-identity@3.972.78':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/nested-clients': 3.997.46
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-sdk-s3@3.972.77':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/signature-v4-multi-region': 3.996.47
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/nested-clients@3.997.46':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/signature-v4-multi-region': 3.996.47
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/signature-v4-multi-region@3.996.47':
+    dependencies:
+      '@aws-sdk/types': 3.974.6
+      '@smithy/signature-v4': 5.7.4
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/token-providers@3.1138.0':
+    dependencies:
+      '@aws-sdk/core': 3.978.1
+      '@aws-sdk/nested-clients': 3.997.46
+      '@aws-sdk/types': 3.974.6
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/types@3.974.6':
+    dependencies:
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws-sdk/xml-builder@3.972.41':
+    dependencies:
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@aws/lambda-invoke-store@0.3.0': {}
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.8
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.9
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -6999,7 +7634,7 @@ snapshots:
     dependencies:
       '@transia/xrpl': 2.7.3-alpha.28(bufferutil@4.1.0)(utf-8-validate@5.0.10)
       '@types/chrome': 0.0.253
-      node-forge: 1.4.0
+      node-forge: 1.4.0(patch_hash=02907f52247711a7ef40888d32c1b81ba9d2978da8eb131d6e57149fc6475820)
       xrpl: 2.14.1(bufferutil@4.1.0)(utf-8-validate@5.0.10)
     transitivePeerDependencies:
       - bufferutil
@@ -7017,17 +7652,17 @@ snapshots:
       - crossws
       - ocache
 
-  '@dxup/nuxt@0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@dxup/nuxt@0.5.10(esbuild@0.27.7)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       '@dxup/unimport': 0.1.2
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@vue/compiler-dom': 3.5.43
       chokidar: 5.0.0
       knitwork: 1.3.0
       magic-string: 1.4.2
       pathe: 2.0.3
       tinyglobby: 0.2.17
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -7375,7 +8010,7 @@ snapshots:
   '@eslint/css-tree@4.1.1':
     dependencies:
       mdn-data: 2.35.0
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@eslint/eslintrc@3.3.7':
     dependencies:
@@ -7404,6 +8039,10 @@ snapshots:
       '@eslint/core': 0.17.0
       levn: 0.4.1
 
+  '@fastify/merge-json-schemas@0.2.1':
+    dependencies:
+      dequal: 2.0.3
+
   '@floating-ui/core@1.8.0':
     dependencies:
       '@floating-ui/utils': 0.2.12
@@ -7484,7 +8123,7 @@ snapshots:
       escodegen: 2.1.0
       estree-walker: 2.0.2
       jsonc-eslint-parser: 2.4.2
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
       yaml-eslint-parser: 1.3.2
     optionalDependencies:
       vue-i18n: 11.4.12(vue@3.5.43(typescript@5.9.3))
@@ -7513,11 +8152,11 @@ snapshots:
   '@intlify/message-compiler@11.4.12':
     dependencies:
       '@intlify/shared': 11.4.12
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@intlify/shared@11.4.12': {}
 
-  '@intlify/unplugin-vue-i18n@11.2.5(@vue/compiler-dom@3.5.43)(eslint@9.39.5(jiti@2.7.0))(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-i18n@11.4.12(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3))':
+  '@intlify/unplugin-vue-i18n@11.2.5(@vue/compiler-dom@3.5.43)(eslint@9.39.5(jiti@2.7.0))(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-i18n@11.4.12(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
       '@eslint-community/eslint-utils': 4.10.1(eslint@9.39.5(jiti@2.7.0))
       '@intlify/bundle-utils': 11.2.5(vue-i18n@11.4.12(vue@3.5.43(typescript@5.9.3)))
@@ -7533,7 +8172,7 @@ snapshots:
       unplugin: 2.3.11
       vue: 3.5.43(typescript@5.9.3)
     optionalDependencies:
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       vue-i18n: 11.4.12(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/compiler-dom'
@@ -7574,7 +8213,7 @@ snapshots:
 
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
-      '@jridgewell/sourcemap-codec': 1.6.0
+      '@jridgewell/sourcemap-codec': 1.5.5
       '@jridgewell/trace-mapping': 0.3.31
 
   '@jridgewell/remapping@2.3.5':
@@ -7589,6 +8228,8 @@ snapshots:
       '@jridgewell/gen-mapping': 0.3.13
       '@jridgewell/trace-mapping': 0.3.31
 
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
   '@jridgewell/sourcemap-codec@1.6.0': {}
 
   '@jridgewell/trace-mapping@0.3.31':
@@ -7726,11 +8367,11 @@ snapshots:
 
   '@nuxt/devalue@2.0.2': {}
 
-  '@nuxt/devtools-kit@3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@nuxt/devtools-kit@3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       execa: 8.0.1
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - magic-string
       - magicast
@@ -7749,11 +8390,11 @@ snapshots:
       pkg-types: 2.3.3
       semver: 7.8.5
 
-  '@nuxt/devtools@3.4.2(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@nuxt/devtools@3.4.2(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
-      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@nuxt/devtools-wizard': 3.4.2
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@vue/devtools-core': 8.2.1(vue@3.5.43(typescript@5.9.3))
       '@vue/devtools-kit': 8.2.1
       birpc: 4.2.0
@@ -7775,14 +8416,14 @@ snapshots:
       perfect-debounce: 2.1.0
       pkg-types: 2.3.3
       semver: 7.8.5
-      simple-git: 3.36.0
+      simple-git: 4.0.2
       sirv: 3.0.2
       structured-clone-es: 2.0.1
       tinyglobby: 0.2.17
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-plugin-inspect: 11.4.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      vite-plugin-vue-tracer: 1.5.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-plugin-inspect: 11.4.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      vite-plugin-vue-tracer: 1.5.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       which: 6.0.1
       ws: 8.21.3(bufferutil@4.1.0)(utf-8-validate@5.0.10)
     transitivePeerDependencies:
@@ -7854,13 +8495,13 @@ snapshots:
       - supports-color
       - typescript
 
-  '@nuxt/eslint@1.17.0(@typescript-eslint/utils@8.70.1(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(@vue/compiler-sfc@3.5.43)(crossws@0.4.12(srvx@0.11.22))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(srvx@0.11.22)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@nuxt/eslint@1.17.0(@typescript-eslint/utils@8.70.1(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(@vue/compiler-sfc@3.5.43)(crossws@0.4.12(srvx@0.11.22))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(srvx@0.11.22)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       '@eslint/config-inspector': 3.5.0(crossws@0.4.12(srvx@0.11.22))(eslint@9.39.5(jiti@2.7.0))(srvx@0.11.22)
-      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@nuxt/eslint-config': 1.17.0(@typescript-eslint/utils@8.70.1(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(@vue/compiler-sfc@3.5.43)(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
       '@nuxt/eslint-plugin': 1.17.0(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       chokidar: 5.0.0
       eslint: 9.39.5(jiti@2.7.0)
       eslint-flat-config-utils: 3.2.0
@@ -7869,7 +8510,7 @@ snapshots:
       get-port-please: 3.2.0
       mlly: 1.8.2
       pathe: 2.0.3
-      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unimport: 6.5.0(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -7895,13 +8536,13 @@ snapshots:
       - vite
       - webpack
 
-  '@nuxt/fonts@0.14.0(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.28.2)(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@nuxt/fonts@0.14.0(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.27.7)(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
-      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       consola: 3.4.2
       defu: 6.1.7
-      fontless: 0.2.1(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      fontless: 0.2.1(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       h3: 1.15.11
       magic-regexp: 0.10.0
       ofetch: 1.5.1
@@ -7910,7 +8551,7 @@ snapshots:
       tinyglobby: 0.2.17
       ufo: 1.6.4
       unifont: 0.7.5
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
     transitivePeerDependencies:
       - '@azure/app-configuration'
@@ -7946,19 +8587,19 @@ snapshots:
       - vite
       - webpack
 
-  '@nuxt/icon@2.5.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@nuxt/icon@2.5.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
       '@iconify/collections': 1.0.741
       '@iconify/types': 2.0.0
       '@iconify/utils': 3.1.7
       '@iconify/vue': 5.0.3(vue@3.5.43(typescript@5.9.3))
-      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       consola: 3.4.2
       local-pkg: 1.2.1
       mlly: 1.8.2
       ohash: 2.0.12
-      picomatch: 4.0.7
+      picomatch: 4.0.5
       std-env: 4.2.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
@@ -7971,7 +8612,7 @@ snapshots:
       - vite
       - vue
 
-  '@nuxt/kit@4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))':
+  '@nuxt/kit@4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))':
     dependencies:
       c12: 3.3.4(magicast@0.5.5)
       consola: 3.4.2
@@ -7991,7 +8632,7 @@ snapshots:
       scule: 1.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
-      unctx: 3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      unctx: 3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       untyped: 2.0.0
       verkit: 0.3.2
     transitivePeerDependencies:
@@ -8001,7 +8642,7 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))':
+  '@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))':
     dependencies:
       c12: 3.3.4(magicast@0.5.5)
       consola: 3.4.2
@@ -8021,7 +8662,7 @@ snapshots:
       scule: 1.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
-      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       untyped: 2.0.0
       verkit: 0.3.2
     transitivePeerDependencies:
@@ -8031,11 +8672,11 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxt/nitro-server@4.5.2(4062c2abf6e9c3c646190cfa175760c1)':
+  '@nuxt/nitro-server@4.5.2(3fa81c4a57e2504a1a63aa3f72a99eff)':
     dependencies:
       '@nuxt/devalue': 2.0.2
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
-      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
+      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       '@vue/shared': 3.5.43
       consola: 3.4.2
       defu: 6.1.7
@@ -8045,19 +8686,19 @@ snapshots:
       escape-string-regexp: 5.0.0
       exsolve: 1.1.1
       h3: 1.15.11
-      impound: 1.2.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      impound: 1.2.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       klona: 2.0.6
       mocked-exports: 0.1.1
-      nitropack: 2.13.4(drizzle-orm@0.45.3(postgres@3.4.9))(idb-keyval@6.3.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(srvx@0.11.22)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      nitropack: 2.13.4(drizzle-orm@0.45.3(postgres@3.4.9))(idb-keyval@6.3.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(srvx@0.11.22)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       nostics: 1.3.0
-      nuxt: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
+      nuxt: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(tsx@4.23.12)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
       nypm: 0.6.10
       ohash: 2.0.12
       pathe: 2.0.3
       rou3: 0.9.2
       std-env: 4.2.0
       ufo: 1.6.4
-      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
       vue: 3.5.43(typescript@5.9.3)
       vue-bundle-renderer: 2.4.0
@@ -8127,26 +8768,26 @@ snapshots:
       pkg-types: 2.3.3
       std-env: 4.2.0
 
-  '@nuxt/telemetry@2.9.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))':
+  '@nuxt/telemetry@2.9.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       citty: 0.2.2
       consola: 3.4.2
       rc9: 3.1.0
       std-env: 4.2.0
 
-  '@nuxt/ui@4.11.2(ec9dd9a06663e7a932dfb8f38752dddf)':
+  '@nuxt/ui@4.11.2(6d450da6065ab185a789c3389c81ae31)':
     dependencies:
       '@floating-ui/dom': 1.8.0
       '@iconify/vue': 5.0.3(vue@3.5.43(typescript@5.9.3))
-      '@nuxt/fonts': 0.14.0(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.28.2)(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      '@nuxt/icon': 2.5.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/fonts': 0.14.0(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.27.7)(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      '@nuxt/icon': 2.5.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@nuxt/schema': 4.5.2
-      '@nuxtjs/color-mode': 4.0.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxtjs/color-mode': 4.0.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@standard-schema/spec': 1.1.0
       '@tailwindcss/postcss': 4.3.3
-      '@tailwindcss/vite': 4.3.3(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@tailwindcss/vite': 4.3.3(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@tanstack/vue-table': 8.21.3(vue@3.5.43(typescript@5.9.3))
       '@tanstack/vue-virtual': 3.13.39(vue@3.5.43(typescript@5.9.3))
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
@@ -8166,7 +8807,7 @@ snapshots:
       '@tiptap/starter-kit': 3.31.3
       '@tiptap/suggestion': 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
       '@tiptap/vue-3': 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(vue@3.5.43(typescript@5.9.3))
-      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       '@vueuse/core': 14.4.0(vue@3.5.43(typescript@5.9.3))
       '@vueuse/integrations': 14.4.0(change-case@5.4.4)(fuse.js@7.5.0)(idb-keyval@6.3.0)(vue@3.5.43(typescript@5.9.3))
       '@vueuse/shared': 14.4.0(vue@3.5.43(typescript@5.9.3))
@@ -8196,15 +8837,15 @@ snapshots:
       tinyglobby: 0.2.17
       typescript: 5.9.3
       ufo: 1.6.4
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin-auto-import: 21.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(@vueuse/core@14.4.0(vue@3.5.43(typescript@5.9.3)))(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin-vue-components: 32.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin-auto-import: 21.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(@vueuse/core@14.4.0(vue@3.5.43(typescript@5.9.3)))(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin-vue-components: 32.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       vaul-vue: 0.4.1(patch_hash=745c51497acce22bbe96fcc248a7de7767e5f8beee0f24441d9d34c33e89faa0)(reka-ui@2.10.4(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3))
       vue-component-type-helpers: 3.3.11
     optionalDependencies:
       '@internationalized/date': 3.12.4
       '@internationalized/number': 3.6.8
-      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       zod: 4.6.5
     transitivePeerDependencies:
       - '@azure/app-configuration'
@@ -8258,11 +8899,11 @@ snapshots:
       - vue
       - webpack
 
-  '@nuxt/vite-builder@4.5.2(192fea6631a6099137c9b72eb273ee26)':
+  '@nuxt/vite-builder@4.5.2(eeebb6ed07e5bccc353105079f59e390)':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
-      '@vitejs/plugin-vue': 6.0.9(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
-      '@vitejs/plugin-vue-jsx': 5.1.6(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
+      '@vitejs/plugin-vue': 6.0.9(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@vitejs/plugin-vue-jsx': 5.1.6(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       autoprefixer: 10.6.1(postcss@8.5.28)
       consola: 3.4.2
       cssnano: 8.0.10(postcss@8.5.28)
@@ -8276,7 +8917,7 @@ snapshots:
       knitwork: 1.3.0
       mlly: 1.8.2
       mocked-exports: 0.1.1
-      nuxt: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
+      nuxt: 4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(tsx@4.23.12)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1)
       nypm: 0.6.10
       pathe: 2.0.3
       pkg-types: 2.3.3
@@ -8286,9 +8927,9 @@ snapshots:
       std-env: 4.2.0
       ufo: 1.6.4
       unenv: 2.0.0-rc.24
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-node: 6.0.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-plugin-checker: 0.14.5(eslint@9.39.5(jiti@2.7.0))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-node: 6.0.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-plugin-checker: 0.14.5(eslint@9.39.5(jiti@2.7.0))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))
       vue: 3.5.43(typescript@5.9.3)
       vue-bundle-renderer: 2.4.0
     optionalDependencies:
@@ -8321,9 +8962,9 @@ snapshots:
       - vue-tsc
       - yaml
 
-  '@nuxtjs/color-mode@4.0.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))':
+  '@nuxtjs/color-mode@4.0.1(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       exsolve: 1.1.1
       pathe: 2.0.3
       pkg-types: 2.3.3
@@ -8335,16 +8976,16 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxtjs/i18n@10.6.0(@vue/compiler-dom@3.5.43)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(magicast@0.5.5)(rolldown@1.2.10)(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@nuxtjs/i18n@10.6.0(@vue/compiler-dom@3.5.43)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(magicast@0.5.5)(rolldown@1.2.10)(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
       '@intlify/core': 11.4.12
       '@intlify/h3': 0.7.4
       '@intlify/message-compiler': 11.4.12
       '@intlify/shared': 11.4.12
-      '@intlify/unplugin-vue-i18n': 11.2.5(@vue/compiler-dom@3.5.43)(eslint@9.39.5(jiti@2.7.0))(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-i18n@11.4.12(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3))
+      '@intlify/unplugin-vue-i18n': 11.2.5(@vue/compiler-dom@3.5.43)(eslint@9.39.5(jiti@2.7.0))(rollup@4.63.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-i18n@11.4.12(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3))
       '@intlify/utils': 0.14.1
       '@miyaneee/rollup-plugin-json5': 1.2.0(rollup@4.63.4)
-      '@nuxt/kit': 4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@rollup/plugin-yaml': 4.1.2(rollup@4.63.4)
       '@vue/compiler-sfc': 3.5.43
       confbox: 0.2.4
@@ -8360,12 +9001,12 @@ snapshots:
       oxc-walker: 0.7.0(oxc-parser@0.141.0)
       pathe: 2.0.3
       ufo: 1.6.4
-      unhead: 3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unhead: 3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unrouting: 0.2.3
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
       vue-i18n: 11.4.12(vue@3.5.43(typescript@5.9.3))
-      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
       - '@azure/app-configuration'
       - '@azure/cosmos'
@@ -8611,13 +9252,13 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.1': {}
 
-  '@rollup/plugin-alias@6.0.0(rollup@4.63.4)':
+  '@rollup/plugin-alias@6.0.0(rollup@4.62.4)':
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-commonjs@29.0.3(rollup@4.63.4)':
+  '@rollup/plugin-commonjs@29.0.3(rollup@4.62.4)':
     dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       commondir: 1.0.1
       estree-walker: 2.0.2
       fdir: 6.5.0(picomatch@4.0.7)
@@ -8625,46 +9266,46 @@ snapshots:
       magic-string: 0.30.21
       picomatch: 4.0.7
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-inject@5.0.5(rollup@4.63.4)':
+  '@rollup/plugin-inject@5.0.5(rollup@4.62.4)':
     dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       estree-walker: 2.0.2
       magic-string: 0.30.21
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-json@6.1.0(rollup@4.63.4)':
+  '@rollup/plugin-json@6.1.0(rollup@4.62.4)':
     dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-node-resolve@16.0.3(rollup@4.63.4)':
+  '@rollup/plugin-node-resolve@16.0.3(rollup@4.62.4)':
     dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       '@types/resolve': 1.20.2
       deepmerge: 4.3.1
       is-module: 1.0.0
       resolve: 1.22.12
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-replace@6.0.3(rollup@4.63.4)':
+  '@rollup/plugin-replace@6.0.3(rollup@4.62.4)':
     dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       magic-string: 0.30.21
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
-  '@rollup/plugin-terser@1.0.0(rollup@4.63.4)':
+  '@rollup/plugin-terser@1.0.0(rollup@4.62.4)':
     dependencies:
       serialize-javascript: 7.1.2
       smob: 1.6.2
       terser: 5.51.2
     optionalDependencies:
-      rollup: 4.63.4
+      rollup: 4.62.4
 
   '@rollup/plugin-yaml@4.1.2(rollup@4.63.4)':
     dependencies:
@@ -8674,86 +9315,169 @@ snapshots:
     optionalDependencies:
       rollup: 4.63.4
 
+  '@rollup/pluginutils@5.4.0(rollup@4.62.4)':
+    dependencies:
+      '@types/estree': 1.0.9
+      estree-walker: 2.0.2
+      picomatch: 4.0.5
+    optionalDependencies:
+      rollup: 4.62.4
+
   '@rollup/pluginutils@5.4.0(rollup@4.63.4)':
     dependencies:
       '@types/estree': 1.0.9
       estree-walker: 2.0.2
-      picomatch: 4.0.7
+      picomatch: 4.0.5
     optionalDependencies:
       rollup: 4.63.4
 
+  '@rollup/rollup-android-arm-eabi@4.62.4':
+    optional: true
+
   '@rollup/rollup-android-arm-eabi@4.63.4':
     optional: true
 
+  '@rollup/rollup-android-arm64@4.62.4':
+    optional: true
+
   '@rollup/rollup-android-arm64@4.63.4':
     optional: true
 
+  '@rollup/rollup-darwin-arm64@4.62.4':
+    optional: true
+
   '@rollup/rollup-darwin-arm64@4.63.4':
     optional: true
 
+  '@rollup/rollup-darwin-x64@4.62.4':
+    optional: true
+
   '@rollup/rollup-darwin-x64@4.63.4':
     optional: true
 
+  '@rollup/rollup-freebsd-arm64@4.62.4':
+    optional: true
+
   '@rollup/rollup-freebsd-arm64@4.63.4':
     optional: true
 
+  '@rollup/rollup-freebsd-x64@4.62.4':
+    optional: true
+
   '@rollup/rollup-freebsd-x64@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-arm-gnueabihf@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-arm-musleabihf@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-arm-musleabihf@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-arm64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-arm64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-arm64-musl@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-arm64-musl@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-loong64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-loong64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-loong64-musl@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-loong64-musl@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-ppc64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-ppc64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-ppc64-musl@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-ppc64-musl@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-musl@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-musl@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-s390x-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-s390x-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-x64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-x64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-linux-x64-musl@4.62.4':
+    optional: true
+
   '@rollup/rollup-linux-x64-musl@4.63.4':
     optional: true
 
+  '@rollup/rollup-openbsd-x64@4.62.4':
+    optional: true
+
   '@rollup/rollup-openbsd-x64@4.63.4':
     optional: true
 
+  '@rollup/rollup-openharmony-arm64@4.62.4':
+    optional: true
+
   '@rollup/rollup-openharmony-arm64@4.63.4':
     optional: true
 
+  '@rollup/rollup-win32-arm64-msvc@4.62.4':
+    optional: true
+
   '@rollup/rollup-win32-arm64-msvc@4.63.4':
     optional: true
 
+  '@rollup/rollup-win32-ia32-msvc@4.62.4':
+    optional: true
+
   '@rollup/rollup-win32-ia32-msvc@4.63.4':
     optional: true
 
+  '@rollup/rollup-win32-x64-gnu@4.62.4':
+    optional: true
+
   '@rollup/rollup-win32-x64-gnu@4.63.4':
     optional: true
 
+  '@rollup/rollup-win32-x64-msvc@4.62.4':
+    optional: true
+
   '@rollup/rollup-win32-x64-msvc@4.63.4':
     optional: true
 
@@ -8771,11 +9495,11 @@ snapshots:
     dependencies:
       '@noble/hashes': 2.4.0
 
-  '@simple-git/args-pathspec@1.0.3': {}
+  '@simple-git/args-pathspec@1.0.4': {}
 
-  '@simple-git/argv-parser@1.1.1':
+  '@simple-git/argv-parser@2.0.1':
     dependencies:
-      '@simple-git/args-pathspec': 1.0.3
+      '@simple-git/args-pathspec': 1.0.4
 
   '@sindresorhus/base62@1.0.0': {}
 
@@ -8783,6 +9507,39 @@ snapshots:
 
   '@sindresorhus/merge-streams@4.0.0': {}
 
+  '@smithy/core@3.35.0':
+    dependencies:
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@smithy/credential-provider-imds@4.5.2':
+    dependencies:
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@smithy/fetch-http-handler@5.8.0':
+    dependencies:
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@smithy/node-http-handler@4.12.1':
+    dependencies:
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@smithy/signature-v4@5.7.4':
+    dependencies:
+      '@smithy/core': 3.35.0
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
+  '@smithy/types@4.19.0':
+    dependencies:
+      tslib: 2.8.1
+
   '@speed-highlight/core@1.2.24': {}
 
   '@standard-schema/spec@1.1.0': {}
@@ -8795,7 +9552,7 @@ snapshots:
       eslint-visitor-keys: 4.2.1
       espree: 10.4.0
       estraverse: 5.3.0
-      picomatch: 4.0.7
+      picomatch: 4.0.5
 
   '@swc/helpers@0.5.23':
     dependencies:
@@ -8808,7 +9565,7 @@ snapshots:
       jiti: 2.7.0
       lightningcss: 1.32.0
       magic-string: 0.30.21
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
       tailwindcss: 4.3.3
 
   '@tailwindcss/oxide-android-arm64@4.3.3':
@@ -8870,12 +9627,12 @@ snapshots:
       postcss: 8.5.28
       tailwindcss: 4.3.3
 
-  '@tailwindcss/vite@4.3.3(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@tailwindcss/vite@4.3.3(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       '@tailwindcss/node': 4.3.3
       '@tailwindcss/oxide': 4.3.3
       tailwindcss: 4.3.3
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
 
   '@tanstack/table-core@8.21.3': {}
 
@@ -9209,6 +9966,10 @@ snapshots:
     dependencies:
       undici-types: 8.9.0
 
+  '@types/nodemailer@7.0.11':
+    dependencies:
+      '@types/node': 24.13.6
+
   '@types/resolve@1.20.2': {}
 
   '@types/web-bluetooth@0.0.20': {}
@@ -9310,18 +10071,18 @@ snapshots:
       '@typescript-eslint/types': 8.70.1
       eslint-visitor-keys: 5.0.1
 
-  '@unhead/bundler@3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unhead@3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@unhead/bundler@3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unhead@3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       magic-string: 1.4.2
       oxc-walker: 1.1.1(@oxc-project/types@0.151.0)(oxc-parser@0.141.0)(rolldown@1.2.10)
-      unhead: 3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unhead: 3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
     optionalDependencies:
-      esbuild: 0.28.2
+      esbuild: 0.27.7
       lightningcss: 1.33.0
       oxc-parser: 0.141.0
       rolldown: 1.2.10
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@oxc-project/types'
@@ -9331,15 +10092,15 @@ snapshots:
       - rollup
       - unloader
 
-  '@unhead/vue@3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@unhead/vue@3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
-      '@unhead/bundler': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unhead@3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@unhead/bundler': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unhead@3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       hookable: 6.1.2
-      unhead: 3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unhead: 3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       vue: 3.5.43(typescript@5.9.3)
     optionalDependencies:
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@oxc-project/types'
@@ -9425,10 +10186,10 @@ snapshots:
   '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
     optional: true
 
-  '@vercel/nft@1.11.0(rollup@4.63.4)':
+  '@vercel/nft@1.11.0(rollup@4.62.4)':
     dependencies:
       '@mapbox/node-pre-gyp': 2.0.3
-      '@rollup/pluginutils': 5.4.0(rollup@4.63.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
       acorn: 8.18.0
       acorn-import-attributes: 1.9.5(acorn@8.18.0)
       async-sema: 3.1.1
@@ -9444,25 +10205,25 @@ snapshots:
       - rollup
       - supports-color
 
-  '@vitejs/plugin-vue-jsx@5.1.6(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@vitejs/plugin-vue-jsx@5.1.6(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-syntax-typescript': 7.29.7(@babel/core@7.29.7)
       '@babel/plugin-transform-typescript': 7.29.9(@babel/core@7.29.7)
       '@rolldown/pluginutils': 1.0.1
       '@vue/babel-plugin-jsx': 2.0.1(@babel/core@7.29.7)
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       vue: 3.5.43(typescript@5.9.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-vue@6.0.9(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
+  '@vitejs/plugin-vue@6.0.9(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       vue: 3.5.43(typescript@5.9.3)
 
-  '@vitest/coverage-v8@3.2.7(vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@vitest/coverage-v8@3.2.7(vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       '@ampproject/remapping': 2.3.0
       '@bcoe/v8-coverage': 1.0.2
@@ -9477,7 +10238,7 @@ snapshots:
       std-env: 3.10.0
       test-exclude: 7.0.2
       tinyrainbow: 2.0.0
-      vitest: 3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
+      vitest: 3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -9489,13 +10250,13 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.7(vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@vitest/mocker@3.2.7(vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))':
     dependencies:
       '@vitest/spy': 3.2.7
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
 
   '@vitest/pretty-format@3.2.7':
     dependencies:
@@ -9580,7 +10341,7 @@ snapshots:
       '@vue/shared': 3.5.43
       entities: 7.0.1
       estree-walker: 2.0.2
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@vue/compiler-dom@3.5.43':
     dependencies:
@@ -9597,7 +10358,7 @@ snapshots:
       estree-walker: 2.0.2
       magic-string: 0.30.21
       postcss: 8.5.28
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   '@vue/compiler-ssr@3.5.43':
     dependencies:
@@ -9633,7 +10394,7 @@ snapshots:
       alien-signals: 3.2.1
       muggle-string: 0.4.1
       path-browserify: 1.0.1
-      picomatch: 4.0.7
+      picomatch: 4.0.5
 
   '@vue/reactivity@3.5.43':
     dependencies:
@@ -9784,6 +10545,12 @@ snapshots:
       - ioredis
       - uploadthing
 
+  '@xrpl-commons/xrpl-connect-vue@1.0.0-rc.2(vue@3.5.43(typescript@5.9.3))(xrpl-connect@1.0.0-rc.2(patch_hash=fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)))(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10))':
+    dependencies:
+      vue: 3.5.43(typescript@5.9.3)
+      xrpl: 5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
+      xrpl-connect: 1.0.0-rc.2(patch_hash=fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10))
+
   '@xrplf/isomorphic@1.0.2(bufferutil@4.1.0)(utf-8-validate@5.0.10)':
     dependencies:
       '@noble/hashes': 2.3.0
@@ -9798,7 +10565,7 @@ snapshots:
   '@xrplf/secret-numbers@3.0.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)':
     dependencies:
       '@xrplf/isomorphic': 1.0.2(bufferutil@4.1.0)(utf-8-validate@5.0.10)
-      ripple-keypairs: 3.1.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
+      ripple-keypairs: 3.0.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -9829,6 +10596,10 @@ snapshots:
 
   agent-base@7.1.4: {}
 
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
   ajv@6.15.0:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -9857,6 +10628,8 @@ snapshots:
 
   ansis@4.4.0: {}
 
+  any-promise@1.3.0: {}
+
   anymatch@3.1.3:
     dependencies:
       normalize-path: 3.0.0
@@ -10021,6 +10794,8 @@ snapshots:
 
   boolbase@1.0.0: {}
 
+  bowser@2.14.1: {}
+
   brace-expansion@1.1.21:
     dependencies:
       balanced-match: 1.0.2
@@ -10082,6 +10857,11 @@ snapshots:
     dependencies:
       run-applescript: 7.1.0
 
+  bundle-require@5.1.0(esbuild@0.27.7):
+    dependencies:
+      esbuild: 0.27.7
+      load-tsconfig: 0.2.5
+
   c12@3.3.4(magicast@0.5.5):
     dependencies:
       chokidar: 5.0.0
@@ -10148,6 +10928,10 @@ snapshots:
 
   check-error@2.1.3: {}
 
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
   chokidar@5.0.0:
     dependencies:
       readdirp: 5.1.1
@@ -10188,6 +10972,8 @@ snapshots:
 
   commander@2.20.3: {}
 
+  commander@4.1.1: {}
+
   comment-parser@1.4.7: {}
 
   comment-parser@1.4.9: {}
@@ -10224,6 +11010,8 @@ snapshots:
 
   cookie-es@3.1.1: {}
 
+  cookie@1.1.1: {}
+
   core-js-compat@3.50.0:
     dependencies:
       browserslist: 4.29.0
@@ -10283,12 +11071,12 @@ snapshots:
   css-tree@2.2.1:
     dependencies:
       mdn-data: 2.0.28
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   css-tree@3.2.1:
     dependencies:
       mdn-data: 2.27.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   css-what@7.0.0: {}
 
@@ -10397,6 +11185,8 @@ snapshots:
 
   depd@2.0.0: {}
 
+  dequal@2.0.3: {}
+
   destr@2.0.5: {}
 
   detect-indent@7.0.2: {}
@@ -10956,6 +11746,15 @@ snapshots:
 
   fast-json-stable-stringify@2.1.0: {}
 
+  fast-json-stringify@6.4.0:
+    dependencies:
+      '@fastify/merge-json-schemas': 0.2.1
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 3.1.8
+      json-schema-ref-resolver: 3.0.0
+      rfdc: 1.4.1
+
   fast-levenshtein@2.0.6: {}
 
   fast-npm-meta@2.2.0:
@@ -10978,6 +11777,10 @@ snapshots:
     dependencies:
       reusify: 1.1.0
 
+  fdir@6.5.0(picomatch@4.0.5):
+    optionalDependencies:
+      picomatch: 4.0.5
+
   fdir@6.5.0(picomatch@4.0.7):
     optionalDependencies:
       picomatch: 4.0.7
@@ -11010,6 +11813,12 @@ snapshots:
       locate-path: 8.0.0
       unicorn-magic: 0.3.0
 
+  fix-dts-default-cjs-exports@1.0.1:
+    dependencies:
+      magic-string: 0.30.21
+      mlly: 1.8.2
+      rollup: 4.62.4
+
   flat-cache@4.0.1:
     dependencies:
       flatted: 3.4.4
@@ -11033,7 +11842,7 @@ snapshots:
     dependencies:
       tiny-inflate: 1.0.3
 
-  fontless@0.2.1(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  fontless@0.2.1(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       consola: 3.4.2
       css-tree: 3.2.1
@@ -11049,7 +11858,7 @@ snapshots:
       unifont: 0.7.5
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
     optionalDependencies:
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@azure/app-configuration'
       - '@azure/cosmos'
@@ -11305,12 +12114,12 @@ snapshots:
 
   import-meta-resolve@4.2.0: {}
 
-  impound@1.2.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  impound@1.2.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       es-module-lexer: 2.3.2
       pathe: 2.0.3
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
     transitivePeerDependencies:
       - '@farmfe/core'
@@ -11425,7 +12234,7 @@ snapshots:
 
   is-typed-array@1.1.15:
     dependencies:
-      which-typed-array: 1.1.24
+      which-typed-array: 1.1.22
 
   is-typedarray@1.0.0: {}
 
@@ -11474,6 +12283,8 @@ snapshots:
 
   jose@6.2.12: {}
 
+  joycon@3.1.1: {}
+
   js-tokens@10.0.0: {}
 
   js-tokens@4.0.0: {}
@@ -11495,6 +12306,10 @@ snapshots:
 
   json-buffer@3.0.1: {}
 
+  json-schema-ref-resolver@3.0.0:
+    dependencies:
+      dequal: 2.0.3
+
   json-schema-to-typescript-lite@15.0.0:
     dependencies:
       '@apidevtools/json-schema-ref-parser': 14.2.1(@types/json-schema@7.0.15)
@@ -11532,7 +12347,7 @@ snapshots:
   launch-editor@2.14.1:
     dependencies:
       picocolors: 1.1.1
-      shell-quote: 1.10.0
+      shell-quote: 1.11.0
 
   lazystream@1.0.1:
     dependencies:
@@ -11547,6 +12362,12 @@ snapshots:
     dependencies:
       isomorphic.js: 0.2.5
 
+  light-my-request@6.6.0:
+    dependencies:
+      cookie: 1.1.1
+      process-warning: 4.0.1
+      set-cookie-parser: 2.7.2
+
   lightningcss-android-arm64@1.32.0:
     optional: true
 
@@ -11647,6 +12468,8 @@ snapshots:
 
   lilconfig@3.1.3: {}
 
+  lines-and-columns@1.2.4: {}
+
   linkifyjs@4.3.3: {}
 
   listhen@1.10.1(srvx@0.11.22):
@@ -11660,7 +12483,7 @@ snapshots:
       h3: 1.15.11
       http-shutdown: 1.2.2
       jiti: 2.7.0
-      node-forge: 1.4.0
+      node-forge: 1.4.0(patch_hash=02907f52247711a7ef40888d32c1b81ba9d2978da8eb131d6e57149fc6475820)
       pathe: 2.0.3
       std-env: 4.2.0
       tinyclip: 0.1.15
@@ -11670,6 +12493,8 @@ snapshots:
     transitivePeerDependencies:
       - srvx
 
+  load-tsconfig@0.2.5: {}
+
   loader-utils@3.3.1: {}
 
   local-pkg@1.2.1:
@@ -11718,6 +12543,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
 
+  magic-string@1.2.3:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
   magic-string@1.4.2:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
@@ -11726,13 +12555,13 @@ snapshots:
     dependencies:
       '@babel/parser': 7.29.9
       '@babel/types': 7.29.8
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   magicast@0.5.5:
     dependencies:
       '@babel/parser': 7.29.9
       '@babel/types': 7.29.8
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   make-asynchronous@1.1.0:
     dependencies:
@@ -11842,6 +12671,12 @@ snapshots:
 
   multiformats@14.0.5: {}
 
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
   nan@2.29.0: {}
 
   nanoid@3.3.19: {}
@@ -11854,17 +12689,17 @@ snapshots:
 
   next-tick@1.1.0: {}
 
-  nitropack@2.13.4(drizzle-orm@0.45.3(postgres@3.4.9))(idb-keyval@6.3.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(srvx@0.11.22)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  nitropack@2.13.4(drizzle-orm@0.45.3(postgres@3.4.9))(idb-keyval@6.3.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(srvx@0.11.22)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       '@cloudflare/kv-asset-handler': 0.4.2
-      '@rollup/plugin-alias': 6.0.0(rollup@4.63.4)
-      '@rollup/plugin-commonjs': 29.0.3(rollup@4.63.4)
-      '@rollup/plugin-inject': 5.0.5(rollup@4.63.4)
-      '@rollup/plugin-json': 6.1.0(rollup@4.63.4)
-      '@rollup/plugin-node-resolve': 16.0.3(rollup@4.63.4)
-      '@rollup/plugin-replace': 6.0.3(rollup@4.63.4)
-      '@rollup/plugin-terser': 1.0.0(rollup@4.63.4)
-      '@vercel/nft': 1.11.0(rollup@4.63.4)
+      '@rollup/plugin-alias': 6.0.0(rollup@4.62.4)
+      '@rollup/plugin-commonjs': 29.0.3(rollup@4.62.4)
+      '@rollup/plugin-inject': 5.0.5(rollup@4.62.4)
+      '@rollup/plugin-json': 6.1.0(rollup@4.62.4)
+      '@rollup/plugin-node-resolve': 16.0.3(rollup@4.62.4)
+      '@rollup/plugin-replace': 6.0.3(rollup@4.62.4)
+      '@rollup/plugin-terser': 1.0.0(rollup@4.62.4)
+      '@vercel/nft': 1.11.0(rollup@4.62.4)
       archiver: 7.0.1
       c12: 3.3.4(magicast@0.5.5)
       chokidar: 5.0.0
@@ -11906,8 +12741,8 @@ snapshots:
       pkg-types: 2.3.3
       pretty-bytes: 7.1.3
       radix3: 1.1.2
-      rollup: 4.63.4
-      rollup-plugin-visualizer: 7.1.1(rolldown@1.2.10)(rollup@4.63.4)
+      rollup: 4.62.4
+      rollup-plugin-visualizer: 7.1.1(rolldown@1.2.10)(rollup@4.62.4)
       scule: 1.3.0
       semver: 7.8.5
       serve-placeholder: 2.0.2
@@ -11919,7 +12754,7 @@ snapshots:
       uncrypto: 0.1.3
       unctx: 2.5.0
       unenv: 2.0.0-rc.24
-      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.62.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
       unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)
       untyped: 2.0.0
@@ -11977,7 +12812,7 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-forge@1.4.0: {}
+  node-forge@1.4.0(patch_hash=02907f52247711a7ef40888d32c1b81ba9d2978da8eb131d6e57149fc6475820): {}
 
   node-gyp-build@4.8.4: {}
 
@@ -11985,6 +12820,8 @@ snapshots:
 
   node-releases@2.0.57: {}
 
+  nodemailer@10.0.10: {}
+
   nopt@8.1.0:
     dependencies:
       abbrev: 3.0.1
@@ -12006,9 +12843,9 @@ snapshots:
     dependencies:
       boolbase: 1.0.0
 
-  nuxt-csurf@1.6.6(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))):
+  nuxt-csurf@1.6.6(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))):
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       defu: 6.1.7
       uncsrf: 1.2.0
     transitivePeerDependencies:
@@ -12020,12 +12857,12 @@ snapshots:
 
   nuxt-define@1.0.0: {}
 
-  nuxt-security@2.6.0(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))):
+  nuxt-security@2.6.0(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))):
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       basic-auth: 2.0.1
       defu: 6.1.7
-      nuxt-csurf: 1.6.6(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      nuxt-csurf: 1.6.6(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       pathe: 2.0.3
       unplugin-remove: 1.0.3(rollup@4.63.4)
       xss: 1.0.15
@@ -12038,17 +12875,17 @@ snapshots:
       - supports-color
       - unplugin
 
-  nuxt@4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.28.2)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1):
+  nuxt@4.5.2(@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.29.7))(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7))(@oxc-project/types@0.151.0)(@types/node@24.13.6)(@vue/compiler-sfc@3.5.43)(bufferutil@4.1.0)(cac@7.0.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(drizzle-orm@0.45.3(postgres@3.4.9))(esbuild@0.27.7)(eslint@9.39.5(jiti@2.7.0))(idb-keyval@6.3.0)(ioredis@5.11.1)(lightningcss@1.33.0)(magicast@0.5.5)(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4))(rollup@4.63.4)(srvx@0.11.22)(terser@5.51.2)(tsx@4.23.12)(typescript@5.9.3)(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3))(yaml@2.9.1):
     dependencies:
-      '@dxup/nuxt': 0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@dxup/nuxt': 0.5.10(esbuild@0.27.7)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@nuxt/cli': 3.37.0(@nuxt/schema@4.5.2)(cac@7.0.0)(magicast@0.5.5)
-      '@nuxt/devtools': 3.4.2(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
-      '@nuxt/nitro-server': 4.5.2(4062c2abf6e9c3c646190cfa175760c1)
+      '@nuxt/devtools': 3.4.2(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(idb-keyval@6.3.0)(ioredis@5.11.1)(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))(utf-8-validate@5.0.10)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
+      '@nuxt/nitro-server': 4.5.2(3fa81c4a57e2504a1a63aa3f72a99eff)
       '@nuxt/schema': 4.5.2
-      '@nuxt/telemetry': 2.9.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))
-      '@nuxt/vite-builder': 4.5.2(192fea6631a6099137c9b72eb273ee26)
-      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      '@nuxt/telemetry': 2.9.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))
+      '@nuxt/vite-builder': 4.5.2(eeebb6ed07e5bccc353105079f59e390)
+      '@unhead/vue': 3.4.1(@oxc-project/types@0.151.0)(esbuild@0.27.7)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
       '@vue/shared': 3.5.43
       chokidar: 5.0.0
       compatx: 0.2.0
@@ -12062,7 +12899,7 @@ snapshots:
       fnv1a-64: 0.1.2
       hookable: 6.1.2
       ignore: 7.0.10
-      impound: 1.2.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      impound: 1.2.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       jiti: 2.7.0
       klona: 2.0.6
       knitwork: 1.3.0
@@ -12089,17 +12926,17 @@ snapshots:
       ufo: 1.6.4
       ultrahtml: 1.7.0
       uncrypto: 0.1.3
-      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      unctx: 3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       undici: 8.11.0
-      unhead: 3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unhead: 3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unimport: 6.5.0(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unrouting: 0.2.3
       untyped: 2.0.0
       verkit: 0.3.2
       vue: 3.5.43(typescript@5.9.3)
       vue-component-type-helpers: 3.3.11
-      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
+      vue-router: 5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3))
     optionalDependencies:
       '@types/node': 24.13.6
     transitivePeerDependencies:
@@ -12186,6 +13023,10 @@ snapshots:
       pathe: 2.0.3
       tinyexec: 1.3.1
 
+  oauth4webapi@3.8.8: {}
+
+  object-assign@4.1.1: {}
+
   object-deep-merge@2.0.1: {}
 
   object-identity@0.2.3: {}
@@ -12237,6 +13078,11 @@ snapshots:
       powershell-utils: 0.2.1
       wsl-utils: 1.0.0
 
+  openid-client@6.8.8:
+    dependencies:
+      jose: 6.2.12
+      oauth4webapi: 3.8.8
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -12377,6 +13223,8 @@ snapshots:
 
   picomatch@2.3.2: {}
 
+  picomatch@4.0.5: {}
+
   picomatch@4.0.7: {}
 
   pino-abstract-transport@2.0.0:
@@ -12399,6 +13247,8 @@ snapshots:
       sonic-boom: 4.2.1
       thread-stream: 3.2.0
 
+  pirates@4.0.7: {}
+
   pkce-challenge@5.0.1: {}
 
   pkg-types@1.3.1:
@@ -12462,6 +13312,15 @@ snapshots:
     dependencies:
       postcss: 8.5.28
 
+  postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.28)(tsx@4.23.12)(yaml@2.9.1):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 2.7.0
+      postcss: 8.5.28
+      tsx: 4.23.12
+      yaml: 2.9.1
+
   postcss-merge-longhand@8.0.4(postcss@8.5.28):
     dependencies:
       postcss: 8.5.28
@@ -12587,7 +13446,7 @@ snapshots:
     dependencies:
       nanoid: 3.3.19
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   postgres@3.4.9: {}
 
@@ -12603,6 +13462,8 @@ snapshots:
 
   process-nextick-args@2.0.1: {}
 
+  process-warning@4.0.1: {}
+
   process-warning@5.1.0: {}
 
   process@0.11.10: {}
@@ -12701,6 +13562,8 @@ snapshots:
 
   range-parser@1.3.0: {}
 
+  rate-limiter-flexible@7.4.0: {}
+
   rc9@3.1.0:
     dependencies:
       defu: 6.1.7
@@ -12728,6 +13591,8 @@ snapshots:
     dependencies:
       minimatch: 5.1.9
 
+  readdirp@4.1.2: {}
+
   readdirp@5.1.1: {}
 
   real-require@0.2.0: {}
@@ -12790,6 +13655,8 @@ snapshots:
 
   reusify@1.1.0: {}
 
+  rfdc@1.4.1: {}
+
   ripemd160@2.0.3:
     dependencies:
       hash-base: 3.1.2
@@ -12843,6 +13710,15 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
+  ripple-keypairs@3.0.0(bufferutil@4.1.0)(utf-8-validate@5.0.10):
+    dependencies:
+      '@noble/curves': 2.4.0
+      '@xrplf/isomorphic': 1.0.2(bufferutil@4.1.0)(utf-8-validate@5.0.10)
+      ripple-address-codec: 5.0.1(bufferutil@4.1.0)(utf-8-validate@5.0.10)
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
   ripple-keypairs@3.1.0(bufferutil@4.1.0)(utf-8-validate@5.0.10):
     dependencies:
       '@noble/curves': 2.4.0
@@ -12879,6 +13755,16 @@ snapshots:
       '@rolldown/binding-win32-arm64-msvc': 1.2.10
       '@rolldown/binding-win32-x64-msvc': 1.2.10
 
+  rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.62.4):
+    dependencies:
+      open: 11.0.4
+      picomatch: 4.0.7
+      source-map: 0.8.0
+      yargs: 18.2.0
+    optionalDependencies:
+      rolldown: 1.2.10
+      rollup: 4.62.4
+
   rollup-plugin-visualizer@7.1.1(rolldown@1.2.10)(rollup@4.63.4):
     dependencies:
       open: 11.0.4
@@ -12888,6 +13774,39 @@ snapshots:
     optionalDependencies:
       rolldown: 1.2.10
       rollup: 4.63.4
+    optional: true
+
+  rollup@4.62.4:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.62.4
+      '@rollup/rollup-android-arm64': 4.62.4
+      '@rollup/rollup-darwin-arm64': 4.62.4
+      '@rollup/rollup-darwin-x64': 4.62.4
+      '@rollup/rollup-freebsd-arm64': 4.62.4
+      '@rollup/rollup-freebsd-x64': 4.62.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.4
+      '@rollup/rollup-linux-arm64-gnu': 4.62.4
+      '@rollup/rollup-linux-arm64-musl': 4.62.4
+      '@rollup/rollup-linux-loong64-gnu': 4.62.4
+      '@rollup/rollup-linux-loong64-musl': 4.62.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.4
+      '@rollup/rollup-linux-ppc64-musl': 4.62.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.4
+      '@rollup/rollup-linux-riscv64-musl': 4.62.4
+      '@rollup/rollup-linux-s390x-gnu': 4.62.4
+      '@rollup/rollup-linux-x64-gnu': 4.62.4
+      '@rollup/rollup-linux-x64-musl': 4.62.4
+      '@rollup/rollup-openbsd-x64': 4.62.4
+      '@rollup/rollup-openharmony-arm64': 4.62.4
+      '@rollup/rollup-win32-arm64-msvc': 4.62.4
+      '@rollup/rollup-win32-ia32-msvc': 4.62.4
+      '@rollup/rollup-win32-x64-gnu': 4.62.4
+      '@rollup/rollup-win32-x64-msvc': 4.62.4
+      fsevents: 2.3.3
 
   rollup@4.63.4:
     dependencies:
@@ -12990,6 +13909,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  set-cookie-parser@2.7.2: {}
+
   set-function-length@1.2.2:
     dependencies:
       define-data-property: 1.1.4
@@ -13013,7 +13934,7 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
-  shell-quote@1.10.0: {}
+  shell-quote@1.11.0: {}
 
   siginfo@2.0.0: {}
 
@@ -13021,12 +13942,12 @@ snapshots:
 
   signal-exit@4.1.0: {}
 
-  simple-git@3.36.0:
+  simple-git@4.0.2:
     dependencies:
       '@kwsites/file-exists': 1.1.1
       '@kwsites/promise-deferred': 1.1.1
-      '@simple-git/args-pathspec': 1.0.3
-      '@simple-git/argv-parser': 1.1.1
+      '@simple-git/args-pathspec': 1.0.4
+      '@simple-git/argv-parser': 2.0.1
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
@@ -13049,7 +13970,7 @@ snapshots:
     dependencies:
       atomic-sleep: 1.0.0
 
-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}
 
   source-map-support@0.5.21:
     dependencies:
@@ -13159,6 +14080,16 @@ snapshots:
       postcss: 8.5.28
       postcss-selector-parser: 7.1.6
 
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.17
+      ts-interface-checker: 0.1.13
+
   super-regex@1.1.0:
     dependencies:
       function-timeout: 1.0.2
@@ -13241,6 +14172,14 @@ snapshots:
     transitivePeerDependencies:
       - react-native-b4a
 
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
   thread-stream@3.2.0:
     dependencies:
       real-require: 0.2.0
@@ -13271,8 +14210,8 @@ snapshots:
 
   tinyglobby@0.2.17:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.7)
-      picomatch: 4.0.7
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
 
   tinypool@1.1.1: {}
 
@@ -13307,14 +14246,52 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
+  tree-kill@1.2.2: {}
+
   ts-api-utils@2.5.0(typescript@5.9.3):
     dependencies:
       typescript: 5.9.3
 
+  ts-interface-checker@0.1.13: {}
+
   tslib@1.14.1: {}
 
   tslib@2.8.1: {}
 
+  tsup@8.5.1(jiti@2.7.0)(postcss@8.5.28)(tsx@4.23.12)(typescript@5.9.3)(yaml@2.9.1):
+    dependencies:
+      bundle-require: 5.1.0(esbuild@0.27.7)
+      cac: 6.7.14
+      chokidar: 4.0.3
+      consola: 3.4.2
+      debug: 4.4.3
+      esbuild: 0.27.7
+      fix-dts-default-cjs-exports: 1.0.1
+      joycon: 3.1.1
+      picocolors: 1.1.1
+      postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.28)(tsx@4.23.12)(yaml@2.9.1)
+      resolve-from: 5.0.0
+      rollup: 4.62.4
+      source-map: 0.7.6
+      sucrase: 3.35.1
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.17
+      tree-kill: 1.2.2
+    optionalDependencies:
+      postcss: 8.5.28
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - jiti
+      - supports-color
+      - tsx
+      - yaml
+
+  tsx@4.23.12:
+    dependencies:
+      esbuild: 0.28.2
+    optionalDependencies:
+      fsevents: 2.3.3
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1
@@ -13358,19 +14335,19 @@ snapshots:
       magic-string: 0.30.21
       unplugin: 2.3.11
 
-  unctx@3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))):
+  unctx@3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))):
     optionalDependencies:
       magic-string: 0.30.21
       oxc-parser: 0.141.0
       rolldown: 1.2.10
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
 
-  unctx@3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))):
+  unctx@3.0.1(magic-string@1.4.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))):
     optionalDependencies:
       magic-string: 1.4.2
       oxc-parser: 0.141.0
       rolldown: 1.2.10
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
 
   undici-types@6.21.0: {}
 
@@ -13386,12 +14363,12 @@ snapshots:
     dependencies:
       pathe: 2.0.3
 
-  unhead@3.4.1(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  unhead@3.4.1(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       hookable: 6.1.2
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
     optionalDependencies:
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -13413,13 +14390,13 @@ snapshots:
       ohash: 2.0.12
       undici: 8.11.0
 
-  unimport@6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  unimport@6.5.0(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       acorn: 8.18.0
       escape-string-regexp: 5.0.0
       estree-walker: 3.0.3
       local-pkg: 1.2.1
-      magic-string: 1.4.2
+      magic-string: 1.2.3
       mlly: 1.8.2
       pathe: 2.0.3
       picomatch: 4.0.7
@@ -13427,7 +14404,7 @@ snapshots:
       scule: 1.3.0
       strip-literal: 4.0.0
       tinyglobby: 0.2.17
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
     optionalDependencies:
       oxc-parser: 0.141.0
@@ -13443,16 +14420,46 @@ snapshots:
       - vite
       - webpack
 
-  unplugin-auto-import@21.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(@vueuse/core@14.4.0(vue@3.5.43(typescript@5.9.3)))(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  unimport@6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.62.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
+    dependencies:
+      acorn: 8.18.0
+      escape-string-regexp: 5.0.0
+      estree-walker: 3.0.3
+      local-pkg: 1.2.1
+      magic-string: 1.2.3
+      mlly: 1.8.2
+      pathe: 2.0.3
+      picomatch: 4.0.7
+      pkg-types: 2.3.3
+      scule: 1.3.0
+      strip-literal: 4.0.0
+      tinyglobby: 0.2.17
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.62.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin-utils: 0.3.2
+    optionalDependencies:
+      oxc-parser: 0.141.0
+      rolldown: 1.2.10
+    transitivePeerDependencies:
+      - '@farmfe/core'
+      - '@rsbuild/core'
+      - '@rspack/core'
+      - bun-types-no-globals
+      - esbuild
+      - rollup
+      - unloader
+      - vite
+      - webpack
+
+  unplugin-auto-import@21.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(@vueuse/core@14.4.0(vue@3.5.43(typescript@5.9.3)))(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       local-pkg: 1.2.1
       magic-string: 1.4.2
       picomatch: 4.0.7
-      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unimport: 6.5.0(esbuild@0.27.7)(oxc-parser@0.141.0)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
     optionalDependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
       '@vueuse/core': 14.4.0(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
       - '@farmfe/core'
@@ -13483,9 +14490,9 @@ snapshots:
   unplugin-utils@0.3.2:
     dependencies:
       pathe: 2.0.3
-      picomatch: 4.0.7
+      picomatch: 4.0.5
 
-  unplugin-vue-components@32.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
+  unplugin-vue-components@32.1.0(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       chokidar: 5.0.0
       local-pkg: 1.2.1
@@ -13494,11 +14501,11 @@ snapshots:
       obug: 2.2.1
       picomatch: 4.0.7
       tinyglobby: 0.2.17
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
       vue: 3.5.43(typescript@5.9.3)
     optionalDependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -13523,16 +14530,27 @@ snapshots:
       picomatch: 4.0.7
       webpack-virtual-modules: 0.6.2
 
-  unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       '@jridgewell/remapping': 2.3.5
       picomatch: 4.0.7
       webpack-virtual-modules: 0.6.2
     optionalDependencies:
-      esbuild: 0.28.2
+      esbuild: 0.27.7
       rolldown: 1.2.10
       rollup: 4.63.4
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+
+  unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.62.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
+    dependencies:
+      '@jridgewell/remapping': 2.3.5
+      picomatch: 4.0.7
+      webpack-virtual-modules: 0.6.2
+    optionalDependencies:
+      esbuild: 0.28.2
+      rolldown: 1.2.10
+      rollup: 4.62.4
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
 
   unrouting@0.2.3:
     dependencies:
@@ -13624,7 +14642,7 @@ snapshots:
       is-arguments: 1.2.0
       is-generator-function: 1.1.2
       is-typed-array: 1.1.15
-      which-typed-array: 1.1.24
+      which-typed-array: 1.1.22
 
   vaul-vue@0.4.1(patch_hash=745c51497acce22bbe96fcc248a7de7767e5f8beee0f24441d9d34c33e89faa0)(reka-ui@2.10.4(vue@3.5.43(typescript@5.9.3)))(vue@3.5.43(typescript@5.9.3)):
     dependencies:
@@ -13636,23 +14654,23 @@ snapshots:
 
   verkit@0.3.2: {}
 
-  vite-dev-rpc@2.0.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  vite-dev-rpc@2.0.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       birpc: 4.2.0
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-hot-client: 2.2.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-hot-client: 2.2.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
 
-  vite-hot-client@2.2.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  vite-hot-client@2.2.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
 
-  vite-node@3.2.4(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1):
+  vite-node@3.2.4(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1):
     dependencies:
       cac: 6.7.14
       debug: 4.4.3
       es-module-lexer: 1.7.0
       pathe: 2.0.3
-      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -13667,13 +14685,13 @@ snapshots:
       - tsx
       - yaml
 
-  vite-node@6.0.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
+  vite-node@6.0.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1):
     dependencies:
       cac: 7.0.0
       es-module-lexer: 2.3.2
       obug: 2.2.1
       pathe: 2.0.3
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - '@vitejs/devtools'
@@ -13688,7 +14706,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-checker@0.14.5(eslint@9.39.5(jiti@2.7.0))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3)):
+  vite-plugin-checker@0.14.5(eslint@9.39.5(jiti@2.7.0))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue-tsc@3.3.11(typescript@5.9.3)):
     dependencies:
       '@babel/code-frame': 7.29.7
       chokidar: 5.0.0
@@ -13697,14 +14715,14 @@ snapshots:
       picomatch: 4.0.7
       proper-lockfile: 4.1.2
       tiny-invariant: 1.3.3
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     optionalDependencies:
       eslint: 9.39.5(jiti@2.7.0)
       optionator: 0.9.4
       typescript: 5.9.3
       vue-tsc: 3.3.11(typescript@5.9.3)
 
-  vite-plugin-inspect@11.4.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  vite-plugin-inspect@11.4.1(@nuxt/kit@4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)):
     dependencies:
       ansis: 4.4.0
       error-stack-parser-es: 1.0.5
@@ -13714,28 +14732,28 @@ snapshots:
       perfect-debounce: 2.1.0
       sirv: 3.0.2
       unplugin-utils: 0.3.2
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-dev-rpc: 2.0.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-dev-rpc: 2.0.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
     optionalDependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.10)(unplugin@3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)))
 
-  vite-plugin-vue-tracer@1.5.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
+  vite-plugin-vue-tracer@1.5.0(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       estree-walker: 3.0.3
       exsolve: 1.1.1
       magic-string: 1.4.2
       pathe: 2.0.3
-      source-map-js: 1.2.1
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      source-map-js: 1.2.2
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       vue: 3.5.43(typescript@5.9.3)
 
-  vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1):
+  vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1):
     dependencies:
       esbuild: 0.28.2
       fdir: 6.5.0(picomatch@4.0.7)
       picomatch: 4.0.7
       postcss: 8.5.28
-      rollup: 4.63.4
+      rollup: 4.62.4
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.6
@@ -13743,9 +14761,10 @@ snapshots:
       jiti: 2.7.0
       lightningcss: 1.33.0
       terser: 5.51.2
+      tsx: 4.23.12
       yaml: 2.9.1
 
-  vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
+  vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -13754,17 +14773,18 @@ snapshots:
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.6
-      esbuild: 0.28.2
+      esbuild: 0.27.7
       fsevents: 2.3.3
       jiti: 2.7.0
       terser: 5.51.2
+      tsx: 4.23.12
       yaml: 2.9.1
 
-  vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1):
+  vitest@3.2.7(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1):
     dependencies:
       '@types/chai': 5.2.3
       '@vitest/expect': 3.2.7
-      '@vitest/mocker': 3.2.7(vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1))
+      '@vitest/mocker': 3.2.7(vite@7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       '@vitest/pretty-format': 3.2.7
       '@vitest/runner': 3.2.7
       '@vitest/snapshot': 3.2.7
@@ -13782,8 +14802,8 @@ snapshots:
       tinyglobby: 0.2.17
       tinypool: 1.1.1
       tinyrainbow: 2.0.0
-      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-node: 3.2.4(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 7.3.6(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
+      vite-node: 3.2.4(@types/node@24.13.6)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 24.13.6
@@ -13835,7 +14855,7 @@ snapshots:
       '@vue/devtools-api': 6.6.4
       vue: 3.5.43(typescript@5.9.3)
 
-  vue-router@5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
+  vue-router@5.3.1(@vue/compiler-sfc@3.5.43)(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       '@vue-macros/common': 3.1.4(vue@3.5.43(typescript@5.9.3))
       '@vue/devtools-api': 8.2.1
@@ -13851,12 +14871,12 @@ snapshots:
       picomatch: 4.0.7
       scule: 1.3.0
       tinyglobby: 0.2.17
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      unplugin: 3.4.0(esbuild@0.27.7)(rolldown@1.2.10)(rollup@4.63.4)(vite@8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1))
       unplugin-utils: 0.3.2
       vue: 3.5.43(typescript@5.9.3)
     optionalDependencies:
       '@vue/compiler-sfc': 3.5.43
-      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.0(@types/node@24.13.6)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.12)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -13910,7 +14930,7 @@ snapshots:
 
   wheel-gestures@2.3.0: {}
 
-  which-typed-array@1.1.24:
+  which-typed-array@1.1.22:
     dependencies:
       available-typed-arrays: 1.0.7
       call-bind: 1.0.9
@@ -13969,7 +14989,7 @@ snapshots:
 
   xml-name-validator@5.0.0: {}
 
-  xrpl-connect@1.0.0-rc.0(patch_hash=e2ed5ff5b3a2c073307e088b37dc70382b07d407935c719d8be11a4a04332989)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)):
+  xrpl-connect@1.0.0-rc.2(patch_hash=fc9808b6fae2f6618e5a51a02a66e384ffe5ce3ef9cd5679e9d2b099840d9d5a)(bufferutil@4.1.0)(db0@0.3.4(drizzle-orm@0.45.3(postgres@3.4.9)))(ioredis@5.11.1)(utf-8-validate@5.0.10)(xrpl@5.3.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)):
     dependencies:
       '@crossmarkio/typings': 0.0.6(bufferutil@4.1.0)(utf-8-validate@5.0.10)
       '@gemwallet/api': 3.8.0
diff --git a/apps/web/scripts/admin-fixtures.ts b/apps/web/scripts/admin-fixtures.ts
new file mode 100644
index 0000000..41877f7
--- /dev/null
+++ b/apps/web/scripts/admin-fixtures.ts
@@ -0,0 +1,51 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { mkdir, writeFile } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
+import { createDatabaseClient } from '../server/lib/db/index.js'
+import { adminSecret } from '../server/xcs/admin/config.js'
+
+async function main() {
+  const url = new URL(adminSecret(process.env, 'XCS_ADMIN_FIXTURE_DATABASE_URL'))
+  const directory = process.env.XCS_DOCUMENT_FILESYSTEM_DIRECTORY ?? ''
+  if (
+    process.env.NODE_ENV === 'production' ||
+    !['127.0.0.1', 'localhost', 'postgres'].includes(url.hostname) ||
+    !/^\/xcs_admin_demo[a-z0-9_]*$/.test(url.pathname) ||
+    !isAbsolute(directory)
+  )
+    throw new Error('FIXTURE_LOCAL_DEMO_DATABASE_REQUIRED')
+  await mkdir(directory, { recursive: true, mode: 0o700 })
+  const bytes = Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aOioAAAAASUVORK5CYII=',
+    'base64',
+  )
+  const client = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+  try {
+    for (const role of ['issuer', 'verifier'] as const) {
+      const key = `synthetic-${randomUUID()}.png`
+      await writeFile(join(directory, key), bytes, { mode: 0o600, flag: 'wx' })
+      await client.sql.begin(async (sql) => {
+        const [user] =
+          await sql`INSERT INTO app_users(identity_issuer,identity_subject,email,email_verified_at,display_name)
+          VALUES ('https://synthetic.invalid',${randomUUID()},'synthetic@example.test',statement_timestamp(),'Synthetic review contact') RETURNING id`
+        const [org] =
+          await sql`INSERT INTO app_organizations(responsible_user_id,name) VALUES (${user!.id},${'Synthetic ' + role + ' organization'}) RETURNING id`
+        await sql`INSERT INTO app_organization_applications(organization_id,role,website,jurisdiction,description,purpose)
+          VALUES (${org!.id},${role},'https://example.test','Synthetic jurisdiction','Local validation fixture, not a real organization.','Validate administrator decisions.')`
+        await sql`INSERT INTO app_documents(organization_id,application_role,storage_key,mime_type,byte_length,sha256,uploaded_by)
+          VALUES (${org!.id},${role},${key},'image/png',${bytes.length},${createHash('sha256').update(bytes).digest('hex')},${user!.id})`
+      })
+    }
+    console.log(
+      'Created two synthetic applications and private PNG documents. No account can sign in through the synthetic issuer.',
+    )
+  } finally {
+    await client.close()
+  }
+}
+main().catch(() => {
+  console.error(
+    'admin-fixtures: failed; require migrated local xcs_admin_demo database and private writable directory',
+  )
+  process.exitCode = 1
+})
diff --git a/apps/web/scripts/admin-notifier.ts b/apps/web/scripts/admin-notifier.ts
new file mode 100644
index 0000000..80cbf4b
--- /dev/null
+++ b/apps/web/scripts/admin-notifier.ts
@@ -0,0 +1,62 @@
+import { adminSecret } from '../server/xcs/admin/config.js'
+import { setTimeout as delay } from 'node:timers/promises'
+import { createDatabaseClient } from '../server/lib/db/index.js'
+import {
+  PostgresNotificationRepository,
+  processNextNotification,
+} from '../server/xcs/admin/notifications.js'
+import { createSmtpDelivery } from '../server/xcs/notifications/smtp.js'
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2)
+  if (args.some((arg) => arg !== '--once')) throw new Error('Unsupported argument')
+  const databaseUrl = adminSecret(process.env, 'XCS_NOTIFIER_DATABASE_URL')
+  if (!databaseUrl) throw new Error('XCS_NOTIFIER_DATABASE_URL is required')
+  const portalOrigin = adminSecret(process.env, 'XCS_AUTH_ORIGIN')
+  let parsedOrigin: URL
+  try {
+    parsedOrigin = new URL(portalOrigin)
+  } catch {
+    throw new Error('XCS_AUTH_ORIGIN must be an exact HTTPS origin')
+  }
+  if (
+    parsedOrigin.protocol !== 'https:' ||
+    parsedOrigin.origin !== portalOrigin ||
+    parsedOrigin.username ||
+    parsedOrigin.password
+  )
+    throw new Error('XCS_AUTH_ORIGIN must be an exact HTTPS origin')
+  const { transport, sender } = createSmtpDelivery(process.env)
+  const client = createDatabaseClient(databaseUrl, { onNotice: () => {} })
+  const controller = new AbortController()
+  const stop = () => controller.abort()
+  process.once('SIGINT', stop)
+  process.once('SIGTERM', stop)
+  try {
+    const [role] = await client.sql`SELECT current_user AS role`
+    if (role?.role !== 'xcs_notifier')
+      throw new Error('The notifier requires the xcs_notifier DB role')
+    const repository = new PostgresNotificationRepository(client)
+    do {
+      const outcome = await processNextNotification(repository, transport, sender, portalOrigin)
+      if (outcome !== 'idle') console.log(`admin-notifier: ${outcome}`)
+      if (args.includes('--once') || controller.signal.aborted) break
+      if (outcome === 'idle') {
+        await delay(2_000, undefined, { signal: controller.signal }).catch((error: unknown) => {
+          if (!controller.signal.aborted) throw error
+        })
+      }
+    } while (!controller.signal.aborted)
+  } finally {
+    process.removeListener('SIGINT', stop)
+    process.removeListener('SIGTERM', stop)
+    transport.close()
+    await client.close()
+  }
+}
+
+main().catch(() => {
+  // Connection/SMTP exceptions may carry credentials, addresses or message content.
+  console.error('admin-notifier: stopped; check private configuration and database availability')
+  process.exitCode = 1
+})
diff --git a/apps/web/server/api/admin/[...path].ts b/apps/web/server/api/admin/[...path].ts
new file mode 100644
index 0000000..7cf73b2
--- /dev/null
+++ b/apps/web/server/api/admin/[...path].ts
@@ -0,0 +1,12 @@
+import { defineEventHandler, setResponseHeader, setResponseStatus, type EventHandler } from 'h3'
+declare module 'h3' {
+  interface H3EventContext {
+    xcsAdmin?: EventHandler
+  }
+}
+export default defineEventHandler((event) => {
+  setResponseHeader(event, 'cache-control', 'private, no-store')
+  if (event.context.xcsAdmin) return event.context.xcsAdmin(event)
+  setResponseStatus(event, 503)
+  return { error: 'ADMIN_UNAVAILABLE' }
+})
diff --git a/apps/web/server/api/auth/[...path].ts b/apps/web/server/api/auth/[...path].ts
new file mode 100644
index 0000000..fd4970f
--- /dev/null
+++ b/apps/web/server/api/auth/[...path].ts
@@ -0,0 +1,17 @@
+import { defineEventHandler, setResponseHeader, setResponseStatus, type EventHandler } from 'h3'
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsAuth?: EventHandler
+  }
+}
+
+export default defineEventHandler((event) => {
+  setResponseHeader(event, 'cache-control', 'private, no-store')
+  if (event.context.xcsAuth) return event.context.xcsAuth(event)
+  if (event.method === 'GET' && event.path.split('?')[0] === '/api/auth/session') {
+    return { enabled: false, user: null }
+  }
+  setResponseStatus(event, 503)
+  return { error: 'AUTH_UNAVAILABLE' }
+})
diff --git a/apps/web/server/api/issuer/[...path].ts b/apps/web/server/api/issuer/[...path].ts
new file mode 100644
index 0000000..a5992e9
--- /dev/null
+++ b/apps/web/server/api/issuer/[...path].ts
@@ -0,0 +1,10 @@
+import { defineEventHandler, createError, type EventHandler } from 'h3'
+declare module 'h3' {
+  interface H3EventContext {
+    xcsIssuer?: EventHandler
+  }
+}
+export default defineEventHandler((event) => {
+  if (!event.context.xcsIssuer) throw createError({ statusCode: 503, message: 'ISSUER_DISABLED' })
+  return event.context.xcsIssuer(event)
+})
diff --git a/apps/web/server/api/presentations/resolve.post.ts b/apps/web/server/api/presentations/resolve.post.ts
new file mode 100644
index 0000000..91b7d91
--- /dev/null
+++ b/apps/web/server/api/presentations/resolve.post.ts
@@ -0,0 +1,7 @@
+import { createError, defineEventHandler } from 'h3'
+
+export default defineEventHandler((event) => {
+  if (!event.context.xcsPresentation)
+    throw createError({ statusCode: 503, message: 'PRESENTATION_DISABLED' })
+  return event.context.xcsPresentation(event)
+})
diff --git a/apps/web/server/api/recipient/[...path].ts b/apps/web/server/api/recipient/[...path].ts
new file mode 100644
index 0000000..289f391
--- /dev/null
+++ b/apps/web/server/api/recipient/[...path].ts
@@ -0,0 +1,7 @@
+import { createError, defineEventHandler } from 'h3'
+
+export default defineEventHandler((event) => {
+  if (!event.context.xcsRecipient)
+    throw createError({ statusCode: 503, message: 'RECIPIENT_DISABLED' })
+  return event.context.xcsRecipient(event)
+})
diff --git a/apps/web/server/api/verifier/[...path].ts b/apps/web/server/api/verifier/[...path].ts
new file mode 100644
index 0000000..21d12e4
--- /dev/null
+++ b/apps/web/server/api/verifier/[...path].ts
@@ -0,0 +1,13 @@
+import { createError, defineEventHandler, type EventHandler } from 'h3'
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsVerifier?: EventHandler
+  }
+}
+
+export default defineEventHandler((event) => {
+  if (!event.context.xcsVerifier)
+    throw createError({ statusCode: 503, message: 'VERIFIER_DISABLED' })
+  return event.context.xcsVerifier(event)
+})
diff --git a/apps/web/server/lib/db/app/bootstrap-admin.ts b/apps/web/server/lib/db/app/bootstrap-admin.ts
new file mode 100644
index 0000000..dd6f98c
--- /dev/null
+++ b/apps/web/server/lib/db/app/bootstrap-admin.ts
@@ -0,0 +1,37 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import type { DatabaseClient } from '../client.js'
+
+/** Explicit one-time operator action. Never invoked by login or migration. */
+export async function bootstrapFirstAdmin(
+  client: DatabaseClient,
+  input: { issuer: string; subject: string; operator: string },
+): Promise<{ userId: string; created: boolean }> {
+  if (
+    !input.issuer.trim() ||
+    !input.subject.trim() ||
+    !input.operator.trim() ||
+    input.operator.length > 200
+  ) {
+    throw new Error('ADMIN_BOOTSTRAP_INPUT_INVALID')
+  }
+  return client.sql.begin(async (sql) => {
+    await sql`SELECT pg_advisory_xact_lock(1480807217, 30)`
+    const [user] = await sql<{ id: string }[]>`SELECT id FROM app_users
+      WHERE identity_issuer = ${input.issuer} AND identity_subject = ${input.subject} AND status = 'active' FOR UPDATE`
+    if (!user) throw new Error('ADMIN_BOOTSTRAP_ACCOUNT_NOT_FOUND')
+    const roles = await sql<
+      { user_id: string; revoked_at: Date | null }[]
+    >`SELECT user_id, revoked_at FROM app_user_roles WHERE role = 'admin' FOR UPDATE`
+    if (roles.some((role) => role.user_id === user.id && role.revoked_at !== null))
+      throw new Error('ADMIN_BOOTSTRAP_REVOKED')
+    if (roles.some((role) => role.user_id !== user.id && role.revoked_at === null))
+      throw new Error('ADMIN_BOOTSTRAP_ALREADY_INITIALIZED')
+    if (roles.some((role) => role.user_id === user.id)) return { userId: user.id, created: false }
+    // Historical bootstrap also prevents using this command to replace a removed administrator.
+    const previous = await sql`SELECT id FROM app_admin_bootstrap_audit LIMIT 1`
+    if (previous.length) throw new Error('ADMIN_BOOTSTRAP_ALREADY_INITIALIZED')
+    await sql`INSERT INTO app_user_roles (user_id, role, granted_by) VALUES (${user.id}, 'admin', ${user.id})`
+    await sql`INSERT INTO app_admin_bootstrap_audit (user_id, operator) VALUES (${user.id}, ${input.operator.trim()})`
+    return { userId: user.id, created: true }
+  })
+}
diff --git a/apps/web/server/lib/db/app/invitations.ts b/apps/web/server/lib/db/app/invitations.ts
new file mode 100644
index 0000000..6210d4a
--- /dev/null
+++ b/apps/web/server/lib/db/app/invitations.ts
@@ -0,0 +1,41 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { and, eq, exists, gt, isNull, sql } from 'drizzle-orm'
+
+import type { XcsDatabase } from '../client.js'
+import { appInvites, appUsers } from '#db/schema/app'
+import { hashAppToken } from './tokens.js'
+
+/** Call only from an authenticated mutation, with userId supplied by the server's session. */
+export async function claimInvitation(db: XcsDatabase, input: { token: string; userId: string }) {
+  const tokenHash = hashAppToken(input.token)
+  if (tokenHash === null) return null
+
+  // One conditional UPDATE is the claim boundary. Statement time, not transaction start,
+  // prevents a caller's long-running transaction from extending the invitation's lifetime.
+  const [claimed] = await db
+    .update(appInvites)
+    .set({ claimedBy: input.userId, claimedAt: sql`statement_timestamp()` })
+    .where(
+      and(
+        eq(appInvites.tokenHash, tokenHash),
+        isNull(appInvites.claimedAt),
+        isNull(appInvites.revokedAt),
+        gt(appInvites.expiresAt, sql`statement_timestamp()`),
+        exists(
+          db
+            .select({ id: appUsers.id })
+            .from(appUsers)
+            .where(and(eq(appUsers.id, input.userId), eq(appUsers.status, 'active'))),
+        ),
+      ),
+    )
+    .returning({
+      id: appInvites.id,
+      organizationId: appInvites.organizationId,
+      profileId: appInvites.profileId,
+      schemaUid: appInvites.schemaUid,
+      claimedBy: appInvites.claimedBy,
+      claimedAt: appInvites.claimedAt,
+    })
+  return claimed ?? null
+}
diff --git a/apps/web/server/lib/db/app/tokens.ts b/apps/web/server/lib/db/app/tokens.ts
new file mode 100644
index 0000000..3505451
--- /dev/null
+++ b/apps/web/server/lib/db/app/tokens.ts
@@ -0,0 +1,13 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { createHash, randomBytes } from 'node:crypto'
+
+/** Bearer secrets stay outside the database; persist only the returned hash. */
+export function createAppToken(): { token: string; tokenHash: string } {
+  const token = randomBytes(32).toString('base64url')
+  return { token, tokenHash: hashAppToken(token)! }
+}
+
+export function hashAppToken(token: string): string | null {
+  if (!/^[A-Za-z0-9_-]{43}$/.test(token)) return null
+  return createHash('sha256').update(token, 'utf8').digest('hex')
+}
diff --git a/apps/web/server/lib/db/app/visibility.ts b/apps/web/server/lib/db/app/visibility.ts
new file mode 100644
index 0000000..2fd7f7b
--- /dev/null
+++ b/apps/web/server/lib/db/app/visibility.ts
@@ -0,0 +1,169 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { and, eq, isNull, sql } from 'drizzle-orm'
+import { alias } from 'drizzle-orm/pg-core'
+
+import type { XcsDatabase } from '../client.js'
+import {
+  appCredentialMetadata,
+  appOrganizationApplications,
+  appOrganizations,
+  appPresentations,
+  appUsers,
+} from '#db/schema/app'
+import { hashAppToken } from './tokens.js'
+
+export interface CredentialAccess {
+  scope: 'public' | 'full'
+  publicFields: string[]
+}
+
+/** All authorization facts are read together, never accepted as request-supplied roles/approvals. */
+export async function getCredentialAccess(
+  db: XcsDatabase,
+  input: {
+    profileId: string
+    generationId: string
+    viewerUserId: string | null
+    presentationToken?: string
+  },
+): Promise<CredentialAccess | null> {
+  const issuer = alias(appOrganizations, 'issuer_organization')
+  const verifier = alias(appOrganizations, 'verifier_organization')
+  const tokenHash =
+    input.presentationToken === undefined ? null : hashAppToken(input.presentationToken)
+
+  const [row] = await db
+    .select({
+      visibility: appCredentialMetadata.visibility,
+      publicFields: appCredentialMetadata.publicFields,
+      viewerId: appUsers.id,
+      recipientUserId: appCredentialMetadata.recipientUserId,
+      issuerResponsibleUserId: issuer.responsibleUserId,
+      issuerStatus: issuer.status,
+      verifierResponsibleUserId: verifier.responsibleUserId,
+      verifierStatus: verifier.status,
+      verifierApproval: appOrganizationApplications.status,
+    })
+    .from(appCredentialMetadata)
+    .leftJoin(
+      appUsers,
+      input.viewerUserId === null
+        ? sql`FALSE`
+        : and(eq(appUsers.id, input.viewerUserId), eq(appUsers.status, 'active')),
+    )
+    .leftJoin(issuer, eq(issuer.id, appCredentialMetadata.issuerOrganizationId))
+    .leftJoin(
+      appPresentations,
+      tokenHash === null
+        ? sql`FALSE`
+        : and(
+            eq(appPresentations.tokenHash, tokenHash),
+            eq(appPresentations.profileId, appCredentialMetadata.profileId),
+            eq(appPresentations.generationId, appCredentialMetadata.generationId),
+            eq(appPresentations.recipientUserId, appCredentialMetadata.recipientUserId),
+            eq(appPresentations.scope, 'full'),
+            isNull(appPresentations.revokedAt),
+          ),
+    )
+    .leftJoin(verifier, eq(verifier.id, appPresentations.verifierOrganizationId))
+    .leftJoin(
+      appOrganizationApplications,
+      and(
+        eq(appOrganizationApplications.organizationId, verifier.id),
+        eq(appOrganizationApplications.role, 'verifier'),
+      ),
+    )
+    .where(
+      and(
+        eq(appCredentialMetadata.profileId, input.profileId),
+        eq(appCredentialMetadata.generationId, input.generationId),
+      ),
+    )
+  if (!row) return null
+
+  const isOwner =
+    row.viewerId !== null &&
+    (row.viewerId === row.recipientUserId ||
+      (row.viewerId === row.issuerResponsibleUserId && row.issuerStatus === 'active'))
+  const isAuthorizedVerifier =
+    row.viewerId !== null &&
+    row.viewerId === row.verifierResponsibleUserId &&
+    row.verifierStatus === 'active' &&
+    row.verifierApproval === 'approved'
+  return {
+    scope: row.visibility === 'public' || isOwner || isAuthorizedVerifier ? 'full' : 'public',
+    publicFields: row.publicFields,
+  }
+}
+
+export type ClaimValue =
+  null | boolean | number | string | ClaimValue[] | { [key: string]: ClaimValue }
+export type Claims = { [key: string]: ClaimValue }
+
+interface Selection {
+  whole: boolean
+  children: Map<string, Selection>
+}
+
+/** RFC 6901 pointers relative to claims. Objects can be narrowed; arrays are atomic fields. */
+export function validatePublicFields(paths: readonly string[]): void {
+  selection(paths)
+}
+
+function selection(paths: readonly string[]): Selection {
+  if (!Array.isArray(paths) || paths.length > 256) throw new Error('INVALID_PUBLIC_FIELDS')
+  const root: Selection = { whole: false, children: new Map() }
+  for (const path of paths) {
+    if (
+      typeof path !== 'string' ||
+      !path.startsWith('/') ||
+      path.length > 1024 ||
+      /~(?![01])/u.test(path)
+    ) {
+      throw new Error('INVALID_PUBLIC_FIELD_PATH')
+    }
+    const parts = path
+      .slice(1)
+      .split('/')
+      .map((part) => part.replaceAll('~1', '/').replaceAll('~0', '~'))
+    if (
+      parts.length > 32 ||
+      parts.some((part) => ['__proto__', 'constructor', 'prototype'].includes(part))
+    ) {
+      throw new Error('INVALID_PUBLIC_FIELD_PATH')
+    }
+    let node = root
+    for (const part of parts) {
+      let child = node.children.get(part)
+      if (!child) {
+        child = { whole: false, children: new Map() }
+        node.children.set(part, child)
+      }
+      node = child
+    }
+    node.whole = true
+  }
+  return root
+}
+
+function project(source: Claims, node: Selection): Claims {
+  const result: Claims = {}
+  for (const [key, child] of node.children) {
+    if (!Object.hasOwn(source, key)) continue
+    const value = source[key]!
+    if (child.whole) {
+      result[key] = structuredClone(value)
+    } else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+      const nested = project(value, child)
+      if (Object.keys(nested).length > 0) result[key] = nested
+    }
+  }
+  return result
+}
+
+/** Return only claims, never spread a private payload envelope into a public response. */
+export function filterCredentialClaims(claims: Claims, access: CredentialAccess): Claims {
+  if (access.scope === 'full') return structuredClone(claims)
+  if (access.scope !== 'public') throw new Error('INVALID_CREDENTIAL_ACCESS')
+  return project(claims, selection(access.publicFields))
+}
diff --git a/apps/web/server/lib/db/bootstrap.ts b/apps/web/server/lib/db/bootstrap.ts
new file mode 100644
index 0000000..a8dbe4d
--- /dev/null
+++ b/apps/web/server/lib/db/bootstrap.ts
@@ -0,0 +1,55 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import type { DatabaseClient } from './client.js'
+import { migrateDatabase, migrateDatabaseInTransaction } from './migrations.js'
+import {
+  applyRuntimeDatabasePrivilegesInTransaction,
+  parseDatabaseClusterScope,
+  prepareRuntimeDatabaseProvisioningInTransaction,
+  type RuntimeDatabaseProvisioning,
+  type RuntimeDatabaseProvisioningReport,
+} from './provision.js'
+
+export {
+  DatabaseBootstrapConfigurationError,
+  MissingRuntimeDatabaseRolesError,
+  UnsafeRuntimeDatabaseRolesError,
+  parseDatabaseClusterScope,
+  provisionRuntimeDatabasePrivileges,
+  XCS_API_DATABASE_CONNECTION_LIMIT,
+  XCS_API_DATABASE_ROLE,
+  XCS_APP_DATABASE_ROLE,
+  XCS_ADMIN_APP_DATABASE_ROLE,
+  XCS_NOTIFIER_DATABASE_ROLE,
+  XCS_ISSUER_DATABASE_ROLE,
+  XCS_PAYLOAD_WRITER_DATABASE_ROLE,
+  XCS_DATABASE_CLUSTER_SCOPE,
+  XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
+  XCS_INDEXER_DATABASE_ROLE,
+  XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
+  XCS_MONITOR_DATABASE_ROLE,
+  XCS_RUNTIME_DATABASE_ROLES,
+  type RuntimeDatabaseProvisioning,
+  type RuntimeDatabaseProvisioningReport,
+  type UnappliedRuntimeRoleResourceControl,
+} from './provision.js'
+
+export async function initializeDatabase(client: DatabaseClient): Promise<void> {
+  await migrateDatabase(client)
+}
+
+export async function bootstrapDatabase(
+  client: DatabaseClient,
+  provisioning: RuntimeDatabaseProvisioning,
+): Promise<RuntimeDatabaseProvisioningReport> {
+  // Reject an invalid acknowledgement before reserving a connection.
+  parseDatabaseClusterScope(provisioning.clusterScope)
+  return await client.sql.begin(async (transaction) => {
+    // DigitalOcean must have created every user before any migration changes state.
+    const administrator = await prepareRuntimeDatabaseProvisioningInTransaction(
+      transaction,
+      provisioning,
+    )
+    await migrateDatabaseInTransaction(transaction)
+    return await applyRuntimeDatabasePrivilegesInTransaction(transaction, administrator)
+  })
+}
diff --git a/apps/web/server/lib/db/client.ts b/apps/web/server/lib/db/client.ts
index bd0a28c..592ae6c 100644
--- a/apps/web/server/lib/db/client.ts
+++ b/apps/web/server/lib/db/client.ts
@@ -1,4 +1,4 @@
-// Copied from packages/db/src/client.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
 import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js'
 import postgres, { type Sql } from 'postgres'
 
@@ -12,7 +12,10 @@ export interface DatabaseClient {
   close: () => Promise<void>
 }
 
-export function createDatabaseClient(databaseUrl: string): DatabaseClient {
+export function createDatabaseClient(
+  databaseUrl: string,
+  options: { onNotice?: () => void } = {},
+): DatabaseClient {
   if (databaseUrl.trim().length === 0) {
     throw new Error('DATABASE_URL must not be empty')
   }
@@ -22,6 +25,7 @@ export function createDatabaseClient(databaseUrl: string): DatabaseClient {
     idle_timeout: 20,
     connect_timeout: 10,
     prepare: false,
+    ...(options.onNotice ? { onnotice: options.onNotice } : {}),
   })
 
   return {
diff --git a/apps/web/server/lib/db/index.ts b/apps/web/server/lib/db/index.ts
new file mode 100644
index 0000000..c18dcc5
--- /dev/null
+++ b/apps/web/server/lib/db/index.ts
@@ -0,0 +1,10 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+export * from './client.js'
+export * from './indexer-fencing.js'
+export * from './transactions.js'
+export * from '#db/schema'
+export * from '#db/schema/app'
+export * from './app/tokens.js'
+export * from './app/invitations.js'
+export * from './app/visibility.js'
+export * from './app/bootstrap-admin.js'
diff --git a/apps/web/server/lib/db/indexer-fencing.ts b/apps/web/server/lib/db/indexer-fencing.ts
new file mode 100644
index 0000000..f7271c7
--- /dev/null
+++ b/apps/web/server/lib/db/indexer-fencing.ts
@@ -0,0 +1,454 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+import { and, eq, gt, isNull, lte, or, sql } from 'drizzle-orm'
+
+import type { XcsDatabase } from './client.js'
+import {
+  INDEXER_STATUS_STATES,
+  indexerIncidents,
+  indexerStatuses,
+  type IndexerStatusRow,
+  type IndexerStatusState,
+} from '#db/schema'
+
+const UINT32_MAX = 4_294_967_295
+const MAX_SAFE_EPOCH = Number.MAX_SAFE_INTEGER
+const HASH_PATTERN = /^[0-9a-f]{64}$/u
+const ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/u
+const PROFILE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,127}$/u
+const WRITER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u
+
+export const MIN_INDEXER_LEASE_DURATION_MS = 10_000
+export const MAX_INDEXER_LEASE_DURATION_MS = 300_000
+
+export interface IndexerLeaseToken {
+  profileId: string
+  writerId: string
+  epoch: number
+}
+
+export interface AcquiredIndexerLease extends IndexerLeaseToken {
+  leaseExpiresAt: Date
+}
+
+export interface AcquireIndexerLeaseInput {
+  profileId: string
+  writerId: string
+  leaseDurationMs: number
+  now?: Date
+}
+
+export interface RenewIndexerLeaseInput {
+  leaseDurationMs: number
+  now?: Date
+}
+
+export interface NormalizedIndexerLeaseRequest {
+  profileId: string
+  writerId: string
+  now: Date
+  leaseExpiresAt: Date
+}
+
+export interface IndexerStatusWriteOptions {
+  now?: Date
+}
+
+export type WritableIndexerStatusState = Exclude<IndexerStatusState, 'halted'>
+
+export interface IndexerStatusUpdateInput {
+  state: WritableIndexerStatusState
+  primarySourceTip?: number | null
+  secondarySourceTip?: number | null
+  lastAgreedLedgerIndex?: number | null
+  lastAgreedLedgerHash?: string | null
+}
+
+export interface HaltIndexerStatusInput {
+  primarySourceTip?: number | null
+  secondarySourceTip?: number | null
+  lastAgreedLedgerIndex?: number | null
+  lastAgreedLedgerHash?: string | null
+}
+
+export interface NormalizedIndexerStatus {
+  state: IndexerStatusState
+  primarySourceTip: number | null
+  secondarySourceTip: number | null
+  lastAgreedLedgerIndex: number | null
+  lastAgreedLedgerHash: string | null
+  errorCode: string | null
+}
+
+export type IndexerLeaseErrorCode = 'INDEXER_LEASE_UNAVAILABLE' | 'INDEXER_LEASE_LOST'
+
+export class IndexerLeaseError extends Error {
+  constructor(readonly code: IndexerLeaseErrorCode) {
+    super(code)
+    this.name = 'IndexerLeaseError'
+  }
+}
+
+function validDate(value: Date | undefined): Date {
+  const date = value ?? new Date()
+  if (!Number.isFinite(date.getTime())) throw new Error('now must be a valid date')
+  return date
+}
+
+function databaseNow(value: Date | undefined) {
+  // clock_timestamp() is evaluated after a blocked row lock is acquired.
+  // CURRENT_TIMESTAMP is frozen at transaction start and could renew a lease
+  // to an instant that already passed while the statement was waiting.
+  return value === undefined ? sql`clock_timestamp()` : validDate(value)
+}
+
+function nullableUint32(value: number | null | undefined, field: string): number | null {
+  if (value === undefined || value === null) return null
+  if (!Number.isInteger(value) || value < 0 || value > UINT32_MAX) {
+    throw new Error(`${field} must be a nullable uint32`)
+  }
+  return value
+}
+
+function sanitizedErrorCode(value: string): string {
+  if (!ERROR_CODE_PATTERN.test(value)) {
+    throw new Error('errorCode must be a sanitized machine code')
+  }
+  return value
+}
+
+function normalizeStatus(
+  input:
+    IndexerStatusUpdateInput | (HaltIndexerStatusInput & { state: 'halted'; errorCode: string }),
+): NormalizedIndexerStatus {
+  if (!INDEXER_STATUS_STATES.includes(input.state)) throw new Error('state is invalid')
+
+  const primarySourceTip = nullableUint32(input.primarySourceTip, 'primarySourceTip')
+  const secondarySourceTip = nullableUint32(input.secondarySourceTip, 'secondarySourceTip')
+  const lastAgreedLedgerIndex = nullableUint32(input.lastAgreedLedgerIndex, 'lastAgreedLedgerIndex')
+  const lastAgreedLedgerHash = input.lastAgreedLedgerHash ?? null
+
+  if ((lastAgreedLedgerIndex === null) !== (lastAgreedLedgerHash === null)) {
+    throw new Error('last agreed ledger index and hash must be provided together')
+  }
+  if (lastAgreedLedgerHash !== null && !HASH_PATTERN.test(lastAgreedLedgerHash)) {
+    throw new Error('lastAgreedLedgerHash must be lowercase 32-byte hexadecimal')
+  }
+
+  if (input.state !== 'halted' && lastAgreedLedgerIndex !== null) {
+    if (primarySourceTip !== null && lastAgreedLedgerIndex > primarySourceTip) {
+      throw new Error('last agreed ledger cannot exceed the primary source tip')
+    }
+    if (secondarySourceTip !== null && lastAgreedLedgerIndex > secondarySourceTip) {
+      throw new Error('last agreed ledger cannot exceed the secondary source tip')
+    }
+  }
+
+  if (input.state === 'ready') {
+    if (
+      primarySourceTip === null ||
+      secondarySourceTip === null ||
+      lastAgreedLedgerIndex === null ||
+      lastAgreedLedgerHash === null
+    ) {
+      throw new Error('ready status requires both source tips and a last agreed ledger')
+    }
+    if (lastAgreedLedgerIndex !== Math.min(primarySourceTip, secondarySourceTip)) {
+      throw new Error('ready status must agree with the effective source tip')
+    }
+  }
+
+  return {
+    state: input.state,
+    primarySourceTip,
+    secondarySourceTip,
+    lastAgreedLedgerIndex,
+    lastAgreedLedgerHash,
+    errorCode: input.state === 'halted' ? sanitizedErrorCode(input.errorCode) : null,
+  }
+}
+
+export function normalizeIndexerStatusUpdate(
+  input: IndexerStatusUpdateInput,
+): NormalizedIndexerStatus {
+  return normalizeStatus(input)
+}
+
+export function normalizeHaltIndexerStatus(
+  input: HaltIndexerStatusInput,
+  errorCode: string,
+): NormalizedIndexerStatus {
+  return normalizeStatus({ ...input, state: 'halted', errorCode })
+}
+
+function normalizeLeaseDuration(leaseDurationMs: number): number {
+  if (
+    !Number.isInteger(leaseDurationMs) ||
+    leaseDurationMs < MIN_INDEXER_LEASE_DURATION_MS ||
+    leaseDurationMs > MAX_INDEXER_LEASE_DURATION_MS
+  ) {
+    throw new Error(
+      `leaseDurationMs must be an integer between ${MIN_INDEXER_LEASE_DURATION_MS} and ${MAX_INDEXER_LEASE_DURATION_MS}`,
+    )
+  }
+  return leaseDurationMs
+}
+
+function normalizeToken(token: IndexerLeaseToken): IndexerLeaseToken {
+  if (!PROFILE_ID_PATTERN.test(token.profileId)) throw new Error('profileId is invalid')
+  if (!WRITER_ID_PATTERN.test(token.writerId)) throw new Error('writerId is invalid')
+  if (!Number.isSafeInteger(token.epoch) || token.epoch < 1 || token.epoch > MAX_SAFE_EPOCH) {
+    throw new Error('epoch must be a positive safe integer')
+  }
+  return token
+}
+
+function leaseExpiration(now: Date, leaseDurationMs: number): Date {
+  const expiresAt = new Date(now.getTime() + normalizeLeaseDuration(leaseDurationMs))
+  if (!Number.isFinite(expiresAt.getTime())) throw new Error('lease expiration is invalid')
+  return expiresAt
+}
+
+function databaseLeaseExpiration(value: Date | undefined, leaseDurationMs: number) {
+  return value === undefined
+    ? sql`clock_timestamp() + (${leaseDurationMs}::bigint * interval '1 millisecond')`
+    : leaseExpiration(validDate(value), leaseDurationMs)
+}
+
+export function normalizeIndexerLeaseRequest(
+  input: AcquireIndexerLeaseInput,
+): NormalizedIndexerLeaseRequest {
+  const token = normalizeToken({ profileId: input.profileId, writerId: input.writerId, epoch: 1 })
+  const now = validDate(input.now)
+  return {
+    profileId: token.profileId,
+    writerId: token.writerId,
+    now,
+    leaseExpiresAt: leaseExpiration(now, input.leaseDurationMs),
+  }
+}
+
+function acquiredLease(row: IndexerStatusRow): AcquiredIndexerLease {
+  if (row.writerId === null || row.leaseExpiresAt === null) {
+    throw new Error('indexer lease write returned an inactive lease')
+  }
+  return {
+    profileId: row.profileId,
+    writerId: row.writerId,
+    epoch: row.writerEpoch,
+    leaseExpiresAt: row.leaseExpiresAt,
+  }
+}
+
+function tokenFilter(token: IndexerLeaseToken) {
+  return and(
+    eq(indexerStatuses.profileId, token.profileId),
+    eq(indexerStatuses.writerId, token.writerId),
+    eq(indexerStatuses.writerEpoch, token.epoch),
+  )
+}
+
+function activeTokenFilter(token: IndexerLeaseToken, now: ReturnType<typeof databaseNow>) {
+  return and(tokenFilter(token), gt(indexerStatuses.leaseExpiresAt, now))
+}
+
+export async function readIndexerStatus(
+  database: XcsDatabase,
+  profileId: string,
+): Promise<IndexerStatusRow | undefined> {
+  const [row] = await database
+    .select()
+    .from(indexerStatuses)
+    .where(eq(indexerStatuses.profileId, profileId))
+    .limit(1)
+  return row
+}
+
+export async function acquireIndexerLease(
+  database: XcsDatabase,
+  input: AcquireIndexerLeaseInput,
+): Promise<AcquiredIndexerLease> {
+  const lease = normalizeIndexerLeaseRequest(input)
+  return database.transaction(async (transaction) => {
+    const tx = transaction as unknown as XcsDatabase
+    const [inserted] = await tx
+      .insert(indexerStatuses)
+      .values({
+        profileId: lease.profileId,
+        state: 'starting',
+        primarySourceTip: null,
+        secondarySourceTip: null,
+        lastAgreedLedgerIndex: null,
+        lastAgreedLedgerHash: null,
+        errorCode: null,
+        writerId: null,
+        writerEpoch: 1,
+        leaseExpiresAt: null,
+        updatedAt: databaseNow(input.now),
+      })
+      .onConflictDoNothing()
+      .returning({ profileId: indexerStatuses.profileId })
+
+    // A separate locked read makes every clock expression in the following
+    // UPDATE run after conflict/row-lock waits, never before them.
+    await tx
+      .select({ profileId: indexerStatuses.profileId })
+      .from(indexerStatuses)
+      .where(eq(indexerStatuses.profileId, lease.profileId))
+      .for('update')
+      .limit(1)
+
+    const now = databaseNow(input.now)
+    const [row] = await tx
+      .update(indexerStatuses)
+      .set({
+        state: 'starting',
+        primarySourceTip: null,
+        secondarySourceTip: null,
+        lastAgreedLedgerIndex: null,
+        lastAgreedLedgerHash: null,
+        errorCode: null,
+        writerId: lease.writerId,
+        writerEpoch:
+          inserted === undefined
+            ? sql`${indexerStatuses.writerEpoch} + 1`
+            : indexerStatuses.writerEpoch,
+        leaseExpiresAt: databaseLeaseExpiration(input.now, input.leaseDurationMs),
+        updatedAt: now,
+      })
+      .where(
+        inserted === undefined
+          ? and(
+              eq(indexerStatuses.profileId, lease.profileId),
+              or(isNull(indexerStatuses.leaseExpiresAt), lte(indexerStatuses.leaseExpiresAt, now)),
+              lte(indexerStatuses.writerEpoch, MAX_SAFE_EPOCH - 1),
+            )
+          : eq(indexerStatuses.profileId, lease.profileId),
+      )
+      .returning()
+    if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_UNAVAILABLE')
+    return acquiredLease(row)
+  })
+}
+
+export async function renewIndexerLease(
+  database: XcsDatabase,
+  tokenInput: IndexerLeaseToken,
+  input: RenewIndexerLeaseInput,
+): Promise<AcquiredIndexerLease> {
+  const token = normalizeToken(tokenInput)
+  normalizeLeaseDuration(input.leaseDurationMs)
+  return database.transaction(async (transaction) => {
+    const tx = transaction as unknown as XcsDatabase
+    await tx
+      .select({ profileId: indexerStatuses.profileId })
+      .from(indexerStatuses)
+      .where(tokenFilter(token))
+      .for('update')
+      .limit(1)
+
+    const now = databaseNow(input.now)
+    const [row] = await tx
+      .update(indexerStatuses)
+      .set({
+        leaseExpiresAt: databaseLeaseExpiration(input.now, input.leaseDurationMs),
+        updatedAt: now,
+      })
+      .where(activeTokenFilter(token, now))
+      .returning()
+    if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_LOST')
+    return acquiredLease(row)
+  })
+}
+
+export async function updateIndexerStatus(
+  database: XcsDatabase,
+  tokenInput: IndexerLeaseToken,
+  input: IndexerStatusUpdateInput,
+  options: IndexerStatusWriteOptions = {},
+): Promise<IndexerStatusRow> {
+  const token = normalizeToken(tokenInput)
+  const value = normalizeIndexerStatusUpdate(input)
+  const now = databaseNow(options.now)
+  const [row] = await database
+    .update(indexerStatuses)
+    .set({ ...value, updatedAt: now })
+    .where(activeTokenFilter(token, now))
+    .returning()
+  if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_LOST')
+  return row
+}
+
+export async function releaseIndexerLease(
+  database: XcsDatabase,
+  tokenInput: IndexerLeaseToken,
+  options: IndexerStatusWriteOptions = {},
+): Promise<IndexerStatusRow> {
+  const token = normalizeToken(tokenInput)
+  const now = databaseNow(options.now)
+  const [row] = await database
+    .update(indexerStatuses)
+    .set({
+      state: 'catching_up',
+      errorCode: null,
+      writerId: null,
+      leaseExpiresAt: null,
+      updatedAt: now,
+    })
+    .where(tokenFilter(token))
+    .returning()
+  if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_LOST')
+  return row
+}
+
+export async function haltIndexer(
+  database: XcsDatabase,
+  tokenInput: IndexerLeaseToken,
+  input: HaltIndexerStatusInput,
+  errorCode: string,
+  options: IndexerStatusWriteOptions = {},
+): Promise<IndexerStatusRow> {
+  const token = normalizeToken(tokenInput)
+  const value = normalizeHaltIndexerStatus(input, errorCode)
+  const now = databaseNow(options.now)
+  return database.transaction(async (transaction) => {
+    const tx = transaction as unknown as XcsDatabase
+    const [row] = await tx
+      .update(indexerStatuses)
+      .set({ ...value, writerId: null, leaseExpiresAt: null, updatedAt: now })
+      .where(tokenFilter(token))
+      .returning()
+    if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_LOST')
+
+    await tx.insert(indexerIncidents).values({
+      profileId: token.profileId,
+      writerEpoch: token.epoch,
+      errorCode: value.errorCode!,
+      primarySourceTip: value.primarySourceTip,
+      secondarySourceTip: value.secondarySourceTip,
+      lastAgreedLedgerIndex: value.lastAgreedLedgerIndex,
+      lastAgreedLedgerHash: value.lastAgreedLedgerHash,
+      recordedAt: now,
+    })
+    return row
+  })
+}
+
+/**
+ * Locks and validates the fencing row. Call this inside the same transaction
+ * that persists a ledger so a lease takeover cannot race the projection write.
+ */
+export async function lockActiveIndexerLease(
+  database: XcsDatabase,
+  tokenInput: IndexerLeaseToken,
+  options: IndexerStatusWriteOptions = {},
+): Promise<IndexerStatusRow> {
+  const token = normalizeToken(tokenInput)
+  const [row] = await database
+    .select()
+    .from(indexerStatuses)
+    .where(activeTokenFilter(token, databaseNow(options.now)))
+    .for('update')
+    .limit(1)
+  if (row === undefined) throw new IndexerLeaseError('INDEXER_LEASE_LOST')
+  return row
+}
diff --git a/apps/web/server/lib/db/migrations.ts b/apps/web/server/lib/db/migrations.ts
new file mode 100644
index 0000000..ea631a4
--- /dev/null
+++ b/apps/web/server/lib/db/migrations.ts
@@ -0,0 +1,160 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+// Diverges by design (shared db/migrations location and XCS_MIGRATIONS_DIR deployment override); source sha256:42c7d5380bba58dcfc4414b033d5e9c028d5dc93bec2ddce6db860d43cb1abae.
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { readMigrationFiles } from 'drizzle-orm/migrator'
+import type { Sql, TransactionSql } from 'postgres'
+
+import type { DatabaseClient } from './client.js'
+
+const DEFAULT_MIGRATIONS_FOLDERS = [
+  fileURLToPath(new URL('../../../../../db/migrations', import.meta.url)),
+  fileURLToPath(new URL('../../../db/migrations', import.meta.url)),
+]
+
+export function migrationsFolder(): string {
+  return (
+    process.env.XCS_MIGRATIONS_DIR?.trim() ||
+    DEFAULT_MIGRATIONS_FOLDERS.find((folder) => existsSync(join(folder, 'meta/_journal.json'))) ||
+    DEFAULT_MIGRATIONS_FOLDERS[0]!
+  )
+}
+
+export const DATABASE_MIGRATIONS_FOLDER = migrationsFolder()
+const LOCK_CLASS = 1_480_807_217
+const LOCK_OBJECT = 2
+
+export interface MigrationStatus {
+  applied: string[]
+  pending: string[]
+}
+
+interface MigrationEntry {
+  tag: string
+  when: number
+  hash: string
+  statements: string[]
+}
+
+function readCatalog(folder: string): MigrationEntry[] {
+  const journal = JSON.parse(readFileSync(join(folder, 'meta/_journal.json'), 'utf8')) as {
+    dialect?: unknown
+    entries?: Array<{ idx?: unknown; tag?: unknown; when?: unknown }>
+  }
+  if (
+    journal.dialect !== 'postgresql' ||
+    !Array.isArray(journal.entries) ||
+    journal.entries.length === 0
+  ) {
+    throw new Error('DATABASE_MIGRATION_CATALOG_INVALID')
+  }
+  const tags = new Set<string>()
+  let previous = 0
+  for (const [index, entry] of journal.entries.entries()) {
+    if (
+      entry.idx !== index ||
+      typeof entry.tag !== 'string' ||
+      !/^\d{4}_[a-zA-Z0-9_-]+$/.test(entry.tag) ||
+      tags.has(entry.tag) ||
+      typeof entry.when !== 'number' ||
+      !Number.isSafeInteger(entry.when) ||
+      entry.when <= previous
+    ) {
+      throw new Error('DATABASE_MIGRATION_CATALOG_INVALID')
+    }
+    tags.add(entry.tag)
+    previous = entry.when
+  }
+  const migrations = readMigrationFiles({ migrationsFolder: folder })
+  return migrations.map((migration, index) => ({
+    tag: journal.entries![index]!.tag as string,
+    when: migration.folderMillis,
+    hash: migration.hash,
+    statements: migration.sql,
+  }))
+}
+
+async function status(
+  sql: Sql | TransactionSql,
+  catalog: MigrationEntry[],
+): Promise<MigrationStatus> {
+  const [table] = await sql<{ exists: boolean }[]>`
+    SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS exists
+  `
+  // Inspection of an empty database must not create the Drizzle schema or journal.
+  const applied = table?.exists
+    ? await sql<{ hash: string; created_at: string | number | null }[]>`
+        SELECT hash, created_at FROM drizzle.__drizzle_migrations ORDER BY created_at, id
+      `
+    : []
+  if (
+    applied.length > catalog.length ||
+    applied.some((row, index) => {
+      const expected = catalog[index]!
+      return row.hash !== expected.hash || String(row.created_at) !== String(expected.when)
+    })
+  ) {
+    throw new Error('DATABASE_MIGRATION_HISTORY_MISMATCH')
+  }
+  return {
+    applied: catalog.slice(0, applied.length).map((entry) => entry.tag),
+    pending: catalog.slice(applied.length).map((entry) => entry.tag),
+  }
+}
+
+export async function databaseMigrationStatus(
+  client: DatabaseClient,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  return status(client.sql, readCatalog(migrationsFolder))
+}
+
+/** Applies the existing Drizzle journal without rotating passwords or widening runtime grants. */
+export async function migrateDatabase(
+  client: DatabaseClient,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  const catalog = readCatalog(migrationsFolder)
+  return client.sql.begin((transaction) => migrateCatalogInTransaction(transaction, catalog))
+}
+
+async function migrateCatalogInTransaction(
+  transaction: TransactionSql,
+  catalog: MigrationEntry[],
+): Promise<MigrationStatus> {
+  // The stock migrator reads history before its transaction. Read, validate and apply on
+  // one locked transaction instead, retaining Drizzle's SQL reader and exact journal format.
+  const [lock] = await transaction<{ locked: boolean }[]>`
+    SELECT pg_try_advisory_xact_lock(${LOCK_CLASS}, ${LOCK_OBJECT}) AS locked
+  `
+  if (!lock?.locked) throw new Error('DATABASE_MIGRATION_BUSY')
+  const before = await status(transaction, catalog)
+  if (before.pending.length === 0) return before
+  await transaction`CREATE SCHEMA IF NOT EXISTS drizzle`
+  await transaction`
+    CREATE TABLE IF NOT EXISTS drizzle.__drizzle_migrations (
+      id SERIAL PRIMARY KEY,
+      hash text NOT NULL,
+      created_at bigint
+    )
+  `
+  for (const migration of catalog.slice(before.applied.length)) {
+    // These are reviewed local migration artifacts, never request-supplied SQL.
+    for (const statement of migration.statements) await transaction.unsafe(statement)
+    await transaction`
+      INSERT INTO drizzle.__drizzle_migrations (hash, created_at)
+      VALUES (${migration.hash}, ${migration.when})
+    `
+  }
+  return status(transaction, catalog)
+}
+
+/** Applies migrations inside a caller-owned transaction, allowing an atomic bootstrap. */
+export async function migrateDatabaseInTransaction(
+  transaction: TransactionSql,
+  migrationsFolder = DATABASE_MIGRATIONS_FOLDER,
+): Promise<MigrationStatus> {
+  return migrateCatalogInTransaction(transaction, readCatalog(migrationsFolder))
+}
diff --git a/apps/web/server/lib/db/provision.ts b/apps/web/server/lib/db/provision.ts
new file mode 100644
index 0000000..3266cd6
--- /dev/null
+++ b/apps/web/server/lib/db/provision.ts
@@ -0,0 +1,555 @@
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+// Provisioning is grants-only: DigitalOcean owns runtime users and passwords.
+import type { TransactionSql } from 'postgres'
+
+import type { DatabaseClient } from './client.js'
+
+export const XCS_INDEXER_DATABASE_ROLE = 'xcs_indexer' as const
+export const XCS_API_DATABASE_ROLE = 'xcs_api' as const
+export const XCS_PAYLOAD_WRITER_DATABASE_ROLE = 'xcs_payload_writer' as const
+export const XCS_MONITOR_DATABASE_ROLE = 'xcs_monitor' as const
+export const XCS_APP_DATABASE_ROLE = 'xcs_app' as const
+export const XCS_ADMIN_APP_DATABASE_ROLE = 'xcs_admin_app' as const
+export const XCS_NOTIFIER_DATABASE_ROLE = 'xcs_notifier' as const
+export const XCS_ISSUER_DATABASE_ROLE = 'xcs_issuer' as const
+export const XCS_DATABASE_CLUSTER_SCOPE = 'dedicated' as const
+
+const PROVISION_LOCK_CLASS_ID = 1_480_807_217
+const PROVISION_LOCK_OBJECT_ID = 1
+
+export const XCS_RUNTIME_DATABASE_ROLES = [
+  XCS_INDEXER_DATABASE_ROLE,
+  XCS_API_DATABASE_ROLE,
+  XCS_PAYLOAD_WRITER_DATABASE_ROLE,
+  XCS_MONITOR_DATABASE_ROLE,
+  XCS_APP_DATABASE_ROLE,
+  XCS_ADMIN_APP_DATABASE_ROLE,
+  XCS_NOTIFIER_DATABASE_ROLE,
+  XCS_ISSUER_DATABASE_ROLE,
+] as const
+
+export const XCS_INDEXER_DATABASE_CONNECTION_LIMIT = 12
+export const XCS_API_DATABASE_CONNECTION_LIMIT = 12
+export const XCS_MONITOR_DATABASE_CONNECTION_LIMIT = 3
+
+export interface RuntimeDatabaseProvisioning {
+  clusterScope: typeof XCS_DATABASE_CLUSTER_SCOPE
+}
+
+export function parseDatabaseClusterScope(
+  value: string | undefined,
+): typeof XCS_DATABASE_CLUSTER_SCOPE {
+  if (value !== XCS_DATABASE_CLUSTER_SCOPE) {
+    throw new DatabaseBootstrapConfigurationError(
+      `XCS_DATABASE_CLUSTER_SCOPE must be ${XCS_DATABASE_CLUSTER_SCOPE}; runtime roles are cluster-wide`,
+    )
+  }
+  return XCS_DATABASE_CLUSTER_SCOPE
+}
+
+/** An operator configuration mistake: a missing or invalid environment value.
+ * It is built from names and fixed text only, never from a connection string,
+ * so the CLI can print its message without leaking a credential. */
+export class DatabaseBootstrapConfigurationError extends Error {
+  readonly code = 'DATABASE_BOOTSTRAP_CONFIGURATION' as const
+
+  constructor(message: string) {
+    super(message)
+    this.name = 'DatabaseBootstrapConfigurationError'
+  }
+}
+
+/** The managed database service creates the users and holds their passwords; this
+ * step only assigns privileges, so a role it cannot find is an operator error.
+ * It names the missing roles and carries no credential, so the CLI can print it. */
+export class MissingRuntimeDatabaseRolesError extends Error {
+  readonly code = 'DATABASE_ROLES_MISSING' as const
+  readonly roles: readonly string[]
+
+  constructor(missing: readonly string[]) {
+    const names = missing.join(', ')
+    super(
+      `Database ${missing.length === 1 ? 'role' : 'roles'} ${names} ` +
+        `${missing.length === 1 ? 'does' : 'do'} not exist. Database users are owned by the ` +
+        'managed database service, not by this step: create ' +
+        `${names} in the DigitalOcean control panel (Databases -> the cluster -> Users) or with ` +
+        '`doctl databases user create`, then run the grants step again. This step never creates ' +
+        'a role and never sets, resets or reads a role password.',
+    )
+    this.name = 'MissingRuntimeDatabaseRolesError'
+    this.roles = missing
+  }
+}
+
+/** A runtime role the managed database service has configured in a way this
+ * deployment must not run against: it cannot log in, or it holds an attribute
+ * that would defeat least privilege. Provisioning does not own role attributes
+ * -- altering them requires a superuser, which a managed cluster's
+ * administrator is not -- so it verifies them and refuses to continue.
+ * It names roles and findings only, never a credential, so the CLI can print it. */
+export class UnsafeRuntimeDatabaseRolesError extends Error {
+  readonly code = 'DATABASE_ROLES_UNSAFE' as const
+  readonly roles: readonly string[]
+  readonly findings: readonly string[]
+
+  constructor(findings: readonly string[], roles: readonly string[]) {
+    super(
+      `Database ${roles.length === 1 ? 'role' : 'roles'} ${roles.join(', ')} ` +
+        `${roles.length === 1 ? 'is' : 'are'} not configured safely for least-privilege ` +
+        `runtime access: ${findings.join('; ')}. Role attributes and role memberships belong to ` +
+        'the managed database service, not to this step: a managed cluster administrator is not a ' +
+        'superuser and cannot change them. Fix them in the DigitalOcean control panel ' +
+        '(Databases -> the cluster -> Users) or with `doctl databases user` and run the grants ' +
+        'step again. This step never creates a role and never sets, resets or reads a role password.',
+    )
+    this.name = 'UnsafeRuntimeDatabaseRolesError'
+    this.roles = roles
+    this.findings = findings
+  }
+}
+
+/** Per-role resource and safety controls. These are not security attributes:
+ * a non-superuser administrator holding CREATEROLE and ADMIN OPTION on the
+ * role may set them (verified against PostgreSQL 16 and 17), so provisioning
+ * still applies them -- one statement each, outside the grants, so a cluster
+ * that refuses one cannot cost the deployment its privileges. */
+interface RuntimeRoleResourceControls {
+  readonly connectionLimit: number
+  readonly settings: Readonly<Record<string, string>>
+}
+
+const XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS: Readonly<
+  Record<(typeof XCS_RUNTIME_DATABASE_ROLES)[number], RuntimeRoleResourceControls>
+> = {
+  xcs_indexer: {
+    connectionLimit: XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '5min',
+      lock_timeout: '30s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_api: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_payload_writer: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_monitor: {
+    connectionLimit: XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '10s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_app: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_admin_app: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_notifier: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+  xcs_issuer: {
+    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
+    settings: {
+      statement_timeout: '30s',
+      lock_timeout: '15s',
+      idle_in_transaction_session_timeout: '30s',
+    },
+  },
+}
+
+/** A resource control the cluster refused and that is not already in effect.
+ * Reported rather than thrown: the privilege grants are the point of this step
+ * and must not be lost to a missing timeout, but a deployment must never
+ * quietly lose one either. */
+export interface UnappliedRuntimeRoleResourceControl {
+  readonly role: string
+  readonly control: string
+  readonly intended: string
+  readonly actual: string
+}
+
+export interface RuntimeDatabaseProvisioningReport {
+  /** The cluster administrator this run authenticated as, read from the live
+   * session. Its membership in the runtime roles is how a managed service
+   * administers its own users and is accepted, not revoked. */
+  readonly administrator: string
+  readonly unappliedResourceControls: readonly UnappliedRuntimeRoleResourceControl[]
+}
+
+interface RuntimeRoleAttributes {
+  roleName: string
+  canLogin: boolean
+  isSuperuser: boolean
+  canCreateDatabase: boolean
+  canCreateRole: boolean
+  canReplicate: boolean
+  canBypassRls: boolean
+  connectionLimit: number
+  configuration: string[] | null
+}
+
+const UNSAFE_ROLE_ATTRIBUTES = [
+  ['isSuperuser', 'is a superuser'],
+  ['canCreateDatabase', 'can create databases'],
+  ['canCreateRole', 'can create roles'],
+  ['canReplicate', 'can replicate'],
+  ['canBypassRls', 'can bypass row-level security'],
+] as const
+
+function unsafeRoleAttributeFindings(roles: readonly RuntimeRoleAttributes[]): string[] {
+  const findings: string[] = []
+  for (const role of roles) {
+    const reasons: string[] = []
+    if (!role.canLogin) reasons.push('cannot log in')
+    for (const [attribute, reason] of UNSAFE_ROLE_ATTRIBUTES) {
+      if (role[attribute]) reasons.push(reason)
+    }
+    if (reasons.length > 0) findings.push(`${role.roleName} ${reasons.join(' and ')}`)
+  }
+  return findings
+}
+
+interface RuntimeRoleMembership {
+  grantedRole: string
+  memberRole: string
+}
+
+function unsafeRoleMembershipFindings(
+  memberships: readonly RuntimeRoleMembership[],
+  administrator: string,
+): string[] {
+  const runtimeRoles = new Set<string>(XCS_RUNTIME_DATABASE_ROLES)
+  const findings: string[] = []
+  for (const { grantedRole, memberRole } of memberships) {
+    // The one membership this deployment grants itself.
+    if (grantedRole === 'pg_monitor' && memberRole === XCS_MONITOR_DATABASE_ROLE) continue
+    // The cluster administrator is a member of every user the managed service
+    // creates for it, granted by the platform's own superuser. That is how the
+    // service administers those users; it is not ours to remove.
+    if (memberRole === administrator && runtimeRoles.has(grantedRole)) continue
+    if (runtimeRoles.has(memberRole)) {
+      findings.push(`${memberRole} is a member of ${grantedRole}`)
+    } else {
+      findings.push(
+        `${memberRole} is a member of ${grantedRole} but is not the cluster administrator`,
+      )
+    }
+  }
+  return findings
+}
+
+function unsafeRoleNames(findings: readonly string[]): string[] {
+  const named = XCS_RUNTIME_DATABASE_ROLES.filter((role) =>
+    findings.some((finding) => finding.includes(role)),
+  )
+  return named.length > 0 ? [...named] : [...XCS_RUNTIME_DATABASE_ROLES]
+}
+
+const REVOKE_CURRENT_DATABASE_ACCESS_SQL = `
+  REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer;
+  REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+  DO $xcs_database_grants$
+  BEGIN
+    EXECUTE format('REVOKE ALL PRIVILEGES ON DATABASE %I FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', current_database());
+    EXECUTE format('GRANT CONNECT ON DATABASE %I TO xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', current_database());
+  END
+  $xcs_database_grants$;
+`
+
+// Table-level REVOKE does not remove column grants. Normalize every runtime role
+// so a previous release cannot retain broader column-level privileges.
+const REVOKE_RUNTIME_COLUMNS_SQL = `
+  DO $xcs_app_columns$
+  DECLARE relation record;
+  BEGIN
+    FOR relation IN
+      SELECT table_name, string_agg(format('%I', column_name), ', ' ORDER BY ordinal_position) AS columns
+      FROM information_schema.columns WHERE table_schema = 'public' GROUP BY table_name
+    LOOP
+      EXECUTE format('REVOKE SELECT (%2$s), INSERT (%2$s), UPDATE (%2$s), REFERENCES (%2$s) ON TABLE public.%1$I FROM xcs_indexer, xcs_api, xcs_monitor, xcs_payload_writer, xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer', relation.table_name, relation.columns);
+    END LOOP;
+  END
+  $xcs_app_columns$;
+`
+
+const GRANT_APPLICATION_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_app;
+  GRANT SELECT ON TABLE app_users, app_user_roles, app_wallets TO xcs_app;
+  GRANT SELECT (id, responsible_user_id, name, status) ON TABLE app_organizations TO xcs_app;
+  GRANT SELECT (organization_id, role, status) ON TABLE app_organization_applications TO xcs_app;
+  GRANT INSERT (identity_issuer, identity_subject, email, email_verified_at, display_name) ON TABLE app_users TO xcs_app;
+  GRANT UPDATE (email, email_verified_at, display_name) ON TABLE app_users TO xcs_app;
+  GRANT INSERT (user_id) ON TABLE app_user_roles TO xcs_app;
+  GRANT INSERT (user_id, network_id, address, verified_at) ON TABLE app_wallets TO xcs_app;
+  GRANT UPDATE (verified_at, revoked_at) ON TABLE app_wallets TO xcs_app;
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE app_sessions, app_auth_transactions, app_wallet_challenges TO xcs_app;
+`
+
+// The portal administrator pool is separate from the bootstrap superuser xcs_admin.
+const GRANT_ADMIN_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_admin_app;
+  GRANT SELECT (id, email, email_verified_at, display_name, status) ON app_users TO xcs_admin_app;
+  GRANT SELECT ON app_user_roles, app_sessions, app_organizations, app_organization_applications, app_documents, app_wallets TO xcs_admin_app;
+  GRANT SELECT, INSERT ON app_admin_decisions, app_admin_notifications TO xcs_admin_app;
+  GRANT UPDATE (status, reviewed_by, reviewed_at, review_reason, revision) ON app_organization_applications TO xcs_admin_app;
+  GRANT UPDATE (status, recipient_email, attempt_id, claimed_at, error_code) ON app_admin_notifications TO xcs_admin_app;
+`
+const GRANT_NOTIFIER_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_notifier;
+  GRANT SELECT ON app_admin_notifications, app_admin_decisions TO xcs_notifier;
+  GRANT SELECT (id, name) ON app_organizations TO xcs_notifier;
+  GRANT SELECT (id, email, email_verified_at, status) ON app_users TO xcs_notifier;
+  GRANT UPDATE (status, attempts, attempt_id, claimed_at, sent_at, error_code, recipient_email) ON app_admin_notifications TO xcs_notifier;
+`
+
+const GRANT_ISSUER_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_issuer;
+  GRANT SELECT (id, email, email_verified_at, display_name, status) ON app_users TO xcs_issuer;
+  GRANT SELECT ON app_sessions, app_wallets, app_organizations, app_organization_applications,
+    app_schema_metadata, app_invites, app_credential_metadata, app_issuer_payloads,
+    app_invite_deliveries, app_presentations, network_profiles, schemas, schema_events,
+    credential_generations, credential_events, ledger_checkpoints, indexer_status, app_verifier_history, app_presentation_challenges, app_presentation_proofs TO xcs_issuer;
+  GRANT INSERT (id, responsible_user_id, name) ON app_organizations TO xcs_issuer;
+  GRANT INSERT (organization_id, role, website, contact, jurisdiction, description, purpose) ON app_organization_applications TO xcs_issuer;
+  GRANT INSERT (id, organization_id, application_role, storage_key, mime_type, byte_length, sha256, uploaded_by) ON app_documents TO xcs_issuer;
+  GRANT INSERT ON app_schema_metadata, app_invites, app_credential_metadata, app_issuer_payloads, app_invite_deliveries TO xcs_issuer;
+  GRANT UPDATE (token_hash, expires_at, revoked_at, claimed_by, claimed_at) ON app_invites TO xcs_issuer;
+  GRANT UPDATE (status, error_code) ON app_invite_deliveries TO xcs_issuer;
+  GRANT INSERT ON app_presentations, app_verifier_history, app_presentation_challenges, app_presentation_proofs TO xcs_issuer;
+  GRANT DELETE ON app_presentation_challenges TO xcs_issuer;
+  GRANT UPDATE (revoked_at) ON app_presentations TO xcs_issuer;
+`
+
+const GRANT_RUNTIME_ACCESS_SQL = `
+  GRANT USAGE ON SCHEMA public TO xcs_indexer, xcs_api, xcs_payload_writer;
+
+  GRANT SELECT, INSERT ON TABLE
+    network_profiles, ledger_checkpoints, schema_events, schemas, credential_events
+  TO xcs_indexer;
+  GRANT SELECT, INSERT ON TABLE indexer_status, credential_generations TO xcs_indexer;
+  GRANT UPDATE (
+    state, primary_source_tip, secondary_source_tip, last_agreed_ledger_index,
+    last_agreed_ledger_hash, error_code, writer_id, writer_epoch, lease_expires_at, updated_at
+  ) ON TABLE indexer_status TO xcs_indexer;
+  GRANT UPDATE (
+    accepted, last_ledger_index, deleted_ledger_index, deletion_cause, updated_at
+  ) ON TABLE credential_generations TO xcs_indexer;
+  GRANT SELECT, INSERT ON TABLE indexer_incidents TO xcs_indexer;
+
+  GRANT SELECT ON TABLE
+    network_profiles, ledger_checkpoints, indexer_status, indexer_incidents,
+    schema_events, schemas, credential_generations, credential_events
+  TO xcs_api;
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE pin_challenges, demo_pins TO xcs_payload_writer;
+  GRANT SELECT, INSERT ON TABLE hosted_payloads, hosted_payload_publications TO xcs_payload_writer;
+`
+
+const RUNTIME_ROLE_ATTRIBUTES_SQL = `
+  SELECT
+    rolname AS "roleName",
+    rolcanlogin AS "canLogin",
+    rolsuper AS "isSuperuser",
+    rolcreatedb AS "canCreateDatabase",
+    rolcreaterole AS "canCreateRole",
+    rolreplication AS "canReplicate",
+    rolbypassrls AS "canBypassRls",
+    rolconnlimit AS "connectionLimit",
+    rolconfig AS "configuration"
+  FROM pg_roles
+  WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
+  ORDER BY rolname
+`
+
+const RUNTIME_ROLE_MEMBERSHIPS_SQL = `
+  SELECT granted_role.rolname AS "grantedRole", member_role.rolname AS "memberRole"
+  FROM pg_auth_members auth_membership
+  JOIN pg_roles granted_role ON granted_role.oid = auth_membership.roleid
+  JOIN pg_roles member_role ON member_role.oid = auth_membership.member
+  WHERE granted_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
+     OR member_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_payload_writer', 'xcs_monitor', 'xcs_app', 'xcs_admin_app', 'xcs_notifier', 'xcs_issuer')
+  ORDER BY granted_role.rolname, member_role.rolname
+`
+
+function settingOf(configuration: readonly string[] | null, name: string): string | undefined {
+  const prefix = `${name}=`
+  const entry = configuration?.find((candidate) => candidate.startsWith(prefix))
+  return entry === undefined ? undefined : entry.slice(prefix.length)
+}
+
+export async function prepareRuntimeDatabaseProvisioningInTransaction(
+  sql: TransactionSql,
+  provisioning: RuntimeDatabaseProvisioning,
+): Promise<string> {
+  parseDatabaseClusterScope(provisioning.clusterScope)
+  await sql`SELECT pg_advisory_xact_lock(${PROVISION_LOCK_CLASS_ID}, ${PROVISION_LOCK_OBJECT_ID})`
+
+  const [session] = await sql<{ administrator: string }[]>`
+    SELECT current_user AS "administrator"
+  `
+  const administrator = session?.administrator
+  if (administrator === undefined) {
+    throw new DatabaseBootstrapConfigurationError(
+      'The database session reported no current user, so the cluster administrator could not ' +
+        'be identified. Provisioning verifies role memberships against it and cannot continue.',
+    )
+  }
+
+  const present = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
+  const found = new Set(present.map((row) => row.roleName))
+  const missing = XCS_RUNTIME_DATABASE_ROLES.filter((role) => !found.has(role))
+  if (missing.length > 0) throw new MissingRuntimeDatabaseRolesError(missing)
+
+  const memberships = await sql.unsafe<RuntimeRoleMembership[]>(RUNTIME_ROLE_MEMBERSHIPS_SQL)
+  const findings = [
+    ...unsafeRoleAttributeFindings(present),
+    ...unsafeRoleMembershipFindings(memberships, administrator),
+  ]
+  if (findings.length > 0) {
+    throw new UnsafeRuntimeDatabaseRolesError(findings, unsafeRoleNames(findings))
+  }
+
+  return administrator
+}
+
+export async function applyRuntimeDatabasePrivilegesInTransaction(
+  sql: TransactionSql,
+  administrator: string,
+): Promise<RuntimeDatabaseProvisioningReport> {
+  await sql.unsafe(REVOKE_CURRENT_DATABASE_ACCESS_SQL)
+  await sql.unsafe(REVOKE_RUNTIME_COLUMNS_SQL)
+  await sql.unsafe(GRANT_RUNTIME_ACCESS_SQL)
+  await sql.unsafe(GRANT_APPLICATION_ACCESS_SQL)
+  await sql.unsafe(GRANT_ADMIN_ACCESS_SQL)
+  await sql.unsafe(GRANT_NOTIFIER_ACCESS_SQL)
+  await sql.unsafe(GRANT_ISSUER_ACCESS_SQL)
+
+  // pg_monitor is a predefined role the cluster owns. Passing it on requires
+  // the administrator to hold it WITH ADMIN OPTION, which a managed provider
+  // need not grant, so this is attempted rather than assumed: DigitalOcean
+  // refuses it at `check_role_membership_authorization`. A refusal costs the
+  // monitor role its server statistics, not the deployment, and it is named
+  // in the report rather than passing unnoticed.
+  const monitorGrants: { role: string; control: string; intended: string }[] = []
+  try {
+    await sql.savepoint(async (scoped) => {
+      await scoped.unsafe('GRANT pg_monitor TO xcs_monitor WITH INHERIT TRUE, SET FALSE')
+    })
+  } catch {
+    monitorGrants.push({
+      role: XCS_MONITOR_DATABASE_ROLE,
+      control: 'pg_monitor membership',
+      intended: 'granted',
+    })
+  }
+
+  // Resource controls last, one statement each inside its own savepoint, so
+  // a cluster that refuses one keeps the grants above.
+  const refused: { role: string; control: string; intended: string }[] = []
+  for (const role of XCS_RUNTIME_DATABASE_ROLES) {
+    const controls = XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS[role]
+    const statements: { control: string; intended: string; statement: string }[] = [
+      {
+        control: 'CONNECTION LIMIT',
+        intended: String(controls.connectionLimit),
+        statement: `ALTER ROLE ${role} WITH CONNECTION LIMIT ${controls.connectionLimit}`,
+      },
+      ...Object.entries(controls.settings).map(([name, value]) => ({
+        control: name,
+        intended: value,
+        statement: `ALTER ROLE ${role} SET ${name} = '${value}'`,
+      })),
+    ]
+    for (const { control, intended, statement } of statements) {
+      try {
+        await sql.savepoint(async (scoped) => {
+          await scoped.unsafe(statement)
+        })
+      } catch {
+        refused.push({ role, control, intended })
+      }
+    }
+  }
+
+  // A refusal is only a loss if the intended value is not already in effect.
+  let unappliedResourceControls: UnappliedRuntimeRoleResourceControl[] = []
+  if (refused.length > 0) {
+    const effective = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
+    const byRole = new Map(effective.map((row) => [row.roleName, row]))
+    unappliedResourceControls = refused.flatMap(({ role, control, intended }) => {
+      const row = byRole.get(role)
+      const actual =
+        control === 'CONNECTION LIMIT'
+          ? row === undefined
+            ? undefined
+            : String(row.connectionLimit)
+          : settingOf(row?.configuration ?? null, control)
+      return actual === intended ? [] : [{ role, control, intended, actual: actual ?? 'unset' }]
+    })
+  }
+
+  // A refused pg_monitor grant is only a loss when the membership is absent.
+  const unappliedMonitorGrants: UnappliedRuntimeRoleResourceControl[] = []
+  if (monitorGrants.length > 0) {
+    const [held] = await sql<Array<{ present: boolean }>>`
+      SELECT EXISTS (
+        SELECT 1
+        FROM pg_auth_members membership
+        JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
+        JOIN pg_roles member_role ON member_role.oid = membership.member
+        WHERE granted_role.rolname = 'pg_monitor'
+          AND member_role.rolname = ${XCS_MONITOR_DATABASE_ROLE}
+      ) AS present
+    `
+    if (held?.present !== true) {
+      unappliedMonitorGrants.push(...monitorGrants.map((entry) => ({ ...entry, actual: 'absent' })))
+    }
+  }
+
+  return {
+    administrator,
+    unappliedResourceControls: [...unappliedResourceControls, ...unappliedMonitorGrants],
+  }
+}
+export async function provisionRuntimeDatabasePrivileges(
+  client: DatabaseClient,
+  provisioning: RuntimeDatabaseProvisioning,
+): Promise<RuntimeDatabaseProvisioningReport> {
+  parseDatabaseClusterScope(provisioning.clusterScope)
+  return await client.sql.begin(async (sql) => {
+    const administrator = await prepareRuntimeDatabaseProvisioningInTransaction(sql, provisioning)
+    return await applyRuntimeDatabasePrivilegesInTransaction(sql, administrator)
+  })
+}
diff --git a/apps/web/server/lib/db/transactions.ts b/apps/web/server/lib/db/transactions.ts
index 2d5558c..5b3c399 100644
--- a/apps/web/server/lib/db/transactions.ts
+++ b/apps/web/server/lib/db/transactions.ts
@@ -1,5 +1,5 @@
-// Copied from packages/db/src/transactions.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (the web app's ESLint config enables preserve-caught-error, which the package config does not, so this copy carries the disable comment); source sha256:b367ac3f9b4388ba910cc2cd03d32b17325e71fa5d8a6982b120f8cd2dd13e1e.
+// Not a vendored copy (retired source): application-local database implementation maintained with db/schema.
+// Diverges by design (the web ESLint rule requires an explicit distinction for an unrelated retry configuration error); source sha256:b367ac3f9b4388ba910cc2cd03d32b17325e71fa5d8a6982b120f8cd2dd13e1e.
 import type { XcsDatabase } from './client.js'
 
 const RETRYABLE_TRANSACTION_ERROR_CODES = new Set(['40001', '40P01'])
@@ -82,8 +82,7 @@ export async function runSerializableTransaction<T>(
 
       const randomValue = random()
       if (!Number.isFinite(randomValue) || randomValue < 0 || randomValue >= 1) {
-        // This rejects a caller-supplied `random`; the caught transaction error is
-        // unrelated and must not be attached as its cause.
+        // Caller configuration errors are unrelated to the caught database failure.
         // eslint-disable-next-line preserve-caught-error
         throw new Error('random must return a finite number in [0, 1)')
       }
diff --git a/apps/web/server/plugins/00-public-profile.ts b/apps/web/server/plugins/00-public-profile.ts
index 4cc1bbf..d0b7d4e 100644
--- a/apps/web/server/plugins/00-public-profile.ts
+++ b/apps/web/server/plugins/00-public-profile.ts
@@ -1,4 +1,6 @@
-import { publicProfileId } from '../xcs/settings'
+import { loadHostedPayloadConfig } from '../xcs/config'
+import { loadIssuerConfig } from '../xcs/issuer/config'
+import { apiEnvironment, publicProfileId } from '../xcs/settings'
 
 /**
  * Publishes the browser-visible profile identifier, derived from the network
@@ -22,5 +24,11 @@ import { publicProfileId } from '../xcs/settings'
  * empty identifier, which is what an unset `NUXT_PUBLIC_PROFILE_ID` already meant.
  */
 export default defineNitroPlugin(() => {
-  process.env.NUXT_PUBLIC_PROFILE_ID = publicProfileId()
+  const environment = apiEnvironment()
+  const hostedPayloads = loadHostedPayloadConfig(environment)
+  process.env.NUXT_PUBLIC_PROFILE_ID = publicProfileId(environment)
+  process.env.NUXT_PUBLIC_ISSUER_ENABLED = loadIssuerConfig(environment) === undefined ? '0' : '1'
+  process.env.NUXT_PUBLIC_PAYLOAD_BASE_URL = hostedPayloads.enabled
+    ? hostedPayloads.publicBaseUrl
+    : ''
 })
diff --git a/apps/web/server/plugins/00-xcs-api.ts b/apps/web/server/plugins/00-xcs-api.ts
index d57608b..447fdb8 100644
--- a/apps/web/server/plugins/00-xcs-api.ts
+++ b/apps/web/server/plugins/00-xcs-api.ts
@@ -11,6 +11,9 @@ import { IndexerUnavailableError } from '../xcs/ledger-freshness'
 import { PostgresOperationalMetricsRepository } from '../xcs/operational-metrics-repository'
 import { DisabledPayloadResolver, SafePayloadResolver } from '../xcs/payload-resolver'
 import { DemoPinningService } from '../xcs/pinning'
+import { HostedPayloadService } from '../xcs/hosted-payloads'
+import { PostgresHostedPayloadRepository } from '../xcs/hosted-payloads-repository'
+import { HostedPayloadResolver } from '../xcs/hosted-payload-resolver'
 import { PostgresPinningRepository } from '../xcs/pinning-repository'
 import { PostgresApiRepository } from '../xcs/repository'
 import type { ApiRepository } from '../xcs/types'
@@ -43,11 +46,11 @@ function createBrowserE2eContext(): XcsApiContext {
     // The fixtures never reach a database; the value only satisfies the
     // configuration contract so the rest of it is loaded the usual way.
     XCS_DATABASE_URL: process.env.XCS_DATABASE_URL ?? 'postgres://127.0.0.1:1/xcs-browser-e2e',
-    // Forced after the checked-in settings: the fixture context must open
-    // neither a pinning store nor a metrics repository even if a settings edit
-    // turns pinning on or the environment supplies a metrics token.
     XCS_DEMO_PINNING_ENABLED: 'false',
     XCS_METRICS_TOKEN: '',
+    XCS_PUBLIC_PAYLOAD_BASE_URL: '',
+    XCS_PAYLOAD_STORAGE_IP_HASH_SECRET: '',
+    XCS_HOSTED_PAYLOAD_NETWORKS: '',
   })
   const real = createApiHandlers({
     repository: unavailableRepository,
@@ -95,21 +98,42 @@ function createBrowserE2eContext(): XcsApiContext {
 function createProductionContext(): XcsApiContext {
   const config = loadApiConfig(apiEnvironment())
   const database = createDatabaseClient(config.databaseUrl)
-  const repository = new PostgresApiRepository(database.db)
-  const pinningService = config.demoPinning.enabled
-    ? new DemoPinningService({
-        repository: new PostgresPinningRepository(database.db),
-        apiRepository: repository,
-        store: new KuboPinStore(config.demoPinning.kuboRpcUrl),
-        ipHashSecret: config.demoPinning.ipHashSecret,
-        enabledNetworks: new Set(config.demoPinning.networks),
-        maxLedgerAgeSeconds: config.readinessMaxLedgerAgeSeconds,
-      })
+  const payloadDatabase = config.payloadDatabaseUrl
+    ? createDatabaseClient(config.payloadDatabaseUrl)
     : undefined
+  const repository = new PostgresApiRepository(database.db)
+  const pinningService =
+    config.demoPinning.enabled && payloadDatabase
+      ? new DemoPinningService({
+          repository: new PostgresPinningRepository(payloadDatabase.db),
+          apiRepository: repository,
+          store: new KuboPinStore(config.demoPinning.kuboRpcUrl),
+          ipHashSecret: config.demoPinning.ipHashSecret,
+          enabledNetworks: new Set(config.demoPinning.networks),
+          maxLedgerAgeSeconds: config.readinessMaxLedgerAgeSeconds,
+        })
+      : undefined
+  const hostedPayloadService =
+    config.hostedPayloads.enabled && payloadDatabase
+      ? new HostedPayloadService({
+          repository: new PostgresHostedPayloadRepository(payloadDatabase.db),
+          apiRepository: repository,
+          publicBaseUrl: config.hostedPayloads.publicBaseUrl,
+          ipHashSecret: config.hostedPayloads.ipHashSecret,
+          enabledNetworks: new Set(config.hostedPayloads.networks),
+          maxLedgerAgeSeconds: config.readinessMaxLedgerAgeSeconds,
+        })
+      : undefined
   const handlers = createApiHandlers({
     repository,
     resolver: config.payloadFetchEnabled
-      ? new SafePayloadResolver(config.ipfsGateway)
+      ? config.hostedPayloads.enabled && hostedPayloadService
+        ? new HostedPayloadResolver(
+            config.hostedPayloads.publicBaseUrl,
+            hostedPayloadService,
+            new SafePayloadResolver(config.ipfsGateway),
+          )
+        : new SafePayloadResolver(config.ipfsGateway)
       : new DisabledPayloadResolver(),
     trustPolicy: new StaticTrustPolicy({
       trusted: config.trustedIssuers,
@@ -127,14 +151,15 @@ function createProductionContext(): XcsApiContext {
         }
       : {}),
     ...(pinningService === undefined ? {} : { pinningService }),
+    ...(hostedPayloadService === undefined ? {} : { hostedPayloadService }),
   })
   const janitor =
     pinningService === undefined
       ? undefined
       : setInterval(
           () => {
-            void pinningService.unpinExpired().catch((error: unknown) => {
-              console.error('demo pin cleanup failed', String(error))
+            void pinningService.unpinExpired().catch(() => {
+              console.error('Demo pin cleanup failed')
             })
           },
           60 * 60 * 1_000,
@@ -149,6 +174,7 @@ function createProductionContext(): XcsApiContext {
       if (janitor !== undefined) clearInterval(janitor)
       await handlers.close()
       await database.close()
+      await payloadDatabase?.close()
     },
   }
 }
diff --git a/apps/web/server/plugins/xcs-admin.ts b/apps/web/server/plugins/xcs-admin.ts
new file mode 100644
index 0000000..e568bc2
--- /dev/null
+++ b/apps/web/server/plugins/xcs-admin.ts
@@ -0,0 +1,32 @@
+import { defineNitroPlugin } from 'nitropack/runtime'
+import { createError } from 'h3'
+import { createDatabaseClient } from '../lib/db/index.js'
+import { loadAdminConfig } from '../xcs/admin/config'
+import { apiEnvironment } from '../xcs/settings'
+import { PrivateDocuments } from '../xcs/admin/documents'
+import { createAdminHandler } from '../xcs/admin/http'
+import { AdminRepository } from '../xcs/admin/repository'
+import { createPrivateDocumentBackend } from '../xcs/documents/storage'
+
+export default defineNitroPlugin((nitroApp) => {
+  const config = loadAdminConfig(apiEnvironment())
+  if (!config) return
+  const database = createDatabaseClient(config.databaseUrl, { onNotice: () => undefined })
+  const documentBackend = createPrivateDocumentBackend(config.storage)
+  const handler = createAdminHandler({
+    repository: new AdminRepository(database),
+    documents: new PrivateDocuments(documentBackend, config.signingKey),
+    authorize: (event, mutation) => {
+      if (!event.context.xcsRequireAdmin)
+        throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+      return event.context.xcsRequireAdmin(event, mutation)
+    },
+  })
+  nitroApp.hooks.hook('request', (event) => {
+    event.context.xcsAdmin = handler
+  })
+  nitroApp.hooks.hook('close', async () => {
+    documentBackend.close?.()
+    await database.close()
+  })
+})
diff --git a/apps/web/server/plugins/xcs-auth.ts b/apps/web/server/plugins/xcs-auth.ts
new file mode 100644
index 0000000..e9c461f
--- /dev/null
+++ b/apps/web/server/plugins/xcs-auth.ts
@@ -0,0 +1,66 @@
+import { defineNitroPlugin, useRuntimeConfig } from 'nitropack/runtime'
+import { createDatabaseClient } from '../lib/db/index.js'
+import { loadAuthConfig } from '../xcs/auth/config'
+import { apiEnvironment } from '../xcs/settings'
+import {
+  createAuthHandler,
+  readAuthSession,
+  requireAuthSession,
+  requireAuthRole,
+  requireCsrf,
+} from '../xcs/auth/http'
+import { OidcProvider } from '../xcs/auth/oidc'
+import { PostgresAuthRepository } from '../xcs/auth/repository'
+import type { H3Event } from 'h3'
+import type { Session } from '../xcs/auth/types'
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsRequireAdmin?: (event: H3Event, mutation: boolean) => Promise<Session>
+    xcsRequireSession?: (event: H3Event, mutation: boolean) => Promise<Session>
+    xcsReadSession?: (event: H3Event) => Promise<Session | null>
+  }
+}
+
+export default defineNitroPlugin(async (nitroApp) => {
+  if (!import.meta.dev && process.env.XCS_AUTH_BROWSER_E2E === '1')
+    throw new Error('AUTH_BROWSER_E2E_FORBIDDEN')
+  const runtime = useRuntimeConfig()
+  if (
+    import.meta.dev &&
+    runtime.browserE2eMode === 'enabled' &&
+    process.env.XCS_AUTH_BROWSER_E2E === '1'
+  ) {
+    const { createBrowserAuthHarness } = await import('../xcs/auth/browser-harness')
+    const harness = await createBrowserAuthHarness(process.env.XCS_AUTH_TEST_ORIGIN ?? '')
+    nitroApp.hooks.hook('request', (event) => {
+      event.context.xcsAuth = harness.handler
+    })
+    nitroApp.hooks.hook('close', harness.close)
+    return
+  }
+  const config = loadAuthConfig(apiEnvironment())
+  if (!config) return
+  const database = createDatabaseClient(config.databaseUrl, { onNotice: () => undefined })
+  const repository = new PostgresAuthRepository(database)
+  const provider = new OidcProvider({
+    ...config,
+    redirectUri: `${config.origin}/api/auth/callback`,
+  })
+  const handler = createAuthHandler({ ...config, repository, provider })
+  nitroApp.hooks.hook('request', (event) => {
+    event.context.xcsAuth = handler
+    event.context.xcsReadSession = (request) => readAuthSession(request, repository)
+    event.context.xcsRequireSession = async (request, mutation) => {
+      const session = await requireAuthSession(request, repository)
+      if (mutation) requireCsrf(request, session, config.origin)
+      return session
+    }
+    event.context.xcsRequireAdmin = async (request, mutation) => {
+      const session = await requireAuthRole(request, repository, 'admin')
+      if (mutation) requireCsrf(request, session, config.origin)
+      return session
+    }
+  })
+  nitroApp.hooks.hook('close', database.close)
+})
diff --git a/apps/web/server/plugins/xcs-issuer.ts b/apps/web/server/plugins/xcs-issuer.ts
new file mode 100644
index 0000000..dca7a17
--- /dev/null
+++ b/apps/web/server/plugins/xcs-issuer.ts
@@ -0,0 +1,48 @@
+import { defineNitroPlugin } from 'nitropack/runtime'
+import { createError } from 'h3'
+import { createDatabaseClient } from '../lib/db/index.js'
+import { loadIssuerConfig } from '../xcs/issuer/config'
+import { apiEnvironment } from '../xcs/settings'
+import { createIssuerHandler } from '../xcs/issuer/http'
+import { IssuerRepository } from '../xcs/issuer/repository'
+import { PrivateDocumentStorage } from '../xcs/issuer/storage'
+import { sendIssuerNotification } from '../xcs/issuer/notifications'
+import { createSmtpDelivery } from '../xcs/notifications/smtp'
+import type { IssuerServices } from '../xcs/issuer/services'
+import { createPrivateDocumentBackend } from '../xcs/documents/storage'
+
+export default defineNitroPlugin((nitroApp) => {
+  const config = loadIssuerConfig(apiEnvironment())
+  if (!config) return
+  const database = createDatabaseClient(config.databaseUrl, { onNotice: () => undefined })
+  const { transport, sender } = createSmtpDelivery(process.env)
+  const documentBackend = createPrivateDocumentBackend(config.storage)
+  const repository = new IssuerRepository(database, {
+    ...config,
+    documents: new PrivateDocumentStorage(documentBackend),
+    notify: (message) => sendIssuerNotification(transport, message, sender),
+  })
+  const handler = createIssuerHandler({
+    repository,
+    authorize: (event, mutation) => {
+      if (!event.context.xcsRequireSession)
+        throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+      return event.context.xcsRequireSession(event, mutation)
+    },
+    readSession: (event) => {
+      if (!event.context.xcsReadSession)
+        throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+      return event.context.xcsReadSession(event)
+    },
+  })
+  const services: IssuerServices = { database, repository, config }
+  nitroApp.hooks.hook('request', (event) => {
+    event.context.xcsIssuer = handler
+    event.context.xcsIssuerServices = services
+  })
+  nitroApp.hooks.hook('close', async () => {
+    documentBackend.close?.()
+    transport.close()
+    await database.close()
+  })
+})
diff --git a/apps/web/server/plugins/xcs-recipient.ts b/apps/web/server/plugins/xcs-recipient.ts
new file mode 100644
index 0000000..8cb0eda
--- /dev/null
+++ b/apps/web/server/plugins/xcs-recipient.ts
@@ -0,0 +1,58 @@
+import { defineNitroPlugin } from 'nitropack/runtime'
+import { createError, defineEventHandler, type EventHandler } from 'h3'
+import type {} from '../xcs/issuer/services'
+import type {} from '../xcs/verifier/services'
+import { RecipientRepository } from '../xcs/recipient/repository'
+import { createRecipientHandler } from '../xcs/recipient/http'
+import { createPresentationHandler } from '../xcs/presentations/http'
+import { evidencePolicyFromConfig } from '../xcs/presentations/evidence'
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsRecipient?: EventHandler
+    xcsPresentation?: EventHandler
+  }
+}
+
+export default defineNitroPlugin((nitroApp) => {
+  // Resolve shared services after all request hooks; keep repositories and rate limiters per plugin.
+  let recipient: EventHandler | undefined
+  let presentation: EventHandler | undefined
+  const recipientRoute = defineEventHandler((event) => {
+    const services = event.context.xcsIssuerServices
+    if (!services) throw createError({ statusCode: 503, message: 'RECIPIENT_DISABLED' })
+    recipient ??= createRecipientHandler({
+      repository: new RecipientRepository(
+        services.database,
+        services.config.origin,
+        evidencePolicyFromConfig(event.context.xcs.config),
+      ),
+      authorize: (request, mutation) => {
+        if (!request.context.xcsRequireSession)
+          throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+        return request.context.xcsRequireSession(request, mutation)
+      },
+    })
+    return recipient(event)
+  })
+  const presentationRoute = defineEventHandler((event) => {
+    const issuer = event.context.xcsIssuerServices
+    const services = event.context.xcsVerifierServices?.()
+    if (!issuer || !services)
+      throw createError({ statusCode: 503, message: 'PRESENTATION_DISABLED' })
+    presentation ??= createPresentationHandler({
+      repository: services.presentations,
+      origin: issuer.config.origin,
+      readSession: (request) => {
+        if (!request.context.xcsReadSession)
+          throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+        return request.context.xcsReadSession(request)
+      },
+    })
+    return presentation(event)
+  })
+  nitroApp.hooks.hook('request', (event) => {
+    event.context.xcsRecipient = recipientRoute
+    event.context.xcsPresentation = presentationRoute
+  })
+})
diff --git a/apps/web/server/plugins/xcs-verifier.ts b/apps/web/server/plugins/xcs-verifier.ts
new file mode 100644
index 0000000..eaa9b2b
--- /dev/null
+++ b/apps/web/server/plugins/xcs-verifier.ts
@@ -0,0 +1,40 @@
+import { createError, defineEventHandler, type EventHandler } from 'h3'
+import { defineNitroPlugin } from 'nitropack/runtime'
+import { createVerifierHandler } from '../xcs/verifier/http'
+import { createVerifierServices, type VerifierServices } from '../xcs/verifier/services'
+import { evidencePolicyFromConfig } from '../xcs/presentations/evidence'
+
+export default defineNitroPlugin((nitroApp) => {
+  let services: VerifierServices | undefined
+  let handler: EventHandler | undefined
+  // Initialization happens when a route executes, after all request hooks. The shared pool
+  // is owned and closed by the issuer plugin; handlers and rate limiters survive requests.
+  nitroApp.hooks.hook('request', (event) => {
+    event.context.xcsVerifierServices = () => {
+      if (!services) {
+        const issuer = event.context.xcsIssuerServices
+        if (!issuer) throw createError({ statusCode: 503, message: 'VERIFIER_DISABLED' })
+        services = createVerifierServices(
+          issuer,
+          evidencePolicyFromConfig(event.context.xcs.config),
+        )
+      }
+      return services
+    }
+    event.context.xcsVerifier = defineEventHandler(async (request) => {
+      if (!handler) {
+        const { repository, presentations } = request.context.xcsVerifierServices!()
+        handler = createVerifierHandler({
+          repository,
+          authorize: (event, mutation) => {
+            if (!event.context.xcsRequireSession)
+              throw createError({ statusCode: 503, message: 'AUTH_UNAVAILABLE' })
+            return event.context.xcsRequireSession(event, mutation)
+          },
+          resolvePresentation: (session, id) => presentations.resolveById(session, id),
+        })
+      }
+      return handler(request)
+    })
+  })
+})
diff --git a/apps/web/server/routes/p.ts b/apps/web/server/routes/p.ts
new file mode 100644
index 0000000..d1a9289
--- /dev/null
+++ b/apps/web/server/routes/p.ts
@@ -0,0 +1 @@
+export default defineEventHandler(apiRouteNotFound)
diff --git a/apps/web/server/routes/p/[...].ts b/apps/web/server/routes/p/[...].ts
new file mode 100644
index 0000000..d1a9289
--- /dev/null
+++ b/apps/web/server/routes/p/[...].ts
@@ -0,0 +1 @@
+export default defineEventHandler(apiRouteNotFound)
diff --git a/apps/web/server/routes/p/[locator].get.ts b/apps/web/server/routes/p/[locator].get.ts
new file mode 100644
index 0000000..1887e38
--- /dev/null
+++ b/apps/web/server/routes/p/[locator].get.ts
@@ -0,0 +1 @@
+export default defineEventHandler((event) => dispatch(event, 'GET', '/p/:locator'))
diff --git a/apps/web/server/routes/q/[locator].ts b/apps/web/server/routes/q/[locator].ts
new file mode 100644
index 0000000..9e81e0f
--- /dev/null
+++ b/apps/web/server/routes/q/[locator].ts
@@ -0,0 +1,7 @@
+import { defineEventHandler, createError } from 'h3'
+
+export default defineEventHandler((event) => {
+  if (!event.context.xcsIssuer)
+    throw createError({ statusCode: 503, message: 'ISSUER_UNAVAILABLE' })
+  return event.context.xcsIssuer(event)
+})
diff --git a/apps/web/server/routes/v1/payloads/[locator].post.ts b/apps/web/server/routes/v1/payloads/[locator].post.ts
new file mode 100644
index 0000000..999d098
--- /dev/null
+++ b/apps/web/server/routes/v1/payloads/[locator].post.ts
@@ -0,0 +1 @@
+export default defineEventHandler((event) => dispatch(event, 'POST', '/v1/payloads/:locator'))
diff --git a/apps/web/server/utils/apiPaths.ts b/apps/web/server/utils/apiPaths.ts
index c46a1d4..a2eea5e 100644
--- a/apps/web/server/utils/apiPaths.ts
+++ b/apps/web/server/utils/apiPaths.ts
@@ -1,4 +1,4 @@
-const API_PREFIXES = ['/v1', '/health', '/internal', '/documentation']
+const API_PREFIXES = ['/v1', '/health', '/internal', '/documentation', '/p']
 
 /**
  * The read API owns these path prefixes. Everything else is a Nuxt page or a
diff --git a/apps/web/server/xcs/admin/config.ts b/apps/web/server/xcs/admin/config.ts
new file mode 100644
index 0000000..217a801
--- /dev/null
+++ b/apps/web/server/xcs/admin/config.ts
@@ -0,0 +1,32 @@
+import { loadPrivateDocumentStorageConfig } from '../documents/config'
+import { serverSecret } from '../secrets'
+import { loadAuthConfig } from '../auth/config'
+
+export const adminSecret = serverSecret
+export function loadAdminConfig(env: NodeJS.ProcessEnv) {
+  const supplied = [
+    'NUXT_ADMIN_DATABASE_URL',
+    'NUXT_ADMIN_DATABASE_URL_FILE',
+    'XCS_ADMIN_DOCUMENT_KEY',
+    'XCS_ADMIN_DOCUMENT_KEY_FILE',
+  ].some((name) => (env[name] ?? '').trim().length > 0)
+  if (!supplied) return undefined
+  if (loadAuthConfig(env) === undefined) throw new Error('ADMIN_AUTH_REQUIRED')
+  const databaseUrl = adminSecret(env, 'NUXT_ADMIN_DATABASE_URL'),
+    signingKey = adminSecret(env, 'XCS_ADMIN_DOCUMENT_KEY')
+  let database: URL
+  try {
+    database = new URL(databaseUrl)
+  } catch {
+    throw new Error('ADMIN_DATABASE_INVALID')
+  }
+  if (
+    !['postgres:', 'postgresql:'].includes(database.protocol) ||
+    decodeURIComponent(database.username) !== 'xcs_admin_app' ||
+    !database.password
+  )
+    throw new Error('ADMIN_DATABASE_ROLE_REQUIRED')
+  if (Buffer.byteLength(signingKey) < 32) throw new Error('ADMIN_DOCUMENT_CONFIGURATION_REQUIRED')
+  const storage = loadPrivateDocumentStorageConfig(env)
+  return { databaseUrl, signingKey, storage }
+}
diff --git a/apps/web/server/xcs/admin/documents.ts b/apps/web/server/xcs/admin/documents.ts
new file mode 100644
index 0000000..d4e4351
--- /dev/null
+++ b/apps/web/server/xcs/admin/documents.ts
@@ -0,0 +1,90 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+import { AdminError, uuid } from './domain'
+import {
+  FilesystemPrivateDocumentBackend,
+  readStoredPrivateDocument,
+  type PrivateDocumentBackend,
+} from '../documents/storage'
+
+export interface ReviewDocument {
+  id: string
+  storage_key: string
+  mime_type: string
+  byte_length: number
+  sha256: string
+}
+const TTL = 300
+export class PrivateDocuments {
+  private readonly backend: PrivateDocumentBackend
+
+  constructor(
+    backend: PrivateDocumentBackend | string,
+    private readonly signingKey: string,
+    private readonly now = () => Date.now(),
+  ) {
+    if (Buffer.byteLength(signingKey) < 32) throw new Error('ADMIN_DOCUMENT_KEY_REQUIRED')
+    try {
+      this.backend =
+        typeof backend === 'string' ? new FilesystemPrivateDocumentBackend(backend) : backend
+    } catch {
+      throw new Error('ADMIN_DOCUMENT_STORAGE_INVALID')
+    }
+  }
+  private signature(id: string, sessionId: string, expires: number): string {
+    return createHmac('sha256', this.signingKey)
+      .update(JSON.stringify([id, sessionId, expires]))
+      .digest('base64url')
+  }
+  link(id: string, sessionId: string) {
+    uuid(id)
+    const expires = Math.floor(this.now() / 1000) + TTL
+    return {
+      url: `/api/admin/documents/${id}?expires=${expires}&signature=${this.signature(id, sessionId, expires)}`,
+      expiresAt: new Date(expires * 1000).toISOString(),
+    }
+  }
+  verify(id: string, sessionId: string, expires: unknown, signature: unknown) {
+    if (
+      typeof expires !== 'string' ||
+      !/^\d{10,11}$/.test(expires) ||
+      typeof signature !== 'string' ||
+      !/^[A-Za-z0-9_-]{43}$/.test(signature)
+    )
+      throw new AdminError(403, 'ADMIN_DOCUMENT_LINK_INVALID')
+    const expiry = Number(expires),
+      now = Math.floor(this.now() / 1000)
+    if (expiry <= now || expiry > now + TTL)
+      throw new AdminError(403, 'ADMIN_DOCUMENT_LINK_EXPIRED')
+    if (
+      !timingSafeEqual(Buffer.from(signature), Buffer.from(this.signature(id, sessionId, expiry)))
+    )
+      throw new AdminError(403, 'ADMIN_DOCUMENT_LINK_INVALID')
+  }
+  async read(document: ReviewDocument): Promise<Buffer> {
+    try {
+      const content = await readStoredPrivateDocument(this.backend, {
+        storageKey: document.storage_key,
+        mimeType: document.mime_type,
+        byteLength: document.byte_length,
+        sha256: document.sha256,
+      })
+      if (!content) throw new AdminError(404, 'ADMIN_DOCUMENT_MISSING')
+      return content
+    } catch (error) {
+      if (error instanceof AdminError) throw error
+      if ((error as Error).message === 'DOCUMENT_OBJECT_KEY_INVALID')
+        throw new AdminError(422, 'ADMIN_DOCUMENT_PATH_INVALID')
+      if ((error as Error).message === 'DOCUMENT_METADATA_INVALID')
+        throw new AdminError(422, 'ADMIN_DOCUMENT_INVALID')
+      if (
+        ['DOCUMENT_OBJECT_INTEGRITY_INVALID', 'DOCUMENT_OBJECT_TOO_LARGE'].includes(
+          (error as Error).message,
+        )
+      )
+        throw new AdminError(422, 'ADMIN_DOCUMENT_INTEGRITY_INVALID')
+      if ((error as Error).message === 'DOCUMENT_OBJECT_PATH_INVALID')
+        throw new AdminError(422, 'ADMIN_DOCUMENT_PATH_INVALID')
+      throw new AdminError(422, 'ADMIN_DOCUMENT_UNREADABLE')
+    }
+  }
+}
diff --git a/apps/web/server/xcs/admin/domain.ts b/apps/web/server/xcs/admin/domain.ts
new file mode 100644
index 0000000..e3a6f1f
--- /dev/null
+++ b/apps/web/server/xcs/admin/domain.ts
@@ -0,0 +1,88 @@
+import { createHash } from 'node:crypto'
+
+export type ApplicationRole = 'issuer' | 'verifier'
+export type ApplicationStatus = 'pending' | 'approved' | 'rejected' | 'suspended'
+export type DecisionAction = 'approve' | 'reject' | 'suspend' | 'restore'
+export interface DecisionInput {
+  action: DecisionAction
+  revision: number
+  reason: string
+  idempotencyKey: string
+}
+export class AdminError extends Error {
+  constructor(
+    readonly statusCode: number,
+    readonly code: string,
+    readonly current?: unknown,
+  ) {
+    super(code)
+  }
+}
+export const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+export function uuid(value: unknown): string {
+  if (typeof value !== 'string' || !UUID.test(value))
+    throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+  return value.toLowerCase()
+}
+export function role(value: unknown): ApplicationRole {
+  if (value !== 'issuer' && value !== 'verifier') throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+  return value
+}
+export function decisionInput(value: unknown): DecisionInput {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+  const input = value as Record<string, unknown>
+  if (
+    Object.keys(input).some(
+      (k) => !['action', 'revision', 'reason', 'idempotencyKey'].includes(k),
+    ) ||
+    !['approve', 'reject', 'suspend', 'restore'].includes(String(input.action)) ||
+    !Number.isSafeInteger(input.revision) ||
+    Number(input.revision) < 0 ||
+    Number(input.revision) > 2147483646 ||
+    typeof input.reason !== 'string' ||
+    input.reason.length > 2000
+  )
+    throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+  const reason = input.reason.trim()
+  if (['reject', 'suspend'].includes(String(input.action)) && !reason)
+    throw new AdminError(400, 'ADMIN_REASON_REQUIRED')
+  return {
+    action: input.action as DecisionAction,
+    revision: Number(input.revision),
+    reason,
+    idempotencyKey: uuid(input.idempotencyKey),
+  }
+}
+export function transition(
+  status: ApplicationStatus,
+  applicationRole: ApplicationRole,
+  action: DecisionAction,
+): ApplicationStatus {
+  if (status === 'pending' && action === 'approve') return 'approved'
+  if (status === 'pending' && action === 'reject') return 'rejected'
+  if (applicationRole === 'verifier' && status === 'approved' && action === 'suspend')
+    return 'suspended'
+  if (applicationRole === 'verifier' && status === 'suspended' && action === 'restore')
+    return 'approved'
+  throw new AdminError(409, 'ADMIN_TRANSITION_INVALID')
+}
+export function requestHash(
+  organizationId: string,
+  applicationRole: ApplicationRole,
+  input: DecisionInput,
+): string {
+  return createHash('sha256')
+    .update(
+      JSON.stringify([organizationId, applicationRole, input.action, input.revision, input.reason]),
+    )
+    .digest('hex')
+}
+export function verifiedEmail(email: unknown, verifiedAt: unknown): string | null {
+  return verifiedAt &&
+    typeof email === 'string' &&
+    email.length <= 254 &&
+    /^[^\s<>(),;:"\\@]+@[^\s<>(),;:"\\@]+\.[^\s<>(),;:"\\@]+$/.test(email)
+    ? email
+    : null
+}
diff --git a/apps/web/server/xcs/admin/http.ts b/apps/web/server/xcs/admin/http.ts
new file mode 100644
index 0000000..7a607fb
--- /dev/null
+++ b/apps/web/server/xcs/admin/http.ts
@@ -0,0 +1,148 @@
+import {
+  createRouter,
+  defineEventHandler,
+  getQuery,
+  getRouterParam,
+  setResponseHeaders,
+  setResponseStatus,
+  type H3Event,
+} from 'h3'
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible'
+import type { Session } from '../auth/types'
+import { readJsonBody } from '../private-body'
+import { AdminError, decisionInput, role, uuid } from './domain'
+import type { PrivateDocuments } from './documents'
+import type { AdminRepository } from './repository'
+
+export interface AdminOptions {
+  repository: AdminRepository
+  documents: PrivateDocuments
+  authorize: (event: H3Event, mutation: boolean) => Promise<Session>
+}
+export function createAdminHandler({ repository, documents, authorize }: AdminOptions) {
+  const router = createRouter(),
+    sessions = new WeakMap<H3Event, Session>()
+  const limits = new RateLimiterMemory({ points: 120, duration: 60 })
+  const mutations = new RateLimiterMemory({ points: 30, duration: 60 })
+  const page = (event: H3Event, allowed: string[] = ['page']) => {
+    const query = getQuery(event)
+    if (
+      Object.keys(query).some((k) => !allowed.includes(k)) ||
+      (query.page !== undefined &&
+        (typeof query.page !== 'string' || !/^[1-9]\d{0,5}$/.test(query.page)))
+    )
+      throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+    return Number(query.page ?? 1)
+  }
+  router.get(
+    '/api/admin/applications',
+    defineEventHandler((event) => {
+      const p = page(event, ['page', 'role']),
+        filter = getQuery(event).role
+      return repository.list(p, filter === undefined ? undefined : role(filter))
+    }),
+  )
+  router.get(
+    '/api/admin/verifiers',
+    defineEventHandler((event) => repository.list(page(event), undefined, true)),
+  )
+  router.get(
+    '/api/admin/audit',
+    defineEventHandler((event) => repository.history(page(event))),
+  )
+  router.get(
+    '/api/admin/applications/:id/:role',
+    defineEventHandler((event) =>
+      repository.detail(uuid(getRouterParam(event, 'id')), role(getRouterParam(event, 'role'))),
+    ),
+  )
+  router.post(
+    '/api/admin/applications/:id/:role/decisions',
+    defineEventHandler(async (event) =>
+      repository.decide(
+        sessions.get(event)!,
+        uuid(getRouterParam(event, 'id')),
+        role(getRouterParam(event, 'role')),
+        decisionInput(await readJsonBody(event, 8192)),
+      ),
+    ),
+  )
+  router.post(
+    '/api/admin/documents/:id/link',
+    defineEventHandler(async (event) => {
+      const id = uuid(getRouterParam(event, 'id'))
+      await documents.read(await repository.document(id))
+      return documents.link(id, sessions.get(event)!.id)
+    }),
+  )
+  router.get(
+    '/api/admin/documents/:id',
+    defineEventHandler(async (event) => {
+      const id = uuid(getRouterParam(event, 'id')),
+        query = getQuery(event)
+      documents.verify(id, sessions.get(event)!.id, query.expires, query.signature)
+      const document = await repository.document(id),
+        content = await documents.read(document)
+      const extension = { 'application/pdf': 'pdf', 'image/png': 'png', 'image/jpeg': 'jpg' }[
+        document.mime_type
+      ]
+      setResponseHeaders(event, {
+        'content-type': document.mime_type,
+        'content-length': String(content.length),
+        'content-disposition': `inline; filename="review-${id}.${extension}"`,
+        'content-security-policy': "default-src 'none'; sandbox",
+      })
+      return content
+    }),
+  )
+  router.post(
+    '/api/admin/notifications/:id/retry',
+    defineEventHandler(async (event) => {
+      const input = await readJsonBody(event, 64)
+      if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).length)
+        throw new AdminError(400, 'ADMIN_INPUT_INVALID')
+      return repository.retryNotification(uuid(getRouterParam(event, 'id')))
+    }),
+  )
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, {
+      'cache-control': 'private, no-store',
+      'referrer-policy': 'no-referrer',
+      'x-content-type-options': 'nosniff',
+      'x-frame-options': 'DENY',
+    })
+    try {
+      const session = await authorize(event, event.method !== 'GET')
+      sessions.set(event, session)
+      await limits.consume(session.userId)
+      if (event.method !== 'GET') await mutations.consume(session.userId)
+      return await router.handler(event)
+    } catch (error) {
+      const status =
+        error instanceof RateLimiterRes
+          ? 429
+          : ((error as { statusCode?: number })?.statusCode ?? 503)
+      const safeStatus = [400, 401, 403, 404, 405, 409, 413, 415, 422, 429].includes(status)
+        ? status
+        : 503
+      setResponseStatus(event, safeStatus)
+      return {
+        error:
+          error instanceof AdminError
+            ? error.code
+            : safeStatus === 401
+              ? 'AUTH_REQUIRED'
+              : safeStatus === 403
+                ? 'AUTH_NOT_AUTHORIZED'
+                : safeStatus === 429
+                  ? 'ADMIN_RATE_LIMITED'
+                  : safeStatus === 503
+                    ? 'ADMIN_UNAVAILABLE'
+                    : 'ADMIN_REQUEST_REJECTED',
+        ...(error instanceof AdminError && error.current ? { current: error.current } : {}),
+      }
+    } finally {
+      sessions.delete(event)
+    }
+  })
+}
diff --git a/apps/web/server/xcs/admin/notifications.ts b/apps/web/server/xcs/admin/notifications.ts
new file mode 100644
index 0000000..d297306
--- /dev/null
+++ b/apps/web/server/xcs/admin/notifications.ts
@@ -0,0 +1,207 @@
+import { randomUUID } from 'node:crypto'
+import type { DatabaseClient } from '../../lib/db/index.js'
+import {
+  classifySmtpFailure,
+  DEFAULT_NOTIFICATION_SENDER,
+  isNotificationEmail,
+  type NotificationMessage,
+  type NotificationSender,
+  type NotificationTransport,
+} from '../notifications/smtp'
+
+export {
+  classifySmtpFailure,
+  createSmtpDelivery,
+  createSmtpTransport,
+  isNotificationEmail,
+  loadSmtpConfiguration,
+} from '../notifications/smtp'
+export type {
+  NotificationMessage,
+  NotificationSender,
+  NotificationTransport,
+  SmtpConfiguration,
+} from '../notifications/smtp'
+
+const SMTP_DEADLINE_MS = 60_000
+const STALE_CLAIM_SECONDS = 300
+
+export interface ClaimedNotification {
+  id: string
+  attemptId: string
+  decisionId: string
+  recipientEmail: string
+  organizationName: string
+  role: string
+  status: string
+  reason: string | null
+}
+
+export type NotificationOutcome = 'idle' | 'sent' | 'failed' | 'blocked' | 'uncertain'
+export type ClaimResult =
+  { kind: 'idle' | 'blocked' } | { kind: 'claimed'; notification: ClaimedNotification }
+
+export interface NotificationRepository {
+  recoverStale(): Promise<void>
+  claim(): Promise<ClaimResult>
+  finish(
+    notification: ClaimedNotification,
+    outcome: 'sent' | 'failed' | 'uncertain',
+    errorCode: string | null,
+  ): Promise<void>
+}
+
+export class PostgresNotificationRepository implements NotificationRepository {
+  constructor(private readonly client: DatabaseClient) {}
+
+  async recoverStale(): Promise<void> {
+    // The previous process may have delivered before losing its acknowledgement.
+    // Never automatically send these claims again, even after a worker restart.
+    await this.client.sql`UPDATE app_admin_notifications
+      SET status = 'uncertain', error_code = 'WORKER_INTERRUPTED'
+      WHERE status = 'sending' AND claimed_at < statement_timestamp() - ${STALE_CLAIM_SECONDS} * interval '1 second'`
+  }
+
+  async claim(): Promise<ClaimResult> {
+    const result = await this.client.sql.begin(async (sql): Promise<ClaimResult> => {
+      const [row] = await sql`SELECT n.id, n.decision_id, n.recipient_email,
+        u.email AS current_email, u.email_verified_at, u.status AS user_status,
+        d.role, d.after_status, d.reason, o.name AS organization_name
+        FROM app_admin_notifications n
+        JOIN app_users u ON u.id = n.recipient_user_id
+        JOIN app_admin_decisions d ON d.id = n.decision_id
+        JOIN app_organizations o ON o.id = d.organization_id
+        WHERE n.status = 'pending' ORDER BY n.created_at, n.id
+        LIMIT 1 FOR UPDATE OF n SKIP LOCKED`
+      if (!row) return { kind: 'idle' }
+      if (
+        row.user_status !== 'active' ||
+        !row.email_verified_at ||
+        !isNotificationEmail(row.recipient_email) ||
+        row.current_email !== row.recipient_email
+      ) {
+        await sql`UPDATE app_admin_notifications SET status = 'blocked', error_code = 'RECIPIENT_UNAVAILABLE'
+          WHERE id = ${row.id}`
+        return { kind: 'blocked' }
+      }
+      const attemptId = randomUUID()
+      await sql`UPDATE app_admin_notifications SET status = 'sending', attempts = attempts + 1,
+        attempt_id = ${attemptId}, claimed_at = statement_timestamp(), error_code = NULL
+        WHERE id = ${row.id}`
+      return {
+        kind: 'claimed',
+        notification: {
+          id: row.id,
+          attemptId,
+          decisionId: row.decision_id,
+          recipientEmail: row.recipient_email,
+          organizationName: row.organization_name,
+          role: row.role,
+          status: row.after_status,
+          reason: row.reason,
+        },
+      }
+    })
+    return result as ClaimResult
+  }
+
+  async finish(
+    notification: ClaimedNotification,
+    outcome: 'sent' | 'failed' | 'uncertain',
+    errorCode: string | null,
+  ): Promise<void> {
+    await this.client
+      .sql`UPDATE app_admin_notifications SET status = ${outcome}, error_code = ${errorCode},
+      sent_at = CASE WHEN ${outcome} = 'sent' THEN statement_timestamp() ELSE NULL END
+      WHERE id = ${notification.id} AND attempt_id = ${notification.attemptId} AND status = 'sending'`
+  }
+}
+
+export function createNotificationMessage(
+  notification: ClaimedNotification,
+  sender: NotificationSender = DEFAULT_NOTIFICATION_SENDER,
+  portalOrigin?: string,
+): NotificationMessage {
+  const statuses: Record<string, [string, string]> = {
+    approved: ['approved', 'approuvé'],
+    rejected: ['rejected', 'refusé'],
+    suspended: ['suspended', 'suspendu'],
+  }
+  const [english, french] = statuses[notification.status] ?? [
+    notification.status,
+    notification.status,
+  ]
+  const destination = portalOrigin
+    ? `${new URL(portalOrigin).origin}/${notification.role === 'issuer' ? 'issuer' : 'verifier'}`
+    : undefined
+  const reason = notification.reason?.trim()
+  const escapeHtml = (value: string) =>
+    value.replace(
+      /[&<>"']/g,
+      (character) =>
+        ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]!,
+    )
+  const text = [
+    `The ${notification.role} access for ${notification.organizationName} is now ${english}.`,
+    ...(reason ? [`Reason: ${reason}`] : []),
+    ...(destination ? [`Open your space: ${destination}`] : []),
+    '',
+    `L’accès ${notification.role} de ${notification.organizationName} est maintenant ${french}.`,
+    ...(reason ? [`Motif : ${reason}`] : []),
+    ...(destination ? [`Ouvrir votre espace : ${destination}`] : []),
+  ]
+  return {
+    from: { name: sender.name, address: sender.address },
+    to: { name: '', address: notification.recipientEmail },
+    envelope: { from: sender.envelopeFrom, to: [notification.recipientEmail] },
+    messageId: `<admin-decision-${notification.decisionId}@${sender.messageIdDomain}>`,
+    subject: 'XCS — Access decision / Décision concernant votre accès',
+    // No profile, document, wallet, private claim, token, or protocol identifier is sent.
+    text: text.join('\n'),
+    ...(destination
+      ? {
+          html: [
+            `<p>The ${escapeHtml(notification.role)} access for <strong>${escapeHtml(notification.organizationName)}</strong> is now ${escapeHtml(english)}.<br>`,
+            `L’accès ${escapeHtml(notification.role)} de <strong>${escapeHtml(notification.organizationName)}</strong> est maintenant ${escapeHtml(french)}.</p>`,
+            reason ? `<p>Reason / Motif: ${escapeHtml(reason).replace(/\n/g, '<br>')}</p>` : '',
+            `<p><a href="${escapeHtml(destination)}">Open your space / Ouvrir votre espace</a></p>`,
+          ].join(''),
+        }
+      : {}),
+  }
+}
+
+export async function processNextNotification(
+  repository: NotificationRepository,
+  transport: NotificationTransport,
+  sender?: NotificationSender,
+  portalOrigin?: string,
+): Promise<NotificationOutcome> {
+  await repository.recoverStale()
+  const result = await repository.claim()
+  if (result.kind !== 'claimed') return result.kind
+  const notification = result.notification
+  let outcome: 'sent' | 'failed' | 'uncertain'
+  let errorCode: string | null = null
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const info = await Promise.race([
+      transport.sendMail(createNotificationMessage(notification, sender, portalOrigin)),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error('SMTP_DEADLINE')), SMTP_DEADLINE_MS)
+      }),
+    ])
+    outcome = info.accepted.length === 1 && info.rejected.length === 0 ? 'sent' : 'uncertain'
+    if (outcome === 'uncertain') errorCode = 'SMTP_ACCEPTANCE_UNCERTAIN'
+  } catch (error) {
+    outcome = classifySmtpFailure(error)
+    // Persist a fixed code only: SMTP errors can contain addresses and message content.
+    errorCode = outcome === 'failed' ? 'SMTP_REJECTED' : 'SMTP_ACCEPTANCE_UNCERTAIN'
+  } finally {
+    if (timer) clearTimeout(timer)
+  }
+  // A database failure here must leave the claim sending, later becoming uncertain.
+  // It must not be mistaken for a definitive SMTP failure and offered for retry.
+  await repository.finish(notification, outcome, errorCode)
+  return outcome
+}
diff --git a/apps/web/server/xcs/admin/repository.ts b/apps/web/server/xcs/admin/repository.ts
new file mode 100644
index 0000000..7397327
--- /dev/null
+++ b/apps/web/server/xcs/admin/repository.ts
@@ -0,0 +1,140 @@
+import { randomUUID } from 'node:crypto'
+import type { DatabaseClient } from '../../lib/db/index.js'
+import type { Session } from '../auth/types'
+import {
+  AdminError,
+  requestHash,
+  transition,
+  verifiedEmail,
+  type ApplicationRole,
+  type DecisionInput,
+} from './domain'
+
+export class AdminRepository {
+  constructor(private readonly client: DatabaseClient) {}
+
+  async list(page: number, filter?: ApplicationRole, verifiers = false) {
+    const sql = this.client.sql
+    const items = await sql`SELECT a.organization_id, a.role, a.status, a.revision, a.submitted_at,
+      a.reviewed_at, a.review_reason, o.name FROM app_organization_applications a
+      JOIN app_organizations o ON o.id = a.organization_id
+      WHERE (${verifiers} AND a.role = 'verifier' AND a.status IN ('approved','suspended'))
+        OR (NOT ${verifiers} AND a.status = 'pending' AND (${filter ?? null}::text IS NULL OR a.role = ${filter ?? null}))
+      ORDER BY a.submitted_at, a.organization_id, a.role LIMIT 20 OFFSET ${(page - 1) * 20}`
+    const [count] = await sql`SELECT count(*)::int AS total FROM app_organization_applications a
+      WHERE (${verifiers} AND a.role = 'verifier' AND a.status IN ('approved','suspended'))
+        OR (NOT ${verifiers} AND a.status = 'pending' AND (${filter ?? null}::text IS NULL OR a.role = ${filter ?? null}))`
+    const counts =
+      await sql`SELECT role, count(*)::int AS count FROM app_organization_applications WHERE status='pending' GROUP BY role`
+    return {
+      items,
+      total: count!.total,
+      page,
+      pageSize: 20,
+      counts: {
+        issuer: counts.find((r) => r.role === 'issuer')?.count ?? 0,
+        verifier: counts.find((r) => r.role === 'verifier')?.count ?? 0,
+      },
+    }
+  }
+
+  async detail(id: string, role: ApplicationRole) {
+    const sql = this.client.sql
+    const [application] =
+      await sql`SELECT a.organization_id, a.role, a.status, a.revision, a.submitted_at,
+      a.reviewed_at, a.review_reason, a.website, a.contact, a.jurisdiction, a.description, a.purpose,
+      o.name, o.responsible_user_id, u.display_name AS responsible_name, u.email AS responsible_email
+      FROM app_organization_applications a JOIN app_organizations o ON o.id=a.organization_id
+      JOIN app_users u ON u.id=o.responsible_user_id WHERE a.organization_id=${id} AND a.role=${role}`
+    if (!application) throw new AdminError(404, 'ADMIN_APPLICATION_NOT_FOUND')
+    const wallets =
+      await sql`SELECT address, network_id, verified_at FROM app_wallets WHERE user_id=${application.responsible_user_id} AND revoked_at IS NULL ORDER BY verified_at, id`
+    const documents =
+      await sql`SELECT id, mime_type, byte_length FROM app_documents WHERE organization_id=${id} AND application_role=${role} ORDER BY created_at,id`
+    const history = await this.historyRows(1, id, role)
+    return { application, wallets, documents, history }
+  }
+
+  private async historyRows(page: number, id?: string, role?: ApplicationRole) {
+    return this.client.sql`SELECT d.id, d.organization_id, d.role, o.name AS organization_name,
+      u.display_name AS actor_name, d.actor_id, d.action, d.before_status, d.after_status,
+      d.revision, d.reason, d.created_at, n.id AS notification_id, n.status AS notification_status
+      FROM app_admin_decisions d JOIN app_organizations o ON o.id=d.organization_id
+      JOIN app_users u ON u.id=d.actor_id LEFT JOIN app_admin_notifications n ON n.decision_id=d.id
+      WHERE (${id ?? null}::uuid IS NULL OR d.organization_id=${id ?? null}) AND (${role ?? null}::text IS NULL OR d.role=${role ?? null})
+      ORDER BY d.created_at DESC, d.id DESC LIMIT 20 OFFSET ${(page - 1) * 20}`
+  }
+
+  async history(page: number) {
+    const [count] = await this.client.sql`SELECT count(*)::int AS total FROM app_admin_decisions`
+    return { items: await this.historyRows(page), total: count!.total, page, pageSize: 20 }
+  }
+
+  async decide(session: Session, id: string, role: ApplicationRole, input: DecisionInput) {
+    const hash = requestHash(id, role, input)
+    return this.client.sql.begin(async (sql) => {
+      // Serialize reuse of an actor's key even across different applications.
+      await sql`SELECT pg_advisory_xact_lock(hashtextextended(${session.userId + ':' + input.idempotencyKey},0))`
+      const [authorized] =
+        await sql`SELECT s.id FROM app_sessions s JOIN app_users u ON u.id=s.user_id
+        JOIN app_user_roles r ON r.user_id=u.id AND r.role='admin' AND r.revoked_at IS NULL
+        WHERE s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+        AND u.status='active' AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()`
+      if (!authorized) throw new AdminError(403, 'ADMIN_ACCESS_REVOKED')
+      const [previous] =
+        await sql`SELECT id, before_status, after_status, reason, revision, created_at, request_hash FROM app_admin_decisions WHERE actor_id=${session.userId} AND idempotency_key=${input.idempotencyKey}`
+      if (previous) {
+        if (previous.request_hash !== hash) throw new AdminError(409, 'ADMIN_IDEMPOTENCY_MISMATCH')
+        const { request_hash: _hash, ...decision } = previous
+        return { decision, replayed: true }
+      }
+      const [application] =
+        await sql`SELECT status, revision, reviewed_at, review_reason FROM app_organization_applications WHERE organization_id=${id} AND role=${role} FOR UPDATE`
+      if (!application) throw new AdminError(404, 'ADMIN_APPLICATION_NOT_FOUND')
+      if (application.revision !== input.revision)
+        throw new AdminError(409, 'ADMIN_CONFLICT', application)
+      const after = transition(application.status, role, input.action)
+      const [responsible] =
+        await sql`SELECT u.id,u.email,u.email_verified_at FROM app_organizations o JOIN app_users u ON u.id=o.responsible_user_id WHERE o.id=${id} AND o.status='active' AND u.status='active'`
+      if (!responsible) throw new AdminError(409, 'ADMIN_ORGANIZATION_INACTIVE')
+      const email = verifiedEmail(responsible.email, responsible.email_verified_at)
+      const [decision] = await sql`INSERT INTO app_admin_decisions
+        (id,organization_id,role,actor_id,action,before_status,after_status,reason,revision,idempotency_key,request_hash)
+        VALUES (${randomUUID()},${id},${role},${session.userId},${input.action},${application.status},${after},${input.reason || null},${input.revision + 1},${input.idempotencyKey},${hash})
+        RETURNING id,before_status,after_status,reason,revision,created_at`
+      await sql`UPDATE app_organization_applications SET status=${after},revision=revision+1,reviewed_by=${session.userId},reviewed_at=statement_timestamp(),review_reason=${input.reason || null} WHERE organization_id=${id} AND role=${role}`
+      await sql`INSERT INTO app_admin_notifications(id,decision_id,recipient_user_id,recipient_email,status,error_code)
+        VALUES (${randomUUID()},${decision!.id},${responsible.id},${email},${email ? 'pending' : 'blocked'},${email ? null : 'VERIFIED_EMAIL_REQUIRED'})`
+      return { decision, replayed: false }
+    })
+  }
+
+  async document(id: string) {
+    const [document] = await this.client
+      .sql`SELECT id,storage_key,mime_type,byte_length,sha256 FROM app_documents WHERE id=${id}`
+    if (!document) throw new AdminError(404, 'ADMIN_DOCUMENT_NOT_FOUND')
+    return document as {
+      id: string
+      storage_key: string
+      mime_type: string
+      byte_length: number
+      sha256: string
+    }
+  }
+
+  async retryNotification(id: string) {
+    return this.client.sql.begin(async (sql) => {
+      const [notification] =
+        await sql`SELECT id,status,recipient_user_id FROM app_admin_notifications WHERE id=${id} FOR UPDATE`
+      if (!notification) throw new AdminError(404, 'ADMIN_NOTIFICATION_NOT_FOUND')
+      if (!['failed', 'blocked'].includes(notification.status))
+        throw new AdminError(409, 'ADMIN_NOTIFICATION_NOT_RETRYABLE')
+      const [user] =
+        await sql`SELECT email,email_verified_at FROM app_users WHERE id=${notification.recipient_user_id} AND status='active'`
+      const email = verifiedEmail(user?.email, user?.email_verified_at)
+      if (!email) throw new AdminError(409, 'ADMIN_VERIFIED_EMAIL_REQUIRED')
+      await sql`UPDATE app_admin_notifications SET status='pending',recipient_email=${email},attempt_id=NULL,claimed_at=NULL,error_code=NULL WHERE id=${id}`
+      return { status: 'pending' }
+    })
+  }
+}
diff --git a/apps/web/server/xcs/applications/domain.ts b/apps/web/server/xcs/applications/domain.ts
new file mode 100644
index 0000000..9fdb3ee
--- /dev/null
+++ b/apps/web/server/xcs/applications/domain.ts
@@ -0,0 +1,102 @@
+export interface OrganizationApplication {
+  id: string
+  name: string
+  status: 'active' | 'suspended' | 'closed'
+  applicationStatus: 'pending' | 'approved' | 'rejected' | 'suspended'
+  reviewReason: string | null
+  revision: number
+}
+
+export interface ApplicationInput {
+  name: string
+  website: string
+  contact: string
+  jurisdiction: string
+  description: string
+  purpose: string
+  documents: { mimeType: string; base64: string }[]
+}
+
+export class ApplicationError extends Error {
+  constructor(
+    readonly statusCode: number,
+    readonly code: string,
+  ) {
+    super(code)
+  }
+}
+
+export function inputObject(value: unknown, keys: string[]): Record<string, unknown> {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    Object.keys(value).some((key) => !keys.includes(key))
+  )
+    throw new ApplicationError(400, 'APPLICATION_INPUT_INVALID')
+  return value as Record<string, unknown>
+}
+
+export function inputText(value: unknown, max: number): string {
+  if (
+    typeof value !== 'string' ||
+    !value.trim() ||
+    value.length > max ||
+    Array.from(value).some(
+      (character) => character.charCodeAt(0) < 32 && !['\t', '\n', '\r'].includes(character),
+    )
+  )
+    throw new ApplicationError(400, 'APPLICATION_INPUT_INVALID')
+  return value.trim()
+}
+
+export function inputUuid(value: unknown): string {
+  const id = inputText(value, 36)
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id))
+    throw new ApplicationError(400, 'APPLICATION_INPUT_INVALID')
+  return id.toLowerCase()
+}
+
+export function parseApplicationInput(value: unknown): ApplicationInput {
+  const input = inputObject(value, [
+    'name',
+    'website',
+    'contact',
+    'jurisdiction',
+    'description',
+    'purpose',
+    'documents',
+  ])
+  const website = inputText(input.website, 2048)
+  try {
+    const url = new URL(website)
+    if (url.protocol !== 'https:' || url.username || url.password) throw new Error()
+  } catch {
+    throw new ApplicationError(400, 'APPLICATION_WEBSITE_INVALID')
+  }
+  if (!Array.isArray(input.documents) || input.documents.length < 1 || input.documents.length > 3)
+    throw new ApplicationError(400, 'APPLICATION_DOCUMENT_REQUIRED')
+  return {
+    name: inputText(input.name, 200),
+    website,
+    contact: inputText(input.contact, 1000),
+    jurisdiction: inputText(input.jurisdiction, 200),
+    description: inputText(input.description, 5000),
+    purpose: inputText(input.purpose, 5000),
+    documents: input.documents.map((value) => {
+      const document = inputObject(value, ['mimeType', 'base64'])
+      return {
+        mimeType: inputText(document.mimeType, 100),
+        base64: inputText(document.base64, Math.ceil((5 * 1024 * 1024) / 3) * 4),
+      }
+    }),
+  }
+}
+
+export interface ApplicationRepository {
+  apply(
+    session: import('../auth/types').Session,
+    input: ApplicationInput,
+    role: 'issuer' | 'verifier',
+  ): Promise<{ organizationId: string; status: 'pending' }>
+}
diff --git a/apps/web/server/xcs/auth/browser-harness.ts b/apps/web/server/xcs/auth/browser-harness.ts
new file mode 100644
index 0000000..557431c
--- /dev/null
+++ b/apps/web/server/xcs/auth/browser-harness.ts
@@ -0,0 +1,49 @@
+import { startOidcProvider } from '../../../test/helpers/oidcProvider'
+import { MemoryAuthRepository } from '../../../test/helpers/memoryAuth'
+import { OidcProvider } from './oidc'
+import { createAuthHandler } from './http'
+
+/** Loaded only by the guarded development branch in xcs-auth; never a production provider. */
+export async function createBrowserAuthHarness(value: string) {
+  if (
+    !import.meta.dev ||
+    process.env.XCS_BROWSER_E2E !== '1' ||
+    process.env.XCS_AUTH_BROWSER_E2E !== '1'
+  ) {
+    throw new Error('AUTH_BROWSER_E2E_FORBIDDEN')
+  }
+  const origin = new URL(value)
+  if (
+    origin.protocol !== 'http:' ||
+    origin.hostname !== '127.0.0.1' ||
+    origin.pathname !== '/' ||
+    origin.search ||
+    origin.hash
+  )
+    throw new Error('AUTH_BROWSER_E2E_ORIGIN_INVALID')
+  const stub = await startOidcProvider({
+    claims: {
+      sub: 'xcs-browser-user',
+      email: 'recipient@example.test',
+      email_verified: true,
+      name: 'Test recipient',
+    },
+  })
+  const provider = new OidcProvider({
+    issuerUrl: stub.issuer,
+    clientId: stub.clientId,
+    clientSecret: stub.clientSecret,
+    redirectUri: `${origin.origin}/api/auth/callback`,
+    allowLoopbackHttp: true,
+  })
+  return {
+    handler: createAuthHandler({
+      repository: new MemoryAuthRepository(),
+      provider,
+      origin: origin.origin,
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+    }),
+    close: stub.close,
+  }
+}
diff --git a/apps/web/server/xcs/auth/config.ts b/apps/web/server/xcs/auth/config.ts
new file mode 100644
index 0000000..eca9bb5
--- /dev/null
+++ b/apps/web/server/xcs/auth/config.ts
@@ -0,0 +1,104 @@
+import { readFileSync, statSync } from 'node:fs'
+
+import { apiSettings } from '../settings'
+
+export interface AuthConfig {
+  origin: string
+  issuerUrl: string
+  clientId: string
+  clientSecret: string
+  databaseUrl: string
+  idleSeconds: number
+  absoluteSeconds: number
+}
+
+function secret(env: NodeJS.ProcessEnv, name: string): string {
+  const direct = env[name]
+  const file = env[`${name}_FILE`]
+  if (direct && file) throw new Error('AUTH_SECRET_CONFLICT')
+  if (!file) return direct ?? ''
+  const stat = statSync(file)
+  if (!stat.isFile() || stat.size > 16384 || stat.size < 1) throw new Error('AUTH_SECRET_INVALID')
+  const value = readFileSync(file, 'utf8').replace(/\r?\n$/, '')
+  if (!value.trim() || /[\r\n]/.test(value)) throw new Error('AUTH_SECRET_INVALID')
+  return value
+}
+
+function seconds(value: string | undefined, fallback: number, max: number): number {
+  if (value === undefined || value === '') return fallback
+  if (!/^\d+$/.test(value)) throw new Error('AUTH_DURATION_INVALID')
+  const n = Number(value)
+  if (!Number.isSafeInteger(n) || n < 60 || n > max) throw new Error('AUTH_DURATION_INVALID')
+  return n
+}
+
+export function loadAuthConfig(env: NodeJS.ProcessEnv): AuthConfig | undefined {
+  const supplied = [
+    'XCS_AUTH_ORIGIN',
+    'XCS_IDENTITY_CLIENT_ID',
+    'XCS_IDENTITY_CLIENT_ID_FILE',
+    'XCS_IDENTITY_CLIENT_SECRET',
+    'XCS_IDENTITY_CLIENT_SECRET_FILE',
+    'NUXT_APP_DATABASE_URL',
+    'NUXT_APP_DATABASE_URL_FILE',
+  ].some((name) => (env[name] ?? '').trim().length > 0)
+  if (!supplied) return undefined
+  const clientId = secret(env, 'XCS_IDENTITY_CLIENT_ID')
+  const clientSecret = secret(env, 'XCS_IDENTITY_CLIENT_SECRET')
+  const databaseUrl = secret(env, 'NUXT_APP_DATABASE_URL')
+  if (!clientId || !clientSecret || !databaseUrl) throw new Error('AUTH_CONFIGURATION_REQUIRED')
+  let origin: URL, issuer: URL, database: URL
+  try {
+    origin = new URL(env.XCS_AUTH_ORIGIN ?? '')
+    issuer = new URL(env.XCS_IDENTITY_ISSUER ?? apiSettings.XCS_IDENTITY_ISSUER)
+    database = new URL(databaseUrl)
+  } catch {
+    throw new Error('AUTH_CONFIGURATION_INVALID')
+  }
+  if (
+    origin.protocol !== 'https:' ||
+    origin.pathname !== '/' ||
+    origin.search ||
+    origin.hash ||
+    origin.username ||
+    origin.password
+  ) {
+    throw new Error('AUTH_HTTPS_ORIGIN_REQUIRED')
+  }
+  if (
+    issuer.protocol !== 'https:' ||
+    issuer.search ||
+    issuer.hash ||
+    issuer.username ||
+    issuer.password
+  ) {
+    throw new Error('AUTH_HTTPS_ISSUER_REQUIRED')
+  }
+  if (
+    !['postgres:', 'postgresql:'].includes(database.protocol) ||
+    decodeURIComponent(database.username) !== 'xcs_app' ||
+    !database.password
+  ) {
+    throw new Error('AUTH_APPLICATION_DATABASE_ROLE_REQUIRED')
+  }
+  const idleSeconds = seconds(
+    env.XCS_AUTH_IDLE_SECONDS ?? apiSettings.XCS_AUTH_IDLE_SECONDS,
+    1800,
+    86400,
+  )
+  const absoluteSeconds = seconds(
+    env.XCS_AUTH_MAX_SECONDS ?? apiSettings.XCS_AUTH_MAX_SECONDS,
+    28800,
+    604800,
+  )
+  if (idleSeconds > absoluteSeconds) throw new Error('AUTH_DURATION_INVALID')
+  return {
+    origin: origin.origin,
+    issuerUrl: issuer.href.replace(/\/$/, ''),
+    clientId,
+    clientSecret,
+    databaseUrl,
+    idleSeconds,
+    absoluteSeconds,
+  }
+}
diff --git a/apps/web/server/xcs/auth/http.ts b/apps/web/server/xcs/auth/http.ts
new file mode 100644
index 0000000..df34452
--- /dev/null
+++ b/apps/web/server/xcs/auth/http.ts
@@ -0,0 +1,390 @@
+import { randomUUID, timingSafeEqual } from 'node:crypto'
+import { createAppToken, hashAppToken } from '../../lib/db/index.js'
+import { isValidClassicAddress } from 'xrpl'
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible'
+import {
+  createError,
+  createRouter,
+  defineEventHandler,
+  getCookie,
+  getHeader,
+  getQuery,
+  setCookie,
+  deleteCookie,
+  sendRedirect,
+  setResponseHeaders,
+  setResponseStatus,
+  type H3Event,
+} from 'h3'
+import { readJsonBody } from '../private-body'
+import type { AuthIdentityProvider } from './oidc'
+import { hasRole, type AuthRepository, type Session, type AppRole } from './types'
+import { verifyWalletProof } from './wallet-proof'
+import { authReturnPath } from '../../../app/utils/portalRoutes'
+
+export const SESSION_COOKIE = '__Host-xcs-session'
+const LOGIN_COOKIE = '__Host-xcs-login'
+const LINK_COOKIE = '__Host-xcs-link-handoff'
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+const COOKIE = { httpOnly: true, secure: true, sameSite: 'lax' as const, path: '/' }
+export interface AuthRuntimeOptions {
+  repository: AuthRepository
+  provider: AuthIdentityProvider
+  origin: string
+  idleSeconds: number
+  absoluteSeconds: number
+}
+const failure = (statusCode: number, message: string): never => {
+  throw createError({ statusCode, message })
+}
+function equal(left: string, right: string): boolean {
+  const a = Buffer.from(left),
+    b = Buffer.from(right)
+  return a.length === b.length && timingSafeEqual(a, b)
+}
+function cookieHash(event: H3Event): string | null {
+  return hashAppToken(getCookie(event, SESSION_COOKIE) ?? '')
+}
+export async function readAuthSession(
+  event: H3Event,
+  repository: AuthRepository,
+): Promise<Session | null> {
+  const hash = cookieHash(event)
+  return hash ? repository.session(hash) : null
+}
+export async function requireAuthSession(
+  event: H3Event,
+  repository: AuthRepository,
+): Promise<Session> {
+  return (await readAuthSession(event, repository)) ?? failure(401, 'AUTH_REQUIRED')
+}
+export async function requireAuthRole(
+  event: H3Event,
+  repository: AuthRepository,
+  role: AppRole,
+  organizationId?: string,
+): Promise<Session> {
+  const session = await requireAuthSession(event, repository)
+  if (!hasRole(session.account, role, organizationId)) failure(403, 'AUTH_NOT_AUTHORIZED')
+  return session
+}
+export function requireCsrf(event: H3Event, session: Session, origin: string): void {
+  if (
+    getHeader(event, 'origin') !== origin ||
+    !equal(getHeader(event, 'x-xcs-csrf') ?? '', session.csrfToken)
+  ) {
+    failure(403, 'AUTH_CSRF_REJECTED')
+  }
+  const site = getHeader(event, 'sec-fetch-site')
+  if (site && site !== 'same-origin' && site !== 'none') failure(403, 'AUTH_CSRF_REJECTED')
+}
+function sessionResponse(session: Session | null) {
+  return {
+    enabled: true,
+    user: session?.account ?? null,
+    ...(session
+      ? {
+          csrfToken: session.csrfToken,
+          expiresAt: session.expiresAt.toISOString(),
+          absoluteExpiresAt: session.absoluteExpiresAt.toISOString(),
+        }
+      : {}),
+  }
+}
+async function body(event: H3Event): Promise<Record<string, unknown>> {
+  const input = await readJsonBody(event, 4096)
+  if (!input || typeof input !== 'object' || Array.isArray(input))
+    failure(400, 'AUTH_INPUT_INVALID')
+  return input as Record<string, unknown>
+}
+function only(input: Record<string, unknown>, keys: string[]): void {
+  if (Object.keys(input).some((key) => !keys.includes(key))) failure(400, 'AUTH_INPUT_INVALID')
+}
+
+export function createAuthHandler(options: AuthRuntimeOptions) {
+  const { repository, provider, origin, idleSeconds, absoluteSeconds } = options
+  const router = createRouter()
+  const limits = new RateLimiterMemory({ points: 120, duration: 60 })
+  const mutations = new RateLimiterMemory({ points: 20, duration: 60 })
+  const sessionInput = () => ({
+    ...createAppToken(),
+    csrfToken: createAppToken().token,
+    idleSeconds,
+    absoluteSeconds,
+  })
+  const mutation = async (event: H3Event) => {
+    const session = await requireAuthSession(event, repository)
+    requireCsrf(event, session, origin)
+    await mutations.consume(`user:${session.userId}`)
+    return session
+  }
+  router.get(
+    '/api/auth/session',
+    defineEventHandler(async (event) => sessionResponse(await readAuthSession(event, repository))),
+  )
+  router.post(
+    '/api/auth/link-handoff',
+    defineEventHandler(async (event) => {
+      // Pre-authentication handoff: the browser must initiate an explicit same-origin POST.
+      // Merely opening a link cannot set the cookie or claim/disclose anything.
+      const site = getHeader(event, 'sec-fetch-site')
+      if (getHeader(event, 'origin') !== origin || (site && site !== 'same-origin'))
+        failure(403, 'AUTH_CSRF_REJECTED')
+      await mutations.consume(
+        `handoff:${event.context.xcsClientAddress ?? event.node.req.socket.remoteAddress ?? 'unknown'}`,
+      )
+      const input = await body(event)
+      only(input, ['kind', 'token'])
+      if (
+        !['invitation', 'presentation'].includes(String(input.kind)) ||
+        typeof input.token !== 'string' ||
+        !/^[A-Za-z0-9_-]{43}$/.test(input.token)
+      )
+        failure(400, 'AUTH_INPUT_INVALID')
+      setCookie(event, LINK_COOKIE, `${input.kind}.${input.token}`, { ...COOKIE, maxAge: 600 })
+      return { ok: true }
+    }),
+  )
+  router.post(
+    '/api/auth/link-handoff/consume',
+    defineEventHandler(async (event) => {
+      await mutation(event)
+      const input = await body(event)
+      only(input, ['kind'])
+      if (!['invitation', 'presentation'].includes(String(input.kind)))
+        failure(400, 'AUTH_INPUT_INVALID')
+      const stored = getCookie(event, LINK_COOKIE)
+      const match = /^(invitation|presentation)\.([A-Za-z0-9_-]{43})$/.exec(stored ?? '')
+      // A different page must not destroy a still-pending link of the other kind.
+      if (!match || match[1] !== input.kind) return { token: null }
+      deleteCookie(event, LINK_COOKIE, COOKIE)
+      return { token: match[2] }
+    }),
+  )
+  router.get(
+    '/api/auth/login',
+    defineEventHandler(async (event) => {
+      await mutations.consume(
+        `login:${event.context.xcsClientAddress ?? event.node.req.socket.remoteAddress ?? 'unknown'}`,
+      )
+      const query = getQuery(event)
+      const returnTo = authReturnPath(query.returnTo)
+      const state = createAppToken(),
+        browser = createAppToken()
+      const nonce = createAppToken().token,
+        codeVerifier = createAppToken().token
+      const url = await provider.authorizationUrl({ state: state.token, nonce, codeVerifier })
+      await repository.saveLogin({
+        stateHash: state.tokenHash,
+        browserHash: browser.tokenHash,
+        nonce,
+        codeVerifier,
+        returnTo,
+        expiresAt: new Date(Date.now() + 600000),
+      })
+      setCookie(event, LOGIN_COOKIE, browser.token, { ...COOKIE, maxAge: 600 })
+      return sendRedirect(event, url, 302)
+    }),
+  )
+  router.get(
+    '/api/auth/callback',
+    defineEventHandler(async (event) => {
+      const query = getQuery(event)
+      const browserHash = hashAppToken(getCookie(event, LOGIN_COOKIE) ?? '')
+      deleteCookie(event, LOGIN_COOKIE, COOKIE)
+      const stateHash = typeof query.state === 'string' ? hashAppToken(query.state) : null
+      if (!browserHash || !stateHash) return sendRedirect(event, '/auth/login?error=signin', 302)
+      const login = await repository.consumeLogin(stateHash, browserHash)
+      if (!login) return sendRedirect(event, '/auth/login?error=signin', 302)
+      try {
+        if (
+          query.error ||
+          typeof query.code !== 'string' ||
+          typeof query.state !== 'string' ||
+          query.code.length > 4096
+        )
+          throw new Error('AUTH_CALLBACK_INVALID')
+        const callbackUrl = new URL('/api/auth/callback', origin)
+        callbackUrl.searchParams.set('code', query.code)
+        callbackUrl.searchParams.set('state', query.state)
+        if (query.iss !== undefined) {
+          if (typeof query.iss !== 'string') throw new Error('AUTH_CALLBACK_INVALID')
+          callbackUrl.searchParams.set('iss', query.iss)
+        }
+        const identity = await provider.exchange({
+          callbackUrl,
+          state: query.state,
+          nonce: login.nonce,
+          codeVerifier: login.codeVerifier,
+        })
+        const input = sessionInput()
+        await repository.createSession(identity, input, cookieHash(event) ?? undefined)
+        setCookie(event, SESSION_COOKIE, input.token, { ...COOKIE, maxAge: idleSeconds })
+        return sendRedirect(event, login.returnTo, 302)
+      } catch {
+        // Provider errors and request URLs can contain tokens or personal data.
+        return sendRedirect(event, '/auth/login?error=signin', 302)
+      }
+    }),
+  )
+  router.post(
+    '/api/auth/refresh',
+    defineEventHandler(async (event) => {
+      const session = await mutation(event)
+      const input = sessionInput()
+      if (!(await repository.refresh(session.tokenHash, input))) failure(401, 'AUTH_REQUIRED')
+      const updated = await repository.session(input.tokenHash)
+      if (!updated) failure(401, 'AUTH_REQUIRED')
+      setCookie(event, SESSION_COOKIE, input.token, {
+        ...COOKIE,
+        maxAge: Math.max(0, Math.floor((updated.expiresAt.getTime() - Date.now()) / 1000)),
+      })
+      return sessionResponse(updated)
+    }),
+  )
+  router.post(
+    '/api/auth/logout',
+    defineEventHandler(async (event) => {
+      const session = await mutation(event)
+      await repository.logout(session.id)
+      deleteCookie(event, SESSION_COOKIE, COOKIE)
+      deleteCookie(event, LINK_COOKIE, COOKIE)
+      return { ok: true }
+    }),
+  )
+  router.get(
+    '/api/auth/access',
+    defineEventHandler(async (event) => {
+      const query = getQuery(event)
+      const role = query.role
+      if (typeof role !== 'string' || !['admin', 'recipient', 'issuer', 'verifier'].includes(role))
+        failure(400, 'AUTH_INPUT_INVALID')
+      const organizationId = query.organizationId
+      if (
+        organizationId !== undefined &&
+        (typeof organizationId !== 'string' || !UUID.test(organizationId))
+      )
+        failure(400, 'AUTH_INPUT_INVALID')
+      await requireAuthRole(
+        event,
+        repository,
+        role as AppRole,
+        organizationId as string | undefined,
+      )
+      return { authorized: true }
+    }),
+  )
+  router.post(
+    '/api/auth/wallet/challenge',
+    defineEventHandler(async (event) => {
+      const session = await mutation(event)
+      const input = await body(event)
+      only(input, ['address', 'networkId'])
+      // The existing XCS wallet flows are Testnet-only. Network is signed, never inferred from an address.
+      if (
+        typeof input.address !== 'string' ||
+        !isValidClassicAddress(input.address) ||
+        input.networkId !== 1
+      )
+        failure(400, 'AUTH_WALLET_INPUT_INVALID')
+      const id = randomUUID(),
+        expiresAt = new Date(Date.now() + 300000)
+      const message = [
+        'XCS wallet ownership proof',
+        `Origin: ${origin}`,
+        `User: ${session.userId}`,
+        `Session: ${session.id}`,
+        `Network: 1 (XRPL Testnet)`,
+        `Address: ${input.address}`,
+        `Challenge: ${id}`,
+        `Nonce: ${createAppToken().token}`,
+        `Expires: ${expiresAt.toISOString()}`,
+        'This message links this wallet to your XCS account. It does not authorize a transaction.',
+      ].join('\n')
+      if (
+        !(await repository.saveChallenge(session.tokenHash, {
+          id,
+          sessionId: session.id,
+          networkId: 1,
+          address: input.address as string,
+          message,
+          expiresAt,
+        }))
+      )
+        failure(401, 'AUTH_REQUIRED')
+      return { id, message, expiresAt: expiresAt.toISOString() }
+    }),
+  )
+  router.post(
+    '/api/auth/wallet/link',
+    defineEventHandler(async (event) => {
+      const session = await mutation(event),
+        input = await body(event)
+      only(input, ['challengeId', 'signature', 'publicKey', 'scheme'])
+      if (
+        typeof input.challengeId !== 'string' ||
+        !UUID.test(input.challengeId) ||
+        typeof input.signature !== 'string' ||
+        typeof input.publicKey !== 'string' ||
+        !['ripple', 'otsu'].includes(String(input.scheme))
+      )
+        failure(400, 'AUTH_WALLET_PROOF_INVALID')
+      const challenge = await repository.challenge(session.tokenHash, input.challengeId as string)
+      if (
+        !challenge ||
+        !verifyWalletProof(challenge.message, challenge.address, {
+          signature: input.signature as string,
+          publicKey: input.publicKey as string,
+          scheme: input.scheme as 'ripple' | 'otsu',
+        })
+      )
+        failure(400, 'AUTH_WALLET_PROOF_INVALID')
+      if (!(await repository.linkWallet(session.tokenHash, challenge.id)))
+        failure(409, 'AUTH_WALLET_LINK_UNAVAILABLE')
+      return sessionResponse(await repository.session(session.tokenHash))
+    }),
+  )
+  router.post(
+    '/api/auth/wallet/unlink',
+    defineEventHandler(async (event) => {
+      const session = await mutation(event),
+        input = await body(event)
+      only(input, ['walletId'])
+      if (typeof input.walletId !== 'string' || !UUID.test(input.walletId))
+        failure(400, 'AUTH_INPUT_INVALID')
+      if (!(await repository.unlinkWallet(session.tokenHash, input.walletId as string)))
+        failure(404, 'AUTH_WALLET_NOT_FOUND')
+      return sessionResponse(await repository.session(session.tokenHash))
+    }),
+  )
+  const routeHandler = router.handler
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, {
+      'cache-control': 'private, no-store',
+      'referrer-policy': 'no-referrer',
+      'x-content-type-options': 'nosniff',
+    })
+    try {
+      await limits.consume(
+        event.context.xcsClientAddress ?? event.node.req.socket.remoteAddress ?? 'unknown',
+      )
+      return await routeHandler(event)
+    } catch (error) {
+      const status =
+        error instanceof RateLimiterRes
+          ? 429
+          : ((error as { statusCode?: number })?.statusCode ?? 503)
+      const safeStatus = [400, 401, 403, 404, 405, 409, 413, 415, 429].includes(status)
+        ? status
+        : 503
+      setResponseStatus(event, safeStatus)
+      const code =
+        safeStatus === 429
+          ? 'AUTH_RATE_LIMITED'
+          : safeStatus === 503
+            ? 'AUTH_UNAVAILABLE'
+            : 'AUTH_REQUEST_REJECTED'
+      return { error: code }
+    }
+  })
+}
diff --git a/apps/web/server/xcs/auth/oidc.ts b/apps/web/server/xcs/auth/oidc.ts
new file mode 100644
index 0000000..f8ec97f
--- /dev/null
+++ b/apps/web/server/xcs/auth/oidc.ts
@@ -0,0 +1,182 @@
+import * as oidc from 'openid-client'
+
+export interface OidcSettings {
+  issuerUrl: string
+  clientId: string
+  clientSecret: string
+  redirectUri: string
+  allowLoopbackHttp?: boolean
+}
+
+export interface Identity {
+  issuer: string
+  subject: string
+  email?: string
+  emailVerified: boolean
+  displayName?: string
+}
+
+interface AuthorizationInput {
+  state: string
+  nonce: string
+  codeVerifier: string
+}
+
+export interface AuthIdentityProvider {
+  authorizationUrl(input: AuthorizationInput): Promise<string>
+  exchange(input: AuthorizationInput & { callbackUrl: URL }): Promise<Identity>
+}
+
+/** The HTTP exception is for an explicitly configured local test provider only. */
+function checkedUrl(value: string, allowLoopbackHttp: boolean): URL {
+  if (value.length > 2048) throw new Error('OIDC_URL_INVALID')
+  const url = new URL(value)
+  const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)
+  if (
+    url.username ||
+    url.password ||
+    url.hash ||
+    (url.protocol !== 'https:' && !(allowLoopbackHttp && loopback && url.protocol === 'http:'))
+  ) {
+    throw new Error('OIDC_URL_INVALID')
+  }
+  return url
+}
+
+function checkAuthorizationInput(input: AuthorizationInput): void {
+  if (!input.state || !input.nonce || !/^[A-Za-z0-9._~-]{43,128}$/u.test(input.codeVerifier)) {
+    throw new Error('OIDC_AUTHORIZATION_CONTEXT_INVALID')
+  }
+}
+
+export class OidcProvider implements AuthIdentityProvider {
+  private readonly settings: OidcSettings
+  private readonly allowLoopbackHttp: boolean
+  private configuration?: Promise<oidc.Configuration>
+
+  constructor(settings: OidcSettings) {
+    this.settings = { ...settings }
+    this.allowLoopbackHttp =
+      settings.allowLoopbackHttp === true && process.env.NODE_ENV !== 'production'
+    if (settings.allowLoopbackHttp === true && !this.allowLoopbackHttp) {
+      throw new Error('OIDC_HTTP_TEST_ONLY')
+    }
+    const issuer = checkedUrl(settings.issuerUrl, this.allowLoopbackHttp)
+    const redirect = checkedUrl(settings.redirectUri, this.allowLoopbackHttp)
+    if (
+      issuer.search ||
+      issuer.pathname.includes('/.well-known/') ||
+      redirect.search ||
+      !settings.clientId.trim() ||
+      !settings.clientSecret.trim()
+    ) {
+      throw new Error('OIDC_SETTINGS_INVALID')
+    }
+  }
+
+  private async discover(): Promise<oidc.Configuration> {
+    if (!this.configuration) {
+      this.configuration = oidc
+        .discovery(
+          new URL(this.settings.issuerUrl),
+          this.settings.clientId,
+          undefined,
+          oidc.ClientSecretBasic(this.settings.clientSecret),
+          {
+            timeout: 10,
+            execute: [
+              oidc.enableNonRepudiationChecks,
+              ...(this.allowLoopbackHttp ? [oidc.allowInsecureRequests] : []),
+            ],
+            [oidc.customFetch]: (url, options) => {
+              checkedUrl(String(url), this.allowLoopbackHttp)
+              const { body, ...fetchOptions } = options
+              // Never follow a provider redirect carrying client authentication or a code.
+              return fetch(url, {
+                ...fetchOptions,
+                ...(body === undefined
+                  ? {}
+                  : { body: body instanceof Uint8Array ? new Uint8Array(body).buffer : body }),
+                redirect: 'error',
+              })
+            },
+          },
+        )
+        .then((configuration) => {
+          const metadata = configuration.serverMetadata()
+          if (metadata.issuer !== this.settings.issuerUrl) throw new Error('OIDC_ISSUER_MISMATCH')
+          for (const endpoint of [
+            metadata.authorization_endpoint,
+            metadata.token_endpoint,
+            metadata.jwks_uri,
+          ]) {
+            if (!endpoint) throw new Error('OIDC_METADATA_INCOMPLETE')
+            checkedUrl(endpoint, this.allowLoopbackHttp)
+          }
+          return configuration
+        })
+        .catch((error: unknown) => {
+          // A temporary discovery outage must not poison this provider until restart.
+          this.configuration = undefined
+          throw error
+        })
+    }
+    return this.configuration
+  }
+
+  async authorizationUrl(input: AuthorizationInput): Promise<string> {
+    checkAuthorizationInput(input)
+    const configuration = await this.discover()
+    return oidc.buildAuthorizationUrl(configuration, {
+      redirect_uri: this.settings.redirectUri,
+      scope: 'openid profile email',
+      response_type: 'code',
+      state: input.state,
+      nonce: input.nonce,
+      code_challenge: await oidc.calculatePKCECodeChallenge(input.codeVerifier),
+      code_challenge_method: 'S256',
+    }).href
+  }
+
+  async exchange(input: AuthorizationInput & { callbackUrl: URL }): Promise<Identity> {
+    checkAuthorizationInput(input)
+    const callback = new URL(input.callbackUrl)
+    callback.search = ''
+    if (callback.href !== new URL(this.settings.redirectUri).href) {
+      throw new Error('OIDC_CALLBACK_MISMATCH')
+    }
+    const configuration = await this.discover()
+    const tokens = await oidc.authorizationCodeGrant(configuration, input.callbackUrl, {
+      expectedState: input.state,
+      expectedNonce: input.nonce,
+      pkceCodeVerifier: input.codeVerifier,
+      idTokenExpected: true,
+    })
+    const claims = tokens.claims()
+    if (
+      !claims ||
+      !claims.sub.trim() ||
+      claims.sub.length > 2048 ||
+      claims.iss.length > 2048 ||
+      (typeof claims.email === 'string' && claims.email.length > 320) ||
+      (typeof claims.name === 'string' && claims.name.length > 512)
+    ) {
+      throw new Error('OIDC_IDENTITY_INVALID')
+    }
+    // Provider roles and bearer tokens deliberately do not cross this boundary.
+    return {
+      issuer: claims.iss,
+      subject: claims.sub,
+      ...(typeof claims.email === 'string' && claims.email.length > 0
+        ? { email: claims.email }
+        : {}),
+      emailVerified:
+        claims.email_verified === true &&
+        typeof claims.email === 'string' &&
+        claims.email.length > 0,
+      ...(typeof claims.name === 'string' && claims.name.length > 0
+        ? { displayName: claims.name }
+        : {}),
+    }
+  }
+}
diff --git a/apps/web/server/xcs/auth/repository.ts b/apps/web/server/xcs/auth/repository.ts
new file mode 100644
index 0000000..aebe20c
--- /dev/null
+++ b/apps/web/server/xcs/auth/repository.ts
@@ -0,0 +1,176 @@
+import type { DatabaseClient } from '../../lib/db/index.js'
+import type { Identity } from './oidc'
+import type {
+  Account,
+  AuthRepository,
+  LoginTransaction,
+  Session,
+  SessionInput,
+  WalletChallenge,
+} from './types'
+
+export class PostgresAuthRepository implements AuthRepository {
+  constructor(private readonly client: DatabaseClient) {}
+
+  async saveLogin(login: LoginTransaction): Promise<void> {
+    const sql = this.client.sql
+    await sql`DELETE FROM app_auth_transactions WHERE expires_at <= statement_timestamp()`
+    await sql`INSERT INTO app_auth_transactions (state_hash, browser_hash, nonce, code_verifier, return_to, expires_at)
+      VALUES (${login.stateHash}, ${login.browserHash}, ${login.nonce}, ${login.codeVerifier}, ${login.returnTo}, ${login.expiresAt.toISOString()})`
+  }
+
+  async consumeLogin(stateHash: string, browserHash: string): Promise<LoginTransaction | null> {
+    const rows = await this.client.sql`DELETE FROM app_auth_transactions
+      WHERE state_hash = ${stateHash} AND browser_hash = ${browserHash} AND expires_at > statement_timestamp()
+      RETURNING state_hash, browser_hash, nonce, code_verifier, return_to, expires_at`
+    const row = rows[0]
+    return row
+      ? {
+          stateHash: row.state_hash,
+          browserHash: row.browser_hash,
+          nonce: row.nonce,
+          codeVerifier: row.code_verifier,
+          returnTo: row.return_to,
+          expiresAt: new Date(row.expires_at),
+        }
+      : null
+  }
+
+  async createSession(
+    identity: Identity,
+    input: SessionInput,
+    previousTokenHash?: string,
+  ): Promise<void> {
+    await this.client.sql.begin(async (sql) => {
+      // Identity equality never relies on an email address or a provider role claim.
+      const [user] =
+        await sql`INSERT INTO app_users (identity_issuer, identity_subject, email, email_verified_at, display_name)
+        VALUES (${identity.issuer}, ${identity.subject}, ${identity.email ?? null}, ${identity.email && identity.emailVerified ? new Date().toISOString() : null}, ${identity.displayName ?? null})
+        ON CONFLICT (identity_issuer, identity_subject) DO UPDATE SET email = EXCLUDED.email,
+          email_verified_at = EXCLUDED.email_verified_at, display_name = EXCLUDED.display_name
+        WHERE app_users.status = 'active' RETURNING id`
+      if (!user) throw new Error('AUTH_ACCOUNT_UNAVAILABLE')
+      // The database grants INSERT(user_id) only; its default can grant recipient, never admin.
+      await sql`INSERT INTO app_user_roles (user_id) VALUES (${user.id}) ON CONFLICT DO NOTHING`
+      if (previousTokenHash)
+        await sql`DELETE FROM app_sessions WHERE token_hash = ${previousTokenHash}`
+      await sql`DELETE FROM app_sessions WHERE expires_at <= statement_timestamp() OR absolute_expires_at <= statement_timestamp()`
+      await sql`INSERT INTO app_sessions (user_id, token_hash, csrf_token, expires_at, absolute_expires_at)
+        VALUES (${user.id}, ${input.tokenHash}, ${input.csrfToken}, statement_timestamp() + ${input.idleSeconds} * interval '1 second', statement_timestamp() + ${input.absoluteSeconds} * interval '1 second')`
+    })
+  }
+
+  async session(tokenHash: string): Promise<Session | null> {
+    const sql = this.client.sql
+    const [row] =
+      await sql`SELECT s.id, s.token_hash, s.user_id, s.csrf_token, s.expires_at, s.absolute_expires_at, u.email, u.display_name
+      FROM app_sessions s JOIN app_users u ON u.id = s.user_id
+      WHERE s.token_hash = ${tokenHash} AND s.expires_at > statement_timestamp()
+        AND s.absolute_expires_at > statement_timestamp() AND u.status = 'active'`
+    if (!row) return null
+    const roles =
+      await sql`SELECT role FROM app_user_roles WHERE user_id = ${row.user_id} AND revoked_at IS NULL`
+    const orgs = await sql`SELECT o.id, o.name, a.role FROM app_organizations o
+      JOIN app_organization_applications a ON a.organization_id = o.id
+      WHERE o.responsible_user_id = ${row.user_id} AND o.status = 'active' AND a.status = 'approved'`
+    const wallets =
+      await sql`SELECT id, address, network_id, verified_at FROM app_wallets WHERE user_id = ${row.user_id} AND revoked_at IS NULL ORDER BY verified_at, id`
+    const organizations: Account['organizations'] = []
+    for (const org of orgs) {
+      let found = organizations.find((item) => item.id === org.id)
+      if (!found) {
+        found = { id: org.id, name: org.name, roles: [] }
+        organizations.push(found)
+      }
+      found.roles.push(org.role)
+    }
+    return {
+      id: row.id,
+      tokenHash: row.token_hash,
+      userId: row.user_id,
+      csrfToken: row.csrf_token,
+      expiresAt: new Date(row.expires_at),
+      absoluteExpiresAt: new Date(row.absolute_expires_at),
+      account: {
+        id: row.user_id,
+        email: row.email,
+        displayName: row.display_name,
+        roles: roles.map((r) => r.role),
+        organizations,
+        wallets: wallets.map((w) => ({
+          id: w.id,
+          address: w.address,
+          networkId: Number(w.network_id),
+          verifiedAt: new Date(w.verified_at).toISOString(),
+        })),
+      },
+    }
+  }
+
+  async refresh(tokenHash: string, input: SessionInput): Promise<boolean> {
+    const rows = await this.client
+      .sql`UPDATE app_sessions s SET token_hash = ${input.tokenHash}, csrf_token = ${input.csrfToken},
+      expires_at = LEAST(s.absolute_expires_at, statement_timestamp() + ${input.idleSeconds} * interval '1 second')
+      FROM app_users u WHERE s.token_hash = ${tokenHash} AND u.id = s.user_id AND u.status = 'active'
+      AND s.expires_at > statement_timestamp() AND s.absolute_expires_at > statement_timestamp() RETURNING s.id`
+    return rows.length === 1
+  }
+
+  async logout(sessionId: string): Promise<void> {
+    await this.client.sql`DELETE FROM app_sessions WHERE id = ${sessionId}`
+  }
+
+  async saveChallenge(tokenHash: string, challenge: WalletChallenge): Promise<boolean> {
+    const rows = await this.client
+      .sql`INSERT INTO app_wallet_challenges (id, session_id, network_id, address, message, expires_at)
+      SELECT ${challenge.id}, s.id, ${challenge.networkId}, ${challenge.address}, ${challenge.message}, ${challenge.expiresAt.toISOString()}
+      FROM app_sessions s JOIN app_users u ON u.id = s.user_id WHERE s.token_hash = ${tokenHash}
+      AND u.status = 'active' AND s.expires_at > statement_timestamp() AND s.absolute_expires_at > statement_timestamp()
+      RETURNING id`
+    return rows.length === 1
+  }
+
+  async challenge(tokenHash: string, id: string): Promise<WalletChallenge | null> {
+    const [row] = await this.client.sql`SELECT c.* FROM app_wallet_challenges c
+      JOIN app_sessions s ON c.session_id = s.id JOIN app_users u ON u.id = s.user_id
+      WHERE c.id = ${id} AND s.token_hash = ${tokenHash} AND u.status = 'active'
+      AND c.expires_at > statement_timestamp() AND s.expires_at > statement_timestamp()
+      AND s.absolute_expires_at > statement_timestamp()`
+    return row
+      ? {
+          id: row.id,
+          sessionId: row.session_id,
+          networkId: Number(row.network_id),
+          address: row.address,
+          message: row.message,
+          expiresAt: new Date(row.expires_at),
+        }
+      : null
+  }
+
+  async linkWallet(tokenHash: string, id: string): Promise<boolean> {
+    return this.client.sql.begin(async (sql) => {
+      // DELETE RETURNING makes a concurrent or replayed proof unable to link twice.
+      const [challenge] =
+        await sql`DELETE FROM app_wallet_challenges c USING app_sessions s, app_users u
+        WHERE c.id = ${id} AND c.session_id = s.id AND s.token_hash = ${tokenHash}
+        AND u.id = s.user_id AND u.status = 'active' AND c.expires_at > statement_timestamp()
+        AND s.expires_at > statement_timestamp() AND s.absolute_expires_at > statement_timestamp()
+        RETURNING c.address, c.network_id, s.user_id`
+      if (!challenge) return false
+      const rows = await sql`INSERT INTO app_wallets (user_id, network_id, address, verified_at)
+        VALUES (${challenge.user_id}, ${challenge.network_id}, ${challenge.address}, statement_timestamp())
+        ON CONFLICT (network_id, address) DO UPDATE SET verified_at = EXCLUDED.verified_at, revoked_at = NULL
+        WHERE app_wallets.user_id = EXCLUDED.user_id RETURNING id`
+      return rows.length === 1
+    })
+  }
+
+  async unlinkWallet(tokenHash: string, walletId: string): Promise<boolean> {
+    const rows = await this.client.sql`UPDATE app_wallets w SET revoked_at = statement_timestamp()
+      FROM app_sessions s, app_users u WHERE s.token_hash = ${tokenHash} AND u.id = s.user_id
+      AND u.status = 'active' AND s.expires_at > statement_timestamp() AND s.absolute_expires_at > statement_timestamp()
+      AND w.id = ${walletId} AND w.user_id = s.user_id AND w.revoked_at IS NULL RETURNING w.id`
+    return rows.length === 1
+  }
+}
diff --git a/apps/web/server/xcs/auth/types.ts b/apps/web/server/xcs/auth/types.ts
new file mode 100644
index 0000000..2ea26b2
--- /dev/null
+++ b/apps/web/server/xcs/auth/types.ts
@@ -0,0 +1,63 @@
+import type { Identity } from './oidc'
+
+export type PersonalRole = 'admin' | 'recipient'
+export type OrganizationRole = 'issuer' | 'verifier'
+export type AppRole = PersonalRole | OrganizationRole
+export interface Account {
+  id: string
+  email: string | null
+  displayName: string | null
+  roles: PersonalRole[]
+  organizations: { id: string; name: string; roles: OrganizationRole[] }[]
+  wallets: { id: string; address: string; networkId: number; verifiedAt: string }[]
+}
+export interface Session {
+  id: string
+  tokenHash: string
+  userId: string
+  csrfToken: string
+  expiresAt: Date
+  absoluteExpiresAt: Date
+  account: Account
+}
+export interface LoginTransaction {
+  stateHash: string
+  browserHash: string
+  nonce: string
+  codeVerifier: string
+  returnTo: string
+  expiresAt: Date
+}
+export interface WalletChallenge {
+  id: string
+  sessionId: string
+  networkId: number
+  address: string
+  message: string
+  expiresAt: Date
+}
+export interface SessionInput {
+  tokenHash: string
+  csrfToken: string
+  idleSeconds: number
+  absoluteSeconds: number
+}
+export interface AuthRepository {
+  saveLogin(login: LoginTransaction): Promise<void>
+  consumeLogin(stateHash: string, browserHash: string): Promise<LoginTransaction | null>
+  createSession(identity: Identity, input: SessionInput, previousTokenHash?: string): Promise<void>
+  session(tokenHash: string): Promise<Session | null>
+  refresh(tokenHash: string, input: SessionInput): Promise<boolean>
+  logout(sessionId: string): Promise<void>
+  saveChallenge(tokenHash: string, challenge: WalletChallenge): Promise<boolean>
+  challenge(tokenHash: string, id: string): Promise<WalletChallenge | null>
+  linkWallet(tokenHash: string, id: string): Promise<boolean>
+  unlinkWallet(tokenHash: string, walletId: string): Promise<boolean>
+}
+
+export function hasRole(account: Account, role: AppRole, organizationId?: string): boolean {
+  if (role === 'admin' || role === 'recipient') return account.roles.includes(role)
+  return account.organizations.some(
+    (org) => (!organizationId || org.id === organizationId) && org.roles.includes(role),
+  )
+}
diff --git a/apps/web/server/xcs/auth/wallet-proof.ts b/apps/web/server/xcs/auth/wallet-proof.ts
new file mode 100644
index 0000000..f1f61dc
--- /dev/null
+++ b/apps/web/server/xcs/auth/wallet-proof.ts
@@ -0,0 +1,62 @@
+import { createHash, createPublicKey, verify } from 'node:crypto'
+
+import { deriveAddress, verify as verifyRippleSignature } from 'ripple-keypairs'
+
+export interface WalletProof {
+  signature: string
+  publicKey: string
+  scheme: 'ripple' | 'otsu'
+}
+
+/** Proves a master-key address only; regular keys and multisign accounts are unsupported. */
+export function verifyWalletProof(message: string, address: string, proof: WalletProof): boolean {
+  try {
+    if (
+      typeof message !== 'string' ||
+      message.length === 0 ||
+      Buffer.byteLength(message) > 8192 ||
+      !proof ||
+      typeof proof.publicKey !== 'string' ||
+      typeof proof.signature !== 'string' ||
+      !/^(?:02|03|ED)[0-9a-f]{64}$/iu.test(proof.publicKey) ||
+      !/^(?:[0-9a-f]{2}){64,72}$/iu.test(proof.signature)
+    ) {
+      return false
+    }
+    const publicKey = proof.publicKey.toUpperCase()
+    if (deriveAddress(publicKey) !== address) return false
+    if (proof.scheme === 'ripple') {
+      return verifyRippleSignature(
+        Buffer.from(message, 'utf8').toString('hex'),
+        proof.signature,
+        publicKey,
+      )
+    }
+    if (
+      proof.scheme !== 'otsu' ||
+      !/^(?:02|03)/u.test(publicKey) ||
+      proof.signature.length !== 128
+    ) {
+      return false
+    }
+    const key = createPublicKey({
+      key: Buffer.concat([
+        // SubjectPublicKeyInfo: ecPublicKey + secp256k1 + compressed 33-byte point.
+        Buffer.from('3036301006072a8648ce3d020106052b8104000a032200', 'hex'),
+        Buffer.from(publicKey, 'hex'),
+      ]),
+      format: 'der',
+      type: 'spki',
+    })
+    // Otsu hashes UTF-8 once, then noble/curves v2 signs with its default prehash=true.
+    const digest = createHash('sha256').update(message, 'utf8').digest()
+    return verify(
+      'sha256',
+      digest,
+      { key, dsaEncoding: 'ieee-p1363' },
+      Buffer.from(proof.signature, 'hex'),
+    )
+  } catch {
+    return false
+  }
+}
diff --git a/apps/web/server/xcs/config.ts b/apps/web/server/xcs/config.ts
index 69a1af7..1063b46 100644
--- a/apps/web/server/xcs/config.ts
+++ b/apps/web/server/xcs/config.ts
@@ -1,10 +1,14 @@
 import { isIP } from 'node:net'
 import { isValidClassicAddress } from 'xrpl'
-
+import { adminSecret } from './admin/config'
 import { apiEnvironment, apiSettings } from './settings'
 
 export interface ApiConfig {
   databaseUrl: string
+  payloadDatabaseUrl: string | undefined
+  hostedPayloads:
+    | { enabled: false }
+    | { enabled: true; publicBaseUrl: string; ipHashSecret: string; networks: string[] }
   trustedProxyCidrs: string[]
   ipfsGateway: string
   trustedIssuers: string[]
@@ -28,39 +32,27 @@ export interface ApiConfig {
       }
 }
 
-/**
- * The operational metrics routes are enabled by the presence of a usable
- * `XCS_METRICS_TOKEN` and by nothing else.
- *
- * No token means no routes, which is what an ordinary deployment that sets
- * nothing gets. A token that is present but malformed is a hard error rather
- * than a quiet fallback to "off": a typo in the one credential that guards the
- * snapshot must not silently produce an unmonitored deployment.
- */
 function operationalMetrics(environment: NodeJS.ProcessEnv): ApiConfig['operationalMetrics'] {
-  const supplied = environment.XCS_METRICS_TOKEN
-  if (supplied === undefined || supplied.trim().length === 0) return { enabled: false }
-  if (!/^[A-Za-z0-9_-]{32,256}$/u.test(supplied)) {
+  const token = adminSecret(environment, 'XCS_METRICS_TOKEN')
+  if (token.trim().length === 0) return { enabled: false }
+  if (!/^[A-Za-z0-9_-]{32,256}$/u.test(token)) {
     throw new Error('XCS_METRICS_TOKEN must be 32 to 256 URL-safe random characters')
   }
-  return { enabled: true, token: supplied }
+  return { enabled: true, token }
 }
 
-function requiredValue(value: string | undefined, name: string): string {
+function required(environment: NodeJS.ProcessEnv, name: string): string {
+  const value = adminSecret(environment, name)
   if (value === undefined || value.trim().length === 0) throw new Error(`${name} is required`)
   return value
 }
 
-function required(environment: NodeJS.ProcessEnv, name: string): string {
-  return requiredValue(environment[name], name)
-}
-
 function compatibleRequired(
   environment: NodeJS.ProcessEnv,
   primary: string,
   legacy: string,
 ): string {
-  const value = environment[primary] ?? environment[legacy]
+  const value = adminSecret(environment, primary) || adminSecret(environment, legacy)
   if (value === undefined || value.trim().length === 0) {
     throw new Error(`${primary} is required`)
   }
@@ -133,6 +125,56 @@ function origins(value: string | undefined): string[] {
   })
 }
 
+function databaseUrl(environment: NodeJS.ProcessEnv, name: string, role: string): string {
+  const value = required(environment, name)
+  try {
+    const url = new URL(value)
+    if (
+      !['postgres:', 'postgresql:'].includes(url.protocol) ||
+      decodeURIComponent(url.username) !== role
+    ) {
+      throw new Error('invalid role')
+    }
+  } catch {
+    // Connection URLs can contain secrets: never include their value or parser error.
+    throw new Error(`${name} must be a PostgreSQL URL for the ${role} role`)
+  }
+  return value
+}
+
+function hostedPayloadBaseUrl(value: string): string {
+  const parsed = new URL(value)
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.origin !== value ||
+    Buffer.byteLength(`${value}/p/${'0'.repeat(18)}#xcs-sha256=${'0'.repeat(64)}`, 'utf8') > 128
+  ) {
+    throw new Error(
+      'XCS_PUBLIC_PAYLOAD_BASE_URL must be a short HTTPS origin that produces a URI of at most 128 bytes',
+    )
+  }
+  return value
+}
+
+export function loadHostedPayloadConfig(
+  environment: NodeJS.ProcessEnv = apiEnvironment(),
+): ApiConfig['hostedPayloads'] {
+  const supplied = [
+    environment.XCS_PUBLIC_PAYLOAD_BASE_URL,
+    environment.XCS_PAYLOAD_STORAGE_IP_HASH_SECRET,
+    environment.XCS_HOSTED_PAYLOAD_NETWORKS,
+  ].some((value) => value !== undefined && value.trim().length > 0)
+  if (!supplied) return { enabled: false }
+  return {
+    enabled: true,
+    publicBaseUrl: hostedPayloadBaseUrl(required(environment, 'XCS_PUBLIC_PAYLOAD_BASE_URL')),
+    ipHashSecret: required(environment, 'XCS_PAYLOAD_STORAGE_IP_HASH_SECRET'),
+    networks: list(environment.XCS_HOSTED_PAYLOAD_NETWORKS),
+  }
+}
+
 export function loadApiConfig(environment: NodeJS.ProcessEnv = apiEnvironment()): ApiConfig {
   const readinessMaxLedgerAgeSeconds = Number(
     environment.XCS_READINESS_MAX_LEDGER_AGE_SECONDS ??
@@ -153,10 +195,7 @@ export function loadApiConfig(environment: NodeJS.ProcessEnv = apiEnvironment())
   const demoPinning = demoPinningEnabled
     ? {
         enabled: true as const,
-        kuboRpcUrl: requiredValue(
-          environment.XCS_IPFS_API_URL ?? apiSettings.XCS_IPFS_API_URL,
-          'XCS_IPFS_API_URL',
-        ),
+        kuboRpcUrl: environment.XCS_IPFS_API_URL ?? apiSettings.XCS_IPFS_API_URL,
         ipHashSecret: required(environment, 'XCS_PINNING_IP_HASH_SECRET'),
         networks: list(environment.XCS_PINNING_NETWORKS ?? apiSettings.XCS_PINNING_NETWORKS),
       }
@@ -165,6 +204,7 @@ export function loadApiConfig(environment: NodeJS.ProcessEnv = apiEnvironment())
     environment.XCS_TRUSTED_ISSUERS ?? apiSettings.XCS_TRUSTED_ISSUERS,
     'XCS_TRUSTED_ISSUERS',
   )
+  const hostedPayloads = loadHostedPayloadConfig(environment)
   const untrustedIssuers = addressList(
     environment.XCS_UNTRUSTED_ISSUERS ?? apiSettings.XCS_UNTRUSTED_ISSUERS,
     'XCS_UNTRUSTED_ISSUERS',
@@ -174,6 +214,11 @@ export function loadApiConfig(environment: NodeJS.ProcessEnv = apiEnvironment())
   }
   return {
     databaseUrl: compatibleRequired(environment, 'XCS_DATABASE_URL', 'DATABASE_URL'),
+    payloadDatabaseUrl:
+      hostedPayloads.enabled || demoPinningEnabled
+        ? databaseUrl(environment, 'XCS_PAYLOAD_DATABASE_URL', 'xcs_payload_writer')
+        : undefined,
+    hostedPayloads,
     trustedProxyCidrs: trustedProxyCidrs(environment.XCS_TRUSTED_PROXY_CIDRS),
     ipfsGateway:
       environment.XCS_IPFS_GATEWAY_URL ??
diff --git a/apps/web/server/xcs/credential-state.ts b/apps/web/server/xcs/credential-state.ts
index 1f10b1e..3e61fde 100644
--- a/apps/web/server/xcs/credential-state.ts
+++ b/apps/web/server/xcs/credential-state.ts
@@ -19,7 +19,7 @@ export function credentialGenerationState(
       closeTime,
     })
   } catch (error) {
-    if (error instanceof XcsError && error.code === 'INVALID_RIPPLE_TIME') {
+    if (error instanceof XcsError && error.code === 'RIPPLE_TIME_INVALID') {
       throw new IndexerUnavailableError(
         'INDEXER_EVIDENCE_INVALID',
         'The indexed credential lifecycle evidence is incomplete or inconsistent.',
diff --git a/apps/web/server/xcs/documents/config.ts b/apps/web/server/xcs/documents/config.ts
new file mode 100644
index 0000000..8aae66a
--- /dev/null
+++ b/apps/web/server/xcs/documents/config.ts
@@ -0,0 +1,60 @@
+import { isAbsolute } from 'node:path'
+import { serverSecret } from '../secrets'
+import type { PrivateDocumentStorageConfig } from './storage'
+
+const s3Bucket = /^(?!-)(?!.*\.\.)(?!.*-$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/
+const s3Region = /^[a-z0-9][a-z0-9-]{0,62}$/
+const s3Prefix = /^(?:[A-Za-z0-9][A-Za-z0-9._-]{0,62}\/)?$/
+
+export function loadPrivateDocumentStorageConfig(
+  env: NodeJS.ProcessEnv,
+): PrivateDocumentStorageConfig {
+  const driver = env.XCS_DOCUMENT_STORAGE_DRIVER
+  if (driver === 'filesystem') {
+    const directory = env.XCS_DOCUMENT_FILESYSTEM_DIRECTORY ?? ''
+    if (!isAbsolute(directory)) throw new Error('DOCUMENT_FILESYSTEM_DIRECTORY_REQUIRED')
+    if (env.NODE_ENV === 'production' && env.XCS_DOCUMENT_FILESYSTEM_LOCAL !== '1')
+      throw new Error('DOCUMENT_FILESYSTEM_LOCAL_ONLY')
+    return { driver, directory }
+  }
+  if (driver === 's3') {
+    const bucket = env.XCS_DOCUMENT_S3_BUCKET ?? '',
+      region = env.XCS_DOCUMENT_S3_REGION ?? '',
+      endpointValue = env.XCS_DOCUMENT_S3_ENDPOINT ?? '',
+      prefix = env.XCS_DOCUMENT_S3_PREFIX ?? '',
+      privateBucketConfirmed = env.XCS_DOCUMENT_S3_PRIVATE_BUCKET === '1',
+      accessKeyId = serverSecret(env, 'XCS_DOCUMENT_S3_ACCESS_KEY_ID'),
+      secretAccessKey = serverSecret(env, 'XCS_DOCUMENT_S3_SECRET_ACCESS_KEY')
+    let endpoint: URL
+    try {
+      endpoint = new URL(endpointValue)
+    } catch {
+      throw new Error('DOCUMENT_S3_CONFIGURATION_INVALID')
+    }
+    if (
+      endpoint.protocol !== 'https:' ||
+      endpoint.origin !== endpointValue ||
+      endpoint.username ||
+      endpoint.password ||
+      !s3Bucket.test(bucket) ||
+      !s3Region.test(region) ||
+      !s3Prefix.test(prefix) ||
+      !privateBucketConfirmed ||
+      !/^[A-Za-z0-9/+=._-]{8,256}$/.test(accessKeyId) ||
+      Buffer.byteLength(secretAccessKey) < 16 ||
+      Buffer.byteLength(secretAccessKey) > 1024
+    )
+      throw new Error('DOCUMENT_S3_CONFIGURATION_INVALID')
+    return {
+      driver,
+      bucket,
+      region,
+      endpoint: endpoint.origin,
+      prefix,
+      privateBucketConfirmed,
+      accessKeyId,
+      secretAccessKey,
+    }
+  }
+  throw new Error('DOCUMENT_STORAGE_DRIVER_REQUIRED')
+}
diff --git a/apps/web/server/xcs/documents/storage.ts b/apps/web/server/xcs/documents/storage.ts
new file mode 100644
index 0000000..69b39b5
--- /dev/null
+++ b/apps/web/server/xcs/documents/storage.ts
@@ -0,0 +1,292 @@
+import { createHash, randomBytes } from 'node:crypto'
+import { constants } from 'node:fs'
+import { link, lstat, mkdir, open, realpath, unlink } from 'node:fs/promises'
+import { isAbsolute, join, resolve, sep } from 'node:path'
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client,
+  type S3ClientConfig,
+} from '@aws-sdk/client-s3'
+
+export const MAX_PRIVATE_DOCUMENT_BYTES = 20 * 1024 * 1024
+
+const privateDocumentKey = /^[0-9a-f]{64}\.(?:pdf|png|jpg)$/
+export interface PrivateDocumentBackend {
+  put(storageKey: string, mimeType: string, bytes: Buffer): Promise<void>
+  get(storageKey: string, maximumBytes: number): Promise<Buffer | undefined>
+  delete(storageKey: string): Promise<void>
+  release?(storageKey: string): void
+  close?(): void
+}
+
+export interface StoredPrivateDocument {
+  storageKey: string
+  mimeType: string
+  byteLength: number
+  sha256: string
+}
+
+export type PrivateDocumentStorageConfig =
+  | { driver: 'filesystem'; directory: string }
+  | {
+      driver: 's3'
+      bucket: string
+      region: string
+      endpoint: string
+      prefix: string
+      privateBucketConfirmed: true
+      accessKeyId: string
+      secretAccessKey: string
+    }
+
+function storageKey(value: string): string {
+  if (!privateDocumentKey.test(value)) throw new Error('DOCUMENT_OBJECT_KEY_INVALID')
+  return value
+}
+
+function filesystemRoot(directory: string): void {
+  if (
+    !isAbsolute(directory) ||
+    resolve(directory) === sep ||
+    directory.split(sep).some((part) => ['public', 'static', '..'].includes(part))
+  )
+    throw new Error('DOCUMENT_FILESYSTEM_ROOT_INVALID')
+}
+
+/** A local-only backend with atomic publication and symlink-safe reads. */
+export class FilesystemPrivateDocumentBackend implements PrivateDocumentBackend {
+  private readonly owned = new Map<string, { root: string; dev: number; ino: number }>()
+
+  constructor(private readonly directory: string) {
+    filesystemRoot(directory)
+  }
+
+  private async root(): Promise<string> {
+    await mkdir(this.directory, { recursive: true, mode: 0o700 })
+    const stat = await lstat(this.directory)
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      throw new Error('DOCUMENT_FILESYSTEM_ROOT_INVALID')
+    const root = await realpath(this.directory)
+    if (root.split(sep).some((part) => ['public', 'static'].includes(part)))
+      throw new Error('DOCUMENT_FILESYSTEM_ROOT_INVALID')
+    return root
+  }
+
+  async put(key: string, _mimeType: string, bytes: Buffer): Promise<void> {
+    storageKey(key)
+    const root = await this.root()
+    const path = join(root, key)
+    const staging = join(root, `.upload-${randomBytes(32).toString('hex')}`)
+    const file = await open(
+      staging,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+      0o600,
+    )
+    let published = false
+    try {
+      await file.writeFile(bytes)
+      await file.sync()
+      const stat = await file.stat()
+      await link(staging, path)
+      published = true
+      const directory = await open(root, constants.O_RDONLY | constants.O_DIRECTORY)
+      try {
+        await directory.sync()
+      } finally {
+        await directory.close()
+      }
+      this.owned.set(key, { root, dev: stat.dev, ino: stat.ino })
+    } catch (error) {
+      if (published) await unlink(path).catch(() => undefined)
+      throw error
+    } finally {
+      await file.close()
+      await unlink(staging).catch(() => undefined)
+    }
+  }
+
+  async get(key: string, maximumBytes: number): Promise<Buffer | undefined> {
+    storageKey(key)
+    const root = await this.root()
+    const path = join(root, key)
+    try {
+      const actual = await realpath(path)
+      if (!actual.startsWith(root + sep) || actual !== path)
+        throw new Error('DOCUMENT_OBJECT_PATH_INVALID')
+      const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+      try {
+        const stat = await file.stat()
+        if (!stat.isFile() || stat.size > maximumBytes) throw new Error('DOCUMENT_OBJECT_TOO_LARGE')
+        const bytes = Buffer.alloc(maximumBytes + 1)
+        let length = 0
+        while (length < bytes.length) {
+          const result = await file.read(bytes, length, bytes.length - length, null)
+          if (!result.bytesRead) break
+          length += result.bytesRead
+        }
+        if (length > maximumBytes) throw new Error('DOCUMENT_OBJECT_TOO_LARGE')
+        return bytes.subarray(0, length)
+      } finally {
+        await file.close()
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined
+      throw error
+    }
+  }
+
+  async delete(key: string): Promise<void> {
+    storageKey(key)
+    const owned = this.owned.get(key)
+    if (!owned) throw new Error('DOCUMENT_OBJECT_CLEANUP_INVALID')
+    const path = join(owned.root, key)
+    try {
+      const stat = await lstat(path)
+      if (!stat.isFile() || stat.dev !== owned.dev || stat.ino !== owned.ino)
+        throw new Error('DOCUMENT_OBJECT_CLEANUP_INVALID')
+      await unlink(path)
+      this.owned.delete(key)
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+      this.owned.delete(key)
+    }
+  }
+
+  release(key: string): void {
+    this.owned.delete(key)
+  }
+}
+
+type S3Sender = Pick<S3Client, 'send' | 'destroy'>
+
+function isMissingObject(error: unknown): boolean {
+  const value = error as { name?: string; $metadata?: { httpStatusCode?: number } }
+  return (
+    value?.name === 'NoSuchKey' ||
+    value?.name === 'NotFound' ||
+    value?.$metadata?.httpStatusCode === 404
+  )
+}
+
+async function readBoundedBody(body: unknown, maximumBytes: number): Promise<Buffer> {
+  if (!body || typeof (body as AsyncIterable<unknown>)[Symbol.asyncIterator] !== 'function')
+    throw new Error('DOCUMENT_OBJECT_UNREADABLE')
+  const chunks: Buffer[] = []
+  let length = 0
+  for await (const chunk of body as AsyncIterable<Uint8Array | string>) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    length += bytes.length
+    if (length > maximumBytes) {
+      const destroy = (body as { destroy?: () => void }).destroy
+      destroy?.call(body)
+      throw new Error('DOCUMENT_OBJECT_TOO_LARGE')
+    }
+    chunks.push(bytes)
+  }
+  return Buffer.concat(chunks, length)
+}
+
+/** Private S3-compatible object storage, including DigitalOcean Spaces. */
+export class S3PrivateDocumentBackend implements PrivateDocumentBackend {
+  constructor(
+    private readonly client: S3Sender,
+    private readonly bucket: string,
+    private readonly prefix = '',
+  ) {}
+
+  private key(key: string): string {
+    return this.prefix + storageKey(key)
+  }
+
+  async put(key: string, mimeType: string, bytes: Buffer): Promise<void> {
+    await this.client.send(
+      new PutObjectCommand({
+        Bucket: this.bucket,
+        Key: this.key(key),
+        Body: bytes,
+        ContentLength: bytes.length,
+        ContentType: mimeType,
+        ACL: 'private',
+      }),
+    )
+  }
+
+  async get(key: string, maximumBytes: number): Promise<Buffer | undefined> {
+    try {
+      const result = await this.client.send(
+        new GetObjectCommand({
+          Bucket: this.bucket,
+          Key: this.key(key),
+          Range: `bytes=0-${maximumBytes}`,
+        }),
+      )
+      if (result.ContentLength !== undefined && result.ContentLength > maximumBytes)
+        throw new Error('DOCUMENT_OBJECT_TOO_LARGE')
+      return readBoundedBody(result.Body, maximumBytes)
+    } catch (error) {
+      if (isMissingObject(error)) return undefined
+      throw error
+    }
+  }
+
+  async delete(key: string): Promise<void> {
+    await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: this.key(key) }))
+  }
+
+  close(): void {
+    this.client.destroy()
+  }
+}
+
+export function createPrivateDocumentBackend(
+  config: PrivateDocumentStorageConfig,
+): PrivateDocumentBackend {
+  if (config.driver === 'filesystem') return new FilesystemPrivateDocumentBackend(config.directory)
+  if (config.privateBucketConfirmed !== true) throw new Error('DOCUMENT_S3_BUCKET_PRIVATE_REQUIRED')
+  const clientConfig: S3ClientConfig = {
+    region: config.region,
+    endpoint: config.endpoint,
+    forcePathStyle: false,
+    credentials: {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+    },
+  }
+  return new S3PrivateDocumentBackend(new S3Client(clientConfig), config.bucket, config.prefix)
+}
+
+export function privateDocumentDigest(bytes: Buffer): string {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+export async function readStoredPrivateDocument(
+  backend: PrivateDocumentBackend,
+  document: StoredPrivateDocument,
+): Promise<Buffer | undefined> {
+  storageKey(document.storageKey)
+  if (
+    !['application/pdf', 'image/png', 'image/jpeg'].includes(document.mimeType) ||
+    !Number.isSafeInteger(document.byteLength) ||
+    document.byteLength < 1 ||
+    document.byteLength > MAX_PRIVATE_DOCUMENT_BYTES ||
+    !/^[0-9a-f]{64}$/.test(document.sha256)
+  )
+    throw new Error('DOCUMENT_METADATA_INVALID')
+  const content = await backend.get(document.storageKey, document.byteLength)
+  if (!content) return undefined
+  const magic =
+    document.mimeType === 'application/pdf'
+      ? content.subarray(0, 5).equals(Buffer.from('%PDF-'))
+      : document.mimeType === 'image/png'
+        ? content.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))
+        : content.subarray(0, 3).equals(Buffer.from([255, 216, 255]))
+  if (
+    content.length !== document.byteLength ||
+    !magic ||
+    privateDocumentDigest(content) !== document.sha256
+  )
+    throw new Error('DOCUMENT_OBJECT_INTEGRITY_INVALID')
+  return content
+}
diff --git a/apps/web/server/xcs/handlers.ts b/apps/web/server/xcs/handlers.ts
index 7c5f8f9..5993754 100644
--- a/apps/web/server/xcs/handlers.ts
+++ b/apps/web/server/xcs/handlers.ts
@@ -34,6 +34,11 @@ import {
   encodeSchemaRegistrationCursor,
 } from './pagination.js'
 import { PinningError, type DemoPinningService } from './pinning.js'
+import {
+  HostedPayloadError,
+  HOSTED_PAYLOAD_LOCATOR_PATTERN,
+  type HostedPayloadService,
+} from './hosted-payloads.js'
 import { authoritativeSchemaCatalogBundle } from './schema-catalog.js'
 import {
   authoritativeResolvedSchema,
@@ -105,6 +110,7 @@ export interface CreateApiOptions {
   trustPolicy: TrustPolicy
   allowedOrigins?: string[]
   pinningService?: DemoPinningService
+  hostedPayloadService?: HostedPayloadService
   operationalMetrics?: {
     token: string
     repository: OperationalMetricsRepository
@@ -167,7 +173,7 @@ function validationMessage(context: string, validate: ValidateFunction): string
 }
 
 export function mapError(error: unknown): ApiReply {
-  if (error instanceof PinningError) {
+  if (error instanceof PinningError || error instanceof HostedPayloadError) {
     return {
       statusCode: error.statusCode,
       headers: {},
@@ -396,6 +402,82 @@ export function createApiHandlers(options: CreateApiOptions): ApiHandlers {
 
   const routes: RouteDefinition[] = []
 
+  if (options.hostedPayloadService) {
+    const service = options.hostedPayloadService
+    const params = {
+      type: 'object',
+      additionalProperties: false,
+      required: ['locator'],
+      properties: { locator: { type: 'string', pattern: HOSTED_PAYLOAD_LOCATOR_PATTERN } },
+    }
+    routes.push(
+      route<{ locator: string }>(
+        'GET',
+        '/p/:locator',
+        {
+          schema: { params },
+          rateLimit: { max: 300, timeWindowMs: 60_000, scope: 'route' },
+        },
+        async (request, reply) => {
+          const payload = await service.get(request.params.locator)
+          return reply
+            .header('cache-control', 'public, max-age=31536000, immutable')
+            .header('content-type', 'application/json; charset=utf-8')
+            .header('etag', `"${payload.digestHex}"`)
+            .header('x-content-type-options', 'nosniff')
+            .send(payload.content)
+        },
+      ),
+    )
+    routes.push(
+      route<
+        { locator: string },
+        Record<string, string | undefined>,
+        { network: string; payloadBase64: string; signedTransactionBlob: string }
+      >(
+        'POST',
+        '/v1/payloads/:locator',
+        {
+          schema: {
+            params,
+            body: {
+              type: 'object',
+              additionalProperties: false,
+              required: ['network', 'payloadBase64', 'signedTransactionBlob'],
+              properties: {
+                network: { type: 'string', pattern: PROFILE_PATTERN },
+                payloadBase64: { type: 'string', minLength: 4, maxLength: 90_000 },
+                signedTransactionBlob: {
+                  type: 'string',
+                  pattern: '^(?:[0-9A-Fa-f]{2})+$',
+                  maxLength: 32768,
+                },
+              },
+            },
+            response: {
+              400: errorResponseSchema,
+              401: errorResponseSchema,
+              403: errorResponseSchema,
+              404: errorResponseSchema,
+              409: errorResponseSchema,
+              413: errorResponseSchema,
+              429: errorResponseSchema,
+              503: errorResponseSchema,
+            },
+          },
+          bodyLimitBytes: 128 * 1024,
+          rateLimit: { max: 20, timeWindowMs: 60_000, scope: 'route' },
+        },
+        async (request) =>
+          service.publish({
+            ...request.body,
+            locator: request.params.locator,
+            ipAddress: request.ip,
+          }),
+      ),
+    )
+  }
+
   for (const path of ['/health/live', '/health']) {
     routes.push(
       route('GET', path, { rateLimit: false, cacheControl: 'no-store' }, async () => ({
diff --git a/apps/web/server/xcs/hosted-payload-resolver.ts b/apps/web/server/xcs/hosted-payload-resolver.ts
new file mode 100644
index 0000000..5e99076
--- /dev/null
+++ b/apps/web/server/xcs/hosted-payload-resolver.ts
@@ -0,0 +1,40 @@
+import { type HostedPayloadService, HostedPayloadError } from './hosted-payloads.js'
+import { PayloadUnavailableError, PayloadInvalidError } from './payload-resolver.js'
+import type { PayloadResolver } from './types.js'
+import { parsePayloadUri } from '#xcs/core/index.js'
+export class HostedPayloadResolver implements PayloadResolver {
+  constructor(
+    private readonly origin: string,
+    private readonly hosted: HostedPayloadService,
+    private readonly external: PayloadResolver,
+  ) {}
+  async resolve(uri: string) {
+    const parsed = parsePayloadUri(uri)
+    if (parsed.kind !== 'https') return this.external.resolve(uri)
+    const url = new URL(parsed.fetchUrl)
+    const match = /^\/p\/([0-9a-f]{18}|[0-9a-f]{20})$/u.exec(url.pathname)
+    if (
+      url.origin !== this.origin ||
+      url.username !== '' ||
+      url.password !== '' ||
+      url.search !== '' ||
+      match === null
+    ) {
+      return this.external.resolve(uri)
+    }
+    try {
+      const payload = await this.hosted.get(match[1]!)
+      return new TextEncoder().encode(payload.content)
+    } catch (error) {
+      if (error instanceof HostedPayloadError) {
+        if (error.code === 'PAYLOAD_NOT_FOUND') {
+          throw new PayloadUnavailableError('Hosted payload not found', { cause: error })
+        }
+        if (error.code === 'PAYLOAD_STORAGE_INTEGRITY_ERROR') {
+          throw new PayloadInvalidError('Hosted payload storage integrity failed', { cause: error })
+        }
+      }
+      throw error
+    }
+  }
+}
diff --git a/apps/web/server/xcs/hosted-payloads-repository.ts b/apps/web/server/xcs/hosted-payloads-repository.ts
new file mode 100644
index 0000000..7cdee40
--- /dev/null
+++ b/apps/web/server/xcs/hosted-payloads-repository.ts
@@ -0,0 +1,109 @@
+import type { DatabaseClient } from '../lib/db/index.js'
+import { HostedPayloadError, type HostedPayloadRepository } from './hosted-payloads.js'
+import {
+  hostedPayloadPublications,
+  hostedPayloads,
+  runSerializableTransaction,
+} from '../lib/db/index.js'
+import { and, count, eq, gte, or } from 'drizzle-orm'
+export class PostgresHostedPayloadRepository implements HostedPayloadRepository {
+  constructor(private readonly db: DatabaseClient['db']) {}
+  async get(locator: string) {
+    const [row] = await this.db
+      .select({
+        locator: hostedPayloads.locator,
+        digestHex: hostedPayloads.digestHex,
+        content: hostedPayloads.content,
+      })
+      .from(hostedPayloads)
+      .where(eq(hostedPayloads.locator, locator))
+      .limit(1)
+    return row
+  }
+  async publish(input: Parameters<HostedPayloadRepository['publish']>[0]) {
+    return runSerializableTransaction(this.db, async (tx) => {
+      const [existingPublication] = await tx
+        .select()
+        .from(hostedPayloadPublications)
+        .where(eq(hostedPayloadPublications.transactionHash, input.transactionHash))
+        .limit(1)
+      if (existingPublication !== void 0) {
+        if (
+          existingPublication.locator !== input.locator ||
+          existingPublication.profileId !== input.profileId ||
+          existingPublication.issuer !== input.issuer ||
+          existingPublication.subject !== input.subject ||
+          existingPublication.schemaUid !== input.schemaUid
+        ) {
+          throw new HostedPayloadError('PAYLOAD_PUBLICATION_CONFLICT', 409)
+        }
+        const [existingPayload] = await tx
+          .select({
+            locator: hostedPayloads.locator,
+            digestHex: hostedPayloads.digestHex,
+            content: hostedPayloads.content,
+          })
+          .from(hostedPayloads)
+          .where(eq(hostedPayloads.locator, input.locator))
+          .limit(1)
+        if (
+          existingPayload === void 0 ||
+          existingPayload.digestHex !== input.digestHex ||
+          existingPayload.content !== input.content
+        ) {
+          throw new HostedPayloadError('PAYLOAD_STORAGE_INTEGRITY_ERROR', 500)
+        }
+        return existingPayload
+      }
+      const since = new Date(input.now.getTime() - 24 * 60 * 60 * 1e3)
+      const [quota] = await tx
+        .select({ value: count() })
+        .from(hostedPayloadPublications)
+        .where(
+          and(
+            gte(hostedPayloadPublications.createdAt, since),
+            or(
+              eq(hostedPayloadPublications.issuer, input.issuer),
+              eq(hostedPayloadPublications.requesterIpHash, input.requesterIpHash),
+            ),
+          ),
+        )
+      if ((quota?.value ?? 0) >= input.dailyLimit) {
+        throw new HostedPayloadError('PAYLOAD_PUBLICATION_QUOTA_EXCEEDED', 429)
+      }
+      await tx
+        .insert(hostedPayloads)
+        .values({
+          locator: input.locator,
+          digestHex: input.digestHex,
+          content: input.content,
+          createdAt: input.now,
+        })
+        .onConflictDoNothing()
+      const [payload] = await tx
+        .select({
+          locator: hostedPayloads.locator,
+          digestHex: hostedPayloads.digestHex,
+          content: hostedPayloads.content,
+        })
+        .from(hostedPayloads)
+        .where(eq(hostedPayloads.locator, input.locator))
+        .limit(1)
+      if (payload === void 0) throw new HostedPayloadError('PAYLOAD_STORAGE_UNAVAILABLE', 503)
+      if (payload.digestHex !== input.digestHex || payload.content !== input.content) {
+        throw new HostedPayloadError('PAYLOAD_LOCATOR_COLLISION', 409)
+      }
+      await tx.insert(hostedPayloadPublications).values({
+        transactionHash: input.transactionHash,
+        locator: input.locator,
+        profileId: input.profileId,
+        issuer: input.issuer,
+        subject: input.subject,
+        schemaUid: input.schemaUid,
+        requesterIpHash: input.requesterIpHash,
+        createdAt: input.now,
+      })
+      return payload
+    })
+  }
+}
diff --git a/apps/web/server/xcs/hosted-payloads.ts b/apps/web/server/xcs/hosted-payloads.ts
new file mode 100644
index 0000000..36fe565
--- /dev/null
+++ b/apps/web/server/xcs/hosted-payloads.ts
@@ -0,0 +1,283 @@
+import { createHmac } from 'node:crypto'
+import {
+  parseCredentialPayload,
+  parseJson,
+  parsePayloadUri,
+  payloadDigest,
+} from '#xcs/core/index.js'
+import {
+  assertXcsTransactionSemantics,
+  credentialHexToUri,
+  decodeSignedTransactionBlob,
+} from '#xcs/sdk/index.js'
+import { assertAuthoritativeLedgerEvidence } from './indexer-status.js'
+import { DEFAULT_LEDGER_MAX_AGE_SECONDS } from './ledger-freshness.js'
+import { authoritativeResolvedSchema, schemaProjectionEvidenceUids } from './schema-projection.js'
+import type { ApiRepository } from './types.js'
+
+export interface HostedPayloadRecord {
+  readonly locator: string
+  readonly digestHex: string
+  readonly content: string
+}
+export interface HostedPayloadRepository {
+  publish(input: {
+    locator: string
+    digestHex: string
+    content: string
+    transactionHash: string
+    profileId: string
+    issuer: string
+    subject: string
+    schemaUid: string
+    requesterIpHash: string
+    now: Date
+    dailyLimit: number
+  }): Promise<HostedPayloadRecord>
+  get(locator: string): Promise<HostedPayloadRecord | undefined>
+}
+export interface HostedPayloadServiceOptions {
+  readonly repository: HostedPayloadRepository
+  readonly apiRepository: ApiRepository
+  readonly publicBaseUrl: string
+  readonly ipHashSecret: string
+  readonly enabledNetworks: ReadonlySet<string>
+  readonly maxLedgerAgeSeconds?: number
+  readonly now?: () => Date
+}
+export const HOSTED_PAYLOAD_MAX_BYTES = 64 * 1024
+export const HOSTED_PAYLOAD_LOCATOR_HEX_LENGTH = 18
+export const HOSTED_PAYLOAD_LOCATOR_PATTERN = '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'
+const validLocator = new RegExp(HOSTED_PAYLOAD_LOCATOR_PATTERN, 'u')
+const DAILY_PUBLICATION_LIMIT = 50
+export class HostedPayloadError extends Error {
+  constructor(
+    readonly code: string,
+    readonly statusCode: number,
+    options: { cause?: unknown } = {},
+  ) {
+    super(code, options)
+    this.name = 'HostedPayloadError'
+  }
+}
+export function hostedPayloadLocator(digestHex: string) {
+  if (!/^[0-9a-f]{64}$/u.test(digestHex)) {
+    throw new HostedPayloadError('PAYLOAD_DIGEST_INVALID', 400)
+  }
+  return digestHex.slice(0, HOSTED_PAYLOAD_LOCATOR_HEX_LENGTH)
+}
+export function hostedPayloadFetchUrl(publicBaseUrl: string, locator: string) {
+  if (!validLocator.test(locator)) {
+    throw new HostedPayloadError('PAYLOAD_LOCATOR_INVALID', 400)
+  }
+  return `${publicBaseUrl}/p/${locator}`
+}
+function decodePayloadBase64(value: string) {
+  if (
+    value.length === 0 ||
+    value.length % 4 !== 0 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value)
+  ) {
+    throw new HostedPayloadError('PAYLOAD_BASE64_INVALID', 400)
+  }
+  const content = Uint8Array.from(Buffer.from(value, 'base64'))
+  if (content.length === 0 || content.length > HOSTED_PAYLOAD_MAX_BYTES) {
+    throw new HostedPayloadError('PAYLOAD_SIZE_INVALID', 413)
+  }
+  return content
+}
+function hashIp(ipAddress: string, secret: string) {
+  return createHmac('sha256', secret).update(ipAddress, 'utf8').digest('hex')
+}
+export class HostedPayloadService {
+  constructor(private readonly options: HostedPayloadServiceOptions) {
+    if (Buffer.byteLength(options.ipHashSecret, 'utf8') < 32) {
+      throw new Error('Hosted payload IP hash secret must contain at least 32 bytes')
+    }
+    this.now = options.now ?? (() => new Date())
+  }
+  private readonly now: () => Date
+  async get(locator: string) {
+    if (!validLocator.test(locator)) {
+      throw new HostedPayloadError('PAYLOAD_NOT_FOUND', 404)
+    }
+    const payload = await this.options.repository.get(locator)
+    if (payload === undefined) throw new HostedPayloadError('PAYLOAD_NOT_FOUND', 404)
+    if (payload.locator !== locator || payload.digestHex.slice(0, locator.length) !== locator) {
+      throw new HostedPayloadError('PAYLOAD_STORAGE_INTEGRITY_ERROR', 500)
+    }
+    if (payloadDigest(payload.content) !== payload.digestHex) {
+      throw new HostedPayloadError('PAYLOAD_STORAGE_INTEGRITY_ERROR', 500)
+    }
+    return payload
+  }
+  async publish(input: {
+    network: string
+    locator: string
+    payloadBase64: string
+    signedTransactionBlob: string
+    ipAddress: string
+  }) {
+    if (!this.options.enabledNetworks.has(input.network)) {
+      throw new HostedPayloadError('PAYLOAD_HOSTING_NETWORK_DISABLED', 404)
+    }
+    const bytes = decodePayloadBase64(input.payloadBase64)
+    const digestHex = payloadDigest(bytes)
+    if (hostedPayloadLocator(digestHex) !== input.locator) {
+      throw new HostedPayloadError('PAYLOAD_LOCATOR_MISMATCH', 400)
+    }
+    let signed
+    try {
+      signed = decodeSignedTransactionBlob(input.signedTransactionBlob)
+    } catch (error) {
+      throw new HostedPayloadError('SIGNED_TRANSACTION_INVALID', 401, { cause: error })
+    }
+    const validated = await this.options.apiRepository.withConsistentSnapshot(
+      async (repository) => {
+        const network = await repository.getNetwork(input.network)
+        if (network === undefined) throw new HostedPayloadError('NETWORK_NOT_FOUND', 404)
+        if (network.networkId !== 1) {
+          throw new HostedPayloadError('PAYLOAD_HOSTING_NETWORK_DISABLED', 404)
+        }
+        let semantics
+        try {
+          semantics = assertXcsTransactionSemantics(signed.transaction, {
+            profileId: network.profileId,
+            xcsVersion: network.xcsVersion,
+            networkId: network.networkId,
+            requiredAmendment: network.requiredAmendment,
+            registryAddress: network.registryAddress,
+            registrationAmountDrops: String(network.registrationAmountDrops),
+            activationLedgerIndex: network.activationLedgerIndex,
+            activationLedgerHash: network.activationLedgerHash,
+          })
+        } catch (error) {
+          throw new HostedPayloadError('SIGNED_TRANSACTION_INVALID', 401, { cause: error })
+        }
+        if (semantics.kind !== 'credential-create') {
+          throw new HostedPayloadError('SIGNED_TRANSACTION_NOT_CREDENTIAL_CREATE', 400)
+        }
+        const transaction = semantics.transaction
+        const expectedFetchUrl = hostedPayloadFetchUrl(this.options.publicBaseUrl, input.locator)
+        let credentialUri
+        try {
+          if (transaction.URI === undefined) throw new Error('signed URI missing')
+          credentialUri = credentialHexToUri(transaction.URI)
+          const parsedUri = parsePayloadUri(credentialUri)
+          if (
+            parsedUri.kind !== 'https' ||
+            parsedUri.fetchUrl !== expectedFetchUrl ||
+            parsedUri.digestHex !== digestHex
+          ) {
+            throw new Error('signed URI mismatch')
+          }
+        } catch (error) {
+          throw new HostedPayloadError('SIGNED_TRANSACTION_PAYLOAD_MISMATCH', 403, {
+            cause: error,
+          })
+        }
+        let header: Record<string, unknown>
+        try {
+          const parsed = parseJson(bytes)
+          if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            throw new Error('payload is not an object')
+          }
+          header = parsed as Record<string, unknown>
+        } catch (error) {
+          throw new HostedPayloadError('PAYLOAD_INVALID', 400, { cause: error })
+        }
+        if (
+          header.issuer !== transaction.Account ||
+          header.subject !== transaction.Subject ||
+          header.schema !== semantics.schemaUid
+        ) {
+          throw new HostedPayloadError('SIGNED_TRANSACTION_PAYLOAD_MISMATCH', 403)
+        }
+        const databaseNow = await repository.getDatabaseTime()
+        const status = await repository.getIndexerStatus(input.network)
+        const checkpoint = await repository.getLatestCheckpoint(input.network)
+        const authority = {
+          expectedProfileId: input.network,
+          status,
+          checkpoint,
+          now: databaseNow,
+          maxLedgerAgeSeconds: this.options.maxLedgerAgeSeconds ?? DEFAULT_LEDGER_MAX_AGE_SECONDS,
+          minimumLedgerIndex: network.activationLedgerIndex,
+        }
+        assertAuthoritativeLedgerEvidence({ ...authority, projectionLedgerIndexes: [] })
+        const schemaRow = await repository.getSchema(input.network, semantics.schemaUid)
+        if (schemaRow === undefined) throw new HostedPayloadError('SCHEMA_NOT_FOUND', 404)
+        const schemaEvidence = await repository.getSchemaProjectionEvidence({
+          profileId: input.network,
+          schemaUids: schemaProjectionEvidenceUids([schemaRow], input.network),
+        })
+        assertAuthoritativeLedgerEvidence({
+          ...authority,
+          projectionLedgerIndexes: schemaEvidence.map((item) => item.schema.ledgerIndex),
+        })
+        const schema = authoritativeResolvedSchema(schemaRow, schemaEvidence, {
+          profileId: input.network,
+          schemaUid: semantics.schemaUid,
+          networkId: network.networkId,
+          activationLedgerIndex: network.activationLedgerIndex,
+        })
+        const transactionEvents = await repository.getCredentialEventsByTransaction({
+          profileId: input.network,
+          transactionHash: signed.txHash.toLowerCase(),
+          issuer: transaction.Account,
+          subject: transaction.Subject,
+          schemaUid: semantics.schemaUid,
+          limit: 2,
+        })
+        if (
+          transactionEvents.length !== 1 ||
+          transactionEvents[0]?.eventType !== 'created' ||
+          transactionEvents[0].uriHex?.toLowerCase() !== transaction.URI?.toLowerCase()
+        ) {
+          throw new HostedPayloadError('SIGNED_TRANSACTION_NOT_INDEXED', 409)
+        }
+        assertAuthoritativeLedgerEvidence({
+          ...authority,
+          projectionLedgerIndexes: [transactionEvents[0].ledgerIndex],
+        })
+        try {
+          parseCredentialPayload(bytes, {
+            issuer: transaction.Account,
+            subject: transaction.Subject,
+            schemaUid: semantics.schemaUid,
+            fields: schema.fields,
+          })
+        } catch (error) {
+          throw new HostedPayloadError('PAYLOAD_INVALID', 400, { cause: error })
+        }
+        return {
+          transactionHash: signed.txHash.toLowerCase(),
+          issuer: transaction.Account,
+          subject: transaction.Subject,
+          schemaUid: semantics.schemaUid,
+          content: new TextDecoder('utf-8', { fatal: true }).decode(bytes),
+        }
+      },
+    )
+    const stored = await this.options.repository.publish({
+      locator: input.locator,
+      digestHex,
+      content: validated.content,
+      transactionHash: validated.transactionHash,
+      profileId: input.network,
+      issuer: validated.issuer,
+      subject: validated.subject,
+      schemaUid: validated.schemaUid,
+      requesterIpHash: hashIp(input.ipAddress, this.options.ipHashSecret),
+      now: this.now(),
+      dailyLimit: DAILY_PUBLICATION_LIMIT,
+    })
+    return {
+      uri: `${hostedPayloadFetchUrl(this.options.publicBaseUrl, stored.locator)}#xcs-sha256=${stored.digestHex}`,
+      fetchUrl: hostedPayloadFetchUrl(this.options.publicBaseUrl, stored.locator),
+      digestHex: stored.digestHex,
+      byteLength: Buffer.byteLength(stored.content, 'utf8'),
+      transactionHash: validated.transactionHash,
+    }
+  }
+}
diff --git a/apps/web/server/xcs/issuer/config.ts b/apps/web/server/xcs/issuer/config.ts
new file mode 100644
index 0000000..9f6461c
--- /dev/null
+++ b/apps/web/server/xcs/issuer/config.ts
@@ -0,0 +1,37 @@
+import { adminSecret } from '../admin/config'
+import { loadAuthConfig } from '../auth/config'
+import { loadPrivateDocumentStorageConfig } from '../documents/config'
+import { apiSettings } from '../settings'
+export function loadIssuerConfig(env: NodeJS.ProcessEnv) {
+  const supplied = ['NUXT_ISSUER_DATABASE_URL', 'NUXT_ISSUER_DATABASE_URL_FILE'].some(
+    (name) => (env[name] ?? '').trim().length > 0,
+  )
+  if (!supplied) return undefined
+  if (loadAuthConfig(env) === undefined) throw new Error('ISSUER_AUTH_REQUIRED')
+  const databaseUrl = adminSecret(env, 'NUXT_ISSUER_DATABASE_URL')
+  let database: URL, origin: URL
+  try {
+    database = new URL(databaseUrl)
+    origin = new URL(env.XCS_AUTH_ORIGIN ?? '')
+  } catch {
+    throw new Error('ISSUER_CONFIGURATION_INVALID')
+  }
+  if (
+    !['postgres:', 'postgresql:'].includes(database.protocol) ||
+    decodeURIComponent(database.username) !== 'xcs_issuer' ||
+    !database.password
+  )
+    throw new Error('ISSUER_DATABASE_ROLE_REQUIRED')
+  if (
+    origin.protocol !== 'https:' ||
+    origin.origin !== env.XCS_AUTH_ORIGIN ||
+    origin.username ||
+    origin.password
+  )
+    throw new Error('ISSUER_ORIGIN_INVALID')
+  const storage = loadPrivateDocumentStorageConfig(env)
+  const lifetime = env.XCS_ISSUER_INVITE_DAYS ?? apiSettings.XCS_ISSUER_INVITE_DAYS
+  if (!/^\d+$/.test(lifetime) || Number(lifetime) < 1 || Number(lifetime) > 30)
+    throw new Error('ISSUER_INVITE_LIFETIME_INVALID')
+  return { databaseUrl, origin: origin.origin, storage, inviteDays: Number(lifetime) }
+}
diff --git a/apps/web/server/xcs/issuer/http.ts b/apps/web/server/xcs/issuer/http.ts
new file mode 100644
index 0000000..14c274b
--- /dev/null
+++ b/apps/web/server/xcs/issuer/http.ts
@@ -0,0 +1,236 @@
+import {
+  createRouter,
+  defineEventHandler,
+  getQuery,
+  getRequestIP,
+  getRouterParam,
+  setResponseHeaders,
+  setResponseStatus,
+  type H3Event,
+} from 'h3'
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible'
+import type { Session } from '../auth/types'
+import { readJsonBody } from '../private-body'
+import type { IssuerRepository } from './repository'
+import { IssuerError, applicationInput, disclosure, email, hash, object, text, uuid } from './types'
+
+export interface IssuerHandlerOptions {
+  repository: IssuerRepository
+  authorize: (event: H3Event, mutation: boolean) => Promise<Session>
+  readSession: (event: H3Event) => Promise<Session | null>
+}
+export function createIssuerHandler({ repository, authorize, readSession }: IssuerHandlerOptions) {
+  const router = createRouter(),
+    sessions = new WeakMap<H3Event, Session>()
+  const limits = new RateLimiterMemory({ points: 120, duration: 60 }),
+    mutations = new RateLimiterMemory({ points: 20, duration: 60 })
+  const publicLimits = new RateLimiterMemory({ points: 60, duration: 60 })
+  const input = async (event: H3Event, keys: string[], limit = 8192) =>
+    object(await readJsonBody(event, limit), keys)
+  const param = (event: H3Event, key: string) => getRouterParam(event, key)
+  router.get(
+    '/api/issuer/workspace',
+    defineEventHandler((event) => {
+      const query = getQuery(event)
+      if (Object.keys(query).some((key) => key !== 'organizationId'))
+        throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+      return repository.workspace(
+        sessions.get(event)!,
+        query.organizationId === undefined ? undefined : uuid(query.organizationId),
+      )
+    }),
+  )
+  router.post(
+    '/api/issuer/applications',
+    defineEventHandler(async (event) =>
+      repository.apply(
+        sessions.get(event)!,
+        applicationInput(await readJsonBody(event, 22 * 1024 * 1024)),
+      ),
+    ),
+  )
+  router.post(
+    '/api/issuer/schemas',
+    defineEventHandler(async (event) => {
+      const body = await input(event, [
+        'organizationId',
+        'profileId',
+        'transactionHash',
+        'displayName',
+        'category',
+      ])
+      return repository.registerSchema(sessions.get(event)!, {
+        organizationId: uuid(body.organizationId),
+        profileId: text(body.profileId, 200),
+        transactionHash: hash(body.transactionHash),
+        displayName: text(body.displayName, 200, false),
+        category: text(body.category, 200, false),
+      })
+    }),
+  )
+  router.post(
+    '/api/issuer/invites',
+    defineEventHandler(async (event) => {
+      const body = await input(event, [
+        'organizationId',
+        'profileId',
+        'schemaUid',
+        'email',
+        'message',
+      ])
+      return repository.invite(sessions.get(event)!, {
+        organizationId: uuid(body.organizationId),
+        profileId: text(body.profileId, 200),
+        schemaUid: hash(body.schemaUid),
+        email: email(body.email),
+        message: text(body.message, 2000, false),
+      })
+    }),
+  )
+  for (const action of ['resend', 'revoke'] as const)
+    router.post(
+      `/api/issuer/invites/:id/${action}`,
+      defineEventHandler(async (event) => {
+        await input(event, [])
+        return repository.changeInvite(sessions.get(event)!, uuid(param(event, 'id')), action)
+      }),
+    )
+  router.get(
+    '/api/issuer/invites/:id/issuance',
+    defineEventHandler((event) =>
+      repository.issuance(sessions.get(event)!, uuid(param(event, 'id'))),
+    ),
+  )
+  router.post(
+    '/api/issuer/payloads',
+    defineEventHandler(async (event) => {
+      const body = await input(
+        event,
+        ['inviteId', 'canonicalPayload', 'subjectAddress', 'visibility', 'publicFields'],
+        2 * 1024 * 1024,
+      )
+      // Preserve canonical bytes exactly; trimming would hide a caller's noncanonical input.
+      if (
+        typeof body.canonicalPayload !== 'string' ||
+        Buffer.byteLength(body.canonicalPayload) > 1024 * 1024
+      )
+        throw new IssuerError(400, 'ISSUER_PAYLOAD_INVALID')
+      return repository.preparePayload(sessions.get(event)!, {
+        inviteId: uuid(body.inviteId),
+        canonicalPayload: body.canonicalPayload,
+        subjectAddress: text(body.subjectAddress, 50),
+        ...disclosure(body),
+      })
+    }),
+  )
+  router.post(
+    '/api/issuer/credentials',
+    defineEventHandler(async (event) => {
+      const body = await input(event, [
+        'inviteId',
+        'transactionHash',
+        'payloadId',
+        'visibility',
+        'publicFields',
+      ])
+      return repository.recordCredential(sessions.get(event)!, {
+        inviteId: uuid(body.inviteId),
+        transactionHash: hash(body.transactionHash),
+        payloadId: uuid(body.payloadId),
+        ...disclosure(body),
+      })
+    }),
+  )
+  router.get(
+    '/api/issuer/credentials/:profileId/:generationId',
+    defineEventHandler((event) =>
+      repository.credential(
+        sessions.get(event)!,
+        text(param(event, 'profileId'), 200),
+        hash(param(event, 'generationId')),
+      ),
+    ),
+  )
+  router.post(
+    '/api/issuer/credentials/:profileId/:generationId/reconcile',
+    defineEventHandler(async (event) => {
+      const body = await input(event, ['transactionHash'])
+      return repository.refreshCredential(
+        sessions.get(event)!,
+        text(param(event, 'profileId'), 200),
+        hash(param(event, 'generationId')),
+        hash(body.transactionHash),
+      )
+    }),
+  )
+  const servePayload = async (event: H3Event, byLocator: boolean) => {
+    const id = byLocator ? text(param(event, 'locator'), 18) : uuid(param(event, 'id'))
+    if (byLocator && !/^[0-9a-f]{18}$/.test(id))
+      throw new IssuerError(404, 'ISSUER_PAYLOAD_NOT_FOUND')
+    const result = await repository.payload(await readSession(event), id, byLocator)
+    setResponseHeaders(event, {
+      'content-type': 'application/json; charset=utf-8',
+      'content-security-policy': "default-src 'none'; sandbox",
+      'x-xcs-claim-scope': result.scope,
+    })
+    return result.content
+  }
+  router.get(
+    '/api/issuer/payloads/:id',
+    defineEventHandler((event) => servePayload(event, false)),
+  )
+  router.get(
+    '/q/:locator',
+    defineEventHandler((event) => servePayload(event, true)),
+  )
+  for (const action of ['preview', 'claim'] as const)
+    router.post(
+      `/api/issuer/invitations/${action}`,
+      defineEventHandler(async (event) => {
+        const body = await input(event, ['token'])
+        return repository.invitation(sessions.get(event)!, text(body.token, 43), action === 'claim')
+      }),
+    )
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, {
+      'cache-control': 'private, no-store',
+      'referrer-policy': 'no-referrer',
+      'x-content-type-options': 'nosniff',
+      'x-frame-options': 'DENY',
+    })
+    try {
+      const publicPayload =
+        event.method === 'GET' &&
+        (/^\/api\/issuer\/payloads\/[^/]+$/.test(event.path.split('?')[0]!) ||
+          /^\/q\/[^/]+$/.test(event.path.split('?')[0]!))
+      if (!publicPayload) {
+        const session = await authorize(event, event.method !== 'GET')
+        sessions.set(event, session)
+        await limits.consume(session.userId)
+        if (event.method !== 'GET') await mutations.consume(session.userId)
+      } else await publicLimits.consume(getRequestIP(event) ?? 'unknown')
+      return await router.handler(event)
+    } catch (error) {
+      const code =
+        error instanceof RateLimiterRes
+          ? 429
+          : ((error as { statusCode?: number })?.statusCode ?? 503)
+      const status = [400, 401, 403, 404, 405, 409, 413, 415, 422, 429].includes(code) ? code : 503
+      setResponseStatus(event, status)
+      return {
+        error:
+          error instanceof IssuerError
+            ? error.code
+            : status === 401
+              ? 'AUTH_REQUIRED'
+              : status === 403
+                ? 'AUTH_NOT_AUTHORIZED'
+                : status === 429
+                  ? 'ISSUER_RATE_LIMITED'
+                  : 'ISSUER_UNAVAILABLE',
+      }
+    } finally {
+      sessions.delete(event)
+    }
+  })
+}
diff --git a/apps/web/server/xcs/issuer/notifications.ts b/apps/web/server/xcs/issuer/notifications.ts
new file mode 100644
index 0000000..530c9d1
--- /dev/null
+++ b/apps/web/server/xcs/issuer/notifications.ts
@@ -0,0 +1,178 @@
+import {
+  classifySmtpFailure,
+  DEFAULT_NOTIFICATION_SENDER,
+  isNotificationEmail,
+  type NotificationMessage,
+  type NotificationSender,
+  type NotificationTransport,
+} from '../notifications/smtp'
+
+export interface IssuerNotification {
+  id: string
+  kind: 'invitation' | 'issued' | 'revoked'
+  recipientEmail: string
+  organizationName: string
+  claimUrl?: string
+  schemaName?: string
+  expiresAt?: string
+  message?: string | null
+}
+
+export interface IssuerNotificationResult {
+  status: 'sent' | 'failed' | 'uncertain'
+  errorCode: string | null
+}
+
+const SMTP_DEADLINE_MS = 60_000
+
+function hasControlCharacters(value: string, allowWhitespace = false): boolean {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0)
+    return (code < 32 && !(allowWhitespace && [9, 10, 13].includes(code))) || code === 127
+  })
+}
+
+const html = (value: string) =>
+  value.replace(
+    /[&<>"']/g,
+    (character) =>
+      ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]!,
+  )
+
+export function createIssuerNotificationMessage(
+  input: IssuerNotification,
+  sender: NotificationSender = DEFAULT_NOTIFICATION_SENDER,
+): NotificationMessage {
+  if (
+    !isNotificationEmail(input.recipientEmail) ||
+    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(input.id) ||
+    typeof input.organizationName !== 'string' ||
+    input.organizationName.length < 1 ||
+    input.organizationName.length > 200 ||
+    hasControlCharacters(input.organizationName) ||
+    (input.message != null &&
+      (typeof input.message !== 'string' ||
+        input.message.length > 2000 ||
+        hasControlCharacters(input.message, true))) ||
+    (input.schemaName != null &&
+      (input.schemaName.length < 1 ||
+        input.schemaName.length > 200 ||
+        hasControlCharacters(input.schemaName)))
+  )
+    throw new Error('ISSUER_NOTIFICATION_INVALID')
+  let subject: string
+  let text: string[]
+  let htmlBody: string | undefined
+  if (input.kind === 'invitation') {
+    let url: URL
+    try {
+      url = new URL(input.claimUrl ?? '')
+    } catch {
+      throw new Error('ISSUER_NOTIFICATION_INVALID')
+    }
+    if (
+      url.protocol !== 'https:' ||
+      url.username ||
+      url.password ||
+      url.pathname !== '/recipient/invitations' ||
+      url.search ||
+      !/^#[A-Za-z0-9_-]{43}$/.test(url.hash) ||
+      (input.claimUrl?.length ?? 0) > 4096
+    )
+      throw new Error('ISSUER_NOTIFICATION_INVALID')
+    if (!input.schemaName || !input.expiresAt || !Number.isFinite(Date.parse(input.expiresAt)))
+      throw new Error('ISSUER_NOTIFICATION_INVALID')
+    const expiration = new Date(input.expiresAt).toISOString()
+    subject = 'XCS — Credential invitation / Invitation à recevoir une attestation'
+    text = [
+      `${input.organizationName} invites you to receive a credential.`,
+      `Attestation: ${input.schemaName}`,
+      `Link expires: ${expiration}`,
+      `${input.organizationName} vous invite à recevoir une attestation.`,
+      `Attestation : ${input.schemaName}`,
+      `Expiration du lien : ${expiration}`,
+      '',
+      'Open my invitation / Ouvrir mon invitation:',
+      url.href,
+      '',
+      'This link is personal. Do not forward it. XCS will never ask for a recovery phrase or private key.',
+      'Ce lien est personnel. Ne le transférez pas. XCS ne demandera jamais de phrase de récupération ni de clé privée.',
+    ]
+    if (input.message) text.push('', input.message)
+    htmlBody = [
+      `<p><strong>${html(input.organizationName)}</strong> invites you to receive / vous invite à recevoir :</p>`,
+      `<p>${html(input.schemaName)}</p>`,
+      `<p>Expires / Expire : ${html(expiration)}</p>`,
+      `<p><a href="${html(url.href)}">Open my invitation / Ouvrir mon invitation</a></p>`,
+      '<p>This link is personal; do not forward it. XCS will never ask for a recovery phrase or private key.<br>Ce lien est personnel ; ne le transférez pas. XCS ne demandera jamais de phrase de récupération ni de clé privée.</p>',
+      input.message ? `<p>${html(input.message).replace(/\n/g, '<br>')}</p>` : '',
+    ].join('')
+  } else if (input.kind === 'issued') {
+    subject = 'XCS — Credential issued / Attestation émise'
+    text = [
+      `${input.organizationName} has issued your credential.`,
+      `${input.organizationName} a émis votre attestation.`,
+      '',
+      'Sign in to your XCS account to view its status.',
+      'Connectez-vous à votre compte XCS pour consulter son état.',
+    ]
+  } else if (input.kind === 'revoked') {
+    subject = 'XCS — Credential revoked / Attestation révoquée'
+    text = [
+      `${input.organizationName} has revoked your credential.`,
+      `${input.organizationName} a révoqué votre attestation.`,
+      '',
+      'Sign in to your XCS account to view its status.',
+      'Connectez-vous à votre compte XCS pour consulter son état.',
+    ]
+  } else {
+    throw new Error('ISSUER_NOTIFICATION_INVALID')
+  }
+  return {
+    from: { name: sender.name, address: sender.address },
+    to: { name: '', address: input.recipientEmail },
+    envelope: { from: sender.envelopeFrom, to: [input.recipientEmail] },
+    messageId: `<issuer-${input.id}@${sender.messageIdDomain}>`,
+    subject,
+    text: text.join('\n'),
+    ...(htmlBody ? { html: htmlBody } : {}),
+  }
+}
+
+/** Call exactly once after claiming a delivery in PostgreSQL. Never retries SMTP. */
+export async function sendIssuerNotification(
+  transport: NotificationTransport,
+  input: IssuerNotification,
+  sender?: NotificationSender,
+): Promise<IssuerNotificationResult> {
+  let message: NotificationMessage
+  try {
+    message = createIssuerNotificationMessage(input, sender)
+  } catch {
+    return { status: 'failed', errorCode: 'ISSUER_NOTIFICATION_INVALID' }
+  }
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const result = await Promise.race([
+      transport.sendMail(message),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error('SMTP_DEADLINE')), SMTP_DEADLINE_MS)
+      }),
+    ])
+    return result.accepted.length === 1 &&
+      result.accepted[0] === input.recipientEmail &&
+      result.rejected.length === 0
+      ? { status: 'sent', errorCode: null }
+      : { status: 'uncertain', errorCode: 'SMTP_ACCEPTANCE_UNCERTAIN' }
+  } catch (error) {
+    const status = classifySmtpFailure(error)
+    // SMTP exception text may contain the invitation URL or recipient. Never retain
+    // it in the database or logs, including when the server accepted before a reset.
+    return {
+      status,
+      errorCode: status === 'failed' ? 'SMTP_REJECTED' : 'SMTP_ACCEPTANCE_UNCERTAIN',
+    }
+  } finally {
+    if (timer) clearTimeout(timer)
+  }
+}
diff --git a/apps/web/server/xcs/issuer/repository.ts b/apps/web/server/xcs/issuer/repository.ts
new file mode 100644
index 0000000..fb806ac
--- /dev/null
+++ b/apps/web/server/xcs/issuer/repository.ts
@@ -0,0 +1,623 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import {
+  canonicalJson,
+  createHttpsPayloadUri,
+  decodeHexUtf8,
+  parseCredentialPayload,
+  payloadDigest,
+  type SchemaFields,
+} from '#xcs/core/index.js'
+import {
+  createAppToken,
+  filterCredentialClaims,
+  getCredentialAccess,
+  hashAppToken,
+  type Claims,
+  type DatabaseClient,
+} from '../../lib/db/index.js'
+import type { Session } from '../auth/types'
+import type { IssuerDocumentStore } from './storage'
+import type { IssuerNotification, IssuerNotificationResult } from './notifications'
+import { IssuerError, type ApplicationInput } from './types'
+import { isNotificationEmail } from '../admin/notifications'
+
+type Query = DatabaseClient['sql']
+const iso = (value: unknown): string | null =>
+  value == null ? null : new Date(String(value)).toISOString()
+export interface IssuerRepositoryOptions {
+  origin: string
+  inviteDays: number
+  documents: IssuerDocumentStore
+  notify: (message: IssuerNotification) => Promise<IssuerNotificationResult>
+}
+
+export class IssuerRepository {
+  constructor(
+    private readonly client: DatabaseClient,
+    private readonly options: IssuerRepositoryOptions,
+  ) {}
+
+  private async session(sql: Query, session: Session) {
+    const [current] = await sql`SELECT s.id FROM app_sessions s JOIN app_users u ON u.id=s.user_id
+      WHERE s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+      AND u.status='active' AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()`
+    if (!current) throw new IssuerError(401, 'AUTH_REQUIRED')
+  }
+
+  private async organization(sql: Query, session: Session, id: string, approved = true) {
+    await this.session(sql, session)
+    const [org] =
+      await sql`SELECT o.id,o.name,o.status,a.status AS application_status FROM app_organizations o
+      JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='issuer'
+      WHERE o.id=${id} AND o.responsible_user_id=${session.userId}`
+    if (!org) throw new IssuerError(404, 'ISSUER_ORGANIZATION_NOT_FOUND')
+    if (approved && (org.status !== 'active' || org.application_status !== 'approved'))
+      throw new IssuerError(403, 'ISSUER_APPROVAL_REQUIRED')
+    return org
+  }
+
+  async workspace(session: Session, selected?: string) {
+    await this.session(this.client.sql, session)
+    const organizations = await this.client
+      .sql`SELECT o.id,o.name,o.status,a.status AS "applicationStatus",a.review_reason AS "reviewReason",a.revision
+      FROM app_organizations o JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='issuer'
+      WHERE o.responsible_user_id=${session.userId} ORDER BY o.created_at,o.id`
+    const id = selected ?? organizations[0]?.id ?? null
+    if (id && !organizations.some((org) => org.id === id))
+      throw new IssuerError(404, 'ISSUER_ORGANIZATION_NOT_FOUND')
+    if (!id)
+      return {
+        organizations,
+        selectedOrganizationId: null,
+        schemas: [],
+        invites: [],
+        credentials: [],
+      }
+    const schemas = await this.client
+      .sql`SELECT m.profile_id AS "profileId",m.schema_uid AS "schemaUid",m.display_name AS "displayName",m.category,
+      s.name,s.publisher,m.registration_transaction_hash AS "registrationTransactionHash" FROM app_schema_metadata m
+      LEFT JOIN schemas s ON s.profile_id=m.profile_id AND s.schema_uid=m.schema_uid WHERE m.organization_id=${id} ORDER BY m.created_at DESC LIMIT 200`
+    const invites = await this.client
+      .sql`SELECT i.id,i.organization_id AS "organizationId",i.profile_id AS "profileId",i.schema_uid AS "schemaUid",
+      i.delivery_email AS email,i.created_at AS "createdAt",i.expires_at AS "expiresAt",i.claimed_by AS "claimedBy",i.claimed_at AS "claimedAt",i.revoked_at AS "revokedAt",
+      CASE WHEN d.status='sending' AND d.created_at<statement_timestamp()-interval '2 minutes' THEN 'uncertain' ELSE d.status END AS "deliveryStatus",d.error_code AS "deliveryError",
+      recipient.display_name AS "recipientDisplayName",wallet.verified_at AS "recipientWalletVerifiedAt",
+      CASE WHEN i.revoked_at IS NOT NULL OR NOT n.enabled OR n.network_id<>1
+        OR (i.claimed_by IS NOT NULL AND recipient.status<>'active') THEN 'unavailable'
+        WHEN m.generation_id IS NOT NULL THEN 'issued'
+        WHEN i.claimed_by IS NULL THEN 'invited'
+        WHEN wallet.verified_at IS NOT NULL THEN 'ready' ELSE 'wallet_required' END AS "recipientStatus"
+      FROM app_invites i
+      JOIN network_profiles n ON n.profile_id=i.profile_id
+      LEFT JOIN app_users recipient ON recipient.id=i.claimed_by
+      LEFT JOIN app_credential_metadata m ON m.invite_id=i.id
+      LEFT JOIN LATERAL (SELECT max(verified_at) AS verified_at FROM app_wallets
+        WHERE user_id=i.claimed_by AND network_id=n.network_id AND revoked_at IS NULL) wallet ON TRUE
+      LEFT JOIN LATERAL (SELECT status,error_code,created_at FROM app_invite_deliveries WHERE invite_id=i.id ORDER BY created_at DESC,id DESC LIMIT 1) d ON TRUE
+      WHERE i.organization_id=${id} ORDER BY i.created_at DESC,i.id LIMIT 200`
+    const credentials = await this.client
+      .sql`SELECT m.*,g.accepted,g.expiration,g.deleted_ledger_index,g.deletion_cause
+      FROM app_credential_metadata m LEFT JOIN credential_generations g ON g.profile_id=m.profile_id AND g.generation_id=m.generation_id
+      WHERE m.issuer_organization_id=${id} ORDER BY m.created_at DESC LIMIT 200`
+    return {
+      organizations,
+      selectedOrganizationId: id,
+      schemas,
+      invites: invites.map((row) => ({
+        ...row,
+        createdAt: iso(row.createdAt),
+        expiresAt: iso(row.expiresAt),
+        claimedAt: iso(row.claimedAt),
+        revokedAt: iso(row.revokedAt),
+        recipientWalletVerifiedAt: iso(row.recipientWalletVerifiedAt),
+      })),
+      credentials: credentials.map((row) => this.credentialDto(row)),
+    }
+  }
+
+  async apply(session: Session, input: ApplicationInput, role: 'issuer' | 'verifier' = 'issuer') {
+    const stored: Awaited<ReturnType<IssuerDocumentStore['write']>>[] = []
+    const applicationId = randomUUID()
+    let transactionStarted = false
+    try {
+      for (const document of input.documents)
+        stored.push(await this.options.documents.write(document))
+      const result = await this.client.sql.begin(async (transaction) => {
+        transactionStarted = true
+        const sql = transaction as unknown as Query
+        await this.session(sql, session)
+        // Bound accidental repeated submissions, and serialize the count with creation.
+        await sql`SELECT pg_advisory_xact_lock(hashtextextended(${session.userId + ':issuer-applications'},0))`
+        const [count] =
+          await sql`SELECT count(*)::int AS count FROM app_organizations WHERE responsible_user_id=${session.userId}`
+        if (count!.count >= 20) throw new IssuerError(409, 'ISSUER_APPLICATION_LIMIT')
+        const id = applicationId
+        await sql`INSERT INTO app_organizations(id,responsible_user_id,name) VALUES (${id},${session.userId},${input.name})`
+        await sql`INSERT INTO app_organization_applications(organization_id,role,website,contact,jurisdiction,description,purpose)
+          VALUES (${id},${role},${input.website},${input.contact},${input.jurisdiction},${input.description},${input.purpose})`
+        for (const document of stored)
+          await sql`INSERT INTO app_documents(id,organization_id,application_role,storage_key,mime_type,byte_length,sha256,uploaded_by)
+          VALUES (${randomUUID()},${id},${role},${document.storageKey},${document.mimeType},${document.byteLength},${document.sha256},${session.userId})`
+        return { organizationId: id, status: 'pending' }
+      })
+      for (const document of stored) this.options.documents.release?.(document.storageKey)
+      return result
+    } catch (error) {
+      // A connection failure after COMMIT may conceal success. Never delete files
+      // until the original transaction has finished and absence is confirmed.
+      let cleanup = !transactionStarted
+      if (transactionStarted) {
+        try {
+          cleanup = await this.client.sql.begin(async (sql) => {
+            // The original COMMIT can still be in flight on another connection.
+            // Wait on its lock before taking the statement snapshot for this read.
+            await sql`SELECT pg_advisory_xact_lock(hashtextextended(${session.userId + ':issuer-applications'},0))`
+            const [persisted] =
+              await sql`SELECT id FROM app_organizations WHERE id=${applicationId}`
+            return !persisted
+          })
+        } catch {
+          cleanup = false
+        }
+      }
+      if (cleanup)
+        await Promise.allSettled(
+          stored.map((document) => this.options.documents.remove(document.storageKey)),
+        )
+      else for (const document of stored) this.options.documents.release?.(document.storageKey)
+      throw error
+    }
+  }
+
+  async registerSchema(
+    session: Session,
+    input: {
+      organizationId: string
+      profileId: string
+      transactionHash: string
+      displayName: string
+      category: string
+    },
+  ) {
+    return this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      await this.organization(sql, session, input.organizationId)
+      const [schema] =
+        await sql`SELECT s.schema_uid FROM schemas s JOIN schema_events e ON e.profile_id=s.profile_id AND e.transaction_hash=s.registration_transaction_hash
+        JOIN network_profiles n ON n.profile_id=s.profile_id AND n.enabled AND n.network_id=1
+        JOIN app_wallets w ON w.user_id=${session.userId} AND w.address=s.publisher AND w.network_id=n.network_id AND w.revoked_at IS NULL
+        WHERE s.profile_id=${input.profileId} AND lower(s.registration_transaction_hash)=${input.transactionHash} AND e.status='accepted' AND e.schema_uid=s.schema_uid`
+      if (!schema) throw new IssuerError(409, 'ISSUER_SCHEMA_NOT_VALIDATED')
+      await sql`INSERT INTO app_schema_metadata(profile_id,schema_uid,organization_id,display_name,category,registration_transaction_hash)
+        VALUES (${input.profileId},${schema.schema_uid},${input.organizationId},${input.displayName || null},${input.category || null},${input.transactionHash}) ON CONFLICT DO NOTHING`
+      const [owner] =
+        await sql`SELECT organization_id FROM app_schema_metadata WHERE profile_id=${input.profileId} AND schema_uid=${schema.schema_uid}`
+      if (owner?.organization_id !== input.organizationId)
+        throw new IssuerError(409, 'ISSUER_SCHEMA_OWNED')
+      return {
+        profileId: input.profileId,
+        schemaUid: schema.schema_uid,
+        organizationId: input.organizationId,
+      }
+    })
+  }
+
+  private async deliver(message: IssuerNotification) {
+    let result: IssuerNotificationResult
+    try {
+      result = await this.options.notify(message)
+    } catch {
+      result = { status: 'uncertain', errorCode: 'SMTP_ACCEPTANCE_UNCERTAIN' }
+    }
+    // A database failure leaves sending, which is surfaced as uncertain; never replay automatically.
+    await this.client
+      .sql`UPDATE app_invite_deliveries SET status=${result.status},error_code=${result.errorCode} WHERE id=${message.id} AND status='sending'`
+    return result
+  }
+
+  async invite(
+    session: Session,
+    input: {
+      organizationId: string
+      profileId: string
+      schemaUid: string
+      email: string
+      message: string
+    },
+  ) {
+    const secret = createAppToken(),
+      id = randomUUID(),
+      deliveryId = randomUUID()
+    const invitation = await this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      const org = await this.organization(sql, session, input.organizationId)
+      await sql`SELECT pg_advisory_xact_lock(hashtextextended(${input.organizationId + ':invites'},0))`
+      const [count] =
+        await sql`SELECT count(*)::int AS count FROM app_invites WHERE organization_id=${input.organizationId}`
+      if (count!.count >= 2000) throw new IssuerError(409, 'ISSUER_INVITE_LIMIT')
+      const [schema] =
+        await sql`SELECT COALESCE(m.display_name,s.name,m.category,'Attestation') AS schema_name
+        FROM app_schema_metadata m LEFT JOIN schemas s ON s.profile_id=m.profile_id AND s.schema_uid=m.schema_uid
+        WHERE m.organization_id=${input.organizationId} AND m.profile_id=${input.profileId} AND m.schema_uid=${input.schemaUid}`
+      if (!schema) throw new IssuerError(404, 'ISSUER_SCHEMA_NOT_FOUND')
+      const [created] =
+        await sql`INSERT INTO app_invites(id,organization_id,profile_id,schema_uid,delivery_email,token_hash,created_by,expires_at)
+        VALUES (${id},${input.organizationId},${input.profileId},${input.schemaUid},${input.email},${secret.tokenHash},${session.userId},statement_timestamp()+${this.options.inviteDays}*interval '1 day') RETURNING expires_at`
+      await sql`INSERT INTO app_invite_deliveries(id,invite_id,kind,recipient_email,status) VALUES (${deliveryId},${id},'invitation',${input.email},'sending')`
+      return { org, schemaName: schema.schema_name, expiresAt: iso(created!.expires_at)! }
+    })
+    const delivery = await this.deliver({
+      id: deliveryId,
+      kind: 'invitation',
+      recipientEmail: input.email,
+      organizationName: invitation.org.name,
+      claimUrl: `${this.options.origin}/recipient/invitations#${secret.token}`,
+      schemaName: invitation.schemaName,
+      expiresAt: invitation.expiresAt,
+      message: input.message,
+    })
+    return { id, deliveryStatus: delivery.status }
+  }
+
+  async changeInvite(session: Session, id: string, action: 'resend' | 'revoke') {
+    const secret = createAppToken(),
+      deliveryId = randomUUID()
+    const result = await this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      const [invite] = await sql`SELECT * FROM app_invites WHERE id=${id} FOR UPDATE`
+      if (!invite) throw new IssuerError(404, 'ISSUER_INVITE_NOT_FOUND')
+      const org = await this.organization(sql, session, invite.organization_id)
+      if (invite.claimed_by || invite.revoked_at) throw new IssuerError(409, 'ISSUER_INVITE_FINAL')
+      await sql`UPDATE app_invite_deliveries SET status='cancelled',error_code=NULL WHERE invite_id=${id} AND status='sending'`
+      let expiresAt = invite.expires_at
+      if (action === 'resend') {
+        const [updated] =
+          await sql`UPDATE app_invites SET token_hash=${secret.tokenHash},expires_at=statement_timestamp()+${this.options.inviteDays}*interval '1 day' WHERE id=${id} RETURNING expires_at`
+        expiresAt = updated!.expires_at
+        await sql`INSERT INTO app_invite_deliveries(id,invite_id,kind,recipient_email,status) VALUES (${deliveryId},${id},'invitation',${invite.delivery_email},'sending')`
+      } else
+        await sql`UPDATE app_invites SET revoked_at=statement_timestamp(),token_hash=NULL WHERE id=${id}`
+      const [schema] =
+        await sql`SELECT COALESCE(m.display_name,s.name,m.category,'Attestation') AS schema_name
+        FROM app_schema_metadata m LEFT JOIN schemas s ON s.profile_id=m.profile_id AND s.schema_uid=m.schema_uid
+        WHERE m.organization_id=${invite.organization_id} AND m.profile_id=${invite.profile_id} AND m.schema_uid=${invite.schema_uid}`
+      return { invite, org, schemaName: schema?.schema_name ?? 'Attestation', expiresAt }
+    })
+    if (action === 'revoke') return { id, status: 'revoked' }
+    const delivery = await this.deliver({
+      id: deliveryId,
+      kind: 'invitation',
+      recipientEmail: result.invite.delivery_email,
+      organizationName: result.org.name,
+      claimUrl: `${this.options.origin}/recipient/invitations#${secret.token}`,
+      schemaName: result.schemaName,
+      expiresAt: iso(result.expiresAt)!,
+    })
+    return { id, deliveryStatus: delivery.status }
+  }
+
+  private async issuanceRows(sql: Query, session: Session, id: string) {
+    const [invite] = await sql`SELECT * FROM app_invites WHERE id=${id}`
+    if (!invite) throw new IssuerError(404, 'ISSUER_INVITE_NOT_FOUND')
+    const org = await this.organization(sql, session, invite.organization_id)
+    if (!invite.claimed_by || invite.revoked_at)
+      throw new IssuerError(409, 'ISSUER_RECIPIENT_REQUIRED')
+    const [recipient] =
+      await sql`SELECT id,display_name FROM app_users WHERE id=${invite.claimed_by} AND status='active'`
+    const [schema] =
+      await sql`SELECT s.*,n.network_id FROM schemas s JOIN network_profiles n ON n.profile_id=s.profile_id
+      WHERE s.profile_id=${invite.profile_id} AND s.schema_uid=${invite.schema_uid} AND n.enabled AND n.network_id=1`
+    if (!recipient || !schema) throw new IssuerError(409, 'ISSUER_ISSUANCE_UNAVAILABLE')
+    const wallets =
+      await sql`SELECT address,network_id AS "networkId",verified_at AS "verifiedAt" FROM app_wallets WHERE user_id=${recipient.id} AND network_id=${schema.network_id} AND revoked_at IS NULL`
+    const issuerWallets =
+      await sql`SELECT address,network_id AS "networkId",verified_at AS "verifiedAt" FROM app_wallets WHERE user_id=${session.userId} AND network_id=${schema.network_id} AND revoked_at IS NULL`
+    return { invite, org, recipient, schema, wallets, issuerWallets }
+  }
+
+  async issuance(session: Session, id: string) {
+    const rows = await this.issuanceRows(this.client.sql, session, id)
+    const [existing] = await this.client
+      .sql`SELECT profile_id AS "profileId",generation_id AS "generationId" FROM app_credential_metadata WHERE invite_id=${id}`
+    return {
+      existingCredential: existing ?? null,
+      invite: {
+        id,
+        organizationId: rows.invite.organization_id,
+        profileId: rows.invite.profile_id,
+        schemaUid: rows.invite.schema_uid,
+        claimedBy: rows.invite.claimed_by,
+        expiresAt: iso(rows.invite.expires_at),
+        revokedAt: iso(rows.invite.revoked_at),
+        deliveryEmail: rows.invite.delivery_email,
+      },
+      organization: { id: rows.org.id, name: rows.org.name },
+      recipient: {
+        id: rows.recipient.id,
+        displayName: rows.recipient.display_name,
+        wallets: rows.wallets.map((wallet) => ({
+          ...wallet,
+          networkId: Number(wallet.networkId),
+          verifiedAt: iso(wallet.verifiedAt),
+        })),
+      },
+      issuerWallets: rows.issuerWallets.map((wallet) => ({
+        ...wallet,
+        networkId: Number(wallet.networkId),
+        verifiedAt: iso(wallet.verifiedAt),
+      })),
+      schema: {
+        profileId: rows.schema.profile_id,
+        schemaUid: rows.schema.schema_uid,
+        name: rows.schema.name,
+        publisher: rows.schema.publisher,
+        definition: rows.schema.definition,
+        resolvedDefinition: rows.schema.resolved_definition,
+      },
+    }
+  }
+
+  async preparePayload(
+    session: Session,
+    input: {
+      inviteId: string
+      canonicalPayload: string
+      subjectAddress: string
+      visibility: 'public' | 'private'
+      publicFields: string[]
+    },
+  ) {
+    return this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      await sql`SELECT id FROM app_invites WHERE id=${input.inviteId} FOR UPDATE`
+      const rows = await this.issuanceRows(sql, session, input.inviteId)
+      const [count] =
+        await sql`SELECT count(*)::int AS count FROM app_issuer_payloads WHERE invite_id=${input.inviteId}`
+      if (count!.count >= 20) throw new IssuerError(409, 'ISSUER_DRAFT_LIMIT')
+      const [existing] =
+        await sql`SELECT generation_id FROM app_credential_metadata WHERE invite_id=${input.inviteId}`
+      if (existing) throw new IssuerError(409, 'ISSUER_INVITE_ALREADY_ISSUED')
+      if (!rows.wallets.some((wallet) => wallet.address === input.subjectAddress))
+        throw new IssuerError(409, 'ISSUER_SUBJECT_WALLET_REQUIRED')
+      let parsed
+      try {
+        const envelope = JSON.parse(input.canonicalPayload)
+        if (!rows.issuerWallets.some((wallet) => wallet.address === envelope.issuer))
+          throw new Error()
+        parsed = parseCredentialPayload(input.canonicalPayload, {
+          issuer: envelope.issuer,
+          subject: input.subjectAddress,
+          schemaUid: rows.invite.schema_uid,
+          fields: rows.schema.resolved_definition.fields as SchemaFields,
+        })
+      } catch {
+        throw new IssuerError(400, 'ISSUER_PAYLOAD_INVALID')
+      }
+      // Validate selectors against the real envelope without exposing its other fields.
+      filterCredentialClaims(parsed.claims as Claims, {
+        scope: 'public',
+        publicFields: input.publicFields,
+      })
+      const id = randomUUID(),
+        digest = payloadDigest(input.canonicalPayload)
+      const locator = randomBytes(9).toString('hex')
+      const credentialUri = createHttpsPayloadUri(
+        `${this.options.origin}/q/${locator}`,
+        input.canonicalPayload,
+      )
+      if (Buffer.byteLength(credentialUri) > 128)
+        throw new IssuerError(422, 'ISSUER_ORIGIN_TOO_LONG')
+      await sql`INSERT INTO app_issuer_payloads(id,locator,invite_id,created_by,subject_address,canonical_payload,payload_digest,credential_uri,visibility,public_fields)
+        VALUES (${id},${locator},${input.inviteId},${session.userId},${input.subjectAddress},${input.canonicalPayload},${digest},${credentialUri},${input.visibility},${JSON.stringify(input.publicFields)}::jsonb)`
+      return { payloadId: id, credentialUri, payloadDigest: digest }
+    })
+  }
+
+  async recordCredential(
+    session: Session,
+    input: {
+      inviteId: string
+      transactionHash: string
+      payloadId: string
+      visibility: 'public' | 'private'
+      publicFields: string[]
+    },
+  ) {
+    const recorded = await this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      await sql`SELECT id FROM app_invites WHERE id=${input.inviteId} FOR UPDATE`
+      const rows = await this.issuanceRows(sql, session, input.inviteId)
+      const [payload] =
+        await sql`SELECT * FROM app_issuer_payloads WHERE id=${input.payloadId} AND invite_id=${input.inviteId} AND created_by=${session.userId}`
+      if (
+        !payload ||
+        payload.visibility !== input.visibility ||
+        canonicalJson(payload.public_fields) !== canonicalJson(input.publicFields)
+      )
+        throw new IssuerError(409, 'ISSUER_PAYLOAD_MISMATCH')
+      const [event] =
+        await sql`SELECT e.*,g.deleted_ledger_index FROM credential_events e JOIN credential_generations g ON g.profile_id=e.profile_id AND g.generation_id=e.generation_id
+        WHERE e.profile_id=${rows.invite.profile_id} AND lower(e.transaction_hash)=${input.transactionHash} AND e.event_type='created' AND e.schema_uid=${rows.invite.schema_uid}`
+      if (!event) throw new IssuerError(409, 'ISSUER_CREDENTIAL_NOT_VALIDATED')
+      let uri: string
+      try {
+        uri = decodeHexUtf8(event.uri_hex)
+      } catch {
+        throw new IssuerError(409, 'ISSUER_PAYLOAD_MISMATCH')
+      }
+      const envelope = JSON.parse(payload.canonical_payload)
+      if (
+        uri !== payload.credential_uri ||
+        payloadDigest(payload.canonical_payload) !== payload.payload_digest ||
+        envelope.issuer !== event.issuer ||
+        envelope.subject !== event.subject ||
+        event.subject !== payload.subject_address ||
+        !rows.issuerWallets.some((wallet) => wallet.address === event.issuer) ||
+        !rows.wallets.some((wallet) => wallet.address === event.subject)
+      )
+        throw new IssuerError(409, 'ISSUER_CREDENTIAL_MISMATCH')
+      const [existing] =
+        await sql`SELECT * FROM app_credential_metadata WHERE invite_id=${input.inviteId} OR (profile_id=${event.profile_id} AND generation_id=${event.generation_id})`
+      if (existing) {
+        if (
+          existing.invite_id !== input.inviteId ||
+          existing.generation_id !== event.generation_id ||
+          existing.payload_storage_key !== input.payloadId
+        )
+          throw new IssuerError(409, 'ISSUER_CREDENTIAL_EXISTS')
+      } else
+        await sql`INSERT INTO app_credential_metadata(profile_id,generation_id,schema_uid,issuer_organization_id,recipient_user_id,invite_id,issuer_address,subject_address,visibility,public_fields,payload_storage_key,payload_digest,creation_transaction_hash,creation_ledger_index)
+        VALUES (${event.profile_id},${event.generation_id},${event.schema_uid},${rows.org.id},${rows.recipient.id},${input.inviteId},${event.issuer},${event.subject},${payload.visibility},${JSON.stringify(payload.public_fields)}::jsonb,${payload.id},${payload.payload_digest},${input.transactionHash},${event.ledger_index})`
+      return {
+        profileId: event.profile_id,
+        generationId: event.generation_id,
+        organizationId: rows.org.id,
+        inviteId: input.inviteId,
+        notification: existing
+          ? null
+          : await this.queueNotification(sql, input.inviteId, rows.org.name, 'issued'),
+      }
+    })
+    const { notification, ...result } = recorded
+    if (notification) await this.deliver(notification)
+    return result
+  }
+
+  private async queueNotification(
+    sql: Query,
+    inviteId: string,
+    organizationName: string,
+    kind: 'issued' | 'revoked',
+  ): Promise<IssuerNotification | null> {
+    const [existing] =
+      await sql`SELECT id FROM app_invite_deliveries WHERE invite_id=${inviteId} AND kind=${kind}`
+    if (existing) return null
+    const [recipient] =
+      await sql`SELECT u.email,u.email_verified_at FROM app_invites i JOIN app_users u ON u.id=i.claimed_by AND u.status='active' WHERE i.id=${inviteId}`
+    if (!recipient?.email_verified_at || !isNotificationEmail(recipient.email)) return null
+    const id = randomUUID()
+    await sql`INSERT INTO app_invite_deliveries(id,invite_id,kind,recipient_email,status) VALUES (${id},${inviteId},${kind},${recipient.email},'sending')`
+    return { id, kind, organizationName, recipientEmail: recipient.email }
+  }
+
+  async refreshCredential(
+    session: Session,
+    profileId: string,
+    generationId: string,
+    transactionHash: string,
+  ) {
+    const notification = await this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      const [record] =
+        await sql`SELECT m.*,e.deletion_cause FROM app_credential_metadata m JOIN credential_events e ON e.profile_id=m.profile_id AND e.generation_id=m.generation_id
+        WHERE m.profile_id=${profileId} AND m.generation_id=${generationId} AND lower(e.transaction_hash)=${transactionHash} AND e.event_type='deleted' AND e.deletion_cause='issuer_revoked'`
+      if (!record) throw new IssuerError(409, 'ISSUER_REVOCATION_NOT_VALIDATED')
+      const org = await this.organization(sql, session, record.issuer_organization_id)
+      const [wallet] =
+        await sql`SELECT w.id FROM app_wallets w JOIN network_profiles n ON n.network_id=w.network_id WHERE n.profile_id=${profileId} AND n.enabled AND w.user_id=${session.userId} AND w.address=${record.issuer_address} AND w.revoked_at IS NULL`
+      if (!wallet) throw new IssuerError(403, 'ISSUER_WALLET_REQUIRED')
+      await sql`SELECT id FROM app_invites WHERE id=${record.invite_id} FOR UPDATE`
+      return this.queueNotification(sql, record.invite_id, org.name, 'revoked')
+    })
+    if (notification) await this.deliver(notification)
+    return this.credential(session, profileId, generationId)
+  }
+
+  private credentialDto(row: Record<string, unknown>) {
+    return {
+      profileId: row.profile_id,
+      generationId: row.generation_id,
+      schemaUid: row.schema_uid,
+      organizationId: row.issuer_organization_id,
+      inviteId: row.invite_id,
+      recipientUserId: row.recipient_user_id,
+      issuerAddress: row.issuer_address,
+      subjectAddress: row.subject_address,
+      visibility: row.visibility,
+      publicFields: row.public_fields,
+      payloadId: row.payload_storage_key,
+      creationTransactionHash: row.creation_transaction_hash,
+      createdAt: iso(row.created_at),
+      status: {
+        accepted: row.accepted ?? null,
+        expiration: row.expiration == null ? null : Number(row.expiration),
+        deletedLedgerIndex:
+          row.deleted_ledger_index == null ? null : Number(row.deleted_ledger_index),
+        deletionCause: row.deletion_cause ?? null,
+      },
+    }
+  }
+
+  async credential(session: Session, profileId: string, generationId: string) {
+    const [row] = await this.client
+      .sql`SELECT m.*,g.accepted,g.expiration,g.deleted_ledger_index,g.deletion_cause,s.name AS schema_name,u.display_name AS recipient_name
+      FROM app_credential_metadata m LEFT JOIN credential_generations g ON g.profile_id=m.profile_id AND g.generation_id=m.generation_id
+      LEFT JOIN schemas s ON s.profile_id=m.profile_id AND s.schema_uid=m.schema_uid LEFT JOIN app_users u ON u.id=m.recipient_user_id WHERE m.profile_id=${profileId} AND m.generation_id=${generationId}`
+    if (!row) throw new IssuerError(404, 'ISSUER_CREDENTIAL_NOT_FOUND')
+    await this.organization(this.client.sql, session, row.issuer_organization_id)
+    return {
+      ...this.credentialDto(row),
+      schema: { name: row.schema_name },
+      recipient: { id: row.recipient_user_id, displayName: row.recipient_name },
+    }
+  }
+
+  async payload(session: Session | null, id: string, byLocator = false) {
+    const [payload] = await this.client
+      .sql`SELECT p.*,m.profile_id,m.generation_id FROM app_issuer_payloads p
+      LEFT JOIN app_credential_metadata m ON m.payload_storage_key=p.id::text WHERE ${byLocator ? this.client.sql`p.locator=${id}` : this.client.sql`p.id=${id}`}`
+    if (!payload) throw new IssuerError(404, 'ISSUER_PAYLOAD_NOT_FOUND')
+    if (!payload.generation_id) {
+      if (!session || payload.created_by !== session.userId)
+        throw new IssuerError(404, 'ISSUER_PAYLOAD_NOT_FOUND')
+      await this.issuanceRows(this.client.sql, session, payload.invite_id)
+      return { content: payload.canonical_payload, scope: 'full' as const }
+    }
+    const access = await getCredentialAccess(this.client.db, {
+      profileId: payload.profile_id,
+      generationId: payload.generation_id,
+      viewerUserId: session?.userId ?? null,
+    })
+    if (!access) throw new IssuerError(404, 'ISSUER_PAYLOAD_NOT_FOUND')
+    if (access.scope === 'full')
+      return { content: payload.canonical_payload, scope: 'full' as const }
+    const envelope = JSON.parse(payload.canonical_payload)
+    return {
+      content: canonicalJson({ claims: filterCredentialClaims(envelope.claims, access) }),
+      scope: 'public' as const,
+    }
+  }
+
+  async invitation(session: Session, token: string, claim: boolean) {
+    const tokenHash = hashAppToken(token)
+    if (!tokenHash) throw new IssuerError(404, 'ISSUER_INVITATION_UNAVAILABLE')
+    return this.client.sql.begin(async (transaction) => {
+      const sql = transaction as unknown as Query
+      await this.session(sql, session)
+      const [invite] =
+        await sql`SELECT i.id,i.organization_id,i.profile_id,i.schema_uid,i.claimed_by,i.expires_at,o.name,s.name AS schema_name
+        FROM app_invites i JOIN app_organizations o ON o.id=i.organization_id AND o.status='active'
+        JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='issuer' AND a.status='approved'
+        JOIN schemas s ON s.profile_id=i.profile_id AND s.schema_uid=i.schema_uid
+        WHERE i.token_hash=${tokenHash} AND i.revoked_at IS NULL AND i.expires_at>statement_timestamp() FOR UPDATE OF i`
+      if (!invite || (invite.claimed_by && invite.claimed_by !== session.userId))
+        throw new IssuerError(404, 'ISSUER_INVITATION_UNAVAILABLE')
+      if (claim && !invite.claimed_by) {
+        const [updated] =
+          await sql`UPDATE app_invites SET claimed_by=${session.userId},claimed_at=statement_timestamp()
+          WHERE id=${invite.id} AND claimed_by IS NULL AND revoked_at IS NULL AND expires_at>statement_timestamp() RETURNING id`
+        if (!updated) throw new IssuerError(409, 'ISSUER_INVITATION_UNAVAILABLE')
+      }
+      return {
+        id: invite.id,
+        organizationId: invite.organization_id,
+        organizationName: invite.name,
+        profileId: invite.profile_id,
+        schemaUid: invite.schema_uid,
+        schemaName: invite.schema_name,
+        expiresAt: iso(invite.expires_at),
+        claimed: claim || Boolean(invite.claimed_by),
+      }
+    })
+  }
+}
diff --git a/apps/web/server/xcs/issuer/services.ts b/apps/web/server/xcs/issuer/services.ts
new file mode 100644
index 0000000..5c35ee5
--- /dev/null
+++ b/apps/web/server/xcs/issuer/services.ts
@@ -0,0 +1,15 @@
+import type { DatabaseClient } from '../../lib/db/index.js'
+import type { loadIssuerConfig } from './config'
+import type { IssuerRepository } from './repository'
+
+export interface IssuerServices {
+  database: DatabaseClient
+  repository: IssuerRepository
+  config: NonNullable<ReturnType<typeof loadIssuerConfig>>
+}
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsIssuerServices?: IssuerServices
+  }
+}
diff --git a/apps/web/server/xcs/issuer/storage.ts b/apps/web/server/xcs/issuer/storage.ts
new file mode 100644
index 0000000..df5c869
--- /dev/null
+++ b/apps/web/server/xcs/issuer/storage.ts
@@ -0,0 +1,123 @@
+import { randomBytes } from 'node:crypto'
+import {
+  FilesystemPrivateDocumentBackend,
+  MAX_PRIVATE_DOCUMENT_BYTES,
+  privateDocumentDigest,
+  readStoredPrivateDocument,
+  type PrivateDocumentBackend,
+} from '../documents/storage'
+
+export const MAX_DOCUMENT_BYTES = MAX_PRIVATE_DOCUMENT_BYTES
+
+export interface DocumentMetadata {
+  storageKey: string
+  mimeType: string
+  byteLength: number
+  sha256: string
+}
+
+export interface IssuerDocumentStore {
+  write(input: { mimeType: string; base64: string }): Promise<DocumentMetadata>
+  remove(storageKey: string): Promise<void>
+  release?(storageKey: string): void
+}
+
+const extensions: Record<string, string> = {
+  'application/pdf': 'pdf',
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+}
+
+function documentBytes(input: { mimeType: string; base64: string }): Buffer {
+  if (
+    !input ||
+    !Object.hasOwn(extensions, input.mimeType) ||
+    typeof input.base64 !== 'string' ||
+    input.base64.length < 4 ||
+    input.base64.length > Math.ceil(MAX_DOCUMENT_BYTES / 3) * 4 ||
+    input.base64.length % 4 !== 0 ||
+    !/^[A-Za-z0-9+/]*={0,2}$/.test(input.base64)
+  )
+    throw new Error('ISSUER_DOCUMENT_INVALID')
+  const bytes = Buffer.from(input.base64, 'base64')
+  const magic =
+    input.mimeType === 'application/pdf'
+      ? bytes.subarray(0, 5).equals(Buffer.from('%PDF-'))
+      : input.mimeType === 'image/png'
+        ? bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))
+        : bytes.subarray(0, 3).equals(Buffer.from([255, 216, 255]))
+  if (bytes.length > MAX_DOCUMENT_BYTES || bytes.toString('base64') !== input.base64 || !magic)
+    throw new Error('ISSUER_DOCUMENT_INVALID')
+  return bytes
+}
+
+/** Private document volume shared with the administrator's integrity-checked reader. */
+export class PrivateDocumentStorage implements IssuerDocumentStore {
+  private readonly backend: PrivateDocumentBackend
+  private readonly owned = new Set<string>()
+
+  constructor(backend: PrivateDocumentBackend | string) {
+    try {
+      this.backend =
+        typeof backend === 'string' ? new FilesystemPrivateDocumentBackend(backend) : backend
+    } catch {
+      throw new Error('ISSUER_DOCUMENT_STORAGE_INVALID')
+    }
+  }
+
+  async write(input: { mimeType: string; base64: string }): Promise<DocumentMetadata> {
+    const bytes = documentBytes(input)
+    const storageKey = `${randomBytes(32).toString('hex')}.${extensions[input.mimeType]}`
+    try {
+      await this.backend.put(storageKey, input.mimeType, bytes)
+      this.owned.add(storageKey)
+    } catch (error) {
+      if ((error as Error).message === 'DOCUMENT_FILESYSTEM_ROOT_INVALID')
+        throw new Error('ISSUER_DOCUMENT_STORAGE_INVALID', { cause: error })
+      throw new Error('ISSUER_DOCUMENT_WRITE_FAILED', { cause: error })
+    }
+    return {
+      storageKey,
+      mimeType: input.mimeType,
+      byteLength: bytes.length,
+      sha256: privateDocumentDigest(bytes),
+    }
+  }
+
+  async read(document: DocumentMetadata): Promise<Buffer> {
+    try {
+      const bytes = await readStoredPrivateDocument(this.backend, document)
+      if (!bytes) throw new Error('ADMIN_DOCUMENT_MISSING')
+      return bytes
+    } catch (error) {
+      if ((error as Error).message === 'DOCUMENT_OBJECT_KEY_INVALID')
+        throw new Error('ADMIN_DOCUMENT_PATH_INVALID', { cause: error })
+      if (
+        ['DOCUMENT_OBJECT_INTEGRITY_INVALID', 'DOCUMENT_OBJECT_TOO_LARGE'].includes(
+          (error as Error).message,
+        )
+      )
+        throw new Error('ADMIN_DOCUMENT_INTEGRITY_INVALID', { cause: error })
+      if ((error as Error).message === 'DOCUMENT_OBJECT_PATH_INVALID')
+        throw new Error('ADMIN_DOCUMENT_PATH_INVALID', { cause: error })
+      throw error
+    }
+  }
+
+  async remove(storageKey: string): Promise<void> {
+    // Cleanup only newly owned orphans after a failed database write. Never turn a
+    // database/request-controlled key into general deletion from the private volume.
+    if (!this.owned.has(storageKey)) throw new Error('ISSUER_DOCUMENT_CLEANUP_INVALID')
+    try {
+      await this.backend.delete(storageKey)
+      this.owned.delete(storageKey)
+    } catch {
+      throw new Error('ISSUER_DOCUMENT_CLEANUP_INVALID')
+    }
+  }
+
+  release(storageKey: string): void {
+    this.owned.delete(storageKey)
+    this.backend.release?.(storageKey)
+  }
+}
diff --git a/apps/web/server/xcs/issuer/types.ts b/apps/web/server/xcs/issuer/types.ts
new file mode 100644
index 0000000..b5bf3f0
--- /dev/null
+++ b/apps/web/server/xcs/issuer/types.ts
@@ -0,0 +1,138 @@
+import { validatePublicFields } from '../../lib/db/index.js'
+import { isNotificationEmail } from '../admin/notifications'
+import {
+  ApplicationError,
+  parseApplicationInput,
+  type ApplicationInput,
+  type OrganizationApplication,
+} from '../applications/domain'
+
+export type IssuerOrganization = OrganizationApplication
+export interface IssuerSchema {
+  profileId: string
+  schemaUid: string
+  displayName: string | null
+  category: string | null
+  name: string | null
+  publisher: string | null
+  registrationTransactionHash: string
+}
+export interface IssuerInvite {
+  id: string
+  organizationId: string
+  profileId: string
+  schemaUid: string
+  email: string | null
+  createdAt: string
+  expiresAt: string
+  claimedBy: string | null
+  claimedAt: string | null
+  revokedAt: string | null
+  deliveryStatus: 'sending' | 'sent' | 'failed' | 'uncertain' | 'cancelled' | null
+  deliveryError: string | null
+  recipientStatus?: 'invited' | 'wallet_required' | 'ready' | 'issued' | 'unavailable'
+  recipientDisplayName?: string | null
+  recipientWalletVerifiedAt?: string | null
+}
+export interface IssuerCredential {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  organizationId: string
+  inviteId: string | null
+  recipientUserId: string
+  issuerAddress: string
+  subjectAddress: string
+  visibility: 'public' | 'private'
+  publicFields: string[]
+  payloadId: string | null
+  creationTransactionHash: string
+  createdAt: string
+  status: {
+    accepted: boolean | null
+    expiration: number | null
+    deletedLedgerIndex: number | null
+    deletionCause: string | null
+  }
+}
+export interface IssuerWorkspace {
+  organizations: IssuerOrganization[]
+  selectedOrganizationId: string | null
+  schemas: IssuerSchema[]
+  invites: IssuerInvite[]
+  credentials: IssuerCredential[]
+}
+
+export class IssuerError extends Error {
+  constructor(
+    readonly statusCode: number,
+    readonly code: string,
+  ) {
+    super(code)
+  }
+}
+export function object(value: unknown, keys: string[]): Record<string, unknown> {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    Object.keys(value).some((k) => !keys.includes(k))
+  )
+    throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+  return value as Record<string, unknown>
+}
+export function text(value: unknown, max: number, required = true): string {
+  if (value === undefined && !required) return ''
+  if (
+    typeof value !== 'string' ||
+    value.length > max ||
+    (required && !value.trim()) ||
+    Array.from(value).some((char) => char.charCodeAt(0) < 32 && !['\t', '\n', '\r'].includes(char))
+  )
+    throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+  return value.trim()
+}
+export function uuid(value: unknown): string {
+  const id = text(value, 36)
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id))
+    throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+  return id.toLowerCase()
+}
+export function hash(value: unknown): string {
+  const result = text(value, 64).toLowerCase()
+  if (!/^[0-9a-f]{64}$/.test(result)) throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+  return result
+}
+export function email(value: unknown): string {
+  if (!isNotificationEmail(value)) throw new IssuerError(400, 'ISSUER_EMAIL_INVALID')
+  return value
+}
+export function disclosure(input: Record<string, unknown>): {
+  visibility: 'public' | 'private'
+  publicFields: string[]
+} {
+  if (
+    !['public', 'private'].includes(String(input.visibility)) ||
+    !Array.isArray(input.publicFields)
+  )
+    throw new IssuerError(400, 'ISSUER_INPUT_INVALID')
+  try {
+    validatePublicFields(input.publicFields)
+  } catch {
+    throw new IssuerError(400, 'ISSUER_PUBLIC_FIELDS_INVALID')
+  }
+  return {
+    visibility: input.visibility as 'public' | 'private',
+    publicFields: input.publicFields as string[],
+  }
+}
+export type { ApplicationInput }
+export function applicationInput(value: unknown): ApplicationInput {
+  try {
+    return parseApplicationInput(value)
+  } catch (error) {
+    if (error instanceof ApplicationError)
+      throw new IssuerError(error.statusCode, error.code.replace('APPLICATION_', 'ISSUER_'))
+    throw error
+  }
+}
diff --git a/apps/web/server/xcs/notifications/smtp.ts b/apps/web/server/xcs/notifications/smtp.ts
new file mode 100644
index 0000000..230583d
--- /dev/null
+++ b/apps/web/server/xcs/notifications/smtp.ts
@@ -0,0 +1,217 @@
+import { isIP } from 'node:net'
+import nodemailer from 'nodemailer'
+
+export interface NotificationMessage {
+  from: { name: string; address: string }
+  to: { name: string; address: string }
+  envelope: { from: string; to: string[] }
+  messageId: string
+  subject: string
+  text: string
+  html?: string
+}
+
+export interface NotificationTransport {
+  sendMail(message: NotificationMessage): Promise<{ accepted: unknown[]; rejected: unknown[] }>
+  close(): void
+}
+
+export interface NotificationSender {
+  name: string
+  address: string
+  envelopeFrom: string
+  messageIdDomain: string
+}
+
+export interface SmtpConfiguration {
+  host: string
+  port: number
+  secure: boolean
+  requireTls: boolean
+  ignoreTls: boolean
+  username?: string
+  password?: string
+  sender: NotificationSender
+}
+
+const LOCAL_SMTP_HOSTS = new Set(['127.0.0.1', '::1', 'localhost', 'mailpit'])
+export const DEFAULT_NOTIFICATION_SENDER: NotificationSender = Object.freeze({
+  name: 'XCS',
+  address: 'notifications@xcs.test',
+  envelopeFrom: 'notifications@xcs.test',
+  messageIdDomain: 'xcs.test',
+})
+
+function hasControlCharacters(value: string): boolean {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0)
+    return code < 32 || code === 127
+  })
+}
+
+function isHostname(value: string): boolean {
+  if (isIP(value)) return true
+  if (value.length < 1 || value.length > 253 || value.endsWith('.')) return false
+  return value
+    .split('.')
+    .every(
+      (label) =>
+        label.length >= 1 &&
+        label.length <= 63 &&
+        /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label),
+    )
+}
+
+export function isNotificationEmail(email: unknown): email is string {
+  if (typeof email !== 'string' || email.length > 254) return false
+  const separator = email.lastIndexOf('@')
+  if (separator < 1 || separator === email.length - 1) return false
+  const local = email.slice(0, separator)
+  const domain = email.slice(separator + 1)
+  return (
+    local.length <= 64 &&
+    /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/.test(local) &&
+    !local.startsWith('.') &&
+    !local.endsWith('.') &&
+    !local.includes('..') &&
+    isHostname(domain)
+  )
+}
+
+function readOptional(
+  environment: Record<string, string | undefined>,
+  name: string,
+): string | undefined {
+  const value = environment[name]
+  return value === undefined ? undefined : value
+}
+
+function loadSender(
+  environment: Record<string, string | undefined>,
+  localTransport: boolean,
+): NotificationSender {
+  const configuredAddress = readOptional(environment, 'XCS_SMTP_FROM_ADDRESS')
+  if (!localTransport && configuredAddress === undefined)
+    throw new Error('XCS_SMTP_FROM_ADDRESS is required for external SMTP')
+  const address = configuredAddress ?? DEFAULT_NOTIFICATION_SENDER.address
+  if (!isNotificationEmail(address))
+    throw new Error('XCS_SMTP_FROM_ADDRESS must be a valid mailbox')
+
+  const name = readOptional(environment, 'XCS_SMTP_FROM_NAME') ?? DEFAULT_NOTIFICATION_SENDER.name
+  if (name.length < 1 || name.length > 100 || hasControlCharacters(name))
+    throw new Error('XCS_SMTP_FROM_NAME must be a valid display name')
+
+  const envelopeFrom = readOptional(environment, 'XCS_SMTP_ENVELOPE_FROM') ?? address
+  if (!isNotificationEmail(envelopeFrom))
+    throw new Error('XCS_SMTP_ENVELOPE_FROM must be a valid mailbox')
+
+  return {
+    name,
+    address,
+    envelopeFrom,
+    messageIdDomain: address.slice(address.lastIndexOf('@') + 1).toLowerCase(),
+  }
+}
+
+export function loadSmtpConfiguration(
+  environment: Record<string, string | undefined>,
+): SmtpConfiguration {
+  const host = environment.XCS_SMTP_HOST ?? '127.0.0.1'
+  if (!isHostname(host)) throw new Error('XCS_SMTP_HOST must be a valid hostname or IP address')
+  const localTransport = LOCAL_SMTP_HOSTS.has(host.toLowerCase())
+
+  const configuredPort = environment.XCS_SMTP_PORT ?? '1025'
+  const port = Number(configuredPort)
+  if (!/^\d+$/.test(configuredPort) || !Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error('XCS_SMTP_PORT must be a valid port')
+
+  const tlsMode = environment.XCS_SMTP_TLS_MODE ?? (localTransport ? 'disabled' : '')
+  if (!['disabled', 'starttls', 'tls'].includes(tlsMode))
+    throw new Error('XCS_SMTP_TLS_MODE must be disabled, starttls, or tls')
+  if (!localTransport && tlsMode === 'disabled')
+    throw new Error('XCS_SMTP_TLS_MODE must enable TLS for external SMTP')
+
+  const username = readOptional(environment, 'XCS_SMTP_USERNAME')
+  const password = readOptional(environment, 'XCS_SMTP_PASSWORD')
+  if ((username === undefined) !== (password === undefined))
+    throw new Error('XCS_SMTP_USERNAME and XCS_SMTP_PASSWORD must be configured together')
+  if (
+    username !== undefined &&
+    (username.length < 1 || username.length > 512 || hasControlCharacters(username))
+  )
+    throw new Error('XCS_SMTP_USERNAME is invalid')
+  if (
+    password !== undefined &&
+    (password.length < 1 || password.length > 16_384 || hasControlCharacters(password))
+  )
+    throw new Error('XCS_SMTP_PASSWORD is invalid')
+
+  return {
+    host,
+    port,
+    secure: tlsMode === 'tls',
+    requireTls: tlsMode === 'starttls',
+    ignoreTls: tlsMode === 'disabled',
+    ...(username === undefined ? {} : { username, password }),
+    sender: loadSender(environment, localTransport),
+  }
+}
+
+export function createSmtpTransport(configuration: SmtpConfiguration): NotificationTransport {
+  return nodemailer.createTransport({
+    host: configuration.host,
+    port: configuration.port,
+    secure: configuration.secure,
+    requireTLS: configuration.requireTls,
+    ignoreTLS: configuration.ignoreTls,
+    ...(configuration.username === undefined
+      ? {}
+      : { auth: { user: configuration.username, pass: configuration.password } }),
+    connectionTimeout: 10_000,
+    greetingTimeout: 10_000,
+    socketTimeout: 10_000,
+    dnsTimeout: 10_000,
+    logger: false,
+    debug: false,
+    disableFileAccess: true,
+    disableUrlAccess: true,
+  })
+}
+
+export function createSmtpDelivery(environment: Record<string, string | undefined>): {
+  transport: NotificationTransport
+  sender: NotificationSender
+} {
+  const configuration = loadSmtpConfiguration(environment)
+  return { transport: createSmtpTransport(configuration), sender: configuration.sender }
+}
+
+export function classifySmtpFailure(error: unknown): 'failed' | 'uncertain' {
+  if (!error || typeof error !== 'object') return 'uncertain'
+  const details = error as {
+    command?: unknown
+    responseCode?: unknown
+    syscall?: unknown
+    code?: unknown
+  }
+  // Nodemailer labels socket failures CONN even after DATA was transmitted.
+  // Only DNS or an actual connect() failure proves that no message was accepted.
+  if (details.command === 'CONN' && (details.syscall === 'connect' || details.code === 'EDNS'))
+    return 'failed'
+  // A negative SMTP reply is definitive, including a rejection after DATA.
+  if (
+    typeof details.responseCode === 'number' &&
+    details.responseCode >= 400 &&
+    details.responseCode <= 599 &&
+    typeof details.command === 'string' &&
+    /^(EHLO|HELO|STARTTLS|AUTH(?: .*)?|MAIL FROM|RCPT TO|DATA)$/i.test(details.command)
+  )
+    return 'failed'
+  if (
+    typeof details.command === 'string' &&
+    /^(EHLO|HELO|STARTTLS|AUTH(?: .*)?|MAIL FROM|RCPT TO)$/i.test(details.command)
+  )
+    return 'failed'
+  // A reset/timeout during DATA may have followed acceptance by the server.
+  return 'uncertain'
+}
diff --git a/apps/web/server/xcs/presentations/admission.ts b/apps/web/server/xcs/presentations/admission.ts
new file mode 100644
index 0000000..f91380d
--- /dev/null
+++ b/apps/web/server/xcs/presentations/admission.ts
@@ -0,0 +1,37 @@
+import { sql } from 'drizzle-orm'
+import type { XcsDatabase } from '../../lib/db/index.js'
+
+export interface IssuerAdmission {
+  status: 'approved' | 'suspended' | 'not_approved' | 'unknown'
+  organizationId: string
+  checkedAt: string
+  reviewedAt: string | null
+}
+
+/** Current portal admission, not historical approval or a claim about issuer trust. */
+export async function issuerAdmission(
+  db: XcsDatabase,
+  organizationId: string,
+): Promise<IssuerAdmission> {
+  const [row] = await db.execute(sql`SELECT o.status AS organization_status,
+    a.status AS application_status,a.reviewed_at,statement_timestamp() AS checked_at
+    FROM app_organizations o LEFT JOIN app_organization_applications a
+      ON a.organization_id=o.id AND a.role='issuer'
+    WHERE o.id=${organizationId}`)
+  // A missing organization contradicts the credential's foreign key, so do not invent evidence.
+  if (!row) throw new Error('ISSUER_ADMISSION_UNAVAILABLE')
+  const status: IssuerAdmission['status'] =
+    row.organization_status === 'suspended' || row.application_status === 'suspended'
+      ? 'suspended'
+      : row.organization_status === 'active' && row.application_status === 'approved'
+        ? 'approved'
+        : row.application_status == null
+          ? 'unknown'
+          : 'not_approved'
+  return {
+    status,
+    organizationId,
+    checkedAt: new Date(String(row.checked_at)).toISOString(),
+    reviewedAt: row.reviewed_at == null ? null : new Date(String(row.reviewed_at)).toISOString(),
+  }
+}
diff --git a/apps/web/server/xcs/presentations/evidence.ts b/apps/web/server/xcs/presentations/evidence.ts
new file mode 100644
index 0000000..8389a68
--- /dev/null
+++ b/apps/web/server/xcs/presentations/evidence.ts
@@ -0,0 +1,127 @@
+import { and, eq } from 'drizzle-orm'
+import { credentialGenerations } from '#db/schema'
+import type { appCredentialMetadata } from '#db/schema/app'
+import { decodeHexUtf8, verifyCredentialPayload, XcsError } from '#xcs/core/index.js'
+import type { XcsDatabase } from '../../lib/db/client.js'
+import { PostgresApiRepository } from '../repository'
+import { assertAuthoritativeLedgerEvidence } from '../indexer-status'
+import { assertCredentialGenerationEvidence } from '../credential-generation-evidence'
+import { credentialGenerationState } from '../credential-state'
+import { DEFAULT_LEDGER_MAX_AGE_SECONDS, IndexerUnavailableError } from '../ledger-freshness'
+import { authoritativeResolvedSchema, schemaProjectionEvidenceUids } from '../schema-projection'
+import { StaticTrustPolicy, type VerificationReport } from '../verification'
+import type { TrustPolicy } from '../types'
+import type { ApiConfig } from '../config'
+
+export type CredentialMetadata = typeof appCredentialMetadata.$inferSelect
+
+export interface EvidencePolicy {
+  trustPolicy?: TrustPolicy
+  maxLedgerAgeSeconds?: number
+}
+export function evidencePolicyFromConfig(
+  config: Pick<ApiConfig, 'trustedIssuers' | 'untrustedIssuers' | 'readinessMaxLedgerAgeSeconds'>,
+): EvidencePolicy {
+  return {
+    trustPolicy: new StaticTrustPolicy({
+      trusted: config.trustedIssuers,
+      untrusted: config.untrustedIssuers,
+    }),
+    maxLedgerAgeSeconds: config.readinessMaxLedgerAgeSeconds,
+  }
+}
+
+/** Caller supplies the same transaction used for authorization. No HTTP or external payload reads. */
+export async function managedCredentialEvidence(
+  db: XcsDatabase,
+  metadata: CredentialMetadata,
+  canonicalPayload?: string,
+  checkSchema = true,
+  policy: EvidencePolicy = {},
+) {
+  const repository = new PostgresApiRepository(db)
+  const network = await repository.getNetwork(metadata.profileId)
+  const [generation] = await db
+    .select()
+    .from(credentialGenerations)
+    .where(
+      and(
+        eq(credentialGenerations.profileId, metadata.profileId),
+        eq(credentialGenerations.generationId, metadata.generationId),
+      ),
+    )
+  if (!network || !generation)
+    throw new IndexerUnavailableError(
+      'INDEXER_EVIDENCE_INVALID',
+      'Credential generation unavailable',
+    )
+  const evidence = {
+    expectedProfileId: metadata.profileId,
+    status: await repository.getIndexerStatus(metadata.profileId),
+    checkpoint: await repository.getLatestCheckpoint(metadata.profileId),
+    now: await repository.getDatabaseTime(),
+    maxLedgerAgeSeconds: policy.maxLedgerAgeSeconds ?? DEFAULT_LEDGER_MAX_AGE_SECONDS,
+    minimumLedgerIndex: network.activationLedgerIndex,
+    projectionLedgerIndexes: [generation.createdLedgerIndex, generation.lastLedgerIndex],
+  }
+  assertAuthoritativeLedgerEvidence(evidence)
+  assertCredentialGenerationEvidence(generation, {
+    profileId: metadata.profileId,
+    generationId: metadata.generationId,
+    issuer: metadata.issuerAddress,
+    subject: metadata.subjectAddress,
+    schemaUid: metadata.schemaUid,
+    activationLedgerIndex: network.activationLedgerIndex,
+    checkpointLedgerIndex: evidence.checkpoint.ledgerIndex,
+  })
+  const schemaRow = checkSchema
+    ? await repository.getSchema(metadata.profileId, metadata.schemaUid)
+    : undefined
+  const schemaEvidence = schemaRow
+    ? await repository.getSchemaProjectionEvidence({
+        profileId: metadata.profileId,
+        schemaUids: schemaProjectionEvidenceUids([schemaRow], metadata.profileId),
+      })
+    : []
+  if (schemaEvidence.some((item) => item.schema.ledgerIndex > evidence.checkpoint.ledgerIndex))
+    throw new IndexerUnavailableError(
+      'INDEXER_EVIDENCE_INVALID',
+      'Schema ahead of validated checkpoint',
+    )
+  const schema = schemaRow
+    ? authoritativeResolvedSchema(schemaRow, schemaEvidence, {
+        profileId: metadata.profileId,
+        schemaUid: metadata.schemaUid,
+        networkId: network.networkId,
+        activationLedgerIndex: network.activationLedgerIndex,
+      })
+    : undefined
+  const verification: VerificationReport = {
+    onChain: credentialGenerationState(generation, evidence.checkpoint.closeTime),
+    schema: schema ? 'valid' : 'unknown',
+    payload: 'not_checked',
+    // Portal approval is not a trust decision about an issuer or its claims.
+    issuerTrust: policy.trustPolicy?.evaluate(metadata.issuerAddress) ?? 'unknown',
+    generationId: metadata.generationId,
+  }
+  if (canonicalPayload !== undefined) {
+    verification.payload = 'invalid'
+    if (schema && generation.uriHex !== null) {
+      try {
+        verification.payload = verifyCredentialPayload(
+          { status: 'retrieved', content: canonicalPayload },
+          decodeHexUtf8(generation.uriHex),
+          {
+            issuer: metadata.issuerAddress,
+            subject: metadata.subjectAddress,
+            schemaUid: metadata.schemaUid,
+            fields: schema.fields,
+          },
+        )
+      } catch (error) {
+        if (!(error instanceof XcsError)) throw error
+      }
+    }
+  }
+  return { generation, verification }
+}
diff --git a/apps/web/server/xcs/presentations/http.ts b/apps/web/server/xcs/presentations/http.ts
new file mode 100644
index 0000000..32abe03
--- /dev/null
+++ b/apps/web/server/xcs/presentations/http.ts
@@ -0,0 +1,35 @@
+import { defineEventHandler, getHeader, getRequestIP, setResponseHeaders, type H3Event } from 'h3'
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+import type { Session } from '../auth/types'
+import { requireCsrf } from '../auth/http'
+import { readJsonBody } from '../private-body'
+import { object, text } from '../issuer/types'
+import { PORTAL_HEADERS, portalFailure } from '../recipient/http'
+import { RecipientError } from '../recipient/types'
+import type { PresentationRepository } from './repository'
+
+export function createPresentationHandler(options: {
+  repository: PresentationRepository
+  origin: string
+  readSession: (event: H3Event) => Promise<Session | null>
+}) {
+  const limit = new RateLimiterMemory({ points: 60, duration: 60 })
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, PORTAL_HEADERS)
+    try {
+      await limit.consume(getRequestIP(event) ?? 'unknown')
+      if (event.method !== 'POST') throw new RecipientError(405, 'PRESENTATION_METHOD_NOT_ALLOWED')
+      if (
+        getHeader(event, 'origin') !== options.origin ||
+        ![undefined, 'same-origin', 'none'].includes(getHeader(event, 'sec-fetch-site'))
+      )
+        throw new RecipientError(403, 'AUTH_NOT_AUTHORIZED')
+      const session = await options.readSession(event)
+      if (session) requireCsrf(event, session, options.origin)
+      const input = object(await readJsonBody(event, 4096), ['token'])
+      return await options.repository.resolve(session, text(input.token, 43))
+    } catch (error) {
+      return portalFailure(event, error, 'PRESENTATION_UNAVAILABLE')
+    }
+  })
+}
diff --git a/apps/web/server/xcs/presentations/proof.ts b/apps/web/server/xcs/presentations/proof.ts
new file mode 100644
index 0000000..b56d383
--- /dev/null
+++ b/apps/web/server/xcs/presentations/proof.ts
@@ -0,0 +1,120 @@
+import { eq } from 'drizzle-orm'
+import {
+  appPresentationProofs,
+  appPresentations,
+  type PresentationProofRequest,
+} from '#db/schema/app'
+import type { XcsDatabase } from '../../lib/db/index.js'
+import { verifyWalletProof, type WalletProof } from '../auth/wallet-proof'
+import type { managedCredentialRow } from '../recipient/repository'
+
+export type HolderProof =
+  | { status: 'not_provided' | 'invalid' }
+  | ({
+      status: 'verified'
+      address: string
+      networkId: number
+      verifiedAt: string
+      message: string
+      purpose: 'presentation_authorization'
+      keyAuthority: 'master_key_address_only'
+    } & WalletProof)
+
+type CredentialRow = Awaited<ReturnType<typeof managedCredentialRow>>
+
+/** Fixed field order and JSON values avoid newline/field injection in wallet prompts. */
+export function presentationProofMessage(request: PresentationProofRequest): string {
+  return [
+    'XCS presentation authorization v1',
+    'I authorize this credential presentation with the scope and audience below.',
+    'This is not a transaction, payment, wallet link or transfer of ownership.',
+    'The challenge expires in five minutes; the presentation remains valid until revoked.',
+    ...(
+      [
+        'version',
+        'origin',
+        'challengeId',
+        'presentationId',
+        'nonce',
+        'issuedAt',
+        'expiresAt',
+        'profileId',
+        'networkId',
+        'generationId',
+        'issuerAddress',
+        'subjectAddress',
+        'schemaUid',
+        'payloadDigest',
+        'visibility',
+        'publicFields',
+        'scope',
+        'verifierOrganizationId',
+      ] as const
+    ).map((key) => `${key}: ${JSON.stringify(request[key])}`),
+  ].join('\n')
+}
+
+export function proofMatchesCredential(
+  request: PresentationProofRequest,
+  row: CredentialRow,
+): boolean {
+  const m = row.metadata
+  return (
+    request.version === 1 &&
+    request.profileId === m.profileId &&
+    request.generationId === m.generationId &&
+    request.networkId === row.networkId &&
+    request.issuerAddress === m.issuerAddress &&
+    request.subjectAddress === m.subjectAddress &&
+    request.schemaUid === m.schemaUid &&
+    request.payloadDigest === m.payloadDigest &&
+    request.visibility === m.visibility &&
+    JSON.stringify(request.publicFields) === JSON.stringify([...m.publicFields].sort())
+  )
+}
+
+/** Historical signature evidence, not proof of the viewer's presence or current ledger key authority. */
+export async function loadPresentationProof(
+  db: XcsDatabase,
+  id: string,
+  row: CredentialRow,
+): Promise<HolderProof> {
+  const [proof] = await db
+    .select()
+    .from(appPresentationProofs)
+    .where(eq(appPresentationProofs.presentationId, id))
+  if (!proof) return { status: 'not_provided' }
+  const [presentation] = await db.select().from(appPresentations).where(eq(appPresentations.id, id))
+  const request = proof.request
+  const issuedAt = Date.parse(request.issuedAt),
+    expiresAt = Date.parse(request.expiresAt)
+  if (
+    !presentation ||
+    request.presentationId !== id ||
+    presentation.profileId !== request.profileId ||
+    presentation.generationId !== request.generationId ||
+    !Number.isFinite(issuedAt) ||
+    !Number.isFinite(expiresAt) ||
+    expiresAt - issuedAt !== 300000 ||
+    proof.verifiedAt.getTime() < issuedAt ||
+    proof.verifiedAt.getTime() > expiresAt ||
+    request.scope !== presentation.scope ||
+    request.verifierOrganizationId !== presentation.verifierOrganizationId ||
+    !proofMatchesCredential(request, row) ||
+    presentationProofMessage(request) !== proof.message ||
+    !verifyWalletProof(proof.message, row.metadata.subjectAddress, proof)
+  )
+    return { status: 'invalid' }
+  return {
+    status: 'verified',
+    address: row.metadata.subjectAddress,
+    networkId: row.networkId,
+    verifiedAt: proof.verifiedAt.toISOString(),
+    message: proof.message,
+    signature: proof.signature,
+    publicKey: proof.publicKey,
+    scheme: proof.scheme,
+    purpose: 'presentation_authorization',
+    keyAuthority: 'master_key_address_only',
+  }
+}
diff --git a/apps/web/server/xcs/presentations/repository.ts b/apps/web/server/xcs/presentations/repository.ts
new file mode 100644
index 0000000..3a07557
--- /dev/null
+++ b/apps/web/server/xcs/presentations/repository.ts
@@ -0,0 +1,132 @@
+import { eq, sql } from 'drizzle-orm'
+import { appOrganizations, appPresentations } from '#db/schema/app'
+import {
+  filterCredentialClaims,
+  hashAppToken,
+  type Claims,
+  type DatabaseClient,
+  type XcsDatabase,
+} from '../../lib/db/index.js'
+import type { Session } from '../auth/types'
+import {
+  currentPortalSession,
+  managedCredentialRow,
+  managedPayload,
+  presentationDto,
+  recipientCredentialDto,
+} from '../recipient/repository'
+import { RecipientError, type ResolvedPresentation } from '../recipient/types'
+import { managedCredentialEvidence, type EvidencePolicy } from './evidence'
+import { issuerAdmission } from './admission'
+import { loadPresentationProof } from './proof'
+
+export type PresentationObserver = (
+  db: XcsDatabase,
+  session: Session,
+  result: ResolvedPresentation,
+) => Promise<void>
+
+export class PresentationRepository {
+  constructor(
+    private readonly client: DatabaseClient,
+    private readonly observer?: PresentationObserver,
+    private readonly policy: EvidencePolicy = {},
+  ) {}
+
+  private resolveWhere(
+    session: Session | null,
+    selector: { tokenHash: string } | { id: string },
+  ): Promise<ResolvedPresentation> {
+    return this.client.db.transaction(
+      async (tx) => {
+        const db = tx as unknown as XcsDatabase
+        if (session) await currentPortalSession(db, session)
+        // Share lock serializes disclosure with recipient revocation without consuming a grant.
+        const locked = await db.execute(
+          'tokenHash' in selector
+            ? sql`SELECT id,revoked_at AS "revokedAt" FROM app_presentations WHERE token_hash=${selector.tokenHash} FOR SHARE`
+            : sql`SELECT id,revoked_at AS "revokedAt" FROM app_presentations WHERE id=${selector.id} FOR SHARE`,
+        )
+        if (!locked[0]) throw new RecipientError(404, 'PRESENTATION_INVALID')
+        if (locked[0].revokedAt) throw new RecipientError(404, 'PRESENTATION_REVOKED')
+        const [row] = await db
+          .select({ presentation: appPresentations, name: appOrganizations.name })
+          .from(appPresentations)
+          .leftJoin(
+            appOrganizations,
+            eq(appOrganizations.id, appPresentations.verifierOrganizationId),
+          )
+          .where(
+            'tokenHash' in selector
+              ? eq(appPresentations.tokenHash, selector.tokenHash)
+              : eq(appPresentations.id, selector.id),
+          )
+        if (!row) throw new RecipientError(404, 'PRESENTATION_INVALID')
+        const credential = await managedCredentialRow(
+          db,
+          row.presentation.profileId,
+          row.presentation.generationId,
+        )
+        if (credential.metadata.recipientUserId !== row.presentation.recipientUserId)
+          throw new RecipientError(404, 'PRESENTATION_UNAVAILABLE')
+        const holderProof = await loadPresentationProof(db, row.presentation.id, credential)
+        if (holderProof.status === 'invalid')
+          throw new RecipientError(422, 'PRESENTATION_HOLDER_PROOF_INVALID')
+        let scope: 'public' | 'full' = 'public'
+        if (row.presentation.scope === 'full' && session) {
+          const authorized = await db.execute(sql`SELECT o.id FROM app_organizations o
+          JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier'
+          WHERE o.id=${row.presentation.verifierOrganizationId} AND o.responsible_user_id=${session.userId}
+          AND o.status='active' AND a.status='approved'`)
+          if (authorized.length) scope = 'full'
+        }
+        const content = await managedPayload(db, credential.metadata)
+        const { verification } = await managedCredentialEvidence(
+          db,
+          credential.metadata,
+          content,
+          true,
+          this.policy,
+        )
+        if (content === undefined) verification.payload = 'unavailable'
+        // Validate the stored canonical bytes locally, then expose only the selected claims.
+        // Ownership and administrator status never widen a link's scope. Already-public credentials
+        // expose all claims; private credentials expose only the issuer-selected public fields.
+        const claims =
+          content !== undefined && verification.payload === 'valid'
+            ? filterCredentialClaims((JSON.parse(content) as { claims: Claims }).claims, {
+                scope: credential.metadata.visibility === 'public' ? 'full' : scope,
+                publicFields: credential.metadata.publicFields,
+              })
+            : {}
+        if (scope === 'public' && verification.payload === 'valid')
+          verification.payload = 'not_checked'
+        const result: ResolvedPresentation = {
+          presentation: presentationDto(row.presentation, row.name),
+          credential: recipientCredentialDto(
+            credential,
+            verification.onChain as ResolvedPresentation['credential']['status']['state'],
+          ),
+          scope,
+          claims,
+          verification,
+          issuerAdmission: await issuerAdmission(db, credential.metadata.issuerOrganizationId),
+          holderProof,
+          requiresAuthorization: row.presentation.scope === 'full' && scope !== 'full',
+        }
+        if (session && this.observer) await this.observer(db, session, result)
+        return result
+      },
+      { isolationLevel: 'repeatable read' },
+    )
+  }
+  resolve(session: Session | null, token: string) {
+    const tokenHash = hashAppToken(token)
+    if (!tokenHash) throw new RecipientError(404, 'PRESENTATION_INVALID')
+    return this.resolveWhere(session, { tokenHash })
+  }
+  /** Only a history controller that already proved ownership may resolve an internal ID. */
+  resolveById(session: Session, id: string) {
+    return this.resolveWhere(session, { id })
+  }
+}
diff --git a/apps/web/server/xcs/private-body.ts b/apps/web/server/xcs/private-body.ts
new file mode 100644
index 0000000..3a83171
--- /dev/null
+++ b/apps/web/server/xcs/private-body.ts
@@ -0,0 +1,111 @@
+// Private account APIs retain bounded JSON parsing for Node and Nitro in-process bodies.
+import { getHeader, type H3Event } from 'h3'
+class RequestError extends Error {
+  constructor(
+    readonly statusCode: number,
+    message: string,
+  ) {
+    super(message)
+  }
+}
+
+export async function readJsonBody(event: H3Event, maxBytes: number): Promise<unknown> {
+  const contentType = getHeader(event, 'content-type')?.split(';')[0]?.trim().toLowerCase()
+  if (contentType !== 'application/json') {
+    throw new RequestError(415, 'Unsupported Media Type')
+  }
+  const declaredLength = Number(getHeader(event, 'content-length'))
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    throw new RequestError(413, 'Request body is too large')
+  }
+  // Nitro localFetch supplies req.body directly; the Web adapter supplies a Web stream.
+  // Neither emits Node request stream events, unlike an external HTTP request.
+  const requestWithBody = event.node.req as typeof event.node.req & {
+    body?: unknown
+    rawBody?: unknown
+    [key: symbol]: unknown
+  }
+  const suppliedBody: unknown = await (event._requestBody ??
+    event.web?.request?.body ??
+    requestWithBody[Symbol.for('h3RawBody')] ??
+    requestWithBody.rawBody ??
+    requestWithBody.body)
+  const bytes =
+    suppliedBody !== undefined && suppliedBody !== null
+      ? await readSuppliedBody(suppliedBody, maxBytes)
+      : await new Promise<Buffer>((resolve, reject) => {
+          const request = event.node.req
+          if (request.readableEnded) {
+            reject(new RequestError(400, 'Invalid JSON body'))
+            return
+          }
+          const chunks: Buffer[] = []
+          let size = 0
+          const cleanup = () => {
+            request.off('data', onData)
+            request.off('end', onEnd)
+            request.off('error', onError)
+            request.off('aborted', onAborted)
+          }
+          const onError = (error: Error) => {
+            cleanup()
+            reject(error)
+          }
+          const onAborted = () => onError(new RequestError(400, 'Request body was interrupted'))
+          const onEnd = () => {
+            cleanup()
+            resolve(Buffer.concat(chunks, size))
+          }
+          const onData = (chunk: Buffer | string) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+            size += buffer.length
+            if (size > maxBytes) {
+              cleanup()
+              // Drain without retaining bytes; destroying the socket would hide the 413 response.
+              request.resume()
+              reject(new RequestError(413, 'Request body is too large'))
+              return
+            }
+            chunks.push(buffer)
+          }
+          request.on('data', onData)
+          request.once('end', onEnd)
+          request.once('error', onError)
+          request.once('aborted', onAborted)
+        })
+  try {
+    return JSON.parse(bytes.toString('utf8')) as unknown
+  } catch {
+    throw new RequestError(400, 'Invalid JSON body')
+  }
+}
+
+async function readSuppliedBody(body: unknown, maxBytes: number): Promise<Buffer> {
+  if (body instanceof ReadableStream) {
+    const reader = body.getReader()
+    const chunks: Buffer[] = []
+    let size = 0
+    try {
+      for (;;) {
+        const { done, value } = await reader.read()
+        if (done) break
+        const chunk = Buffer.from(value)
+        size += chunk.length
+        if (size > maxBytes) {
+          await reader.cancel()
+          throw new RequestError(413, 'Request body is too large')
+        }
+        chunks.push(chunk)
+      }
+      return Buffer.concat(chunks, size)
+    } finally {
+      reader.releaseLock()
+    }
+  }
+  const bytes =
+    typeof body === 'string' || body instanceof Uint8Array
+      ? Buffer.from(body)
+      : Buffer.from(JSON.stringify(body))
+  if (bytes.length > maxBytes) throw new RequestError(413, 'Request body is too large')
+  return bytes
+}
diff --git a/apps/web/server/xcs/recipient/http.ts b/apps/web/server/xcs/recipient/http.ts
new file mode 100644
index 0000000..156ec4b
--- /dev/null
+++ b/apps/web/server/xcs/recipient/http.ts
@@ -0,0 +1,167 @@
+import {
+  createRouter,
+  defineEventHandler,
+  getQuery,
+  getRequestIP,
+  getRouterParam,
+  setResponseHeaders,
+  setResponseStatus,
+  type H3Event,
+} from 'h3'
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible'
+import type { Session } from '../auth/types'
+import { readJsonBody } from '../private-body'
+import { hash, object, text, uuid } from '../issuer/types'
+import {
+  RecipientError,
+  type CreatePresentationInput,
+  type PresentationChallengeInput,
+} from './types'
+import type { RecipientRepository } from './repository'
+
+export const PORTAL_HEADERS = {
+  'cache-control': 'private, no-store',
+  'referrer-policy': 'no-referrer',
+  'x-content-type-options': 'nosniff',
+  'x-frame-options': 'DENY',
+}
+export function portalFailure(event: H3Event, error: unknown, fallback: string) {
+  const code =
+    error instanceof RateLimiterRes ? 429 : ((error as { statusCode?: number })?.statusCode ?? 503)
+  const status = [400, 401, 403, 404, 405, 409, 413, 415, 422, 429, 503].includes(code) ? code : 503
+  setResponseStatus(event, status)
+  return {
+    error:
+      error instanceof RecipientError
+        ? error.code
+        : status === 401
+          ? 'AUTH_REQUIRED'
+          : status === 403
+            ? 'AUTH_NOT_AUTHORIZED'
+            : status === 429
+              ? 'RECIPIENT_RATE_LIMITED'
+              : status === 400
+                ? 'RECIPIENT_INPUT_INVALID'
+                : fallback,
+  }
+}
+export function createRecipientHandler(options: {
+  repository: RecipientRepository
+  authorize: (event: H3Event, mutation: boolean) => Promise<Session>
+}) {
+  const router = createRouter(),
+    sessions = new WeakMap<H3Event, Session>()
+  const limits = new RateLimiterMemory({ points: 120, duration: 60 })
+  const mutations = new RateLimiterMemory({ points: 20, duration: 60 })
+  const anonymous = new RateLimiterMemory({ points: 120, duration: 60 })
+  const body = async (event: H3Event, keys: string[]) =>
+    object(await readJsonBody(event, 4096), keys)
+  const ref = (event: H3Event) =>
+    [
+      text(getRouterParam(event, 'profileId'), 200),
+      hash(getRouterParam(event, 'generationId')),
+    ] as const
+  const { repository } = options
+  router.get(
+    '/api/recipient/workspace',
+    defineEventHandler((event) => repository.workspace(sessions.get(event)!)),
+  )
+  router.get(
+    '/api/recipient/verifiers',
+    defineEventHandler((event) => repository.verifiers(sessions.get(event)!)),
+  )
+  router.get(
+    '/api/recipient/credentials/:profileId/:generationId',
+    defineEventHandler((event) => repository.credential(sessions.get(event)!, ...ref(event))),
+  )
+  router.get(
+    '/api/recipient/credentials/:profileId/:generationId/payload',
+    defineEventHandler((event) => repository.payload(sessions.get(event)!, ...ref(event))),
+  )
+  router.post(
+    '/api/recipient/credentials/:profileId/:generationId/reconcile',
+    defineEventHandler(async (event) => {
+      const input = await body(event, ['transactionHash', 'action'])
+      if (input.action !== 'accept' && input.action !== 'reject' && input.action !== 'remove')
+        throw new RecipientError(400, 'RECIPIENT_INPUT_INVALID')
+      return repository.reconcile(
+        sessions.get(event)!,
+        ...ref(event),
+        hash(input.transactionHash),
+        input.action,
+      )
+    }),
+  )
+  router.get(
+    '/api/recipient/presentations',
+    defineEventHandler((event) => {
+      const query = object(getQuery(event), ['profileId', 'generationId'])
+      const filter =
+        query.profileId === undefined && query.generationId === undefined
+          ? undefined
+          : { profileId: text(query.profileId, 200), generationId: hash(query.generationId) }
+      return repository.presentations(sessions.get(event)!, filter)
+    }),
+  )
+  const presentationInput = (input: Record<string, unknown>): PresentationChallengeInput => {
+    if (input.scope !== 'public' && input.scope !== 'full')
+      throw new RecipientError(400, 'RECIPIENT_INPUT_INVALID')
+    return {
+      profileId: text(input.profileId, 200),
+      generationId: hash(input.generationId),
+      scope: input.scope,
+      verifierOrganizationId:
+        input.verifierOrganizationId == null ? null : uuid(input.verifierOrganizationId),
+    }
+  }
+  const presentationKeys = ['profileId', 'generationId', 'scope', 'verifierOrganizationId']
+  router.post(
+    '/api/recipient/presentation-challenges',
+    defineEventHandler(async (event) => {
+      const input = presentationInput(await body(event, presentationKeys))
+      return repository.presentationChallenge(sessions.get(event)!, input)
+    }),
+  )
+  router.post(
+    '/api/recipient/presentations',
+    defineEventHandler(async (event) => {
+      const input = await body(event, [...presentationKeys, 'proof'])
+      if (!input.proof) throw new RecipientError(400, 'RECIPIENT_PROOF_REQUIRED')
+      const proof = object(input.proof, ['challengeId', 'signature', 'publicKey', 'scheme'])
+      if (proof.scheme !== 'ripple' && proof.scheme !== 'otsu')
+        throw new RecipientError(400, 'RECIPIENT_INPUT_INVALID')
+      const data: CreatePresentationInput = {
+        ...presentationInput(input),
+        proof: {
+          challengeId: uuid(proof.challengeId),
+          signature: text(proof.signature, 144),
+          publicKey: text(proof.publicKey, 66),
+          scheme: proof.scheme,
+        },
+      }
+      return repository.createPresentation(sessions.get(event)!, data)
+    }),
+  )
+  router.post(
+    '/api/recipient/presentations/:id/revoke',
+    defineEventHandler(async (event) => {
+      await body(event, [])
+      return repository.revokePresentation(sessions.get(event)!, uuid(getRouterParam(event, 'id')))
+    }),
+  )
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, PORTAL_HEADERS)
+    try {
+      await anonymous.consume(getRequestIP(event) ?? 'unknown')
+      const session = await options.authorize(event, event.method !== 'GET')
+      sessions.set(event, session)
+      await limits.consume(session.userId)
+      if (event.method !== 'GET') await mutations.consume(session.userId)
+      return await router.handler(event)
+    } catch (error) {
+      return portalFailure(event, error, 'RECIPIENT_UNAVAILABLE')
+    } finally {
+      sessions.delete(event)
+    }
+  })
+}
diff --git a/apps/web/server/xcs/recipient/repository.ts b/apps/web/server/xcs/recipient/repository.ts
new file mode 100644
index 0000000..2eae1b5
--- /dev/null
+++ b/apps/web/server/xcs/recipient/repository.ts
@@ -0,0 +1,610 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { and, desc, eq, isNull, sql } from 'drizzle-orm'
+import {
+  appCredentialMetadata,
+  appInvites,
+  appIssuerPayloads,
+  appOrganizations,
+  appPresentations,
+  appPresentationChallenges,
+  appPresentationProofs,
+  type PresentationProofRequest,
+} from '#db/schema/app'
+import { credentialEvents, credentialGenerations, networkProfiles, schemas } from '#db/schema'
+import {
+  createAppToken,
+  filterCredentialClaims,
+  type Claims,
+  type DatabaseClient,
+  type XcsDatabase,
+} from '../../lib/db/index.js'
+import type { Session } from '../auth/types'
+import { verifyWalletProof } from '../auth/wallet-proof'
+import { presentationProofMessage, proofMatchesCredential } from '../presentations/proof'
+import { issuerAdmission } from '../presentations/admission'
+import {
+  managedCredentialEvidence,
+  type CredentialMetadata,
+  type EvidencePolicy,
+} from '../presentations/evidence'
+import { IndexerUnavailableError } from '../ledger-freshness'
+import {
+  RecipientError,
+  type CreatePresentationInput,
+  type PresentationChallengeInput,
+  type PresentationChallenge,
+  type CreatedPresentation,
+  type Presentation,
+  type RecipientCredential,
+  type RecipientCredentialDetail,
+  type RecipientPayload,
+  type RecipientWorkspace,
+} from './types'
+
+export async function currentPortalSession(db: XcsDatabase, session: Session): Promise<void> {
+  const rows =
+    await db.execute(sql`SELECT s.id FROM app_sessions s JOIN app_users u ON u.id=s.user_id
+    WHERE s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+    AND u.status='active' AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()`)
+  if (!rows.length) throw new RecipientError(401, 'AUTH_REQUIRED')
+}
+
+export function presentationDto(
+  row: typeof appPresentations.$inferSelect,
+  name: string | null,
+): Presentation {
+  return {
+    id: row.id,
+    profileId: row.profileId,
+    generationId: row.generationId,
+    scope: row.scope,
+    verifierOrganizationId: row.verifierOrganizationId,
+    verifierOrganizationName: name,
+    createdAt: row.createdAt.toISOString(),
+    revokedAt: row.revokedAt?.toISOString() ?? null,
+  }
+}
+
+export async function managedCredentialRow(
+  db: XcsDatabase,
+  profileId: string,
+  generationId: string,
+) {
+  const [row] = await db
+    .select({
+      metadata: appCredentialMetadata,
+      organizationName: appOrganizations.name,
+      schemaName: schemas.name,
+      networkId: networkProfiles.networkId,
+      generation: credentialGenerations,
+    })
+    .from(appCredentialMetadata)
+    .innerJoin(
+      appOrganizations,
+      eq(appOrganizations.id, appCredentialMetadata.issuerOrganizationId),
+    )
+    .innerJoin(networkProfiles, eq(networkProfiles.profileId, appCredentialMetadata.profileId))
+    .leftJoin(
+      schemas,
+      and(
+        eq(schemas.profileId, appCredentialMetadata.profileId),
+        eq(schemas.schemaUid, appCredentialMetadata.schemaUid),
+      ),
+    )
+    .leftJoin(
+      credentialGenerations,
+      and(
+        eq(credentialGenerations.profileId, appCredentialMetadata.profileId),
+        eq(credentialGenerations.generationId, appCredentialMetadata.generationId),
+      ),
+    )
+    .where(
+      and(
+        eq(appCredentialMetadata.profileId, profileId),
+        eq(appCredentialMetadata.generationId, generationId),
+      ),
+    )
+  if (!row) throw new RecipientError(404, 'RECIPIENT_CREDENTIAL_NOT_FOUND')
+  return row
+}
+export function recipientCredentialDto(
+  row: Awaited<ReturnType<typeof managedCredentialRow>>,
+  state: RecipientCredential['status']['state'] = 'unknown',
+): RecipientCredential {
+  const { metadata: m, generation: g } = row
+  return {
+    profileId: m.profileId,
+    generationId: m.generationId,
+    schemaUid: m.schemaUid,
+    schemaName: row.schemaName,
+    organizationId: m.issuerOrganizationId,
+    organizationName: row.organizationName,
+    issuerAddress: m.issuerAddress,
+    subjectAddress: m.subjectAddress,
+    networkId: row.networkId,
+    visibility: m.visibility,
+    createdAt: m.createdAt.toISOString(),
+    creationTransactionHash: m.creationTransactionHash,
+    status: {
+      state,
+      accepted: g?.accepted ?? null,
+      expiration: g?.expiration ?? null,
+      deletedLedgerIndex: g?.deletedLedgerIndex ?? null,
+      deletionCause: g?.deletionCause ?? null,
+    },
+  }
+}
+export async function managedPayload(
+  db: XcsDatabase,
+  metadata: CredentialMetadata,
+): Promise<string | undefined> {
+  if (!metadata.payloadStorageKey) return undefined
+  const [payload] = await db
+    .select()
+    .from(appIssuerPayloads)
+    .where(eq(appIssuerPayloads.id, metadata.payloadStorageKey))
+  // The stored bytes must still be bound to the exact recorded issuance; no remote fallback.
+  if (
+    !payload ||
+    payload.inviteId !== metadata.inviteId ||
+    payload.subjectAddress !== metadata.subjectAddress ||
+    payload.payloadDigest !== metadata.payloadDigest
+  )
+    throw new RecipientError(409, 'RECIPIENT_PAYLOAD_UNAVAILABLE')
+  return payload.canonicalPayload
+}
+
+export class RecipientRepository {
+  constructor(
+    private readonly client: DatabaseClient,
+    private readonly origin: string,
+    private readonly policy: EvidencePolicy = {},
+  ) {}
+
+  private transaction<T>(
+    work: (db: XcsDatabase) => Promise<T>,
+    isolationLevel: 'repeatable read' | 'read committed' = 'repeatable read',
+  ): Promise<T> {
+    return this.client.db.transaction((tx) => work(tx as unknown as XcsDatabase), {
+      isolationLevel,
+    })
+  }
+  private async owned(db: XcsDatabase, session: Session, profileId: string, generationId: string) {
+    await currentPortalSession(db, session)
+    const row = await managedCredentialRow(db, profileId, generationId)
+    if (row.metadata.recipientUserId !== session.userId)
+      throw new RecipientError(404, 'RECIPIENT_CREDENTIAL_NOT_FOUND')
+    return row
+  }
+  private async detail(
+    db: XcsDatabase,
+    session: Session,
+    profileId: string,
+    generationId: string,
+  ): Promise<RecipientCredentialDetail> {
+    const row = await this.owned(db, session, profileId, generationId)
+    let state: RecipientCredential['status']['state'] = 'unknown'
+    try {
+      state = (await managedCredentialEvidence(db, row.metadata, undefined, false, this.policy))
+        .verification.onChain as RecipientCredential['status']['state']
+    } catch (error) {
+      if (!(error instanceof IndexerUnavailableError)) throw error
+    }
+    const events = await db
+      .select({
+        transactionHash: credentialEvents.transactionHash,
+        eventType: credentialEvents.eventType,
+        ledgerIndex: credentialEvents.ledgerIndex,
+        deletionCause: credentialEvents.deletionCause,
+      })
+      .from(credentialEvents)
+      .where(
+        and(
+          eq(credentialEvents.profileId, profileId),
+          eq(credentialEvents.generationId, generationId),
+        ),
+      )
+      .orderBy(desc(credentialEvents.ledgerIndex), desc(credentialEvents.transactionIndex))
+      .limit(100)
+    const [schema] = await db
+      .select({ definition: schemas.resolvedDefinition })
+      .from(schemas)
+      .where(and(eq(schemas.profileId, profileId), eq(schemas.schemaUid, row.metadata.schemaUid)))
+    const fields = (schema?.definition as { fields?: Record<string, unknown> } | undefined)?.fields
+    const admission = await issuerAdmission(db, row.metadata.issuerOrganizationId)
+    return {
+      ...recipientCredentialDto(row, state),
+      issuerAdmission: admission.status,
+      disclosure: {
+        publicFields: row.metadata.publicFields,
+        fields: fields && typeof fields === 'object' ? Object.keys(fields) : [],
+      },
+      events: events as RecipientCredentialDetail['events'],
+    }
+  }
+  async workspace(session: Session): Promise<RecipientWorkspace> {
+    return this.transaction(async (db) => {
+      await currentPortalSession(db, session)
+      const references = await db
+        .select({
+          profileId: appCredentialMetadata.profileId,
+          generationId: appCredentialMetadata.generationId,
+        })
+        .from(appCredentialMetadata)
+        .where(eq(appCredentialMetadata.recipientUserId, session.userId))
+        .orderBy(desc(appCredentialMetadata.createdAt))
+        .limit(200)
+      const credentials: RecipientCredential[] = []
+      for (const reference of references) {
+        const row = await managedCredentialRow(db, reference.profileId, reference.generationId)
+        let state: RecipientCredential['status']['state'] = 'unknown'
+        try {
+          state = (await managedCredentialEvidence(db, row.metadata, undefined, false, this.policy))
+            .verification.onChain as RecipientCredential['status']['state']
+        } catch (error) {
+          if (!(error instanceof IndexerUnavailableError)) throw error
+        }
+        credentials.push(recipientCredentialDto(row, state))
+      }
+      const invitations = await db
+        .select({
+          invite: appInvites,
+          name: appOrganizations.name,
+          schemaName: schemas.name,
+          generationId: appCredentialMetadata.generationId,
+        })
+        .from(appInvites)
+        .innerJoin(appOrganizations, eq(appOrganizations.id, appInvites.organizationId))
+        .leftJoin(
+          schemas,
+          and(
+            eq(schemas.profileId, appInvites.profileId),
+            eq(schemas.schemaUid, appInvites.schemaUid),
+          ),
+        )
+        .leftJoin(appCredentialMetadata, eq(appCredentialMetadata.inviteId, appInvites.id))
+        .where(eq(appInvites.claimedBy, session.userId))
+        .orderBy(desc(appInvites.claimedAt))
+        .limit(200)
+      // In-app notifications come from durable issuance and ledger events, including out-of-portal revocation.
+      const notices = await db.execute<{
+        id: string
+        kind: 'issued' | 'revoked'
+        profileId: string
+        generationId: string
+        organizationName: string
+        createdAt: string
+      }>(sql`
+        SELECT e.transaction_hash || ':' || e.node_index AS id,
+          CASE WHEN e.event_type='created' THEN 'issued' ELSE 'revoked' END AS kind,
+          m.profile_id AS "profileId",m.generation_id AS "generationId",o.name AS "organizationName",e.recorded_at AS "createdAt"
+        FROM app_credential_metadata m JOIN credential_events e ON e.profile_id=m.profile_id AND e.generation_id=m.generation_id
+        JOIN app_organizations o ON o.id=m.issuer_organization_id
+        WHERE m.recipient_user_id=${session.userId} AND (e.event_type='created' OR (e.event_type='deleted' AND e.deletion_cause='issuer_revoked'))
+        ORDER BY e.recorded_at DESC,e.transaction_hash DESC LIMIT 200`)
+      return {
+        credentials,
+        invitations: invitations.map(({ invite: i, name, schemaName, generationId }) => ({
+          id: i.id,
+          organizationId: i.organizationId,
+          organizationName: name,
+          profileId: i.profileId,
+          schemaUid: i.schemaUid,
+          schemaName,
+          claimedAt: i.claimedAt!.toISOString(),
+          expiresAt: i.expiresAt.toISOString(),
+          revokedAt: i.revokedAt?.toISOString() ?? null,
+          generationId,
+        })),
+        notifications: notices.map((n) => ({
+          ...n,
+          createdAt: new Date(n.createdAt).toISOString(),
+        })),
+      }
+    })
+  }
+  credential(session: Session, profileId: string, generationId: string) {
+    return this.transaction((db) => this.detail(db, session, profileId, generationId))
+  }
+  payload(session: Session, profileId: string, generationId: string): Promise<RecipientPayload> {
+    return this.transaction(async (db) => {
+      const row = await this.owned(db, session, profileId, generationId)
+      const content = await managedPayload(db, row.metadata)
+      if (content === undefined) throw new RecipientError(404, 'RECIPIENT_PAYLOAD_UNAVAILABLE')
+      const { verification } = await managedCredentialEvidence(
+        db,
+        row.metadata,
+        content,
+        true,
+        this.policy,
+      )
+      if (verification.payload !== 'valid')
+        throw new RecipientError(409, 'RECIPIENT_PAYLOAD_INVALID')
+      return {
+        scope: 'full',
+        claims: filterCredentialClaims((JSON.parse(content) as { claims: Claims }).claims, {
+          scope: 'full',
+          publicFields: [],
+        }),
+        verification,
+      }
+    })
+  }
+  reconcile(
+    session: Session,
+    profileId: string,
+    generationId: string,
+    transactionHash: string,
+    action: 'accept' | 'reject' | 'remove',
+  ) {
+    return this.transaction(async (db) => {
+      const row = await this.owned(db, session, profileId, generationId)
+      // Rejection needs ledger evidence only. Never load payload bytes on this path.
+      const { generation } = await managedCredentialEvidence(
+        db,
+        row.metadata,
+        undefined,
+        false,
+        this.policy,
+      )
+      const wallets = await db.execute(
+        sql`SELECT id FROM app_wallets WHERE user_id=${session.userId} AND network_id=${row.networkId} AND address=${row.metadata.subjectAddress} AND revoked_at IS NULL`,
+      )
+      if (!wallets.length) throw new RecipientError(403, 'RECIPIENT_WALLET_REQUIRED')
+      const [event] = await db
+        .select()
+        .from(credentialEvents)
+        .where(
+          and(
+            eq(credentialEvents.profileId, profileId),
+            eq(credentialEvents.generationId, generationId),
+            eq(credentialEvents.transactionHash, transactionHash),
+          ),
+        )
+      if (
+        !event ||
+        event.issuer !== row.metadata.issuerAddress ||
+        event.subject !== row.metadata.subjectAddress ||
+        event.schemaUid !== row.metadata.schemaUid ||
+        event.ledgerIndex < generation.createdLedgerIndex ||
+        event.ledgerIndex > generation.lastLedgerIndex ||
+        (action === 'accept'
+          ? event.eventType !== 'accepted' || !event.accepted
+          : event.eventType !== 'deleted' ||
+            event.deletionCause !== (action === 'reject' ? 'subject_rejected' : 'subject_removed'))
+      )
+        throw new RecipientError(409, 'RECIPIENT_ACTION_NOT_VALIDATED')
+      return this.detail(db, session, profileId, generationId)
+    })
+  }
+  verifiers(session: Session) {
+    return this.transaction(async (db) => {
+      await currentPortalSession(db, session)
+      const rows = await db.execute<{ id: string; name: string }>(
+        sql`SELECT o.id,o.name FROM app_organizations o JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier' WHERE o.status='active' AND a.status='approved' ORDER BY o.name,o.id LIMIT 200`,
+      )
+      return { verifiers: [...rows] }
+    })
+  }
+  presentations(session: Session, filter?: { profileId: string; generationId: string }) {
+    return this.transaction(async (db) => {
+      await currentPortalSession(db, session)
+      const rows = await db
+        .select({ presentation: appPresentations, name: appOrganizations.name })
+        .from(appPresentations)
+        .leftJoin(
+          appOrganizations,
+          eq(appOrganizations.id, appPresentations.verifierOrganizationId),
+        )
+        .where(
+          and(
+            eq(appPresentations.recipientUserId, session.userId),
+            ...(filter
+              ? [
+                  eq(appPresentations.profileId, filter.profileId),
+                  eq(appPresentations.generationId, filter.generationId),
+                ]
+              : []),
+          ),
+        )
+        .orderBy(desc(sql`${appPresentations.revokedAt} IS NULL`), desc(appPresentations.createdAt))
+        .limit(200)
+      return { presentations: rows.map((r) => presentationDto(r.presentation, r.name)) }
+    })
+  }
+  private async presentationReady(
+    db: XcsDatabase,
+    session: Session,
+    input: PresentationChallengeInput,
+  ) {
+    const row = await this.owned(db, session, input.profileId, input.generationId)
+    // A stored historical link alone cannot authorize a new share after wallet removal.
+    const wallets = await db.execute(
+      sql`SELECT id FROM app_wallets WHERE user_id=${session.userId} AND network_id=${row.networkId} AND address=${row.metadata.subjectAddress} AND revoked_at IS NULL`,
+    )
+    if (!wallets.length) throw new RecipientError(409, 'RECIPIENT_WALLET_REQUIRED')
+    const { verification } = await managedCredentialEvidence(
+      db,
+      row.metadata,
+      undefined,
+      false,
+      this.policy,
+    )
+    if (verification.onChain !== 'active')
+      throw new RecipientError(409, 'RECIPIENT_CREDENTIAL_NOT_ACTIVE')
+    let verifierName: string | null = null
+    if (input.scope === 'full') {
+      if (!input.verifierOrganizationId)
+        throw new RecipientError(400, 'RECIPIENT_VERIFIER_REQUIRED')
+      const rows = await db.execute<{ name: string }>(
+        sql`SELECT o.name FROM app_organizations o JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier' WHERE o.id=${input.verifierOrganizationId} AND o.status='active' AND a.status='approved'`,
+      )
+      if (!rows[0]) throw new RecipientError(409, 'RECIPIENT_VERIFIER_UNAVAILABLE')
+      verifierName = rows[0].name
+    } else if (input.scope !== 'public' || input.verifierOrganizationId)
+      throw new RecipientError(400, 'RECIPIENT_INPUT_INVALID')
+    return { row, verifierName }
+  }
+  presentationChallenge(
+    session: Session,
+    input: PresentationChallengeInput,
+  ): Promise<PresentationChallenge> {
+    return this.transaction(async (db) => {
+      const { row } = await this.presentationReady(db, session, input)
+      // Use the same database clock as consumption; application-host clock skew cannot extend the proof window.
+      const [clock] = await db.execute<{ now: string }>(sql`SELECT statement_timestamp() AS now`)
+      const now = new Date(String(clock!.now)),
+        expiresAt = new Date(now.getTime() + 300000)
+      const id = randomUUID(),
+        presentationId = randomUUID()
+      const request: PresentationProofRequest = {
+        version: 1,
+        origin: this.origin,
+        challengeId: id,
+        presentationId,
+        nonce: randomBytes(32).toString('base64url'),
+        issuedAt: now.toISOString(),
+        expiresAt: expiresAt.toISOString(),
+        profileId: input.profileId,
+        networkId: row.networkId,
+        generationId: input.generationId,
+        issuerAddress: row.metadata.issuerAddress,
+        subjectAddress: row.metadata.subjectAddress,
+        schemaUid: row.metadata.schemaUid,
+        payloadDigest: row.metadata.payloadDigest,
+        visibility: row.metadata.visibility,
+        publicFields: [...row.metadata.publicFields].sort(),
+        scope: input.scope,
+        verifierOrganizationId: input.verifierOrganizationId ?? null,
+      }
+      const message = presentationProofMessage(request)
+      if (Buffer.byteLength(message) > 8192)
+        throw new RecipientError(400, 'RECIPIENT_INPUT_INVALID')
+      await db.execute(
+        sql`DELETE FROM app_presentation_challenges WHERE session_id=${session.id} AND expires_at <= statement_timestamp()`,
+      )
+      await db.insert(appPresentationChallenges).values({
+        id,
+        sessionId: session.id,
+        presentationId,
+        request,
+        message,
+        createdAt: now,
+        expiresAt,
+      })
+      return {
+        id,
+        presentationId,
+        address: row.metadata.subjectAddress,
+        networkId: row.networkId,
+        message,
+        expiresAt: expiresAt.toISOString(),
+      }
+    })
+  }
+  createPresentation(
+    session: Session,
+    input: CreatePresentationInput,
+  ): Promise<CreatedPresentation> {
+    return this.transaction(async (db) => {
+      // Serialize quota decisions per owner/credential. READ COMMITTED below is intentional:
+      // after waiting, authorization, ledger state and count must see the previous creator's commit.
+      const key = JSON.stringify([
+        'presentations',
+        session.userId,
+        input.profileId,
+        input.generationId,
+      ])
+      await db.execute(sql`SELECT pg_advisory_xact_lock(hashtextextended(${key},0))`)
+      const { row, verifierName } = await this.presentationReady(db, session, input)
+      if (!input.proof) throw new RecipientError(400, 'RECIPIENT_PROOF_REQUIRED')
+      // DELETE takes a row lock and rolls back with any later validation failure.
+      // Separate challenge tables prevent wallet-link signatures from crossing purposes.
+      const [challenge] = await db
+        .delete(appPresentationChallenges)
+        .where(
+          and(
+            eq(appPresentationChallenges.id, input.proof.challengeId),
+            eq(appPresentationChallenges.sessionId, session.id),
+          ),
+        )
+        .returning()
+      if (!challenge) throw new RecipientError(403, 'RECIPIENT_PROOF_INVALID')
+      const [clock] = await db.execute<{ fresh: boolean }>(
+        sql`SELECT ${challenge.expiresAt.toISOString()}::timestamptz > statement_timestamp() AS fresh`,
+      )
+      if (!clock?.fresh) throw new RecipientError(409, 'RECIPIENT_PROOF_EXPIRED')
+      const request = challenge.request
+      if (
+        request.origin !== this.origin ||
+        request.challengeId !== challenge.id ||
+        request.presentationId !== challenge.presentationId ||
+        request.issuedAt !== challenge.createdAt.toISOString() ||
+        request.expiresAt !== challenge.expiresAt.toISOString() ||
+        request.scope !== input.scope ||
+        request.verifierOrganizationId !== (input.verifierOrganizationId ?? null) ||
+        !proofMatchesCredential(request, row) ||
+        presentationProofMessage(request) !== challenge.message ||
+        !verifyWalletProof(challenge.message, row.metadata.subjectAddress, input.proof)
+      )
+        throw new RecipientError(403, 'RECIPIENT_PROOF_INVALID')
+      const [quota] = await db.execute<{ count: number }>(
+        sql`SELECT count(*)::int AS count FROM app_presentations WHERE recipient_user_id=${session.userId} AND profile_id=${input.profileId} AND generation_id=${input.generationId} AND revoked_at IS NULL`,
+      )
+      if (quota!.count >= 200) throw new RecipientError(409, 'RECIPIENT_PRESENTATION_LIMIT')
+      const secret = createAppToken()
+      const [presentation] = await db
+        .insert(appPresentations)
+        .values({
+          id: challenge.presentationId,
+          profileId: input.profileId,
+          generationId: input.generationId,
+          recipientUserId: session.userId,
+          scope: input.scope,
+          verifierOrganizationId: input.scope === 'full' ? input.verifierOrganizationId : null,
+          tokenHash: secret.tokenHash,
+        })
+        .returning()
+      await db.insert(appPresentationProofs).values({
+        presentationId: presentation!.id,
+        request,
+        message: challenge.message,
+        signature: input.proof.signature,
+        publicKey: input.proof.publicKey,
+        scheme: input.proof.scheme,
+      })
+      return {
+        ...presentationDto(presentation!, verifierName),
+        token: secret.token,
+        url: `${this.origin}/presentations#${secret.token}`,
+      }
+    }, 'read committed')
+  }
+  revokePresentation(session: Session, id: string): Promise<Presentation> {
+    return this.transaction(async (db) => {
+      await currentPortalSession(db, session)
+      await db
+        .update(appPresentations)
+        .set({ revokedAt: sql`statement_timestamp()` })
+        .where(
+          and(
+            eq(appPresentations.id, id),
+            eq(appPresentations.recipientUserId, session.userId),
+            isNull(appPresentations.revokedAt),
+          ),
+        )
+      const [row] = await db
+        .select({ presentation: appPresentations, name: appOrganizations.name })
+        .from(appPresentations)
+        .leftJoin(
+          appOrganizations,
+          eq(appOrganizations.id, appPresentations.verifierOrganizationId),
+        )
+        .where(
+          and(eq(appPresentations.id, id), eq(appPresentations.recipientUserId, session.userId)),
+        )
+      if (!row) throw new RecipientError(404, 'RECIPIENT_PRESENTATION_NOT_FOUND')
+      return presentationDto(row.presentation, row.name)
+    })
+  }
+}
diff --git a/apps/web/server/xcs/recipient/types.ts b/apps/web/server/xcs/recipient/types.ts
new file mode 100644
index 0000000..d120429
--- /dev/null
+++ b/apps/web/server/xcs/recipient/types.ts
@@ -0,0 +1,116 @@
+import type { Claims } from '../../lib/db/index.js'
+import type { VerificationReport } from '../verification'
+import type { IssuerAdmission } from '../presentations/admission'
+import type { HolderProof } from '../presentations/proof'
+import type { WalletProof } from '../auth/wallet-proof'
+
+export interface RecipientCredential {
+  profileId: string
+  generationId: string
+  schemaUid: string
+  schemaName: string | null
+  organizationId: string
+  organizationName: string
+  issuerAddress: string
+  subjectAddress: string
+  networkId: number
+  visibility: 'public' | 'private'
+  createdAt: string
+  creationTransactionHash: string
+  status: {
+    state: 'pending' | 'active' | 'expired' | 'deleted' | 'unknown'
+    accepted: boolean | null
+    expiration: number | null
+    deletedLedgerIndex: number | null
+    deletionCause: string | null
+  }
+}
+export interface RecipientInvitation {
+  id: string
+  organizationId: string
+  organizationName: string
+  profileId: string
+  schemaUid: string
+  schemaName: string | null
+  claimedAt: string
+  expiresAt: string
+  revokedAt: string | null
+  generationId: string | null
+}
+export interface RecipientNotification {
+  id: string
+  kind: 'issued' | 'revoked'
+  profileId: string
+  generationId: string
+  organizationName: string
+  createdAt: string
+}
+export interface RecipientWorkspace {
+  invitations: RecipientInvitation[]
+  credentials: RecipientCredential[]
+  notifications: RecipientNotification[]
+}
+export interface RecipientCredentialDetail extends RecipientCredential {
+  issuerAdmission: IssuerAdmission['status']
+  disclosure: { publicFields: string[]; fields: string[] }
+  events: {
+    transactionHash: string
+    eventType: 'created' | 'accepted' | 'deleted'
+    ledgerIndex: number
+    deletionCause: string | null
+  }[]
+}
+export interface Presentation {
+  id: string
+  profileId: string
+  generationId: string
+  scope: 'public' | 'full'
+  verifierOrganizationId: string | null
+  verifierOrganizationName: string | null
+  createdAt: string
+  revokedAt: string | null
+}
+export interface PresentationChallengeInput {
+  profileId: string
+  generationId: string
+  scope: 'public' | 'full'
+  verifierOrganizationId?: string | null
+}
+export interface CreatePresentationInput extends PresentationChallengeInput {
+  proof: WalletProof & { challengeId: string }
+}
+export interface PresentationChallenge {
+  id: string
+  presentationId: string
+  address: string
+  networkId: number
+  message: string
+  expiresAt: string
+}
+export interface CreatedPresentation extends Presentation {
+  token: string
+  url: string
+}
+export interface RecipientPayload {
+  scope: 'full'
+  claims: Claims
+  verification: VerificationReport
+}
+export interface ResolvedPresentation {
+  presentation: Presentation
+  credential: RecipientCredential
+  scope: 'public' | 'full'
+  claims: Claims
+  verification: VerificationReport
+  requiresAuthorization: boolean
+  issuerAdmission: IssuerAdmission
+  holderProof: HolderProof
+}
+export class RecipientError extends Error {
+  constructor(
+    readonly statusCode: number,
+    readonly code: string,
+  ) {
+    super(code)
+  }
+}
diff --git a/apps/web/server/xcs/secrets.ts b/apps/web/server/xcs/secrets.ts
new file mode 100644
index 0000000..e7e4fb9
--- /dev/null
+++ b/apps/web/server/xcs/secrets.ts
@@ -0,0 +1,13 @@
+import { readFileSync, statSync } from 'node:fs'
+
+export function serverSecret(env: NodeJS.ProcessEnv, name: string): string {
+  const file = env[`${name}_FILE`],
+    direct = env[name]
+  if (file && direct) throw new Error('ADMIN_SECRET_CONFLICT')
+  if (!file) return direct ?? ''
+  const stat = statSync(file)
+  if (!stat.isFile() || stat.size < 1 || stat.size > 16384) throw new Error('ADMIN_SECRET_INVALID')
+  const value = readFileSync(file, 'utf8').replace(/\r?\n$/, '')
+  if (!value || /[\r\n]/.test(value)) throw new Error('ADMIN_SECRET_INVALID')
+  return value
+}
diff --git a/apps/web/server/xcs/settings.ts b/apps/web/server/xcs/settings.ts
index 36e74e9..c9568fc 100644
--- a/apps/web/server/xcs/settings.ts
+++ b/apps/web/server/xcs/settings.ts
@@ -17,6 +17,13 @@ import { parseNetworkProfile, type NetworkProfile } from '#xcs/core'
  * names, so a bad edit here fails at start-up the way a bad variable used to.
  */
 export const apiSettings = {
+  /** XRPL Commons Identity endpoint used by the account workspace. */
+  XCS_IDENTITY_ISSUER: 'https://account.xrpl.in',
+  /** Session lifetimes for the account workspace. */
+  XCS_AUTH_IDLE_SECONDS: '1800',
+  XCS_AUTH_MAX_SECONDS: '28800',
+  /** Issuer invitation lifetime. */
+  XCS_ISSUER_INVITE_DAYS: '7',
   /** Server-side fetching of credential payloads. Off. */
   XCS_PAYLOAD_FETCH_ENABLED: 'false',
   /** Gateway used to fetch `ipfs://` payloads once the flag above is on. */
@@ -38,13 +45,51 @@ export const apiSettings = {
   XCS_UNTRUSTED_ISSUERS: '',
 } as const satisfies Record<string, string>
 
+function isHttpsLoopbackOrigin(value: string | undefined): value is string {
+  if (!value) return false
+  let url: URL
+  try {
+    url = new URL(value)
+  } catch {
+    return false
+  }
+  return (
+    (value === url.origin || value === `${url.origin}/`) &&
+    url.protocol === 'https:' &&
+    ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) &&
+    url.pathname === '/' &&
+    !url.search &&
+    !url.hash &&
+    !url.username &&
+    !url.password
+  )
+}
+
+function identityIssuer(environment: NodeJS.ProcessEnv): string {
+  const qualification = environment.XCS_LOCAL_IDENTITY_QUALIFICATION
+  if (qualification === undefined || qualification === '') return apiSettings.XCS_IDENTITY_ISSUER
+  if (
+    qualification !== '1' ||
+    !isHttpsLoopbackOrigin(environment.XCS_AUTH_ORIGIN) ||
+    !isHttpsLoopbackOrigin(environment.XCS_IDENTITY_ISSUER)
+  ) {
+    throw new Error('LOCAL_IDENTITY_QUALIFICATION_INVALID')
+  }
+  return new URL(environment.XCS_IDENTITY_ISSUER).origin
+}
+
 /**
  * The environment `loadApiConfig` parses in production: the process environment
- * with the checked-in settings applied on top, so a deployment variable of the
- * same name cannot reintroduce a retired setting or weaken a flag.
+ * with the checked-in settings applied on top, so a deployment variable cannot
+ * reintroduce a retired setting or weaken a flag. The sole exception is the
+ * explicitly enabled, loopback-only Identity qualification contract above.
  */
 export function apiEnvironment(environment: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  return { ...environment, ...apiSettings }
+  return {
+    ...environment,
+    ...apiSettings,
+    XCS_IDENTITY_ISSUER: identityIssuer(environment),
+  }
 }
 
 /**
diff --git a/apps/web/server/xcs/verifier/csv.ts b/apps/web/server/xcs/verifier/csv.ts
new file mode 100644
index 0000000..73c9168
--- /dev/null
+++ b/apps/web/server/xcs/verifier/csv.ts
@@ -0,0 +1,44 @@
+import type { VerifierHistoryEntry } from './types'
+
+function cell(value: string): string {
+  // Spreadsheet applications may ignore leading whitespace before a formula.
+  const safe = /^[\s\uFEFF]*[=+@-]/u.test(value) || /^[\t\r\n]/u.test(value) ? `'${value}` : value
+  return `"${safe.replaceAll('"', '""')}"`
+}
+
+export function historyCsv(history: VerifierHistoryEntry[]): string {
+  const columns = [
+    'id',
+    'organizationId',
+    'presentationId',
+    'profileId',
+    'generationId',
+    'scope',
+    'checkedAt',
+    'onChain',
+    'schema',
+    'payload',
+    'issuerTrust',
+  ]
+  return [
+    columns.map(cell).join(','),
+    ...history.map((entry) =>
+      [
+        entry.id,
+        entry.organizationId,
+        entry.presentationId,
+        entry.profileId,
+        entry.generationId,
+        entry.scope,
+        entry.checkedAt,
+        entry.verification.onChain,
+        entry.verification.schema,
+        entry.verification.payload,
+        entry.verification.issuerTrust,
+      ]
+        .map(cell)
+        .join(','),
+    ),
+    '',
+  ].join('\r\n')
+}
diff --git a/apps/web/server/xcs/verifier/http.ts b/apps/web/server/xcs/verifier/http.ts
new file mode 100644
index 0000000..25a09e4
--- /dev/null
+++ b/apps/web/server/xcs/verifier/http.ts
@@ -0,0 +1,122 @@
+import {
+  createRouter,
+  defineEventHandler,
+  getQuery,
+  getRouterParam,
+  setResponseHeaders,
+  setResponseStatus,
+  type H3Event,
+} from 'h3'
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible'
+import {
+  ApplicationError,
+  inputObject,
+  inputUuid,
+  parseApplicationInput,
+} from '../applications/domain'
+import type { Session } from '../auth/types'
+import { RecipientError } from '../recipient/types'
+import { readJsonBody } from '../private-body'
+import { historyCsv } from './csv'
+import type { PresentationResolver, VerifierRepository } from './repository'
+import { VerifierError } from './types'
+
+export interface VerifierHandlerOptions {
+  repository: Pick<VerifierRepository, 'workspace' | 'apply' | 'history' | 'reopen'>
+  authorize: (event: H3Event, mutation: boolean) => Promise<Session>
+  resolvePresentation: PresentationResolver
+}
+
+export function createVerifierHandler({
+  repository,
+  authorize,
+  resolvePresentation,
+}: VerifierHandlerOptions) {
+  const router = createRouter()
+  const sessions = new WeakMap<H3Event, Session>()
+  const limits = new RateLimiterMemory({ points: 120, duration: 60 })
+  const mutations = new RateLimiterMemory({ points: 20, duration: 60 })
+  function selection(event: H3Event) {
+    const query = getQuery(event)
+    if (Object.keys(query).some((key) => key !== 'organizationId'))
+      throw new VerifierError(400, 'VERIFIER_INPUT_INVALID')
+    return query.organizationId === undefined ? undefined : inputUuid(query.organizationId)
+  }
+  router.get(
+    '/api/verifier/workspace',
+    defineEventHandler((event) => repository.workspace(sessions.get(event)!, selection(event))),
+  )
+  router.post(
+    '/api/verifier/applications',
+    defineEventHandler(async (event) =>
+      repository.apply(
+        sessions.get(event)!,
+        parseApplicationInput(await readJsonBody(event, 22 * 1024 * 1024)),
+      ),
+    ),
+  )
+  router.get(
+    '/api/verifier/history.csv',
+    defineEventHandler(async (event) => {
+      const history = await repository.history(sessions.get(event)!, selection(event))
+      setResponseHeaders(event, {
+        'content-type': 'text/csv; charset=utf-8',
+        'content-disposition': 'attachment; filename="verifier-history.csv"',
+        'content-security-policy': "default-src 'none'; sandbox",
+      })
+      return historyCsv(history)
+    }),
+  )
+  router.post(
+    '/api/verifier/history/:id/presentation',
+    defineEventHandler(async (event) => {
+      if (Object.keys(getQuery(event)).length)
+        throw new VerifierError(400, 'VERIFIER_INPUT_INVALID')
+      inputObject(await readJsonBody(event, 4096), [])
+      return repository.reopen(
+        sessions.get(event)!,
+        inputUuid(getRouterParam(event, 'id')),
+        resolvePresentation,
+      )
+    }),
+  )
+  return defineEventHandler(async (event) => {
+    setResponseHeaders(event, {
+      'cache-control': 'private, no-store',
+      'referrer-policy': 'no-referrer',
+      'x-content-type-options': 'nosniff',
+      'x-frame-options': 'DENY',
+    })
+    try {
+      const mutation = event.method !== 'GET'
+      const session = await authorize(event, mutation)
+      sessions.set(event, session)
+      await limits.consume(session.userId)
+      if (mutation) await mutations.consume(session.userId)
+      return await router.handler(event)
+    } catch (error) {
+      const code =
+        error instanceof RateLimiterRes
+          ? 429
+          : ((error as { statusCode?: number })?.statusCode ?? 503)
+      const status = [400, 401, 403, 404, 405, 409, 413, 415, 422, 429].includes(code) ? code : 503
+      setResponseStatus(event, status)
+      return {
+        error:
+          error instanceof VerifierError ||
+          error instanceof ApplicationError ||
+          error instanceof RecipientError
+            ? error.code
+            : status === 401
+              ? 'AUTH_REQUIRED'
+              : status === 403
+                ? 'AUTH_NOT_AUTHORIZED'
+                : status === 429
+                  ? 'VERIFIER_RATE_LIMITED'
+                  : 'VERIFIER_UNAVAILABLE',
+      }
+    } finally {
+      sessions.delete(event)
+    }
+  })
+}
diff --git a/apps/web/server/xcs/verifier/repository.ts b/apps/web/server/xcs/verifier/repository.ts
new file mode 100644
index 0000000..d69e2ae
--- /dev/null
+++ b/apps/web/server/xcs/verifier/repository.ts
@@ -0,0 +1,129 @@
+import { sql } from 'drizzle-orm'
+import type { DatabaseClient } from '../../lib/db/index.js'
+import type { XcsDatabase } from '../../lib/db/client.js'
+import type { ApplicationInput, ApplicationRepository } from '../applications/domain'
+import type { Session } from '../auth/types'
+import type { ResolvedPresentation } from '../recipient/types'
+import type { VerificationReport } from '../verification'
+import { VerifierError, type VerifierHistoryEntry, type VerifierWorkspace } from './types'
+
+type Query = DatabaseClient['sql']
+export type PresentationResolver = (
+  session: Session,
+  presentationId: string,
+) => Promise<ResolvedPresentation>
+
+export class VerifierRepository {
+  constructor(
+    private readonly client: DatabaseClient,
+    private readonly applications: ApplicationRepository,
+  ) {}
+
+  private async session(query: Query, session: Session) {
+    const [current] = await query`SELECT s.id FROM app_sessions s JOIN app_users u ON u.id=s.user_id
+      WHERE s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+      AND u.status='active' AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()`
+    if (!current) throw new VerifierError(401, 'AUTH_REQUIRED')
+  }
+
+  async workspace(session: Session, selected?: string): Promise<VerifierWorkspace> {
+    await this.session(this.client.sql, session)
+    const organizations = await this.client.sql`SELECT o.id,o.name,o.status,
+      a.status AS "applicationStatus",a.review_reason AS "reviewReason",a.revision
+      FROM app_organizations o JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier'
+      WHERE o.responsible_user_id=${session.userId}
+      ORDER BY (o.status='active' AND a.status='approved') DESC,o.created_at,o.id`
+    const chosen = selected ?? organizations[0]?.id
+    const organization = organizations.find((entry) => entry.id === chosen)
+    if (chosen && !organization) throw new VerifierError(404, 'VERIFIER_ORGANIZATION_NOT_FOUND')
+    return {
+      organizations: organizations as unknown as VerifierWorkspace['organizations'],
+      selectedOrganizationId: organization?.id ?? null,
+      history:
+        organization?.status === 'active' && organization.applicationStatus === 'approved'
+          ? await this.history(session, organization.id)
+          : [],
+    }
+  }
+
+  apply(session: Session, input: ApplicationInput) {
+    return this.applications.apply(session, input, 'verifier')
+  }
+
+  private async approvedOrganization(session: Session, organizationId?: string) {
+    await this.session(this.client.sql, session)
+    const rows = organizationId
+      ? await this.client.sql`SELECT o.id FROM app_organizations o
+        JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier'
+        WHERE o.id=${organizationId} AND o.responsible_user_id=${session.userId}
+        AND o.status='active' AND a.status='approved'`
+      : await this.client.sql`SELECT o.id FROM app_organizations o
+        JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier'
+        WHERE o.responsible_user_id=${session.userId} AND o.status='active' AND a.status='approved'
+        ORDER BY o.created_at,o.id LIMIT 1`
+    if (!rows[0]) throw new VerifierError(403, 'VERIFIER_APPROVAL_REQUIRED')
+    return String(rows[0].id)
+  }
+
+  async history(session: Session, organizationId?: string): Promise<VerifierHistoryEntry[]> {
+    const id = await this.approvedOrganization(session, organizationId)
+    const rows = await this.client.sql`SELECT h.id,h.verifier_organization_id,h.presentation_id,
+      h.profile_id,h.generation_id,h.scope,h.checked_at,h.on_chain,h.schema_status,h.payload_status,h.issuer_trust
+      FROM app_verifier_history h
+      JOIN app_organizations o ON o.id=h.verifier_organization_id AND o.responsible_user_id=${session.userId} AND o.status='active'
+      JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier' AND a.status='approved'
+      JOIN app_sessions s ON s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+      JOIN app_users u ON u.id=s.user_id AND u.status='active'
+      WHERE h.verifier_organization_id=${id} AND h.verifier_user_id=${session.userId}
+      AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()
+      ORDER BY h.checked_at DESC,h.id DESC LIMIT 500`
+    return rows.map((row) => ({
+      id: row.id,
+      organizationId: row.verifier_organization_id,
+      presentationId: row.presentation_id,
+      profileId: row.profile_id,
+      generationId: row.generation_id,
+      scope: row.scope,
+      checkedAt: new Date(row.checked_at).toISOString(),
+      verification: {
+        onChain: row.on_chain,
+        schema: row.schema_status,
+        payload: row.payload_status,
+        issuerTrust: row.issuer_trust,
+      } as VerificationReport,
+    }))
+  }
+
+  async reopen(session: Session, id: string, resolve: PresentationResolver) {
+    await this.session(this.client.sql, session)
+    const [entry] = await this.client.sql`SELECT h.presentation_id FROM app_verifier_history h
+      JOIN app_organizations o ON o.id=h.verifier_organization_id AND o.responsible_user_id=${session.userId} AND o.status='active'
+      JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier' AND a.status='approved'
+      WHERE h.id=${id} AND h.verifier_user_id=${session.userId}`
+    if (!entry) throw new VerifierError(404, 'VERIFIER_HISTORY_NOT_FOUND')
+    // History is a locator, never a cached access grant or a cache of private claims.
+    return resolve(session, String(entry.presentation_id))
+  }
+
+  /** Called inside the presentation resolver's authorized, consistent transaction. */
+  async record(db: XcsDatabase, session: Session, result: ResolvedPresentation) {
+    if (result.requiresAuthorization) return
+    const audience = result.scope === 'full' ? result.presentation.verifierOrganizationId : null
+    if (result.scope === 'full' && !audience) return
+    await db.execute(sql`INSERT INTO app_verifier_history
+      (verifier_organization_id,verifier_user_id,presentation_id,profile_id,generation_id,scope,on_chain,schema_status,payload_status,issuer_trust)
+      SELECT o.id,s.user_id,p.id,p.profile_id,p.generation_id,${result.scope},
+        ${result.verification.onChain},${result.verification.schema},${result.verification.payload},${result.verification.issuerTrust}
+      FROM app_organizations o
+      JOIN app_organization_applications a ON a.organization_id=o.id AND a.role='verifier' AND a.status='approved'
+      JOIN app_sessions s ON s.id=${session.id} AND s.token_hash=${session.tokenHash} AND s.user_id=${session.userId}
+      JOIN app_users u ON u.id=s.user_id AND u.status='active'
+      JOIN app_presentations p ON p.id=${result.presentation.id} AND p.revoked_at IS NULL
+      WHERE o.responsible_user_id=s.user_id AND o.status='active'
+      AND s.expires_at>statement_timestamp() AND s.absolute_expires_at>statement_timestamp()
+      AND p.profile_id=${result.credential.profileId} AND p.generation_id=${result.credential.generationId}
+      AND (${result.scope}='public' AND p.scope='public' OR ${result.scope}='full' AND p.scope='full' AND p.verifier_organization_id=o.id)
+      AND (${audience}::uuid IS NULL OR o.id=${audience}::uuid)
+      ORDER BY o.created_at,o.id LIMIT 1`)
+  }
+}
diff --git a/apps/web/server/xcs/verifier/services.ts b/apps/web/server/xcs/verifier/services.ts
new file mode 100644
index 0000000..a2cb2f9
--- /dev/null
+++ b/apps/web/server/xcs/verifier/services.ts
@@ -0,0 +1,31 @@
+import type { DatabaseClient } from '../../lib/db/index.js'
+import type { ApplicationRepository } from '../applications/domain'
+import { PresentationRepository } from '../presentations/repository'
+import type { EvidencePolicy } from '../presentations/evidence'
+import { VerifierRepository } from './repository'
+
+export interface VerifierDependencies {
+  database: DatabaseClient
+  repository: ApplicationRepository
+}
+
+export function createVerifierServices(
+  dependencies: VerifierDependencies,
+  policy: EvidencePolicy = {},
+) {
+  const repository = new VerifierRepository(dependencies.database, dependencies.repository)
+  const presentations = new PresentationRepository(
+    dependencies.database,
+    (db, session, result) => repository.record(db, session, result),
+    policy,
+  )
+  return { repository, presentations }
+}
+
+export type VerifierServices = ReturnType<typeof createVerifierServices>
+
+declare module 'h3' {
+  interface H3EventContext {
+    xcsVerifierServices?: () => VerifierServices
+  }
+}
diff --git a/apps/web/server/xcs/verifier/types.ts b/apps/web/server/xcs/verifier/types.ts
new file mode 100644
index 0000000..12a28ed
--- /dev/null
+++ b/apps/web/server/xcs/verifier/types.ts
@@ -0,0 +1,30 @@
+import type { OrganizationApplication } from '../applications/domain'
+import type { VerificationReport } from '../verification'
+
+export type VerifierOrganization = OrganizationApplication
+
+export interface VerifierHistoryEntry {
+  id: string
+  organizationId: string
+  presentationId: string
+  profileId: string
+  generationId: string
+  scope: 'public' | 'full'
+  checkedAt: string
+  verification: VerificationReport
+}
+
+export interface VerifierWorkspace {
+  organizations: VerifierOrganization[]
+  selectedOrganizationId: string | null
+  history: VerifierHistoryEntry[]
+}
+
+export class VerifierError extends Error {
+  constructor(
+    readonly statusCode: number,
+    readonly code: string,
+  ) {
+    super(code)
+  }
+}
diff --git a/apps/web/test/admin-config.test.ts b/apps/web/test/admin-config.test.ts
new file mode 100644
index 0000000..6ed9a59
--- /dev/null
+++ b/apps/web/test/admin-config.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { loadAdminConfig } from '../server/xcs/admin/config'
+describe('admin configuration', () => {
+  const env = {
+    XCS_AUTH_ORIGIN: 'https://xcs.example',
+    XCS_IDENTITY_CLIENT_ID: 'test-client',
+    XCS_IDENTITY_CLIENT_SECRET: 'test-secret',
+    NUXT_APP_DATABASE_URL: 'postgres://xcs_app:fixture@localhost/xcs',
+    NUXT_ADMIN_DATABASE_URL: 'postgres://xcs_admin_app:fixture@localhost/xcs',
+    XCS_ADMIN_DOCUMENT_KEY: 'test-only-32-character-signing-key',
+    XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+    XCS_DOCUMENT_FILESYSTEM_DIRECTORY: '/private/documents',
+  }
+  it('is opt-in and requires shared auth and restricted database role', () => {
+    expect(loadAdminConfig({})).toBeUndefined()
+    expect(loadAdminConfig(env)?.storage).toEqual({
+      driver: 'filesystem',
+      directory: '/private/documents',
+    })
+    expect(() => loadAdminConfig({ ...env, XCS_IDENTITY_CLIENT_SECRET: '' })).toThrow(
+      'AUTH_CONFIGURATION_REQUIRED',
+    )
+    expect(() =>
+      loadAdminConfig({
+        ...env,
+        NUXT_ADMIN_DATABASE_URL: 'postgres://xcs_admin:fixture@localhost/xcs',
+      }),
+    ).toThrow('ADMIN_DATABASE_ROLE_REQUIRED')
+    expect(() => loadAdminConfig({ ...env, XCS_DOCUMENT_FILESYSTEM_DIRECTORY: 'public' })).toThrow()
+    expect(() => loadAdminConfig({ ...env, XCS_ADMIN_DOCUMENT_KEY: 'weak' })).toThrow()
+  })
+})
diff --git a/apps/web/test/admin-documents.test.ts b/apps/web/test/admin-documents.test.ts
new file mode 100644
index 0000000..40ec9be
--- /dev/null
+++ b/apps/web/test/admin-documents.test.ts
@@ -0,0 +1,87 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { mkdtemp, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { PrivateDocuments } from '../server/xcs/admin/documents'
+import { decisionInput, transition, verifiedEmail } from '../server/xcs/admin/domain'
+
+const directories: string[] = []
+afterEach(async () => {
+  for (const directory of directories.splice(0))
+    await rm(directory, { recursive: true, force: true })
+})
+describe('admin documents and transitions', () => {
+  it('binds five-minute links to one document and one session', () => {
+    let now = Date.now()
+    const service = new PrivateDocuments('/unused', randomBytes(32).toString('hex'), () => now)
+    const id = randomUUID(),
+      session = randomUUID(),
+      url = new URL(service.link(id, session).url, 'https://xcs.test')
+    const expires = url.searchParams.get('expires'),
+      signature = url.searchParams.get('signature')
+    expect(() => service.verify(id, session, expires, signature)).not.toThrow()
+    expect(() => service.verify(id, randomUUID(), expires, signature)).toThrow(
+      'ADMIN_DOCUMENT_LINK_INVALID',
+    )
+    expect(() => service.verify(randomUUID(), session, expires, signature)).toThrow(
+      'ADMIN_DOCUMENT_LINK_INVALID',
+    )
+    now += 300000
+    expect(() => service.verify(id, session, expires, signature)).toThrow(
+      'ADMIN_DOCUMENT_LINK_EXPIRED',
+    )
+  })
+  it('rejects missing, altered, unsupported, traversal and symlink documents', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'xcs-admin-doc-'))
+    directories.push(directory)
+    const service = new PrivateDocuments(directory, randomBytes(32).toString('hex'))
+    const bytes = Buffer.from('%PDF-1.4\nsynthetic test only\n')
+    const storageKey = `${'a'.repeat(64)}.pdf`
+    const document = {
+      id: randomUUID(),
+      storage_key: storageKey,
+      mime_type: 'application/pdf',
+      byte_length: bytes.length,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+    }
+    await expect(service.read(document)).rejects.toThrow('ADMIN_DOCUMENT_MISSING')
+    await writeFile(join(directory, storageKey), bytes)
+    expect(await service.read(document)).toEqual(bytes)
+    await expect(service.read({ ...document, storage_key: '../proof.pdf' })).rejects.toThrow(
+      'ADMIN_DOCUMENT_PATH_INVALID',
+    )
+    await expect(service.read({ ...document, mime_type: 'text/html' })).rejects.toThrow(
+      'ADMIN_DOCUMENT_INVALID',
+    )
+    const linkedKey = `${'b'.repeat(64)}.pdf`
+    await symlink(join(directory, storageKey), join(directory, linkedKey))
+    await expect(service.read({ ...document, storage_key: linkedKey })).rejects.toThrow(
+      'ADMIN_DOCUMENT_PATH_INVALID',
+    )
+    await writeFile(
+      join(directory, storageKey),
+      Buffer.from(bytes.toString().replace('synthetic', 'tampered!')),
+    )
+    await expect(service.read(document)).rejects.toThrow('ADMIN_DOCUMENT_INTEGRITY_INVALID')
+  })
+  it('enforces the transition matrix and required reason', () => {
+    for (const role of ['issuer', 'verifier'] as const) {
+      expect(transition('pending', role, 'approve')).toBe('approved')
+      expect(transition('pending', role, 'reject')).toBe('rejected')
+      expect(() => transition('rejected', role, 'approve')).toThrow('ADMIN_TRANSITION_INVALID')
+    }
+    expect(transition('approved', 'verifier', 'suspend')).toBe('suspended')
+    expect(transition('suspended', 'verifier', 'restore')).toBe('approved')
+    expect(() => transition('approved', 'issuer', 'suspend')).toThrow()
+    expect(() =>
+      decisionInput({ action: 'reject', reason: ' ', revision: 0, idempotencyKey: randomUUID() }),
+    ).toThrow('ADMIN_REASON_REQUIRED')
+    expect(() =>
+      decisionInput({ action: 'approve', reason: '', revision: -1, idempotencyKey: randomUUID() }),
+    ).toThrow()
+    expect(verifiedEmail('user@example.test', new Date())).toBe('user@example.test')
+    expect(verifiedEmail('user@example.test', null)).toBeNull()
+    expect(verifiedEmail('User <user@example.test>', new Date())).toBeNull()
+  })
+})
diff --git a/apps/web/test/admin-notifications.test.ts b/apps/web/test/admin-notifications.test.ts
new file mode 100644
index 0000000..2da5ee9
--- /dev/null
+++ b/apps/web/test/admin-notifications.test.ts
@@ -0,0 +1,345 @@
+import { createServer, type Socket } from 'node:net'
+import { once } from 'node:events'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  classifySmtpFailure,
+  createNotificationMessage,
+  isNotificationEmail,
+  processNextNotification,
+  type ClaimedNotification,
+  type NotificationRepository,
+  type NotificationTransport,
+} from '../server/xcs/admin/notifications'
+import { createSmtpDelivery, loadSmtpConfiguration } from '../server/xcs/notifications/smtp'
+
+const notification: ClaimedNotification = {
+  id: '84b066bb-aa8d-40a6-b37d-3a3d7cf25485',
+  attemptId: '898709b2-32e9-4e6f-b76d-c0e8c86a1819',
+  decisionId: '4bf585ef-6af5-4f9d-a565-abf70265a7ed',
+  recipientEmail: 'responsible@example.test',
+  organizationName: 'Example organization',
+  role: 'verifier',
+  status: 'approved',
+  reason: 'The application meets the access requirements.',
+}
+
+function setup() {
+  const repository = {
+    recoverStale: vi.fn<NotificationRepository['recoverStale']>().mockResolvedValue(),
+    claim: vi
+      .fn<NotificationRepository['claim']>()
+      .mockResolvedValue({ kind: 'claimed', notification }),
+    finish: vi.fn<NotificationRepository['finish']>().mockResolvedValue(),
+  }
+  const transport = {
+    sendMail: vi
+      .fn<NotificationTransport['sendMail']>()
+      .mockResolvedValue({ accepted: [notification.recipientEmail], rejected: [] }),
+    close: vi.fn(),
+  }
+  return { repository, transport }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('admin notification delivery', () => {
+  it('delivers a bilingual decision with exactly one explicit envelope recipient', async () => {
+    const { repository, transport } = setup()
+    expect(await processNextNotification(repository, transport)).toBe('sent')
+    const message = transport.sendMail.mock.calls[0]![0]
+    expect(message.to).toEqual({ name: '', address: notification.recipientEmail })
+    expect(message.envelope.to).toEqual([notification.recipientEmail])
+    expect(message.text).toContain('now approved')
+    expect(message.text).toContain('maintenant approuvé')
+    expect(message.text).toContain(notification.reason)
+    expect(message.text).not.toContain(notification.decisionId)
+    expect(repository.finish).toHaveBeenCalledWith(notification, 'sent', null)
+    expect(repository.recoverStale).toHaveBeenCalledOnce()
+  })
+
+  it.each(['idle', 'blocked'] as const)('does not send a %s notification', async (kind) => {
+    const { repository, transport } = setup()
+    repository.claim.mockResolvedValue({ kind })
+    expect(await processNextNotification(repository, transport)).toBe(kind)
+    expect(transport.sendMail).not.toHaveBeenCalled()
+    expect(repository.finish).not.toHaveBeenCalled()
+  })
+
+  it('records a definitive connection failure without retaining SMTP error details', async () => {
+    const { repository, transport } = setup()
+    transport.sendMail.mockRejectedValue({
+      command: 'CONN',
+      syscall: 'connect',
+      message: 'sensitive detail',
+    })
+    expect(await processNextNotification(repository, transport)).toBe('failed')
+    expect(repository.finish).toHaveBeenCalledWith(notification, 'failed', 'SMTP_REJECTED')
+    expect(JSON.stringify(repository.finish.mock.calls)).not.toContain('sensitive detail')
+  })
+
+  it('records an ambiguous DATA failure as uncertain', async () => {
+    const { repository, transport } = setup()
+    transport.sendMail.mockRejectedValue({ command: 'DATA', code: 'ETIMEDOUT' })
+    expect(await processNextNotification(repository, transport)).toBe('uncertain')
+    expect(repository.finish).toHaveBeenCalledWith(
+      notification,
+      'uncertain',
+      'SMTP_ACCEPTANCE_UNCERTAIN',
+    )
+  })
+
+  it('bounds the total SMTP attempt and never retries after an ambiguous deadline', async () => {
+    vi.useFakeTimers()
+    const { repository, transport } = setup()
+    transport.sendMail.mockReturnValue(new Promise(() => {}))
+    const result = processNextNotification(repository, transport)
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect(await result).toBe('uncertain')
+    expect(transport.sendMail).toHaveBeenCalledOnce()
+    expect(repository.finish).toHaveBeenCalledWith(
+      notification,
+      'uncertain',
+      'SMTP_ACCEPTANCE_UNCERTAIN',
+    )
+  })
+
+  it('does not misclassify a database failure after successful SMTP as a resendable failure', async () => {
+    const { repository, transport } = setup()
+    repository.finish.mockRejectedValue(new Error('Database unavailable'))
+    await expect(processNextNotification(repository, transport)).rejects.toThrow(
+      'Database unavailable',
+    )
+    expect(repository.finish).toHaveBeenCalledOnce()
+    expect(repository.finish).toHaveBeenCalledWith(notification, 'sent', null)
+  })
+
+  it('requires positive acceptance evidence', async () => {
+    const { repository, transport } = setup()
+    transport.sendMail.mockResolvedValue({ accepted: [], rejected: [] })
+    expect(await processNextNotification(repository, transport)).toBe('uncertain')
+  })
+
+  it('keeps the logical Message-ID stable across explicit attempts', () => {
+    expect(createNotificationMessage(notification).messageId).toBe(
+      createNotificationMessage({ ...notification, attemptId: 'another-attempt' }).messageId,
+    )
+  })
+
+  it('links to the role space without exposing the decision identifier', () => {
+    const message = createNotificationMessage(notification, undefined, 'https://xcs.example.test')
+    expect(message.text).toContain('https://xcs.example.test/verifier')
+    expect(message.html).toContain('Open your space / Ouvrir votre espace')
+    expect(message.text).not.toContain(notification.decisionId)
+  })
+})
+
+describe('SMTP boundaries', () => {
+  it.each([
+    [{ command: 'CONN', code: 'ESOCKET', syscall: 'connect' }, 'failed'],
+    [{ command: 'CONN', code: 'EDNS' }, 'failed'],
+    [{ command: 'CONN', code: 'ECONNECTION' }, 'uncertain'],
+    [{ command: 'CONN', code: 'ETIMEDOUT' }, 'uncertain'],
+    [{ command: 'RCPT TO', responseCode: 550 }, 'failed'],
+    [{ command: 'DATA', responseCode: 451 }, 'failed'],
+    [{ command: 'DATA', code: 'ECONNRESET' }, 'uncertain'],
+    [{ code: 'ETIMEDOUT' }, 'uncertain'],
+    [new Error('unknown'), 'uncertain'],
+  ])('classifies %j conservatively as %s', (error, expected) => {
+    expect(classifySmtpFailure(error)).toBe(expected)
+  })
+
+  it.each([
+    'a@example.test, b@example.test',
+    'Name <a@example.test>',
+    'a@example.test\r\nBcc:b@example.test',
+    '',
+    null,
+  ])('rejects a recipient that is not a single mailbox: %j', (email) => {
+    expect(isNotificationEmail(email)).toBe(false)
+  })
+
+  it('accepts a plain verified mailbox', () => {
+    expect(isNotificationEmail('responsible+test@example.test')).toBe(true)
+  })
+
+  it.each(['https://mailpit', 'bad host', '-smtp.example.com'])(
+    'rejects invalid SMTP host %s',
+    (host) => {
+      expect(() => loadSmtpConfiguration({ XCS_SMTP_HOST: host })).toThrow('valid hostname')
+    },
+  )
+
+  it.each(['0', '-1', '65536', '1025x', '1.5', ''])('rejects invalid SMTP port %s', (port) => {
+    expect(() => loadSmtpConfiguration({ XCS_SMTP_PORT: port })).toThrow('valid port')
+  })
+
+  it.each(['127.0.0.1', 'localhost', 'mailpit'])('accepts local Mailpit host %s', (host) => {
+    const { transport } = createSmtpDelivery({ XCS_SMTP_HOST: host })
+    expect(transport.sendMail).toBeTypeOf('function')
+    transport.close()
+  })
+
+  it('loads authenticated STARTTLS and configurable sender fields for production', () => {
+    const configuration = loadSmtpConfiguration({
+      XCS_SMTP_HOST: 'smtp.example.com',
+      XCS_SMTP_PORT: '587',
+      XCS_SMTP_TLS_MODE: 'starttls',
+      XCS_SMTP_USERNAME: 'xcs-user',
+      XCS_SMTP_PASSWORD: 'private-test-secret',
+      XCS_SMTP_FROM_NAME: 'XCS Commons',
+      XCS_SMTP_FROM_ADDRESS: 'notifications@example.com',
+      XCS_SMTP_ENVELOPE_FROM: 'bounces@example.com',
+    })
+    expect(configuration).toMatchObject({
+      host: 'smtp.example.com',
+      port: 587,
+      secure: false,
+      requireTls: true,
+      ignoreTls: false,
+      username: 'xcs-user',
+      sender: {
+        name: 'XCS Commons',
+        address: 'notifications@example.com',
+        envelopeFrom: 'bounces@example.com',
+        messageIdDomain: 'example.com',
+      },
+    })
+  })
+
+  it('supports implicit TLS without weakening certificate verification', () => {
+    const configuration = loadSmtpConfiguration({
+      XCS_SMTP_HOST: 'smtp.example.com',
+      XCS_SMTP_PORT: '465',
+      XCS_SMTP_TLS_MODE: 'tls',
+      XCS_SMTP_FROM_ADDRESS: 'notifications@example.com',
+    })
+    expect(configuration).toMatchObject({
+      secure: true,
+      requireTls: false,
+      ignoreTls: false,
+    })
+  })
+
+  it.each([
+    [{ XCS_SMTP_HOST: 'smtp.example.com' }, 'XCS_SMTP_TLS_MODE'],
+    [
+      {
+        XCS_SMTP_HOST: 'smtp.example.com',
+        XCS_SMTP_TLS_MODE: 'disabled',
+        XCS_SMTP_FROM_ADDRESS: 'notifications@example.com',
+      },
+      'enable TLS',
+    ],
+    [{ XCS_SMTP_USERNAME: 'user' }, 'configured together'],
+    [{ XCS_SMTP_PASSWORD: 'secret' }, 'configured together'],
+    [{ XCS_SMTP_FROM_ADDRESS: 'Sender <notifications@example.com>' }, 'valid mailbox'],
+    [{ XCS_SMTP_FROM_NAME: 'XCS\r\nBcc: other@example.com' }, 'display name'],
+    [{ XCS_SMTP_ENVELOPE_FROM: 'a@example.com,b@example.com' }, 'valid mailbox'],
+  ])('rejects an unsafe or incomplete production configuration', (environment, expected) => {
+    expect(() => loadSmtpConfiguration(environment)).toThrow(expected)
+  })
+
+  it('applies the configured header sender and envelope sender without changing the recipient', () => {
+    const sender = loadSmtpConfiguration({
+      XCS_SMTP_FROM_NAME: 'XRPL Commons',
+      XCS_SMTP_FROM_ADDRESS: 'notify@example.test',
+      XCS_SMTP_ENVELOPE_FROM: 'bounce@example.test',
+    }).sender
+    const message = createNotificationMessage(notification, sender)
+    expect(message.from).toEqual({ name: 'XRPL Commons', address: 'notify@example.test' })
+    expect(message.envelope).toEqual({
+      from: 'bounce@example.test',
+      to: [notification.recipientEmail],
+    })
+    expect(message.messageId).toBe(`<admin-decision-${notification.decisionId}@example.test>`)
+  })
+})
+
+// Exercise Nodemailer's actual SMTP protocol and error shape, without an external service.
+async function localSmtpServer(accept: boolean) {
+  const sockets = new Set<Socket>()
+  const messages: string[] = []
+  const server = createServer((socket) => {
+    sockets.add(socket)
+    socket.on('close', () => sockets.delete(socket))
+    socket.on('error', () => {})
+    socket.write('220 local.test ESMTP\r\n')
+    let buffer = ''
+    let inData = false
+    let content = ''
+    socket.on('data', (chunk) => {
+      buffer += chunk.toString('utf8')
+      let newline: number
+      while ((newline = buffer.indexOf('\r\n')) !== -1) {
+        const line = buffer.slice(0, newline)
+        buffer = buffer.slice(newline + 2)
+        if (inData) {
+          if (line === '.') {
+            messages.push(content)
+            inData = false
+            if (accept) socket.write('250 accepted\r\n')
+            else socket.destroy()
+          } else content += `${line}\n`
+        } else if (line.startsWith('EHLO') || line.startsWith('HELO')) {
+          socket.write('250 local.test\r\n')
+        } else if (line === 'DATA') {
+          inData = true
+          socket.write('354 send data\r\n')
+        } else if (line === 'QUIT') socket.end('221 bye\r\n')
+        else socket.write('250 OK\r\n')
+      }
+    })
+  })
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const address = server.address()
+  if (!address || typeof address === 'string') throw new Error('SMTP test server has no port')
+  return {
+    port: address.port,
+    messages,
+    close: async () => {
+      for (const socket of sockets) socket.destroy()
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()))
+      })
+    },
+  }
+}
+
+describe('actual local SMTP transport', () => {
+  it('receives the decision and persists success after the SMTP acknowledgement', async () => {
+    const server = await localSmtpServer(true)
+    const { transport } = createSmtpDelivery({ XCS_SMTP_PORT: String(server.port) })
+    try {
+      const { repository } = setup()
+      expect(await processNextNotification(repository, transport)).toBe('sent')
+      expect(server.messages).toHaveLength(1)
+      expect(server.messages[0]).toContain('To: responsible@example.test')
+      expect(server.messages[0]).toContain(
+        `Message-ID: <admin-decision-${notification.decisionId}@xcs.test>`,
+      )
+      expect(repository.finish).toHaveBeenCalledWith(notification, 'sent', null)
+    } finally {
+      transport.close()
+      await server.close()
+    }
+  })
+
+  it('keeps acceptance uncertain when the connection breaks after receiving DATA', async () => {
+    const server = await localSmtpServer(false)
+    const { transport } = createSmtpDelivery({ XCS_SMTP_PORT: String(server.port) })
+    try {
+      const { repository } = setup()
+      expect(await processNextNotification(repository, transport)).toBe('uncertain')
+      expect(server.messages).toHaveLength(1)
+      expect(repository.finish).toHaveBeenCalledWith(
+        notification,
+        'uncertain',
+        'SMTP_ACCEPTANCE_UNCERTAIN',
+      )
+    } finally {
+      transport.close()
+      await server.close()
+    }
+  })
+})
diff --git a/apps/web/test/admin-postgres.integration.test.ts b/apps/web/test/admin-postgres.integration.test.ts
new file mode 100644
index 0000000..616ab96
--- /dev/null
+++ b/apps/web/test/admin-postgres.integration.test.ts
@@ -0,0 +1,480 @@
+import { startAdminRuntime } from './helpers/adminRuntime'
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createApp, toNodeListener } from 'h3'
+import inject from 'light-my-request'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import { requireAuthRole, requireCsrf, SESSION_COOKIE } from '../server/xcs/auth/http'
+import type { Session } from '../server/xcs/auth/types'
+import { createAdminHandler } from '../server/xcs/admin/http'
+import { AdminRepository } from '../server/xcs/admin/repository'
+import { PrivateDocuments } from '../server/xcs/admin/documents'
+import {
+  PostgresNotificationRepository,
+  processNextNotification,
+} from '../server/xcs/admin/notifications'
+import { createSmtpDelivery } from '../server/xcs/notifications/smtp'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+let operator: DatabaseClient,
+  db: DatabaseClient,
+  app: DatabaseClient,
+  admin: DatabaseClient,
+  notifier: DatabaseClient
+let auth: PostgresAuthRepository,
+  repo: AdminRepository,
+  session: Session,
+  name: string,
+  directory: string
+let runtimeUrls: { api: string; auth: string; admin: string }
+const origin = 'https://xcs.example',
+  adminInput = {
+    ...createAppToken(),
+    csrfToken: createAppToken().token,
+    idleSeconds: 1800,
+    absoluteSeconds: 28800,
+  }
+const subject = randomUUID()
+let listener: ReturnType<typeof toNodeListener>
+const headers = () => ({
+  cookie: `${SESSION_COOKIE}=${adminInput.token}`,
+  origin,
+  'x-xcs-csrf': adminInput.csrfToken,
+  'sec-fetch-site': 'same-origin',
+})
+async function fixture(verified = true, role = 'verifier') {
+  const [user] =
+    await db.sql`INSERT INTO app_users(identity_issuer,identity_subject,email,email_verified_at,display_name) VALUES ('https://identity.test',${randomUUID()},'responsible@example.test',${verified ? new Date().toISOString() : null},'Synthetic responsible') RETURNING id`
+  const [org] =
+    await db.sql`INSERT INTO app_organizations(responsible_user_id,name) VALUES (${user!.id},'Synthetic organization') RETURNING id`
+  await db.sql`INSERT INTO app_organization_applications(organization_id,role,description) VALUES (${org!.id},${role},'Synthetic review only')`
+  return { id: org!.id as string, userId: user!.id as string, role }
+}
+const decision = (revision = 0, action = 'approve', reason = '') => ({
+  action,
+  revision,
+  reason,
+  idempotencyKey: randomUUID(),
+})
+const post = (id: string, role: string, payload: unknown) =>
+  inject(listener, {
+    method: 'POST',
+    url: `/api/admin/applications/${id}/${role}/decisions`,
+    headers: headers(),
+    payload,
+  })
+
+describe.skipIf(!url)('admin real PostgreSQL / shared auth / restricted pools', () => {
+  beforeAll(async () => {
+    operator = createDatabaseClient(url!, { onNotice: () => undefined })
+    name = `xcs_admin_web_${randomUUID().replaceAll('-', '')}`
+    await operator.sql`CREATE DATABASE ${operator.sql(name)} TEMPLATE template0`
+    const parsed = new URL(url!)
+    parsed.pathname = '/' + name
+    db = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const passwords = await createManagedRuntimeDatabaseUsers(db, {
+      indexerPassword: randomBytes(32).toString('hex'),
+      apiPassword: randomBytes(32).toString('hex'),
+      payloadWriterPassword: randomBytes(32).toString('hex'),
+      monitorPassword: randomBytes(32).toString('hex'),
+      applicationPassword: randomBytes(32).toString('hex'),
+      adminApplicationPassword: randomBytes(32).toString('hex'),
+      notifierPassword: randomBytes(32).toString('hex'),
+    })
+    await bootstrapDatabase(db, { clusterScope: 'dedicated' })
+    const connection = (role: string, password: string) => {
+      const u = new URL(parsed)
+      u.username = role
+      u.password = password
+      return createDatabaseClient(u.toString(), { onNotice: () => undefined })
+    }
+    app = connection('xcs_app', passwords.applicationPassword)
+    admin = connection('xcs_admin_app', passwords.adminApplicationPassword)
+    notifier = connection('xcs_notifier', passwords.notifierPassword)
+    const roleUrl = (role: string, password: string) => {
+      const u = new URL(parsed)
+      u.username = role
+      u.password = password
+      return u.toString()
+    }
+    runtimeUrls = {
+      api: roleUrl('xcs_api', passwords.apiPassword),
+      auth: roleUrl('xcs_app', passwords.applicationPassword),
+      admin: roleUrl('xcs_admin_app', passwords.adminApplicationPassword),
+    }
+    auth = new PostgresAuthRepository(app)
+    repo = new AdminRepository(admin)
+    await auth.createSession(
+      { issuer: 'https://identity.test', subject, emailVerified: false },
+      adminInput,
+    )
+    session = (await auth.session(adminInput.tokenHash))!
+    await db.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${session.userId},'admin')`
+    session = (await auth.session(adminInput.tokenHash))!
+    directory = await mkdtemp(join(tmpdir(), 'xcs-admin-http-'))
+    listener = toNodeListener(
+      createApp().use(
+        createAdminHandler({
+          repository: repo,
+          documents: new PrivateDocuments(directory, randomBytes(32).toString('hex')),
+          authorize: async (event, mutation) => {
+            const s = await requireAuthRole(event, auth, 'admin')
+            if (mutation) requireCsrf(event, s, origin)
+            return s
+          },
+        }),
+      ),
+    )
+  }, 30000)
+  afterAll(async () => {
+    await Promise.all([app?.close(), admin?.close(), notifier?.close(), db?.close()])
+    if (operator && /^xcs_admin_web_[a-f0-9]{32}$/.test(name))
+      await operator.sql`DROP DATABASE ${operator.sql(name)} WITH (FORCE)`
+    await operator?.close()
+    if (directory) await rm(directory, { recursive: true, force: true })
+  })
+  it('denies anonymous and non-admin requests and all CSRF variants', async () => {
+    for (const path of [
+      '/api/admin/applications',
+      '/api/admin/verifiers',
+      '/api/admin/audit',
+      `/api/admin/documents/${randomUUID()}`,
+    ])
+      expect((await inject(listener, { url: path })).statusCode).toBe(401)
+    const token = {
+      ...createAppToken(),
+      csrfToken: createAppToken().token,
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+    }
+    await auth.createSession(
+      { issuer: 'https://identity.test', subject: randomUUID(), emailVerified: false },
+      token,
+    )
+    expect(
+      (
+        await inject(listener, {
+          url: '/api/admin/applications',
+          headers: { cookie: `${SESSION_COOKIE}=${token.token}` },
+        })
+      ).statusCode,
+    ).toBe(403)
+    const f = await fixture()
+    for (const extra of [
+      { origin: 'https://evil.test' },
+      { 'x-xcs-csrf': '' },
+      { 'sec-fetch-site': 'cross-site' },
+    ])
+      expect(
+        (
+          await inject(listener, {
+            method: 'POST',
+            url: `/api/admin/applications/${f.id}/verifier/decisions`,
+            headers: { ...headers(), ...extra },
+            payload: decision(),
+          })
+        ).statusCode,
+      ).toBe(403)
+    expect(
+      (
+        await db.sql`SELECT status FROM app_organization_applications WHERE organization_id=${f.id}`
+      )[0]!.status,
+    ).toBe('pending')
+  })
+  it('atomically approves once under duplicate requests and rejects key reuse for another body', async () => {
+    const f = await fixture(),
+      input = decision()
+    const results = await Promise.all([post(f.id, f.role, input), post(f.id, f.role, input)])
+    expect(results.map((r) => r.statusCode)).toEqual([200, 200])
+    expect(results.map((r) => r.json().replayed).sort()).toEqual([false, true])
+    expect(results[0]!.json().decision.id).toBe(results[1]!.json().decision.id)
+    expect(
+      (await post(f.id, f.role, { ...input, action: 'reject', reason: 'Other' })).statusCode,
+    ).toBe(409)
+    const [row] =
+      await db.sql`SELECT a.revision,(SELECT count(*)::int FROM app_admin_decisions WHERE organization_id=${f.id}) AS decisions,(SELECT count(*)::int FROM app_admin_notifications WHERE decision_id IN(SELECT id FROM app_admin_decisions WHERE organization_id=${f.id})) AS notifications FROM app_organization_applications a WHERE organization_id=${f.id}`
+    expect(row).toMatchObject({ revision: 1, decisions: 1, notifications: 1 })
+  })
+  it('reports the winning decision on a stale concurrent review and supports verifier suspend/restore', async () => {
+    const f = await fixture()
+    const results = await Promise.all([
+      post(f.id, f.role, decision()),
+      post(f.id, f.role, decision(0, 'reject', 'Insufficient evidence')),
+    ])
+    expect(results.map((r) => r.statusCode).sort()).toEqual([200, 409])
+    expect(results.find((r) => r.statusCode === 409)!.json()).toMatchObject({
+      error: 'ADMIN_CONFLICT',
+      current: { revision: 1 },
+    })
+    const approved = await fixture()
+    await post(approved.id, approved.role, decision())
+    expect((await post(approved.id, approved.role, decision(1, 'suspend', ''))).statusCode).toBe(
+      400,
+    )
+    expect(
+      (await post(approved.id, approved.role, decision(1, 'suspend', 'Evidence outdated')))
+        .statusCode,
+    ).toBe(200)
+    expect((await post(approved.id, approved.role, decision(2, 'restore'))).statusCode).toBe(200)
+    const issuer = await fixture(true, 'issuer')
+    await post(issuer.id, issuer.role, decision())
+    expect(
+      (await post(issuer.id, issuer.role, decision(1, 'suspend', 'Invalid role'))).statusCode,
+    ).toBe(409)
+  })
+  it('rolls the decision back when insertion into the outbox fails', async () => {
+    const f = await fixture()
+    await db.sql.unsafe(
+      `CREATE FUNCTION test_fail_admin_outbox() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'synthetic failure'; END $$; CREATE TRIGGER test_admin_failure BEFORE INSERT ON app_admin_notifications FOR EACH ROW EXECUTE FUNCTION test_fail_admin_outbox()`,
+    )
+    try {
+      expect((await post(f.id, f.role, decision())).statusCode).toBe(503)
+    } finally {
+      await db.sql.unsafe(
+        'DROP TRIGGER test_admin_failure ON app_admin_notifications; DROP FUNCTION test_fail_admin_outbox()',
+      )
+    }
+    expect(
+      (
+        await db.sql`SELECT status,revision FROM app_organization_applications WHERE organization_id=${f.id}`
+      )[0],
+    ).toMatchObject({ status: 'pending', revision: 0 })
+    expect(
+      await db.sql`SELECT id FROM app_admin_decisions WHERE organization_id=${f.id}`,
+    ).toHaveLength(0)
+  })
+  it('keeps decisions with blocked unverified email and retries independently', async () => {
+    const f = await fixture(false),
+      response = await post(f.id, f.role, decision())
+    expect(response.statusCode).toBe(200)
+    const [notification] =
+      await db.sql`SELECT id,status FROM app_admin_notifications WHERE decision_id=${response.json().decision.id}`
+    expect(notification!.status).toBe('blocked')
+    expect(
+      (
+        await inject(listener, {
+          method: 'POST',
+          url: `/api/admin/notifications/${notification!.id}/retry`,
+          headers: headers(),
+          payload: {},
+        })
+      ).statusCode,
+    ).toBe(409)
+    await db.sql`UPDATE app_users SET email_verified_at=statement_timestamp() WHERE id=${f.userId}`
+    expect(
+      (
+        await inject(listener, {
+          method: 'POST',
+          url: `/api/admin/notifications/${notification!.id}/retry`,
+          headers: headers(),
+          payload: {},
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect(
+      await db.sql`SELECT id FROM app_admin_decisions WHERE organization_id=${f.id}`,
+    ).toHaveLength(1)
+  })
+  it('downloads valid private documents only for the issuing current admin session', async () => {
+    const f = await fixture(),
+      bytes = Buffer.from('%PDF-1.4\nSynthetic proof\n'),
+      id = randomUUID()
+    const storageKey = `${'a'.repeat(64)}.pdf`
+    await writeFile(join(directory, storageKey), bytes)
+    await db.sql`INSERT INTO app_documents(id,organization_id,application_role,storage_key,mime_type,byte_length,sha256,uploaded_by) VALUES (${id},${f.id},'verifier',${storageKey},'application/pdf',${bytes.length},${createHash('sha256').update(bytes).digest('hex')},${f.userId})`
+    const link = await inject(listener, {
+      method: 'POST',
+      url: `/api/admin/documents/${id}/link`,
+      headers: headers(),
+      payload: {},
+    })
+    expect(link.statusCode).toBe(200)
+    const response = await inject(listener, { url: link.json().url, headers: headers() })
+    expect(response.statusCode).toBe(200)
+    expect(response.headers['cache-control']).toContain('no-store')
+    expect(response.rawPayload).toEqual(bytes)
+    const other = {
+      ...createAppToken(),
+      csrfToken: createAppToken().token,
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+    }
+    await auth.createSession(
+      { issuer: 'https://identity.test', subject, emailVerified: false },
+      other,
+    )
+    expect(
+      (
+        await inject(listener, {
+          url: link.json().url,
+          headers: { cookie: `${SESSION_COOKIE}=${other.token}` },
+        })
+      ).statusCode,
+    ).toBe(403)
+    await db.sql`UPDATE app_user_roles SET revoked_at=statement_timestamp() WHERE user_id=${session.userId} AND role='admin'`
+    expect((await inject(listener, { url: link.json().url, headers: headers() })).statusCode).toBe(
+      403,
+    )
+    await expect(
+      repo.decide(
+        session,
+        f.id,
+        'verifier',
+        decision() as Parameters<AdminRepository['decide']>[3],
+      ),
+    ).rejects.toThrow('ADMIN_ACCESS_REVOKED')
+    await db.sql`UPDATE app_user_roles SET revoked_at=NULL WHERE user_id=${session.userId} AND role='admin'`
+    await writeFile(join(directory, storageKey), 'corrupted')
+    expect((await inject(listener, { url: link.json().url, headers: headers() })).statusCode).toBe(
+      422,
+    )
+  })
+  it('lists metadata without indexer availability or claims and denies private table/audit writes', async () => {
+    const response = await inject(listener, {
+      url: '/api/admin/applications?page=1',
+      headers: headers(),
+    })
+    expect(response.statusCode).toBe(200)
+    expect(response.json().counts).toHaveProperty('issuer')
+    const audit = await inject(listener, { url: '/api/admin/audit', headers: headers() })
+    expect(audit.statusCode).toBe(200)
+    expect(JSON.stringify(audit.json())).not.toMatch(
+      /private_claims|token_hash|identity_subject|storage_key/,
+    )
+    await expect(admin.sql`SELECT * FROM app_credential_metadata`).rejects.toMatchObject({
+      code: '42501',
+    })
+    await expect(admin.sql`DELETE FROM app_admin_decisions`).rejects.toMatchObject({
+      code: '42501',
+    })
+    await expect(
+      notifier.sql`UPDATE app_organization_applications SET status='rejected'`,
+    ).rejects.toMatchObject({ code: '42501' })
+  })
+  it('marks interrupted sending uncertain and never automatically reclaims it', async () => {
+    await db.sql`UPDATE app_admin_notifications SET status='blocked' WHERE status='pending'`
+    const f = await fixture(),
+      r = await post(f.id, f.role, decision())
+    await db.sql`UPDATE app_admin_notifications SET status='sending',attempt_id=${randomUUID()},claimed_at=statement_timestamp()-interval '10 minutes' WHERE decision_id=${r.json().decision.id}`
+    const worker = new PostgresNotificationRepository(notifier)
+    await worker.recoverStale()
+    expect(
+      (
+        await db.sql`SELECT status FROM app_admin_notifications WHERE decision_id=${r.json().decision.id}`
+      )[0]!.status,
+    ).toBe('uncertain')
+    expect(await worker.claim()).toEqual({ kind: 'idle' })
+  })
+  it.skipIf(!process.env.XCS_TEST_MAILPIT_URL)(
+    'delivers to Mailpit, recovers a definite SMTP failure without a new decision',
+    async () => {
+      const f = await fixture(),
+        r = await post(f.id, f.role, decision())
+      const worker = new PostgresNotificationRepository(notifier)
+      const { transport: down } = createSmtpDelivery({
+        XCS_SMTP_HOST: '127.0.0.1',
+        XCS_SMTP_PORT: '1',
+      })
+      expect(await processNextNotification(worker, down)).toBe('failed')
+      down.close()
+      const [notification] =
+        await db.sql`SELECT id,status FROM app_admin_notifications WHERE decision_id=${r.json().decision.id}`
+      expect(notification!.status).toBe('failed')
+      await repo.retryNotification(notification!.id)
+      const { transport: smtp } = createSmtpDelivery({
+        XCS_SMTP_HOST: '127.0.0.1',
+        XCS_SMTP_PORT: process.env.XCS_TEST_SMTP_PORT!,
+      })
+      expect(await processNextNotification(worker, smtp)).toBe('sent')
+      smtp.close()
+      expect(
+        await db.sql`SELECT id FROM app_admin_decisions WHERE organization_id=${f.id}`,
+      ).toHaveLength(1)
+      const messages = (await fetch(`${process.env.XCS_TEST_MAILPIT_URL}/api/v1/messages`).then(
+        (r) => r.json(),
+      )) as { messages: { ID: string }[] }
+      let found = false
+      for (const message of messages.messages) {
+        const detail = (await fetch(
+          `${process.env.XCS_TEST_MAILPIT_URL}/api/v1/message/${message.ID}`,
+        ).then((r) => r.json())) as { Text: string }
+        if (
+          detail.Text.includes('The verifier access for Synthetic organization is now approved.')
+        ) {
+          expect(detail.Text).not.toContain(r.json().decision.id)
+          found = true
+        }
+      }
+      expect(found).toBe(true)
+    },
+  )
+  it.skipIf(process.env.XCS_ADMIN_RUNTIME_TEST !== '1')(
+    'serves four real authenticated screens and persists a browser decision over HTTPS',
+    async () => {
+      const f = await fixture()
+      await db.sql`UPDATE app_organizations SET name='Runtime browser organization' WHERE id=${f.id}`
+      const runtime = await startAdminRuntime(directory, runtimeUrls)
+      try {
+        await runtime.context.addCookies([
+          {
+            name: SESSION_COOKIE,
+            value: adminInput.token,
+            url: runtime.origin,
+            httpOnly: true,
+            secure: true,
+            sameSite: 'Lax',
+          },
+        ])
+        const page = await runtime.context.newPage()
+        const errors: string[] = []
+        page.on('pageerror', (error) => errors.push(error.message))
+        await page.goto(runtime.origin + '/admin')
+        await page.getByRole('heading', { name: 'Applications', exact: true }).waitFor()
+        await page.goto(`${runtime.origin}/admin/applications/${f.id}/verifier`)
+        await page
+          .getByRole('heading', { name: 'Runtime browser organization', exact: true })
+          .waitFor()
+        // SSR headings can appear before Vue has attached the decision button handler.
+        await page.locator('[data-client-ready="true"]').waitFor()
+        await page.getByRole('button', { name: 'Approve access', exact: true }).click()
+        await page.getByTestId('admin-confirm-decision').click()
+        await page.waitForURL(/\/admin\?/)
+        expect(
+          (
+            await db.sql`SELECT status FROM app_organization_applications WHERE organization_id=${f.id}`
+          )[0]!.status,
+        ).toBe('approved')
+        await page.goto(runtime.origin + '/admin/verifiers')
+        await page
+          .getByRole('link', { name: 'Review Runtime browser organization', exact: true })
+          .waitFor()
+        await page.goto(runtime.origin + '/admin/audit')
+        await page
+          .getByRole('heading', { name: 'Runtime browser organization', exact: true })
+          .waitFor()
+        await page.goto(runtime.origin + '/fr/admin')
+        await page.getByRole('heading', { name: 'Candidatures', exact: true }).waitFor()
+        expect(errors).toEqual([])
+        await db.sql`UPDATE app_user_roles SET revoked_at=statement_timestamp() WHERE user_id=${session.userId} AND role='admin'`
+        await page.goto(`${runtime.origin}/admin/applications/${f.id}/verifier`)
+        await page.waitForURL(/\/auth\/not-authorized$/)
+      } finally {
+        await runtime.close()
+        await db.sql`UPDATE app_user_roles SET revoked_at=NULL WHERE user_id=${session.userId} AND role='admin'`
+      }
+    },
+    60000,
+  )
+})
diff --git a/apps/web/test/api/runtime.integration.test.ts b/apps/web/test/api/runtime.integration.test.ts
new file mode 100644
index 0000000..628f4ca
--- /dev/null
+++ b/apps/web/test/api/runtime.integration.test.ts
@@ -0,0 +1,344 @@
+import { spawn, type ChildProcess } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+import { access } from 'node:fs/promises'
+import { createServer } from 'node:net'
+import { setTimeout as delay } from 'node:timers/promises'
+import { fileURLToPath } from 'node:url'
+
+import { computeSchemaUid, encodeCredentialPayload, payloadDigest } from '#xcs/core/index.js'
+import { createDatabaseClient, type DatabaseClient } from '../../server/lib/db/index.js'
+import { bootstrapDatabase } from '../../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from '../lib/db/managedRuntimeUsers.js'
+import { buildCredentialCreate } from '#xcs/sdk/index.js'
+import { describe, expect, it } from 'vitest'
+import { Wallet } from 'xrpl'
+
+// Opt in separately from unit/SQL suites: runtime roles are cluster-wide, so these
+// integration suites must run sequentially on a disposable PostgreSQL 18 cluster.
+const enabled = process.env.XCS_REQUIRE_RUNTIME_TESTS === '1'
+const adminUrl = process.env.XCS_TEST_DATABASE_URL
+if (enabled && !adminUrl) throw new Error('XCS_TEST_DATABASE_URL is required by runtime tests')
+
+const outputEntry = fileURLToPath(new URL('../../.output/server/index.mjs', import.meta.url))
+const profileId = 'runtime-testnet'
+const hash = 'a'.repeat(64)
+const publicPayloadOrigin = 'https://payload.test'
+const fixturePasswords = {
+  indexerPassword: 'indexer-runtime-integration-password-01',
+  apiPassword: 'reader-runtime-integration-password-01',
+  payloadWriterPassword: 'payload-runtime-integration-password-01',
+  monitorPassword: 'monitor-runtime-integration-password-01',
+}
+
+function roleUrl(url: string, role: string, password: string) {
+  const parsed = new URL(url)
+  parsed.username = role
+  parsed.password = password
+  return parsed.toString()
+}
+
+async function unusedPort(): Promise<number> {
+  const server = createServer()
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  await new Promise<void>((resolve, reject) =>
+    server.close((error) => (error ? reject(error) : resolve())),
+  )
+  if (!address || typeof address === 'string') throw new Error('No test port allocated')
+  return address.port
+}
+
+async function stopServer(server: ChildProcess) {
+  if (server.exitCode !== null || server.signalCode !== null) return
+  const exited = new Promise<void>((resolve) => server.once('exit', () => resolve()))
+  server.kill('SIGTERM')
+  const forceKill = setTimeout(() => server.kill('SIGKILL'), 5_000)
+  try {
+    await exited
+  } finally {
+    clearTimeout(forceKill)
+  }
+}
+
+async function seedProjection(database: DatabaseClient) {
+  const issuer = Wallet.generate()
+  const subject = Wallet.generate().address
+  const definition = {
+    xcsVersion: '0.1' as const,
+    name: 'Runtime integration course',
+    description: 'Synthetic PostgreSQL fixture, not a live ledger credential.',
+    fields: { course: { type: 'string' as const } },
+  }
+  const schemaUid = computeSchemaUid({
+    schema: definition,
+    networkId: 1,
+    ledgerHash: hash,
+    ledgerIndex: 1,
+    transactionIndex: 0,
+    publisher: issuer.address,
+  })
+  const payload = encodeCredentialPayload(
+    { course: 'Synthetic course' },
+    {
+      issuer: issuer.address,
+      subject,
+      schemaUid,
+      fields: definition.fields,
+    },
+  )
+  const digest = payloadDigest(payload.bytes)
+  const locator = digest.slice(0, 18)
+  const uri = `${publicPayloadOrigin}/p/${locator}#xcs-sha256=${digest}`
+  const transaction = buildCredentialCreate({ issuer: issuer.address, subject, schemaUid, uri })
+  const signed = issuer.sign({ ...transaction, Fee: '12', Sequence: 1, LastLedgerSequence: 20 })
+  const closeTime = Math.floor(Date.now() / 1_000) - 946684800
+  await database.sql`
+    INSERT INTO network_profiles (profile_id,xcs_version,network_id,required_amendment,
+      registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash)
+    VALUES (${profileId},'0.1',1,${'b'.repeat(64)},${issuer.address},1,1,${hash})
+  `
+  await database.sql`
+    INSERT INTO ledger_checkpoints (profile_id,ledger_index,ledger_hash,parent_hash,
+      close_time,transaction_count,transaction_root)
+    VALUES (${profileId},10,${hash},${'b'.repeat(64)},${closeTime},2,${'c'.repeat(64)})
+  `
+  await database.sql`
+    INSERT INTO indexer_status (profile_id,state,primary_source_tip,secondary_source_tip,
+      last_agreed_ledger_index,last_agreed_ledger_hash,writer_id,writer_epoch,lease_expires_at)
+    VALUES (${profileId},'ready',10,10,10,${hash},'runtime-test-writer',1,now()+interval '5 minutes')
+  `
+  await database.sql`
+    INSERT INTO schema_events (profile_id,transaction_hash,ledger_index,ledger_hash,
+      transaction_index,publisher,status,schema_uid,memo_json)
+    VALUES (${profileId},${'d'.repeat(64)},1,${hash},0,${issuer.address},'accepted',
+      ${schemaUid},${JSON.stringify(definition)}::jsonb)
+  `
+  await database.sql`
+    INSERT INTO schemas (profile_id,schema_uid,publisher,name,description,definition,
+      resolved_definition,registration_transaction_hash,ledger_index,transaction_index)
+    VALUES (${profileId},${schemaUid},${issuer.address},${definition.name},${definition.description},
+      ${JSON.stringify(definition)}::jsonb,
+      ${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,
+      ${'d'.repeat(64)},1,0)
+  `
+  await database.sql`
+    INSERT INTO credential_generations (profile_id,generation_id,ledger_object_id,issuer,
+      subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index)
+    VALUES (${profileId},${signed.hash.toLowerCase()},${'e'.repeat(64)},${issuer.address},
+      ${subject},${schemaUid},${transaction.URI!},false,2,0,2)
+  `
+  await database.sql`
+    INSERT INTO credential_events (profile_id,transaction_hash,node_index,generation_id,
+      ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,
+      schema_uid,uri_hex,accepted,snapshot)
+    VALUES (${profileId},${signed.hash.toLowerCase()},0,${signed.hash.toLowerCase()},
+      ${'e'.repeat(64)},2,${hash},0,'created',${issuer.address},${subject},${schemaUid},
+      ${transaction.URI!},false,'{}'::jsonb)
+  `
+  return { schemaUid, payload, locator, uri, digest, signed }
+}
+
+describe.skipIf(!enabled)('built Nuxt with real PostgreSQL', () => {
+  it('exempts Nitro in-process reads while retaining the external HTTP quota', async () => {
+    await access(outputEntry)
+    const port = await unusedPort()
+    const script = `
+      await import(${JSON.stringify(new URL('../../.output/server/index.mjs', import.meta.url).href)})
+      const request = () => globalThis.$fetch.raw('/v1/verify', {
+        method: 'POST', body: {}, retry: 0, timeout: 2000, ignoreResponseError: true,
+      })
+      const statuses = []
+      for (let index = 0; index < 30; index++) {
+        const response = await request()
+        statuses.push(response.status)
+      }
+      const external = []
+      for (let index = 0; index < 21; index++) {
+        const response = await fetch('http://127.0.0.1:${port}/v1/verify', {
+          method: 'POST', body: '{}',
+          headers: { 'content-type': 'application/json', '__unenv__': 'true',
+            'xcs-client-address': '198.51.100.' + index },
+        })
+        external.push(response.status)
+        await response.arrayBuffer()
+      }
+      process.send({ statuses, external })
+    `
+    const server = spawn(process.execPath, ['--input-type=module', '--eval', script], {
+      stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+      env: {
+        ...Object.fromEntries(
+          Object.entries(process.env).filter(([key]) => !/^(?:XCS_|NUXT_|NITRO_)/u.test(key)),
+        ),
+        NODE_ENV: 'production',
+        NITRO_HOST: '127.0.0.1',
+        NITRO_PORT: String(port),
+        // Validation happens before database access: this probe must not read or write fixtures.
+        XCS_DATABASE_URL: 'postgres://xcs_api:unused@127.0.0.1:1/xcs_unused',
+      },
+    })
+    try {
+      const result = await new Promise<unknown>((resolve, reject) => {
+        const timeout = setTimeout(
+          () => reject(new Error('Nitro SSR quota probe timed out')),
+          10_000,
+        )
+        server.once('message', (message) => {
+          clearTimeout(timeout)
+          resolve(message)
+        })
+        server.once('error', (error) => {
+          clearTimeout(timeout)
+          reject(error)
+        })
+        server.once('exit', () => {
+          clearTimeout(timeout)
+          reject(new Error('Nitro SSR quota probe exited early'))
+        })
+      })
+      expect(result).toEqual({
+        statuses: Array(30).fill(400),
+        external: [...Array(20).fill(400), 429],
+      })
+    } finally {
+      await stopServer(server)
+    }
+  }, 15_000)
+
+  it('serves SSR, readiness, validation and signed payload publication through restricted pools', async () => {
+    await access(outputEntry) // Build first; never silently replace this with a dev server.
+    const admin = createDatabaseClient(adminUrl!)
+    const name = `xcs_runtime_it_${randomUUID().replaceAll('-', '')}`
+    const parsed = new URL(adminUrl!)
+    parsed.pathname = `/${name}`
+    let created = false
+    let provisioned = false
+    let database: DatabaseClient | undefined
+    let server: ChildProcess | undefined
+    try {
+      const [version] =
+        await admin.sql`SELECT current_setting('server_version_num')::integer AS version`
+      expect(version?.version).toBeGreaterThanOrEqual(180_000)
+      expect(version?.version).toBeLessThan(190_000)
+      await admin.sql`CREATE DATABASE ${admin.sql(name)} TEMPLATE template0 ENCODING 'UTF8'`
+      created = true
+      database = createDatabaseClient(parsed.toString())
+      await createManagedRuntimeDatabaseUsers(database, fixturePasswords)
+      await bootstrapDatabase(database, { clusterScope: 'dedicated' })
+      provisioned = true
+      const fixture = await seedProjection(database)
+      const port = await unusedPort()
+      const origin = `http://127.0.0.1:${port}`
+      server = spawn(process.execPath, [outputEntry], {
+        stdio: 'ignore',
+        env: {
+          ...Object.fromEntries(
+            Object.entries(process.env).filter(([key]) => !/^(?:XCS_|NUXT_|NITRO_)/u.test(key)),
+          ),
+          NODE_ENV: 'production',
+          NITRO_HOST: '127.0.0.1',
+          NITRO_PORT: String(port),
+          XCS_DATABASE_URL: roleUrl(parsed.toString(), 'xcs_api', fixturePasswords.apiPassword),
+          XCS_PAYLOAD_DATABASE_URL: roleUrl(
+            parsed.toString(),
+            'xcs_payload_writer',
+            fixturePasswords.payloadWriterPassword,
+          ),
+          // SSR must ignore this browser-only endpoint, using Nitro's in-process dispatch.
+          NUXT_PUBLIC_API_BASE_URL: 'http://127.0.0.1:1',
+          XCS_NETWORK_PROFILE: fileURLToPath(
+            new URL('../fixtures/network-profiles/runtime.json', import.meta.url),
+          ),
+          XCS_ALLOWED_ORIGINS: origin,
+          XCS_PUBLIC_PAYLOAD_BASE_URL: publicPayloadOrigin,
+          XCS_PAYLOAD_STORAGE_IP_HASH_SECRET: 'runtime-integration-ip-hash-secret-01',
+          XCS_HOSTED_PAYLOAD_NETWORKS: profileId,
+        },
+      })
+      const deadline = Date.now() + 30_000
+      let started = false
+      while (Date.now() < deadline) {
+        if (server.exitCode !== null) throw new Error('Built Nuxt exited before startup')
+        const response = await fetch(`${origin}/health/live`, {
+          signal: AbortSignal.timeout(1_000),
+        }).catch(() => undefined)
+        if (response?.ok) {
+          started = true
+          break
+        }
+        await delay(100)
+      }
+      expect(started, 'Built Nuxt must start within 30 seconds').toBe(true)
+      const request = (path: string, init?: RequestInit) =>
+        fetch(`${origin}${path}`, {
+          ...init,
+          signal: AbortSignal.timeout(10_000),
+        })
+      expect(await (await request('/health/live')).json()).toEqual({ status: 'ok' })
+      const networks = await request('/v1/networks')
+      expect(networks.status).toBe(200)
+      expect(await networks.json()).toMatchObject({ items: [{ profileId }] })
+      const readiness = await request(`/v1/networks/${profileId}/readiness`)
+      expect(readiness.status).toBe(200)
+      expect(await readiness.json()).toMatchObject({ status: 'ready', profileId })
+
+      const page = await request('/schemas')
+      expect(page.status).toBe(200)
+      const html = await page.text()
+      expect(html).toContain('data-testid="schema-card"')
+      expect(html).toContain('Runtime integration course')
+      expect(html).toContain(fixture.schemaUid)
+      expect(html).not.toContain('data-testid="explorer-error"')
+      const invalid = await request('/v1/verify', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{}',
+      })
+      expect(invalid.status).toBe(400)
+      expect(await invalid.json()).toHaveProperty('error')
+
+      const publicationBody = JSON.stringify({
+        network: profileId,
+        payloadBase64: Buffer.from(fixture.payload.bytes).toString('base64'),
+        signedTransactionBlob: fixture.signed.tx_blob,
+      })
+      const publish = () =>
+        request(`/v1/payloads/${fixture.locator}`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: publicationBody,
+        })
+      const publication = await publish()
+      expect(publication.status).toBe(200)
+      expect(await publication.json()).toMatchObject({ uri: fixture.uri })
+      expect((await publish()).status).toBe(200)
+      const payload = await request(`/p/${fixture.locator}`)
+      expect(payload.status).toBe(200)
+      expect(await payload.text()).toBe(fixture.payload.json)
+      expect(payload.headers.get('etag')).toBe(`"${fixture.digest}"`)
+      const [stored] =
+        await database.sql`SELECT count(*)::integer AS count FROM hosted_payload_publications`
+      expect(stored?.count).toBe(1)
+    } finally {
+      // Stop connection owners before dropping their database, even on a failed assertion.
+      try {
+        if (server) await stopServer(server)
+      } finally {
+        try {
+          await database?.close()
+          if (created) await admin.sql`DROP DATABASE ${admin.sql(name)} WITH (FORCE)`
+          if (provisioned)
+            await admin.sql`
+              DROP ROLE xcs_indexer, xcs_api, xcs_payload_writer, xcs_monitor,
+                xcs_app, xcs_admin_app, xcs_notifier, xcs_issuer
+            `
+        } finally {
+          await admin.close()
+        }
+      }
+    }
+  }, 60_000)
+})
diff --git a/apps/web/test/auth-config.test.ts b/apps/web/test/auth-config.test.ts
new file mode 100644
index 0000000..002257b
--- /dev/null
+++ b/apps/web/test/auth-config.test.ts
@@ -0,0 +1,69 @@
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { loadAuthConfig } from '../server/xcs/auth/config'
+const env = {
+  XCS_AUTH_ORIGIN: 'https://xcs.example',
+  XCS_IDENTITY_CLIENT_ID: 'test-client',
+  XCS_IDENTITY_CLIENT_SECRET: 'test-secret',
+  NUXT_APP_DATABASE_URL: 'postgres://xcs_app:test-password@127.0.0.1/test',
+}
+let directory: string | undefined
+afterEach(() => {
+  if (directory) rmSync(directory, { recursive: true, force: true })
+})
+describe('authentication configuration', () => {
+  it('is disabled only when the complete contract is absent and rejects a partial contract', () => {
+    expect(loadAuthConfig({})).toBeUndefined()
+    expect(() => loadAuthConfig({ XCS_IDENTITY_CLIENT_SECRET_FILE: '/missing' })).toThrow()
+  })
+  it('uses the canonical issuer and private application role with bounded sessions', () => {
+    expect(loadAuthConfig(env)).toMatchObject({
+      issuerUrl: 'https://account.xrpl.in',
+      origin: 'https://xcs.example',
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+    })
+  })
+  it.each(['xcs_admin', 'xcs_api', 'xcs_payload_writer'])('rejects the %s pool', (role) => {
+    expect(() =>
+      loadAuthConfig({
+        ...env,
+        NUXT_APP_DATABASE_URL: `postgres://${role}:password@127.0.0.1/test`,
+      }),
+    ).toThrow('AUTH_APPLICATION_DATABASE_ROLE_REQUIRED')
+  })
+  it.each([
+    'http://xcs.example',
+    'https://xcs.example/path',
+    'https://user:secret@xcs.example',
+    'https://xcs.example?redirect=evil',
+  ])('rejects an unsafe origin %s', (origin) => {
+    expect(() => loadAuthConfig({ ...env, XCS_AUTH_ORIGIN: origin })).toThrow()
+  })
+  it('rejects HTTP issuers and unbounded durations', () => {
+    expect(() => loadAuthConfig({ ...env, XCS_IDENTITY_ISSUER: 'http://127.0.0.1:1' })).toThrow(
+      'AUTH_HTTPS_ISSUER_REQUIRED',
+    )
+    expect(() => loadAuthConfig({ ...env, XCS_AUTH_IDLE_SECONDS: '90000' })).toThrow(
+      'AUTH_DURATION_INVALID',
+    )
+  })
+  it('loads a mounted secret, rejects conflicts and multiline data', () => {
+    directory = mkdtempSync(join(tmpdir(), 'xcs-auth-config-'))
+    const file = join(directory, 'client-secret')
+    writeFileSync(file, 'fictional-secret\n')
+    const fileEnv = {
+      ...env,
+      XCS_IDENTITY_CLIENT_SECRET: '',
+      XCS_IDENTITY_CLIENT_SECRET_FILE: file,
+    }
+    expect(loadAuthConfig(fileEnv)!.clientSecret).toBe('fictional-secret')
+    expect(() =>
+      loadAuthConfig({ ...fileEnv, XCS_IDENTITY_CLIENT_SECRET: 'another-secret' }),
+    ).toThrow('AUTH_SECRET_CONFLICT')
+    writeFileSync(file, 'one\ntwo\n')
+    expect(() => loadAuthConfig(fileEnv)).toThrow('AUTH_SECRET_INVALID')
+  })
+})
diff --git a/apps/web/test/auth-http.test.ts b/apps/web/test/auth-http.test.ts
new file mode 100644
index 0000000..e6760e6
--- /dev/null
+++ b/apps/web/test/auth-http.test.ts
@@ -0,0 +1,464 @@
+import { createApp, toNodeListener } from 'h3'
+import inject from 'light-my-request'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { deriveAddress, deriveKeypair, generateSeed, sign } from 'ripple-keypairs'
+import { createAuthHandler, SESSION_COOKIE } from '../server/xcs/auth/http'
+import { MemoryAuthRepository } from './helpers/memoryAuth'
+import type { Identity } from '../server/xcs/auth/oidc'
+
+const origin = 'https://xcs.example'
+const identity: Identity = {
+  issuer: 'https://identity.example',
+  subject: 'person-1',
+  email: 'person@example.com',
+  emailVerified: false,
+}
+function cookie(response: inject.Response, name: string) {
+  const values = response.headers['set-cookie']
+  const value = (Array.isArray(values) ? values : [values]).find(
+    (v) => typeof v === 'string' && v.startsWith(name + '='),
+  )
+  if (typeof value !== 'string') throw new Error('COOKIE_MISSING')
+  return value.split(';')[0]!
+}
+function setup() {
+  let now = Date.now()
+  vi.spyOn(Date, 'now').mockImplementation(() => now)
+  const repository = new MemoryAuthRepository(() => now)
+  const provider = {
+    authorizationUrl: async (input: { state: string }) =>
+      `https://identity.example/auth?state=${input.state}`,
+    exchange: async () => ({ ...identity }),
+  }
+  const listener = toNodeListener(
+    createApp().use(
+      createAuthHandler({
+        repository,
+        provider,
+        origin,
+        idleSeconds: 1800,
+        absoluteSeconds: 28800,
+      }),
+    ),
+  )
+  const request = (options: inject.InjectOptions) => inject(listener, options)
+  const login = async () => {
+    const start = await request({
+      method: 'GET',
+      url: '/api/auth/login?returnTo=https://evil.example',
+    })
+    const state = new URL(String(start.headers.location)).searchParams.get('state')!
+    const loginCookie = cookie(start, '__Host-xcs-login')
+    const callback = await request({
+      method: 'GET',
+      url: `/api/auth/callback?state=${state}&code=valid`,
+      headers: { cookie: loginCookie },
+    })
+    const sessionCookie = cookie(callback, SESSION_COOKIE)
+    const session = await request({
+      method: 'GET',
+      url: '/api/auth/session',
+      headers: { cookie: sessionCookie },
+    })
+    return { start, callback, state, loginCookie, sessionCookie, session: session.json() }
+  }
+  return {
+    repository,
+    provider,
+    request,
+    login,
+    advance: (ms: number) => {
+      now += ms
+    },
+  }
+}
+afterEach(() => vi.restoreAllMocks())
+let app: ReturnType<typeof setup>
+beforeEach(() => {
+  app = setup()
+})
+
+describe('XCS authentication HTTP boundary', () => {
+  it('creates a recipient session with secure cookies, reload support and no provider/session tokens in JSON', async () => {
+    const signed = await app.login()
+    expect(signed.callback.statusCode).toBe(302)
+    expect(signed.callback.headers.location).toBe('/account')
+    expect(String(signed.callback.headers['set-cookie'])).toMatch(/HttpOnly/i)
+    expect(String(signed.callback.headers['set-cookie'])).toMatch(/Secure/i)
+    expect(String(signed.callback.headers['set-cookie'])).toMatch(/SameSite=Lax/i)
+    expect(signed.session.user.roles).toEqual(['recipient'])
+    expect(signed.session.user.organizations).toEqual([])
+    expect(JSON.stringify(signed.session)).not.toContain(signed.sessionCookie.split('=')[1])
+    const reload = await app.request({
+      url: '/api/auth/session',
+      headers: { cookie: signed.sessionCookie },
+    })
+    expect(reload.json().user.id).toBe(signed.session.user.id)
+    expect(reload.headers['cache-control']).toBe('private, no-store')
+  })
+  it('does not grant issuer or admin access to a new account', async () => {
+    const signed = await app.login()
+    for (const role of ['issuer', 'verifier', 'admin']) {
+      expect(
+        (
+          await app.request({
+            url: `/api/auth/access?role=${role}`,
+            headers: { cookie: signed.sessionCookie },
+          })
+        ).statusCode,
+      ).toBe(403)
+    }
+    expect(
+      (
+        await app.request({
+          url: '/api/auth/access?role=recipient',
+          headers: { cookie: signed.sessionCookie },
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect((await app.request({ url: '/api/auth/access?role=issuer' })).statusCode).toBe(401)
+  })
+  it('checks current roles and organization audience on every request', async () => {
+    const signed = await app.login(),
+      org = '11111111-1111-4111-8111-111111111111'
+    const account = [...app.repository.accounts.values()][0]!
+    account.organizations.push({ id: org, name: 'Organization', roles: ['issuer'] })
+    expect(
+      (
+        await app.request({
+          url: `/api/auth/access?role=issuer&organizationId=${org}`,
+          headers: { cookie: signed.sessionCookie },
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect(
+      (
+        await app.request({
+          url: '/api/auth/access?role=issuer&organizationId=22222222-2222-4222-8222-222222222222',
+          headers: { cookie: signed.sessionCookie },
+        })
+      ).statusCode,
+    ).toBe(403)
+    account.organizations[0]!.roles = []
+    expect(
+      (
+        await app.request({
+          url: '/api/auth/access?role=issuer',
+          headers: { cookie: signed.sessionCookie },
+        })
+      ).statusCode,
+    ).toBe(403)
+  })
+  it('rejects mismatched browser state and cannot replay a consumed callback', async () => {
+    const signed = await app.login()
+    const wrong = await app.request({
+      url: `/api/auth/callback?state=${signed.state}&code=valid`,
+      headers: { cookie: '__Host-xcs-login=' + 'x'.repeat(43) },
+    })
+    expect(wrong.headers.location).toBe('/auth/login?error=signin')
+    const replay = await app.request({
+      url: `/api/auth/callback?state=${signed.state}&code=valid`,
+      headers: { cookie: signed.loginCookie },
+    })
+    expect(replay.headers.location).toBe('/auth/login?error=signin')
+    expect(String(replay.headers['set-cookie'])).not.toContain(SESSION_COOKIE)
+  })
+  it('redacts provider error details and does not issue a session', async () => {
+    app.provider.exchange = async () => {
+      throw new Error('secret-provider-response')
+    }
+    const start = await app.request({ url: '/api/auth/login' })
+    const state = new URL(String(start.headers.location)).searchParams.get('state')!
+    const response = await app.request({
+      url: `/api/auth/callback?state=${state}&code=valid`,
+      headers: { cookie: cookie(start, '__Host-xcs-login') },
+    })
+    expect(response.headers.location).toBe('/auth/login?error=signin')
+    expect(response.body).not.toContain('secret-provider-response')
+    expect(app.repository.sessions.size).toBe(0)
+  })
+  it('rejects missing CSRF and cross-origin mutations', async () => {
+    const signed = await app.login()
+    for (const headers of [
+      { cookie: signed.sessionCookie, origin },
+      {
+        cookie: signed.sessionCookie,
+        origin: 'https://evil.example',
+        'x-xcs-csrf': signed.session.csrfToken,
+      },
+    ]) {
+      expect(
+        (await app.request({ method: 'POST', url: '/api/auth/logout', headers })).statusCode,
+      ).toBe(403)
+    }
+    expect(app.repository.sessions.size).toBe(1)
+  })
+  it('rotates a session and CSRF token without extending its absolute lifetime', async () => {
+    const signed = await app.login()
+    const response = await app.request({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: { cookie: signed.sessionCookie, origin, 'x-xcs-csrf': signed.session.csrfToken },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(cookie(response, SESSION_COOKIE)).not.toBe(signed.sessionCookie)
+    expect(response.json().csrfToken).not.toBe(signed.session.csrfToken)
+    expect(response.json().absoluteExpiresAt).toBe(signed.session.absoluteExpiresAt)
+    expect(
+      (
+        await app.request({ url: '/api/auth/session', headers: { cookie: signed.sessionCookie } })
+      ).json().user,
+    ).toBeNull()
+  })
+  it('logs out the current session and rejects its cookie immediately', async () => {
+    const signed = await app.login()
+    const response = await app.request({
+      method: 'POST',
+      url: '/api/auth/logout',
+      headers: { cookie: signed.sessionCookie, origin, 'x-xcs-csrf': signed.session.csrfToken },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(
+      (
+        await app.request({ url: '/api/auth/session', headers: { cookie: signed.sessionCookie } })
+      ).json().user,
+    ).toBeNull()
+  })
+  it('expires sessions and rejects suspended accounts', async () => {
+    const first = await app.login()
+    app.advance(1800001)
+    expect(
+      (
+        await app.request({ url: '/api/auth/session', headers: { cookie: first.sessionCookie } })
+      ).json().user,
+    ).toBeNull()
+    const second = await app.login()
+    app.repository.suspended.add(second.session.user.id)
+    expect(
+      (
+        await app.request({ url: '/api/auth/session', headers: { cookie: second.sessionCookie } })
+      ).json().user,
+    ).toBeNull()
+  })
+  it('links a signed current nonce once and supports unlink without a transaction', async () => {
+    const signed = await app.login()
+    const keys = deriveKeypair(generateSeed()),
+      address = deriveAddress(keys.publicKey)
+    const headers = {
+      cookie: signed.sessionCookie,
+      origin,
+      'x-xcs-csrf': signed.session.csrfToken,
+      'content-type': 'application/json',
+    }
+    const challenge = (
+      await app.request({
+        method: 'POST',
+        url: '/api/auth/wallet/challenge',
+        headers,
+        payload: { address, networkId: 1 },
+      })
+    ).json()
+    expect(challenge.message).toContain(`Origin: ${origin}`)
+    const signature = sign(Buffer.from(challenge.message).toString('hex'), keys.privateKey)
+    const proof = {
+      challengeId: challenge.id,
+      signature,
+      publicKey: keys.publicKey,
+      scheme: 'ripple',
+    }
+    const linked = await app.request({
+      method: 'POST',
+      url: '/api/auth/wallet/link',
+      headers,
+      payload: proof,
+    })
+    expect(linked.statusCode).toBe(200)
+    expect(linked.json().user.wallets[0].address).toBe(address)
+    expect(
+      (await app.request({ method: 'POST', url: '/api/auth/wallet/link', headers, payload: proof }))
+        .statusCode,
+    ).toBe(400)
+    const unlinked = await app.request({
+      method: 'POST',
+      url: '/api/auth/wallet/unlink',
+      headers,
+      payload: { walletId: linked.json().user.wallets[0].id },
+    })
+    expect(unlinked.json().user.wallets).toEqual([])
+  })
+  it('rejects an invalid signature, a different session and an expired nonce', async () => {
+    const first = await app.login(),
+      second = await app.login()
+    const keys = deriveKeypair(generateSeed()),
+      address = deriveAddress(keys.publicKey)
+    const headers = {
+      cookie: first.sessionCookie,
+      origin,
+      'x-xcs-csrf': first.session.csrfToken,
+      'content-type': 'application/json',
+    }
+    const challenge = (
+      await app.request({
+        method: 'POST',
+        url: '/api/auth/wallet/challenge',
+        headers,
+        payload: { address, networkId: 1 },
+      })
+    ).json()
+    const proof = {
+      challengeId: challenge.id,
+      signature: sign(Buffer.from(challenge.message).toString('hex'), keys.privateKey),
+      publicKey: keys.publicKey,
+      scheme: 'ripple',
+    }
+    expect(
+      (
+        await app.request({
+          method: 'POST',
+          url: '/api/auth/wallet/link',
+          headers,
+          payload: { ...proof, signature: '00'.repeat(64) },
+        })
+      ).statusCode,
+    ).toBe(400)
+    expect(
+      (
+        await app.request({
+          method: 'POST',
+          url: '/api/auth/wallet/link',
+          headers: {
+            ...headers,
+            cookie: second.sessionCookie,
+            'x-xcs-csrf': second.session.csrfToken,
+          },
+          payload: proof,
+        })
+      ).statusCode,
+    ).toBe(400)
+    app.advance(300001)
+    expect(
+      (await app.request({ method: 'POST', url: '/api/auth/wallet/link', headers, payload: proof }))
+        .statusCode,
+    ).toBe(400)
+  })
+  it('rejects oversize and non-JSON challenge requests', async () => {
+    const signed = await app.login(),
+      headers = { cookie: signed.sessionCookie, origin, 'x-xcs-csrf': signed.session.csrfToken }
+    expect(
+      (
+        await app.request({
+          method: 'POST',
+          url: '/api/auth/wallet/challenge',
+          headers: { ...headers, 'content-type': 'application/json' },
+          payload: JSON.stringify({ data: 'a'.repeat(8192) }),
+        })
+      ).statusCode,
+    ).toBe(413)
+    expect(
+      (
+        await app.request({
+          method: 'POST',
+          url: '/api/auth/wallet/challenge',
+          headers: { ...headers, 'content-type': 'text/plain' },
+          payload: 'x',
+        })
+      ).statusCode,
+    ).toBe(415)
+  })
+})
+
+describe('private link OIDC handoff', () => {
+  const token = 'A'.repeat(43)
+  const linkCookie = '__Host-xcs-link-handoff'
+  it('requires explicit same-origin JSON and never returns the bearer from the anonymous save', async () => {
+    const denied = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff',
+      headers: { origin: 'https://other.test' },
+      payload: { kind: 'invitation', token },
+    })
+    expect(denied.statusCode).toBe(403)
+    const saved = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff',
+      headers: { origin, 'sec-fetch-site': 'same-origin' },
+      payload: { kind: 'invitation', token },
+    })
+    expect(saved.statusCode).toBe(200)
+    expect(saved.json()).toEqual({ ok: true })
+    expect(saved.body).not.toContain(token)
+    expect(saved.headers['cache-control']).toBe('private, no-store')
+    const header = String(saved.headers['set-cookie'])
+    for (const flag of ['HttpOnly', 'Secure', 'SameSite=Lax', 'Max-Age=600', 'Path=/'])
+      expect(header).toContain(flag)
+    const anonymous = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff/consume',
+      headers: { origin, cookie: cookie(saved, linkCookie) },
+      payload: { kind: 'invitation' },
+    })
+    expect(anonymous.statusCode).toBe(401)
+  })
+  it('consumes only the intended link after session and CSRF validation and clears the cookie', async () => {
+    const saved = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff',
+      headers: { origin },
+      payload: { kind: 'presentation', token },
+    })
+    const signed = await app.login()
+    const headers = {
+      origin,
+      cookie: `${signed.sessionCookie}; ${cookie(saved, linkCookie)}`,
+      'x-xcs-csrf': signed.session.csrfToken,
+    }
+    const forbidden = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff/consume',
+      headers: { ...headers, 'x-xcs-csrf': 'wrong' },
+      payload: { kind: 'presentation' },
+    })
+    expect(forbidden.statusCode).toBe(403)
+    const other = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff/consume',
+      headers,
+      payload: { kind: 'invitation' },
+    })
+    expect(other.json()).toEqual({ token: null })
+    expect(other.headers['set-cookie']).toBeUndefined()
+    const consumed = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff/consume',
+      headers,
+      payload: { kind: 'presentation' },
+    })
+    expect(consumed.json()).toEqual({ token })
+    expect(String(consumed.headers['set-cookie'])).toContain('Max-Age=0')
+  })
+  it('returns from OIDC only to an allowlisted token-free route', async () => {
+    const start = await app.request({
+      url: '/api/auth/login?returnTo=%2Ffr%2Frecipient%2Finvitations',
+    })
+    const state = new URL(String(start.headers.location)).searchParams.get('state')!
+    const callback = await app.request({
+      url: `/api/auth/callback?state=${state}&code=valid`,
+      headers: { cookie: cookie(start, '__Host-xcs-login') },
+    })
+    expect(callback.headers.location).toBe('/fr/recipient/invitations')
+  })
+  it.each([
+    { kind: 'other', token },
+    { kind: 'invitation', token: '../unsafe' },
+    { kind: 'invitation', token, extra: true },
+  ])('rejects malformed or extended handoff bodies', async (payload) => {
+    const response = await app.request({
+      method: 'POST',
+      url: '/api/auth/link-handoff',
+      headers: { origin },
+      payload,
+    })
+    expect(response.statusCode).toBe(400)
+    expect(response.headers['set-cookie']).toBeUndefined()
+  })
+})
diff --git a/apps/web/test/auth-oidc.test.ts b/apps/web/test/auth-oidc.test.ts
new file mode 100644
index 0000000..eae70f0
--- /dev/null
+++ b/apps/web/test/auth-oidc.test.ts
@@ -0,0 +1,183 @@
+import { randomBytes } from 'node:crypto'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OidcProvider } from '../server/xcs/auth/oidc'
+import { startOidcProvider, type TestOidcOptions } from './helpers/oidcProvider'
+
+const providers: Awaited<ReturnType<typeof startOidcProvider>>[] = []
+afterEach(async () => {
+  await Promise.all(providers.splice(0).map((provider) => provider.close()))
+  vi.unstubAllEnvs()
+})
+
+async function fixture(options: TestOidcOptions = {}) {
+  const server = await startOidcProvider(options)
+  providers.push(server)
+  const settings = {
+    issuerUrl: server.issuer,
+    clientId: server.clientId,
+    clientSecret: server.clientSecret,
+    redirectUri: 'http://127.0.0.1:3000/auth/callback',
+    allowLoopbackHttp: true,
+  }
+  const provider = new OidcProvider(settings)
+  const input = {
+    state: randomBytes(32).toString('base64url'),
+    nonce: randomBytes(32).toString('base64url'),
+    codeVerifier: randomBytes(32).toString('base64url'),
+  }
+  return {
+    server,
+    settings,
+    provider,
+    input,
+    async callback() {
+      return server.authorize(await provider.authorizationUrl(input))
+    },
+  }
+}
+
+describe('OIDC identity boundary', () => {
+  it('discovers, exchanges a PKCE code with basic authentication and verifies its JWKS signature', async () => {
+    const { server, provider, input, callback } = await fixture({
+      claims: { roles: ['admin'], role: 'admin' },
+    })
+    const identity = await provider
+      .exchange({ ...input, callbackUrl: await callback() })
+      .catch((error: unknown) => {
+        if (server.rejections.length) throw new Error(server.rejections.join(','))
+        throw error
+      })
+    expect(identity).toEqual({
+      issuer: server.issuer,
+      subject: 'fictional-subject',
+      email: 'learner@example.invalid',
+      emailVerified: true,
+      displayName: 'Example Learner',
+    })
+    expect(server.requests).toEqual({ discovery: 1, authorization: 1, token: 1, jwks: 1 })
+  })
+
+  it('requests only identity scopes and binds state, nonce, redirect URI and S256', async () => {
+    const { provider, input, settings } = await fixture()
+    const url = new URL(await provider.authorizationUrl(input))
+    expect(Object.fromEntries(url.searchParams)).toMatchObject({
+      response_type: 'code',
+      scope: 'openid profile email',
+      state: input.state,
+      nonce: input.nonce,
+      redirect_uri: settings.redirectUri,
+      code_challenge_method: 'S256',
+    })
+    expect(url.searchParams.has('client_secret')).toBe(false)
+    expect(url.searchParams.has('code_verifier')).toBe(false)
+  })
+
+  it.each([
+    ['nonce', { claims: { nonce: 'different-nonce' } }],
+    ['missing nonce', { claims: { nonce: undefined } }],
+    ['audience', { claims: { aud: 'different-client' } }],
+    ['issuer', { claims: { iss: 'https://untrusted.example.invalid' } }],
+    ['expired token', { claims: { exp: 1 } }],
+    ['invalid signature', { badSignature: true }],
+    ['missing ID token', { missingIdToken: true }],
+    ['empty subject', { claims: { sub: '' } }],
+    ['oversized subject', { claims: { sub: 'a'.repeat(2049) } }],
+    ['oversized email', { claims: { email: 'a'.repeat(321) } }],
+    ['oversized display name', { claims: { name: 'a'.repeat(513) } }],
+  ] satisfies [string, TestOidcOptions][])('rejects %s', async (_label, options) => {
+    const { provider, input, callback, server } = await fixture(options)
+    await expect(provider.exchange({ ...input, callbackUrl: await callback() })).rejects.toThrow()
+    expect(server.requests.token).toBe(1)
+    expect(server.rejections).toEqual([])
+    if (options.badSignature) expect(server.requests.jwks).toBe(1)
+  })
+
+  it('rejects wrong state before sending the authorization code', async () => {
+    const { provider, input, callback, server } = await fixture()
+    const callbackUrl = await callback()
+    callbackUrl.searchParams.set('state', 'wrong-state')
+    await expect(provider.exchange({ ...input, callbackUrl })).rejects.toThrow()
+    expect(server.requests.token).toBe(0)
+  })
+
+  it('rejects a verifier that does not match the authorization challenge', async () => {
+    const { provider, input, callback } = await fixture()
+    await expect(
+      provider.exchange({ ...input, codeVerifier: 'x'.repeat(43), callbackUrl: await callback() }),
+    ).rejects.toThrow()
+  })
+
+  it('rejects a replayed authorization code', async () => {
+    const { provider, input, callback } = await fixture()
+    const callbackUrl = await callback()
+    await provider.exchange({ ...input, callbackUrl })
+    await expect(provider.exchange({ ...input, callbackUrl })).rejects.toThrow()
+  })
+
+  it.each([false, 'true', undefined])(
+    'does not infer email verification from %s',
+    async (emailVerified) => {
+      const { provider, input, callback } = await fixture({
+        claims: { email_verified: emailVerified },
+      })
+      expect(
+        (await provider.exchange({ ...input, callbackUrl: await callback() })).emailVerified,
+      ).toBe(false)
+    },
+  )
+
+  it('rejects callback URL substitution before sending the code', async () => {
+    const { provider, input, callback, server } = await fixture()
+    const callbackUrl = await callback()
+    callbackUrl.pathname = '/another-callback'
+    await expect(provider.exchange({ ...input, callbackUrl })).rejects.toThrow(
+      'OIDC_CALLBACK_MISMATCH',
+    )
+    expect(server.requests.token).toBe(0)
+  })
+
+  it('rejects non-loopback HTTP metadata even with the test exception', async () => {
+    const { provider, input } = await fixture({
+      metadata: { token_endpoint: 'http://example.invalid/token' },
+    })
+    await expect(provider.authorizationUrl(input)).rejects.toThrow('OIDC_URL_INVALID')
+  })
+
+  it('rejects discovery metadata that names another issuer', async () => {
+    const { provider, input } = await fixture({
+      metadata: { issuer: 'https://other.example.invalid' },
+    })
+    await expect(provider.authorizationUrl(input)).rejects.toThrow()
+  })
+
+  it('rejects an empty authorization context before discovery', async () => {
+    const { provider, input, server } = await fixture()
+    await expect(provider.authorizationUrl({ ...input, nonce: '' })).rejects.toThrow(
+      'OIDC_AUTHORIZATION_CONTEXT_INVALID',
+    )
+    expect(server.requests.discovery).toBe(0)
+  })
+
+  it('requires explicit local HTTP opt-in and prohibits it in production', async () => {
+    const { settings } = await fixture()
+    expect(() => new OidcProvider({ ...settings, allowLoopbackHttp: false })).toThrow(
+      'OIDC_URL_INVALID',
+    )
+    expect(() => new OidcProvider({ ...settings, issuerUrl: 'http://example.invalid' })).toThrow(
+      'OIDC_URL_INVALID',
+    )
+    vi.stubEnv('NODE_ENV', 'production')
+    expect(() => new OidcProvider(settings)).toThrow('OIDC_HTTP_TEST_ONLY')
+  })
+
+  it('rejects a discovery-document URL instead of an issuer identifier', async () => {
+    const { settings } = await fixture()
+    expect(
+      () =>
+        new OidcProvider({
+          ...settings,
+          issuerUrl: `${settings.issuerUrl}/.well-known/openid-configuration`,
+        }),
+    ).toThrow('OIDC_SETTINGS_INVALID')
+  })
+})
diff --git a/apps/web/test/auth-postgres.integration.test.ts b/apps/web/test/auth-postgres.integration.test.ts
new file mode 100644
index 0000000..0a2f5ca
--- /dev/null
+++ b/apps/web/test/auth-postgres.integration.test.ts
@@ -0,0 +1,196 @@
+import { createApp, toNodeListener } from 'h3'
+import inject from 'light-my-request'
+import { createAuthHandler, SESSION_COOKIE } from '../server/xcs/auth/http'
+import { randomBytes, randomUUID } from 'node:crypto'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+let admin: DatabaseClient,
+  database: DatabaseClient,
+  app: DatabaseClient,
+  repo: PostgresAuthRepository,
+  name: string
+const input = () => ({
+  ...createAppToken(),
+  csrfToken: createAppToken().token,
+  idleSeconds: 1800,
+  absoluteSeconds: 28800,
+})
+const identity = {
+  issuer: 'https://identity.example',
+  subject: 'integration-user',
+  email: 'user@example.test',
+  emailVerified: false,
+}
+
+describe.skipIf(!url)('PostgreSQL auth repository through xcs_app', () => {
+  beforeAll(async () => {
+    admin = createDatabaseClient(url!, { onNotice: () => undefined })
+    name = `xcs_auth_web_${randomUUID().replaceAll('-', '')}`
+    await admin.sql`CREATE DATABASE ${admin.sql(name)} TEMPLATE template0`
+    const parsed = new URL(url!)
+    parsed.pathname = '/' + name
+    database = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const applicationPassword = randomBytes(32).toString('base64url')
+    await createManagedRuntimeDatabaseUsers(database, { applicationPassword })
+    await bootstrapDatabase(database, { clusterScope: 'dedicated' })
+    parsed.username = 'xcs_app'
+    parsed.password = applicationPassword
+    app = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    repo = new PostgresAuthRepository(app)
+  }, 30000)
+  afterAll(async () => {
+    await app?.close()
+    await database?.close()
+    if (admin && /^xcs_auth_web_[a-f0-9]{32}$/.test(name))
+      await admin.sql`DROP DATABASE ${admin.sql(name)} WITH (FORCE)`
+    await admin?.close()
+  })
+  it('consumes a login state atomically and only with its browser binding', async () => {
+    const state = createAppToken(),
+      browser = createAppToken()
+    await repo.saveLogin({
+      stateHash: state.tokenHash,
+      browserHash: browser.tokenHash,
+      nonce: createAppToken().token,
+      codeVerifier: createAppToken().token,
+      returnTo: '/account',
+      expiresAt: new Date(Date.now() + 600000),
+    })
+    expect(await repo.consumeLogin(state.tokenHash, createAppToken().tokenHash)).toBeNull()
+    const results = await Promise.all([
+      repo.consumeLogin(state.tokenHash, browser.tokenHash),
+      repo.consumeLogin(state.tokenHash, browser.tokenHash),
+    ])
+    expect(results.filter(Boolean)).toHaveLength(1)
+  })
+  it('creates only a recipient grant and never merges different subjects by email', async () => {
+    const first = input(),
+      second = input()
+    await repo.createSession(identity, first)
+    await repo.createSession({ ...identity, subject: 'another-user' }, second)
+    const a = await repo.session(first.tokenHash),
+      b = await repo.session(second.tokenHash)
+    expect(a!.account.roles).toEqual(['recipient'])
+    expect(a!.userId).not.toBe(b!.userId)
+    const [row] = await database.sql`SELECT email_verified_at FROM app_users WHERE id=${a!.userId}`
+    expect(row!.email_verified_at).toBeNull()
+    await expect(
+      app.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${a!.userId},'admin')`,
+    ).rejects.toMatchObject({ code: '42501' })
+  })
+  it('serializes actual PostgreSQL timestamps through the HTTP boundary', async () => {
+    const value = input()
+    await repo.createSession({ ...identity, emailVerified: true }, value)
+    const handler = createAuthHandler({
+      repository: repo,
+      origin: 'https://xcs.example',
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+      provider: { authorizationUrl: async () => '', exchange: async () => identity },
+    })
+    const response = await inject(toNodeListener(createApp().use(handler)), {
+      url: '/api/auth/session',
+      headers: { cookie: `${SESSION_COOKIE}=${value.token}` },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(response.json().expiresAt).toMatch(/Z$/)
+    expect(response.json().user.roles).toEqual(['recipient'])
+  })
+  it('rotates session secrets once and reads live account suspension', async () => {
+    const first = input(),
+      next = input()
+    await repo.createSession(identity, first)
+    const original = await repo.session(first.tokenHash)
+    expect(await repo.refresh(first.tokenHash, next)).toBe(true)
+    expect(await repo.refresh(first.tokenHash, input())).toBe(false)
+    expect(await repo.session(first.tokenHash)).toBeNull()
+    const refreshed = await repo.session(next.tokenHash)
+    expect(refreshed!.absoluteExpiresAt).toEqual(original!.absoluteExpiresAt)
+    await database.sql`UPDATE app_users SET status='suspended' WHERE id=${refreshed!.userId}`
+    expect(await repo.session(next.tokenHash)).toBeNull()
+    await expect(repo.createSession(identity, input())).rejects.toThrow('AUTH_ACCOUNT_UNAVAILABLE')
+    await database.sql`UPDATE app_users SET status='active' WHERE id=${refreshed!.userId}`
+  })
+  it('revokes the authenticated session even if a concurrent refresh rotates its bearer', async () => {
+    const first = input(),
+      next = input()
+    await repo.createSession(identity, first)
+    const authenticated = (await repo.session(first.tokenHash))!
+    expect(await repo.refresh(first.tokenHash, next)).toBe(true)
+    await repo.logout(authenticated.id)
+    expect(await repo.session(next.tokenHash)).toBeNull()
+  })
+  it('reflects current organization approval and scope without granting personal issuer role', async () => {
+    const value = input()
+    await repo.createSession(identity, value)
+    const session = (await repo.session(value.tokenHash))!
+    const [org] =
+      await database.sql`INSERT INTO app_organizations(responsible_user_id,name) VALUES(${session.userId},'Issuer example') RETURNING id`
+    await database.sql`INSERT INTO app_organization_applications(organization_id,role,status,reviewed_by,reviewed_at) VALUES(${org!.id},'issuer','approved',${session.userId},statement_timestamp())`
+    expect((await repo.session(value.tokenHash))!.account.organizations).toEqual([
+      { id: org!.id, name: 'Issuer example', roles: ['issuer'] },
+    ])
+    await database.sql`UPDATE app_organization_applications SET status='suspended',review_reason='test suspension' WHERE organization_id=${org!.id}`
+    expect((await repo.session(value.tokenHash))!.account.organizations).toEqual([])
+  })
+  it('links a challenge once under concurrency and never reassigns an unlinked wallet', async () => {
+    const value = input()
+    await repo.createSession(identity, value)
+    const session = (await repo.session(value.tokenHash))!
+    const challenge = {
+      id: randomUUID(),
+      sessionId: session.id,
+      networkId: 1,
+      address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+      message: 'XCS test ownership proof',
+      expiresAt: new Date(Date.now() + 300000),
+    }
+    expect(await repo.saveChallenge(value.tokenHash, challenge)).toBe(true)
+    expect(await repo.challenge(value.tokenHash, challenge.id)).toMatchObject(challenge)
+    const results = await Promise.all([
+      repo.linkWallet(value.tokenHash, challenge.id),
+      repo.linkWallet(value.tokenHash, challenge.id),
+    ])
+    expect(results.filter(Boolean)).toHaveLength(1)
+    const linked = (await repo.session(value.tokenHash))!.account.wallets[0]!
+    expect(await repo.unlinkWallet(value.tokenHash, linked.id)).toBe(true)
+    const other = input()
+    await repo.createSession({ ...identity, subject: 'wallet-thief' }, other)
+    const otherSession = (await repo.session(other.tokenHash))!
+    const next = { ...challenge, id: randomUUID(), sessionId: otherSession.id }
+    await repo.saveChallenge(other.tokenHash, next)
+    expect(await repo.linkWallet(other.tokenHash, next.id)).toBe(false)
+    expect((await repo.session(other.tokenHash))!.account.wallets).toEqual([])
+  })
+  it('blocks expired challenges and cascades outstanding challenges on logout', async () => {
+    const value = input()
+    await repo.createSession(identity, value)
+    const session = (await repo.session(value.tokenHash))!
+    const challenge = {
+      id: randomUUID(),
+      sessionId: session.id,
+      networkId: 1,
+      address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+      message: 'XCS test ownership proof',
+      expiresAt: new Date(Date.now() + 300000),
+    }
+    await repo.saveChallenge(value.tokenHash, challenge)
+    await database.sql`UPDATE app_wallet_challenges SET created_at=statement_timestamp()-interval '10 minutes',expires_at=statement_timestamp()-interval '1 minute' WHERE id=${challenge.id}`
+    expect(await repo.challenge(value.tokenHash, challenge.id)).toBeNull()
+    expect(await repo.linkWallet(value.tokenHash, challenge.id)).toBe(false)
+    await repo.logout(session.id)
+    const rows = await database.sql`SELECT id FROM app_wallet_challenges WHERE id=${challenge.id}`
+    expect(rows).toHaveLength(0)
+  })
+})
diff --git a/apps/web/test/clientAddress.test.ts b/apps/web/test/clientAddress.test.ts
new file mode 100644
index 0000000..743f7ff
--- /dev/null
+++ b/apps/web/test/clientAddress.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import { createEvent } from 'h3'
+import { IncomingMessage, ServerResponse } from 'node:http'
+import { Socket } from 'node:net'
+import { isInProcessRequest } from '../server/utils/inProcessRequest'
+import { parseTrustedProxyCidrs, resolveClientAddress } from '../server/utils/clientAddress'
+
+describe('client quota identity', () => {
+  it('recognizes Nitro in-process requests by their server-owned structural marker', async () => {
+    for (const address of ['198.51.100.10', '198.51.100.11']) {
+      const request = new IncomingMessage(new Socket())
+      Reflect.set(request, '__unenv__', { xcsClientAddress: address })
+      const event = createEvent(request, new ServerResponse(request))
+      expect(isInProcessRequest(event)).toBe(true)
+    }
+  })
+
+  it('does not accept client-context headers as an internal SSR identity', async () => {
+    const request = new IncomingMessage(new Socket())
+    request.headers = {
+      'xcs-client-address': '198.51.100.10',
+      'x-xcs-client-key': 'a'.repeat(64),
+      __unenv__: '{"xcsClientAddress":"198.51.100.10"}',
+      'x-forwarded-for': '198.51.100.10',
+    }
+    const event = createEvent(request, new ServerResponse(request))
+    expect(isInProcessRequest(event)).toBe(false)
+  })
+
+  it('ignores forwarded headers from untrusted peers', () => {
+    expect(resolveClientAddress('198.51.100.10', '203.0.113.250', '')).toBe('198.51.100.10')
+    expect(resolveClientAddress('::ffff:203.0.113.5', undefined, '')).toBe('203.0.113.5')
+  })
+  it('walks trusted proxies right-to-left, ignoring attacker-controlled prefixes', () => {
+    for (const prefix of ['192.0.2.250', '203.0.113.251']) {
+      expect(
+        resolveClientAddress('10.42.0.5', `${prefix}, 198.51.100.10, 10.42.0.6`, '10.42.0.0/16'),
+      ).toBe('198.51.100.10')
+    }
+    expect(resolveClientAddress('2001:db8:42::5', '198.51.100.10', '2001:db8:42::/48')).toBe(
+      '198.51.100.10',
+    )
+  })
+  it('fails closed for malformed chains, unresolved peers and wildcard ranges', () => {
+    expect(resolveClientAddress('10.42.0.5', 'attacker, 198.51.100.10', '10.42.0.0/16')).toBe(
+      '10.42.0.5',
+    )
+    expect(resolveClientAddress(undefined, '198.51.100.10', '')).toBe('unresolved-peer')
+    for (const cidr of ['*', '0.0.0.0/0', '::/0'])
+      expect(() => parseTrustedProxyCidrs(cidr)).toThrow('TRUSTED_PROXY_CIDRS_INVALID')
+  })
+})
diff --git a/apps/web/test/credentialReview.test.ts b/apps/web/test/credentialReview.test.ts
index b18bf49..9876e27 100644
--- a/apps/web/test/credentialReview.test.ts
+++ b/apps/web/test/credentialReview.test.ts
@@ -64,6 +64,23 @@ const report = {
 }
 
 describe('exact credential review', () => {
+  it('preserves restricted access as unavailable evidence and never approves a filtered view', async () => {
+    await expect(
+      loadCredentialReview({
+        credential,
+        report,
+        issuer: ISSUER,
+        subject: SUBJECT,
+        schemaUid: UID,
+        schema,
+        fetchPayload: true,
+        fetchImpl: async () =>
+          new Response('{"claims":{}}', {
+            headers: { 'content-type': 'application/json', 'x-xcs-claim-scope': 'public' },
+          }),
+      }),
+    ).rejects.toThrow('PAYLOAD_SCOPE_RESTRICTED')
+  })
   it('loads the exact HTTPS payload and permits a fully valid trusted acceptance', async () => {
     const review = await loadCredentialReview({
       credential,
@@ -88,6 +105,27 @@ describe('exact credential review', () => {
     expect(credentialActionBlockReason(review, 'accept')).toBeUndefined()
   })
 
+  it('blocks acceptance when a payload review error remains alongside previously loaded claims', async () => {
+    const review = await loadCredentialReview({
+      credential,
+      report,
+      issuer: ISSUER,
+      subject: SUBJECT,
+      schemaUid: UID,
+      schema,
+      fetchPayload: true,
+      fetchImpl: async () =>
+        new Response(canonical, { headers: { 'content-type': 'application/json' } }),
+    })
+    const failedReview = { ...review, payloadReviewError: 'PAYLOAD_FETCH_FAILED' }
+
+    expect(failedReview.claims).toEqual(payload.claims)
+    expect(credentialActionBlockReason(failedReview, 'accept')).toBe(
+      'CREDENTIAL_PAYLOAD_REVIEW_FAILED',
+    )
+    expect(credentialActionBlockReason(failedReview, 'reject')).toBeUndefined()
+  })
+
   it('blocks acceptance unless every gate is valid and trusted', async () => {
     const review = await loadCredentialReview({
       credential,
diff --git a/apps/web/test/crossmarkNetwork.test.ts b/apps/web/test/crossmarkNetwork.test.ts
new file mode 100644
index 0000000..9c44eca
--- /dev/null
+++ b/apps/web/test/crossmarkNetwork.test.ts
@@ -0,0 +1,127 @@
+import { CrossmarkAdapter, CrossmarkSDK } from 'xrpl-connect'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const address = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
+const testnet = {
+  label: 'xrp ledger',
+  protocol: 'xrpl',
+  type: 'testnet',
+  wss: 'wss://s.altnet.rippletest.net:51233',
+  rpc: 'https://s.altnet.rippletest.net:51234',
+}
+
+function setup(network: unknown = testnet) {
+  vi.spyOn(CrossmarkSDK.default.sync, 'isInstalled').mockReturnValue(true)
+  vi.spyOn(CrossmarkSDK.default.methods, 'signInAndWait').mockImplementation(async () => {
+    const response = { request: { id: 'approval' }, response: { data: { address, network } } }
+    CrossmarkSDK.default.emit('response', response)
+    return response as never
+  })
+  const live = vi.spyOn(CrossmarkSDK.default.api, 'awaitRequest').mockResolvedValue({
+    response: { data: { network: {} } },
+  } as never)
+  return { adapter: new CrossmarkAdapter(), live }
+}
+
+afterEach(() => {
+  CrossmarkSDK.default.emit('signout')
+  vi.restoreAllMocks()
+})
+
+describe('Crossmark approved network', () => {
+  it('uses the node returned with approval, not the unhydrated background replica', async () => {
+    const { adapter, live } = setup()
+    await expect(adapter.connect({ network: 'testnet' })).resolves.toMatchObject({
+      address,
+      network: { id: 'testnet', wss: testnet.wss, rpc: testnet.rpc },
+    })
+    expect(live).not.toHaveBeenCalled()
+  })
+
+  it('rejects Mainnet approval even if the background replica reports Testnet', async () => {
+    const { adapter, live } = setup({ ...testnet, type: 'mainnet', wss: 'wss://s1.ripple.com' })
+    live.mockResolvedValue({ response: { data: { network: testnet } } } as never)
+    await expect(adapter.connect({ network: 'testnet' })).rejects.toMatchObject({
+      code: 'NETWORK_MISMATCH',
+    })
+    expect(live).not.toHaveBeenCalled()
+    await expect(adapter.getAccount()).resolves.toBeNull()
+  })
+
+  it.each([null, {}, { ...testnet, wss: '' }, { ...testnet, type: 1 }])(
+    'rejects malformed approval network %j without inventing a replacement',
+    async (network) => {
+      const { adapter, live } = setup(network)
+      live.mockResolvedValue({ response: { data: { network: testnet } } } as never)
+      await expect(adapter.connect({ network: 'testnet' })).rejects.toThrow(
+        'Crossmark returned incomplete network information',
+      )
+      expect(live).not.toHaveBeenCalled()
+      await expect(adapter.getAccount()).resolves.toBeNull()
+    },
+  )
+
+  it.each([{}, { ...testnet, type: 'mainnet', wss: 'wss://s1.ripple.com' }])(
+    'rejects signing when SDK session network is unavailable or changed',
+    async (network) => {
+      const { adapter, live } = setup()
+      const sign = vi.spyOn(CrossmarkSDK.default.methods, 'signAndWait')
+      await adapter.connect({ network: 'testnet' })
+      live.mockResolvedValue({ response: { data: { network } } } as never)
+      CrossmarkSDK.default.emit('network-change', { network })
+      await expect(
+        adapter.sign({
+          TransactionType: 'Payment',
+          Account: address,
+          Destination: address,
+          Amount: '1',
+        }),
+      ).rejects.toThrow()
+      expect(sign).not.toHaveBeenCalled()
+    },
+  )
+
+  it('refreshes the account using the SDK session even when the background network is empty', async () => {
+    const { adapter, live } = setup()
+    await adapter.connect({ network: 'testnet' })
+    live.mockResolvedValueOnce({ response: { data: { address } } } as never)
+    await expect(adapter.fetchAccount()).resolves.toMatchObject({
+      address,
+      network: { id: 'testnet', wss: testnet.wss },
+    })
+    expect(live).toHaveBeenNthCalledWith(1, { command: 'address' })
+    expect(live).toHaveBeenCalledTimes(1)
+  })
+
+  it('reaches the actual SDK signing method with the reviewed transaction', async () => {
+    const { adapter, live } = setup()
+    const transaction = {
+      TransactionType: 'Payment' as const,
+      Account: address,
+      Destination: address,
+      Amount: '1',
+    }
+    const sign = vi.spyOn(CrossmarkSDK.default.methods, 'signAndWait').mockResolvedValue({
+      response: { data: { txBlob: 'test-only-opaque-result' } },
+    } as never)
+    await adapter.connect({ network: 'testnet' })
+    await expect(adapter.sign(transaction)).resolves.toMatchObject({
+      tx_blob: 'test-only-opaque-result',
+    })
+    expect(sign).toHaveBeenCalledWith(transaction)
+    expect(live).not.toHaveBeenCalled()
+  })
+
+  it('rejects an empty session overwritten by a late background response, without a cached fallback', async () => {
+    const { adapter, live } = setup()
+    await adapter.connect({ network: 'testnet' })
+    CrossmarkSDK.default.emit('response', {
+      request: { id: 'late-network' },
+      response: { data: { network: {} } },
+    })
+    live.mockResolvedValueOnce({ response: { data: { address } } } as never)
+    await expect(adapter.fetchAccount()).rejects.toThrow(
+      'Crossmark returned incomplete network information',
+    )
+  })
+})
diff --git a/apps/web/test/crossmarkSession.test.ts b/apps/web/test/crossmarkSession.test.ts
new file mode 100644
index 0000000..cc3dc00
--- /dev/null
+++ b/apps/web/test/crossmarkSession.test.ts
@@ -0,0 +1,199 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { bindCrossmarkSession } from '../app/utils/crossmarkSession'
+
+function setup(connected = true, walletId = 'crossmark') {
+  const events = new EventEmitter()
+  const managerEvents = new EventEmitter()
+  const account = {
+    address: 'approved-address',
+    network: {
+      id: 'testnet',
+      name: 'Testnet',
+      wss: 'wss://test.example',
+      rpc: 'https://test.example',
+    },
+  }
+  const fetchAccount = vi.fn(async () => structuredClone(account) as typeof account | null)
+  const manager = {
+    connected,
+    account,
+    wallet: { id: walletId, fetchAccount } as unknown as Parameters<
+      typeof bindCrossmarkSession
+    >[0]['manager']['wallet'],
+    on: managerEvents.on.bind(managerEvents) as Parameters<
+      typeof bindCrossmarkSession
+    >[0]['manager']['on'],
+    off: managerEvents.off.bind(managerEvents) as Parameters<
+      typeof bindCrossmarkSession
+    >[0]['manager']['off'],
+  }
+  const disconnect = vi.fn(async () => {})
+  const onError = vi.fn()
+  const unbind = bindCrossmarkSession({ events, manager, disconnect, onError })
+  return { events, manager, managerEvents, account, fetchAccount, disconnect, onError, unbind }
+}
+
+const settle = async () => {
+  for (let i = 0; i < 15; i++) await Promise.resolve()
+}
+afterEach(() => vi.useRealTimers())
+
+describe('Crossmark session invalidation', () => {
+  it('disconnects immediately on explicit signout', () => {
+    const { events, disconnect, fetchAccount } = setup()
+    events.emit('signout')
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(fetchAccount).not.toHaveBeenCalled()
+  })
+
+  it.each(['user-change', 'network-change'])(
+    'preserves an approved session on duplicate %s',
+    async (event) => {
+      const { events, disconnect, fetchAccount } = setup()
+      events.emit(event)
+      await settle()
+      expect(fetchAccount).toHaveBeenCalledOnce()
+      expect(disconnect).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each(['address', 'id', 'wss', 'rpc', 'missing'])('invalidates a changed %s', async (field) => {
+    const { events, account, fetchAccount, disconnect, onError } = setup()
+    const updated = structuredClone(account)
+    if (field === 'address') updated.address = 'different'
+    else if (field !== 'missing') updated.network[field as 'id' | 'wss' | 'rpc'] = 'different'
+    fetchAccount.mockResolvedValueOnce(field === 'missing' ? null : updated)
+    events.emit('user-change')
+    await settle()
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(onError).toHaveBeenCalledWith(new Error('CROSSMARK_SESSION_CHANGED'))
+  })
+
+  it('rechecks a burst after the outstanding read completes', async () => {
+    const { events, account, fetchAccount, disconnect } = setup()
+    let finish!: (value: typeof account) => void
+    fetchAccount.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve
+        }),
+    )
+    events.emit('user-change')
+    await settle()
+    events.emit('network-change')
+    events.emit('user-change')
+    expect(fetchAccount).toHaveBeenCalledOnce()
+    finish({ ...account, address: 'intermediate' })
+    await settle()
+    expect(fetchAccount).toHaveBeenCalledTimes(2)
+    expect(disconnect).not.toHaveBeenCalled()
+  })
+
+  it.each(['reconnect', 'unmount'])('ignores stale results after %s', async (action) => {
+    const { events, managerEvents, account, fetchAccount, disconnect, onError, unbind } = setup()
+    let finish!: (value: typeof account) => void
+    fetchAccount.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve
+        }),
+    )
+    events.emit('user-change')
+    await settle()
+    if (action === 'unmount') unbind()
+    else {
+      managerEvents.emit('disconnect')
+      managerEvents.emit('connect', account)
+    }
+    finish({ ...account, address: 'old-account' })
+    await settle()
+    expect(disconnect).not.toHaveBeenCalled()
+    expect(onError).not.toHaveBeenCalled()
+  })
+
+  it('bounds stalled reads and handles a late rejection', async () => {
+    vi.useFakeTimers()
+    const { events, fetchAccount, disconnect, onError } = setup()
+    let reject!: (error: Error) => void
+    fetchAccount.mockImplementationOnce(
+      () =>
+        new Promise((_, fail) => {
+          reject = fail
+        }),
+    )
+    events.emit('network-change')
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(onError).toHaveBeenCalledWith(new Error('CROSSMARK_SESSION_REFRESH_TIMEOUT'))
+    reject(new Error('LATE_FAILURE'))
+    await settle()
+    expect(onError).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('clears an unverifiable session with an explicit error', async () => {
+    const { events, fetchAccount, disconnect, onError } = setup()
+    fetchAccount.mockRejectedValueOnce(new Error('provider detail'))
+    events.emit('network-change')
+    await settle()
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(onError).toHaveBeenCalledWith(new Error('CROSSMARK_SESSION_REFRESH_FAILED'))
+  })
+
+  it('does not interrupt a pending sign-in or connect a disconnected wallet', () => {
+    const { events, disconnect } = setup(false)
+    events.emit('user-change')
+    events.emit('network-change')
+    events.emit('signout')
+    expect(disconnect).not.toHaveBeenCalled()
+  })
+
+  it('does not disconnect a different wallet', () => {
+    const { events, disconnect } = setup(true, 'otsu')
+    events.emit('signout')
+    expect(disconnect).not.toHaveBeenCalled()
+  })
+
+  it('coalesces session-change events while disconnect is pending', async () => {
+    const { events, disconnect } = setup()
+    let finish!: () => void
+    disconnect.mockImplementationOnce(() => new Promise<void>((resolve) => (finish = resolve)))
+    events.emit('network-change')
+    events.emit('user-change')
+    events.emit('signout')
+    expect(disconnect).toHaveBeenCalledOnce()
+    finish()
+    await disconnect.mock.results[0]?.value
+  })
+
+  it('removes only its own listeners when the component unmounts', () => {
+    const { events, managerEvents, disconnect, unbind } = setup()
+    const otherListener = vi.fn()
+    events.on('signout', otherListener)
+    unbind()
+    unbind()
+    events.emit('signout')
+    events.emit('user-change')
+    events.emit('network-change')
+    expect(disconnect).not.toHaveBeenCalled()
+    expect(otherListener).toHaveBeenCalledOnce()
+    expect(events.listenerCount('signout')).toBe(1)
+    expect(events.listenerCount('user-change')).toBe(0)
+    expect(events.listenerCount('network-change')).toBe(0)
+    expect(managerEvents.listenerCount('connect')).toBe(0)
+    expect(managerEvents.listenerCount('disconnect')).toBe(0)
+  })
+
+  it('reports disconnect failures and permits a later invalidation', async () => {
+    const { events, disconnect, onError } = setup()
+    const error = new Error('DISCONNECT_FAILED')
+    disconnect.mockRejectedValueOnce(error)
+    events.emit('signout')
+    await expect(disconnect.mock.results[0]?.value).rejects.toBe(error)
+    await Promise.resolve()
+    expect(onError).toHaveBeenCalledWith(error)
+    events.emit('signout')
+    expect(disconnect).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/apps/web/test/fixtures/network-profiles/runtime.json b/apps/web/test/fixtures/network-profiles/runtime.json
new file mode 100644
index 0000000..522f69d
--- /dev/null
+++ b/apps/web/test/fixtures/network-profiles/runtime.json
@@ -0,0 +1,10 @@
+{
+  "profileId": "runtime-testnet",
+  "xcsVersion": "0.1",
+  "networkId": 1,
+  "requiredAmendment": "1CB67D082CF7D9102412D34258CEDB400E659352D3B207348889297A6D90F5EF",
+  "registryAddress": "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+  "registrationAmountDrops": "1",
+  "activationLedgerIndex": 1,
+  "activationLedgerHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+}
diff --git a/apps/web/test/gemWalletRawSigning.test.ts b/apps/web/test/gemWalletRawSigning.test.ts
new file mode 100644
index 0000000..7853b8e
--- /dev/null
+++ b/apps/web/test/gemWalletRawSigning.test.ts
@@ -0,0 +1,153 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { decode, ECDSA, encodeForSigning, hashes, verifySignature, Wallet } from 'xrpl'
+import { GemWalletAPI, type Transaction } from 'xrpl-connect'
+import {
+  requiresGemWalletRawSigning,
+  signGemWalletCredential,
+} from '../app/utils/gemWalletRawSigning'
+
+// Unit-only wallet boundary; live extension qualification is recorded separately.
+vi.mock('xrpl-connect', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('xrpl-connect')>()
+  return { ...actual, GemWalletAPI: { ...actual.GemWalletAPI, signMessage: vi.fn() } }
+})
+
+function fixture(algorithm = ECDSA.ed25519, type = 'CredentialCreate') {
+  const wallet = Wallet.generate(algorithm)
+  const peer = Wallet.generate().address
+  const account = {
+    address: wallet.address,
+    publicKey: wallet.publicKey,
+    network: { id: 'testnet', name: 'Testnet', wss: 'wss://testnet.xrpl-labs.com' },
+  }
+  const transaction = {
+    TransactionType: type,
+    Account: wallet.address,
+    CredentialType: 'AB'.repeat(32),
+    ...(type === 'CredentialCreate'
+      ? { Subject: peer, URI: '68747470733A2F2F6578616D706C652E636F6D' }
+      : { Issuer: peer }),
+    Fee: '12',
+    Sequence: 1,
+    LastLedgerSequence: 100,
+  } as Transaction
+  return { wallet, account, transaction }
+}
+
+describe('GemWallet credential raw signing', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  })
+
+  it.each([ECDSA.ed25519, ECDSA.secp256k1])(
+    'assembles real %s signatures for each credential action',
+    async (algorithm) => {
+      for (const type of ['CredentialCreate', 'CredentialAccept', 'CredentialDelete']) {
+        const { wallet, account, transaction } = fixture(algorithm, type)
+        const original = structuredClone(transaction)
+        const signature = decode(wallet.sign(transaction).tx_blob).TxnSignature as string
+        const sign = vi
+          .spyOn(GemWalletAPI, 'signMessage')
+          .mockResolvedValue({ type: 'response', result: { signedMessage: signature } })
+        const result = await signGemWalletCredential(transaction, account)
+        expect(sign).toHaveBeenLastCalledWith(
+          encodeForSigning({ ...transaction, SigningPubKey: wallet.publicKey }),
+          true,
+        )
+        expect(verifySignature(result.txBlob)).toBe(true)
+        expect(result.hash).toBe(hashes.hashSignedTx(result.txBlob))
+        expect(transaction).toEqual(original)
+      }
+    },
+  )
+
+  it('rejects another account’s signature', async () => {
+    const { account, transaction } = fixture()
+    const wrong = Wallet.generate()
+    const signature = decode(wrong.sign({ ...transaction, Account: wrong.address }).tx_blob)
+      .TxnSignature as string
+    vi.spyOn(GemWalletAPI, 'signMessage').mockResolvedValue({
+      type: 'response',
+      result: { signedMessage: signature },
+    })
+    await expect(signGemWalletCredential(transaction, account)).rejects.toThrow(
+      'invalid XRPL signature',
+    )
+  })
+
+  it('rejects a signature over changed fields', async () => {
+    const { account, transaction, wallet } = fixture()
+    const signature = decode(wallet.sign({ ...transaction, Fee: '1000' }).tx_blob)
+      .TxnSignature as string
+    vi.spyOn(GemWalletAPI, 'signMessage').mockResolvedValue({
+      type: 'response',
+      result: { signedMessage: signature },
+    })
+    await expect(signGemWalletCredential(transaction, account)).rejects.toThrow(
+      'invalid XRPL signature',
+    )
+  })
+
+  it('preserves rejection without retrying or falling back', async () => {
+    const { account, transaction } = fixture()
+    const sign = vi
+      .spyOn(GemWalletAPI, 'signMessage')
+      .mockResolvedValue({ type: 'reject', result: undefined })
+    await expect(signGemWalletCredential(transaction, account)).rejects.toMatchObject({
+      code: 'SIGN_REJECTED',
+    })
+    expect(sign).toHaveBeenCalledTimes(1)
+  })
+
+  it('bounds a missing extension response', async () => {
+    vi.useFakeTimers()
+    const { account, transaction } = fixture()
+    vi.spyOn(GemWalletAPI, 'signMessage').mockReturnValue(new Promise(() => {}))
+    const rejected = expect(signGemWalletCredential(transaction, account)).rejects.toThrow(
+      'timed out',
+    )
+    await vi.advanceTimersByTimeAsync(90_000)
+    await rejected
+  })
+
+  it('preserves extension errors rather than labelling them as timeouts', async () => {
+    const { account, transaction } = fixture()
+    const error = new Error('Wallet is locked')
+    vi.spyOn(GemWalletAPI, 'signMessage').mockRejectedValue(error)
+    await expect(signGemWalletCredential(transaction, account)).rejects.toBe(error)
+  })
+
+  it('rejects invalid identity, network, unprepared and already-signed requests before opening the wallet', async () => {
+    const { account, transaction } = fixture()
+    const sign = vi.spyOn(GemWalletAPI, 'signMessage')
+    await expect(
+      signGemWalletCredential(transaction, { ...account, publicKey: Wallet.generate().publicKey }),
+    ).rejects.toThrow('SIGNER_MISMATCH')
+    await expect(
+      signGemWalletCredential(transaction, {
+        ...account,
+        network: { ...account.network, id: 'mainnet' },
+      }),
+    ).rejects.toThrow('TESTNET_REQUIRED')
+    await expect(
+      signGemWalletCredential({ ...transaction, LastLedgerSequence: undefined }, account),
+    ).rejects.toThrow('PREPARED_TRANSACTION_REQUIRED')
+    await expect(
+      signGemWalletCredential({ ...transaction, TxnSignature: 'AB' }, account),
+    ).rejects.toThrow('UNSIGNED_TRANSACTION_REQUIRED')
+    await expect(
+      signGemWalletCredential(
+        { ...transaction, TransactionType: 'Payment' } as Transaction,
+        account,
+      ),
+    ).rejects.toThrow('TRANSACTION_UNSUPPORTED')
+    expect(sign).not.toHaveBeenCalled()
+  })
+
+  it('never routes other wallets or schema Payments through raw signing', () => {
+    expect(requiresGemWalletRawSigning('gemwallet', 'CredentialCreate')).toBe(true)
+    expect(requiresGemWalletRawSigning('gemwallet', 'Payment')).toBe(false)
+    expect(requiresGemWalletRawSigning('otsu', 'CredentialCreate')).toBe(false)
+  })
+})
diff --git a/apps/web/test/guided-portal-contract.test.ts b/apps/web/test/guided-portal-contract.test.ts
new file mode 100644
index 0000000..7595ad4
--- /dev/null
+++ b/apps/web/test/guided-portal-contract.test.ts
@@ -0,0 +1,57 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import en from '../i18n/locales/en.json'
+import fr from '../i18n/locales/fr.json'
+
+function leafPaths(value: unknown, prefix = ''): string[] {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return [prefix]
+  return Object.entries(value).flatMap(([key, child]) =>
+    leafPaths(child, prefix ? `${prefix}.${key}` : key),
+  )
+}
+
+const source = (path: string) =>
+  readFileSync(fileURLToPath(new URL(`../app/${path}`, import.meta.url)), 'utf8')
+
+describe('guided portal contracts', () => {
+  it('keeps the French and English catalogs structurally identical', () => {
+    expect(leafPaths(fr).sort()).toEqual(leafPaths(en).sort())
+  })
+
+  it('keeps compatibility pages as input-free redirects', () => {
+    for (const path of [
+      'pages/studio.vue',
+      'pages/schemas/register.vue',
+      'pages/issue.vue',
+      'pages/accept.vue',
+      'pages/revoke.vue',
+      'pages/verify.vue',
+      'pages/operations.vue',
+    ]) {
+      const page = source(path)
+      expect(page).toContain('legacyPortalDestination')
+      expect(page).not.toMatch(/<(?:form|input|textarea)|<UInput/u)
+    }
+  })
+
+  it('does not expose protocol identifiers in the verifier result', () => {
+    const template = source('components/PresentationResult.vue').split('</script>')[1] ?? ''
+    expect(template).not.toMatch(
+      /subjectAddress|issuerAddress|generationId|profileId|schemaUid|JsonBlock/u,
+    )
+  })
+
+  it('keeps application components independent from server implementation types', () => {
+    const applicationSources = [
+      'types/portal.ts',
+      'composables/useAuth.ts',
+      'composables/useIssuerWorkspace.ts',
+      'composables/useRecipientWorkspace.ts',
+      'pages/verifier/index.vue',
+    ]
+      .map(source)
+      .join('\n')
+    expect(applicationSources).not.toContain('server/xcs')
+  })
+})
diff --git a/apps/web/test/helpers/adminRuntime.ts b/apps/web/test/helpers/adminRuntime.ts
new file mode 100644
index 0000000..ac7a0fc
--- /dev/null
+++ b/apps/web/test/helpers/adminRuntime.ts
@@ -0,0 +1,137 @@
+import { execFileSync, spawn } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import { get } from 'node:https'
+import { createServer } from 'node:net'
+import { join } from 'node:path'
+import { setTimeout as delay } from 'node:timers/promises'
+import { fileURLToPath } from 'node:url'
+import { chromium } from '@playwright/test'
+
+/** Actual production Nitro + PostgreSQL. Only the synthetic session is pre-created.
+ * Trust this test certificate's public key in this browser process, never the OS CA store.
+ */
+export async function startAdminRuntime(
+  directory: string,
+  databaseUrls: { api: string; auth: string; admin: string },
+  issuer?: { issuerDatabaseUrl: string; smtpPort: number },
+) {
+  const certPath = join(directory, 'tls.crt'),
+    keyPath = join(directory, 'tls.key'),
+    config = join(directory, 'tls.cnf')
+  await writeFile(
+    config,
+    '[req]\ndistinguished_name=dn\nx509_extensions=ext\nprompt=no\n[dn]\nCN=127.0.0.1\n[ext]\nsubjectAltName=IP:127.0.0.1\n',
+    { mode: 0o600 },
+  )
+  execFileSync(
+    'openssl',
+    [
+      'req',
+      '-x509',
+      '-nodes',
+      '-newkey',
+      'rsa:2048',
+      '-days',
+      '1',
+      '-keyout',
+      keyPath,
+      '-out',
+      certPath,
+      '-config',
+      config,
+    ],
+    { stdio: 'ignore' },
+  )
+  const cert = await readFile(certPath, 'utf8'),
+    key = await readFile(keyPath, 'utf8')
+  const publicKey = execFileSync('openssl', ['x509', '-in', certPath, '-pubkey', '-noout'])
+  const der = execFileSync('openssl', ['pkey', '-pubin', '-outform', 'DER'], { input: publicKey })
+  const spki = createHash('sha256').update(der).digest('base64')
+  const socket = createServer()
+  await new Promise<void>((resolve) => socket.listen(0, '127.0.0.1', resolve))
+  const port = (socket.address() as { port: number }).port
+  await new Promise<void>((resolve) => socket.close(() => resolve()))
+  const origin = `https://127.0.0.1:${port}`
+  const child = spawn(
+    process.execPath,
+    [fileURLToPath(new URL('../../.output/server/index.mjs', import.meta.url))],
+    {
+      stdio: 'ignore',
+      env: {
+        ...Object.fromEntries(
+          Object.entries(process.env).filter(([name]) => !/^(XCS_|NUXT_|NITRO_)/.test(name)),
+        ),
+        NODE_ENV: 'production',
+        NITRO_HOST: '127.0.0.1',
+        NITRO_PORT: String(port),
+        NITRO_SSL_CERT: cert,
+        NITRO_SSL_KEY: key,
+        XCS_DATABASE_URL: databaseUrls.api,
+        NUXT_APP_DATABASE_URL: databaseUrls.auth,
+        NUXT_ADMIN_DATABASE_URL: databaseUrls.admin,
+        XCS_AUTH_ORIGIN: origin,
+        XCS_IDENTITY_ISSUER: 'https://identity.test',
+        XCS_IDENTITY_CLIENT_ID: 'synthetic-runtime',
+        XCS_IDENTITY_CLIENT_SECRET: 'synthetic-not-used-for-login',
+        XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+        XCS_DOCUMENT_FILESYSTEM_DIRECTORY: directory,
+        XCS_DOCUMENT_FILESYSTEM_LOCAL: '1',
+        XCS_ADMIN_DOCUMENT_KEY: 'synthetic-runtime-document-key-32-bytes',
+        ...(issuer
+          ? {
+              NUXT_ISSUER_DATABASE_URL: issuer.issuerDatabaseUrl,
+              XCS_SMTP_HOST: '127.0.0.1',
+              XCS_SMTP_PORT: String(issuer.smtpPort),
+            }
+          : {}),
+      },
+    },
+  )
+  const stop = async () => {
+    if (child.exitCode !== null || child.signalCode !== null) return
+    const done = new Promise<void>((resolve) => child.once('exit', () => resolve()))
+    child.kill('SIGTERM')
+    const timer = setTimeout(() => child.kill('SIGKILL'), 5000)
+    await done
+    clearTimeout(timer)
+  }
+  try {
+    let ready = false
+    for (let attempt = 0; attempt < 100; attempt++) {
+      if (child.exitCode !== null) throw new Error('ADMIN_RUNTIME_EXITED')
+      ready = await new Promise<boolean>((resolve) => {
+        const req = get(origin + '/health/live', { ca: cert, timeout: 500 }, (res) => {
+          res.resume()
+          resolve(res.statusCode === 200)
+        })
+        req.on('error', () => resolve(false))
+        req.on('timeout', () => {
+          req.destroy()
+          resolve(false)
+        })
+      })
+      if (ready) break
+      await delay(100)
+    }
+    if (!ready) throw new Error('ADMIN_RUNTIME_NOT_READY')
+    const browser = await chromium.launch({
+      args: [`--ignore-certificate-errors-spki-list=${spki}`],
+    })
+    const context = await browser.newContext()
+    await context.route('**/*', (route) =>
+      new URL(route.request().url()).origin === origin ? route.continue() : route.abort(),
+    )
+    return {
+      origin,
+      context,
+      close: async () => {
+        await browser.close()
+        await stop()
+      },
+    }
+  } catch (error) {
+    await stop()
+    throw error
+  }
+}
diff --git a/apps/web/test/helpers/memoryAuth.ts b/apps/web/test/helpers/memoryAuth.ts
new file mode 100644
index 0000000..6cbd7c7
--- /dev/null
+++ b/apps/web/test/helpers/memoryAuth.ts
@@ -0,0 +1,131 @@
+import { randomUUID } from 'node:crypto'
+import type { Identity } from '../../server/xcs/auth/oidc'
+import type {
+  Account,
+  AuthRepository,
+  LoginTransaction,
+  Session,
+  SessionInput,
+  WalletChallenge,
+} from '../../server/xcs/auth/types'
+
+/** Test storage only. Production always uses PostgresAuthRepository. */
+export class MemoryAuthRepository implements AuthRepository {
+  readonly logins = new Map<string, LoginTransaction>()
+  readonly sessions = new Map<string, Session>()
+  readonly accounts = new Map<string, Account>()
+  readonly challenges = new Map<string, WalletChallenge>()
+  readonly walletOwners = new Map<string, string>()
+  readonly suspended = new Set<string>()
+  constructor(readonly now = () => Date.now()) {}
+  async saveLogin(login: LoginTransaction) {
+    this.logins.set(login.stateHash, login)
+  }
+  async consumeLogin(state: string, browser: string) {
+    const found = this.logins.get(state)
+    if (!found || found.browserHash !== browser || found.expiresAt.getTime() <= this.now())
+      return null
+    this.logins.delete(state)
+    return found
+  }
+  async createSession(identity: Identity, input: SessionInput, previousTokenHash?: string) {
+    const identityKey = JSON.stringify([identity.issuer, identity.subject])
+    let account = this.accounts.get(identityKey)
+    if (!account) {
+      account = {
+        id: randomUUID(),
+        email: identity.email ?? null,
+        displayName: identity.displayName ?? null,
+        roles: ['recipient'],
+        organizations: [],
+        wallets: [],
+      }
+      this.accounts.set(identityKey, account)
+    }
+    if (this.suspended.has(account.id)) throw new Error('ACCOUNT_UNAVAILABLE')
+    if (previousTokenHash) {
+      const previous = this.sessions.get(previousTokenHash)
+      if (previous) await this.logout(previous.id)
+    }
+    this.sessions.set(input.tokenHash, {
+      id: randomUUID(),
+      userId: account.id,
+      tokenHash: input.tokenHash,
+      csrfToken: input.csrfToken,
+      expiresAt: new Date(this.now() + input.idleSeconds * 1000),
+      absoluteExpiresAt: new Date(this.now() + input.absoluteSeconds * 1000),
+      account,
+    })
+  }
+  async session(hash: string) {
+    const session = this.sessions.get(hash)
+    return session &&
+      !this.suspended.has(session.userId) &&
+      session.expiresAt.getTime() > this.now() &&
+      session.absoluteExpiresAt.getTime() > this.now()
+      ? session
+      : null
+  }
+  async refresh(hash: string, input: SessionInput) {
+    const session = await this.session(hash)
+    if (!session || !this.sessions.delete(hash)) return false
+    session.tokenHash = input.tokenHash
+    session.csrfToken = input.csrfToken
+    session.expiresAt = new Date(
+      Math.min(session.absoluteExpiresAt.getTime(), this.now() + input.idleSeconds * 1000),
+    )
+    this.sessions.set(input.tokenHash, session)
+    return true
+  }
+  async logout(sessionId: string) {
+    const session = [...this.sessions.values()].find((value) => value.id === sessionId)
+    if (session) this.sessions.delete(session.tokenHash)
+    if (session)
+      for (const [id, challenge] of this.challenges)
+        if (challenge.sessionId === session.id) this.challenges.delete(id)
+  }
+  async saveChallenge(hash: string, challenge: WalletChallenge) {
+    const session = await this.session(hash)
+    if (!session) return false
+    this.challenges.set(challenge.id, { ...challenge, sessionId: session.id })
+    return true
+  }
+  async challenge(hash: string, id: string) {
+    const session = await this.session(hash),
+      challenge = this.challenges.get(id)
+    return session &&
+      challenge?.sessionId === session.id &&
+      challenge.expiresAt.getTime() > this.now()
+      ? challenge
+      : null
+  }
+  async linkWallet(hash: string, id: string) {
+    const session = await this.session(hash),
+      challenge = await this.challenge(hash, id)
+    if (!session || !challenge || !this.challenges.delete(id)) return false
+    const key = `${challenge.networkId}:${challenge.address}`,
+      owner = this.walletOwners.get(key)
+    if (owner && owner !== session.userId) return false
+    this.walletOwners.set(key, session.userId)
+    if (
+      !session.account.wallets.some(
+        (w) => w.address === challenge.address && w.networkId === challenge.networkId,
+      )
+    )
+      session.account.wallets.push({
+        id: randomUUID(),
+        address: challenge.address,
+        networkId: challenge.networkId,
+        verifiedAt: new Date(this.now()).toISOString(),
+      })
+    return true
+  }
+  async unlinkWallet(hash: string, id: string) {
+    const session = await this.session(hash)
+    if (!session) return false
+    const i = session.account.wallets.findIndex((w) => w.id === id)
+    if (i < 0) return false
+    session.account.wallets.splice(i, 1)
+    return true
+  }
+}
diff --git a/apps/web/test/helpers/oidcProvider.ts b/apps/web/test/helpers/oidcProvider.ts
new file mode 100644
index 0000000..d3e9a16
--- /dev/null
+++ b/apps/web/test/helpers/oidcProvider.ts
@@ -0,0 +1,169 @@
+import { createHash, generateKeyPairSync, randomBytes, sign } from 'node:crypto'
+import { createServer, type ServerResponse } from 'node:http'
+import type { AddressInfo } from 'node:net'
+
+export interface TestOidcOptions {
+  claims?: Record<string, unknown>
+  missingIdToken?: boolean
+  badSignature?: boolean
+  metadata?: Record<string, unknown>
+}
+
+/** Real HTTP discovery/token/JWKS fixture; all credentials and claims are fictional. */
+export async function startOidcProvider(options: TestOidcOptions = {}) {
+  const key = generateKeyPairSync('rsa', { modulusLength: 2048 })
+  const wrongKey = options.badSignature ? generateKeyPairSync('rsa', { modulusLength: 2048 }) : key
+  const publicJwk = {
+    ...key.publicKey.export({ format: 'jwk' }),
+    kid: 'test-key',
+    use: 'sig',
+    alg: 'RS256',
+  }
+  const codes = new Map<string, { challenge: string; nonce: string; redirectUri: string }>()
+  const requests = { discovery: 0, authorization: 0, token: 0, jwks: 0 }
+  const rejections: string[] = []
+  const clientId = 'xcs-test-client'
+  const clientSecret = 'fictional-test-client-secret'
+  let issuer = ''
+  const json = (response: ServerResponse, body: unknown, status = 200) => {
+    response.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+    response.end(JSON.stringify(body))
+  }
+  const server = createServer(async (request, response) => {
+    try {
+      const url = new URL(request.url ?? '/', issuer)
+      if (url.pathname === '/.well-known/openid-configuration') {
+        requests.discovery++
+        json(response, {
+          issuer,
+          authorization_endpoint: `${issuer}/authorize`,
+          token_endpoint: `${issuer}/token`,
+          jwks_uri: `${issuer}/jwks`,
+          response_types_supported: ['code'],
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256'],
+          token_endpoint_auth_methods_supported: ['client_secret_basic'],
+          code_challenge_methods_supported: ['S256'],
+          ...options.metadata,
+        })
+      } else if (url.pathname === '/authorize') {
+        requests.authorization++
+        if (
+          url.searchParams.get('client_id') !== clientId ||
+          url.searchParams.get('code_challenge_method') !== 'S256'
+        ) {
+          json(response, { error: 'invalid_request' }, 400)
+          return
+        }
+        const code = randomBytes(24).toString('base64url')
+        const redirectUri = url.searchParams.get('redirect_uri')!
+        codes.set(code, {
+          challenge: url.searchParams.get('code_challenge')!,
+          nonce: url.searchParams.get('nonce')!,
+          redirectUri,
+        })
+        const callback = new URL(redirectUri)
+        callback.searchParams.set('code', code)
+        callback.searchParams.set('state', url.searchParams.get('state')!)
+        response.writeHead(302, { location: callback.href })
+        response.end()
+      } else if (url.pathname === '/token' && request.method === 'POST') {
+        requests.token++
+        const chunks: Buffer[] = []
+        for await (const chunk of request) chunks.push(Buffer.from(chunk))
+        const body = new URLSearchParams(Buffer.concat(chunks).toString())
+        const code = body.get('code') ?? ''
+        const pending = codes.get(code)
+        codes.delete(code)
+        // HTTP authentication scheme names are case-insensitive; the credentials are not.
+        const basic = /^Basic ([A-Za-z0-9+/]+=*)$/iu.exec(request.headers.authorization ?? '')
+        const credentials = Buffer.from(basic?.[1] ?? '', 'base64')
+          .toString()
+          .split(':')
+        // OAuth Basic encodes each credential as form data before base64 (including hyphens).
+        const authenticated =
+          credentials.length === 2 &&
+          decodeURIComponent(credentials[0]!.replace(/\+/gu, ' ')) === clientId &&
+          decodeURIComponent(credentials[1]!.replace(/\+/gu, ' ')) === clientSecret
+        const challenge = createHash('sha256')
+          .update(body.get('code_verifier') ?? '')
+          .digest('base64url')
+        if (
+          !authenticated ||
+          body.get('grant_type') !== 'authorization_code' ||
+          !pending ||
+          pending.challenge !== challenge ||
+          pending.redirectUri !== body.get('redirect_uri')
+        ) {
+          rejections.push(
+            !authenticated
+              ? 'client_authentication'
+              : body.get('grant_type') !== 'authorization_code'
+                ? 'grant_type'
+                : !pending
+                  ? 'code'
+                  : pending.challenge !== challenge
+                    ? 'pkce'
+                    : 'redirect_uri',
+          )
+          json(response, { error: 'invalid_grant' }, 400)
+          return
+        }
+        const now = Math.floor(Date.now() / 1000)
+        const claims = {
+          iss: issuer,
+          sub: 'fictional-subject',
+          aud: clientId,
+          iat: now,
+          exp: now + 300,
+          nonce: pending.nonce,
+          email: 'learner@example.invalid',
+          email_verified: true,
+          name: 'Example Learner',
+          ...options.claims,
+        }
+        const encoded = [{ alg: 'RS256', kid: 'test-key', typ: 'JWT' }, claims]
+          .map((part) => Buffer.from(JSON.stringify(part)).toString('base64url'))
+          .join('.')
+        const idToken = `${encoded}.${sign('RSA-SHA256', Buffer.from(encoded), wrongKey.privateKey).toString('base64url')}`
+        json(response, {
+          access_token: 'fictional-access-token',
+          refresh_token: 'fictional-refresh-token',
+          token_type: 'Bearer',
+          expires_in: 300,
+          ...(options.missingIdToken ? {} : { id_token: idToken }),
+        })
+      } else if (url.pathname === '/jwks') {
+        requests.jwks++
+        json(response, { keys: [publicJwk] })
+      } else {
+        json(response, { error: 'not_found' }, 404)
+      }
+    } catch {
+      json(response, { error: 'test_provider_failure' }, 500)
+    }
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  issuer = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+  return {
+    issuer,
+    clientId,
+    clientSecret,
+    requests,
+    rejections,
+    async authorize(authorizationUrl: string): Promise<URL> {
+      const response = await fetch(authorizationUrl, { redirect: 'manual' })
+      if (response.status !== 302) throw new Error('TEST_AUTHORIZATION_FAILED')
+      return new URL(response.headers.get('location')!)
+    },
+    async close(): Promise<void> {
+      server.closeAllConnections()
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      )
+    },
+  }
+}
diff --git a/apps/web/test/helpers/recipientDatabase.ts b/apps/web/test/helpers/recipientDatabase.ts
new file mode 100644
index 0000000..25b40af
--- /dev/null
+++ b/apps/web/test/helpers/recipientDatabase.ts
@@ -0,0 +1,187 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { Wallet, unixTimeToRippleTime } from 'xrpl'
+import { sign } from 'ripple-keypairs'
+import type { RecipientRepository } from '../../server/xcs/recipient/repository'
+import type {
+  PresentationChallengeInput,
+  CreatePresentationInput,
+} from '../../server/xcs/recipient/types'
+import {
+  canonicalJson,
+  computeSchemaUid,
+  createHttpsPayloadUri,
+  encodeHexUtf8,
+  payloadDigest,
+} from '#xcs/core/index.js'
+import { bootstrapDatabase } from '../../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from '../lib/db/managedRuntimeUsers.js'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../../server/lib/db/index.js'
+import { PostgresAuthRepository } from '../../server/xcs/auth/repository'
+import type { Session } from '../../server/xcs/auth/types'
+
+/** Synthetic rows exercise the production authorization and canonical-evidence code under restricted grants. */
+export async function createRecipientDatabase(url: string) {
+  const operator = createDatabaseClient(url, { onNotice: () => undefined })
+  const name = 'xcs_recipient_test_' + randomUUID().replaceAll('-', '')
+  const parsed = new URL(url)
+  let db: DatabaseClient | undefined,
+    portal: DatabaseClient | undefined,
+    authClient: DatabaseClient | undefined
+  const close = async () => {
+    await Promise.all([portal?.close(), authClient?.close(), db?.close()])
+    if (/^xcs_recipient_test_[a-f0-9]{32}$/.test(name))
+      await operator.sql`DROP DATABASE IF EXISTS ${operator.sql(name)} WITH (FORCE)`
+    await operator.close()
+  }
+  try {
+    await operator.sql`CREATE DATABASE ${operator.sql(name)} TEMPLATE template0`
+    parsed.pathname = '/' + name
+    db = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const passwords = await createManagedRuntimeDatabaseUsers(db, {
+      indexerPassword: randomBytes(32).toString('hex'),
+      apiPassword: randomBytes(32).toString('hex'),
+      payloadWriterPassword: randomBytes(32).toString('hex'),
+      monitorPassword: randomBytes(32).toString('hex'),
+      applicationPassword: randomBytes(32).toString('hex'),
+      issuerPassword: randomBytes(32).toString('hex'),
+    })
+    await bootstrapDatabase(db, { clusterScope: 'dedicated' })
+    parsed.username = 'xcs_app'
+    parsed.password = passwords.applicationPassword
+    authClient = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    parsed.username = 'xcs_issuer'
+    parsed.password = passwords.issuerPassword
+    portal = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const auth = new PostgresAuthRepository(authClient)
+    const sessions = {} as Record<'issuer' | 'recipient' | 'verifier' | 'other' | 'admin', Session>
+    for (const actor of ['issuer', 'recipient', 'verifier', 'other', 'admin'] as const) {
+      const token = {
+        ...createAppToken(),
+        csrfToken: createAppToken().token,
+        idleSeconds: 1800,
+        absoluteSeconds: 28800,
+      }
+      await auth.createSession(
+        {
+          issuer: 'https://identity.test',
+          subject: actor,
+          emailVerified: true,
+          email: `${actor}@example.test`,
+        },
+        token,
+      )
+      sessions[actor] = (await auth.session(token.tokenHash))!
+    }
+    await db.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${sessions.admin.userId},'admin')`
+    const issuerOrg = randomUUID(),
+      verifierOrg = randomUUID(),
+      otherOrg = randomUUID(),
+      inviteId = randomUUID(),
+      payloadId = randomUUID()
+    for (const [id, user, role, title] of [
+      [issuerOrg, sessions.issuer.userId, 'issuer', 'Issuer'],
+      [verifierOrg, sessions.verifier.userId, 'verifier', 'Verifier'],
+      [otherOrg, sessions.other.userId, 'verifier', 'Other verifier'],
+    ]) {
+      await db.sql`INSERT INTO app_organizations(id,responsible_user_id,name) VALUES (${id},${user},${title})`
+      await db.sql`INSERT INTO app_organization_applications(organization_id,role,status,reviewed_by,reviewed_at) VALUES (${id},${role},'approved',${sessions.admin.userId},statement_timestamp())`
+    }
+    const profileId = 'recipient-testnet',
+      generationId = 'c'.repeat(64),
+      registrationHash = 'b'.repeat(64),
+      ledgerHash = 'd'.repeat(64),
+      acceptedHash = 'e'.repeat(64)
+    const issuerAddress = Wallet.generate().address,
+      subjectWallet = Wallet.generate(),
+      subjectAddress = subjectWallet.address
+    const definition = {
+      xcsVersion: '0.1' as const,
+      name: 'Synthetic recipient credential',
+      description: 'Canonical evidence fixture',
+      fields: { course: { type: 'string' as const }, secret: { type: 'string' as const } },
+    }
+    const schemaUid = computeSchemaUid({
+      schema: definition,
+      networkId: 1,
+      publisher: issuerAddress,
+      ledgerIndex: 1,
+      ledgerHash,
+      transactionIndex: 0,
+    })
+    const canonical = canonicalJson({
+      xcsVersion: '0.1',
+      issuer: issuerAddress,
+      subject: subjectAddress,
+      schema: schemaUid,
+      claims: { course: 'Public course', secret: 'Private synthetic claim' },
+    })
+    const digest = payloadDigest(canonical)
+    const uri = createHttpsPayloadUri('https://xcs.test/q/' + 'a'.repeat(18), canonical)
+    await db.sql`INSERT INTO network_profiles(profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash) VALUES (${profileId},'0.1',1,${ledgerHash},${issuerAddress},1,1,${ledgerHash})`
+    await db.sql`INSERT INTO schema_events(profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profileId},${registrationHash},1,${ledgerHash},0,${issuerAddress},'accepted',${schemaUid},${JSON.stringify(definition)}::jsonb)`
+    await db.sql`INSERT INTO schemas(profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profileId},${schemaUid},${issuerAddress},${definition.name},${definition.description},${JSON.stringify(definition)}::jsonb,${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,${registrationHash},1,0)`
+    await db.sql`INSERT INTO app_schema_metadata(profile_id,schema_uid,organization_id,registration_transaction_hash) VALUES (${profileId},${schemaUid},${issuerOrg},${registrationHash})`
+    await db.sql`INSERT INTO app_invites(id,organization_id,profile_id,schema_uid,token_hash,created_by,expires_at,claimed_by,claimed_at) VALUES (${inviteId},${issuerOrg},${profileId},${schemaUid},${'f'.repeat(64)},${sessions.issuer.userId},statement_timestamp()+interval '7 days',${sessions.recipient.userId},statement_timestamp())`
+    await db.sql`INSERT INTO app_issuer_payloads(id,locator,invite_id,created_by,subject_address,canonical_payload,payload_digest,credential_uri,visibility,public_fields) VALUES (${payloadId},${'a'.repeat(18)},${inviteId},${sessions.issuer.userId},${subjectAddress},${canonical},${digest},${uri},'private','["/course"]'::jsonb)`
+    await db.sql`INSERT INTO app_credential_metadata(profile_id,generation_id,schema_uid,issuer_organization_id,recipient_user_id,invite_id,issuer_address,subject_address,visibility,public_fields,payload_storage_key,payload_digest,creation_transaction_hash,creation_ledger_index) VALUES (${profileId},${generationId},${schemaUid},${issuerOrg},${sessions.recipient.userId},${inviteId},${issuerAddress},${subjectAddress},'private','["/course"]'::jsonb,${payloadId},${digest},${generationId},2)`
+    await db.sql`INSERT INTO app_wallets(user_id,network_id,address,verified_at) VALUES (${sessions.recipient.userId},1,${subjectAddress},statement_timestamp())`
+    await db.sql`INSERT INTO credential_generations(profile_id,generation_id,ledger_object_id,issuer,subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index) VALUES (${profileId},${generationId},${'1'.repeat(64)},${issuerAddress},${subjectAddress},${schemaUid},${encodeHexUtf8(uri)},true,2,0,3)`
+    for (const [transactionHash, eventType, ledgerIndex, accepted] of [
+      [generationId, 'created', 2, false],
+      [acceptedHash, 'accepted', 3, true],
+    ] as const) {
+      await db.sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,uri_hex,accepted,snapshot) VALUES (${profileId},${transactionHash},0,${generationId},${'1'.repeat(64)},${ledgerIndex},${ledgerHash},0,${eventType},${issuerAddress},${subjectAddress},${schemaUid},${encodeHexUtf8(uri)},${accepted},'{}'::jsonb)`
+    }
+    await db.sql`INSERT INTO ledger_checkpoints(profile_id,ledger_index,ledger_hash,parent_hash,close_time,transaction_count,transaction_root) VALUES (${profileId},4,${ledgerHash},${'0'.repeat(64)},${unixTimeToRippleTime(Date.now())},0,${'2'.repeat(64)})`
+    await db.sql`INSERT INTO indexer_status(profile_id,state,primary_source_tip,secondary_source_tip,last_agreed_ledger_index,last_agreed_ledger_hash,writer_id,writer_epoch,lease_expires_at) VALUES (${profileId},'ready',4,4,4,${ledgerHash},'recipient-test-writer',1,statement_timestamp()+interval '4 minutes')`
+    return {
+      db,
+      portal,
+      authClient,
+      auth,
+      sessions,
+      profileId,
+      generationId,
+      schemaUid,
+      issuerOrg,
+      verifierOrg,
+      otherOrg,
+      inviteId,
+      payloadId,
+      acceptedHash,
+      canonical,
+      issuerAddress,
+      subjectAddress,
+      subjectWallet,
+      ledgerHash,
+      uri,
+      close,
+    }
+  } catch (error) {
+    await close()
+    throw error
+  }
+}
+
+/** Test-only synthetic wallet signer; never logs or persists the private key. */
+export async function signPresentationInput(
+  repository: RecipientRepository,
+  session: Session,
+  input: PresentationChallengeInput,
+  wallet: Wallet,
+): Promise<CreatePresentationInput> {
+  const challenge = await repository.presentationChallenge(session, input)
+  return {
+    ...input,
+    proof: {
+      challengeId: challenge.id,
+      publicKey: wallet.publicKey,
+      scheme: 'ripple',
+      signature: sign(Buffer.from(challenge.message).toString('hex'), wallet.privateKey),
+    },
+  }
+}
diff --git a/apps/web/test/helpers/roleJourneyWallet.ts b/apps/web/test/helpers/roleJourneyWallet.ts
new file mode 100644
index 0000000..ba63970
--- /dev/null
+++ b/apps/web/test/helpers/roleJourneyWallet.ts
@@ -0,0 +1,181 @@
+import type { BrowserContext } from '@playwright/test'
+import { sign } from 'ripple-keypairs'
+import { decode, hashes, verifySignature, type Wallet } from 'xrpl'
+
+/** Synthetic extension transport; the production GemWallet SDK and app signer stay real.
+ * Ephemeral private keys remain in Node and never enter the browser or a log.
+ */
+export async function installJourneyWallet(context: BrowserContext, initial: Wallet) {
+  let wallet = initial
+  const signedMessages: Array<{ hex: boolean; address: string }> = []
+  const errors: string[] = []
+  await context.exposeBinding('__journeyGemRequest', async (_source, request) => {
+    switch (request.type) {
+      case 'REQUEST_IS_INSTALLED/V3':
+        return { isInstalled: true }
+      case 'REQUEST_GET_ADDRESS/V3':
+        return { address: wallet.classicAddress }
+      case 'REQUEST_GET_PUBLIC_KEY/V3':
+        return { address: wallet.classicAddress, publicKey: wallet.publicKey }
+      case 'REQUEST_GET_NETWORK/V3':
+        return {
+          chain: 'XRPL',
+          network: 'Testnet',
+          websocket: 'wss://s.altnet.rippletest.net:51233',
+        }
+      case 'REQUEST_SIGN_MESSAGE/V3': {
+        const { message, isHex } = request.payload
+        if (typeof message !== 'string' || message.length > 16384)
+          throw new Error('Invalid synthetic signing input')
+        signedMessages.push({ hex: Boolean(isHex), address: wallet.classicAddress })
+        return {
+          signedMessage: sign(
+            isHex ? message : Buffer.from(message).toString('hex'),
+            wallet.privateKey,
+          ),
+        }
+      }
+      default:
+        errors.push(String(request.type))
+        throw new Error('Unsupported synthetic GemWallet request')
+    }
+  })
+  await context.addInitScript(() => {
+    const bridge = window as unknown as {
+      gemWallet: boolean
+      __journeyGemRequest: (request: unknown) => Promise<unknown>
+    }
+    bridge.gemWallet = true
+    window.addEventListener('message', async (event) => {
+      if (
+        event.source !== window ||
+        event.origin !== location.origin ||
+        event.data?.source !== 'GEM_WALLET_MSG_REQUEST'
+      )
+        return
+      const result = await bridge.__journeyGemRequest(event.data)
+      // `messagedId` is the spelling in GemWallet API 3.8.0's actual content-script contract.
+      window.postMessage(
+        { source: 'GEM_WALLET_MSG_RESPONSE', messagedId: event.data.messageId, result },
+        location.origin,
+      )
+    })
+  })
+  return {
+    select: (value: Wallet) => {
+      wallet = value
+    },
+    signedMessages,
+    errors,
+  }
+}
+
+/** Fully offline RPC transport. The real xrpl Client autofills, validates and submits.
+ * Only after a valid signature is submitted does the caller project the synthetic ledger event.
+ * This does not exercise a rippled consensus network or the indexer ingestion process.
+ */
+export async function installJourneyLedger(
+  context: BrowserContext,
+  options: {
+    amendment: string
+    ledgerHash: string
+    project: (transaction: Record<string, unknown>, transactionHash: string) => Promise<void>
+  },
+) {
+  const transactions = new Map<string, string>()
+  const errors: string[] = []
+  await context.routeWebSocket('**/*', (socket) => {
+    socket.onMessage(async (raw) => {
+      const request = JSON.parse(String(raw)) as Record<string, unknown>
+      let result: unknown
+      try {
+        switch (request.command) {
+          case 'server_info':
+            result = {
+              info: {
+                network_id: 1,
+                build_version: '2.5.0',
+                load_factor: 1,
+                validated_ledger: { seq: 10, hash: options.ledgerHash, base_fee_xrp: 0.00001 },
+              },
+            }
+            break
+          case 'feature':
+            result = { [options.amendment]: { enabled: true, supported: true } }
+            break
+          case 'ledger_current':
+            result = { ledger_current_index: 10 }
+            break
+          case 'ledger':
+            result = {
+              ledger_index: 10,
+              ledger_hash: options.ledgerHash,
+              validated: true,
+              ledger: { ledger_index: 10 },
+            }
+            break
+          case 'account_info':
+            result = {
+              account_data: {
+                Account: request.account,
+                Sequence: 1,
+                Balance: '100000000',
+                Flags: 0,
+              },
+            }
+            break
+          case 'account_objects':
+            result = {
+              account: request.account,
+              account_objects: [],
+              ledger_hash: options.ledgerHash,
+              ledger_index: 10,
+              validated: true,
+            }
+            break
+          case 'submit': {
+            const blob = String(request.tx_blob)
+            if (!verifySignature(blob)) throw new Error('Invalid submitted signature')
+            const transaction = decode(blob)
+            const transactionHash = hashes.hashSignedTx(blob).toLowerCase()
+            await options.project(transaction, transactionHash)
+            transactions.set(transactionHash, blob)
+            result = {
+              engine_result: 'tesSUCCESS',
+              tx_json: { ...transaction, hash: transactionHash },
+              tx_blob: blob,
+            }
+            break
+          }
+          case 'tx': {
+            const hash = String(request.transaction).toLowerCase()
+            const blob = transactions.get(hash)
+            if (!blob) throw new Error('Transaction was never submitted')
+            result = {
+              validated: true,
+              ledger_index: decode(blob).TransactionType === 'CredentialCreate' ? 2 : 3,
+              hash,
+              meta: { TransactionResult: 'tesSUCCESS' },
+              ...(request.binary ? { tx_blob: blob } : { tx_json: decode(blob) }),
+            }
+            break
+          }
+          default:
+            throw new Error('Unsupported RPC method')
+        }
+        socket.send(JSON.stringify({ id: request.id, type: 'response', status: 'success', result }))
+      } catch {
+        errors.push(String(request.command))
+        socket.send(
+          JSON.stringify({
+            id: request.id,
+            type: 'response',
+            status: 'error',
+            error: 'testFixtureRejected',
+          }),
+        )
+      }
+    })
+  })
+  return { transactions, errors }
+}
diff --git a/apps/web/test/hostedPublicationQueue.test.ts b/apps/web/test/hostedPublicationQueue.test.ts
new file mode 100644
index 0000000..4c69bc5
--- /dev/null
+++ b/apps/web/test/hostedPublicationQueue.test.ts
@@ -0,0 +1,210 @@
+import { describe, expect, it, vi } from 'vitest'
+import { canonicalJson } from '#xcs/core/index.js'
+import {
+  assertHostedPayloadSize,
+  createHostedPayloadLocation,
+  encodePayloadBase64,
+  HOSTED_PAYLOAD_MAX_BYTES,
+} from '../app/utils/hostedPayload'
+import { createHostedPublicationQueue } from '../app/utils/hostedPublicationQueue'
+import type { StoredOperation } from '../app/utils/operationJournal'
+
+class MemoryStorage implements Storage {
+  private values = new Map<string, string>()
+  get length() {
+    return this.values.size
+  }
+  key(index: number) {
+    return [...this.values.keys()][index] ?? null
+  }
+  getItem(key: string) {
+    return this.values.get(key) ?? null
+  }
+  setItem(key: string, value: string) {
+    this.values.set(key, value)
+  }
+  removeItem(key: string) {
+    this.values.delete(key)
+  }
+  clear() {
+    this.values.clear()
+  }
+}
+
+const canonicalPayload = canonicalJson({ claims: { course: 'synthetic-course' } })
+const location = createHostedPayloadLocation('https://payload.example', canonicalPayload)
+const draft = {
+  network: 'testnet',
+  canonicalPayload,
+  locator: location.locator,
+  credentialUri: location.credentialUri,
+}
+// Transport fixtures only: the real API independently validates signed blobs.
+const signature = { txHash: 'AB'.repeat(32), txBlob: 'AB'.repeat(200) }
+const receipt = {
+  ...location,
+  uri: location.credentialUri,
+  byteLength: new TextEncoder().encode(canonicalPayload).byteLength,
+  transactionHash: signature.txHash,
+}
+const readPayload = async () =>
+  new Response(canonicalPayload, {
+    headers: { 'content-type': 'application/json' },
+  })
+
+describe('hosted payload size before signing', () => {
+  it('uses canonical UTF-8 bytes, rejecting oversized content before constructing its location', () => {
+    const exact = 'é'.repeat(HOSTED_PAYLOAD_MAX_BYTES / 2)
+    expect(() => assertHostedPayloadSize(exact)).not.toThrow()
+    expect(encodePayloadBase64(exact).length).toBeLessThanOrEqual(90_000)
+    expect(() => createHostedPayloadLocation('https://payload.example', exact + 'a')).toThrow(
+      'PAYLOAD_SIZE_INVALID',
+    )
+    expect(() => encodePayloadBase64(exact + 'a')).toThrow('PAYLOAD_SIZE_INVALID')
+    expect(() => assertHostedPayloadSize('')).toThrow('PAYLOAD_SIZE_INVALID')
+  })
+})
+
+describe('reload-safe hosted publication queue', () => {
+  it('retains the exact consented bytes before signing, and refuses publication without a signature', async () => {
+    const storage = new MemoryStorage()
+    const job = createHostedPublicationQueue(storage).begin(draft)
+    const reloaded = createHostedPublicationQueue(storage)
+    expect(reloaded.list()).toEqual([job])
+    const publish = vi.fn()
+    await expect(reloaded.publish(job.id, publish)).rejects.toThrow(
+      'PAYLOAD_RECOVERY_SIGNATURE_MISSING',
+    )
+    expect(publish).not.toHaveBeenCalled()
+    expect(reloaded.list()).toHaveLength(1)
+  })
+
+  it('survives reload and an indexing timeout, retrying the same publication without a signer or submission', async () => {
+    const storage = new MemoryStorage()
+    const queue = createHostedPublicationQueue(storage)
+    const job = queue.begin(draft)
+    queue.signed(job.id, signature)
+    const reloaded = createHostedPublicationQueue(storage)
+    const publish = vi
+      .fn()
+      .mockRejectedValueOnce({ data: { error: 'SIGNED_TRANSACTION_NOT_INDEXED' } })
+      .mockResolvedValue(receipt)
+    await expect(reloaded.publish(job.id, publish, readPayload)).rejects.toThrow(
+      'SIGNED_TRANSACTION_NOT_INDEXED',
+    )
+    expect(reloaded.list()[0]?.payload.signedTransactionBlob).toBe(signature.txBlob)
+    const proof = await reloaded.publish(job.id, publish, readPayload)
+    expect(proof.credentialUri).toBe(location.credentialUri)
+    expect(publish.mock.calls[0]).toEqual(publish.mock.calls[1])
+    expect(publish).toHaveBeenLastCalledWith({
+      network: draft.network,
+      locator: draft.locator,
+      payloadBase64: encodePayloadBase64(canonicalPayload),
+      signedTransactionBlob: signature.txBlob,
+    })
+    expect(reloaded.list()).toEqual([])
+  })
+
+  it('retains recovery until the uploaded bytes and receipt have both been verified', async () => {
+    const storage = new MemoryStorage()
+    const queue = createHostedPublicationQueue(storage)
+    const job = queue.begin(draft)
+    queue.signed(job.id, signature)
+    await expect(
+      queue.publish(
+        job.id,
+        async () => ({ ...receipt, transactionHash: 'CD'.repeat(32) }),
+        readPayload,
+      ),
+    ).rejects.toThrow('SIGNED_TRANSACTION_PAYLOAD_MISMATCH')
+    await expect(
+      queue.publish(
+        job.id,
+        async () => receipt,
+        async () => {
+          throw new Error('offline')
+        },
+      ),
+    ).rejects.toThrow('PAYLOAD_FETCH_FAILED')
+    expect(queue.list()).toHaveLength(1)
+  })
+
+  it('fails before signing when browser storage refuses the recovery copy', () => {
+    const storage = new MemoryStorage()
+    storage.setItem = () => {
+      throw new Error('quota')
+    }
+    expect(() => createHostedPublicationQueue(storage).begin(draft)).toThrow(
+      'PAYLOAD_RECOVERY_STORAGE_UNAVAILABLE',
+    )
+  })
+
+  it('keeps separate jobs across tabs and never evicts pending publication data', () => {
+    const storage = new MemoryStorage()
+    const first = createHostedPublicationQueue(storage)
+    const second = createHostedPublicationQueue(storage)
+    const jobs = Array.from({ length: 20 }, (_, index) => (index % 2 ? first : second).begin(draft))
+    expect(() => first.begin(draft)).toThrow('PAYLOAD_RECOVERY_QUEUE_FULL')
+    expect(second.list()).toHaveLength(20)
+    first.remove(jobs[0]!.id)
+    expect(second.list()).toHaveLength(19)
+  })
+
+  it('isolates corrupt recovery instead of publishing modified bytes or blocking other jobs', () => {
+    const storage = new MemoryStorage()
+    const queue = createHostedPublicationQueue(storage)
+    const job = queue.begin(draft)
+    storage.setItem(
+      storage.key(0)!,
+      JSON.stringify({ ...job, payload: { ...job.payload, canonicalPayload: '{}' } }),
+    )
+    const good = queue.begin(draft)
+    expect(queue.list()).toEqual([good])
+    expect(queue.inspect().invalidKeys).toHaveLength(1)
+    queue.removeInvalid(queue.inspect().invalidKeys[0]!)
+    expect(queue.inspect().invalidKeys).toEqual([])
+    expect(queue.list()).toEqual([good])
+  })
+
+  it('recovers from the signed journal when the second storage write fails, even after ledger confirmation', async () => {
+    const storage = new MemoryStorage()
+    const queue = createHostedPublicationQueue(storage)
+    const job = queue.begin(draft)
+    storage.setItem = () => {
+      throw new Error('quota')
+    }
+    expect(() => queue.signed(job.id, signature)).toThrow('PAYLOAD_RECOVERY_STORAGE_UNAVAILABLE')
+    const operation: StoredOperation = {
+      operationId: crypto.randomUUID(),
+      account: 'rIssuer',
+      profileId: draft.network,
+      networkId: 1,
+      transactionType: 'CredentialCreate',
+      createdAt: job.createdAt,
+      updatedAt: job.createdAt,
+      stage: 'validated',
+      engineResult: 'tesSUCCESS',
+      txHash: signature.txHash,
+      txBlob: signature.txBlob,
+      business: {
+        action: 'credential-issue',
+        issuer: 'rIssuer',
+        subject: 'rSubject',
+        schemaUid: 'ab'.repeat(32),
+        credentialUri: draft.credentialUri,
+        publicationJobId: job.id,
+      },
+    }
+    const publish = vi.fn(async () => receipt)
+    const reloaded = createHostedPublicationQueue(storage)
+    await expect(
+      reloaded.publish(job.id, publish, readPayload, [
+        { ...operation, profileId: 'another-network' },
+      ]),
+    ).rejects.toThrow('PAYLOAD_RECOVERY_SIGNATURE_MISSING')
+    expect(publish).not.toHaveBeenCalled()
+    await reloaded.publish(job.id, publish, readPayload, [operation])
+    expect(publish).toHaveBeenCalledOnce()
+    expect(reloaded.list()).toEqual([])
+  })
+})
diff --git a/apps/web/test/issuer-config.test.ts b/apps/web/test/issuer-config.test.ts
new file mode 100644
index 0000000..a046e9b
--- /dev/null
+++ b/apps/web/test/issuer-config.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+import { loadIssuerConfig } from '../server/xcs/issuer/config'
+import {
+  applicationInput,
+  disclosure,
+  email,
+  hash,
+  object,
+  text,
+  uuid,
+} from '../server/xcs/issuer/types'
+
+const environment = {
+  NUXT_ISSUER_DATABASE_URL: 'postgres://xcs_issuer:synthetic@localhost/xcs',
+  XCS_AUTH_ORIGIN: 'https://xcs.test',
+  XCS_IDENTITY_CLIENT_ID: 'test-client',
+  XCS_IDENTITY_CLIENT_SECRET: 'test-secret',
+  NUXT_APP_DATABASE_URL: 'postgres://xcs_app:synthetic@localhost/xcs',
+  XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+  XCS_DOCUMENT_FILESYSTEM_DIRECTORY: '/var/lib/xcs-review',
+}
+describe('issuer opt-in configuration and request validation', () => {
+  it('is disabled when its contract is absent and requires authentication', () => {
+    expect(loadIssuerConfig({})).toBeUndefined()
+    expect(() =>
+      loadIssuerConfig({ NUXT_ISSUER_DATABASE_URL: environment.NUXT_ISSUER_DATABASE_URL }),
+    ).toThrow('ISSUER_AUTH_REQUIRED')
+  })
+  it('requires separate least-privilege credentials and a canonical HTTPS origin', () => {
+    for (const role of ['xcs_admin', 'xcs_admin_app', 'xcs_app', 'xcs_api'])
+      expect(() =>
+        loadIssuerConfig({
+          ...environment,
+          NUXT_ISSUER_DATABASE_URL: `postgres://${role}:synthetic@localhost/xcs`,
+        }),
+      ).toThrow('ISSUER_DATABASE_ROLE_REQUIRED')
+    for (const origin of [
+      'http://xcs.test',
+      'https://xcs.test/',
+      'https://xcs.test/path',
+      'https://user:password@xcs.test',
+    ])
+      expect(() => loadIssuerConfig({ ...environment, XCS_AUTH_ORIGIN: origin })).toThrow()
+    expect(() =>
+      loadIssuerConfig({ ...environment, XCS_DOCUMENT_FILESYSTEM_DIRECTORY: 'relative' }),
+    ).toThrow()
+  })
+  it('bounds invitation lifetime and defaults to seven days', () => {
+    expect(loadIssuerConfig(environment)?.inviteDays).toBe(7)
+    for (const days of ['0', '31', 'Infinity', '7.5', '-1'])
+      expect(() => loadIssuerConfig({ ...environment, XCS_ISSUER_INVITE_DAYS: days })).toThrow(
+        'ISSUER_INVITE_LIFETIME_INVALID',
+      )
+    expect(loadIssuerConfig({ ...environment, XCS_ISSUER_INVITE_DAYS: '30' })?.inviteDays).toBe(30)
+  })
+  it('rejects unknown authority fields, malformed IDs, header injection and prototype selectors', () => {
+    expect(() => object({ role: 'admin' }, [])).toThrow()
+    expect(() => uuid('not-an-id')).toThrow()
+    expect(hash('A'.repeat(64))).toBe('a'.repeat(64))
+    expect(() => hash('g'.repeat(64))).toThrow()
+    expect(() => email('a@example.test\r\nBcc: other@example.test')).toThrow()
+    expect(() => text('hidden\u0000value', 100)).toThrow()
+    expect(() =>
+      disclosure({ visibility: 'private', publicFields: ['/__proto__/secret'] }),
+    ).toThrow('ISSUER_PUBLIC_FIELDS_INVALID')
+    expect(() => disclosure({ visibility: 'owner', publicFields: [] })).toThrow()
+    expect(disclosure({ visibility: 'private', publicFields: ['/public'] })).toEqual({
+      visibility: 'private',
+      publicFields: ['/public'],
+    })
+  })
+  it('requires complete application evidence and refuses caller-selected storage keys', () => {
+    const input = {
+      name: 'School',
+      website: 'https://school.test',
+      contact: 'Responsible',
+      jurisdiction: 'France',
+      description: 'Training',
+      purpose: 'Credentials',
+      documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+    }
+    expect(applicationInput(input).name).toBe('School')
+    expect(() => applicationInput({ ...input, documents: [] })).toThrow('ISSUER_DOCUMENT_REQUIRED')
+    expect(() =>
+      applicationInput({ ...input, documents: Array(4).fill(input.documents[0]) }),
+    ).toThrow()
+    expect(() =>
+      applicationInput({
+        ...input,
+        documents: [{ ...input.documents[0], storageKey: '../private' }],
+      }),
+    ).toThrow()
+    expect(() => applicationInput({ ...input, website: 'javascript:alert(1)' })).toThrow(
+      'ISSUER_WEBSITE_INVALID',
+    )
+    expect(() => applicationInput({ ...input, status: 'approved' })).toThrow()
+  })
+})
diff --git a/apps/web/test/issuer-document-commit.test.ts b/apps/web/test/issuer-document-commit.test.ts
new file mode 100644
index 0000000..0cabcbb
--- /dev/null
+++ b/apps/web/test/issuer-document-commit.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { DatabaseClient } from '../server/lib/db/index.js'
+import type { Session } from '../server/xcs/auth/types'
+import { IssuerRepository } from '../server/xcs/issuer/repository'
+
+const session = { id: 'session', userId: 'user', tokenHash: 'token-hash' } as Session
+const application = {
+  name: 'Synthetic',
+  website: 'https://synthetic.test',
+  contact: 'Synthetic',
+  jurisdiction: 'France',
+  description: 'Synthetic',
+  purpose: 'Synthetic',
+  documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+}
+
+function fixture(outcome: 'commit' | 'rollback' | 'timeout') {
+  const documents = {
+    write: vi.fn(async () => ({
+      storageKey: 'synthetic.pdf',
+      mimeType: 'application/pdf',
+      byteLength: 5,
+      sha256: 'a'.repeat(64),
+    })),
+    remove: vi.fn(async () => {}),
+    release: vi.fn(),
+  }
+  let transaction = 0,
+    committed = false,
+    lockHeld = false
+  const recoverySteps: string[] = []
+  const locks: unknown[] = []
+  const originalFailure = new Error('connection failed while awaiting commit')
+  const sql = Object.assign(
+    // An unlocked snapshot sees absence while the original commit is in flight.
+    vi.fn(async () => []),
+    {
+      begin: vi.fn(async (callback: (query: unknown) => Promise<unknown>) => {
+        transaction++
+        if (transaction === 1) {
+          await callback(async (parts: TemplateStringsArray, ...values: unknown[]) => {
+            const statement = parts.join('?')
+            if (statement.includes('pg_advisory_xact_lock')) {
+              lockHeld = true
+              locks.push(values[0])
+            }
+            if (statement.includes('FROM app_sessions')) return [{ id: session.id }]
+            if (statement.includes('count(*)')) return [{ count: 0 }]
+            return []
+          })
+          // Caller receives an ambiguous failure before PostgreSQL resolves COMMIT.
+          throw originalFailure
+        }
+        return callback(async (parts: TemplateStringsArray, ...values: unknown[]) => {
+          const statement = parts.join('?')
+          if (statement.includes('pg_advisory_xact_lock')) {
+            recoverySteps.push('lock')
+            locks.push(values[0])
+            expect(lockHeld).toBe(true)
+            if (outcome === 'timeout') throw new Error('lock timeout')
+            committed = outcome === 'commit'
+            lockHeld = false
+            return []
+          }
+          if (statement.includes('SELECT id FROM app_organizations')) {
+            recoverySteps.push('read')
+            expect(lockHeld).toBe(false)
+            return committed ? [{ id: 'persisted-organization' }] : []
+          }
+          throw new Error('Unexpected recovery query')
+        })
+      }),
+    },
+  )
+  const repository = new IssuerRepository({ sql } as unknown as DatabaseClient, {
+    origin: 'https://xcs.test',
+    inviteDays: 7,
+    documents,
+    notify: async () => ({ status: 'sent', errorCode: null }),
+  })
+  return { repository, documents, recoverySteps, locks, originalFailure, sql }
+}
+
+describe('issuer document cleanup after an ambiguous commit', () => {
+  it('waits for the original application transaction before deciding whether documents are orphaned', async () => {
+    const test = fixture('commit')
+    await expect(test.repository.apply(session, application)).rejects.toBe(test.originalFailure)
+    expect(test.recoverySteps).toEqual(['lock', 'read'])
+    expect(test.locks).toEqual(['user:issuer-applications', 'user:issuer-applications'])
+    expect(test.sql).not.toHaveBeenCalled()
+    expect(test.documents.remove).not.toHaveBeenCalled()
+    expect(test.documents.release).toHaveBeenCalledWith('synthetic.pdf')
+  })
+  it('cleans files only after rollback and a serialized absence check', async () => {
+    const test = fixture('rollback')
+    await expect(test.repository.apply(session, application)).rejects.toBe(test.originalFailure)
+    expect(test.recoverySteps).toEqual(['lock', 'read'])
+    expect(test.documents.remove).toHaveBeenCalledWith('synthetic.pdf')
+    expect(test.documents.release).not.toHaveBeenCalled()
+  })
+  it('preserves files when the recovery lock times out instead of guessing the commit outcome', async () => {
+    const test = fixture('timeout')
+    await expect(test.repository.apply(session, application)).rejects.toBe(test.originalFailure)
+    expect(test.recoverySteps).toEqual(['lock'])
+    expect(test.documents.remove).not.toHaveBeenCalled()
+    expect(test.documents.release).toHaveBeenCalledWith('synthetic.pdf')
+  })
+})
diff --git a/apps/web/test/issuer-notifications.test.ts b/apps/web/test/issuer-notifications.test.ts
new file mode 100644
index 0000000..58c5ace
--- /dev/null
+++ b/apps/web/test/issuer-notifications.test.ts
@@ -0,0 +1,137 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { describe, expect, it, vi } from 'vitest'
+import type { NotificationTransport } from '../server/xcs/admin/notifications'
+import {
+  createIssuerNotificationMessage,
+  sendIssuerNotification,
+  type IssuerNotification,
+} from '../server/xcs/issuer/notifications'
+import { loadSmtpConfiguration } from '../server/xcs/notifications/smtp'
+
+const token = randomBytes(32).toString('base64url')
+const invitation: IssuerNotification = {
+  id: randomUUID(),
+  kind: 'invitation',
+  recipientEmail: 'recipient@example.test',
+  organizationName: 'Synthetic school',
+  claimUrl: `https://xcs.example.test/recipient/invitations#${token}`,
+  schemaName: 'Course completion',
+  expiresAt: '2026-10-15T12:00:00.000Z',
+  message: 'A personal message.\nUn message personnel.',
+}
+const transport = (
+  sendMail = vi.fn().mockResolvedValue({ accepted: [invitation.recipientEmail], rejected: [] }),
+): NotificationTransport => ({ sendMail, close: vi.fn() })
+
+describe('issuer notification delivery', () => {
+  it('uses an explicit single-recipient envelope and places the private token only in invitation text', () => {
+    const message = createIssuerNotificationMessage(invitation)
+    expect(message.envelope.to).toEqual([invitation.recipientEmail])
+    expect(message.messageId).toBe(`<issuer-${invitation.id}@xcs.test>`)
+    expect(message.text).toContain(invitation.claimUrl)
+    expect(message.text).toContain(invitation.message)
+    expect(JSON.stringify({ ...message, text: undefined, html: undefined })).not.toContain(token)
+    expect(message.html).toContain('Open my invitation')
+    expect(message.html).toContain(invitation.schemaName)
+    expect(message.text).toContain(invitation.expiresAt)
+    expect(message).not.toHaveProperty('attachments')
+  })
+
+  it('uses the same configured sender and envelope identity as administrator notifications', () => {
+    const sender = loadSmtpConfiguration({
+      XCS_SMTP_FROM_NAME: 'XRPL Commons',
+      XCS_SMTP_FROM_ADDRESS: 'notify@example.test',
+      XCS_SMTP_ENVELOPE_FROM: 'bounce@example.test',
+    }).sender
+    const message = createIssuerNotificationMessage(invitation, sender)
+    expect(message.from).toEqual({ name: 'XRPL Commons', address: 'notify@example.test' })
+    expect(message.envelope).toEqual({
+      from: 'bounce@example.test',
+      to: [invitation.recipientEmail],
+    })
+    expect(message.messageId).toBe(`<issuer-${invitation.id}@example.test>`)
+  })
+
+  it.each(['issued', 'revoked'] as const)(
+    'does not include private links or optional message in %s notifications',
+    (kind) => {
+      const message = createIssuerNotificationMessage({ ...invitation, kind })
+      expect(message.text).not.toContain(token)
+      expect(message.text).not.toContain(invitation.message)
+      expect(message.text).toContain(kind === 'issued' ? 'a émis' : 'a révoqué')
+    },
+  )
+
+  it.each([
+    { recipientEmail: 'first@example.test,second@example.test' },
+    { recipientEmail: 'recipient@example.test\r\nBcc: other@example.test' },
+    { organizationName: 'School\r\nBcc: other@example.test' },
+    { id: 'id\r\nBcc: other@example.test' },
+    { message: 'x'.repeat(2001) },
+    { claimUrl: `http://xcs.example.test/recipient/invitations#${token}` },
+    { claimUrl: `https://username:password@xcs.example.test/recipient/invitations#${token}` },
+    { claimUrl: `https://xcs.example.test/recipient/invitations?token=${token}` },
+    { claimUrl: `https://xcs.example.test/recipient/invitations/${token}` },
+  ])('rejects malformed notification before SMTP', async (override) => {
+    const smtp = transport()
+    expect(await sendIssuerNotification(smtp, { ...invitation, ...override })).toEqual({
+      status: 'failed',
+      errorCode: 'ISSUER_NOTIFICATION_INVALID',
+    })
+    expect(smtp.sendMail).not.toHaveBeenCalled()
+  })
+
+  it('sends once and reports definite SMTP acceptance', async () => {
+    const smtp = transport()
+    expect(await sendIssuerNotification(smtp, invitation)).toEqual({
+      status: 'sent',
+      errorCode: null,
+    })
+    expect(smtp.sendMail).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    [{ command: 'CONN', syscall: 'connect', code: 'ECONNREFUSED' }, 'failed', 'SMTP_REJECTED'],
+    [{ command: 'DATA', responseCode: 550 }, 'failed', 'SMTP_REJECTED'],
+    [{ command: 'DATA', code: 'ECONNRESET' }, 'uncertain', 'SMTP_ACCEPTANCE_UNCERTAIN'],
+    [{ command: 'CONN', code: 'ETIMEDOUT' }, 'uncertain', 'SMTP_ACCEPTANCE_UNCERTAIN'],
+  ])(
+    'classifies transport failure without exposing message or retrying',
+    async (failure, status, errorCode) => {
+      const smtp = transport(
+        vi.fn().mockRejectedValue({ ...(failure as object), message: `private ${token}` }),
+      )
+      const result = await sendIssuerNotification(smtp, invitation)
+      expect(result).toEqual({ status, errorCode })
+      expect(JSON.stringify(result)).not.toContain(token)
+      expect(smtp.sendMail).toHaveBeenCalledTimes(1)
+    },
+  )
+
+  it.each([{ accepted: [] }, { accepted: ['other@example.test'] }])(
+    'marks unexpected recipient acceptance as uncertain',
+    async ({ accepted }) => {
+      const smtp = transport(vi.fn().mockResolvedValue({ accepted, rejected: [] }))
+      expect(await sendIssuerNotification(smtp, invitation)).toEqual({
+        status: 'uncertain',
+        errorCode: 'SMTP_ACCEPTANCE_UNCERTAIN',
+      })
+    },
+  )
+
+  it('bounds a hanging delivery without an automatic retry', async () => {
+    vi.useFakeTimers()
+    try {
+      const smtp = transport(vi.fn().mockImplementation(() => new Promise(() => {})))
+      const delivery = sendIssuerNotification(smtp, invitation)
+      await vi.advanceTimersByTimeAsync(60000)
+      expect(await delivery).toEqual({
+        status: 'uncertain',
+        errorCode: 'SMTP_ACCEPTANCE_UNCERTAIN',
+      })
+      expect(smtp.sendMail).toHaveBeenCalledTimes(1)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/apps/web/test/issuer-postgres.integration.test.ts b/apps/web/test/issuer-postgres.integration.test.ts
new file mode 100644
index 0000000..7bfb3b5
--- /dev/null
+++ b/apps/web/test/issuer-postgres.integration.test.ts
@@ -0,0 +1,537 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { createApp, toNodeListener } from 'h3'
+import inject from 'light-my-request'
+import { Wallet } from 'xrpl'
+import { beforeAll, afterAll, describe, expect, it, vi } from 'vitest'
+import { canonicalJson, encodeHexUtf8 } from '#xcs/core/index.js'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { IssuerRepository } from '../server/xcs/issuer/repository'
+import { createIssuerHandler } from '../server/xcs/issuer/http'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import {
+  requireAuthSession,
+  readAuthSession,
+  requireCsrf,
+  SESSION_COOKIE,
+} from '../server/xcs/auth/http'
+import type { Session } from '../server/xcs/auth/types'
+import type { IssuerNotification } from '../server/xcs/issuer/notifications'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+let operator: DatabaseClient,
+  db: DatabaseClient,
+  issuer: DatabaseClient,
+  app: DatabaseClient,
+  name: string
+let repo: IssuerRepository,
+  auth: PostgresAuthRepository,
+  session: Session,
+  recipient: Session,
+  outsider: Session
+let listener: ReturnType<typeof toNodeListener>,
+  organizationId: string,
+  inviteId: string,
+  payloadId: string,
+  canonical: string
+const origin = 'https://xcs.test',
+  profileId = 'issuer-testnet',
+  schemaUid = 'a'.repeat(64),
+  schemaTx = 'b'.repeat(64),
+  generation = 'c'.repeat(64),
+  ledgerHash = 'd'.repeat(64)
+const publisher = Wallet.generate().address,
+  subject = Wallet.generate().address
+const messages: IssuerNotification[] = []
+const token = {
+  ...createAppToken(),
+  csrfToken: createAppToken().token,
+  idleSeconds: 1800,
+  absoluteSeconds: 28800,
+}
+const documents = {
+  write: vi.fn(async () => ({
+    storageKey: randomUUID() + '.pdf',
+    mimeType: 'application/pdf',
+    byteLength: 5,
+    sha256: 'f'.repeat(64),
+  })),
+  remove: vi.fn(async () => {}),
+  release: vi.fn(),
+}
+const definition = {
+  xcsVersion: '0.1',
+  name: 'Synthetic',
+  description: 'Test',
+  fields: { course: { type: 'string' }, secret: { type: 'string' } },
+}
+const headers = () => ({
+  cookie: `${SESSION_COOKIE}=${token.token}`,
+  origin,
+  'x-xcs-csrf': token.csrfToken,
+})
+async function approve(id: string) {
+  await db.sql`UPDATE app_organization_applications SET status='approved',reviewed_by=${session.userId},reviewed_at=statement_timestamp(),revision=revision+1 WHERE organization_id=${id}`
+}
+
+describe.skipIf(!url)('issuer actual PostgreSQL restricted role and authentication', () => {
+  beforeAll(async () => {
+    operator = createDatabaseClient(url!, { onNotice: () => undefined })
+    name = 'xcs_issuer_test_' + randomUUID().replaceAll('-', '')
+    await operator.sql`CREATE DATABASE ${operator.sql(name)} TEMPLATE template0`
+    const parsed = new URL(url!)
+    parsed.pathname = '/' + name
+    db = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const passwords = await createManagedRuntimeDatabaseUsers(db, {
+      indexerPassword: randomBytes(32).toString('hex'),
+      apiPassword: randomBytes(32).toString('hex'),
+      payloadWriterPassword: randomBytes(32).toString('hex'),
+      monitorPassword: randomBytes(32).toString('hex'),
+      applicationPassword: randomBytes(32).toString('hex'),
+      issuerPassword: randomBytes(32).toString('hex'),
+    })
+    await bootstrapDatabase(db, { clusterScope: 'dedicated' })
+    parsed.username = 'xcs_app'
+    parsed.password = passwords.applicationPassword
+    app = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    parsed.username = 'xcs_issuer'
+    parsed.password = passwords.issuerPassword
+    issuer = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    auth = new PostgresAuthRepository(app)
+    await auth.createSession(
+      {
+        issuer: 'https://identity.test',
+        subject: 'issuer',
+        emailVerified: true,
+        email: 'issuer@example.test',
+      },
+      token,
+    )
+    session = (await auth.session(token.tokenHash))!
+    for (const who of ['recipient', 'outsider']) {
+      const credential = {
+        ...createAppToken(),
+        csrfToken: createAppToken().token,
+        idleSeconds: 1800,
+        absoluteSeconds: 28800,
+      }
+      await auth.createSession(
+        {
+          issuer: 'https://identity.test',
+          subject: who,
+          emailVerified: true,
+          email: `${who}@example.test`,
+        },
+        credential,
+      )
+      if (who === 'recipient') recipient = (await auth.session(credential.tokenHash))!
+      else outsider = (await auth.session(credential.tokenHash))!
+    }
+    repo = new IssuerRepository(issuer, {
+      origin,
+      inviteDays: 7,
+      documents,
+      notify: async (message) => {
+        messages.push(message)
+        return { status: 'sent', errorCode: null }
+      },
+    })
+    listener = toNodeListener(
+      createApp().use(
+        createIssuerHandler({
+          repository: repo,
+          authorize: async (event, mutation) => {
+            const session = await requireAuthSession(event, auth)
+            if (mutation) requireCsrf(event, session, origin)
+            return session
+          },
+          readSession: (event) => readAuthSession(event, auth),
+        }),
+      ),
+    )
+    await db.sql`INSERT INTO network_profiles(profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash) VALUES (${profileId},'0.1',1,${ledgerHash},${publisher},1,1,${ledgerHash})`
+    await db.sql`INSERT INTO schema_events(profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profileId},${schemaTx},1,${ledgerHash},0,${publisher},'accepted',${schemaUid},${JSON.stringify(definition)}::jsonb)`
+    await db.sql`INSERT INTO schemas(profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profileId},${schemaUid},${publisher},'Synthetic','Test',${JSON.stringify(definition)}::jsonb,${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,${schemaTx},1,0)`
+    await db.sql`INSERT INTO app_wallets(user_id,network_id,address,verified_at) VALUES (${session.userId},1,${publisher},now()),(${recipient.userId},1,${subject},now())`
+  }, 30000)
+  afterAll(async () => {
+    await Promise.all([issuer?.close(), app?.close(), db?.close()])
+    if (operator && /^xcs_issuer_test_[a-f0-9]{32}$/.test(name))
+      await operator.sql`DROP DATABASE ${operator.sql(name)} WITH (FORCE)`
+    await operator?.close()
+  })
+  it('rejects unsigned and cross-origin mutations and arbitrary document fields', async () => {
+    expect(
+      (await inject(listener, { method: 'GET', url: '/api/issuer/workspace' })).statusCode,
+    ).toBe(401)
+    expect(
+      (
+        await inject(listener, {
+          method: 'POST',
+          url: '/api/issuer/applications',
+          payload: {},
+          headers: { ...headers(), origin: 'https://evil.test' },
+        })
+      ).statusCode,
+    ).toBe(403)
+    expect(
+      (
+        await inject(listener, {
+          method: 'POST',
+          url: '/api/issuer/applications',
+          payload: { admin: true },
+          headers: headers(),
+        })
+      ).statusCode,
+    ).toBe(400)
+  })
+  it('creates pending organization with private documents and refuses self-approval', async () => {
+    const response = await inject(listener, {
+      method: 'POST',
+      url: '/api/issuer/applications',
+      headers: headers(),
+      payload: {
+        name: 'Synthetic issuer',
+        website: 'https://issuer.test',
+        contact: 'Responsible',
+        jurisdiction: 'France',
+        description: 'Synthetic only',
+        purpose: 'Test',
+        documents: [
+          { mimeType: 'application/pdf', base64: Buffer.from('%PDF-').toString('base64') },
+        ],
+      },
+    })
+    expect(response.statusCode, response.body).toBe(200)
+    organizationId = response.json().organizationId
+    expect((await repo.workspace(session)).organizations[0]?.applicationStatus).toBe('pending')
+    await expect(
+      repo.registerSchema(session, {
+        organizationId,
+        profileId,
+        transactionHash: schemaTx,
+        displayName: 'Course',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ statusCode: 403 })
+    await expect(
+      issuer.sql`UPDATE app_organization_applications SET status='approved' WHERE organization_id=${organizationId}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      issuer.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${session.userId},'admin')`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      issuer.sql`UPDATE schemas SET name='fake' WHERE profile_id=${profileId}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await approve(organizationId)
+  })
+  it('accepts only indexed registration belonging to a linked publisher and forbids metadata takeover', async () => {
+    await expect(
+      repo.registerSchema(session, {
+        organizationId,
+        profileId,
+        transactionHash: 'e'.repeat(64),
+        displayName: '',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    await expect(
+      repo.registerSchema(outsider, {
+        organizationId,
+        profileId,
+        transactionHash: schemaTx,
+        displayName: '',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ statusCode: 404 })
+    const registered = await repo.registerSchema(session, {
+      organizationId,
+      profileId,
+      transactionHash: schemaTx,
+      displayName: 'Course',
+      category: '',
+    })
+    expect(registered.schemaUid).toBe(schemaUid)
+    await db.sql`UPDATE app_wallets SET revoked_at=now() WHERE user_id=${session.userId}`
+    await expect(
+      repo.registerSchema(session, {
+        organizationId,
+        profileId,
+        transactionHash: schemaTx,
+        displayName: '',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    await db.sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${session.userId}`
+    const second = await repo.apply(session, {
+      name: 'Second organization',
+      website: 'https://second.test',
+      contact: 'Responsible',
+      jurisdiction: 'France',
+      description: 'Other',
+      purpose: 'Test',
+      documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+    })
+    await approve(second.organizationId)
+    await expect(
+      repo.registerSchema(session, {
+        organizationId: second.organizationId,
+        profileId,
+        transactionHash: schemaTx,
+        displayName: '',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ code: 'ISSUER_SCHEMA_OWNED' })
+  })
+  it('rotates a secret on resend, persists hashes only and claims atomically for the logged-in account', async () => {
+    const invite = await repo.invite(session, {
+      organizationId,
+      profileId,
+      schemaUid,
+      email: 'different-address@example.test',
+      message: 'Welcome',
+    })
+    inviteId = invite.id
+    const first = new URL(messages.at(-1)!.claimUrl!).hash.slice(1)
+    const [row] = await db.sql`SELECT token_hash FROM app_invites WHERE id=${inviteId}`
+    expect(row!.token_hash).not.toBe(first)
+    expect(JSON.stringify(await repo.workspace(session))).not.toContain(first)
+    await repo.changeInvite(session, inviteId, 'resend')
+    const second = new URL(messages.at(-1)!.claimUrl!).hash.slice(1)
+    expect(second).not.toBe(first)
+    await expect(repo.invitation(recipient, first, true)).rejects.toMatchObject({ statusCode: 404 })
+    expect((await repo.invitation(recipient, second, false)).claimed).toBe(false)
+    const claimed = await Promise.allSettled([
+      repo.invitation(recipient, second, true),
+      repo.invitation(outsider, second, true),
+    ])
+    expect(claimed.filter((result) => result.status === 'fulfilled')).toHaveLength(1)
+    const [winner] = await db.sql`SELECT claimed_by FROM app_invites WHERE id=${inviteId}`
+    // Keep later tests deterministic while still asserting the two-account race above.
+    await db.sql`UPDATE app_invites SET claimed_by=${recipient.userId} WHERE id=${inviteId}`
+    expect([recipient.userId, outsider.userId]).toContain(winner!.claimed_by)
+    await expect(repo.changeInvite(session, inviteId, 'revoke')).rejects.toMatchObject({
+      statusCode: 409,
+    })
+  })
+  it('prepares exact private bytes without public publication, validates schema and linked subject', async () => {
+    canonical = canonicalJson({
+      xcsVersion: '0.1',
+      issuer: publisher,
+      subject,
+      schema: schemaUid,
+      claims: { course: 'Public course', secret: 'PRIVATE SYNTHETIC' },
+    })
+    const input = {
+      inviteId,
+      canonicalPayload: canonical,
+      subjectAddress: subject,
+      visibility: 'private' as const,
+      publicFields: ['/course'],
+    }
+    await expect(
+      repo.preparePayload(session, { ...input, canonicalPayload: canonical + ' ' }),
+    ).rejects.toMatchObject({ statusCode: 400 })
+    await expect(
+      repo.preparePayload(session, { ...input, subjectAddress: publisher }),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    const draft = await repo.preparePayload(session, input)
+    payloadId = draft.payloadId
+    expect(Buffer.byteLength(draft.credentialUri)).toBeLessThanOrEqual(128)
+    expect((await repo.payload(session, payloadId)).content).toBe(canonical)
+    await expect(repo.payload(null, payloadId)).rejects.toMatchObject({ statusCode: 404 })
+    await expect(repo.payload(outsider, payloadId)).rejects.toMatchObject({ statusCode: 404 })
+    expect((await db.sql`SELECT count(*)::int AS count FROM hosted_payloads`)[0]!.count).toBe(0)
+    const uriHex = encodeHexUtf8(draft.credentialUri)
+    await db.sql`INSERT INTO credential_generations(profile_id,generation_id,ledger_object_id,issuer,subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index) VALUES (${profileId},${generation},${'e'.repeat(64)},${publisher},${subject},${schemaUid},${uriHex},false,2,0,2)`
+    await db.sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,uri_hex,accepted,snapshot) VALUES (${profileId},${generation},0,${generation},${'e'.repeat(64)},2,${ledgerHash},0,'created',${publisher},${subject},${schemaUid},${uriHex},false,'{}')`
+  })
+  it('rejects expired or revoked invitation tokens, including preview, without identifying the recipient', async () => {
+    const expired = await repo.invite(session, {
+      organizationId,
+      profileId,
+      schemaUid,
+      email: 'expires@example.test',
+      message: '',
+    })
+    const expiredToken = new URL(messages.at(-1)!.claimUrl!).hash.slice(1)
+    await db.sql`UPDATE app_invites SET created_at=now()-interval '2 days',expires_at=now()-interval '1 day' WHERE id=${expired.id}`
+    await expect(repo.invitation(recipient, expiredToken, true)).rejects.toMatchObject({
+      statusCode: 404,
+    })
+    await expect(repo.invitation(recipient, expiredToken, false)).rejects.toMatchObject({
+      statusCode: 404,
+    })
+    const revoked = await repo.invite(session, {
+      organizationId,
+      profileId,
+      schemaUid,
+      email: 'revoked@example.test',
+      message: '',
+    })
+    const revokedToken = new URL(messages.at(-1)!.claimUrl!).hash.slice(1)
+    await repo.changeInvite(session, revoked.id, 'revoke')
+    await expect(repo.invitation(recipient, revokedToken, true)).rejects.toMatchObject({
+      statusCode: 404,
+    })
+    expect(
+      (
+        await inject(listener, {
+          method: 'POST',
+          url: '/api/issuer/invitations/preview',
+          payload: { token: revokedToken },
+        })
+      ).statusCode,
+    ).toBe(401)
+  })
+  it('bounds drafts and rechecks both wallets, account activity and committed bytes at the final recording boundary', async () => {
+    const draftInput = {
+      inviteId,
+      canonicalPayload: canonical,
+      subjectAddress: subject,
+      visibility: 'private' as const,
+      publicFields: ['/course'],
+    }
+    const recordInput = {
+      inviteId,
+      transactionHash: generation,
+      payloadId,
+      visibility: 'private' as const,
+      publicFields: ['/course'],
+    }
+    await db.sql`UPDATE app_wallets SET revoked_at=now() WHERE user_id=${session.userId}`
+    await expect(repo.preparePayload(session, draftInput)).rejects.toMatchObject({
+      code: 'ISSUER_PAYLOAD_INVALID',
+    })
+    await expect(repo.recordCredential(session, recordInput)).rejects.toMatchObject({
+      code: 'ISSUER_CREDENTIAL_MISMATCH',
+    })
+    await db.sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${session.userId}`
+    await db.sql`UPDATE app_wallets SET revoked_at=now() WHERE user_id=${recipient.userId}`
+    await expect(repo.preparePayload(session, draftInput)).rejects.toMatchObject({
+      code: 'ISSUER_SUBJECT_WALLET_REQUIRED',
+    })
+    await expect(repo.recordCredential(session, recordInput)).rejects.toMatchObject({
+      code: 'ISSUER_CREDENTIAL_MISMATCH',
+    })
+    await db.sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${recipient.userId}`
+    await db.sql`UPDATE app_users SET status='suspended' WHERE id=${session.userId}`
+    await expect(repo.preparePayload(session, draftInput)).rejects.toMatchObject({
+      statusCode: 401,
+    })
+    await db.sql`UPDATE app_users SET status='active' WHERE id=${session.userId}`
+    await expect(
+      repo.recordCredential(session, { ...recordInput, publicFields: ['/secret'] }),
+    ).rejects.toMatchObject({ code: 'ISSUER_PAYLOAD_MISMATCH' })
+    const [row] =
+      await db.sql`SELECT uri_hex FROM credential_events WHERE transaction_hash=${generation}`
+    await db.sql`UPDATE credential_events SET uri_hex=${encodeHexUtf8('https://other.test/#xcs-sha256=' + 'a'.repeat(64))} WHERE transaction_hash=${generation}`
+    await expect(repo.recordCredential(session, recordInput)).rejects.toMatchObject({
+      code: 'ISSUER_CREDENTIAL_MISMATCH',
+    })
+    await db.sql`UPDATE credential_events SET uri_hex=${row!.uri_hex} WHERE transaction_hash=${generation}`
+    await db.sql`INSERT INTO app_issuer_payloads(id,locator,invite_id,created_by,subject_address,canonical_payload,payload_digest,credential_uri,visibility,public_fields)
+      SELECT gen_random_uuid(),left(replace(gen_random_uuid()::text,'-',''),18),invite_id,created_by,subject_address,canonical_payload,payload_digest,credential_uri,visibility,public_fields
+      FROM app_issuer_payloads CROSS JOIN generate_series(1,19) WHERE id=${payloadId}`
+    await expect(repo.preparePayload(session, draftInput)).rejects.toMatchObject({
+      code: 'ISSUER_DRAFT_LIMIT',
+    })
+    await db.sql`DELETE FROM app_issuer_payloads WHERE invite_id=${inviteId} AND id<>${payloadId}`
+  })
+  it('records only the exact indexed generation and sends once to verified claimant, never original delivery email', async () => {
+    const input = {
+      inviteId,
+      transactionHash: generation,
+      payloadId,
+      visibility: 'private' as const,
+      publicFields: ['/course'],
+    }
+    await expect(
+      repo.recordCredential(session, { ...input, transactionHash: 'f'.repeat(64) }),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    await expect(
+      repo.recordCredential(session, { ...input, visibility: 'public' }),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    const [record] = await Promise.all([
+      repo.recordCredential(session, input),
+      repo.recordCredential(session, input),
+    ])
+    expect(record.generationId).toBe(generation)
+    await repo.recordCredential(session, input)
+    expect(messages.filter((message) => message.kind === 'issued')).toHaveLength(1)
+    expect(messages.find((message) => message.kind === 'issued')!.recipientEmail).toBe(
+      'recipient@example.test',
+    )
+    expect((await repo.issuance(session, inviteId)).recipient.id).toBe(recipient.userId)
+    expect((await repo.issuance(session, inviteId)).existingCredential).toEqual({
+      profileId,
+      generationId: generation,
+    })
+    await expect(
+      repo.preparePayload(session, {
+        inviteId,
+        canonicalPayload: canonical,
+        subjectAddress: subject,
+        visibility: 'private',
+        publicFields: ['/course'],
+      }),
+    ).rejects.toMatchObject({ code: 'ISSUER_INVITE_ALREADY_ISSUED' })
+  })
+  it('delivers canonical full owner/recipient payloads and only selected claims anonymously or to other accounts', async () => {
+    expect((await repo.payload(session, payloadId)).content).toBe(canonical)
+    expect((await repo.payload(recipient, payloadId)).content).toBe(canonical)
+    for (const viewer of [null, outsider])
+      expect(JSON.parse((await repo.payload(viewer, payloadId)).content)).toEqual({
+        claims: { course: 'Public course' },
+      })
+    await db.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${outsider.userId},'admin')`
+    expect(JSON.parse((await repo.payload(outsider, payloadId)).content)).toEqual({
+      claims: { course: 'Public course' },
+    })
+    await expect(app.sql`SELECT canonical_payload FROM app_issuer_payloads`).rejects.toMatchObject({
+      code: '42501',
+    })
+    const [locator] = await db.sql`SELECT locator FROM app_issuer_payloads WHERE id=${payloadId}`
+    const alias = await inject(listener, { method: 'GET', url: '/q/' + locator!.locator })
+    expect(alias.json()).toEqual({ claims: { course: 'Public course' } })
+    const response = await inject(listener, {
+      method: 'GET',
+      url: '/api/issuer/payloads/' + payloadId,
+    })
+    expect(response.headers['cache-control']).toBe('private, no-store')
+    expect(response.body).not.toContain('PRIVATE SYNTHETIC')
+    expect(response.headers['x-xcs-claim-scope']).toBe('public')
+    expect(JSON.stringify(await repo.workspace(session))).not.toContain('PRIVATE SYNTHETIC')
+  })
+  it('records verified revocation notification once, and stale approvals/sessions prevent further writes', async () => {
+    const revokeTx = 'f'.repeat(64)
+    await expect(
+      repo.refreshCredential(session, profileId, generation, revokeTx),
+    ).rejects.toMatchObject({ statusCode: 409 })
+    await db.sql`UPDATE credential_generations SET deleted_ledger_index=3,last_ledger_index=3,deletion_cause='issuer_revoked' WHERE generation_id=${generation}`
+    await db.sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,accepted,deletion_cause,snapshot) VALUES (${profileId},${revokeTx},0,${generation},${'e'.repeat(64)},3,${ledgerHash},0,'deleted',${publisher},${subject},${schemaUid},false,'issuer_revoked','{}')`
+    await repo.refreshCredential(session, profileId, generation, revokeTx)
+    await repo.refreshCredential(session, profileId, generation, revokeTx)
+    expect(messages.filter((message) => message.kind === 'revoked')).toHaveLength(1)
+    await db.sql`UPDATE app_organizations SET status='suspended' WHERE id=${organizationId}`
+    await expect(repo.issuance(session, inviteId)).rejects.toMatchObject({ statusCode: 403 })
+    await db.sql`UPDATE app_organizations SET status='active' WHERE id=${organizationId}`
+    await auth.logout(session.id)
+    await expect(
+      repo.registerSchema(session, {
+        organizationId,
+        profileId,
+        transactionHash: schemaTx,
+        displayName: '',
+        category: '',
+      }),
+    ).rejects.toMatchObject({ statusCode: 401 })
+  })
+})
diff --git a/apps/web/test/issuer-runtime.integration.test.ts b/apps/web/test/issuer-runtime.integration.test.ts
new file mode 100644
index 0000000..e89916d
--- /dev/null
+++ b/apps/web/test/issuer-runtime.integration.test.ts
@@ -0,0 +1,310 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { access, mkdir, mkdtemp, readFile, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { Wallet } from 'xrpl'
+import en from '../i18n/locales/en.json'
+import { expect as browserExpect, type Page } from '@playwright/test'
+import { describe, expect, it } from 'vitest'
+import { canonicalJson, encodeHexUtf8 } from '#xcs/core/index.js'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import { SESSION_COOKIE } from '../server/xcs/auth/http'
+import { startAdminRuntime } from './helpers/adminRuntime'
+
+const enabled = process.env.XCS_ISSUER_RUNTIME_TEST === '1'
+const databaseUrl = process.env.XCS_TEST_DATABASE_URL?.trim()
+const smtpPort = Number(process.env.XCS_ISSUER_RUNTIME_SMTP_PORT ?? '5531')
+const mailpitOrigin = process.env.XCS_ISSUER_RUNTIME_MAILPIT_ORIGIN ?? 'http://127.0.0.1:8031'
+if (enabled && !databaseUrl) throw new Error('XCS_TEST_DATABASE_URL is required')
+
+/** Actual browser fetches: browser-owned Secure cookies, Origin and shared CSRF contract. */
+async function request(page: Page, path: string, body?: unknown) {
+  return page.evaluate(
+    async ({ path, body }) => {
+      const auth = await fetch('/api/auth/session').then((response) => response.json())
+      const response = await fetch(
+        path,
+        body === undefined
+          ? {}
+          : {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', 'x-xcs-csrf': auth.csrfToken ?? '' },
+              body: JSON.stringify(body),
+            },
+      )
+      return {
+        status: response.status,
+        body: await response.json(),
+        cache: response.headers.get('cache-control'),
+      }
+    },
+    { path, body },
+  )
+}
+
+describe.skipIf(!enabled)(
+  'compiled issuer portal with PostgreSQL, Chromium and actual Mailpit SMTP',
+  () => {
+    it('uploads a private application, mails an invitation, claims it and filters an indexed private credential', async () => {
+      await access(fileURLToPath(new URL('../.output/server/index.mjs', import.meta.url)))
+      const smtpUi = new URL(mailpitOrigin)
+      if (
+        smtpUi.protocol !== 'http:' ||
+        !['127.0.0.1', 'localhost'].includes(smtpUi.hostname) ||
+        smtpUi.username ||
+        smtpUi.password
+      )
+        throw new Error('Runtime tests require local Mailpit')
+      const testId = randomUUID().replaceAll('-', '')
+      const databaseName = 'xcs_issuer_runtime_' + testId
+      const base = fileURLToPath(new URL('../../../.data/issuer-runtime/', import.meta.url))
+      await mkdir(base, { recursive: true })
+      const directory = await mkdtemp(join(base, 'run-'))
+      let operator: DatabaseClient | undefined,
+        database: DatabaseClient | undefined,
+        authDatabase: DatabaseClient | undefined
+      let runtime: Awaited<ReturnType<typeof startAdminRuntime>> | undefined
+      try {
+        operator = createDatabaseClient(databaseUrl!, { onNotice: () => undefined })
+        await operator.sql`CREATE DATABASE ${operator.sql(databaseName)} TEMPLATE template0`
+        const url = new URL(databaseUrl!)
+        url.pathname = '/' + databaseName
+        database = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+        const passwords = await createManagedRuntimeDatabaseUsers(database, {
+          indexerPassword: randomBytes(32).toString('hex'),
+          apiPassword: randomBytes(32).toString('hex'),
+          payloadWriterPassword: randomBytes(32).toString('hex'),
+          monitorPassword: randomBytes(32).toString('hex'),
+          applicationPassword: randomBytes(32).toString('hex'),
+          adminApplicationPassword: randomBytes(32).toString('hex'),
+          issuerPassword: randomBytes(32).toString('hex'),
+        })
+        await bootstrapDatabase(database, { clusterScope: 'dedicated' })
+        const roleUrl = (role: string, password: string) => {
+          const value = new URL(url)
+          value.username = role
+          value.password = password
+          return value.toString()
+        }
+        authDatabase = createDatabaseClient(roleUrl('xcs_app', passwords.applicationPassword), {
+          onNotice: () => undefined,
+        })
+        const auth = new PostgresAuthRepository(authDatabase)
+        const login = async (subject: string) => {
+          const input = {
+            ...createAppToken(),
+            csrfToken: createAppToken().token,
+            idleSeconds: 1800,
+            absoluteSeconds: 28800,
+          }
+          await auth.createSession(
+            {
+              issuer: 'https://identity.test',
+              subject,
+              email: `${subject}-${testId}@example.test`,
+              emailVerified: true,
+              displayName: `Synthetic ${subject}`,
+            },
+            input,
+          )
+          return { ...input, userId: (await auth.session(input.tokenHash))!.userId }
+        }
+        const issuer = await login('issuer'),
+          recipient = await login('recipient')
+        const issuerAddress = Wallet.generate().address,
+          subjectAddress = Wallet.generate().address
+        const profileId = 'issuer-runtime',
+          schemaUid = 'a'.repeat(64),
+          registrationHash = 'b'.repeat(64),
+          generationId = 'c'.repeat(64),
+          ledgerHash = 'd'.repeat(64)
+        const definition = {
+          xcsVersion: '0.1',
+          name: 'Synthetic runtime schema',
+          description: 'Fixture-only validated projection',
+          fields: { course: { type: 'string' }, secret: { type: 'string' } },
+        }
+        // Synthetic authoritative projection fixtures replace XRPL submission only; all issuer
+        // HTTP handlers, role grants, storage, SMTP and rendering execute in the built application.
+        await database.sql`INSERT INTO network_profiles(profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash) VALUES (${profileId},'0.1',1,${ledgerHash},${issuerAddress},1,1,${ledgerHash})`
+        await database.sql`INSERT INTO schema_events(profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profileId},${registrationHash},1,${ledgerHash},0,${issuerAddress},'accepted',${schemaUid},${JSON.stringify(definition)}::jsonb)`
+        await database.sql`INSERT INTO schemas(profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profileId},${schemaUid},${issuerAddress},${definition.name},${definition.description},${JSON.stringify(definition)}::jsonb,${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,${registrationHash},1,0)`
+        await database.sql`INSERT INTO app_wallets(user_id,network_id,address,verified_at) VALUES (${issuer.userId},1,${issuerAddress},now()),(${recipient.userId},1,${subjectAddress},now())`
+        runtime = await startAdminRuntime(
+          directory,
+          {
+            api: roleUrl('xcs_api', passwords.apiPassword),
+            auth: roleUrl('xcs_app', passwords.applicationPassword),
+            admin: roleUrl('xcs_admin_app', passwords.adminApplicationPassword),
+          },
+          { issuerDatabaseUrl: roleUrl('xcs_issuer', passwords.issuerPassword), smtpPort },
+        )
+        const context = runtime.context
+        const signIn = async (value: typeof issuer) => {
+          await context.clearCookies()
+          await context.addCookies([
+            {
+              name: SESSION_COOKIE,
+              value: value.token,
+              url: runtime!.origin,
+              httpOnly: true,
+              secure: true,
+              sameSite: 'Lax',
+            },
+          ])
+        }
+        await signIn(issuer)
+        const page = await context.newPage()
+        await page.goto(runtime.origin + '/issuer/apply')
+        // Wait for hydration before filling SSR-rendered controls.
+        await browserExpect(page.locator('[data-client-ready]')).toHaveAttribute(
+          'data-client-ready',
+          'true',
+        )
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.name, { exact: true })
+          .fill('Synthetic runtime school')
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.website, { exact: true })
+          .fill('https://school.example.test')
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.contact, { exact: true })
+          .fill('responsible@example.test')
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.jurisdiction, { exact: true })
+          .fill('France')
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.description, { exact: true })
+          .fill('Synthetic application for runtime verification')
+        await page
+          .getByLabel(en.simpleIssuer.applicationFields.purpose, { exact: true })
+          .fill('Issue synthetic completion records')
+        const proof = Buffer.from('%PDF-1.4\nSynthetic private evidence\n%%EOF')
+        await page
+          .locator('input[type=file]')
+          .setInputFiles({ name: 'proof.pdf', mimeType: 'application/pdf', buffer: proof })
+        await page.getByRole('button', { name: en.simpleIssuer.applySubmit, exact: true }).click()
+        await browserExpect(page).toHaveURL(/\/issuer\/application\?organizationId=/)
+        const organizationId = new URL(page.url()).searchParams.get('organizationId')!
+        await browserExpect(
+          page.getByRole('heading', { name: 'Synthetic runtime school', exact: true }),
+        ).toBeVisible()
+        const [document] =
+          await database.sql`SELECT storage_key FROM app_documents WHERE organization_id=${organizationId}`
+        expect(await readFile(join(directory, document!.storage_key))).toEqual(proof)
+        expect(
+          (
+            await request(page, '/api/issuer/schemas', {
+              organizationId,
+              profileId,
+              transactionHash: registrationHash,
+            })
+          ).status,
+        ).toBe(403)
+        await database.sql`UPDATE app_organization_applications SET status='approved',reviewed_by=${issuer.userId},reviewed_at=now(),revision=1 WHERE organization_id=${organizationId}`
+        expect(
+          (
+            await request(page, '/api/issuer/schemas', {
+              organizationId,
+              profileId,
+              transactionHash: registrationHash,
+              displayName: 'Runtime course',
+            })
+          ).status,
+        ).toBe(200)
+        const email = `invited-${testId}@example.test`
+        const sent = await request(page, '/api/issuer/invites', {
+          organizationId,
+          profileId,
+          schemaUid,
+          email,
+          message: 'Synthetic invitation only',
+        })
+        expect(sent.status).toBe(200)
+        expect(sent.body.deliveryStatus).toBe('sent')
+        const inviteId = sent.body.id as string
+        // Mailpit's documented rendered-text endpoint is filtered by our unique synthetic recipient.
+        const textUrl = new URL('/view/latest.txt', mailpitOrigin)
+        textUrl.searchParams.set('query', 'to:' + email)
+        let message = ''
+        await browserExpect
+          .poll(async () => {
+            const response = await fetch(textUrl)
+            message = response.ok ? await response.text() : ''
+            return message.includes('/recipient/invitations#')
+          })
+          .toBe(true)
+        const link = message.match(
+          /https:\/\/[^\s]+\/recipient\/invitations#[A-Za-z0-9_-]{43}/,
+        )?.[0]
+        expect(Boolean(link)).toBe(true)
+        expect(message).not.toContain('Synthetic private evidence')
+        await signIn(recipient)
+        await page.goto(link!)
+        await browserExpect(
+          page.getByRole('button', { name: 'Claim with this account', exact: true }),
+        ).toBeVisible()
+        expect(new URL(page.url()).hash).toBe('')
+        await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+        await browserExpect(
+          page.getByText(en.simpleRecipient.invitationReady, { exact: true }),
+        ).toBeVisible()
+        const [claimed] =
+          await database.sql`SELECT claimed_by FROM app_invites WHERE id=${inviteId}`
+        expect(claimed!.claimed_by).toBe(recipient.userId)
+        await signIn(issuer)
+        await page.goto(runtime.origin + '/issuer')
+        const canonical = canonicalJson({
+          xcsVersion: '0.1',
+          issuer: issuerAddress,
+          subject: subjectAddress,
+          schema: schemaUid,
+          claims: { course: 'Public runtime course', secret: 'PRIVATE RUNTIME CLAIM' },
+        })
+        const draft = await request(page, '/api/issuer/payloads', {
+          inviteId,
+          canonicalPayload: canonical,
+          subjectAddress,
+          visibility: 'private',
+          publicFields: ['/course'],
+        })
+        expect(draft.status).toBe(200)
+        const uriHex = encodeHexUtf8(draft.body.credentialUri)
+        await database.sql`INSERT INTO credential_generations(profile_id,generation_id,ledger_object_id,issuer,subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index) VALUES (${profileId},${generationId},${'e'.repeat(64)},${issuerAddress},${subjectAddress},${schemaUid},${uriHex},false,2,0,2)`
+        await database.sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,uri_hex,accepted,snapshot) VALUES (${profileId},${generationId},0,${generationId},${'e'.repeat(64)},2,${ledgerHash},0,'created',${issuerAddress},${subjectAddress},${schemaUid},${uriHex},false,'{}')`
+        const recorded = await request(page, '/api/issuer/credentials', {
+          inviteId,
+          transactionHash: generationId,
+          payloadId: draft.body.payloadId,
+          visibility: 'private',
+          publicFields: ['/course'],
+        })
+        expect(recorded.status).toBe(200)
+        const payloadPath = new URL(draft.body.credentialUri).pathname
+        expect((await request(page, payloadPath)).body.claims.secret).toBe('PRIVATE RUNTIME CLAIM')
+        await context.clearCookies()
+        const publicView = await request(page, payloadPath)
+        expect(publicView.status).toBe(200)
+        expect(publicView.body).toEqual({ claims: { course: 'Public runtime course' } })
+        expect(publicView.cache).toBe('private, no-store')
+        expect(
+          (await database.sql`SELECT count(*)::int AS count FROM hosted_payloads`)[0]!.count,
+        ).toBe(0)
+      } finally {
+        await runtime?.close()
+        await Promise.all([authDatabase?.close(), database?.close()])
+        if (operator && /^xcs_issuer_runtime_[a-f0-9]{32}$/.test(databaseName))
+          await operator.sql`DROP DATABASE IF EXISTS ${operator.sql(databaseName)} WITH (FORCE)`
+        await operator?.close()
+        await rm(directory, { recursive: true, force: true })
+      }
+    }, 90000)
+  },
+)
diff --git a/apps/web/test/issuer-storage.test.ts b/apps/web/test/issuer-storage.test.ts
new file mode 100644
index 0000000..ea36e4d
--- /dev/null
+++ b/apps/web/test/issuer-storage.test.ts
@@ -0,0 +1,131 @@
+import { randomBytes } from 'node:crypto'
+import { lstat, mkdtemp, readdir, rm, symlink, unlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { PrivateDocuments } from '../server/xcs/admin/documents'
+import { MAX_DOCUMENT_BYTES, PrivateDocumentStorage } from '../server/xcs/issuer/storage'
+
+const roots: string[] = []
+async function directory() {
+  const root = await mkdtemp(join(tmpdir(), 'xcs-issuer-doc-'))
+  roots.push(root)
+  return root
+}
+afterEach(async () => {
+  for (const root of roots.splice(0)) await rm(root, { recursive: true, force: true })
+})
+
+const pdf = Buffer.from('%PDF-1.4\nsynthetic document\n')
+const input = { mimeType: 'application/pdf', base64: pdf.toString('base64') }
+
+describe('issuer private document storage', () => {
+  it.each([
+    ['application/pdf', pdf],
+    ['image/png', Buffer.from([137, 80, 78, 71, 13, 10, 26, 10, 0])],
+    ['image/jpeg', Buffer.from([255, 216, 255, 224, 0])],
+  ])(
+    'publishes an opaque private %s readable by administrator integrity checks',
+    async (mimeType, bytes) => {
+      const root = await directory()
+      const store = new PrivateDocumentStorage(root)
+      const document = await store.write({ mimeType, base64: bytes.toString('base64') })
+      expect(document.storageKey).toMatch(/^[0-9a-f]{64}\.(pdf|png|jpg)$/)
+      expect(document.byteLength).toBe(bytes.length)
+      expect((await lstat(join(root, document.storageKey))).mode & 0o777).toBe(0o600)
+      expect(await readdir(root)).toEqual([document.storageKey])
+      expect(await store.read(document)).toEqual(bytes)
+      const reader = new PrivateDocuments(root, randomBytes(32).toString('hex'))
+      expect(
+        await reader.read({
+          id: '',
+          storage_key: document.storageKey,
+          mime_type: mimeType,
+          byte_length: document.byteLength,
+          sha256: document.sha256,
+        }),
+      ).toEqual(bytes)
+    },
+  )
+
+  it.each([
+    { ...input, mimeType: 'text/html' },
+    { ...input, mimeType: 'image/png' },
+    { ...input, base64: `data:application/pdf;base64,${input.base64}` },
+    { ...input, base64: `${input.base64}\n` },
+    { ...input, base64: 'JVBERi0===' },
+    { ...input, base64: '!!!!' },
+  ])('rejects unsupported MIME, mismatched magic and malformed base64', async (invalid) => {
+    const root = await directory()
+    await expect(new PrivateDocumentStorage(root).write(invalid)).rejects.toThrow(
+      'ISSUER_DOCUMENT_INVALID',
+    )
+    expect(await readdir(root)).toEqual([])
+  })
+
+  it('rejects uploads larger than 20 MiB before creating a file', async () => {
+    const root = await directory()
+    const bytes = Buffer.alloc(MAX_DOCUMENT_BYTES + 1)
+    pdf.copy(bytes)
+    await expect(
+      new PrivateDocumentStorage(root).write({ ...input, base64: bytes.toString('base64') }),
+    ).rejects.toThrow('ISSUER_DOCUMENT_INVALID')
+    expect(await readdir(root)).toEqual([])
+  })
+
+  it.each([
+    'relative',
+    '/',
+    '/app/public/documents',
+    '/app/.output/public/documents',
+    '/app/static/private',
+    '/private/docs/../public',
+  ])('rejects unsafe roots %s', (root) => {
+    expect(() => new PrivateDocumentStorage(root)).toThrow('ISSUER_DOCUMENT_STORAGE_INVALID')
+  })
+
+  it('rejects symlinked document roots', async () => {
+    const root = await directory()
+    const target = await directory()
+    const linked = join(root, 'linked')
+    await symlink(target, linked)
+    await expect(new PrivateDocumentStorage(linked).write(input)).rejects.toThrow(
+      'ISSUER_DOCUMENT_STORAGE_INVALID',
+    )
+    expect(await readdir(target)).toEqual([])
+  })
+
+  it('detects tampering, traversal and symlink replacement on read', async () => {
+    const root = await directory()
+    const store = new PrivateDocumentStorage(root)
+    const document = await store.write(input)
+    await expect(store.read({ ...document, storageKey: '../escaped.pdf' })).rejects.toThrow(
+      'ADMIN_DOCUMENT_PATH_INVALID',
+    )
+    await writeFile(join(root, document.storageKey), Buffer.from('%PDF-1.4\ntampered! document\n'))
+    await expect(store.read(document)).rejects.toThrow('ADMIN_DOCUMENT_INTEGRITY_INVALID')
+    await unlink(join(root, document.storageKey))
+    const target = join(root, 'other.pdf')
+    await writeFile(target, pdf)
+    await symlink(target, join(root, document.storageKey))
+    await expect(store.read(document)).rejects.toThrow('ADMIN_DOCUMENT_PATH_INVALID')
+    await expect(store.remove(document.storageKey)).rejects.toThrow(
+      'ISSUER_DOCUMENT_CLEANUP_INVALID',
+    )
+  })
+
+  it('removes only newly owned files and releases persisted documents', async () => {
+    const root = await directory()
+    const store = new PrivateDocumentStorage(root)
+    const first = await store.write(input)
+    const second = await store.write(input)
+    expect(first.storageKey).not.toBe(second.storageKey)
+    await expect(new PrivateDocumentStorage(root).remove(first.storageKey)).rejects.toThrow(
+      'ISSUER_DOCUMENT_CLEANUP_INVALID',
+    )
+    await store.remove(first.storageKey)
+    store.release(second.storageKey)
+    await expect(store.remove(second.storageKey)).rejects.toThrow('ISSUER_DOCUMENT_CLEANUP_INVALID')
+    expect(await readdir(root)).toEqual([second.storageKey])
+  })
+})
diff --git a/apps/web/test/issuerEngine.test.ts b/apps/web/test/issuerEngine.test.ts
new file mode 100644
index 0000000..dcc7831
--- /dev/null
+++ b/apps/web/test/issuerEngine.test.ts
@@ -0,0 +1,241 @@
+import { createHttpsPayloadUri, payloadDigest } from '#xcs/core/index.js'
+import { describe, expect, it } from 'vitest'
+import {
+  assertIssuerPayloadReceipt,
+  assertIssuerWallet,
+  assertIssuanceContextUnchanged,
+  claimPublicPointer,
+  clearIssuerEngineRecord,
+  issuerVisibilityPreview,
+  readIssuerEngineRecord,
+  saveIssuerEngineRecord,
+  type IssuerIssuanceContext,
+} from '../app/utils/issuerEngine'
+
+const context: IssuerIssuanceContext = {
+  invite: {
+    id: 'invite',
+    organizationId: 'organization',
+    profileId: 'testnet',
+    schemaUid: 'a'.repeat(64),
+    claimedBy: 'claimant',
+    expiresAt: '2030-01-01T00:00:00Z',
+    revokedAt: null,
+  },
+  schema: {
+    schemaUid: 'a'.repeat(64),
+    profileId: 'testnet',
+    name: 'Course',
+    publisher: 'issuer',
+    definition: {
+      xcsVersion: '0.1',
+      name: 'Course',
+      description: 'Completion',
+      fields: { name: { type: 'string' } },
+    },
+    resolvedDefinition: {
+      definition: {
+        xcsVersion: '0.1',
+        name: 'Course',
+        description: 'Completion',
+        fields: { name: { type: 'string' } },
+      },
+      fields: { name: { type: 'string' } },
+      lineage: [],
+    },
+  },
+  recipient: {
+    id: 'claimant',
+    displayName: 'Real claimant',
+    wallets: [{ address: 'subject', networkId: 1 }],
+  },
+  organization: { id: 'organization', name: 'Issuer' },
+  issuerWallets: [{ address: 'issuer', networkId: 1 }],
+}
+
+describe('issuer signing context', () => {
+  it('accepts the currently verified Testnet wallets', () => {
+    expect(() => assertIssuerWallet(context.issuerWallets, 'issuer')).not.toThrow()
+    expect(() =>
+      assertIssuanceContextUnchanged(context, structuredClone(context), 'subject', 'issuer'),
+    ).not.toThrow()
+  })
+  it.each([
+    [
+      'recipient changed',
+      (value: IssuerIssuanceContext) => {
+        value.recipient.id = 'someone-else'
+      },
+    ],
+    [
+      'claimant changed',
+      (value: IssuerIssuanceContext) => {
+        value.invite.claimedBy = 'someone-else'
+      },
+    ],
+    [
+      'wallet unlinked',
+      (value: IssuerIssuanceContext) => {
+        value.recipient.wallets = []
+      },
+    ],
+    [
+      'wrong network',
+      (value: IssuerIssuanceContext) => {
+        value.recipient.wallets[0]!.networkId = 0
+      },
+    ],
+    [
+      'organization changed',
+      (value: IssuerIssuanceContext) => {
+        value.invite.organizationId = 'other'
+      },
+    ],
+    [
+      'schema changed',
+      (value: IssuerIssuanceContext) => {
+        value.schema.schemaUid = 'b'.repeat(64)
+      },
+    ],
+    [
+      'revoked invitation',
+      (value: IssuerIssuanceContext) => {
+        value.invite.revokedAt = '2026-09-23'
+      },
+    ],
+  ])('blocks %s after preview', (_name, change) => {
+    const current = structuredClone(context)
+    change(current)
+    expect(() => assertIssuanceContextUnchanged(context, current, 'subject', 'issuer')).toThrow(
+      'ISSUER_CONTEXT_CHANGED',
+    )
+  })
+  it('blocks an unlinked issuer even if the recipient is unchanged', () => {
+    expect(() =>
+      assertIssuanceContextUnchanged(
+        context,
+        { ...context, issuerWallets: [] },
+        'subject',
+        'issuer',
+      ),
+    ).toThrow('ISSUER_VERIFIED_WALLET_REQUIRED')
+  })
+  it('blocks a second issuance when another confirmed transaction already consumed the invitation', () => {
+    expect(() =>
+      assertIssuanceContextUnchanged(
+        context,
+        { ...context, existingCredential: { profileId: 'testnet', generationId: 'b'.repeat(64) } },
+        'subject',
+        'issuer',
+      ),
+    ).toThrow('ISSUER_INVITE_ALREADY_ISSUED')
+  })
+})
+
+describe('issuer payload disclosure', () => {
+  const claims = { learner: 'Camille', course: 'Security', 'a/b~c': 'escaped', __proto__: null }
+  it('starts private with no publicly visible claims', () => {
+    expect(issuerVisibilityPreview(claims, { visibility: 'private', publicFields: [] })).toEqual({
+      public: {},
+      private: claims,
+    })
+  })
+  it('shows only explicitly selected whole fields and handles JSON pointer escapes', () => {
+    expect(claimPublicPointer('a/b~c')).toBe('/a~1b~0c')
+    expect(
+      issuerVisibilityPreview(claims, {
+        visibility: 'private',
+        publicFields: ['/course', '/a~1b~0c'],
+      }),
+    ).toEqual({
+      public: { course: 'Security', 'a/b~c': 'escaped' },
+      private: { learner: 'Camille' },
+    })
+  })
+  it('warnable public mode exposes all fields regardless of selectors', () => {
+    expect(issuerVisibilityPreview(claims, { visibility: 'public', publicFields: [] })).toEqual({
+      public: claims,
+      private: {},
+    })
+  })
+  it('requires exact payload commitment in both receipt and signed URI', () => {
+    const payload = '{"claim":"private"}'
+    const receipt = {
+      payloadId: '12345678-1234-1234-1234-123456789abc',
+      credentialUri: createHttpsPayloadUri('https://x.test/q/123456789012345678', payload),
+      payloadDigest: payloadDigest(payload),
+    }
+    expect(() => assertIssuerPayloadReceipt(receipt, payload)).not.toThrow()
+    expect(() =>
+      assertIssuerPayloadReceipt({ ...receipt, payloadDigest: 'a'.repeat(64) }, payload),
+    ).toThrow('ISSUER_PAYLOAD_DIGEST_MISMATCH')
+    expect(() =>
+      assertIssuerPayloadReceipt(
+        {
+          ...receipt,
+          credentialUri: createHttpsPayloadUri('https://x.test/q/123456789012345678', '{}'),
+        },
+        payload,
+      ),
+    ).toThrow('ISSUER_PAYLOAD_DIGEST_MISMATCH')
+    expect(() =>
+      assertIssuerPayloadReceipt(
+        {
+          ...receipt,
+          credentialUri: createHttpsPayloadUri(
+            'https://x.test/api/issuer/payloads/12345678-1234-1234-1234-123456789abc',
+            payload,
+          ),
+        },
+        payload,
+      ),
+    ).toThrow('ISSUER_PAYLOAD_DIGEST_MISMATCH')
+  })
+})
+
+describe('issuer reconciliation after reload', () => {
+  function storage() {
+    const values = new Map<string, string>()
+    return {
+      values,
+      getItem: (key: string) => values.get(key) ?? null,
+      setItem: (key: string, value: string) => {
+        values.set(key, value)
+      },
+      removeItem: (key: string) => {
+        values.delete(key)
+      },
+    }
+  }
+  it('persists only references and recovers the same signed transaction', () => {
+    const store = storage()
+    const receipt = {
+      transactionHash: 'a'.repeat(64),
+      payloadId: '12345678-1234-1234-1234-123456789abc',
+      visibility: 'private' as const,
+      publicFields: ['/course'],
+      claims: { secret: 'never persist' },
+    }
+    saveIssuerEngineRecord(store, 'account:invite', receipt)
+    expect([...store.values.values()].join('')).not.toContain('never persist')
+    expect(readIssuerEngineRecord(store, 'account:invite')).toEqual({
+      transactionHash: receipt.transactionHash,
+      payloadId: receipt.payloadId,
+      visibility: 'private',
+      publicFields: ['/course'],
+    })
+    expect(readIssuerEngineRecord(store, 'other-account:invite')).toBeNull()
+    clearIssuerEngineRecord(store, 'account:invite')
+    expect(readIssuerEngineRecord(store, 'account:invite')).toBeNull()
+  })
+  it.each([
+    '{',
+    '{"transactionHash":"bad"}',
+    JSON.stringify({ transactionHash: 'a'.repeat(64), visibility: 'unsafe' }),
+    JSON.stringify({ transactionHash: 'a'.repeat(64), publicFields: [3] }),
+  ])('rejects corrupt stored references %s', (value) => {
+    const store = storage()
+    store.setItem('xcs-issuer-engine:test', value)
+    expect(readIssuerEngineRecord(store, 'test')).toBeNull()
+  })
+})
diff --git a/apps/web/test/issuerEngineRecovery.test.ts b/apps/web/test/issuerEngineRecovery.test.ts
new file mode 100644
index 0000000..458e4da
--- /dev/null
+++ b/apps/web/test/issuerEngineRecovery.test.ts
@@ -0,0 +1,156 @@
+import { ref, shallowRef } from 'vue'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useIssuerEngineRecovery } from '../app/composables/useIssuerEngineRecovery'
+import type { WalletSubmissionResult } from '../app/composables/useWallet'
+import type { IssuerSchemaEngineContext } from '../app/utils/issuerEngine'
+import { IndexedDbOperationJournal, type StoredOperation } from '../app/utils/operationJournal'
+
+const references = new Map<string, string>()
+const storage = {
+  getItem: (key: string) => references.get(key) ?? null,
+  setItem: (key: string, value: string) => {
+    references.set(key, value)
+  },
+  removeItem: (key: string) => {
+    references.delete(key)
+  },
+}
+const receipt = {
+  transactionHash: 'a'.repeat(64),
+  payloadId: '12345678-1234-1234-1234-123456789abc',
+  visibility: 'private' as const,
+  publicFields: [],
+}
+const validated = (businessConfirmation: 'confirmed' | 'timeout') =>
+  ({ txHash: receipt.transactionHash, businessConfirmation }) as WalletSubmissionResult
+
+beforeEach(() => {
+  references.clear()
+  vi.stubGlobal('ref', ref)
+  vi.stubGlobal('shallowRef', shallowRef)
+  vi.stubGlobal('onMounted', (fn: () => void) => fn())
+  vi.stubGlobal('localStorage', storage)
+  vi.stubGlobal('indexedDB', {})
+  vi.spyOn(IndexedDbOperationJournal.prototype, 'list').mockResolvedValue([])
+})
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.restoreAllMocks()
+})
+
+function context(record = vi.fn(async () => {})): IssuerSchemaEngineContext {
+  return { key: 'account:invite', profileId: 'testnet', beforeSign: vi.fn(async () => {}), record }
+}
+
+function operation(overrides: Partial<StoredOperation> = {}): StoredOperation {
+  return {
+    operationId: 'operation',
+    account: 'issuer',
+    profileId: 'testnet',
+    networkId: 1,
+    transactionType: 'CredentialCreate',
+    createdAt: '2026-09-24T00:00:00Z',
+    updatedAt: '2026-09-24T00:00:01Z',
+    stage: 'expired',
+    txHash: receipt.transactionHash,
+    lastLedgerSequence: 100,
+    ...overrides,
+  }
+}
+
+describe('issuer metadata recovery', () => {
+  it('keeps signed references when ledger success is not yet indexed', async () => {
+    const current = context()
+    const recovery = useIssuerEngineRecovery(() => current)
+    recovery.stash(receipt)
+    await recovery.finish(validated('timeout'))
+    expect(current.record).not.toHaveBeenCalled()
+    expect(recovery.pending.value).toEqual(receipt)
+    expect(recovery.saved.value).toBe(false)
+  })
+  it('records only after confirmed business evidence and clears completed references', async () => {
+    const current = context()
+    const recovery = useIssuerEngineRecovery(() => current)
+    recovery.stash(receipt)
+    await recovery.finish(validated('confirmed'))
+    expect(current.record).toHaveBeenCalledExactlyOnceWith(receipt)
+    expect(recovery.pending.value).toBeNull()
+    expect(recovery.saved.value).toBe(true)
+    expect(references.size).toBe(0)
+  })
+  it('reconciles the same reference after an interrupted recording request and reload', async () => {
+    const record = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('NETWORK_UNAVAILABLE'))
+      .mockResolvedValueOnce(undefined)
+    const current = context(record)
+    const first = useIssuerEngineRecovery(() => current)
+    first.stash(receipt)
+    await first.finish(validated('confirmed'))
+    expect(first.error.value).toBe('NETWORK_UNAVAILABLE')
+    const reloaded = useIssuerEngineRecovery(() => current)
+    expect(reloaded.pending.value).toEqual(receipt)
+    await reloaded.retry()
+    expect(record).toHaveBeenNthCalledWith(2, receipt)
+    expect(current.beforeSign).not.toHaveBeenCalled()
+    expect(reloaded.saved.value).toBe(true)
+  })
+  it('does not restore another account or invitation recovery reference', () => {
+    const current = context()
+    useIssuerEngineRecovery(() => current).stash(receipt)
+    expect(
+      useIssuerEngineRecovery(() => ({ ...current, key: 'other-account:invite' })).pending.value,
+    ).toBeNull()
+    expect(
+      useIssuerEngineRecovery(() => ({ ...current, key: 'account:other-invite' })).pending.value,
+    ).toBeNull()
+  })
+  it.each([
+    ['expired', operation()],
+    [
+      'validated tec failure',
+      operation({ stage: 'validated', engineResult: 'tecNO_TARGET', ledgerIndex: 99 }),
+    ],
+  ])('permits an explicit new attempt after matching journal %s', async (_name, failed) => {
+    vi.mocked(IndexedDbOperationJournal.prototype.list).mockResolvedValue([failed])
+    const current = context()
+    const recovery = useIssuerEngineRecovery(() => current)
+    recovery.stash(receipt)
+    expect(await recovery.checkFailure()).toBe(true)
+    await recovery.restart()
+    expect(recovery.pending.value).toBeNull()
+    expect(references.size).toBe(0)
+    expect(current.record).not.toHaveBeenCalled()
+  })
+  it.each([
+    ['unknown', []],
+    ['pending', [operation({ stage: 'pending' })]],
+    ['generic failure', [operation({ stage: 'failed', engineResult: 'tefPAST_SEQ' })]],
+    [
+      'ledger success',
+      [operation({ stage: 'validated', engineResult: 'tesSUCCESS', ledgerIndex: 99 })],
+    ],
+    ['unproven failure', [operation({ stage: 'validated', engineResult: 'tecNO_TARGET' })]],
+    ['different transaction', [operation({ txHash: 'b'.repeat(64) })]],
+    ['different network', [operation({ profileId: 'other-testnet' })]],
+  ])('keeps references when evidence is %s', async (_name, operations) => {
+    vi.mocked(IndexedDbOperationJournal.prototype.list).mockResolvedValue(operations)
+    const recovery = useIssuerEngineRecovery(() => context())
+    recovery.stash(receipt)
+    expect(await recovery.checkFailure()).toBe(false)
+    await recovery.restart()
+    expect(recovery.pending.value).toEqual(receipt)
+    expect(references.size).toBe(1)
+  })
+  it('rechecks evidence at the reset action instead of trusting a stale displayed result', async () => {
+    const list = vi
+      .mocked(IndexedDbOperationJournal.prototype.list)
+      .mockResolvedValue([operation()])
+    const recovery = useIssuerEngineRecovery(() => context())
+    recovery.stash(receipt)
+    expect(await recovery.checkFailure()).toBe(true)
+    list.mockResolvedValue([])
+    await recovery.restart()
+    expect(recovery.pending.value).toEqual(receipt)
+  })
+})
diff --git a/apps/web/test/issuerWorkspace.test.ts b/apps/web/test/issuerWorkspace.test.ts
new file mode 100644
index 0000000..e4bf319
--- /dev/null
+++ b/apps/web/test/issuerWorkspace.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { issuerCredentialState, issuerInvitationState } from '../app/utils/issuerWorkspace'
+import type { IssuerCredential, IssuerInvite } from '../server/xcs/issuer/types'
+
+describe('issuer observed lifecycle', () => {
+  const credential = (status: Partial<IssuerCredential['status']>) =>
+    ({
+      status: {
+        accepted: true,
+        expiration: null,
+        deletedLedgerIndex: null,
+        deletionCause: null,
+        ...status,
+      },
+    }) as IssuerCredential
+  it('does not report acceptance when the projection is missing', () => {
+    expect(issuerCredentialState(credential({ accepted: null }))).toBe('unavailable')
+  })
+  it('shows expiry even for an accepted credential', () => {
+    expect(issuerCredentialState(credential({ expiration: 1000 }), 946685800000)).toBe('expired')
+  })
+  it.each([
+    ['issuer_revoked', 'revoked'],
+    ['subject_rejected', 'declined'],
+    [null, 'inactive'],
+  ])('preserves deletion cause %s', (deletionCause, expected) => {
+    expect(
+      issuerCredentialState(credential({ deletedLedgerIndex: 200, deletionCause, expiration: 1 })),
+    ).toBe(expected)
+  })
+  it('requires explicit recipient acceptance', () => {
+    expect(issuerCredentialState(credential({ accepted: false }))).toBe('issued')
+  })
+  it('does not expire a claimed invitation retroactively', () => {
+    const invite = {
+      claimedAt: '2026-01-01T00:00:00Z',
+      expiresAt: '2026-01-02T00:00:00Z',
+      revokedAt: null,
+    } as IssuerInvite
+    expect(issuerInvitationState(invite, Date.parse('2026-01-03'))).toBe('claimed')
+    expect(issuerInvitationState({ ...invite, claimedAt: null }, Date.parse('2026-01-03'))).toBe(
+      'expired',
+    )
+  })
+})
diff --git a/apps/web/test/lib/db/bootstrap.ts b/apps/web/test/lib/db/bootstrap.ts
index 59b8cd1..d12c9df 100644
--- a/apps/web/test/lib/db/bootstrap.ts
+++ b/apps/web/test/lib/db/bootstrap.ts
@@ -1,45 +1 @@
-// Copied from packages/db/src/bootstrap.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (migrations are applied from db/migrations, and provisioning is grants-only so no password travels through this module); source sha256:ef5dc1f95861fc8465a9d68e59e25f5a55eedab91a483b9d34ec89abf7346ca3.
-import { fileURLToPath } from 'node:url'
-
-import { migrate } from 'drizzle-orm/postgres-js/migrator'
-
-import type { DatabaseClient } from '../../../server/lib/db/client.js'
-import {
-  provisionRuntimeDatabasePrivileges,
-  type RuntimeDatabaseProvisioning,
-  type RuntimeDatabaseProvisioningReport,
-} from './provision.js'
-
-const BASELINE_FOLDER = fileURLToPath(new URL('../../../../../db/migrations', import.meta.url))
-
-export {
-  DatabaseBootstrapConfigurationError,
-  MissingRuntimeDatabaseRolesError,
-  parseDatabaseClusterScope,
-  provisionRuntimeDatabasePrivileges,
-  UnsafeRuntimeDatabaseRolesError,
-  XCS_API_DATABASE_CONNECTION_LIMIT,
-  XCS_API_DATABASE_ROLE,
-  XCS_DATABASE_CLUSTER_SCOPE,
-  XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
-  XCS_INDEXER_DATABASE_ROLE,
-  XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
-  XCS_MONITOR_DATABASE_ROLE,
-  XCS_RUNTIME_DATABASE_ROLES,
-  type RuntimeDatabaseProvisioning,
-  type RuntimeDatabaseProvisioningReport,
-  type UnappliedRuntimeRoleResourceControl,
-} from './provision.js'
-
-export async function initializeDatabase(client: DatabaseClient): Promise<void> {
-  await migrate(client.db, { migrationsFolder: BASELINE_FOLDER })
-}
-
-export async function bootstrapDatabase(
-  client: DatabaseClient,
-  provisioning: RuntimeDatabaseProvisioning,
-): Promise<RuntimeDatabaseProvisioningReport> {
-  await initializeDatabase(client)
-  return await provisionRuntimeDatabasePrivileges(client, provisioning)
-}
+export * from '../../../server/lib/db/bootstrap.js'
diff --git a/apps/web/test/lib/db/managedRuntimeUsers.ts b/apps/web/test/lib/db/managedRuntimeUsers.ts
new file mode 100644
index 0000000..4f58939
--- /dev/null
+++ b/apps/web/test/lib/db/managedRuntimeUsers.ts
@@ -0,0 +1,70 @@
+import type { DatabaseClient } from '../../../server/lib/db/client.js'
+
+const PASSWORD_PATTERN = /^[A-Za-z0-9_-]{32,256}$/u
+
+export interface ManagedRuntimeDatabasePasswords {
+  indexerPassword: string
+  apiPassword: string
+  payloadWriterPassword: string
+  monitorPassword: string
+  applicationPassword: string
+  adminApplicationPassword: string
+  notifierPassword: string
+  issuerPassword: string
+}
+
+export const MANAGED_RUNTIME_DATABASE_PASSWORDS: ManagedRuntimeDatabasePasswords = {
+  indexerPassword: 'integration-only-indexer-password-0001',
+  apiPassword: 'integration-only-api-password-00000001',
+  payloadWriterPassword: 'integration-only-payload-password-001',
+  monitorPassword: 'integration-only-monitor-password-0001',
+  applicationPassword: 'integration-only-application-password-1',
+  adminApplicationPassword: 'integration-only-admin-password-00001',
+  notifierPassword: 'integration-only-notifier-password-001',
+  issuerPassword: 'integration-only-issuer-password-00001',
+}
+
+const ROLE_PASSWORD_PROPERTIES = [
+  ['xcs_indexer', 'indexerPassword'],
+  ['xcs_api', 'apiPassword'],
+  ['xcs_payload_writer', 'payloadWriterPassword'],
+  ['xcs_monitor', 'monitorPassword'],
+  ['xcs_app', 'applicationPassword'],
+  ['xcs_admin_app', 'adminApplicationPassword'],
+  ['xcs_notifier', 'notifierPassword'],
+  ['xcs_issuer', 'issuerPassword'],
+] as const
+
+/**
+ * Test-only stand-in for DigitalOcean. Production bootstrap must never call this:
+ * the managed database service creates the users and owns their passwords.
+ */
+export async function createManagedRuntimeDatabaseUsers(
+  administrator: DatabaseClient,
+  overrides: Partial<ManagedRuntimeDatabasePasswords> = {},
+): Promise<ManagedRuntimeDatabasePasswords> {
+  const passwords = { ...MANAGED_RUNTIME_DATABASE_PASSWORDS, ...overrides }
+  for (const [, property] of ROLE_PASSWORD_PROPERTIES) {
+    if (!PASSWORD_PATTERN.test(passwords[property])) {
+      throw new Error(`Invalid test password for ${property}`)
+    }
+  }
+
+  // Role names are fixed constants and passwords are constrained above to URL-safe
+  // characters. PostgreSQL utility statements do not accept password parameters.
+  await administrator.sql.unsafe(
+    ROLE_PASSWORD_PROPERTIES.map(
+      ([role, property]) => `
+        DO $xcs_test_user$
+        BEGIN
+          IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+            CREATE ROLE ${role} LOGIN;
+          END IF;
+        END
+        $xcs_test_user$;
+        ALTER ROLE ${role} WITH LOGIN PASSWORD '${passwords[property]}';
+      `,
+    ).join('\n'),
+  )
+  return passwords
+}
diff --git a/apps/web/test/lib/db/provision.ts b/apps/web/test/lib/db/provision.ts
index 1717fa6..b9ab269 100644
--- a/apps/web/test/lib/db/provision.ts
+++ b/apps/web/test/lib/db/provision.ts
@@ -1,426 +1 @@
-// Copied from packages/db/src/provision.ts at 61fb809; keep in sync by hand (see CONTRIBUTING.md).
-// Diverges by design (provisioning is grants-only: the managed PostgreSQL service owns the runtime users and their passwords, so this copy neither creates roles nor sets passwords); source sha256:ad624bb5a8d9403dda699767be589440680ac21bb4e2a3d7cfd648fb592b0fb5.
-import type { DatabaseClient } from '../../../server/lib/db/client.js'
-
-export const XCS_INDEXER_DATABASE_ROLE = 'xcs_indexer' as const
-export const XCS_API_DATABASE_ROLE = 'xcs_api' as const
-export const XCS_MONITOR_DATABASE_ROLE = 'xcs_monitor' as const
-export const XCS_DATABASE_CLUSTER_SCOPE = 'dedicated' as const
-
-export const XCS_RUNTIME_DATABASE_ROLES = [
-  XCS_INDEXER_DATABASE_ROLE,
-  XCS_API_DATABASE_ROLE,
-  XCS_MONITOR_DATABASE_ROLE,
-] as const
-
-export const XCS_INDEXER_DATABASE_CONNECTION_LIMIT = 12
-export const XCS_API_DATABASE_CONNECTION_LIMIT = 12
-export const XCS_MONITOR_DATABASE_CONNECTION_LIMIT = 3
-
-const PROVISION_LOCK_CLASS_ID = 1_480_807_217
-const PROVISION_LOCK_OBJECT_ID = 1
-
-export interface RuntimeDatabaseProvisioning {
-  clusterScope: typeof XCS_DATABASE_CLUSTER_SCOPE
-}
-
-export function parseDatabaseClusterScope(
-  value: string | undefined,
-): typeof XCS_DATABASE_CLUSTER_SCOPE {
-  if (value !== XCS_DATABASE_CLUSTER_SCOPE) {
-    throw new DatabaseBootstrapConfigurationError(
-      `XCS_DATABASE_CLUSTER_SCOPE must be ${XCS_DATABASE_CLUSTER_SCOPE}; runtime roles are cluster-wide`,
-    )
-  }
-  return XCS_DATABASE_CLUSTER_SCOPE
-}
-
-/** An operator configuration mistake: a missing or invalid environment value.
- * It is built from names and fixed text only, never from a connection string,
- * so the CLI can print its message without leaking a credential. */
-export class DatabaseBootstrapConfigurationError extends Error {
-  readonly code = 'DATABASE_BOOTSTRAP_CONFIGURATION' as const
-
-  constructor(message: string) {
-    super(message)
-    this.name = 'DatabaseBootstrapConfigurationError'
-  }
-}
-
-/** The managed database service creates the users and holds their passwords; this
- * step only assigns privileges, so a role it cannot find is an operator error.
- * It names the missing roles and carries no credential, so the CLI can print it. */
-export class MissingRuntimeDatabaseRolesError extends Error {
-  readonly code = 'DATABASE_ROLES_MISSING' as const
-  readonly roles: readonly string[]
-
-  constructor(missing: readonly string[]) {
-    const names = missing.join(', ')
-    super(
-      `Database ${missing.length === 1 ? 'role' : 'roles'} ${names} ` +
-        `${missing.length === 1 ? 'does' : 'do'} not exist. Database users are owned by the ` +
-        'managed database service, not by this step: create ' +
-        `${names} in the DigitalOcean control panel (Databases -> the cluster -> Users) or with ` +
-        '`doctl databases user create`, then run the grants step again. This step never creates ' +
-        'a role and never sets, resets or reads a role password.',
-    )
-    this.name = 'MissingRuntimeDatabaseRolesError'
-    this.roles = missing
-  }
-}
-
-/** A runtime role the managed database service has configured in a way this
- * deployment must not run against: it cannot log in, or it holds an attribute
- * that would defeat least privilege. Provisioning does not own role attributes
- * -- altering them requires a superuser, which a managed cluster's
- * administrator is not -- so it verifies them and refuses to continue.
- * It names roles and findings only, never a credential, so the CLI can print it. */
-export class UnsafeRuntimeDatabaseRolesError extends Error {
-  readonly code = 'DATABASE_ROLES_UNSAFE' as const
-  readonly roles: readonly string[]
-  readonly findings: readonly string[]
-
-  constructor(findings: readonly string[], roles: readonly string[]) {
-    super(
-      `Database ${roles.length === 1 ? 'role' : 'roles'} ${roles.join(', ')} ` +
-        `${roles.length === 1 ? 'is' : 'are'} not configured safely for least-privilege ` +
-        `runtime access: ${findings.join('; ')}. Role attributes and role memberships belong to ` +
-        'the managed database service, not to this step: a managed cluster administrator is not a ' +
-        'superuser and cannot change them. Fix them in the DigitalOcean control panel ' +
-        '(Databases -> the cluster -> Users) or with `doctl databases user` and run the grants ' +
-        'step again. This step never creates a role and never sets, resets or reads a role password.',
-    )
-    this.name = 'UnsafeRuntimeDatabaseRolesError'
-    this.roles = roles
-    this.findings = findings
-  }
-}
-
-/** Per-role resource and safety controls. These are not security attributes:
- * a non-superuser administrator holding CREATEROLE and ADMIN OPTION on the
- * role may set them (verified against PostgreSQL 16 and 17), so provisioning
- * still applies them -- one statement each, outside the grants, so a cluster
- * that refuses one cannot cost the deployment its privileges. */
-interface RuntimeRoleResourceControls {
-  readonly connectionLimit: number
-  readonly settings: Readonly<Record<string, string>>
-}
-
-const XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS: Readonly<
-  Record<(typeof XCS_RUNTIME_DATABASE_ROLES)[number], RuntimeRoleResourceControls>
-> = {
-  xcs_indexer: {
-    connectionLimit: XCS_INDEXER_DATABASE_CONNECTION_LIMIT,
-    settings: {
-      statement_timeout: '5min',
-      lock_timeout: '30s',
-      idle_in_transaction_session_timeout: '30s',
-    },
-  },
-  xcs_api: {
-    connectionLimit: XCS_API_DATABASE_CONNECTION_LIMIT,
-    settings: {
-      statement_timeout: '30s',
-      lock_timeout: '15s',
-      idle_in_transaction_session_timeout: '30s',
-    },
-  },
-  xcs_monitor: {
-    connectionLimit: XCS_MONITOR_DATABASE_CONNECTION_LIMIT,
-    settings: {
-      statement_timeout: '30s',
-      lock_timeout: '10s',
-      idle_in_transaction_session_timeout: '30s',
-    },
-  },
-}
-
-/** A resource control the cluster refused and that is not already in effect.
- * Reported rather than thrown: the privilege grants are the point of this step
- * and must not be lost to a missing timeout, but a deployment must never
- * quietly lose one either. */
-export interface UnappliedRuntimeRoleResourceControl {
-  readonly role: string
-  readonly control: string
-  readonly intended: string
-  readonly actual: string
-}
-
-export interface RuntimeDatabaseProvisioningReport {
-  /** The cluster administrator this run authenticated as, read from the live
-   * session. Its membership in the runtime roles is how a managed service
-   * administers its own users and is accepted, not revoked. */
-  readonly administrator: string
-  readonly unappliedResourceControls: readonly UnappliedRuntimeRoleResourceControl[]
-}
-
-interface RuntimeRoleAttributes {
-  roleName: string
-  canLogin: boolean
-  isSuperuser: boolean
-  canCreateDatabase: boolean
-  canCreateRole: boolean
-  canReplicate: boolean
-  canBypassRls: boolean
-  connectionLimit: number
-  configuration: string[] | null
-}
-
-const UNSAFE_ROLE_ATTRIBUTES = [
-  ['isSuperuser', 'is a superuser'],
-  ['canCreateDatabase', 'can create databases'],
-  ['canCreateRole', 'can create roles'],
-  ['canReplicate', 'can replicate'],
-  ['canBypassRls', 'can bypass row-level security'],
-] as const
-
-function unsafeRoleAttributeFindings(roles: readonly RuntimeRoleAttributes[]): string[] {
-  const findings: string[] = []
-  for (const role of roles) {
-    const reasons: string[] = []
-    if (!role.canLogin) reasons.push('cannot log in')
-    for (const [attribute, reason] of UNSAFE_ROLE_ATTRIBUTES) {
-      if (role[attribute]) reasons.push(reason)
-    }
-    if (reasons.length > 0) findings.push(`${role.roleName} ${reasons.join(' and ')}`)
-  }
-  return findings
-}
-
-interface RuntimeRoleMembership {
-  grantedRole: string
-  memberRole: string
-}
-
-function unsafeRoleMembershipFindings(
-  memberships: readonly RuntimeRoleMembership[],
-  administrator: string,
-): string[] {
-  const runtimeRoles = new Set<string>(XCS_RUNTIME_DATABASE_ROLES)
-  const findings: string[] = []
-  for (const { grantedRole, memberRole } of memberships) {
-    // The one membership this deployment grants itself.
-    if (grantedRole === 'pg_monitor' && memberRole === XCS_MONITOR_DATABASE_ROLE) continue
-    // The cluster administrator is a member of every user the managed service
-    // creates for it, granted by the platform's own superuser. That is how the
-    // service administers those users; it is not ours to remove.
-    if (memberRole === administrator && runtimeRoles.has(grantedRole)) continue
-    if (runtimeRoles.has(memberRole)) {
-      findings.push(`${memberRole} is a member of ${grantedRole}`)
-    } else {
-      findings.push(
-        `${memberRole} is a member of ${grantedRole} but is not the cluster administrator`,
-      )
-    }
-  }
-  return findings
-}
-
-function unsafeRoleNames(findings: readonly string[]): string[] {
-  const named = XCS_RUNTIME_DATABASE_ROLES.filter((role) =>
-    findings.some((finding) => finding.includes(role)),
-  )
-  return named.length > 0 ? [...named] : [...XCS_RUNTIME_DATABASE_ROLES]
-}
-
-const REVOKE_CURRENT_DATABASE_ACCESS_SQL = `
-  REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor;
-  REVOKE CREATE ON SCHEMA public FROM PUBLIC;
-  DO $xcs_database_grants$
-  BEGIN
-    EXECUTE format('REVOKE ALL PRIVILEGES ON DATABASE %I FROM PUBLIC, xcs_indexer, xcs_api, xcs_monitor', current_database());
-    EXECUTE format('GRANT CONNECT ON DATABASE %I TO xcs_indexer, xcs_api, xcs_monitor', current_database());
-  END
-  $xcs_database_grants$;
-`
-
-const GRANT_RUNTIME_ACCESS_SQL = `
-  GRANT USAGE ON SCHEMA public TO xcs_indexer, xcs_api;
-
-  GRANT SELECT, INSERT ON TABLE
-    network_profiles, ledger_checkpoints, schema_events, schemas, credential_events
-  TO xcs_indexer;
-  GRANT SELECT, INSERT ON TABLE indexer_status, credential_generations TO xcs_indexer;
-  GRANT UPDATE (
-    state, primary_source_tip, secondary_source_tip, last_agreed_ledger_index,
-    last_agreed_ledger_hash, error_code, writer_id, writer_epoch, lease_expires_at, updated_at
-  ) ON TABLE indexer_status TO xcs_indexer;
-  GRANT UPDATE (
-    accepted, last_ledger_index, deleted_ledger_index, deletion_cause, updated_at
-  ) ON TABLE credential_generations TO xcs_indexer;
-  GRANT SELECT, INSERT ON TABLE indexer_incidents TO xcs_indexer;
-
-  GRANT SELECT ON TABLE
-    network_profiles, ledger_checkpoints, indexer_status, indexer_incidents,
-    schema_events, schemas, credential_generations, credential_events
-  TO xcs_api;
-  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE pin_challenges, demo_pins TO xcs_api;
-`
-
-const RUNTIME_ROLE_ATTRIBUTES_SQL = `
-  SELECT
-    rolname AS "roleName",
-    rolcanlogin AS "canLogin",
-    rolsuper AS "isSuperuser",
-    rolcreatedb AS "canCreateDatabase",
-    rolcreaterole AS "canCreateRole",
-    rolreplication AS "canReplicate",
-    rolbypassrls AS "canBypassRls",
-    rolconnlimit AS "connectionLimit",
-    rolconfig AS "configuration"
-  FROM pg_roles
-  WHERE rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
-  ORDER BY rolname
-`
-
-const RUNTIME_ROLE_MEMBERSHIPS_SQL = `
-  SELECT granted_role.rolname AS "grantedRole", member_role.rolname AS "memberRole"
-  FROM pg_auth_members auth_membership
-  JOIN pg_roles granted_role ON granted_role.oid = auth_membership.roleid
-  JOIN pg_roles member_role ON member_role.oid = auth_membership.member
-  WHERE granted_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
-     OR member_role.rolname IN ('xcs_indexer', 'xcs_api', 'xcs_monitor')
-  ORDER BY granted_role.rolname, member_role.rolname
-`
-
-function settingOf(configuration: readonly string[] | null, name: string): string | undefined {
-  const prefix = `${name}=`
-  const entry = configuration?.find((candidate) => candidate.startsWith(prefix))
-  return entry === undefined ? undefined : entry.slice(prefix.length)
-}
-
-export async function provisionRuntimeDatabasePrivileges(
-  client: DatabaseClient,
-  provisioning: RuntimeDatabaseProvisioning,
-): Promise<RuntimeDatabaseProvisioningReport> {
-  parseDatabaseClusterScope(provisioning.clusterScope)
-
-  return await client.sql.begin(async (sql) => {
-    await sql`SELECT pg_advisory_xact_lock(${PROVISION_LOCK_CLASS_ID}, ${PROVISION_LOCK_OBJECT_ID})`
-
-    // The administrator is read from the live session, not hard-coded: it is
-    // `doadmin` on DigitalOcean, something else on another provider and on a
-    // developer's own PostgreSQL.
-    const [session] = await sql<{ administrator: string }[]>`
-      SELECT current_user AS "administrator"
-    `
-    const administrator = session?.administrator
-    if (administrator === undefined) {
-      throw new DatabaseBootstrapConfigurationError(
-        'The database session reported no current user, so the cluster administrator could not ' +
-          'be identified. Provisioning verifies role memberships against it and cannot continue.',
-      )
-    }
-
-    const present = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
-    const found = new Set(present.map((row) => row.roleName))
-    const missing = XCS_RUNTIME_DATABASE_ROLES.filter((role) => !found.has(role))
-    if (missing.length > 0) {
-      throw new MissingRuntimeDatabaseRolesError(missing)
-    }
-
-    const memberships = await sql.unsafe<RuntimeRoleMembership[]>(RUNTIME_ROLE_MEMBERSHIPS_SQL)
-    const findings = [
-      ...unsafeRoleAttributeFindings(present),
-      ...unsafeRoleMembershipFindings(memberships, administrator),
-    ]
-    if (findings.length > 0) {
-      throw new UnsafeRuntimeDatabaseRolesError(findings, unsafeRoleNames(findings))
-    }
-
-    await sql.unsafe(REVOKE_CURRENT_DATABASE_ACCESS_SQL)
-    await sql.unsafe(GRANT_RUNTIME_ACCESS_SQL)
-
-    // pg_monitor is a predefined role the cluster owns. Passing it on requires
-    // the administrator to hold it WITH ADMIN OPTION, which a managed provider
-    // need not grant, so this is attempted rather than assumed: DigitalOcean
-    // refuses it at `check_role_membership_authorization`. A refusal costs the
-    // monitor role its server statistics, not the deployment, and it is named
-    // in the report rather than passing unnoticed.
-    const monitorGrants: { role: string; control: string; intended: string }[] = []
-    try {
-      await sql.savepoint(async (scoped) => {
-        await scoped.unsafe('GRANT pg_monitor TO xcs_monitor WITH INHERIT TRUE, SET FALSE')
-      })
-    } catch {
-      monitorGrants.push({
-        role: XCS_MONITOR_DATABASE_ROLE,
-        control: 'pg_monitor membership',
-        intended: 'granted',
-      })
-    }
-
-    // Resource controls last, one statement each inside its own savepoint, so
-    // a cluster that refuses one keeps the grants above.
-    const refused: { role: string; control: string; intended: string }[] = []
-    for (const role of XCS_RUNTIME_DATABASE_ROLES) {
-      const controls = XCS_RUNTIME_DATABASE_ROLE_RESOURCE_CONTROLS[role]
-      const statements: { control: string; intended: string; statement: string }[] = [
-        {
-          control: 'CONNECTION LIMIT',
-          intended: String(controls.connectionLimit),
-          statement: `ALTER ROLE ${role} WITH CONNECTION LIMIT ${controls.connectionLimit}`,
-        },
-        ...Object.entries(controls.settings).map(([name, value]) => ({
-          control: name,
-          intended: value,
-          statement: `ALTER ROLE ${role} SET ${name} = '${value}'`,
-        })),
-      ]
-      for (const { control, intended, statement } of statements) {
-        try {
-          await sql.savepoint(async (scoped) => {
-            await scoped.unsafe(statement)
-          })
-        } catch {
-          refused.push({ role, control, intended })
-        }
-      }
-    }
-
-    // A refusal is only a loss if the intended value is not already in effect.
-    let unappliedResourceControls: UnappliedRuntimeRoleResourceControl[] = []
-    if (refused.length > 0) {
-      const effective = await sql.unsafe<RuntimeRoleAttributes[]>(RUNTIME_ROLE_ATTRIBUTES_SQL)
-      const byRole = new Map(effective.map((row) => [row.roleName, row]))
-      unappliedResourceControls = refused.flatMap(({ role, control, intended }) => {
-        const row = byRole.get(role)
-        const actual =
-          control === 'CONNECTION LIMIT'
-            ? row === undefined
-              ? undefined
-              : String(row.connectionLimit)
-            : settingOf(row?.configuration ?? null, control)
-        return actual === intended ? [] : [{ role, control, intended, actual: actual ?? 'unset' }]
-      })
-    }
-
-    // A refused pg_monitor grant is only a loss when the membership is absent.
-    const unappliedMonitorGrants: UnappliedRuntimeRoleResourceControl[] = []
-    if (monitorGrants.length > 0) {
-      const [held] = await sql<Array<{ present: boolean }>>`
-        SELECT EXISTS (
-          SELECT 1
-          FROM pg_auth_members membership
-          JOIN pg_roles granted_role ON granted_role.oid = membership.roleid
-          JOIN pg_roles member_role ON member_role.oid = membership.member
-          WHERE granted_role.rolname = 'pg_monitor'
-            AND member_role.rolname = ${XCS_MONITOR_DATABASE_ROLE}
-        ) AS present
-      `
-      if (held?.present !== true) {
-        unappliedMonitorGrants.push(
-          ...monitorGrants.map((entry) => ({ ...entry, actual: 'absent' })),
-        )
-      }
-    }
-
-    return {
-      administrator,
-      unappliedResourceControls: [...unappliedResourceControls, ...unappliedMonitorGrants],
-    }
-  })
-}
+export * from '../../../server/lib/db/provision.js'
diff --git a/apps/web/test/lib/xcs/core/credential.test.ts b/apps/web/test/lib/xcs/core/credential.test.ts
index 42a71c3..5dc5671 100644
--- a/apps/web/test/lib/xcs/core/credential.test.ts
+++ b/apps/web/test/lib/xcs/core/credential.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/credential.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/credential.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -30,7 +30,7 @@ describe('credential payload', () => {
     expect(parseCredentialPayload(encoded.bytes, context)).toEqual(encoded.payload)
     expect(encoded.json).toBe(new TextDecoder().decode(encoded.bytes))
     expect(() => parseCredentialPayload(`${encoded.json}\n`, context)).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'PAYLOAD_INVALID' }),
     )
   })
 
@@ -60,4 +60,28 @@ describe('credential payload', () => {
       verifyCredentialPayload({ status: 'retrieved', content: encoded.bytes }, uri, context),
     ).toBe('valid')
   })
+
+  it.each([{ courseId: '\ud800', passed: true }, { '\ud800': 'xcs-101' }])(
+    'reports malformed Unicode in payload values or keys as invalid',
+    (claims) => {
+      const content = JSON.stringify({
+        claims,
+        issuer: context.issuer,
+        schema: context.schemaUid,
+        subject: context.subject,
+        xcsVersion: '0.1',
+      })
+      const uri = createIpfsPayloadUri(content)
+
+      expect(verifyCredentialPayload({ status: 'retrieved', content }, uri, context)).toBe(
+        'invalid',
+      )
+    },
+  )
+
+  it('preserves valid Unicode including surrogate pairs', () => {
+    const encoded = encodeCredentialPayload({ courseId: 'Cours réussi 🎓', passed: true }, context)
+
+    expect(parseCredentialPayload(encoded.bytes, context).claims.courseId).toBe('Cours réussi 🎓')
+  })
 })
diff --git a/apps/web/test/lib/xcs/core/network-lifecycle.test.ts b/apps/web/test/lib/xcs/core/network-lifecycle.test.ts
index 335ca11..cfc6c22 100644
--- a/apps/web/test/lib/xcs/core/network-lifecycle.test.ts
+++ b/apps/web/test/lib/xcs/core/network-lifecycle.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/network-lifecycle.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/network-lifecycle.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -27,7 +27,7 @@ describe('network and native lifecycle', () => {
   it('wraps xrpl.js Ripple-time conversion with strict protocol bounds', () => {
     expect(rippleTimeToIso(0)).toBe('2000-01-01T00:00:00.000Z')
     expect(() => rippleTimeToIso(-1)).toThrow(
-      expect.objectContaining({ code: 'INVALID_RIPPLE_TIME' }),
+      expect.objectContaining({ code: 'RIPPLE_TIME_INVALID' }),
     )
   })
 
diff --git a/apps/web/test/lib/xcs/core/schema.test.ts b/apps/web/test/lib/xcs/core/schema.test.ts
index 8780d0f..a45c9ae 100644
--- a/apps/web/test/lib/xcs/core/schema.test.ts
+++ b/apps/web/test/lib/xcs/core/schema.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/core/test/schema.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/core/test/schema.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { describe, expect, it } from 'vitest'
 
 import {
@@ -45,7 +45,7 @@ describe('schema', () => {
     )
     expect(parseSchemaBytes(canonical).name).toBe('Schema')
     expect(() => parseSchemaBytes(new TextEncoder().encode('{ "xcsVersion": "0.1" }'))).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'JSON_INVALID' }),
     )
     expect(() =>
       parseSchemaBytes(
@@ -53,7 +53,7 @@ describe('schema', () => {
           '{"description":"First","description":"Second","fields":{"value":{"type":"string"}},"name":"Schema","xcsVersion":"0.1"}',
         ),
       ),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_JSON' }))
+    ).toThrow(expect.objectContaining({ code: 'JSON_DUPLICATE_KEY' }))
   })
 
   it('resolves prior parents and rejects field overrides', () => {
@@ -89,7 +89,7 @@ describe('schema', () => {
     expect(Object.keys(resolveSchema(child, context).fields)).toEqual(['courseId', 'score'])
     expect(() =>
       resolveSchema(parseSchema({ ...child, fields: { courseId: { type: 'bool' } } }), context),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_SCHEMA_REFERENCE' }))
+    ).toThrow(expect.objectContaining({ code: 'SCHEMA_OVERRIDE_FORBIDDEN' }))
   })
 
   it('derives the published schema UID with noble SHA-256', () => {
diff --git a/apps/web/test/lib/xcs/sdk/builders.test.ts b/apps/web/test/lib/xcs/sdk/builders.test.ts
index d3233bc..5503a42 100644
--- a/apps/web/test/lib/xcs/sdk/builders.test.ts
+++ b/apps/web/test/lib/xcs/sdk/builders.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/test/builders.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/test/builders.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { computeSchemaUid, createHttpsPayloadUri, encodeSchema } from '#xcs/core/index.js'
 import { decode, encode, type Payment } from 'xrpl'
 import { describe, expect, it } from 'vitest'
diff --git a/apps/web/test/lib/xcs/sdk/network.test.ts b/apps/web/test/lib/xcs/sdk/network.test.ts
index f151afd..7e48e90 100644
--- a/apps/web/test/lib/xcs/sdk/network.test.ts
+++ b/apps/web/test/lib/xcs/sdk/network.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/test/network.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/test/network.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import type { Client } from 'xrpl'
 import { describe, expect, it, vi } from 'vitest'
 
diff --git a/apps/web/test/lib/xcs/sdk/submission.test.ts b/apps/web/test/lib/xcs/sdk/submission.test.ts
index 4a6901d..9abdaf2 100644
--- a/apps/web/test/lib/xcs/sdk/submission.test.ts
+++ b/apps/web/test/lib/xcs/sdk/submission.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/test/submission.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/test/submission.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { decode, encode, hashes, Wallet, type Client, type SubmittableTransaction } from 'xrpl'
 import { describe, expect, it, vi } from 'vitest'
 
@@ -200,6 +200,69 @@ describe('reliable submission', () => {
     expect(submit).not.toHaveBeenCalled()
   })
 
+  it('rejects a signature returned after expiry before persisting it or entering the relay path', async () => {
+    const blob = signedBlob()
+    const transaction = decode(blob) as unknown as SubmittableTransaction
+    const journal = new MemoryOperationJournal()
+    const submit = vi.fn()
+    const onValidatedSignature = vi.fn()
+    const beforeSubmit = vi.fn()
+    const request = vi.fn(async () => ({ result: { ledger_current_index: 51 } }))
+    await expect(
+      signPreparedAndSubmit(
+        mockClient({ submit, request }),
+        transaction,
+        { sign: async () => ({ txBlob: blob, hash: hashes.hashSignedTx(blob) }) },
+        { journal, onValidatedSignature, beforeSubmit },
+      ),
+    ).rejects.toMatchObject({ code: 'XCS_SDK_TRANSACTION_EXPIRED' })
+    expect(onValidatedSignature).not.toHaveBeenCalled()
+    expect(beforeSubmit).not.toHaveBeenCalled()
+    expect(submit).not.toHaveBeenCalled()
+    expect(journal.entries.map((entry) => entry.stage)).toEqual(['prepared', 'failed'])
+    expect(journal.entries.every((entry) => entry.txHash === undefined)).toBe(true)
+  })
+
+  it('rechecks expiry after the final asynchronous host guard without relaying the blob', async () => {
+    const blob = signedBlob()
+    const journal = new MemoryOperationJournal()
+    let currentLedger = 49
+    const submit = vi.fn()
+    const onValidatedSignature = vi.fn()
+    await expect(
+      signPreparedAndSubmit(
+        mockClient({
+          submit,
+          request: vi.fn(async () => ({ result: { ledger_current_index: currentLedger } })),
+        }),
+        decode(blob) as unknown as SubmittableTransaction,
+        { sign: async () => ({ txBlob: blob, hash: hashes.hashSignedTx(blob) }) },
+        {
+          journal,
+          onValidatedSignature,
+          beforeSubmit: async () => {
+            currentLedger = 51
+          },
+        },
+      ),
+    ).rejects.toMatchObject({ code: 'XCS_SDK_TRANSACTION_EXPIRED' })
+    expect(onValidatedSignature).toHaveBeenCalledOnce()
+    expect(submit).not.toHaveBeenCalled()
+    // Once recovery material has escaped to a host hook, do not infer global absence.
+    expect(journal.entries.at(-1)?.stage).toBe('signed')
+  })
+
+  it('keeps a previously relayed cached transaction pending after its ledger window', async () => {
+    const request = vi.fn(async ({ command }: { command: string }) => ({
+      result: command === 'tx' ? { validated: false } : { ledger_current_index: 100 },
+    }))
+    await expect(
+      getTransactionStatus(mockClient({ request }), 'AB'.repeat(32), 50),
+    ).resolves.toMatchObject({ status: 'pending' })
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(request).toHaveBeenCalledWith(expect.objectContaining({ command: 'tx' }))
+  })
+
   it('runs the validated-signature hook after exact comparison and before submit', async () => {
     const calls: string[] = []
     const blob = signedBlob()
@@ -313,18 +376,47 @@ describe('reliable submission', () => {
     expect(request).not.toHaveBeenCalled()
   })
 
-  it('reports expiration only after the last ledger sequence passes', async () => {
-    const notFound = Object.assign(new Error('txnNotFound'), { data: { error: 'txnNotFound' } })
+  it('does not infer final failure from an open ledger or incomplete history', async () => {
+    const notFound = Object.assign(new Error('txnNotFound'), {
+      data: { error: 'txnNotFound', searched_all: false },
+    })
     const client = mockClient({
-      request: vi
-        .fn()
-        .mockRejectedValueOnce(notFound)
-        .mockResolvedValueOnce({ result: { ledger_current_index: 51 } }),
+      request: vi.fn(async (request: { command: string }) => {
+        if (request.command === 'tx') throw notFound
+        return { result: { ledger_current_index: 51 } }
+      }),
     })
 
     await expect(getTransactionStatus(client, 'AB'.repeat(32), 50)).resolves.toMatchObject({
-      status: 'expired',
+      status: 'not_found',
+    })
+  })
+
+  it('keeps polling after txnNotFound so a later validated result is not lost', async () => {
+    const journal = new MemoryOperationJournal()
+    let lookups = 0
+    const client = mockClient({
+      request: vi.fn(async ({ command }: { command: string }) => {
+        if (command !== 'tx') return { result: { ledger_current_index: 51 } }
+        if (lookups++ === 0) {
+          throw Object.assign(new Error('txnNotFound'), { data: { error: 'txnNotFound' } })
+        }
+        return {
+          result: {
+            validated: true,
+            ledger_index: 50,
+            meta: { TransactionResult: 'tesSUCCESS' },
+          },
+        }
+      }),
+    })
+    const result = await submitSignedTransaction(client, signedBlob(), {
+      journal,
+      pollIntervalMs: 1,
+      timeoutMs: 100,
     })
+    expect(result).toMatchObject({ status: 'validated', ledgerIndex: 50 })
+    expect(journal.entries.map((entry) => entry.stage)).not.toContain('expired')
   })
 
   it('rejects an expired prepared transaction before any submit side effect', async () => {
diff --git a/apps/web/test/lib/xcs/sdk/transaction-validation.test.ts b/apps/web/test/lib/xcs/sdk/transaction-validation.test.ts
index b8a6817..6c208ce 100644
--- a/apps/web/test/lib/xcs/sdk/transaction-validation.test.ts
+++ b/apps/web/test/lib/xcs/sdk/transaction-validation.test.ts
@@ -1,4 +1,4 @@
-// Copied from packages/sdk/test/transaction-validation.test.ts at 54c3486; keep in sync by hand (see CONTRIBUTING.md).
+// Copied from packages/sdk/test/transaction-validation.test.ts at a9777cc; keep in sync by hand (see CONTRIBUTING.md).
 import { createHttpsPayloadUri, encodeSchema } from '#xcs/core/index.js'
 import type { CredentialAccept, CredentialCreate, CredentialDelete, Payment } from 'xrpl'
 import { describe, expect, it } from 'vitest'
diff --git a/apps/web/test/payloadPublication.test.ts b/apps/web/test/payloadPublication.test.ts
index 134f3c7..4c07216 100644
--- a/apps/web/test/payloadPublication.test.ts
+++ b/apps/web/test/payloadPublication.test.ts
@@ -1,5 +1,5 @@
 import { createHttpsPayloadUri, createIpfsPayloadUri } from '#xcs/core/index.js'
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import {
   MAX_PILOT_PAYLOAD_BYTES,
@@ -14,6 +14,7 @@ function jsonResponse(content: BodyInit, headers: Record<string, string> = {}):
     headers: { 'content-type': 'application/json; charset=utf-8', ...headers },
   })
 }
+afterEach(() => vi.unstubAllGlobals())
 
 describe('browser HTTPS payload publication proof', () => {
   const canonical = canonicalJson({ claims: { programId: 'course-1' } })
@@ -129,6 +130,50 @@ describe('browser HTTPS payload publication proof', () => {
     ).rejects.toThrow('PAYLOAD_DIGEST_MISMATCH')
   })
 
+  it('treats an intentionally filtered private view as restricted, not digest tampering', async () => {
+    const response = jsonResponse(canonicalJson({ claims: {} }), { 'x-xcs-claim-scope': 'public' })
+    const readBytes = vi.spyOn(response.body!, 'getReader')
+    const fetchMock = vi.fn(async () => response)
+    await expect(
+      readCanonicalHttpsPayload({ credentialUri: uri, fetchImpl: fetchMock }),
+    ).rejects.toThrow('PAYLOAD_SCOPE_RESTRICTED')
+    expect(readBytes).not.toHaveBeenCalled()
+    expect(fetchMock).toHaveBeenCalledExactlyOnceWith(
+      uri.split('#')[0],
+      expect.objectContaining({ credentials: 'omit' }),
+    )
+  })
+
+  it('allows only the same-origin short private alias on a local HTTPS deployment without credentials', async () => {
+    vi.stubGlobal('window', { location: { origin: 'https://localhost:3443' } })
+    const privateUri = createHttpsPayloadUri(
+      'https://localhost:3443/q/123456789012345678',
+      canonical,
+    )
+    const fetchMock = vi.fn(async () => jsonResponse(canonical, { 'x-xcs-claim-scope': 'full' }))
+    await expect(
+      readCanonicalHttpsPayload({ credentialUri: privateUri, fetchImpl: fetchMock }),
+    ).resolves.toMatchObject({ content: canonical })
+    expect(fetchMock).toHaveBeenCalledExactlyOnceWith(
+      privateUri.split('#')[0],
+      expect.objectContaining({ credentials: 'omit', redirect: 'error' }),
+    )
+    for (const base of [
+      'https://localhost:3444/q/123456789012345678',
+      'https://localhost:3443/q/12345678901234567890',
+      'https://localhost:3443/q/123456789012345678?scope=full',
+    ]) {
+      fetchMock.mockClear()
+      await expect(
+        readCanonicalHttpsPayload({
+          credentialUri: createHttpsPayloadUri(base, canonical),
+          fetchImpl: fetchMock,
+        }),
+      ).rejects.toThrow('PILOT_PAYLOAD_HOST_REJECTED')
+      expect(fetchMock).not.toHaveBeenCalled()
+    }
+  })
+
   it('aborts a stalled request on timeout', async () => {
     const fetchMock = vi.fn(
       async (_input: string | URL | Request, init?: RequestInit): Promise<Response> =>
diff --git a/apps/web/test/portalPresenters.test.ts b/apps/web/test/portalPresenters.test.ts
new file mode 100644
index 0000000..e3d6255
--- /dev/null
+++ b/apps/web/test/portalPresenters.test.ts
@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest'
+import type { IssuerWorkspaceView, PortalAccount } from '../app/types/portal'
+import { invitationProgress, issuerNextAction } from '../app/utils/portalPresenters'
+
+const workspace: IssuerWorkspaceView = {
+  organizations: [],
+  selectedOrganizationId: null,
+  schemas: [],
+  invites: [],
+  credentials: [],
+}
+const account: PortalAccount = {
+  id: 'user',
+  email: null,
+  displayName: null,
+  roles: ['recipient'],
+  organizations: [],
+  wallets: [],
+}
+
+describe('issuer next action', () => {
+  it('moves through application, approval, wallet, template and invitation gates', () => {
+    expect(issuerNextAction(workspace, account).kind).toBe('apply')
+    const pending = {
+      ...workspace,
+      selectedOrganizationId: 'org',
+      organizations: [
+        {
+          id: 'org',
+          name: 'Org',
+          status: 'active' as const,
+          applicationStatus: 'pending' as const,
+          reviewReason: null,
+          revision: 0,
+        },
+      ],
+    }
+    expect(issuerNextAction(pending, account).kind).toBe('awaitApproval')
+    const approved = {
+      ...pending,
+      organizations: [{ ...pending.organizations[0]!, applicationStatus: 'approved' as const }],
+    }
+    expect(issuerNextAction(approved, account).kind).toBe('linkWallet')
+    const walletAccount = {
+      ...account,
+      wallets: [{ id: 'wallet', address: 'rAddress', networkId: 1, verifiedAt: '' }],
+    }
+    expect(issuerNextAction(approved, walletAccount).kind).toBe('createTemplate')
+    const modeled = {
+      ...approved,
+      schemas: [
+        {
+          profileId: 'testnet',
+          schemaUid: 'a'.repeat(64),
+          displayName: 'Course',
+          category: 'Education',
+          name: 'Course',
+          publisher: null,
+          registrationTransactionHash: 'b'.repeat(64),
+        },
+      ],
+    }
+    expect(issuerNextAction(modeled, walletAccount).kind).toBe('invite')
+  })
+
+  it('prioritizes a recipient ready for issuance over waiting invitations', () => {
+    const invite = {
+      id: '00000000-0000-4000-8000-000000000001',
+      organizationId: 'org',
+      profileId: 'testnet',
+      schemaUid: 'a'.repeat(64),
+      email: 'recipient@example.test',
+      createdAt: '',
+      expiresAt: '2099-01-01T00:00:00.000Z',
+      claimedBy: 'recipient',
+      claimedAt: '2026-01-01T00:00:00.000Z',
+      revokedAt: null,
+      deliveryStatus: 'sent' as const,
+      deliveryError: null,
+      recipientStatus: 'ready' as const,
+      recipientWalletVerifiedAt: '2026-01-01T00:00:00.000Z',
+    }
+    const modeled = {
+      ...workspace,
+      selectedOrganizationId: 'org',
+      organizations: [
+        {
+          id: 'org',
+          name: 'Org',
+          status: 'active' as const,
+          applicationStatus: 'approved' as const,
+          reviewReason: null,
+          revision: 0,
+        },
+      ],
+      schemas: [{}] as IssuerWorkspaceView['schemas'],
+      invites: [invite],
+    }
+    const readyAccount = {
+      ...account,
+      wallets: [{ id: '', address: '', networkId: 1, verifiedAt: '' }],
+    }
+    expect(issuerNextAction(modeled, readyAccount)).toMatchObject({
+      kind: 'issue',
+      inviteId: invite.id,
+    })
+    expect(invitationProgress(invite)).toEqual({
+      email: 'complete',
+      claimed: 'complete',
+      wallet: 'complete',
+      issuance: 'current',
+    })
+  })
+})
diff --git a/apps/web/test/portalProblem.test.ts b/apps/web/test/portalProblem.test.ts
new file mode 100644
index 0000000..6736f8c
--- /dev/null
+++ b/apps/web/test/portalProblem.test.ts
@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest'
+import { portalProblem } from '../app/utils/portalProblem'
+
+describe('portal problem mapping', () => {
+  it('maps authentication, wallet and retryable failures to safe actions', () => {
+    expect(portalProblem({ data: { error: 'AUTH_REQUIRED' } })).toMatchObject({ action: 'signIn' })
+    expect(portalProblem(new Error('RECIPIENT_WALLET_REQUIRED'))).toMatchObject({
+      action: 'linkWallet',
+      stateUnchanged: true,
+    })
+    expect(portalProblem(new Error('PRESENTATION_UNAVAILABLE'))).toMatchObject({
+      action: 'retry',
+      recoverable: true,
+    })
+  })
+})
diff --git a/apps/web/test/portalRoutes.test.ts b/apps/web/test/portalRoutes.test.ts
new file mode 100644
index 0000000..e4ef9d8
--- /dev/null
+++ b/apps/web/test/portalRoutes.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import {
+  authReturnPath,
+  legacyPortalDestination,
+  walletReturnPath,
+} from '../app/utils/portalRoutes'
+
+describe('portal route allowlists', () => {
+  it('keeps exact localized role destinations and rejects bearer/query redirects', () => {
+    expect(authReturnPath('/fr/presentations')).toBe('/fr/presentations')
+    expect(authReturnPath('/issuer/recipients')).toBe('/issuer/recipients')
+    expect(authReturnPath('/admin')).toBe('/admin')
+    expect(
+      authReturnPath('/admin/applications/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/verifier'),
+    ).toBe('/admin/applications/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/verifier')
+    expect(
+      authReturnPath(
+        `/recipient/credentials/${'a'.repeat(64)}/present?profile=xrpl-testnet-xcs-v1`,
+      ),
+    ).toBe(`/recipient/credentials/${'a'.repeat(64)}/present?profile=xrpl-testnet-xcs-v1`)
+    expect(authReturnPath('/presentations#secret')).toBe('/account')
+    expect(authReturnPath('/issuer?organizationId=secret')).toBe('/account')
+    expect(
+      authReturnPath(`/recipient/credentials/${'a'.repeat(64)}?profile=xrpl-testnet&token=secret`),
+    ).toBe('/account')
+    expect(
+      authReturnPath(`/recipient/credentials/${'a'.repeat(64)}?profile=https://outside.test`),
+    ).toBe('/account')
+    expect(authReturnPath('/admin/applications/not-an-id/verifier')).toBe('/account')
+    expect(authReturnPath(`/recipient/credentials/${'a'.repeat(63)}`)).toBe('/account')
+    expect(authReturnPath('https://outside.test/issuer')).toBe('/account')
+  })
+
+  it('returns wallet setup to allowlisted exact recipient and issuer screens', () => {
+    expect(walletReturnPath('/fr/recipient', 'fr')).toBe('/fr/recipient')
+    expect(
+      walletReturnPath(
+        `/issuer/issue/${'a'.repeat(8)}-${'b'.repeat(4)}-${'c'.repeat(4)}-${'d'.repeat(4)}-${'e'.repeat(12)}`,
+        'en',
+      ),
+    ).toContain('/issuer/issue/')
+    expect(walletReturnPath('/presentations#secret', 'fr')).toBe('/fr/recipient')
+  })
+
+  it('preserves locale and drops all legacy route inputs', () => {
+    expect(legacyPortalDestination('/schemas/register', 'fr')).toBe(
+      '/fr/issuer/schemas/new#xcs-legacy-redirect',
+    )
+    expect(legacyPortalDestination('/verify', 'en')).toBe('/presentations#xcs-legacy-redirect')
+  })
+})
diff --git a/apps/web/test/postgres.integration.test.ts b/apps/web/test/postgres.integration.test.ts
index 9ea32e3..0ed361d 100644
--- a/apps/web/test/postgres.integration.test.ts
+++ b/apps/web/test/postgres.integration.test.ts
@@ -1,13 +1,20 @@
 import { randomUUID } from 'node:crypto'
 
 import { computeSchemaUid, parseSchema, type SchemaDefinition } from '#xcs/core/index.js'
-import { schemaEvents, schemas } from '#db/schema'
-import { type DatabaseClient, createDatabaseClient } from '../server/lib/db/client.js'
-import { bootstrapDatabase } from './lib/db/bootstrap.js'
+import {
+  createDatabaseClient,
+  schemaEvents,
+  schemas,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+
 import { PostgresOperationalMetricsRepository } from '../server/xcs/operational-metrics-repository.js'
 import { PostgresPinningRepository } from '../server/xcs/pinning-repository.js'
+import { PostgresHostedPayloadRepository } from '../server/xcs/hosted-payloads-repository.js'
 import { PostgresApiRepository } from '../server/xcs/repository.js'
 import {
   authoritativeSchemaCatalogBundle,
@@ -31,11 +38,13 @@ const CATALOG_NETWORK_ID = 2
 const PUBLISHER = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
 const INDEXER_DATABASE_PASSWORD = 'indexer-metrics-integration-password-01'
 const API_DATABASE_PASSWORD = 'api-metrics-integration-password-000001'
+const PAYLOAD_DATABASE_PASSWORD = 'payload-metrics-integration-password-01'
 const MONITOR_DATABASE_PASSWORD = 'monitor-metrics-integration-password-01'
 
 let adminClient: DatabaseClient | undefined
 let databaseClient: DatabaseClient | undefined
 let runtimeApiClient: DatabaseClient | undefined
+let runtimePayloadClient: DatabaseClient | undefined
 let temporaryDatabaseName: string | undefined
 let temporaryDatabaseUrl: string | undefined
 let runtimeRoleCleanupAllowed = false
@@ -137,17 +146,19 @@ describePostgres('PostgreSQL 18 API integration', () => {
     `
     temporaryDatabaseUrl = databaseUrl(adminDatabaseUrl, temporaryDatabaseName)
     databaseClient = createDatabaseClient(temporaryDatabaseUrl)
-    // Stands in for the managed database service, which owns the users and their
-    // passwords; bootstrap only assigns privileges to roles that already exist.
     runtimeRoleCleanupAllowed = true
-    await adminClient.sql.unsafe(`
-      CREATE ROLE xcs_indexer LOGIN PASSWORD '${INDEXER_DATABASE_PASSWORD}';
-      CREATE ROLE xcs_api LOGIN PASSWORD '${API_DATABASE_PASSWORD}';
-      CREATE ROLE xcs_monitor LOGIN PASSWORD '${MONITOR_DATABASE_PASSWORD}';
-    `)
-    const bootstrapProvisioning = { clusterScope: 'dedicated' } as const
-    await bootstrapDatabase(databaseClient, bootstrapProvisioning)
-    await bootstrapDatabase(databaseClient, bootstrapProvisioning)
+    await createManagedRuntimeDatabaseUsers(databaseClient, {
+      indexerPassword: INDEXER_DATABASE_PASSWORD,
+      apiPassword: API_DATABASE_PASSWORD,
+      payloadWriterPassword: PAYLOAD_DATABASE_PASSWORD,
+      monitorPassword: MONITOR_DATABASE_PASSWORD,
+    })
+    const provisioning = { clusterScope: 'dedicated' } as const
+    await bootstrapDatabase(databaseClient, provisioning)
+    await bootstrapDatabase(databaseClient, provisioning)
+    runtimePayloadClient = createDatabaseClient(
+      runtimeDatabaseUrl(temporaryDatabaseUrl, 'xcs_payload_writer', PAYLOAD_DATABASE_PASSWORD),
+    )
     runtimeApiClient = createDatabaseClient(
       runtimeDatabaseUrl(temporaryDatabaseUrl, 'xcs_api', API_DATABASE_PASSWORD),
     )
@@ -155,6 +166,15 @@ describePostgres('PostgreSQL 18 API integration', () => {
 
   afterAll(async () => {
     const cleanupErrors: unknown[] = []
+    if (runtimePayloadClient !== undefined) {
+      try {
+        await runtimePayloadClient.close()
+      } catch (error) {
+        cleanupErrors.push(error)
+      } finally {
+        runtimePayloadClient = undefined
+      }
+    }
     if (runtimeApiClient !== undefined) {
       try {
         await runtimeApiClient.close()
@@ -192,7 +212,12 @@ describePostgres('PostgreSQL 18 API integration', () => {
             DROP ROLE IF EXISTS
               xcs_indexer,
               xcs_api,
-              xcs_monitor
+              xcs_payload_writer,
+              xcs_monitor,
+              xcs_app,
+              xcs_admin_app,
+              xcs_notifier,
+              xcs_issuer
           `
           runtimeRoleCleanupAllowed = false
         } catch (error) {
@@ -212,6 +237,63 @@ describePostgres('PostgreSQL 18 API integration', () => {
     }
   })
 
+  it('preserves hosted payload compatibility, idempotency, quotas and append-only runtime grants', async () => {
+    if (databaseClient === undefined || runtimePayloadClient === undefined)
+      throw new Error('PostgreSQL test database is not initialized')
+    const profile = 'hosted-testnet'
+    const uid = '9'.repeat(64)
+    const txHash = '8'.repeat(64)
+    await databaseClient.sql`INSERT INTO network_profiles (profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash,enabled) VALUES (${profile},'0.1',1,${HASH},${PUBLISHER},1,1,${HASH},true)`
+    await databaseClient.sql`INSERT INTO schema_events (profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profile},${txHash},1,${HASH},0,${PUBLISHER},'accepted',${uid},'{}')`
+    await databaseClient.sql`INSERT INTO schemas (profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profile},${uid},${PUBLISHER},'Hosted','Synthetic','{}','{}',${txHash},1,0)`
+    const repository = new PostgresHostedPayloadRepository(runtimePayloadClient.db)
+    const input = {
+      locator: '1'.repeat(18),
+      digestHex: '1'.repeat(64),
+      content: '{}',
+      transactionHash: '2'.repeat(64),
+      profileId: profile,
+      issuer: PUBLISHER,
+      subject: PUBLISHER,
+      schemaUid: uid,
+      requesterIpHash: '3'.repeat(64),
+      now: new Date(),
+      dailyLimit: 2,
+    }
+    const stored = await repository.publish(input)
+    expect(await repository.publish(input)).toEqual(stored)
+    const legacy = { ...input, locator: '1'.repeat(20), transactionHash: '4'.repeat(64) }
+    expect(await repository.publish(legacy)).toMatchObject({ locator: legacy.locator })
+    await expect(
+      repository.publish({ ...input, transactionHash: '5'.repeat(64) }),
+    ).rejects.toMatchObject({ code: 'PAYLOAD_PUBLICATION_QUOTA_EXCEEDED' })
+    await expect(
+      repository.publish({ ...input, subject: 'rLs1MzkFWCxTbuAHgjeTZK4fcCDDnf2KRv' }),
+    ).rejects.toMatchObject({ code: 'PAYLOAD_PUBLICATION_CONFLICT' })
+    await expect(
+      repository.publish({
+        ...input,
+        transactionHash: '6'.repeat(64),
+        content: '{"changed":true}',
+        dailyLimit: 50,
+      }),
+    ).rejects.toMatchObject({ code: 'PAYLOAD_LOCATOR_COLLISION' })
+    await expect(
+      runtimePayloadClient.sql`UPDATE hosted_payloads SET content='changed' WHERE locator=${input.locator}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      runtimePayloadClient.sql`DELETE FROM hosted_payloads WHERE locator=${input.locator}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      databaseClient.sql`INSERT INTO hosted_payloads (locator,digest_hex,content) VALUES (${'a'.repeat(18)},${'a'.repeat(64)},${'x'.repeat(65537)})`,
+    ).rejects.toMatchObject({ code: '23514' })
+    await databaseClient.sql`DELETE FROM hosted_payload_publications WHERE profile_id=${profile}`
+    await databaseClient.sql`DELETE FROM hosted_payloads WHERE locator IN (${input.locator}, ${legacy.locator})`
+    await databaseClient.sql`DELETE FROM schemas WHERE profile_id=${profile}`
+    await databaseClient.sql`DELETE FROM schema_events WHERE profile_id=${profile}`
+    await databaseClient.sql`DELETE FROM network_profiles WHERE profile_id=${profile}`
+  })
+
   it('decodes database time inside an authoritative read snapshot', async () => {
     if (runtimeApiClient === undefined) {
       throw new Error('PostgreSQL test database is not initialized')
@@ -328,7 +410,7 @@ describePostgres('PostgreSQL 18 API integration', () => {
   })
 
   it('serializes concurrent pin quota reservations without raw advisory locks', async () => {
-    if (databaseClient === undefined || runtimeApiClient === undefined) {
+    if (databaseClient === undefined || runtimePayloadClient === undefined) {
       throw new Error('PostgreSQL test database is not initialized')
     }
     await databaseClient.sql`
@@ -341,7 +423,7 @@ describePostgres('PostgreSQL 18 API integration', () => {
         ${PUBLISHER}, 1, 100, ${HASH}, true
       ) ON CONFLICT (profile_id) DO NOTHING
     `
-    const repository = new PostgresPinningRepository(runtimeApiClient.db)
+    const repository = new PostgresPinningRepository(runtimePayloadClient.db)
     const now = new Date('2030-01-01T00:00:00.000Z')
     const wallet = PUBLISHER
     const requesterIpHash = '6'.repeat(64)
@@ -382,7 +464,7 @@ describePostgres('PostgreSQL 18 API integration', () => {
       status: 'rejected',
       reason: { statusCode: 429 },
     })
-    const [storedPins] = await runtimeApiClient.sql<Array<{ count: number }>>`
+    const [storedPins] = await runtimePayloadClient.sql<Array<{ count: number }>>`
       SELECT count(*)::integer AS count
       FROM demo_pins
       WHERE requester_ip_hash = ${requesterIpHash}
diff --git a/apps/web/test/presentation-proof.test.ts b/apps/web/test/presentation-proof.test.ts
new file mode 100644
index 0000000..1911f89
--- /dev/null
+++ b/apps/web/test/presentation-proof.test.ts
@@ -0,0 +1,100 @@
+import { ECDSA, Wallet } from 'xrpl'
+import { sign } from 'ripple-keypairs'
+import { describe, expect, it } from 'vitest'
+import type { PresentationProofRequest } from '#db/schema/app'
+import { verifyWalletProof } from '../server/xcs/auth/wallet-proof'
+import { presentationProofMessage } from '../server/xcs/presentations/proof'
+
+const wallet = Wallet.generate()
+const request: PresentationProofRequest = {
+  version: 1,
+  origin: 'https://xcs.test',
+  challengeId: '00000000-0000-4000-8000-000000000001',
+  presentationId: '00000000-0000-4000-8000-000000000002',
+  nonce: 'a'.repeat(43),
+  issuedAt: '2026-09-24T12:00:00.000Z',
+  expiresAt: '2026-09-24T12:05:00.000Z',
+  profileId: 'testnet',
+  networkId: 1,
+  generationId: 'a'.repeat(64),
+  issuerAddress: Wallet.generate().address,
+  subjectAddress: wallet.address,
+  schemaUid: 'b'.repeat(64),
+  payloadDigest: 'c'.repeat(64),
+  visibility: 'private',
+  publicFields: ['/course'],
+  scope: 'public',
+  verifierOrganizationId: null,
+}
+
+describe('presentation signature purpose and disclosure', () => {
+  it('uses a deterministic unambiguous message and verifies both supported XRPL master-key curves', () => {
+    for (const algorithm of [ECDSA.ed25519, ECDSA.secp256k1]) {
+      const holder = Wallet.generate(algorithm)
+      const message = presentationProofMessage({ ...request, subjectAddress: holder.address })
+      expect(message).toBe(presentationProofMessage({ ...request, subjectAddress: holder.address }))
+      expect(message).toContain('not a transaction, payment, wallet link')
+      expect(
+        verifyWalletProof(message, holder.address, {
+          scheme: 'ripple',
+          publicKey: holder.publicKey,
+          signature: sign(Buffer.from(message).toString('hex'), holder.privateKey),
+        }),
+      ).toBe(true)
+    }
+  })
+  it('cryptographically binds every selected audience, disclosure and credential field', () => {
+    const message = presentationProofMessage(request)
+    const proof = {
+      scheme: 'ripple' as const,
+      publicKey: wallet.publicKey,
+      signature: sign(Buffer.from(message).toString('hex'), wallet.privateKey),
+    }
+    for (const replacement of [
+      { origin: 'https://other.test' },
+      { profileId: 'other-profile' },
+      { networkId: 2 },
+      { generationId: 'd'.repeat(64) },
+      { schemaUid: 'd'.repeat(64) },
+      { payloadDigest: 'd'.repeat(64) },
+      { subjectAddress: Wallet.generate().address },
+      { issuerAddress: Wallet.generate().address },
+      { publicFields: ['/secret'] },
+      { visibility: 'public' as const },
+      { scope: 'full' as const },
+      { verifierOrganizationId: '00000000-0000-4000-8000-000000000003' },
+      { presentationId: '00000000-0000-4000-8000-000000000003' },
+      { challengeId: '00000000-0000-4000-8000-000000000003' },
+      { nonce: 'b'.repeat(43) },
+      { issuedAt: '2026-09-24T12:01:00.000Z' },
+      { expiresAt: '2026-09-24T12:06:00.000Z' },
+    ])
+      expect(
+        verifyWalletProof(
+          presentationProofMessage({ ...request, ...replacement }),
+          wallet.address,
+          proof,
+        ),
+      ).toBe(false)
+    expect(
+      verifyWalletProof(
+        message.replace('XCS presentation authorization v1', 'XCS wallet ownership proof'),
+        wallet.address,
+        proof,
+      ),
+    ).toBe(false)
+  })
+  it('escapes untrusted profile and selector strings so they cannot introduce wallet-prompt fields', () => {
+    const message = presentationProofMessage({
+      ...request,
+      profileId: 'profile\nscope: "full"',
+      publicFields: ['/course\nverifierOrganizationId: "other"'],
+    })
+    expect(message.split('\n').filter((line) => line.startsWith('scope:'))).toEqual([
+      'scope: "public"',
+    ])
+    expect(
+      message.split('\n').filter((line) => line.startsWith('verifierOrganizationId:')),
+    ).toEqual(['verifierOrganizationId: null'])
+  })
+})
diff --git a/apps/web/test/presentationView.test.ts b/apps/web/test/presentationView.test.ts
new file mode 100644
index 0000000..ed69b22
--- /dev/null
+++ b/apps/web/test/presentationView.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+import type { VerificationDimensions } from '../app/utils/credentialReview'
+import {
+  presentationHeadline,
+  presentationTokenFromLink,
+  presentationLink,
+} from '../app/utils/presentationView'
+
+const valid: VerificationDimensions = {
+  onChain: 'active',
+  schema: 'valid',
+  payload: 'valid',
+  issuerTrust: 'trusted',
+}
+const current = { usable: true, fresh: true }
+
+describe('presentation verdict', () => {
+  it('never reuses a successful report for revoked grants or stale evidence', () => {
+    expect(presentationHeadline(valid, { ...current, usable: false })).toBe('unusable')
+    expect(presentationHeadline(valid, { ...current, fresh: false })).toBe('unavailable')
+    expect(presentationHeadline(null, current)).toBe('unavailable')
+  })
+  it.each([
+    [{ onChain: 'pending' }, 'pending'],
+    [{ onChain: 'not_found' }, 'notFound'],
+    [{ onChain: 'expired' }, 'expired'],
+    [{ onChain: 'deleted' }, 'deleted'],
+    [{ schema: 'invalid' }, 'schemaInvalid'],
+    [{ schema: 'unknown' }, 'schemaUnknown'],
+    [{ payload: 'tampered' }, 'tampered'],
+    [{ payload: 'invalid' }, 'contentInvalid'],
+    [{ payload: 'unavailable' }, 'contentUnavailable'],
+    [{ payload: 'not_checked' }, 'partial'],
+    [{ issuerTrust: 'unknown' }, 'unknownIssuer'],
+    [{ issuerTrust: 'untrusted' }, 'untrusted'],
+    [{}, 'passed'],
+  ] as [Partial<VerificationDimensions>, string][])(
+    'displays %j distinctly',
+    (changes, expected) => {
+      expect(presentationHeadline({ ...valid, ...changes }, current)).toBe(expected)
+    },
+  )
+  it('prioritizes known failures over unknown dimensions without hiding lifecycle failures', () => {
+    expect(
+      presentationHeadline({ ...valid, schema: 'unknown', payload: 'tampered' }, current),
+    ).toBe('tampered')
+    expect(
+      presentationHeadline({ ...valid, schema: 'invalid', payload: 'tampered' }, current),
+    ).toBe('schemaInvalid')
+    expect(presentationHeadline({ ...valid, onChain: 'expired', schema: 'invalid' }, current)).toBe(
+      'expired',
+    )
+    expect(
+      presentationHeadline({ ...valid, payload: 'not_checked', issuerTrust: 'untrusted' }, current),
+    ).toBe('untrusted')
+  })
+})
+
+describe('share link', () => {
+  const token = 'a'.repeat(43)
+  it('keeps bearer in a fragment and respects the French route', () => {
+    const link = new URL(presentationLink('https://portal.example', '/fr/presentations', token))
+    expect(link.pathname).toBe('/fr/presentations')
+    expect(link.search).toBe('')
+    expect(link.hash).toBe(`#${token}`)
+  })
+  it('rejects foreign origins, arbitrary routes and malformed tokens', () => {
+    expect(() =>
+      presentationLink('https://portal.example', 'https://foreign.example/presentations', token),
+    ).toThrow()
+    expect(() => presentationLink('https://portal.example', '/p/locator', token)).toThrow()
+    expect(() => presentationLink('https://portal.example', '/presentations', 'invalid')).toThrow()
+  })
+})
+
+describe('received presentation link', () => {
+  const token = 'x'.repeat(43)
+  it('accepts complete English and French sharing links from this portal', () => {
+    for (const path of ['/presentations', '/fr/presentations']) {
+      expect(
+        presentationTokenFromLink(
+          'https://portal.example',
+          ` https://portal.example${path}#${token} `,
+        ),
+      ).toBe(token)
+    }
+  })
+  it.each([
+    'https://foreign.example/presentations',
+    'https://portal.example.evil.test/presentations',
+    'http://portal.example/presentations',
+    'https://user:password@portal.example/presentations',
+    'https://portal.example/presentations?token=secret',
+    'https://portal.example/p/locator',
+    'javascript:alert(1)',
+  ])('rejects foreign or unrelated links without fetching them: %s', (input) => {
+    expect(() => presentationTokenFromLink('https://portal.example', `${input}#${token}`)).toThrow()
+  })
+  it('rejects bare references, missing and malformed fragments', () => {
+    for (const input of [
+      token,
+      '/presentations',
+      'https://portal.example/presentations',
+      'https://portal.example/presentations#invalid',
+    ]) {
+      expect(() => presentationTokenFromLink('https://portal.example', input)).toThrow()
+    }
+  })
+})
diff --git a/apps/web/test/private-document-s3.test.ts b/apps/web/test/private-document-s3.test.ts
new file mode 100644
index 0000000..6e2cf31
--- /dev/null
+++ b/apps/web/test/private-document-s3.test.ts
@@ -0,0 +1,180 @@
+import { randomBytes } from 'node:crypto'
+import { Readable } from 'node:stream'
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  PutObjectCommand,
+  type S3Client,
+} from '@aws-sdk/client-s3'
+import { describe, expect, it } from 'vitest'
+import { PrivateDocuments } from '../server/xcs/admin/documents'
+import { loadPrivateDocumentStorageConfig } from '../server/xcs/documents/config'
+import { S3PrivateDocumentBackend } from '../server/xcs/documents/storage'
+import { PrivateDocumentStorage } from '../server/xcs/issuer/storage'
+
+class FakeS3Client {
+  readonly commands: unknown[] = []
+  readonly objects = new Map<string, Buffer>()
+  destroyed = false
+
+  async send(command: unknown): Promise<Record<string, unknown>> {
+    this.commands.push(command)
+    if (command instanceof PutObjectCommand) {
+      const key = String(command.input.Key)
+      if (this.objects.has(key))
+        throw Object.assign(new Error('exists'), { name: 'PreconditionFailed' })
+      this.objects.set(key, Buffer.from(command.input.Body as Uint8Array))
+      return { ETag: 'synthetic' }
+    }
+    if (command instanceof GetObjectCommand) {
+      const bytes = this.objects.get(String(command.input.Key))
+      if (!bytes)
+        throw Object.assign(new Error('missing'), {
+          name: 'NoSuchKey',
+          $metadata: { httpStatusCode: 404 },
+        })
+      return { ContentLength: bytes.length, Body: Readable.from([bytes]) }
+    }
+    if (command instanceof DeleteObjectCommand) {
+      this.objects.delete(String(command.input.Key))
+      return {}
+    }
+    throw new Error('UNEXPECTED_S3_COMMAND')
+  }
+
+  destroy(): void {
+    this.destroyed = true
+  }
+}
+
+function backend(client: FakeS3Client) {
+  return new S3PrivateDocumentBackend(client as unknown as S3Client, 'xcs-private', 'review/')
+}
+
+const bytes = Buffer.from('%PDF-1.4\nprivate review evidence\n')
+const input = { mimeType: 'application/pdf', base64: bytes.toString('base64') }
+
+describe('private S3 document storage', () => {
+  it('writes an opaque private object and lets the admin verify its stored integrity', async () => {
+    const client = new FakeS3Client(),
+      objectBackend = backend(client),
+      issuer = new PrivateDocumentStorage(objectBackend),
+      document = await issuer.write(input)
+
+    expect(document.storageKey).toMatch(/^[0-9a-f]{64}\.pdf$/)
+    const write = client.commands.find(
+      (command): command is PutObjectCommand => command instanceof PutObjectCommand,
+    )
+    expect(write?.input).toMatchObject({
+      Bucket: 'xcs-private',
+      Key: `review/${document.storageKey}`,
+      ACL: 'private',
+      ContentType: 'application/pdf',
+    })
+    expect(JSON.stringify(write?.input)).not.toContain('http')
+
+    issuer.release(document.storageKey)
+    const admin = new PrivateDocuments(objectBackend, randomBytes(32).toString('hex'))
+    await expect(
+      admin.read({
+        id: '',
+        storage_key: document.storageKey,
+        mime_type: document.mimeType,
+        byte_length: document.byteLength,
+        sha256: document.sha256,
+      }),
+    ).resolves.toEqual(bytes)
+  })
+
+  it('removes only an object owned by the failed issuer write', async () => {
+    const client = new FakeS3Client(),
+      objectBackend = backend(client),
+      issuer = new PrivateDocumentStorage(objectBackend),
+      first = await issuer.write(input),
+      second = await issuer.write(input)
+
+    await issuer.remove(first.storageKey)
+    expect(client.objects.has(`review/${first.storageKey}`)).toBe(false)
+    issuer.release(second.storageKey)
+    await expect(issuer.remove(second.storageKey)).rejects.toThrow(
+      'ISSUER_DOCUMENT_CLEANUP_INVALID',
+    )
+    expect(client.objects.has(`review/${second.storageKey}`)).toBe(true)
+  })
+
+  it('maps missing, non-opaque and oversized objects to safe admin errors', async () => {
+    const client = new FakeS3Client(),
+      objectBackend = backend(client),
+      service = new PrivateDocuments(objectBackend, randomBytes(32).toString('hex')),
+      key = `${'a'.repeat(64)}.pdf`,
+      document = {
+        id: '',
+        storage_key: key,
+        mime_type: 'application/pdf',
+        byte_length: bytes.length,
+        sha256: 'a'.repeat(64),
+      }
+
+    await expect(service.read(document)).rejects.toThrow('ADMIN_DOCUMENT_MISSING')
+    await expect(service.read({ ...document, storage_key: '../secret.pdf' })).rejects.toThrow(
+      'ADMIN_DOCUMENT_PATH_INVALID',
+    )
+    client.objects.set(`review/${key}`, Buffer.concat([bytes, Buffer.from('extra')]))
+    await expect(service.read(document)).rejects.toThrow('ADMIN_DOCUMENT_INTEGRITY_INVALID')
+  })
+
+  it('requires an explicit local driver or complete HTTPS S3 configuration', () => {
+    expect(() => loadPrivateDocumentStorageConfig({})).toThrow('DOCUMENT_STORAGE_DRIVER_REQUIRED')
+    expect(
+      loadPrivateDocumentStorageConfig({
+        XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+        XCS_DOCUMENT_FILESYSTEM_DIRECTORY: '/var/lib/xcs-review',
+      }),
+    ).toEqual({ driver: 'filesystem', directory: '/var/lib/xcs-review' })
+    expect(() =>
+      loadPrivateDocumentStorageConfig({
+        NODE_ENV: 'production',
+        XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+        XCS_DOCUMENT_FILESYSTEM_DIRECTORY: '/var/lib/xcs-review',
+      }),
+    ).toThrow('DOCUMENT_FILESYSTEM_LOCAL_ONLY')
+    expect(
+      loadPrivateDocumentStorageConfig({
+        NODE_ENV: 'production',
+        XCS_DOCUMENT_STORAGE_DRIVER: 'filesystem',
+        XCS_DOCUMENT_FILESYSTEM_DIRECTORY: '/var/lib/xcs-review',
+        XCS_DOCUMENT_FILESYSTEM_LOCAL: '1',
+      }),
+    ).toEqual({ driver: 'filesystem', directory: '/var/lib/xcs-review' })
+    const s3Environment = {
+      XCS_DOCUMENT_STORAGE_DRIVER: 's3',
+      XCS_DOCUMENT_S3_ENDPOINT: 'https://fra1.digitaloceanspaces.com',
+      XCS_DOCUMENT_S3_REGION: 'fra1',
+      XCS_DOCUMENT_S3_BUCKET: 'xcs-private-documents',
+      XCS_DOCUMENT_S3_PRIVATE_BUCKET: '1',
+      XCS_DOCUMENT_S3_PREFIX: 'review/',
+      XCS_DOCUMENT_S3_ACCESS_KEY_ID: 'synthetic-access-key',
+      XCS_DOCUMENT_S3_SECRET_ACCESS_KEY: 'synthetic-secret-key-value',
+    }
+    const s3 = loadPrivateDocumentStorageConfig(s3Environment)
+    expect(s3).toMatchObject({
+      driver: 's3',
+      endpoint: 'https://fra1.digitaloceanspaces.com',
+      bucket: 'xcs-private-documents',
+      privateBucketConfirmed: true,
+      prefix: 'review/',
+    })
+    expect(() =>
+      loadPrivateDocumentStorageConfig({
+        ...s3Environment,
+        XCS_DOCUMENT_S3_ENDPOINT: 'http://fra1.digitaloceanspaces.com',
+      }),
+    ).toThrow('DOCUMENT_S3_CONFIGURATION_INVALID')
+    expect(() =>
+      loadPrivateDocumentStorageConfig({
+        ...s3Environment,
+        XCS_DOCUMENT_S3_PRIVATE_BUCKET: '0',
+      }),
+    ).toThrow('DOCUMENT_S3_CONFIGURATION_INVALID')
+  })
+})
diff --git a/apps/web/test/privateLinkHistory.test.ts b/apps/web/test/privateLinkHistory.test.ts
new file mode 100644
index 0000000..94243a3
--- /dev/null
+++ b/apps/web/test/privateLinkHistory.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { privateLinkHistoryState } from '../app/utils/privateLinkHistory'
+
+describe('private link history state', () => {
+  it('removes bearer fragments while preserving navigation indices, queries and scroll', () => {
+    const state = {
+      current: '/presentations#secret',
+      back: '/fr/recipient/invitations?view=short#another-secret',
+      forward: '/presentations/#third-secret',
+      position: 4,
+      replaced: false,
+      scroll: { top: 12, left: 0 },
+    }
+    expect(privateLinkHistoryState(state)).toEqual({
+      ...state,
+      current: '/presentations',
+      back: '/fr/recipient/invitations?view=short',
+      forward: '/presentations/',
+    })
+    expect(state.current).toBe('/presentations#secret')
+  })
+  it('preserves ordinary anchors and arbitrary non-router state', () => {
+    const state = {
+      current: '/learn#credentials',
+      back: '/other/presentations#anchor',
+      forward: null,
+      other: 'keep',
+    }
+    expect(privateLinkHistoryState(state)).toEqual(state)
+    expect(privateLinkHistoryState(null)).toBeNull()
+  })
+})
diff --git a/apps/web/test/recipient-http.test.ts b/apps/web/test/recipient-http.test.ts
new file mode 100644
index 0000000..85adc06
--- /dev/null
+++ b/apps/web/test/recipient-http.test.ts
@@ -0,0 +1,286 @@
+import { createApp, createError, getHeader, toNodeListener } from 'h3'
+import { inject } from 'light-my-request'
+import { describe, expect, it, vi } from 'vitest'
+import { createRecipientHandler } from '../server/xcs/recipient/http'
+import { createPresentationHandler } from '../server/xcs/presentations/http'
+import type { RecipientRepository } from '../server/xcs/recipient/repository'
+import type { PresentationRepository } from '../server/xcs/presentations/repository'
+import type { Session } from '../server/xcs/auth/types'
+import { requireCsrf } from '../server/xcs/auth/http'
+
+const origin = 'https://xcs.test'
+const session = { userId: 'recipient', csrfToken: 'csrf-test-only' } as Session
+const generation = 'a'.repeat(64),
+  transactionHash = 'b'.repeat(64)
+const path = `/api/recipient/credentials/testnet/${generation}`
+
+function recipientFixture() {
+  const repository = {
+    workspace: vi.fn(async () => ({ credentials: [] })),
+    payload: vi.fn(async () => ({ claims: { private: 'secret' } })),
+    reconcile: vi.fn(async () => ({ status: { state: 'deleted' } })),
+    createPresentation: vi.fn(async () => ({ id: 'presentation' })),
+    presentationChallenge: vi.fn(async () => ({ id: 'challenge' })),
+    presentations: vi.fn(async () => ({ presentations: [] })),
+  }
+  const handler = toNodeListener(
+    createApp().use(
+      createRecipientHandler({
+        repository: repository as unknown as RecipientRepository,
+        authorize: async (event, mutation) => {
+          if (getHeader(event, 'authorization') !== 'test-session')
+            throw createError({ statusCode: 401 })
+          if (mutation) requireCsrf(event, session, origin)
+          return session
+        },
+      }),
+    ),
+  )
+  return { repository, handler }
+}
+describe('recipient HTTP boundary', () => {
+  it('requires authentication and current CSRF before a rejection; rejection never requests payload', async () => {
+    const { repository, handler } = recipientFixture()
+    expect(
+      (await inject(handler, { method: 'GET', url: '/api/recipient/workspace' })).statusCode,
+    ).toBe(401)
+    const request = {
+      method: 'POST' as const,
+      url: `${path}/reconcile`,
+      payload: { transactionHash, action: 'reject' },
+    }
+    expect(
+      (await inject(handler, { ...request, headers: { authorization: 'test-session', origin } }))
+        .statusCode,
+    ).toBe(403)
+    const response = await inject(handler, {
+      ...request,
+      headers: { authorization: 'test-session', origin, 'x-xcs-csrf': session.csrfToken },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(repository.reconcile).toHaveBeenCalledWith(
+      session,
+      'testnet',
+      generation,
+      transactionHash,
+      'reject',
+    )
+    expect(repository.payload).not.toHaveBeenCalled()
+    expect(response.body).not.toContain('secret')
+  })
+  it('rejects extra fields and malformed presentation filters instead of trusting supplied owners', async () => {
+    const { repository, handler } = recipientFixture()
+    const response = await inject(handler, {
+      method: 'POST',
+      url: '/api/recipient/presentations',
+      headers: { authorization: 'test-session', origin, 'x-xcs-csrf': session.csrfToken },
+      payload: {
+        profileId: 'testnet',
+        generationId: generation,
+        scope: 'public',
+        recipientUserId: 'other',
+      },
+    })
+    expect(response.statusCode).toBe(400)
+    expect(repository.createPresentation).not.toHaveBeenCalled()
+    expect(
+      (
+        await inject(handler, {
+          method: 'GET',
+          url: '/api/recipient/presentations?profileId=testnet',
+          headers: { authorization: 'test-session' },
+        })
+      ).statusCode,
+    ).toBe(400)
+    expect(repository.presentations).not.toHaveBeenCalled()
+  })
+  it('requires CSRF for challenges and a strict purpose-specific proof before creating links', async () => {
+    const { repository, handler } = recipientFixture()
+    const payload = { profileId: 'testnet', generationId: generation, scope: 'public' }
+    const headers = { authorization: 'test-session', origin, 'x-xcs-csrf': session.csrfToken }
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/recipient/presentation-challenges',
+          payload,
+          headers: { authorization: 'test-session', origin },
+        })
+      ).statusCode,
+    ).toBe(403)
+    expect(repository.presentationChallenge).not.toHaveBeenCalled()
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/recipient/presentation-challenges',
+          payload,
+          headers,
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect(repository.presentationChallenge).toHaveBeenCalledWith(session, {
+      ...payload,
+      verifierOrganizationId: null,
+    })
+    const missing = await inject(handler, {
+      method: 'POST',
+      url: '/api/recipient/presentations',
+      payload,
+      headers,
+    })
+    expect(missing.statusCode).toBe(400)
+    expect(missing.json()).toEqual({ error: 'RECIPIENT_PROOF_REQUIRED' })
+    expect(repository.createPresentation).not.toHaveBeenCalled()
+    const proof = {
+      challengeId: '00000000-0000-4000-8000-000000000001',
+      scheme: 'ripple',
+      publicKey: 'ED' + 'a'.repeat(64),
+      signature: 'a'.repeat(128),
+    }
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/recipient/presentations',
+          payload: { ...payload, proof: { ...proof, message: 'client-selected' } },
+          headers,
+        })
+      ).statusCode,
+    ).toBe(400)
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/recipient/presentations',
+          payload: { ...payload, proof },
+          headers,
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect(repository.createPresentation).toHaveBeenCalledWith(session, {
+      ...payload,
+      verifierOrganizationId: null,
+      proof,
+    })
+  })
+  it('reads full claims only through the explicit payload endpoint', async () => {
+    const { repository, handler } = recipientFixture()
+    await inject(handler, {
+      method: 'GET',
+      url: '/api/recipient/workspace',
+      headers: { authorization: 'test-session' },
+    })
+    expect(repository.payload).not.toHaveBeenCalled()
+    const response = await inject(handler, {
+      method: 'GET',
+      url: `${path}/payload`,
+      headers: { authorization: 'test-session' },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(repository.payload).toHaveBeenCalledOnce()
+    expect(response.headers['cache-control']).toBe('private, no-store')
+  })
+})
+
+describe('presentation POST disclosure boundary', () => {
+  function fixture(authenticated = false) {
+    const resolve = vi.fn(async () => ({ scope: 'public', claims: { course: 'Public' } }))
+    const handler = toNodeListener(
+      createApp().use(
+        createPresentationHandler({
+          origin,
+          repository: { resolve } as unknown as PresentationRepository,
+          readSession: async () => (authenticated ? session : null),
+        }),
+      ),
+    )
+    return { resolve, handler }
+  }
+  it('requires explicit same-origin JSON even anonymously, excluding scanners and cross-site requests', async () => {
+    const { resolve, handler } = fixture()
+    const token = 'a'.repeat(43)
+    for (const headers of [
+      {},
+      { origin: 'https://other.test' },
+      { origin, 'sec-fetch-site': 'cross-site' },
+    ]) {
+      expect(
+        (
+          await inject(handler, {
+            method: 'POST',
+            url: '/api/presentations/resolve',
+            headers,
+            payload: { token },
+          })
+        ).statusCode,
+      ).toBe(403)
+    }
+    expect(
+      (
+        await inject(handler, {
+          method: 'GET',
+          url: '/api/presentations/resolve',
+          headers: { origin },
+        })
+      ).statusCode,
+    ).toBe(405)
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/presentations/resolve',
+          headers: { origin, 'content-type': 'text/plain' },
+          payload: token,
+        })
+      ).statusCode,
+    ).toBe(415)
+    expect(resolve).not.toHaveBeenCalled()
+    const response = await inject(handler, {
+      method: 'POST',
+      url: '/api/presentations/resolve',
+      headers: { origin },
+      payload: { token },
+    })
+    expect(response.statusCode).toBe(200)
+    expect(resolve).toHaveBeenCalledWith(null, token)
+    expect(response.headers['referrer-policy']).toBe('no-referrer')
+    expect(response.headers['cache-control']).toBe('private, no-store')
+  })
+  it('requires CSRF for a signed-in consultation and rejects owner/scope spoofing', async () => {
+    const { resolve, handler } = fixture(true)
+    const payload = { token: 'a'.repeat(43) }
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/presentations/resolve',
+          headers: { origin },
+          payload,
+        })
+      ).statusCode,
+    ).toBe(403)
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/presentations/resolve',
+          headers: { origin, 'x-xcs-csrf': session.csrfToken },
+          payload: { ...payload, scope: 'full' },
+        })
+      ).statusCode,
+    ).toBe(400)
+    expect(resolve).not.toHaveBeenCalled()
+    expect(
+      (
+        await inject(handler, {
+          method: 'POST',
+          url: '/api/presentations/resolve',
+          headers: { origin, 'x-xcs-csrf': session.csrfToken },
+          payload,
+        })
+      ).statusCode,
+    ).toBe(200)
+    expect(resolve).toHaveBeenCalledWith(session, payload.token)
+  })
+})
diff --git a/apps/web/test/recipient-postgres.integration.test.ts b/apps/web/test/recipient-postgres.integration.test.ts
new file mode 100644
index 0000000..00bc461
--- /dev/null
+++ b/apps/web/test/recipient-postgres.integration.test.ts
@@ -0,0 +1,649 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { Wallet, unixTimeToRippleTime } from 'xrpl'
+import { sign } from 'ripple-keypairs'
+import { createAppToken } from '../server/lib/db/index.js'
+import { createRecipientDatabase, signPresentationInput } from './helpers/recipientDatabase'
+import { RecipientRepository } from '../server/xcs/recipient/repository'
+import { PresentationRepository } from '../server/xcs/presentations/repository'
+import { StaticTrustPolicy } from '../server/xcs/verification'
+import type { Session } from '../server/xcs/auth/types'
+import type {
+  CreatedPresentation,
+  PresentationChallengeInput,
+  CreatePresentationInput,
+} from '../server/xcs/recipient/types'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+
+describe.skipIf(!url)('recipient and presentation actual PostgreSQL authorization', () => {
+  let f: Awaited<ReturnType<typeof createRecipientDatabase>>,
+    recipient: RecipientRepository,
+    presentations: PresentationRepository
+  let full: CreatedPresentation, publicLink: CreatedPresentation
+  const createPresentation = async (session: Session, input: PresentationChallengeInput) =>
+    recipient.createPresentation(
+      session,
+      await signPresentationInput(recipient, session, input, f.subjectWallet),
+    )
+  beforeAll(async () => {
+    f = await createRecipientDatabase(url!)
+    recipient = new RecipientRepository(f.portal, 'https://xcs.test')
+    presentations = new PresentationRepository(f.portal)
+    full = await createPresentation(f.sessions.recipient, {
+      profileId: f.profileId,
+      generationId: f.generationId,
+      scope: 'full',
+      verifierOrganizationId: f.verifierOrg,
+    })
+    publicLink = await createPresentation(f.sessions.recipient, {
+      profileId: f.profileId,
+      generationId: f.generationId,
+      scope: 'public',
+    })
+  }, 30000)
+  afterAll(async () => {
+    await f?.close()
+  })
+
+  it('lists only the recipient records and never includes payloads, delivery emails, or tokens in metadata', async () => {
+    const workspace = await recipient.workspace(f.sessions.recipient)
+    expect(workspace.credentials).toHaveLength(1)
+    expect(workspace.credentials[0]!.status.state).toBe('active')
+    expect(workspace.invitations).toHaveLength(1)
+    expect(workspace.notifications.map((notice) => notice.kind)).toEqual(['issued'])
+    for (const forbidden of [
+      'Private synthetic claim',
+      'canonicalPayload',
+      'tokenHash',
+      'deliveryEmail',
+    ])
+      expect(JSON.stringify(workspace)).not.toContain(forbidden)
+    expect((await recipient.workspace(f.sessions.other)).credentials).toEqual([])
+    await expect(
+      recipient.credential(f.sessions.other, f.profileId, f.generationId),
+    ).rejects.toMatchObject({ statusCode: 404 })
+    await expect(
+      recipient.payload(f.sessions.admin, f.profileId, f.generationId),
+    ).rejects.toMatchObject({ statusCode: 404 })
+    const detail = await recipient.credential(f.sessions.recipient, f.profileId, f.generationId)
+    expect(detail.disclosure).toEqual({ publicFields: ['/course'], fields: ['course', 'secret'] })
+    expect(detail.events).toHaveLength(2)
+    expect(
+      (await recipient.payload(f.sessions.recipient, f.profileId, f.generationId)).claims.secret,
+    ).toBe('Private synthetic claim')
+  })
+  it('stores hashes only and enforces the full audience, public scope and revoked-link boundary', async () => {
+    const [stored] = await f.db.sql`SELECT token_hash FROM app_presentations WHERE id=${full.id}`
+    expect(stored!.token_hash).not.toBe(full.token)
+    expect(stored!.token_hash).toMatch(/^[a-f0-9]{64}$/)
+    expect(full.url).toBe(`https://xcs.test/presentations#${full.token}`)
+    const listed = await recipient.presentations(f.sessions.recipient)
+    expect(JSON.stringify(listed)).not.toContain(full.token)
+    expect(JSON.stringify(listed)).not.toContain('tokenHash')
+    const result = await presentations.resolve(f.sessions.verifier, full.token)
+    expect(result.scope).toBe('full')
+    expect(result.claims.secret).toBe('Private synthetic claim')
+    expect(result.verification).toMatchObject({
+      onChain: 'active',
+      schema: 'valid',
+      payload: 'valid',
+      issuerTrust: 'unknown',
+      generationId: f.generationId,
+    })
+    for (const session of [
+      null,
+      f.sessions.other,
+      f.sessions.admin,
+      f.sessions.recipient,
+      f.sessions.issuer,
+    ]) {
+      const reduced = await presentations.resolve(session, full.token)
+      expect(reduced.scope).toBe('public')
+      expect(reduced.claims).toEqual({ course: 'Public course' })
+      expect(reduced.requiresAuthorization).toBe(true)
+      expect(reduced.verification.payload).toBe('not_checked')
+    }
+    const reduced = await presentations.resolve(f.sessions.recipient, publicLink.token)
+    expect(reduced.claims).toEqual({ course: 'Public course' })
+    expect(reduced.scope).toBe('public')
+    expect(reduced.requiresAuthorization).toBe(false)
+    await expect(
+      recipient.revokePresentation(f.sessions.other, publicLink.id),
+    ).rejects.toMatchObject({ statusCode: 404 })
+    const disposable = await createPresentation(f.sessions.recipient, {
+      profileId: f.profileId,
+      generationId: f.generationId,
+      scope: 'public',
+    })
+    await recipient.revokePresentation(f.sessions.recipient, disposable.id)
+    await expect(presentations.resolve(null, disposable.token)).rejects.toMatchObject({
+      statusCode: 404,
+      code: 'PRESENTATION_REVOKED',
+    })
+    await expect(presentations.resolve(f.sessions.verifier, 'x'.repeat(43))).rejects.toMatchObject({
+      statusCode: 404,
+      code: 'PRESENTATION_INVALID',
+    })
+  })
+  it('keeps already-public credential claims public even when the private-field selector is empty', async () => {
+    await f.db
+      .sql`UPDATE app_credential_metadata SET visibility='public',public_fields='[]'::jsonb WHERE profile_id=${f.profileId}`
+    try {
+      const alreadyPublic = await createPresentation(f.sessions.recipient, {
+        profileId: f.profileId,
+        generationId: f.generationId,
+        scope: 'public',
+      })
+      const result = await presentations.resolve(null, alreadyPublic.token)
+      await recipient.revokePresentation(f.sessions.recipient, alreadyPublic.id)
+      expect(result.scope).toBe('public')
+      expect(result.claims).toEqual({ course: 'Public course', secret: 'Private synthetic claim' })
+      expect(result).not.toHaveProperty('canonicalPayload')
+    } finally {
+      await f.db
+        .sql`UPDATE app_credential_metadata SET visibility='private',public_fields='["/course"]'::jsonb WHERE profile_id=${f.profileId}`
+    }
+  })
+  it('rechecks current verifier approval and account/session state without an issuer allowlist', async () => {
+    await f.db
+      .sql`UPDATE app_organization_applications SET status='suspended',review_reason='Synthetic suspension' WHERE organization_id=${f.verifierOrg} AND role='verifier'`
+    try {
+      const result = await presentations.resolve(f.sessions.verifier, full.token)
+      expect(result.scope).toBe('public')
+      expect(result.claims).not.toHaveProperty('secret')
+      await expect(
+        createPresentation(f.sessions.recipient, {
+          profileId: f.profileId,
+          generationId: f.generationId,
+          scope: 'full',
+          verifierOrganizationId: f.verifierOrg,
+        }),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_VERIFIER_UNAVAILABLE' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_organization_applications SET status='approved',review_reason=NULL WHERE organization_id=${f.verifierOrg} AND role='verifier'`
+    }
+    expect((await presentations.resolve(f.sessions.verifier, full.token)).scope).toBe('full')
+    await f.db.sql`UPDATE app_users SET status='suspended' WHERE id=${f.sessions.verifier.userId}`
+    try {
+      await expect(presentations.resolve(f.sessions.verifier, full.token)).rejects.toMatchObject({
+        statusCode: 401,
+      })
+    } finally {
+      await f.db.sql`UPDATE app_users SET status='active' WHERE id=${f.sessions.verifier.userId}`
+    }
+    await f.db
+      .sql`UPDATE app_sessions SET token_hash=${'0'.repeat(64)} WHERE id=${f.sessions.recipient.id}`
+    try {
+      await expect(recipient.workspace(f.sessions.recipient)).rejects.toMatchObject({
+        statusCode: 401,
+      })
+    } finally {
+      await f.db
+        .sql`UPDATE app_sessions SET token_hash=${f.sessions.recipient.tokenHash} WHERE id=${f.sessions.recipient.id}`
+    }
+  })
+  it('uses configured trust and ledger freshness, failing closed before private disclosure', async () => {
+    const strict = new PresentationRepository(f.portal, undefined, {
+      maxLedgerAgeSeconds: 30,
+      trustPolicy: new StaticTrustPolicy({ untrusted: [f.issuerAddress] }),
+    })
+    expect((await strict.resolve(f.sessions.verifier, full.token)).verification.issuerTrust).toBe(
+      'untrusted',
+    )
+    await f.db
+      .sql`UPDATE ledger_checkpoints SET close_time=${unixTimeToRippleTime(Date.now() - 60000)} WHERE profile_id=${f.profileId}`
+    try {
+      await expect(strict.resolve(f.sessions.verifier, full.token)).rejects.toMatchObject({
+        code: 'INDEXER_STALE',
+      })
+      expect(
+        (await presentations.resolve(f.sessions.verifier, full.token)).verification.onChain,
+      ).toBe('active')
+    } finally {
+      await f.db
+        .sql`UPDATE ledger_checkpoints SET close_time=${unixTimeToRippleTime(Date.now())} WHERE profile_id=${f.profileId}`
+    }
+    await f.db.sql`UPDATE indexer_status SET state='catching_up' WHERE profile_id=${f.profileId}`
+    try {
+      await expect(presentations.resolve(f.sessions.verifier, full.token)).rejects.toMatchObject({
+        code: 'INDEXER_NOT_READY',
+      })
+      expect((await recipient.workspace(f.sessions.recipient)).credentials[0]!.status.state).toBe(
+        'unknown',
+      )
+    } finally {
+      await f.db.sql`UPDATE indexer_status SET state='ready' WHERE profile_id=${f.profileId}`
+    }
+  })
+  it('reports corrupt canonical payloads without exposing any claims and rejects inconsistent schema evidence', async () => {
+    await f.db
+      .sql`UPDATE app_issuer_payloads SET canonical_payload='{"claims":{"secret":"tampered"}}' WHERE id=${f.payloadId}`
+    try {
+      for (const session of [null, f.sessions.verifier]) {
+        const result = await presentations.resolve(session, full.token)
+        expect(result.verification.payload).toBe('tampered')
+        expect(result.claims).toEqual({})
+      }
+      await expect(
+        recipient.payload(f.sessions.recipient, f.profileId, f.generationId),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_PAYLOAD_INVALID' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_issuer_payloads SET canonical_payload=${f.canonical} WHERE id=${f.payloadId}`
+    }
+    await f.db
+      .sql`UPDATE schemas SET name='Wrong projected name' WHERE profile_id=${f.profileId} AND schema_uid=${f.schemaUid}`
+    try {
+      await expect(presentations.resolve(f.sessions.verifier, full.token)).rejects.toMatchObject({
+        code: 'SCHEMA_PROJECTION_INVALID',
+      })
+    } finally {
+      await f.db
+        .sql`UPDATE schemas SET name='Synthetic recipient credential' WHERE profile_id=${f.profileId} AND schema_uid=${f.schemaUid}`
+    }
+  })
+  it('requires acceptance for a new presentation and reports credential expiry without inventing a grant TTL', async () => {
+    const input = { profileId: f.profileId, generationId: f.generationId, scope: 'public' as const }
+    await f.db.sql`UPDATE credential_generations SET accepted=false WHERE profile_id=${f.profileId}`
+    try {
+      await expect(createPresentation(f.sessions.recipient, input)).rejects.toMatchObject({
+        code: 'RECIPIENT_CREDENTIAL_NOT_ACTIVE',
+      })
+      expect((await presentations.resolve(null, publicLink.token)).verification.onChain).toBe(
+        'pending',
+      )
+    } finally {
+      await f.db
+        .sql`UPDATE credential_generations SET accepted=true WHERE profile_id=${f.profileId}`
+    }
+    await f.db
+      .sql`UPDATE credential_generations SET expiration=${unixTimeToRippleTime(Date.now() - 60000)} WHERE profile_id=${f.profileId}`
+    try {
+      await expect(createPresentation(f.sessions.recipient, input)).rejects.toMatchObject({
+        code: 'RECIPIENT_CREDENTIAL_NOT_ACTIVE',
+      })
+      expect(
+        (await presentations.resolve(f.sessions.verifier, full.token)).verification.onChain,
+      ).toBe('expired')
+      expect(
+        (await recipient.presentations(f.sessions.recipient)).presentations.find(
+          (p) => p.id === full.id,
+        )!.revokedAt,
+      ).toBe(null)
+    } finally {
+      await f.db
+        .sql`UPDATE credential_generations SET expiration=NULL WHERE profile_id=${f.profileId}`
+    }
+  })
+  it('reconciles only the exact indexed subject action with a linked wallet, without reading rejected payload bytes', async () => {
+    expect(
+      (
+        await recipient.reconcile(
+          f.sessions.recipient,
+          f.profileId,
+          f.generationId,
+          f.acceptedHash,
+          'accept',
+        )
+      ).status.accepted,
+    ).toBe(true)
+    await expect(
+      recipient.reconcile(
+        f.sessions.recipient,
+        f.profileId,
+        f.generationId,
+        f.acceptedHash,
+        'reject',
+      ),
+    ).rejects.toMatchObject({ code: 'RECIPIENT_ACTION_NOT_VALIDATED' })
+    const deletionHash = '3'.repeat(64)
+    await f.db
+      .sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,accepted,deletion_cause,snapshot) VALUES (${f.profileId},${deletionHash},0,${f.generationId},${'1'.repeat(64)},4,${f.ledgerHash},0,'deleted',${f.issuerAddress},${f.subjectAddress},${f.schemaUid},false,'subject_rejected','{}'::jsonb)`
+    await f.db
+      .sql`UPDATE credential_generations SET accepted=false,last_ledger_index=4,deleted_ledger_index=4,deletion_cause='subject_rejected' WHERE profile_id=${f.profileId}`
+    // A payload read here would fail canonical verification. Rejection succeeds on ledger metadata alone.
+    await f.db
+      .sql`UPDATE app_issuer_payloads SET canonical_payload='not-json' WHERE id=${f.payloadId}`
+    try {
+      const result = await recipient.reconcile(
+        f.sessions.recipient,
+        f.profileId,
+        f.generationId,
+        deletionHash,
+        'reject',
+      )
+      expect(result.status.deletionCause).toBe('subject_rejected')
+      expect(result).not.toHaveProperty('claims')
+      await expect(
+        recipient.reconcile(
+          f.sessions.recipient,
+          f.profileId,
+          f.generationId,
+          deletionHash,
+          'remove',
+        ),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_ACTION_NOT_VALIDATED' })
+      await f.db
+        .sql`UPDATE credential_events SET deletion_cause='subject_removed',accepted=true WHERE transaction_hash=${deletionHash}`
+      await f.db
+        .sql`UPDATE credential_generations SET deletion_cause='subject_removed',accepted=true WHERE profile_id=${f.profileId}`
+      expect(
+        (
+          await recipient.reconcile(
+            f.sessions.recipient,
+            f.profileId,
+            f.generationId,
+            deletionHash,
+            'remove',
+          )
+        ).status.deletionCause,
+      ).toBe('subject_removed')
+      await f.db
+        .sql`UPDATE app_wallets SET revoked_at=statement_timestamp() WHERE user_id=${f.sessions.recipient.userId}`
+      await expect(
+        recipient.reconcile(
+          f.sessions.recipient,
+          f.profileId,
+          f.generationId,
+          deletionHash,
+          'reject',
+        ),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_WALLET_REQUIRED' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${f.sessions.recipient.userId}`
+      await f.db
+        .sql`UPDATE app_issuer_payloads SET canonical_payload=${f.canonical} WHERE id=${f.payloadId}`
+      await f.db.sql`DELETE FROM credential_events WHERE transaction_hash=${deletionHash}`
+      await f.db
+        .sql`UPDATE credential_generations SET accepted=true,last_ledger_index=3,deleted_ledger_index=NULL,deletion_cause=NULL WHERE profile_id=${f.profileId}`
+    }
+  })
+  it('notifies an issuer revocation observed outside the portal from durable ledger events', async () => {
+    const transactionHash = '4'.repeat(64)
+    await f.db
+      .sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,accepted,deletion_cause,snapshot) VALUES (${f.profileId},${transactionHash},0,${f.generationId},${'1'.repeat(64)},4,${f.ledgerHash},0,'deleted',${f.issuerAddress},${f.subjectAddress},${f.schemaUid},true,'issuer_revoked','{}'::jsonb)`
+    await f.db
+      .sql`UPDATE credential_generations SET last_ledger_index=4,deleted_ledger_index=4,deletion_cause='issuer_revoked' WHERE profile_id=${f.profileId}`
+    try {
+      const workspace = await recipient.workspace(f.sessions.recipient)
+      expect(workspace.notifications.map((n) => n.kind)).toEqual(['revoked', 'issued'])
+      expect(workspace.credentials[0]!.status.deletionCause).toBe('issuer_revoked')
+      expect(JSON.stringify(workspace.notifications)).not.toContain('Private synthetic claim')
+    } finally {
+      await f.db.sql`DELETE FROM credential_events WHERE transaction_hash=${transactionHash}`
+      await f.db
+        .sql`UPDATE credential_generations SET last_ledger_index=3,deleted_ledger_index=NULL,deletion_cause=NULL WHERE profile_id=${f.profileId}`
+    }
+  })
+  it('serializes the 200-active-grant quota and keeps every active grant reachable ahead of revoked history', async () => {
+    await f.db
+      .sql`INSERT INTO app_presentations(profile_id,generation_id,recipient_user_id,scope,token_hash)
+      SELECT ${f.profileId},${f.generationId},${f.sessions.recipient.userId},'public','5'||lpad(n::text,63,'0') FROM generate_series(1,197) AS n`
+    try {
+      const input = {
+        profileId: f.profileId,
+        generationId: f.generationId,
+        scope: 'public' as const,
+      }
+      const attempts = await Promise.allSettled([
+        createPresentation(f.sessions.recipient, input),
+        createPresentation(f.sessions.recipient, input),
+      ])
+      expect(attempts.filter((result) => result.status === 'fulfilled')).toHaveLength(1)
+      const failure = attempts.find(
+        (result) => result.status === 'rejected',
+      ) as PromiseRejectedResult
+      expect(failure.reason).toMatchObject({
+        statusCode: 409,
+        code: 'RECIPIENT_PRESENTATION_LIMIT',
+      })
+      await f.db
+        .sql`INSERT INTO app_presentations(profile_id,generation_id,recipient_user_id,scope,token_hash,revoked_at)
+        SELECT ${f.profileId},${f.generationId},${f.sessions.recipient.userId},'public','6'||lpad(n::text,63,'0'),statement_timestamp() FROM generate_series(1,205) AS n`
+      const listed = await recipient.presentations(f.sessions.recipient, {
+        profileId: f.profileId,
+        generationId: f.generationId,
+      })
+      expect(listed.presentations).toHaveLength(200)
+      expect(listed.presentations.every((grant) => grant.revokedAt === null)).toBe(true)
+      expect(listed.presentations.some((grant) => grant.id === full.id)).toBe(true)
+      const spare = listed.presentations.find(
+        (grant) => grant.id !== full.id && grant.id !== publicLink.id,
+      )!
+      await recipient.revokePresentation(f.sessions.recipient, spare.id)
+      expect((await createPresentation(f.sessions.recipient, input)).revokedAt).toBe(null)
+    } finally {
+      await f.db
+        .sql`DELETE FROM app_presentation_proofs WHERE presentation_id NOT IN (${full.id},${publicLink.id})`
+      await f.db.sql`DELETE FROM app_presentations WHERE id NOT IN (${full.id},${publicLink.id})`
+    }
+  })
+  it('limits SQL privileges to presentation creation/revocation and history append; no ledger or role writes', async () => {
+    await expect(
+      f.authClient.sql`SELECT canonical_payload FROM app_issuer_payloads`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(f.authClient.sql`SELECT * FROM app_verifier_history`).rejects.toMatchObject({
+      code: '42501',
+    })
+    await expect(
+      f.portal.sql`UPDATE app_presentations SET token_hash=${'9'.repeat(64)} WHERE id=${full.id}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      f.portal.sql`UPDATE credential_generations SET accepted=false`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(
+      f.portal.sql`UPDATE app_organization_applications SET status='approved'`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(f.portal.sql`DELETE FROM app_verifier_history`).rejects.toMatchObject({
+      code: '42501',
+    })
+    const columns = await f.db
+      .sql`SELECT column_name FROM information_schema.columns WHERE table_name='app_presentations'`
+    expect(columns.map((row) => row.column_name)).not.toContain('expires_at')
+    expect(columns.map((row) => row.column_name)).not.toContain('consumed_at')
+  })
+  it('requires a fresh signed scope-bound challenge and consumes it atomically only once', async () => {
+    const input = { profileId: f.profileId, generationId: f.generationId, scope: 'public' as const }
+    const signed = await signPresentationInput(
+      recipient,
+      f.sessions.recipient,
+      input,
+      f.subjectWallet,
+    )
+    const [challenge] = await f.db
+      .sql`SELECT * FROM app_presentation_challenges WHERE id=${signed.proof.challengeId}`
+    for (const forbidden of [
+      f.sessions.recipient.id,
+      f.sessions.recipient.userId,
+      f.sessions.recipient.tokenHash,
+      f.subjectWallet.privateKey,
+      'Private synthetic claim',
+    ])
+      expect(challenge!.message).not.toContain(forbidden)
+    expect(challenge!.message).toContain('XCS presentation authorization v1')
+    expect(challenge!.message).toContain(f.generationId)
+    expect(challenge!.message).toContain('"/course"')
+    expect(challenge!.message).toContain('not a transaction, payment, wallet link')
+    const results = await Promise.allSettled([
+      recipient.createPresentation(f.sessions.recipient, signed),
+      recipient.createPresentation(f.sessions.recipient, signed),
+    ])
+    expect(results.filter((r) => r.status === 'fulfilled')).toHaveLength(1)
+    expect(
+      (results.find((r) => r.status === 'rejected') as PromiseRejectedResult).reason,
+    ).toMatchObject({ code: 'RECIPIENT_PROOF_INVALID' })
+    const result = (
+      results.find((r) => r.status === 'fulfilled') as PromiseFulfilledResult<CreatedPresentation>
+    ).value
+    const resolved = await presentations.resolve(null, result.token)
+    expect(resolved.holderProof).toMatchObject({
+      status: 'verified',
+      address: f.subjectAddress,
+      publicKey: f.subjectWallet.publicKey,
+      keyAuthority: 'master_key_address_only',
+    })
+    expect(resolved.issuerAdmission.status).toBe('approved')
+    expect(
+      await f.db
+        .sql`SELECT id FROM app_presentation_challenges WHERE id=${signed.proof.challengeId}`,
+    ).toEqual([])
+    await expect(
+      f.portal.sql`UPDATE app_presentation_proofs SET message='tampered'`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await expect(f.authClient.sql`SELECT * FROM app_presentation_proofs`).rejects.toMatchObject({
+      code: '42501',
+    })
+    await recipient.revokePresentation(f.sessions.recipient, result.id)
+  })
+  it('rejects scope/audience changes, another wallet, another session, and cross-purpose signatures without consuming the valid challenge', async () => {
+    const input = { profileId: f.profileId, generationId: f.generationId, scope: 'public' as const }
+    const signed = await signPresentationInput(
+      recipient,
+      f.sessions.recipient,
+      input,
+      f.subjectWallet,
+    )
+    await expect(
+      recipient.createPresentation(f.sessions.recipient, {
+        ...signed,
+        scope: 'full',
+        verifierOrganizationId: f.verifierOrg,
+      }),
+    ).rejects.toMatchObject({ code: 'RECIPIENT_PROOF_INVALID' })
+    const other = Wallet.generate()
+    await expect(
+      recipient.createPresentation(f.sessions.recipient, {
+        ...signed,
+        proof: { ...signed.proof, publicKey: other.publicKey },
+      }),
+    ).rejects.toMatchObject({ code: 'RECIPIENT_PROOF_INVALID' })
+    await expect(
+      recipient.createPresentation(f.sessions.recipient, {
+        ...signed,
+        proof: {
+          ...signed.proof,
+          signature: sign(
+            Buffer.from('XCS wallet ownership proof').toString('hex'),
+            f.subjectWallet.privateKey,
+          ),
+        },
+      }),
+    ).rejects.toMatchObject({ code: 'RECIPIENT_PROOF_INVALID' })
+    const token = {
+      ...createAppToken(),
+      csrfToken: createAppToken().token,
+      idleSeconds: 1800,
+      absoluteSeconds: 28800,
+    }
+    await f.auth.createSession(
+      {
+        issuer: 'https://identity.test',
+        subject: 'recipient',
+        emailVerified: true,
+        email: 'recipient@example.test',
+      },
+      token,
+    )
+    const secondSession = (await f.auth.session(token.tokenHash))!
+    await expect(recipient.createPresentation(secondSession, signed)).rejects.toMatchObject({
+      code: 'RECIPIENT_PROOF_INVALID',
+    })
+    // Auth has no access to this purpose's challenge, even if the holder submits its UUID.
+    expect(await f.auth.challenge(f.sessions.recipient.tokenHash, signed.proof.challengeId)).toBe(
+      null,
+    )
+    expect(await f.auth.linkWallet(f.sessions.recipient.tokenHash, signed.proof.challengeId)).toBe(
+      false,
+    )
+    const created = await recipient.createPresentation(f.sessions.recipient, signed)
+    await recipient.revokePresentation(f.sessions.recipient, created.id)
+  })
+  it('rechecks current wallet, acceptance, disclosure and verifier approval between signing and creation', async () => {
+    const input = {
+      profileId: f.profileId,
+      generationId: f.generationId,
+      scope: 'full' as const,
+      verifierOrganizationId: f.verifierOrg,
+    }
+    const signed = await signPresentationInput(
+      recipient,
+      f.sessions.recipient,
+      input,
+      f.subjectWallet,
+    )
+    await f.db
+      .sql`UPDATE app_wallets SET revoked_at=statement_timestamp() WHERE user_id=${f.sessions.recipient.userId}`
+    try {
+      await expect(
+        recipient.createPresentation(f.sessions.recipient, signed),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_WALLET_REQUIRED' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${f.sessions.recipient.userId}`
+    }
+    await f.db.sql`UPDATE credential_generations SET accepted=false WHERE profile_id=${f.profileId}`
+    try {
+      await expect(
+        recipient.createPresentation(f.sessions.recipient, signed),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_CREDENTIAL_NOT_ACTIVE' })
+    } finally {
+      await f.db
+        .sql`UPDATE credential_generations SET accepted=true WHERE profile_id=${f.profileId}`
+    }
+    await f.db
+      .sql`UPDATE app_credential_metadata SET public_fields='[]'::jsonb WHERE profile_id=${f.profileId}`
+    try {
+      await expect(
+        recipient.createPresentation(f.sessions.recipient, signed),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_PROOF_INVALID' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_credential_metadata SET public_fields='["/course"]'::jsonb WHERE profile_id=${f.profileId}`
+    }
+    await f.db
+      .sql`UPDATE app_organization_applications SET status='suspended',review_reason='Test' WHERE organization_id=${f.verifierOrg} AND role='verifier'`
+    try {
+      await expect(
+        recipient.createPresentation(f.sessions.recipient, signed),
+      ).rejects.toMatchObject({ code: 'RECIPIENT_VERIFIER_UNAVAILABLE' })
+    } finally {
+      await f.db
+        .sql`UPDATE app_organization_applications SET status='approved',review_reason=NULL WHERE organization_id=${f.verifierOrg} AND role='verifier'`
+    }
+    const created = await recipient.createPresentation(f.sessions.recipient, signed)
+    await recipient.revokePresentation(f.sessions.recipient, created.id)
+  })
+  it('expires challenges after five minutes, requires a proof for new links and distinguishes unsigned legacy grants from corrupted proofs', async () => {
+    const input = { profileId: f.profileId, generationId: f.generationId, scope: 'public' as const }
+    await expect(
+      recipient.createPresentation(f.sessions.recipient, input as CreatePresentationInput),
+    ).rejects.toMatchObject({ code: 'RECIPIENT_PROOF_REQUIRED' })
+    const signed = await signPresentationInput(
+      recipient,
+      f.sessions.recipient,
+      input,
+      f.subjectWallet,
+    )
+    await f.db
+      .sql`UPDATE app_presentation_challenges SET created_at=statement_timestamp()-interval '6 minutes',expires_at=statement_timestamp()-interval '1 minute' WHERE id=${signed.proof.challengeId}`
+    await expect(recipient.createPresentation(f.sessions.recipient, signed)).rejects.toMatchObject({
+      code: 'RECIPIENT_PROOF_EXPIRED',
+    })
+    const legacy = createAppToken()
+    await f.db
+      .sql`INSERT INTO app_presentations(profile_id,generation_id,recipient_user_id,scope,token_hash) VALUES (${f.profileId},${f.generationId},${f.sessions.recipient.userId},'public',${legacy.tokenHash})`
+    expect((await presentations.resolve(null, legacy.token)).holderProof).toEqual({
+      status: 'not_provided',
+    })
+    const created = await createPresentation(f.sessions.recipient, input)
+    await f.db
+      .sql`UPDATE app_presentation_proofs SET signature=${'0'.repeat(128)} WHERE presentation_id=${created.id}`
+    await expect(presentations.resolve(null, created.token)).rejects.toMatchObject({
+      code: 'PRESENTATION_HOLDER_PROOF_INVALID',
+    })
+  })
+})
diff --git a/apps/web/test/recipient-verifier-runtime.integration.test.ts b/apps/web/test/recipient-verifier-runtime.integration.test.ts
new file mode 100644
index 0000000..cc8c174
--- /dev/null
+++ b/apps/web/test/recipient-verifier-runtime.integration.test.ts
@@ -0,0 +1,333 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { access, mkdir, mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { expect as browserExpect, type Page } from '@playwright/test'
+import { describe, expect, it } from 'vitest'
+import { Wallet } from 'xrpl'
+import { sign } from 'ripple-keypairs'
+import {
+  computeSchemaUid,
+  encodeCredentialPayload,
+  encodeHexUtf8,
+  payloadDigest,
+} from '#xcs/core/index.js'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import { SESSION_COOKIE } from '../server/xcs/auth/http'
+import en from '../i18n/locales/en.json'
+import { startAdminRuntime } from './helpers/adminRuntime'
+
+const enabled = process.env.XCS_RECIPIENT_RUNTIME_TEST === '1'
+const databaseUrl = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (enabled && !databaseUrl) throw new Error('XCS_TEST_DATABASE_URL is required')
+
+async function request(page: Page, path: string, body?: unknown) {
+  return page.evaluate(
+    async ({ path, body }) => {
+      const auth = await fetch('/api/auth/session').then((response) => response.json())
+      const response = await fetch(
+        path,
+        body === undefined
+          ? {}
+          : {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', 'x-xcs-csrf': auth.csrfToken ?? '' },
+              body: JSON.stringify(body),
+            },
+      )
+      const text = await response.text()
+      return {
+        status: response.status,
+        body: response.headers.get('content-type')?.includes('application/json')
+          ? JSON.parse(text)
+          : text,
+        cache: response.headers.get('cache-control'),
+      }
+    },
+    { path, body },
+  )
+}
+
+describe.skipIf(!enabled)('compiled recipient and verifier portals over HTTPS', () => {
+  it('filters anonymous and wrong-audience views, rechecks revoked sharing, and protects history after suspension', async () => {
+    await access(fileURLToPath(new URL('../.output/server/index.mjs', import.meta.url)))
+    const testId = randomUUID().replaceAll('-', ''),
+      databaseName = 'xcs_sharing_runtime_' + testId
+    const base = fileURLToPath(
+      new URL('../../../.data/recipient-verifier-runtime/', import.meta.url),
+    )
+    await mkdir(base, { recursive: true })
+    const directory = await mkdtemp(join(base, 'run-'))
+    let operator: DatabaseClient | undefined,
+      database: DatabaseClient | undefined,
+      authDatabase: DatabaseClient | undefined
+    let runtime: Awaited<ReturnType<typeof startAdminRuntime>> | undefined
+    try {
+      operator = createDatabaseClient(databaseUrl!, { onNotice: () => undefined })
+      await operator.sql`CREATE DATABASE ${operator.sql(databaseName)} TEMPLATE template0`
+      const url = new URL(databaseUrl!)
+      url.pathname = '/' + databaseName
+      database = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+      const passwords = await createManagedRuntimeDatabaseUsers(database, {
+        indexerPassword: randomBytes(32).toString('hex'),
+        apiPassword: randomBytes(32).toString('hex'),
+        payloadWriterPassword: randomBytes(32).toString('hex'),
+        monitorPassword: randomBytes(32).toString('hex'),
+        applicationPassword: randomBytes(32).toString('hex'),
+        adminApplicationPassword: randomBytes(32).toString('hex'),
+        issuerPassword: randomBytes(32).toString('hex'),
+      })
+      await bootstrapDatabase(database, { clusterScope: 'dedicated' })
+      const roleUrl = (role: string, password: string) => {
+        const value = new URL(url)
+        value.username = role
+        value.password = password
+        return value.toString()
+      }
+      authDatabase = createDatabaseClient(roleUrl('xcs_app', passwords.applicationPassword), {
+        onNotice: () => undefined,
+      })
+      const auth = new PostgresAuthRepository(authDatabase)
+      const login = async (subject: string) => {
+        const input = {
+          ...createAppToken(),
+          csrfToken: createAppToken().token,
+          idleSeconds: 1800,
+          absoluteSeconds: 28800,
+        }
+        await auth.createSession(
+          {
+            issuer: 'https://identity.test',
+            subject,
+            email: `${subject}-${testId}@example.test`,
+            emailVerified: true,
+          },
+          input,
+        )
+        return { ...input, userId: (await auth.session(input.tokenHash))!.userId }
+      }
+      const recipient = await login('recipient'),
+        verifier = await login('verifier'),
+        outsider = await login('outsider')
+      const subjectWallet = Wallet.generate()
+      const issuerAddress = Wallet.generate().address,
+        subjectAddress = subjectWallet.address
+      const profileId = 'sharing-runtime',
+        ledgerHash = 'd'.repeat(64),
+        generationId = 'c'.repeat(64),
+        registrationHash = 'b'.repeat(64)
+      const definition = {
+        xcsVersion: '0.1' as const,
+        name: 'Runtime shared credential',
+        description: 'Synthetic authoritative projection',
+        fields: { course: { type: 'string' as const }, secret: { type: 'string' as const } },
+      }
+      const schemaUid = computeSchemaUid({
+        schema: definition,
+        networkId: 1,
+        ledgerHash,
+        ledgerIndex: 1,
+        transactionIndex: 0,
+        publisher: issuerAddress,
+      })
+      const payload = encodeCredentialPayload(
+        { course: 'VISIBLE PUBLIC COURSE', secret: 'PRIVATE AUTHORIZED CLAIM' },
+        { issuer: issuerAddress, subject: subjectAddress, schemaUid, fields: definition.fields },
+      )
+      const digest = payloadDigest(payload.bytes),
+        locator = digest.slice(0, 18),
+        uri = `https://example.test/q/${locator}#xcs-sha256=${digest}`
+      const canonical = new TextDecoder().decode(payload.bytes)
+      const issuerOrg = randomUUID(),
+        verifierOrg = randomUUID(),
+        outsiderOrg = randomUUID(),
+        inviteId = randomUUID(),
+        payloadId = randomUUID()
+      // Only identities and ledger evidence are seeded. Routes, authorization, rendering and
+      // PostgreSQL permissions run in the actual compiled application, without dev fixtures.
+      await database.sql`INSERT INTO network_profiles(profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash) VALUES (${profileId},'0.1',1,${ledgerHash},${issuerAddress},1,1,${ledgerHash})`
+      await database.sql`INSERT INTO ledger_checkpoints(profile_id,ledger_index,ledger_hash,parent_hash,close_time,transaction_count,transaction_root) VALUES (${profileId},10,${ledgerHash},${'e'.repeat(64)},${Math.floor(Date.now() / 1000) - 946684800},2,${'f'.repeat(64)})`
+      await database.sql`INSERT INTO indexer_status(profile_id,state,primary_source_tip,secondary_source_tip,last_agreed_ledger_index,last_agreed_ledger_hash,writer_id,writer_epoch,lease_expires_at) VALUES (${profileId},'ready',10,10,10,${ledgerHash},'sharing-runtime-writer',1,now()+interval '5 minutes')`
+      await database.sql`INSERT INTO schema_events(profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profileId},${registrationHash},1,${ledgerHash},0,${issuerAddress},'accepted',${schemaUid},${JSON.stringify(definition)}::jsonb)`
+      await database.sql`INSERT INTO schemas(profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profileId},${schemaUid},${issuerAddress},${definition.name},${definition.description},${JSON.stringify(definition)}::jsonb,${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,${registrationHash},1,0)`
+      await database.sql`INSERT INTO credential_generations(profile_id,generation_id,ledger_object_id,issuer,subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index) VALUES (${profileId},${generationId},${'e'.repeat(64)},${issuerAddress},${subjectAddress},${schemaUid},${encodeHexUtf8(uri)},true,2,0,2)`
+      await database.sql`INSERT INTO app_organizations(id,responsible_user_id,name) VALUES (${issuerOrg},${recipient.userId},'Runtime issuer'),(${verifierOrg},${verifier.userId},'Runtime designated verifier'),(${outsiderOrg},${outsider.userId},'Runtime other verifier')`
+      await database.sql`INSERT INTO app_organization_applications(organization_id,role,status,reviewed_by,reviewed_at) VALUES (${verifierOrg},'verifier','approved',${recipient.userId},now()),(${outsiderOrg},'verifier','approved',${recipient.userId},now())`
+      await database.sql`INSERT INTO app_schema_metadata(profile_id,schema_uid,organization_id,registration_transaction_hash) VALUES (${profileId},${schemaUid},${issuerOrg},${registrationHash})`
+      await database.sql`INSERT INTO app_invites(id,organization_id,profile_id,schema_uid,created_by,expires_at,claimed_by,claimed_at) VALUES (${inviteId},${issuerOrg},${profileId},${schemaUid},${recipient.userId},now()+interval '7 days',${recipient.userId},now())`
+      await database.sql`INSERT INTO app_issuer_payloads(id,locator,invite_id,created_by,subject_address,canonical_payload,payload_digest,credential_uri,visibility,public_fields) VALUES (${payloadId},${locator},${inviteId},${recipient.userId},${subjectAddress},${canonical},${digest},${uri},'private','["/course"]')`
+      await database.sql`INSERT INTO app_credential_metadata(profile_id,generation_id,schema_uid,issuer_organization_id,recipient_user_id,invite_id,issuer_address,subject_address,visibility,public_fields,payload_storage_key,payload_digest,creation_transaction_hash,creation_ledger_index) VALUES (${profileId},${generationId},${schemaUid},${issuerOrg},${recipient.userId},${inviteId},${issuerAddress},${subjectAddress},'private','["/course"]',${payloadId},${digest},${generationId},2)`
+      runtime = await startAdminRuntime(
+        directory,
+        {
+          api: roleUrl('xcs_api', passwords.apiPassword),
+          auth: roleUrl('xcs_app', passwords.applicationPassword),
+          admin: roleUrl('xcs_admin_app', passwords.adminApplicationPassword),
+        },
+        { issuerDatabaseUrl: roleUrl('xcs_issuer', passwords.issuerPassword), smtpPort: 5531 },
+      )
+      const context = runtime.context,
+        page = await context.newPage()
+      const signIn = async (user?: typeof recipient) => {
+        await context.clearCookies()
+        if (user)
+          await context.addCookies([
+            {
+              name: SESSION_COOKIE,
+              value: user.token,
+              url: runtime!.origin,
+              httpOnly: true,
+              secure: true,
+              sameSite: 'Lax',
+            },
+          ])
+        // The cookie is a login fixture. Navigate as a completed login would, so an old
+        // component's identity-change guard does not intentionally cancel the next action.
+        await page.goto(runtime!.origin + '/')
+      }
+      await signIn(recipient)
+      await database.sql`INSERT INTO app_wallets(user_id,network_id,address,verified_at) VALUES (${recipient.userId},1,${subjectAddress},statement_timestamp())`
+      await page.goto(runtime.origin + '/recipient')
+      await browserExpect(page.getByText(definition.name, { exact: true })).toBeVisible()
+      const createPresentation = async (input: Record<string, unknown>) => {
+        const challenge = await request(page, '/api/recipient/presentation-challenges', input)
+        expect(challenge.status).toBe(200)
+        expect(challenge.body.address).toBe(subjectAddress)
+        return request(page, '/api/recipient/presentations', {
+          ...input,
+          proof: {
+            challengeId: challenge.body.id,
+            signature: sign(
+              Buffer.from(challenge.body.message, 'utf8').toString('hex'),
+              subjectWallet.privateKey,
+            ),
+            publicKey: subjectWallet.publicKey,
+            scheme: 'ripple',
+          },
+        })
+      }
+      const full = await createPresentation({
+        profileId,
+        generationId,
+        scope: 'full',
+        verifierOrganizationId: verifierOrg,
+      })
+      expect(full.status, JSON.stringify(full.body)).toBe(200)
+      const publicLink = await createPresentation({
+        profileId,
+        generationId,
+        scope: 'public',
+      })
+      expect(publicLink.status, JSON.stringify(publicLink.body)).toBe(200)
+      const paths: string[] = []
+      page.on('request', (request) => paths.push(request.url()))
+      const openPresentation = async (token: string) => {
+        await page.goto(runtime!.origin + '/presentations#' + token)
+        await browserExpect(page.getByTestId('presentation-result')).toBeVisible()
+      }
+      await signIn()
+      await openPresentation(publicLink.body.token)
+      await browserExpect(page.getByTestId('presentation-result')).toContainText(
+        'VISIBLE PUBLIC COURSE',
+      )
+      await browserExpect(page.getByTestId('presentation-result')).not.toContainText(
+        'PRIVATE AUTHORIZED CLAIM',
+      )
+      expect(new URL(page.url()).hash).toBe('')
+      // A second fragment in the same document must replace the previous link immediately.
+      // Keep this transition within one anonymous session, independently of login fixtures.
+      await openPresentation(full.body.token)
+      await browserExpect(page.getByTestId('presentation-result')).toContainText(
+        'VISIBLE PUBLIC COURSE',
+      )
+      await browserExpect(page.getByTestId('presentation-result')).not.toContainText(
+        'PRIVATE AUTHORIZED CLAIM',
+      )
+      const anonymous = await request(page, '/api/presentations/resolve', {
+        token: full.body.token,
+      })
+      expect(anonymous.body.requiresAuthorization).toBe(true)
+      expect(anonymous.body.claims).toEqual({ course: 'VISIBLE PUBLIC COURSE' })
+      await signIn(outsider)
+      await openPresentation(full.body.token)
+      await browserExpect(page.getByTestId('presentation-result')).not.toContainText(
+        'PRIVATE AUTHORIZED CLAIM',
+      )
+      expect((await request(page, '/api/verifier/workspace')).body.history).toEqual([])
+      await signIn(verifier)
+      await openPresentation(full.body.token)
+      await browserExpect(page.getByTestId('presentation-result')).toContainText(
+        'PRIVATE AUTHORIZED CLAIM',
+      )
+      const workspace = await request(page, '/api/verifier/workspace')
+      expect(workspace.body.history).toHaveLength(1)
+      expect(JSON.stringify(workspace.body)).not.toContain('PRIVATE AUTHORIZED CLAIM')
+      expect(JSON.stringify(workspace.body)).not.toContain(full.body.token)
+      const historyId = workspace.body.history[0].id
+      const withoutCsrf = await page.evaluate(async (id) => {
+        const response = await fetch(`/api/verifier/history/${id}/presentation`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: '{}',
+        })
+        return response.status
+      }, historyId)
+      expect(withoutCsrf).toBe(403)
+      const accidentalGet = await request(page, `/api/verifier/history/${historyId}/presentation`)
+      // Nitro's catch-all turns an unmatched nested-router method into an empty 204.
+      // It must neither disclose claims nor create a consultation record.
+      expect(accidentalGet.status).toBe(204)
+      expect(accidentalGet.body).toBe('')
+      expect((await request(page, '/api/verifier/workspace')).body.history).toHaveLength(1)
+      const csv = await request(page, '/api/verifier/history.csv')
+      expect(csv.status).toBe(200)
+      expect(csv.body).not.toContain('PRIVATE AUTHORIZED CLAIM')
+      expect(csv.cache).toBe('private, no-store')
+      await page.goto(runtime.origin + '/verifier')
+      await browserExpect(
+        page.getByRole('heading', { name: en.verifier.history, exact: true }),
+      ).toBeVisible()
+      await page.getByRole('button', { name: en.verifier.reopen, exact: true }).click()
+      await browserExpect(page.getByTestId('presentation-result')).toContainText(
+        'PRIVATE AUTHORIZED CLAIM',
+      )
+      await signIn(recipient)
+      expect(
+        (await request(page, `/api/recipient/presentations/${full.body.id}/revoke`, {})).status,
+      ).toBe(200)
+      await signIn(verifier)
+      expect(
+        (await request(page, `/api/verifier/history/${historyId}/presentation`, {})).status,
+      ).toBe(404)
+      expect(
+        (await request(page, '/api/presentations/resolve', { token: full.body.token })).status,
+      ).toBe(404)
+      await database.sql`UPDATE app_organization_applications SET status='suspended',review_reason='Runtime suspension' WHERE organization_id=${verifierOrg}`
+      expect((await request(page, '/api/verifier/workspace')).body.history).toEqual([])
+      expect((await request(page, '/api/verifier/history.csv')).status).toBe(403)
+      await page.goto(runtime.origin + '/verifier')
+      await browserExpect(
+        page.getByRole('heading', { name: en.verifier.history, exact: true }),
+      ).not.toBeVisible()
+      expect(
+        paths.some(
+          (path) => path.includes(full.body.token) || path.includes(publicLink.body.token),
+        ),
+      ).toBe(false)
+    } finally {
+      await runtime?.close()
+      await Promise.all([authDatabase?.close(), database?.close()])
+      if (operator && /^xcs_sharing_runtime_[a-f0-9]{32}$/.test(databaseName))
+        await operator.sql`DROP DATABASE IF EXISTS ${operator.sql(databaseName)} WITH (FORCE)`
+      await operator?.close()
+      await rm(directory, { recursive: true, force: true })
+    }
+  }, 90000)
+})
diff --git a/apps/web/test/recipientPayload.test.ts b/apps/web/test/recipientPayload.test.ts
new file mode 100644
index 0000000..2689a2e
--- /dev/null
+++ b/apps/web/test/recipientPayload.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from 'vitest'
+import { canonicalJson, payloadDigest } from '#xcs/core/index.js'
+import { readRecipientPayload } from '../app/utils/recipientPayload'
+import { authReturnPath } from '../app/utils/portalRoutes'
+
+const content = canonicalJson({ synthetic: 'private' })
+const uri = `https://xcs.test/q/${'a'.repeat(18)}#xcs-sha256=${payloadDigest(content)}`
+
+describe('private recipient payload transport', () => {
+  it('reads canonical digest-checked bytes with same-origin cookies and no redirects/referrer', async () => {
+    const fetchImpl = vi.fn(
+      async () =>
+        new Response(content, {
+          headers: { 'content-type': 'application/json', 'x-xcs-claim-scope': 'full' },
+        }),
+    )
+    const result = await readRecipientPayload({ credentialUri: uri, fetchImpl }, 'https://xcs.test')
+    expect(result.content).toBe(content)
+    expect(fetchImpl).toHaveBeenCalledWith(
+      uri.split('#')[0],
+      expect.objectContaining({
+        credentials: 'same-origin',
+        mode: 'same-origin',
+        redirect: 'error',
+        referrerPolicy: 'no-referrer',
+        cache: 'no-store',
+      }),
+    )
+  })
+  it.each([
+    uri.replace('xcs.test', 'external.test'),
+    uri.replace('/q/', '/p/'),
+    uri.replace('/q/', '/api/'),
+    uri.replace('#', '?download=true#'),
+    uri.replace('https:', 'http:'),
+  ])('rejects non-managed locations before any request: %s', async (credentialUri) => {
+    const fetchImpl = vi.fn()
+    await expect(async () =>
+      readRecipientPayload({ credentialUri, fetchImpl }, 'https://xcs.test'),
+    ).rejects.toThrow()
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+  it('refuses filtered claims and altered canonical bytes', async () => {
+    await expect(
+      readRecipientPayload(
+        {
+          credentialUri: uri,
+          fetchImpl: async () =>
+            new Response(content, {
+              headers: { 'content-type': 'application/json', 'x-xcs-claim-scope': 'public' },
+            }),
+        },
+        'https://xcs.test',
+      ),
+    ).rejects.toThrow('PAYLOAD_SCOPE_RESTRICTED')
+    await expect(
+      readRecipientPayload(
+        {
+          credentialUri: uri,
+          fetchImpl: async () =>
+            new Response('{}', {
+              headers: { 'content-type': 'application/json' },
+            }),
+        },
+        'https://xcs.test',
+      ),
+    ).rejects.toThrow('PAYLOAD_DIGEST_MISMATCH')
+  })
+})
+
+describe('authentication return destinations', () => {
+  it.each(['/account', '/recipient/invitations', '/fr/presentations', '/verifier/apply'])(
+    'accepts the fixed destination %s',
+    (path) => expect(authReturnPath(path)).toBe(path),
+  )
+  it.each([
+    'https://evil.test',
+    '//evil.test',
+    '/presentations#secret',
+    '/account?next=//evil.test',
+    '/fr//evil.test',
+    ['//evil.test'],
+    undefined,
+  ])('rejects arbitrary or token-bearing return values', (path) =>
+    expect(authReturnPath(path)).toBe('/account'),
+  )
+})
diff --git a/apps/web/test/role-journey-postgres.integration.test.ts b/apps/web/test/role-journey-postgres.integration.test.ts
new file mode 100644
index 0000000..0009752
--- /dev/null
+++ b/apps/web/test/role-journey-postgres.integration.test.ts
@@ -0,0 +1,108 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { createRecipientDatabase } from './helpers/recipientDatabase'
+import { IssuerRepository } from '../server/xcs/issuer/repository'
+import { issuerAdmission } from '../server/xcs/presentations/admission'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+
+describe.skipIf(!url)(
+  'issuer admission and recipient readiness through restricted PostgreSQL',
+  () => {
+    let fixture: Awaited<ReturnType<typeof createRecipientDatabase>>
+    let issuer: IssuerRepository
+    beforeAll(async () => {
+      fixture = await createRecipientDatabase(url!)
+      issuer = new IssuerRepository(fixture.portal, {
+        origin: 'https://xcs.test',
+        inviteDays: 7,
+        documents: {
+          write: async () => {
+            throw new Error('UNEXPECTED_DOCUMENT_WRITE')
+          },
+          remove: async () => {},
+        },
+        notify: async () => {
+          throw new Error('UNEXPECTED_DELIVERY')
+        },
+      })
+    }, 30000)
+    afterAll(async () => {
+      await fixture?.close()
+    })
+
+    it('reports current issuer admission separately from verifier approval and historical claims', async () => {
+      const approved = await issuerAdmission(fixture.portal.db, fixture.issuerOrg)
+      expect(approved.status).toBe('approved')
+      expect(Date.parse(approved.checkedAt)).toBeGreaterThan(0)
+      expect(approved.reviewedAt).not.toBeNull()
+      expect(await issuerAdmission(fixture.portal.db, fixture.verifierOrg)).toMatchObject({
+        status: 'unknown',
+      })
+      await fixture.db
+        .sql`UPDATE app_organization_applications SET status='suspended',review_reason='Synthetic pause' WHERE organization_id=${fixture.issuerOrg} AND role='issuer'`
+      expect(await issuerAdmission(fixture.portal.db, fixture.issuerOrg)).toMatchObject({
+        status: 'suspended',
+      })
+      await fixture.db
+        .sql`UPDATE app_organization_applications SET status='approved',review_reason=NULL WHERE organization_id=${fixture.issuerOrg} AND role='issuer'`
+      await fixture.db
+        .sql`UPDATE app_organizations SET status='closed' WHERE id=${fixture.issuerOrg}`
+      expect(await issuerAdmission(fixture.portal.db, fixture.issuerOrg)).toMatchObject({
+        status: 'not_approved',
+      })
+      await fixture.db
+        .sql`UPDATE app_organizations SET status='active' WHERE id=${fixture.issuerOrg}`
+    })
+
+    it('distinguishes invitation, claimed without wallet, ready, and unavailable states without private claims', async () => {
+      const id = randomUUID()
+      await fixture.db
+        .sql`INSERT INTO app_invites(id,organization_id,profile_id,schema_uid,token_hash,created_by,expires_at,delivery_email)
+      VALUES (${id},${fixture.issuerOrg},${fixture.profileId},${fixture.schemaUid},${randomBytes(32).toString('hex')},${fixture.sessions.issuer.userId},statement_timestamp()+interval '7 days','delivery@example.invalid')`
+      const current = async () =>
+        (await issuer.workspace(fixture.sessions.issuer)).invites.find((row) => row.id === id)!
+      expect(await current()).toMatchObject({
+        recipientStatus: 'invited',
+        recipientWalletVerifiedAt: null,
+      })
+      await fixture.db
+        .sql`UPDATE app_invites SET claimed_by=${fixture.sessions.recipient.userId},claimed_at=statement_timestamp() WHERE id=${id}`
+      await fixture.db
+        .sql`UPDATE app_wallets SET revoked_at=statement_timestamp() WHERE user_id=${fixture.sessions.recipient.userId}`
+      expect(await current()).toMatchObject({
+        recipientStatus: 'wallet_required',
+        recipientWalletVerifiedAt: null,
+      })
+      await fixture.db
+        .sql`UPDATE app_wallets SET revoked_at=NULL WHERE user_id=${fixture.sessions.recipient.userId}`
+      const ready = await current()
+      expect(ready.recipientStatus).toBe('ready')
+      expect(Date.parse(ready.recipientWalletVerifiedAt!)).toBeGreaterThan(0)
+      const context = await issuer.issuance(fixture.sessions.issuer, id)
+      expect(context.invite.deliveryEmail).toBe('delivery@example.invalid')
+      expect(context.recipient.wallets).toContainEqual(
+        expect.objectContaining({
+          address: fixture.subjectAddress,
+          networkId: 1,
+          verifiedAt: expect.any(String),
+        }),
+      )
+      await fixture.db.sql`UPDATE app_invites SET revoked_at=statement_timestamp() WHERE id=${id}`
+      expect((await current()).recipientStatus).toBe('unavailable')
+      expect(JSON.stringify(await current())).not.toContain('canonical_payload')
+      await expect(
+        issuer.workspace(fixture.sessions.other, fixture.issuerOrg),
+      ).rejects.toMatchObject({ statusCode: 404 })
+    })
+
+    it('identifies already issued invitations instead of offering another issuance', async () => {
+      const row = (await issuer.workspace(fixture.sessions.issuer)).invites.find(
+        (row) => row.id === fixture.inviteId,
+      )
+      expect(row?.recipientStatus).toBe('issued')
+    })
+  },
+)
diff --git a/apps/web/test/role-journey-runtime.integration.test.ts b/apps/web/test/role-journey-runtime.integration.test.ts
new file mode 100644
index 0000000..0fc473e
--- /dev/null
+++ b/apps/web/test/role-journey-runtime.integration.test.ts
@@ -0,0 +1,546 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { access, mkdir, mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { Wallet } from 'xrpl'
+import { installJourneyLedger, installJourneyWallet } from './helpers/roleJourneyWallet'
+import en from '../i18n/locales/en.json'
+import { expect as browserExpect, type Page } from '@playwright/test'
+import { describe, expect, it } from 'vitest'
+import { computeSchemaUid } from '#xcs/core/index.js'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import { SESSION_COOKIE } from '../server/xcs/auth/http'
+import { startAdminRuntime } from './helpers/adminRuntime'
+
+const enabled = process.env.XCS_ROLE_JOURNEY_RUNTIME_TEST === '1'
+const databaseUrl = process.env.XCS_TEST_DATABASE_URL?.trim()
+const smtpPort = Number(process.env.XCS_ISSUER_RUNTIME_SMTP_PORT ?? '5531')
+const mailpitOrigin = process.env.XCS_ISSUER_RUNTIME_MAILPIT_ORIGIN ?? 'http://127.0.0.1:8031'
+if (enabled && !databaseUrl) throw new Error('XCS_TEST_DATABASE_URL is required')
+
+/** Actual browser fetches: browser-owned Secure cookies, Origin and shared CSRF contract. */
+async function request(page: Page, path: string, body?: unknown) {
+  return page.evaluate(
+    async ({ path, body }) => {
+      const auth = await fetch('/api/auth/session').then((response) => response.json())
+      const response = await fetch(
+        path,
+        body === undefined
+          ? {}
+          : {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', 'x-xcs-csrf': auth.csrfToken ?? '' },
+              body: JSON.stringify(body),
+            },
+      )
+      return {
+        status: response.status,
+        body: await response.json(),
+        cache: response.headers.get('cache-control'),
+      }
+    },
+    { path, body },
+  )
+}
+
+describe.skipIf(!enabled)(
+  'connected role journey in compiled HTTPS with real PostgreSQL and synthetic XRPL transports',
+  () => {
+    it('connects approval, invitation, signed wallet linkage, issuance, signed acceptance and verifier presentation', async () => {
+      await access(fileURLToPath(new URL('../.output/server/index.mjs', import.meta.url)))
+      const smtpUi = new URL(mailpitOrigin)
+      if (
+        smtpUi.protocol !== 'http:' ||
+        !['127.0.0.1', 'localhost'].includes(smtpUi.hostname) ||
+        smtpUi.username ||
+        smtpUi.password
+      )
+        throw new Error('Runtime tests require local Mailpit')
+      const testId = randomUUID().replaceAll('-', '')
+      const databaseName = 'xcs_role_journey_' + testId
+      const base = fileURLToPath(new URL('../../../.data/role-journey-runtime/', import.meta.url))
+      await mkdir(base, { recursive: true })
+      const directory = await mkdtemp(join(base, 'run-'))
+      let operator: DatabaseClient | undefined,
+        database: DatabaseClient | undefined,
+        authDatabase: DatabaseClient | undefined
+      let runtime: Awaited<ReturnType<typeof startAdminRuntime>> | undefined
+      try {
+        operator = createDatabaseClient(databaseUrl!, { onNotice: () => undefined })
+        await operator.sql`CREATE DATABASE ${operator.sql(databaseName)} TEMPLATE template0`
+        const url = new URL(databaseUrl!)
+        url.pathname = '/' + databaseName
+        database = createDatabaseClient(url.toString(), { onNotice: () => undefined })
+        const passwords = await createManagedRuntimeDatabaseUsers(database, {
+          indexerPassword: randomBytes(32).toString('hex'),
+          apiPassword: randomBytes(32).toString('hex'),
+          payloadWriterPassword: randomBytes(32).toString('hex'),
+          monitorPassword: randomBytes(32).toString('hex'),
+          applicationPassword: randomBytes(32).toString('hex'),
+          adminApplicationPassword: randomBytes(32).toString('hex'),
+          issuerPassword: randomBytes(32).toString('hex'),
+        })
+        await bootstrapDatabase(database, { clusterScope: 'dedicated' })
+        const roleUrl = (role: string, password: string) => {
+          const value = new URL(url)
+          value.username = role
+          value.password = password
+          return value.toString()
+        }
+        authDatabase = createDatabaseClient(roleUrl('xcs_app', passwords.applicationPassword), {
+          onNotice: () => undefined,
+        })
+        const auth = new PostgresAuthRepository(authDatabase)
+        const login = async (subject: string) => {
+          const input = {
+            ...createAppToken(),
+            csrfToken: createAppToken().token,
+            idleSeconds: 1800,
+            absoluteSeconds: 28800,
+          }
+          await auth.createSession(
+            {
+              issuer: 'https://identity.test',
+              subject,
+              email: `${subject}-${testId}@example.test`,
+              emailVerified: true,
+              displayName: `Synthetic ${subject}`,
+            },
+            input,
+          )
+          return { ...input, userId: (await auth.session(input.tokenHash))!.userId }
+        }
+        const issuer = await login('issuer'),
+          recipient = await login('recipient'),
+          admin = await login('admin'),
+          verifier = await login('verifier')
+        await database.sql`INSERT INTO app_user_roles(user_id,role) VALUES (${admin.userId},'admin')`
+        const issuerWallet = Wallet.generate(),
+          recipientWallet = Wallet.generate()
+        const issuerAddress = issuerWallet.classicAddress,
+          subjectAddress = recipientWallet.classicAddress
+        const profileId = 'issuer-runtime',
+          registrationHash = 'b'.repeat(64),
+          ledgerHash = 'd'.repeat(64)
+        let generationId = ''
+        const definition = {
+          xcsVersion: '0.1' as const,
+          name: 'Synthetic runtime schema',
+          description: 'Fixture-only validated projection',
+          fields: { course: { type: 'string' as const }, secret: { type: 'string' as const } },
+        }
+        const schemaUid = computeSchemaUid({
+          schema: definition,
+          networkId: 1,
+          ledgerHash,
+          ledgerIndex: 1,
+          transactionIndex: 0,
+          publisher: issuerAddress,
+        })
+        // Seed the existing registry and authoritative indexer checkpoint only. Both credential
+        // projections are created later in the RPC fixture, after real signed blob submission.
+        await database.sql`INSERT INTO network_profiles(profile_id,xcs_version,network_id,required_amendment,registry_address,registration_amount_drops,activation_ledger_index,activation_ledger_hash) VALUES (${profileId},'0.1',1,${ledgerHash},${issuerAddress},1,1,${ledgerHash})`
+        await database.sql`INSERT INTO schema_events(profile_id,transaction_hash,ledger_index,ledger_hash,transaction_index,publisher,status,schema_uid,memo_json) VALUES (${profileId},${registrationHash},1,${ledgerHash},0,${issuerAddress},'accepted',${schemaUid},${JSON.stringify(definition)}::jsonb)`
+        await database.sql`INSERT INTO schemas(profile_id,schema_uid,publisher,name,description,definition,resolved_definition,registration_transaction_hash,ledger_index,transaction_index) VALUES (${profileId},${schemaUid},${issuerAddress},${definition.name},${definition.description},${JSON.stringify(definition)}::jsonb,${JSON.stringify({ definition, fields: definition.fields, lineage: [] })}::jsonb,${registrationHash},1,0)`
+        await database.sql`INSERT INTO ledger_checkpoints(profile_id,ledger_index,ledger_hash,parent_hash,close_time,transaction_count,transaction_root) VALUES (${profileId},10,${ledgerHash},${'e'.repeat(64)},${Math.floor(Date.now() / 1000) - 946684800},2,${'f'.repeat(64)})`
+        await database.sql`INSERT INTO indexer_status(profile_id,state,primary_source_tip,secondary_source_tip,last_agreed_ledger_index,last_agreed_ledger_hash,writer_id,writer_epoch,lease_expires_at) VALUES (${profileId},'ready',10,10,10,${ledgerHash},'journey-fixture-writer',1,now()+interval '5 minutes')`
+        runtime = await startAdminRuntime(
+          directory,
+          {
+            api: roleUrl('xcs_api', passwords.apiPassword),
+            auth: roleUrl('xcs_app', passwords.applicationPassword),
+            admin: roleUrl('xcs_admin_app', passwords.adminApplicationPassword),
+          },
+          { issuerDatabaseUrl: roleUrl('xcs_issuer', passwords.issuerPassword), smtpPort },
+        )
+        const context = runtime.context
+        const walletTransport = await installJourneyWallet(context, issuerWallet)
+        let acceptedHash: string | undefined
+        const ledgerTransport = await installJourneyLedger(context, {
+          amendment: ledgerHash,
+          ledgerHash,
+          project: async (transaction, hash) => {
+            if (transaction.TransactionType === 'CredentialCreate') {
+              expect(transaction).toMatchObject({
+                Account: issuerAddress,
+                Subject: subjectAddress,
+                CredentialType: schemaUid.toUpperCase(),
+              })
+              expect(generationId).toBe('')
+              generationId = hash
+              const uriHex = String(transaction.URI)
+              // Explicit indexer fixture only. The actual issuer UI must prepare its private
+              // payload, sign this blob and submit it before a created projection can exist.
+              await database!
+                .sql`INSERT INTO credential_generations(profile_id,generation_id,ledger_object_id,issuer,subject,schema_uid,uri_hex,accepted,created_ledger_index,created_transaction_index,last_ledger_index) VALUES (${profileId},${generationId},${'e'.repeat(64)},${issuerAddress},${subjectAddress},${schemaUid},${uriHex},false,2,0,2)`
+              await database!
+                .sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,uri_hex,accepted,snapshot) VALUES (${profileId},${generationId},0,${generationId},${'e'.repeat(64)},2,${ledgerHash},0,'created',${issuerAddress},${subjectAddress},${schemaUid},${uriHex},false,'{}')`
+              return
+            }
+            expect(transaction).toMatchObject({
+              TransactionType: 'CredentialAccept',
+              Account: subjectAddress,
+              Issuer: issuerAddress,
+              CredentialType: schemaUid.toUpperCase(),
+            })
+            expect(generationId).toMatch(/^[0-9a-f]{64}$/)
+            await database!
+              .sql`UPDATE credential_generations SET accepted=true,last_ledger_index=3 WHERE profile_id=${profileId} AND generation_id=${generationId} AND accepted=false`
+            await database!
+              .sql`INSERT INTO credential_events(profile_id,transaction_hash,node_index,generation_id,ledger_object_id,ledger_index,ledger_hash,transaction_index,event_type,issuer,subject,schema_uid,accepted,snapshot) VALUES (${profileId},${hash},0,${generationId},${'e'.repeat(64)},3,${ledgerHash},0,'accepted',${issuerAddress},${subjectAddress},${schemaUid},true,'{}')`
+            acceptedHash = hash
+          },
+        })
+        const signIn = async (value: typeof issuer) => {
+          await context.clearCookies()
+          await context.addCookies([
+            {
+              name: SESSION_COOKIE,
+              value: value.token,
+              url: runtime!.origin,
+              httpOnly: true,
+              secure: true,
+              sameSite: 'Lax',
+            },
+          ])
+          await page.goto(runtime!.origin + '/')
+        }
+        const page = await context.newPage()
+        await signIn(issuer)
+        const application = (name: string) => ({
+          name,
+          website: 'https://school.example.test',
+          contact: 'responsible@example.test',
+          jurisdiction: 'France',
+          description: 'Synthetic connected journey',
+          purpose: 'Synthetic credential lifecycle',
+          documents: [
+            {
+              mimeType: 'application/pdf',
+              base64: Buffer.from('%PDF-1.4\nSynthetic evidence\n%%EOF').toString('base64'),
+            },
+          ],
+        })
+        const applied = await request(
+          page,
+          '/api/issuer/applications',
+          application('Journey school'),
+        )
+        expect(applied.status).toBe(200)
+        const organizationId = applied.body.organizationId as string
+        const connectWallet = async (prefix = 'wallet') => {
+          await page.getByTestId(`${prefix}-toggle`).click()
+          await page.locator('[data-wallet-id="gemwallet"]').last().click()
+        }
+        const linkWallet = async (wallet: typeof issuerWallet) => {
+          walletTransport.select(wallet)
+          await page.goto(runtime!.origin + '/account')
+          await connectWallet('wallet-link')
+          await browserExpect(page.getByTestId('auth-link-wallet')).toBeEnabled()
+          await page.getByTestId('auth-link-wallet').click()
+          await page.getByText(en.simpleRecipient.manageWallet, { exact: true }).click()
+          await browserExpect(page.getByTestId('linked-wallets')).toBeVisible()
+          await browserExpect(page.getByTestId('linked-wallets')).toContainText(
+            wallet.classicAddress,
+          )
+        }
+        await linkWallet(issuerWallet)
+        expect(
+          (
+            await request(page, '/api/issuer/schemas', {
+              organizationId,
+              profileId,
+              transactionHash: registrationHash,
+            })
+          ).status,
+        ).toBe(403)
+        await signIn(admin)
+        expect(
+          (
+            await request(page, `/api/admin/applications/${organizationId}/issuer/decisions`, {
+              action: 'approve',
+              revision: 0,
+              reason: '',
+              idempotencyKey: randomUUID(),
+            })
+          ).status,
+        ).toBe(200)
+        await signIn(verifier)
+        const verifierApplication = await request(
+          page,
+          '/api/verifier/applications',
+          application('Journey verifier'),
+        )
+        expect(verifierApplication.status).toBe(200)
+        const verifierOrg = verifierApplication.body.organizationId as string
+        await signIn(admin)
+        expect(
+          (
+            await request(page, `/api/admin/applications/${verifierOrg}/verifier/decisions`, {
+              action: 'approve',
+              revision: 0,
+              reason: '',
+              idempotencyKey: randomUUID(),
+            })
+          ).status,
+        ).toBe(200)
+        await signIn(issuer)
+        expect(
+          (
+            await request(page, '/api/issuer/schemas', {
+              organizationId,
+              profileId,
+              transactionHash: registrationHash,
+              displayName: 'Runtime course',
+            })
+          ).status,
+        ).toBe(200)
+        const email = `invited-${testId}@example.test`
+        const sent = await request(page, '/api/issuer/invites', {
+          organizationId,
+          profileId,
+          schemaUid,
+          email,
+          message: 'Synthetic invitation only',
+        })
+        expect(sent.status).toBe(200)
+        expect(sent.body.deliveryStatus).toBe('sent')
+        const inviteId = sent.body.id as string
+        // Mailpit's documented rendered-text endpoint is filtered by our unique synthetic recipient.
+        const textUrl = new URL('/view/latest.txt', mailpitOrigin)
+        textUrl.searchParams.set('query', 'to:' + email)
+        let message = ''
+        await browserExpect
+          .poll(async () => {
+            const response = await fetch(textUrl)
+            message = response.ok ? await response.text() : ''
+            return message.includes('/recipient/invitations#')
+          })
+          .toBe(true)
+        const link = message.match(
+          /https:\/\/[^\s]+\/recipient\/invitations#[A-Za-z0-9_-]{43}/,
+        )?.[0]
+        expect(Boolean(link)).toBe(true)
+        expect(message).not.toContain('Synthetic private evidence')
+        await signIn(recipient)
+        await page.goto(link!)
+        await browserExpect(
+          page.getByRole('button', { name: 'Claim with this account', exact: true }),
+        ).toBeVisible()
+        expect(new URL(page.url()).hash).toBe('')
+        await page.getByRole('button', { name: 'Claim with this account', exact: true }).click()
+        await browserExpect
+          .poll(
+            async () =>
+              (await database!.sql`SELECT claimed_by FROM app_invites WHERE id=${inviteId}`)[0]
+                ?.claimed_by,
+          )
+          .toBe(recipient.userId)
+        await linkWallet(recipientWallet)
+        const [claimed] =
+          await database.sql`SELECT claimed_by FROM app_invites WHERE id=${inviteId}`
+        expect(claimed!.claimed_by).toBe(recipient.userId)
+        await signIn(issuer)
+        await page.goto(runtime.origin + '/issuer')
+        const readiness = await request(page, `/api/issuer/invites/${inviteId}/issuance`)
+        expect(readiness.status).toBe(200)
+        expect(readiness.body.recipient.wallets).toEqual([
+          expect.objectContaining({ address: subjectAddress, networkId: 1 }),
+        ])
+        expect(readiness.body.issuerWallets).toEqual([
+          expect.objectContaining({ address: issuerAddress, networkId: 1 }),
+        ])
+        walletTransport.select(issuerWallet)
+        await page.goto(runtime.origin + `/issuer/issue/${inviteId}`)
+        await connectWallet()
+        await browserExpect(page.locator('#claim-course')).toBeVisible()
+        await page.locator('#claim-course').fill('Public runtime course')
+        await page.locator('#claim-secret').fill('PRIVATE RUNTIME CLAIM')
+        await browserExpect(page.locator('#claims')).toHaveCount(0)
+        await page.getByRole('checkbox', { name: 'course', exact: true }).check()
+        await page.getByRole('button', { name: en.simpleIssuer.reviewIssue, exact: true }).click()
+        await browserExpect(page.getByTestId('transaction-preview')).toContainText(
+          en.simpleUi.signActions.issue,
+        )
+        await browserExpect(page.getByTestId('transaction-technical-details')).toHaveCount(0)
+        await page
+          .getByRole('checkbox', { name: en.simpleIssuer.visibilityReviewed, exact: true })
+          .check()
+        await page.getByTestId('raw-signing-consent').check()
+        const recording = page.waitForResponse(
+          (response) =>
+            new URL(response.url()).pathname === '/api/issuer/credentials' &&
+            response.request().method() === 'POST',
+        )
+        await page.getByTestId('transaction-sign').click()
+        await browserExpect(page.getByTestId('xcs-confirmed')).toBeVisible()
+        const recorded = await recording
+        expect(recorded.status()).toBe(200)
+        expect((await recorded.json()).generationId).toBe(generationId)
+        expect(ledgerTransport.transactions.size).toBe(1)
+        expect(walletTransport.signedMessages).toContainEqual({ hex: true, address: issuerAddress })
+        await signIn(recipient)
+        walletTransport.select(recipientWallet)
+        await page.goto(
+          runtime.origin + `/recipient/credentials/${generationId}?profile=${profileId}`,
+        )
+        await connectWallet()
+        await page.getByRole('button', { name: en.accept.review, exact: true }).click()
+        await browserExpect(page.getByTestId('credential-subject-review')).toBeVisible()
+        await page
+          .getByRole('button', { name: en.portal.recipient.showAndVerify, exact: true })
+          .click()
+        await browserExpect(page.getByTestId('credential-claims')).toContainText(
+          'PRIVATE RUNTIME CLAIM',
+        )
+        await page.getByTestId('issuer-trust-acknowledgement').getByRole('checkbox').check()
+        await browserExpect(page.getByTestId('transaction-preview')).toContainText(
+          en.simpleUi.signActions.accept,
+        )
+        await browserExpect(page.getByTestId('transaction-technical-details')).toHaveCount(0)
+        await page.getByTestId('raw-signing-consent').check()
+        const reconciliation = page.waitForResponse(
+          (response) =>
+            new URL(response.url()).pathname ===
+              `/api/recipient/credentials/${profileId}/${generationId}/reconcile` &&
+            response.request().method() === 'POST',
+        )
+        await page.getByTestId('transaction-sign').click()
+        const reconciled = await reconciliation
+        expect(reconciled.status()).toBe(200)
+        const accepted = await reconciled.json()
+        expect(accepted.status.accepted).toBe(true)
+        expect(accepted.status.state).toBe('active')
+        // The parent refresh replaces the review/result after reconcile. Assert the durable
+        // accepted state and next action, rather than the transient confirmation component.
+        await browserExpect(
+          page.getByRole('link', { name: en.recipient.present, exact: true }),
+        ).toBeVisible()
+        expect(acceptedHash).toMatch(/^[0-9a-f]{64}$/)
+        expect(ledgerTransport.transactions.size).toBe(2)
+        expect(ledgerTransport.errors).toEqual([])
+        expect(walletTransport.signedMessages).toEqual(
+          expect.arrayContaining([
+            { hex: false, address: issuerAddress },
+            { hex: false, address: subjectAddress },
+            { hex: true, address: subjectAddress },
+          ]),
+        )
+        expect(walletTransport.errors).toEqual([])
+        // This separate message signature binds the actual share intent and audience. Drive
+        // the production UI and SDK, rather than directly signing the API challenge in the test.
+        await page.goto(
+          runtime.origin + `/recipient/credentials/${generationId}/present?profile=${profileId}`,
+        )
+        await connectWallet('presentation-wallet')
+        await page.getByRole('radio', { name: en.presentation.full, exact: true }).check()
+        await page.getByLabel(en.presentation.verifier).selectOption(verifierOrg)
+        const signaturesBeforeShare = walletTransport.signedMessages.length
+        const creationResponse = page.waitForResponse(
+          (response) =>
+            new URL(response.url()).pathname === '/api/recipient/presentations' &&
+            response.request().method() === 'POST',
+        )
+        await page.getByRole('button', { name: en.presentation.create, exact: true }).click()
+        const response = await creationResponse
+        expect(response.status()).toBe(200)
+        const full = { body: (await response.json()) as { id: string; token: string } }
+        await browserExpect(page.locator('#presentation-created-link')).toBeVisible()
+        // Boolean comparison avoids putting a bearer link in assertion diagnostics.
+        expect(
+          (await page.locator('#presentation-created-link').inputValue()) ===
+            runtime.origin + '/presentations#' + full.body.token,
+        ).toBe(true)
+        expect(walletTransport.signedMessages.slice(signaturesBeforeShare)).toEqual([
+          { hex: false, address: subjectAddress },
+        ])
+        await context.clearCookies()
+        const anonymousResolution = page.waitForResponse(
+          (response) =>
+            new URL(response.url()).pathname === '/api/presentations/resolve' &&
+            response.request().method() === 'POST',
+        )
+        await page.goto(runtime.origin + '/presentations#' + full.body.token)
+        const anonymousResponse = await anonymousResolution
+        expect(anonymousResponse.status()).toBe(200)
+        const anonymous = await anonymousResponse.json()
+        expect(anonymous.issuerAdmission.status).toBe('approved')
+        expect(anonymous.issuerAdmission.organizationId).toBe(organizationId)
+        expect(anonymous.credential.subjectAddress).toBe(subjectAddress)
+        expect(anonymous.credential.networkId).toBe(1)
+        expect(anonymous.credential.status.state).toBe('active')
+        expect(anonymous.holderProof.status).toBe('verified')
+        expect(anonymous.holderProof.address).toBe(subjectAddress)
+        expect(anonymous.holderProof.networkId).toBe(1)
+        expect(Number.isFinite(Date.parse(anonymous.holderProof.verifiedAt))).toBe(true)
+        await browserExpect(
+          page.getByRole('region', { name: en.roleJourney.admissionTitle, exact: true }),
+        ).toContainText(en.roleJourney.admissionStatuses.approved)
+        const ledgerSection = page.getByRole('region', {
+          name: en.roleJourney.ledgerRecipientTitle,
+          exact: true,
+        })
+        await browserExpect(ledgerSection).toContainText(en.roleJourney.ledgerStatuses.active)
+        const presentationText = await page.getByTestId('presentation-result').innerText()
+        expect(presentationText).not.toContain(subjectAddress)
+        expect(presentationText).not.toContain(issuerAddress)
+        expect(presentationText).not.toContain(generationId)
+        expect(presentationText).not.toContain(profileId)
+        const proofDate = await page.evaluate(
+          (value) =>
+            new Intl.DateTimeFormat('en', { dateStyle: 'medium', timeStyle: 'short' }).format(
+              new Date(value),
+            ),
+          anonymous.holderProof.verifiedAt,
+        )
+        await browserExpect(
+          page.getByRole('region', { name: en.roleJourney.holderProofTitle, exact: true }),
+        ).toContainText(en.roleJourney.holderVerifiedAt.replace('{date}', proofDate))
+        await browserExpect(page.getByTestId('presentation-result')).toBeVisible()
+        await browserExpect(page.getByTestId('presentation-result')).toContainText(
+          'Public runtime course',
+        )
+        await browserExpect(page.getByTestId('presentation-result')).not.toContainText(
+          'PRIVATE RUNTIME CLAIM',
+        )
+        await signIn(verifier)
+        await page.goto(runtime.origin + '/presentations#' + full.body.token)
+        await browserExpect(page.getByTestId('presentation-result')).toContainText(
+          'PRIVATE RUNTIME CLAIM',
+        )
+        const history = await request(page, '/api/verifier/workspace')
+        expect(history.body.history).toHaveLength(1)
+        expect(JSON.stringify(history.body.history)).not.toContain('PRIVATE RUNTIME CLAIM')
+        expect(JSON.stringify(history.body.history)).not.toContain(full.body.token)
+        await signIn(recipient)
+        expect(
+          (await request(page, `/api/recipient/presentations/${full.body.id}/revoke`, {})).status,
+        ).toBe(200)
+        await signIn(verifier)
+        expect(
+          (
+            await request(
+              page,
+              `/api/verifier/history/${history.body.history[0].id}/presentation`,
+              {},
+            )
+          ).status,
+        ).toBe(404)
+      } finally {
+        await runtime?.close()
+        await Promise.all([authDatabase?.close(), database?.close()])
+        if (operator && /^xcs_role_journey_[a-f0-9]{32}$/.test(databaseName))
+          await operator.sql`DROP DATABASE IF EXISTS ${operator.sql(databaseName)} WITH (FORCE)`
+        await operator?.close()
+        await rm(directory, { recursive: true, force: true })
+      }
+    }, 120000)
+  },
+)
diff --git a/apps/web/test/roleJourney.test.ts b/apps/web/test/roleJourney.test.ts
new file mode 100644
index 0000000..ad67124
--- /dev/null
+++ b/apps/web/test/roleJourney.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { supportsWalletLinkProof, walletLinkReturnPath } from '../app/utils/roleJourney'
+
+describe('wallet onboarding', () => {
+  it.each(['/recipient', '/fr/recipient'])(
+    'preserves the allowed return destination %s',
+    (path) => {
+      expect(walletLinkReturnPath(path, 'en')).toBe(path)
+    },
+  )
+  it.each([
+    'https://outside.test',
+    '//outside.test',
+    '/presentations#token',
+    '/recipient?token=secret',
+    '/account',
+    ['/recipient'],
+    undefined,
+  ])('ignores unsafe or unrelated return values %j', (value) => {
+    expect(walletLinkReturnPath(value, 'fr')).toBe('/fr/recipient')
+    expect(walletLinkReturnPath(value, 'en')).toBe('/recipient')
+  })
+  it('offers only the adapters supported by ownership message verification', () => {
+    expect(
+      [
+        'gemwallet',
+        'metamask-snap',
+        'otsu',
+        'crossmark',
+        'xaman',
+        'ledger',
+        'xyra',
+        'walletconnect',
+      ].filter(supportsWalletLinkProof),
+    ).toEqual(['gemwallet', 'metamask-snap', 'otsu'])
+  })
+})
diff --git a/apps/web/test/server/config.test.ts b/apps/web/test/server/config.test.ts
index d17a14b..81730c5 100644
--- a/apps/web/test/server/config.test.ts
+++ b/apps/web/test/server/config.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
-import { loadApiConfig } from '../../server/xcs/config.js'
+import { loadApiConfig, loadHostedPayloadConfig } from '../../server/xcs/config.js'
 import {
   DisabledPayloadResolver,
   PayloadUnavailableError,
@@ -123,6 +123,31 @@ describe('API configuration', () => {
     ).toThrow('must not overlap')
   })
 
+  it('derives hosted payload publication from one complete server contract', () => {
+    const hostedEnvironment = {
+      XCS_PUBLIC_PAYLOAD_BASE_URL: 'https://p.xcs.test',
+      XCS_PAYLOAD_STORAGE_IP_HASH_SECRET: 'test-only-hosted-payload-secret-0001',
+      XCS_HOSTED_PAYLOAD_NETWORKS: 'testnet-a,testnet-b',
+    }
+    expect(loadHostedPayloadConfig(hostedEnvironment)).toEqual({
+      enabled: true,
+      publicBaseUrl: 'https://p.xcs.test',
+      ipHashSecret: 'test-only-hosted-payload-secret-0001',
+      networks: ['testnet-a', 'testnet-b'],
+    })
+    expect(loadHostedPayloadConfig({})).toEqual({ enabled: false })
+    expect(() => loadHostedPayloadConfig({ XCS_HOSTED_PAYLOAD_NETWORKS: 'testnet-a' })).toThrow(
+      'XCS_PUBLIC_PAYLOAD_BASE_URL is required',
+    )
+    expect(
+      loadApiConfig({
+        ...hostedEnvironment,
+        XCS_DATABASE_URL: 'postgres://xcs_api:password@localhost/xcs',
+        XCS_PAYLOAD_DATABASE_URL: 'postgres://xcs_payload_writer:password@localhost/xcs',
+      }).hostedPayloads,
+    ).toMatchObject({ enabled: true, publicBaseUrl: 'https://p.xcs.test' })
+  })
+
   it('uses a network-free resolver when fetching is disabled', async () => {
     await expect(
       new DisabledPayloadResolver().resolve('https://example.test'),
diff --git a/apps/web/test/server/hosted-payloads.test.ts b/apps/web/test/server/hosted-payloads.test.ts
new file mode 100644
index 0000000..fd7bd77
--- /dev/null
+++ b/apps/web/test/server/hosted-payloads.test.ts
@@ -0,0 +1,296 @@
+import { computeSchemaUid, encodeCredentialPayload, payloadDigest } from '#xcs/core/index.js'
+import { buildCredentialCreate } from '#xcs/sdk/index.js'
+import { describe, expect, it, vi } from 'vitest'
+import { Wallet } from 'xrpl'
+
+import {
+  HostedPayloadService,
+  hostedPayloadLocator,
+  type HostedPayloadRecord,
+  type HostedPayloadRepository,
+} from '../../server/xcs/hosted-payloads.js'
+import { HostedPayloadResolver } from '../../server/xcs/hosted-payload-resolver.js'
+import type { ApiRepository } from '../../server/xcs/types.js'
+import { createApiHandlers, type CreateApiOptions } from '../../server/xcs/handlers.js'
+import { createInjector } from './inject.js'
+import { DisabledPayloadResolver } from '../../server/xcs/payload-resolver.js'
+import { StaticTrustPolicy } from '../../server/xcs/verification.js'
+async function createApi(options: CreateApiOptions) {
+  const handlers = createApiHandlers(options)
+  return { inject: createInjector(handlers), close: () => handlers.close() }
+}
+
+// Test repositories model projection/storage boundaries; signatures and canonical payload validation are real.
+function fixture(claims: Record<string, string> = { course: 'Test course' }) {
+  const issuer = Wallet.generate()
+  const subject = Wallet.generate().address
+  const now = new Date()
+  const fields = Object.fromEntries(
+    Object.keys(claims).map((key) => [key, { type: 'string' as const }]),
+  )
+  const definition = {
+    xcsVersion: '0.1' as const,
+    name: 'Completion',
+    description: 'Test only',
+    fields,
+  }
+  const ledgerHash = 'a'.repeat(64)
+  const uid = computeSchemaUid({
+    schema: definition,
+    networkId: 1,
+    ledgerHash,
+    ledgerIndex: 1,
+    transactionIndex: 0,
+    publisher: issuer.address,
+  })
+  const schema = {
+    profileId: 'testnet',
+    schemaUid: uid,
+    publisher: issuer.address,
+    name: definition.name,
+    description: definition.description,
+    parentUid: null,
+    supersedesUid: null,
+    definition,
+    resolvedDefinition: { definition, fields, lineage: [] },
+    ledgerIndex: 1,
+    transactionIndex: 0,
+    registrationTransactionHash: 'b'.repeat(64),
+  }
+  const evidence = {
+    schema,
+    registration: {
+      profileId: 'testnet',
+      transactionHash: schema.registrationTransactionHash,
+      ledgerIndex: 1,
+      ledgerHash,
+      transactionIndex: 0,
+      publisher: issuer.address,
+      status: 'accepted',
+      reasonCode: null,
+      schemaUid: uid,
+      memoJson: definition,
+    },
+  }
+  const payload = encodeCredentialPayload(claims, {
+    issuer: issuer.address,
+    subject,
+    schemaUid: uid,
+    fields,
+  })
+  const digest = payloadDigest(payload.bytes)
+  const locator = hostedPayloadLocator(digest)
+  const uri = `https://payload.test/p/${locator}#xcs-sha256=${digest}`
+  const transaction = buildCredentialCreate({
+    issuer: issuer.address,
+    subject,
+    schemaUid: uid,
+    uri,
+  })
+  const signed = issuer.sign({ ...transaction, Fee: '12', Sequence: 1, LastLedgerSequence: 20 })
+  const event = { eventType: 'created', uriHex: transaction.URI, ledgerIndex: 2 }
+  const api = {
+    withConsistentSnapshot: async <T>(fn: (repository: ApiRepository) => Promise<T>) =>
+      fn(api as unknown as ApiRepository),
+    getNetwork: async () => ({
+      profileId: 'testnet',
+      xcsVersion: '0.1',
+      networkId: 1,
+      requiredAmendment: 'c'.repeat(64),
+      registryAddress: issuer.address,
+      registrationAmountDrops: 1,
+      activationLedgerIndex: 1,
+      activationLedgerHash: 'd'.repeat(64),
+    }),
+    getDatabaseTime: async () => now,
+    getIndexerStatus: async () => ({
+      profileId: 'testnet',
+      state: 'ready',
+      primarySourceTip: 10,
+      secondarySourceTip: 10,
+      lastAgreedLedgerIndex: 10,
+      lastAgreedLedgerHash: ledgerHash,
+      errorCode: null,
+      writerId: 'test-writer',
+      writerEpoch: 1,
+      leaseExpiresAt: new Date(now.getTime() + 60000),
+      updatedAt: now,
+    }),
+    getLatestCheckpoint: async () => ({
+      profileId: 'testnet',
+      ledgerIndex: 10,
+      ledgerHash,
+      closeTime: Math.floor(now.getTime() / 1000) - 946684800,
+    }),
+    getSchema: async () => schema,
+    getSchemaProjectionEvidence: async () => [evidence],
+    getCredentialEventsByTransaction: vi.fn(async () => [event]),
+  }
+  let stored: HostedPayloadRecord | undefined
+  const repository: HostedPayloadRepository = {
+    get: vi.fn(async () => stored),
+    publish: vi.fn(async (input) => {
+      stored = { locator: input.locator, digestHex: input.digestHex, content: input.content }
+      return stored
+    }),
+  }
+  const service = new HostedPayloadService({
+    repository,
+    apiRepository: api as unknown as ApiRepository,
+    publicBaseUrl: 'https://payload.test',
+    ipHashSecret: 'test-only-ip-hash-secret-000000000000',
+    enabledNetworks: new Set(['testnet']),
+  })
+  const input = {
+    network: 'testnet',
+    locator,
+    payloadBase64: Buffer.from(payload.bytes).toString('base64'),
+    signedTransactionBlob: signed.tx_blob,
+    ipAddress: '127.0.0.1',
+  }
+  return { service, repository, api, input, signed, payload, digest, uri }
+}
+
+describe('hosted public payload authorization', () => {
+  it('serves the publication HTTP contract and immutable exact bytes', async () => {
+    const f = fixture()
+    const app = await createApi({
+      repository: f.api as unknown as ApiRepository,
+      resolver: new DisabledPayloadResolver(),
+      trustPolicy: new StaticTrustPolicy(),
+      hostedPayloadService: f.service,
+    })
+    try {
+      const { ipAddress: _ip, locator, ...body } = f.input
+      const publication = await app.inject({
+        method: 'POST',
+        url: `/v1/payloads/${locator}`,
+        payload: body,
+      })
+      expect(publication.statusCode).toBe(200)
+      expect(publication.json()).toMatchObject({ uri: f.uri })
+      const payload = await app.inject({ method: 'GET', url: `/p/${locator}` })
+      expect(payload.statusCode).toBe(200)
+      expect(payload.body).toBe(f.payload.json)
+      expect(payload.headers['cache-control']).toBe('public, max-age=31536000, immutable')
+      expect(payload.headers.etag).toBe(`"${f.digest}"`)
+      const oversized = await app.inject({
+        method: 'POST',
+        url: `/v1/payloads/${locator}`,
+        payload: { ...body, payloadBase64: Buffer.alloc(65537).toString('base64') },
+      })
+      expect(oversized.statusCode).toBe(413)
+      expect(oversized.json()).toMatchObject({ error: 'PAYLOAD_SIZE_INVALID' })
+    } finally {
+      await app.close()
+    }
+  })
+  it('publishes exact canonical bytes with a valid indexed CredentialCreate signature', async () => {
+    const f = fixture()
+    expect(await f.service.publish(f.input)).toMatchObject({
+      uri: f.uri,
+      transactionHash: f.signed.hash.toLowerCase(),
+      byteLength: f.payload.bytes.length,
+    })
+    expect(await f.service.get(f.input.locator)).toMatchObject({
+      content: f.payload.json,
+      digestHex: f.digest,
+    })
+    expect(f.api.getCredentialEventsByTransaction).toHaveBeenCalledWith(
+      expect.objectContaining({ transactionHash: f.signed.hash.toLowerCase() }),
+    )
+  })
+
+  it.each(['!!!=', '', 'e30'])(
+    'rejects malformed base64 before storage: %s',
+    async (payloadBase64) => {
+      const f = fixture()
+      await expect(f.service.publish({ ...f.input, payloadBase64 })).rejects.toMatchObject({
+        code: 'PAYLOAD_BASE64_INVALID',
+      })
+      expect(f.repository.publish).not.toHaveBeenCalled()
+    },
+  )
+
+  it('rejects decoded payloads larger than 64 KiB before signature or storage', async () => {
+    const f = fixture()
+    await expect(
+      f.service.publish({ ...f.input, payloadBase64: Buffer.alloc(65537).toString('base64') }),
+    ).rejects.toMatchObject({ code: 'PAYLOAD_SIZE_INVALID', statusCode: 413 })
+    expect(f.repository.publish).not.toHaveBeenCalled()
+  })
+
+  it('rejects unsigned data and altered signed transaction bytes', async () => {
+    const f = fixture()
+    for (const blob of [
+      '00',
+      f.signed.tx_blob.slice(0, -2) + (f.signed.tx_blob.endsWith('FF') ? '00' : 'FF'),
+    ]) {
+      await expect(
+        f.service.publish({ ...f.input, signedTransactionBlob: blob }),
+      ).rejects.toMatchObject({ code: 'SIGNED_TRANSACTION_INVALID' })
+    }
+    expect(f.repository.publish).not.toHaveBeenCalled()
+  })
+
+  it('requires exactly one matching indexed creation event before publication', async () => {
+    const f = fixture()
+    f.api.getCredentialEventsByTransaction.mockResolvedValue([])
+    await expect(f.service.publish(f.input)).rejects.toMatchObject({
+      code: 'SIGNED_TRANSACTION_NOT_INDEXED',
+      statusCode: 409,
+    })
+    f.api.getCredentialEventsByTransaction.mockResolvedValue([
+      { eventType: 'created', uriHex: '00', ledgerIndex: 2 },
+    ])
+    await expect(f.service.publish(f.input)).rejects.toMatchObject({
+      code: 'SIGNED_TRANSACTION_NOT_INDEXED',
+    })
+    expect(f.repository.publish).not.toHaveBeenCalled()
+  })
+
+  it("rejects another valid signer's transaction and duplicate projection events", async () => {
+    const f = fixture()
+    const other = fixture()
+    await expect(
+      f.service.publish({ ...f.input, signedTransactionBlob: other.input.signedTransactionBlob }),
+    ).rejects.toMatchObject({ code: 'SIGNED_TRANSACTION_PAYLOAD_MISMATCH' })
+    const events = await f.api.getCredentialEventsByTransaction()
+    f.api.getCredentialEventsByTransaction.mockResolvedValue([...events, ...events])
+    await expect(f.service.publish(f.input)).rejects.toMatchObject({
+      code: 'SIGNED_TRANSACTION_NOT_INDEXED',
+    })
+    expect(f.repository.publish).not.toHaveBeenCalled()
+  })
+
+  it('publishes schema-valid synthetic claims regardless of field names', async () => {
+    const f = fixture({
+      prenom: 'Fictional',
+      firstname: 'Synthetic',
+      email: 'test@example.invalid',
+    })
+    await f.service.publish(f.input)
+    expect(await f.service.get(f.input.locator)).toMatchObject({
+      content: f.payload.json,
+    })
+  })
+
+  it('keeps publication restricted to allowed Testnet profiles', async () => {
+    const f = fixture({ prenom: 'fictional' })
+    await expect(f.service.publish({ ...f.input, network: 'mainnet' })).rejects.toMatchObject({
+      code: 'PAYLOAD_HOSTING_NETWORK_DISABLED',
+    })
+    expect(f.repository.publish).not.toHaveBeenCalled()
+  })
+
+  it('resolves its own immutable hosted URLs directly and delegates other origins', async () => {
+    const f = fixture()
+    await f.service.publish(f.input)
+    const external = { resolve: vi.fn(async () => new Uint8Array([1])) }
+    const resolver = new HostedPayloadResolver('https://payload.test', f.service, external)
+    expect(await resolver.resolve(f.uri)).toEqual(f.payload.bytes)
+    expect(external.resolve).not.toHaveBeenCalled()
+    await resolver.resolve(f.uri.replace('payload.test', 'other.test'))
+    expect(external.resolve).toHaveBeenCalledOnce()
+  })
+})
diff --git a/apps/web/test/server/operational-metrics.test.ts b/apps/web/test/server/operational-metrics.test.ts
index ca6dbe3..fe664c3 100644
--- a/apps/web/test/server/operational-metrics.test.ts
+++ b/apps/web/test/server/operational-metrics.test.ts
@@ -260,7 +260,7 @@ describe('operational metrics', () => {
       new Uint8Array([1]),
       new PayloadUnavailableError('unavailable'),
       new PayloadInvalidError('invalid'),
-      new XcsError('INVALID_PAYLOAD_URI', 'invalid URI'),
+      new XcsError('PAYLOAD_URI_INVALID', 'invalid URI'),
       new Error('unexpected'),
     ]
     const resolver = collector.observePayloadResolver({
diff --git a/apps/web/test/server/settings.test.ts b/apps/web/test/server/settings.test.ts
index 199b343..df3c144 100644
--- a/apps/web/test/server/settings.test.ts
+++ b/apps/web/test/server/settings.test.ts
@@ -67,6 +67,60 @@ describe('checked-in web settings', () => {
       loadApiConfig(apiEnvironment({ XCS_DATABASE_URL: 'postgres://localhost/xcs' })).demoPinning,
     ).toEqual({ enabled: false })
   })
+
+  it('keeps the canonical Identity issuer when local qualification is not enabled', () => {
+    expect(
+      apiEnvironment({
+        XCS_AUTH_ORIGIN: 'https://localhost:3445',
+        XCS_IDENTITY_ISSUER: 'https://localhost:3446',
+      }).XCS_IDENTITY_ISSUER,
+    ).toBe('https://account.xrpl.in')
+  })
+
+  it('allows an explicit HTTPS loopback Identity provider for local qualification', () => {
+    expect(
+      apiEnvironment({
+        XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+        XCS_AUTH_ORIGIN: 'https://localhost:3445',
+        XCS_IDENTITY_ISSUER: 'https://127.0.0.1:3446',
+      }).XCS_IDENTITY_ISSUER,
+    ).toBe('https://127.0.0.1:3446')
+  })
+
+  it.each([
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: 'true',
+      XCS_AUTH_ORIGIN: 'https://localhost:3445',
+      XCS_IDENTITY_ISSUER: 'https://localhost:3446',
+    },
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+      XCS_AUTH_ORIGIN: 'https://xcs.example',
+      XCS_IDENTITY_ISSUER: 'https://localhost:3446',
+    },
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+      XCS_AUTH_ORIGIN: 'https://localhost:3445',
+      XCS_IDENTITY_ISSUER: 'https://identity.example',
+    },
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+      XCS_AUTH_ORIGIN: 'https://localhost:3445',
+      XCS_IDENTITY_ISSUER: 'http://127.0.0.1:3446',
+    },
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+      XCS_AUTH_ORIGIN: 'https://localhost:3445',
+      XCS_IDENTITY_ISSUER: 'https://localhost:3446/path',
+    },
+    {
+      XCS_LOCAL_IDENTITY_QUALIFICATION: '1',
+      XCS_AUTH_ORIGIN: 'https://localhost:3445',
+      XCS_IDENTITY_ISSUER: ' https://localhost:3446',
+    },
+  ])('rejects an unsafe local Identity qualification contract', (environment) => {
+    expect(() => apiEnvironment(environment)).toThrow('LOCAL_IDENTITY_QUALIFICATION_INVALID')
+  })
 })
 
 describe('the browser-visible profile identifier', () => {
diff --git a/apps/web/test/verifier-application.test.ts b/apps/web/test/verifier-application.test.ts
new file mode 100644
index 0000000..0b54e0a
--- /dev/null
+++ b/apps/web/test/verifier-application.test.ts
@@ -0,0 +1,102 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { DatabaseClient } from '../server/lib/db/index.js'
+import type { Session } from '../server/xcs/auth/types'
+import { IssuerRepository } from '../server/xcs/issuer/repository'
+import { VerifierRepository } from '../server/xcs/verifier/repository'
+
+const session = { id: 'session', userId: 'user', tokenHash: 'hash' } as Session
+const application = {
+  name: 'Verifier',
+  website: 'https://example.test',
+  contact: 'Test',
+  jurisdiction: 'FR',
+  description: 'Test',
+  purpose: 'Test',
+  documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+}
+
+function fixture(ambiguousCommit = false) {
+  const statements: { text: string; values: unknown[] }[] = []
+  let transaction = 0
+  const query = vi.fn(async (parts: TemplateStringsArray, ...values: unknown[]) => {
+    const text = parts.join('?')
+    statements.push({ text, values })
+    if (text.includes('FROM app_sessions')) return [{ id: session.id }]
+    if (text.includes('count(*)')) return [{ count: 0 }]
+    if (text.includes('SELECT id FROM app_organizations')) return [{ id: 'committed' }]
+    return []
+  })
+  const sql = Object.assign(query, {
+    begin: vi.fn(async (fn: (query: unknown) => Promise<unknown>) => {
+      transaction++
+      const result = await fn(query)
+      if (ambiguousCommit && transaction === 1) throw new Error('ambiguous commit')
+      return result
+    }),
+  })
+  const client = { sql } as unknown as DatabaseClient
+  const documents = {
+    write: vi.fn(async () => ({
+      storageKey: 'synthetic.pdf',
+      mimeType: 'application/pdf',
+      byteLength: 5,
+      sha256: 'a'.repeat(64),
+    })),
+    release: vi.fn(),
+    remove: vi.fn(async () => {}),
+  }
+  const applications = new IssuerRepository(client, {
+    documents,
+    origin: 'https://example.test',
+    inviteDays: 7,
+    notify: async () => ({ status: 'sent', errorCode: null }),
+  })
+  return {
+    repository: new VerifierRepository(client, applications),
+    applications,
+    documents,
+    statements,
+  }
+}
+
+describe('verifier applications reuse issuer document lifecycle', () => {
+  it('stores verifier application and documents while preserving the shared per-user application limit lock', async () => {
+    const test = fixture()
+    await expect(test.repository.apply(session, application)).resolves.toMatchObject({
+      status: 'pending',
+    })
+    const profile = test.statements.find((entry) =>
+      entry.text.includes('INSERT INTO app_organization_applications'),
+    )!
+    const document = test.statements.find((entry) =>
+      entry.text.includes('INSERT INTO app_documents'),
+    )!
+    expect(profile.values[1]).toBe('verifier')
+    expect(document.values[2]).toBe('verifier')
+    expect(
+      test.statements.find((entry) => entry.text.includes('pg_advisory_xact_lock'))!.values,
+    ).toEqual(['user:issuer-applications'])
+    expect(test.documents.release).toHaveBeenCalledWith('synthetic.pdf')
+    expect(test.documents.remove).not.toHaveBeenCalled()
+  })
+  it('retains original issuer role when no role is supplied', async () => {
+    const test = fixture()
+    await test.applications.apply(session, application)
+    expect(
+      test.statements.find((entry) =>
+        entry.text.includes('INSERT INTO app_organization_applications'),
+      )!.values[1],
+    ).toBe('issuer')
+  })
+  it('keeps verifier documents after an ambiguous commit and serialized persisted-row recovery', async () => {
+    const test = fixture(true)
+    await expect(test.repository.apply(session, application)).rejects.toThrow('ambiguous commit')
+    const locks = test.statements.filter((entry) => entry.text.includes('pg_advisory_xact_lock'))
+    expect(locks.map((entry) => entry.values[0])).toEqual([
+      'user:issuer-applications',
+      'user:issuer-applications',
+    ])
+    expect(test.documents.remove).not.toHaveBeenCalled()
+    expect(test.documents.release).toHaveBeenCalledWith('synthetic.pdf')
+  })
+})
diff --git a/apps/web/test/verifier-http.test.ts b/apps/web/test/verifier-http.test.ts
new file mode 100644
index 0000000..70f7682
--- /dev/null
+++ b/apps/web/test/verifier-http.test.ts
@@ -0,0 +1,206 @@
+import { createApp, createError, toNodeListener } from 'h3'
+import inject from 'light-my-request'
+import { describe, expect, it, vi } from 'vitest'
+import type { Session } from '../server/xcs/auth/types'
+import type { ResolvedPresentation } from '../server/xcs/recipient/types'
+import { createVerifierHandler } from '../server/xcs/verifier/http'
+import { historyCsv } from '../server/xcs/verifier/csv'
+import { VerifierError, type VerifierHistoryEntry } from '../server/xcs/verifier/types'
+
+const session = { id: 'session', userId: 'user', tokenHash: 'not-exported' } as Session
+const id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
+const history: VerifierHistoryEntry = {
+  id,
+  organizationId: id,
+  presentationId: id,
+  profileId: 'testnet',
+  generationId: 'a'.repeat(64),
+  scope: 'full',
+  checkedAt: '2026-09-24T12:00:00.000Z',
+  verification: { onChain: 'active', schema: 'valid', payload: 'valid', issuerTrust: 'unknown' },
+}
+function fixture() {
+  const repository = {
+    workspace: vi.fn(async () => ({
+      organizations: [],
+      selectedOrganizationId: null,
+      history: [],
+    })),
+    apply: vi.fn(async () => ({ organizationId: id, status: 'pending' })),
+    history: vi.fn(async () => [history]),
+    reopen: vi.fn(async () => ({ requiresAuthorization: true }) as ResolvedPresentation),
+  }
+  const authorize = vi.fn(async () => session)
+  const resolvePresentation = vi.fn()
+  const listener = toNodeListener(
+    createApp().use(createVerifierHandler({ repository, authorize, resolvePresentation })),
+  )
+  return { repository, authorize, resolvePresentation, listener }
+}
+
+describe('verifier authenticated HTTP boundary', () => {
+  it('passes authenticated user and selected organization, disables caching', async () => {
+    const test = fixture()
+    const response = await inject(test.listener, {
+      method: 'GET',
+      url: `/api/verifier/workspace?organizationId=${id}`,
+    })
+    expect(response.statusCode).toBe(200)
+    expect(test.repository.workspace).toHaveBeenCalledWith(session, id)
+    expect(test.authorize).toHaveBeenCalledWith(expect.anything(), false)
+    expect(response.headers['cache-control']).toBe('private, no-store')
+    expect(response.headers['referrer-policy']).toBe('no-referrer')
+  })
+  it.each(['?role=issuer', '?organizationId=bad', `?organizationId=${id}&organizationId=${id}`])(
+    'rejects ambiguous or unsupported queries %s',
+    async (query) => {
+      const test = fixture()
+      expect(
+        (await inject(test.listener, { method: 'GET', url: '/api/verifier/workspace' + query }))
+          .statusCode,
+      ).toBe(400)
+      expect(test.repository.workspace).not.toHaveBeenCalled()
+    },
+  )
+  it('requires authentication before listing metadata', async () => {
+    const test = fixture()
+    test.authorize.mockRejectedValueOnce(createError({ statusCode: 401 }))
+    const response = await inject(test.listener, { method: 'GET', url: '/api/verifier/workspace' })
+    expect(response.statusCode).toBe(401)
+    expect(response.json()).toEqual({ error: 'AUTH_REQUIRED' })
+    expect(test.repository.workspace).not.toHaveBeenCalled()
+  })
+  it('requires the mutation CSRF authorizer before accepting applications', async () => {
+    const test = fixture()
+    test.authorize.mockRejectedValueOnce(createError({ statusCode: 403 }))
+    const response = await inject(test.listener, {
+      method: 'POST',
+      url: '/api/verifier/applications',
+      payload: {},
+    })
+    expect(response.statusCode).toBe(403)
+    expect(test.authorize).toHaveBeenCalledWith(expect.anything(), true)
+    expect(test.repository.apply).not.toHaveBeenCalled()
+  })
+  it('validates documents and refuses caller-selected roles', async () => {
+    const test = fixture()
+    const application = {
+      name: 'Verifier',
+      website: 'https://example.test',
+      contact: 'Test',
+      jurisdiction: 'FR',
+      description: 'Test',
+      purpose: 'Test',
+      documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+    }
+    const accepted = await inject(test.listener, {
+      method: 'POST',
+      url: '/api/verifier/applications',
+      payload: application,
+    })
+    expect(accepted.statusCode).toBe(200)
+    expect(test.repository.apply).toHaveBeenCalledWith(session, application)
+    const rejected = await inject(test.listener, {
+      method: 'POST',
+      url: '/api/verifier/applications',
+      payload: { ...application, role: 'issuer' },
+    })
+    expect(rejected.statusCode).toBe(400)
+    expect(test.repository.apply).toHaveBeenCalledTimes(1)
+  })
+  it('exports only bounded metadata through the approval-checked repository', async () => {
+    const test = fixture()
+    const response = await inject(test.listener, {
+      method: 'GET',
+      url: `/api/verifier/history.csv?organizationId=${id}`,
+    })
+    expect(response.statusCode).toBe(200)
+    expect(response.headers['content-type']).toBe('text/csv; charset=utf-8')
+    expect(response.headers['content-disposition']).toContain('attachment')
+    expect(response.body).toContain('"issuerTrust"')
+    expect(response.body).not.toContain(session.tokenHash)
+    expect(test.repository.history).toHaveBeenCalledWith(session, id)
+    test.repository.history.mockRejectedValueOnce(
+      new VerifierError(403, 'VERIFIER_APPROVAL_REQUIRED'),
+    )
+    expect(
+      (await inject(test.listener, { method: 'GET', url: '/api/verifier/history.csv' })).statusCode,
+    ).toBe(403)
+  })
+  it('reopens only by history ID, using the current presentation resolver', async () => {
+    const test = fixture()
+    const response = await inject(test.listener, {
+      method: 'POST',
+      url: `/api/verifier/history/${id}/presentation`,
+      payload: {},
+    })
+    expect(response.statusCode).toBe(200)
+    expect(test.repository.reopen).toHaveBeenCalledWith(session, id, test.resolvePresentation)
+    expect(test.authorize).toHaveBeenCalledWith(expect.anything(), true)
+    expect(
+      (
+        await inject(test.listener, {
+          method: 'POST',
+          url: `/api/verifier/history/${id}/presentation?token=secret`,
+          payload: {},
+        })
+      ).statusCode,
+    ).toBe(400)
+  })
+  it('refuses history reopen GET requests and missing mutation CSRF authorization', async () => {
+    const test = fixture()
+    const get = await inject(test.listener, {
+      method: 'GET',
+      url: `/api/verifier/history/${id}/presentation`,
+    })
+    expect(get.statusCode).toBe(404)
+    expect(test.repository.reopen).not.toHaveBeenCalled()
+    test.authorize.mockRejectedValueOnce(createError({ statusCode: 403 }))
+    const post = await inject(test.listener, {
+      method: 'POST',
+      url: `/api/verifier/history/${id}/presentation`,
+      payload: {},
+    })
+    expect(post.statusCode).toBe(403)
+    expect(test.authorize).toHaveBeenLastCalledWith(expect.anything(), true)
+    expect(test.repository.reopen).not.toHaveBeenCalled()
+  })
+  it('redacts unexpected database failures', async () => {
+    const test = fixture()
+    test.repository.workspace.mockRejectedValueOnce(new Error('sensitive database details'))
+    const response = await inject(test.listener, { method: 'GET', url: '/api/verifier/workspace' })
+    expect(response.statusCode).toBe(503)
+    expect(response.json()).toEqual({ error: 'VERIFIER_UNAVAILABLE' })
+  })
+})
+
+describe('verifier CSV neutralization', () => {
+  it.each([
+    '=HYPERLINK("bad")',
+    '+1+1',
+    '-1+1',
+    '@SUM(A1)',
+    '  =1+1',
+    '\t=1+1',
+    '\r=1+1',
+    '\n=1+1',
+  ])('neutralizes spreadsheet formulas %j', (value) => {
+    const csv = historyCsv([{ ...history, profileId: value }])
+    expect(csv).toContain(`"'${value.replaceAll('"', '""')}"`)
+  })
+  it('quotes multiline and quoted metadata without including arbitrary extra fields', () => {
+    const csv = historyCsv([
+      {
+        ...history,
+        profileId: 'x,"y"\nz',
+        claims: { secret: 'PRIVATE' },
+        token: 'TOKEN',
+        email: 'secret@example.test',
+      } as VerifierHistoryEntry,
+    ])
+    expect(csv).toContain('"x,""y""\nz"')
+    expect(csv).not.toContain('PRIVATE')
+    expect(csv).not.toContain('TOKEN')
+    expect(csv).not.toContain('secret@example.test')
+  })
+})
diff --git a/apps/web/test/verifier-postgres.integration.test.ts b/apps/web/test/verifier-postgres.integration.test.ts
new file mode 100644
index 0000000..927e967
--- /dev/null
+++ b/apps/web/test/verifier-postgres.integration.test.ts
@@ -0,0 +1,232 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import {
+  createAppToken,
+  createDatabaseClient,
+  type DatabaseClient,
+} from '../server/lib/db/index.js'
+import { bootstrapDatabase } from '../server/lib/db/bootstrap.js'
+import { createManagedRuntimeDatabaseUsers } from './lib/db/managedRuntimeUsers.js'
+import { PostgresAuthRepository } from '../server/xcs/auth/repository'
+import type { Session } from '../server/xcs/auth/types'
+import { IssuerRepository } from '../server/xcs/issuer/repository'
+import type { ResolvedPresentation } from '../server/xcs/recipient/types'
+import { VerifierRepository } from '../server/xcs/verifier/repository'
+import { historyCsv } from '../server/xcs/verifier/csv'
+
+const url = process.env.XCS_TEST_DATABASE_URL?.trim()
+if (process.env.XCS_REQUIRE_POSTGRES_TESTS === '1' && !url)
+  throw new Error('XCS_TEST_DATABASE_URL is required')
+let operator: DatabaseClient, owner: DatabaseClient, issuer: DatabaseClient, app: DatabaseClient
+let repository: VerifierRepository, session: Session, outsider: Session, recipient: Session
+let name: string, organizationId: string, outsiderOrganizationId: string
+const presentationId = randomUUID(),
+  publicPresentationId = randomUUID()
+const profileId = '=HYPERLINK("https://example.test")',
+  generationId = 'a'.repeat(64),
+  schemaUid = 'b'.repeat(64)
+const documents = {
+  write: vi.fn(async () => ({
+    storageKey: randomUUID() + '.pdf',
+    mimeType: 'application/pdf',
+    byteLength: 5,
+    sha256: 'a'.repeat(64),
+  })),
+  remove: vi.fn(async () => {}),
+  release: vi.fn(),
+}
+const application = {
+  name: 'Verifier',
+  website: 'https://example.test',
+  contact: 'Test',
+  jurisdiction: 'FR',
+  description: 'Test',
+  purpose: 'Test',
+  documents: [{ mimeType: 'application/pdf', base64: 'JVBERi0=' }],
+}
+
+function resolved(scope: 'public' | 'full' = 'full'): ResolvedPresentation {
+  return {
+    presentation: {
+      id: scope === 'full' ? presentationId : publicPresentationId,
+      profileId,
+      generationId,
+      scope,
+      verifierOrganizationId: scope === 'full' ? organizationId : null,
+      verifierOrganizationName: null,
+      createdAt: new Date().toISOString(),
+      revokedAt: null,
+    },
+    credential: { profileId, generationId },
+    scope,
+    claims: { secret: 'NEVER_STORE_PRIVATE_CLAIMS' },
+    verification: { onChain: 'active', schema: 'valid', payload: 'valid', issuerTrust: 'unknown' },
+    issuerAdmission: {
+      status: 'approved',
+      organizationId,
+      checkedAt: new Date().toISOString(),
+      reviewedAt: null,
+    },
+    holderProof: { status: 'not_provided' },
+    requiresAuthorization: false,
+  } as ResolvedPresentation
+}
+
+describe.skipIf(!url)('verifier history with actual restricted PostgreSQL role', () => {
+  beforeAll(async () => {
+    operator = createDatabaseClient(url!, { onNotice: () => undefined })
+    name = 'xcs_verifier_test_' + randomUUID().replaceAll('-', '')
+    await operator.sql`CREATE DATABASE ${operator.sql(name)} TEMPLATE template0`
+    const parsed = new URL(url!)
+    parsed.pathname = '/' + name
+    owner = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const credentials = await createManagedRuntimeDatabaseUsers(owner, {
+      indexerPassword: randomBytes(32).toString('hex'),
+      apiPassword: randomBytes(32).toString('hex'),
+      payloadWriterPassword: randomBytes(32).toString('hex'),
+      monitorPassword: randomBytes(32).toString('hex'),
+      applicationPassword: randomBytes(32).toString('hex'),
+      issuerPassword: randomBytes(32).toString('hex'),
+    })
+    await bootstrapDatabase(owner, { clusterScope: 'dedicated' })
+    parsed.username = 'xcs_app'
+    parsed.password = credentials.applicationPassword
+    app = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    parsed.username = 'xcs_issuer'
+    parsed.password = credentials.issuerPassword
+    issuer = createDatabaseClient(parsed.toString(), { onNotice: () => undefined })
+    const auth = new PostgresAuthRepository(app)
+    const sessions: Session[] = []
+    for (const subject of ['verifier', 'outsider', 'recipient']) {
+      const token = {
+        ...createAppToken(),
+        csrfToken: createAppToken().token,
+        idleSeconds: 1800,
+        absoluteSeconds: 28800,
+      }
+      await auth.createSession(
+        {
+          issuer: 'https://identity.test',
+          subject,
+          emailVerified: true,
+          email: subject + '@example.test',
+        },
+        token,
+      )
+      sessions.push((await auth.session(token.tokenHash))!)
+    }
+    ;[session, outsider, recipient] = sessions as [Session, Session, Session]
+    const applications = new IssuerRepository(issuer, {
+      documents,
+      origin: 'https://example.test',
+      inviteDays: 7,
+      notify: async () => ({ status: 'sent', errorCode: null }),
+    })
+    repository = new VerifierRepository(issuer, applications)
+    organizationId = (await repository.apply(session, application)).organizationId
+    outsiderOrganizationId = (await repository.apply(outsider, application)).organizationId
+    await owner.sql`INSERT INTO app_schema_metadata(profile_id,schema_uid,organization_id,registration_transaction_hash) VALUES (${profileId},${schemaUid},${organizationId},${'c'.repeat(64)})`
+    await owner.sql`INSERT INTO app_credential_metadata(profile_id,generation_id,schema_uid,issuer_organization_id,recipient_user_id,issuer_address,subject_address,visibility,payload_digest,creation_transaction_hash,creation_ledger_index)
+      VALUES (${profileId},${generationId},${schemaUid},${organizationId},${recipient.userId},'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh','rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh','private',${'d'.repeat(64)},${'e'.repeat(64)},1)`
+    await owner.sql`INSERT INTO app_presentations(id,profile_id,generation_id,recipient_user_id,verifier_organization_id,scope,token_hash)
+      VALUES (${presentationId},${profileId},${generationId},${recipient.userId},${organizationId},'full',${createAppToken().tokenHash}),
+      (${publicPresentationId},${profileId},${generationId},${recipient.userId},NULL,'public',${createAppToken().tokenHash})`
+  }, 30000)
+  afterAll(async () => {
+    await Promise.all([issuer?.close(), app?.close(), owner?.close()])
+    if (operator && /^xcs_verifier_test_[a-f0-9]{32}$/.test(name))
+      await operator.sql`DROP DATABASE ${operator.sql(name)} WITH (FORCE)`
+    await operator?.close()
+  })
+
+  it('creates verifier applications and private documents without granting approval', async () => {
+    const workspace = await repository.workspace(session)
+    expect(workspace.organizations).toHaveLength(1)
+    expect(workspace.organizations[0]?.applicationStatus).toBe('pending')
+    expect(workspace.history).toEqual([])
+    const [document] =
+      await owner.sql`SELECT application_role FROM app_documents WHERE organization_id=${organizationId}`
+    expect(document!.application_role).toBe('verifier')
+    await expect(repository.history(session)).rejects.toMatchObject({ statusCode: 403 })
+    await expect(
+      issuer.sql`UPDATE app_organization_applications SET status='approved' WHERE organization_id=${organizationId}`,
+    ).rejects.toMatchObject({ code: '42501' })
+    await repository.record(issuer.db, session, resolved('public'))
+    expect(await owner.sql`SELECT id FROM app_verifier_history`).toHaveLength(0)
+    await owner.sql`UPDATE app_organization_applications SET status='approved',reviewed_by=${session.userId},reviewed_at=statement_timestamp(),revision=revision+1 WHERE organization_id IN (${organizationId},${outsiderOrganizationId})`
+  })
+  it('records four evidence dimensions without retaining private claims, tokens or email', async () => {
+    await repository.record(issuer.db, session, resolved())
+    const history = await repository.history(session)
+    expect(history).toHaveLength(1)
+    expect(history[0]?.verification).toEqual(resolved().verification)
+    const serialized = JSON.stringify(await owner.sql`SELECT * FROM app_verifier_history`)
+    expect(serialized).not.toContain('NEVER_STORE_PRIVATE_CLAIMS')
+    expect(serialized).not.toContain('token')
+    expect(serialized).not.toContain('email')
+    expect(historyCsv(history)).toContain('"\'=HYPERLINK(""https://example.test"")"')
+    await expect(
+      issuer.sql`UPDATE app_verifier_history SET issuer_trust='trusted'`,
+    ).rejects.toMatchObject({ code: '42501' })
+  })
+  it('isolates history and refuses full-audience bypass even with another approved verifier', async () => {
+    await repository.record(issuer.db, outsider, resolved())
+    expect(await repository.history(outsider)).toEqual([])
+    await expect(repository.workspace(outsider, organizationId)).rejects.toMatchObject({
+      statusCode: 404,
+    })
+    const [entry] = await repository.history(session)
+    const resolve = vi.fn(async () => resolved())
+    await expect(repository.reopen(outsider, entry!.id, resolve)).rejects.toMatchObject({
+      statusCode: 404,
+    })
+    expect(resolve).not.toHaveBeenCalled()
+    await repository.reopen(session, entry!.id, resolve)
+    expect(resolve).toHaveBeenCalledWith(session, presentationId)
+  })
+  it('does not record denied full access and allows approved public verification', async () => {
+    await repository.record(issuer.db, outsider, {
+      ...resolved(),
+      scope: 'public',
+      requiresAuthorization: true,
+    })
+    expect(await repository.history(outsider)).toEqual([])
+    await repository.record(issuer.db, outsider, resolved('public'))
+    expect(await repository.history(outsider)).toHaveLength(1)
+  })
+  it('checks current approval and active organization before history or CSV access', async () => {
+    await owner.sql`UPDATE app_organization_applications SET status='suspended',review_reason='Paused' WHERE organization_id=${organizationId}`
+    expect((await repository.workspace(session)).history).toEqual([])
+    await expect(repository.history(session)).rejects.toMatchObject({ statusCode: 403 })
+    const before = await owner.sql`SELECT count(*)::int AS count FROM app_verifier_history`
+    await repository.record(issuer.db, session, resolved())
+    expect(await owner.sql`SELECT count(*)::int AS count FROM app_verifier_history`).toEqual(before)
+    await owner.sql`UPDATE app_organization_applications SET status='approved',review_reason=NULL WHERE organization_id=${organizationId}`
+    await owner.sql`UPDATE app_organizations SET status='suspended' WHERE id=${organizationId}`
+    await expect(repository.history(session)).rejects.toMatchObject({ statusCode: 403 })
+    await owner.sql`UPDATE app_organizations SET status='active' WHERE id=${organizationId}`
+  })
+  it('does not copy the previous responsible user history after organization transfer', async () => {
+    await owner.sql`UPDATE app_organizations SET responsible_user_id=${outsider.userId} WHERE id=${organizationId}`
+    expect(await repository.history(outsider, organizationId)).toEqual([])
+    await expect(repository.history(session, organizationId)).rejects.toMatchObject({
+      statusCode: 403,
+    })
+    await owner.sql`UPDATE app_organizations SET responsible_user_id=${session.userId} WHERE id=${organizationId}`
+  })
+  it('refuses revoked sessions and presentations at recording and access time', async () => {
+    await owner.sql`UPDATE app_presentations SET revoked_at=statement_timestamp() WHERE id=${presentationId}`
+    const before = await repository.history(session)
+    await repository.record(issuer.db, session, resolved())
+    expect(await repository.history(session)).toEqual(before)
+    await owner.sql`DELETE FROM app_sessions WHERE id=${session.id}`
+    await expect(repository.workspace(session)).rejects.toMatchObject({ statusCode: 401 })
+    await expect(repository.reopen(session, before[0]!.id, vi.fn())).rejects.toMatchObject({
+      statusCode: 401,
+    })
+    await repository.record(issuer.db, session, resolved('public'))
+    expect(
+      await owner.sql`SELECT id FROM app_verifier_history WHERE verifier_user_id=${session.userId}`,
+    ).toHaveLength(before.length)
+  })
+})
diff --git a/apps/web/test/walletAdapters.test.ts b/apps/web/test/walletAdapters.test.ts
index 7df0c8f..c6864e6 100644
--- a/apps/web/test/walletAdapters.test.ts
+++ b/apps/web/test/walletAdapters.test.ts
@@ -1,21 +1,13 @@
 import { adapterSupports } from 'xrpl-connect'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import {
-  clearMismatchedXamanSession,
-  configureXamanOAuthRequest,
-  createXrplConnectAdapters,
-  forceXamanOAuthNetwork,
-  resolveXamanRedirectUrl,
-  withXamanSignWindow,
-} from '../app/utils/walletAdapters'
+import { createXrplConnectAdapters } from '../app/utils/walletAdapters'
 
 describe('XRPL Connect adapter registration', () => {
   afterEach(() => vi.unstubAllGlobals())
 
   it('registers every self-contained sign-only adapter without public app identifiers', () => {
     const adapters = createXrplConnectAdapters()
-
     expect(adapters.map((adapter) => adapter.id)).toEqual([
       'crossmark',
       'gemwallet',
@@ -30,9 +22,8 @@ describe('XRPL Connect adapter registration', () => {
   it('registers all eight official adapters when Xaman and WalletConnect are configured', () => {
     const adapters = createXrplConnectAdapters({
       xamanApiKey: '  00000000-0000-0000-0000-000000000000  ',
-      walletConnectProjectId: `  ${'1'.repeat(32)}  `,
+      walletConnectProjectId: '  ' + '1'.repeat(32) + '  ',
     })
-
     expect(adapters.map((adapter) => adapter.id)).toEqual([
       'xaman',
       'crossmark',
@@ -51,127 +42,15 @@ describe('XRPL Connect adapter registration', () => {
       xamanApiKey: ' ',
       walletConnectProjectId: '\n',
     }).map((adapter) => adapter.id)
-
     expect(adapterIds).not.toContain('xaman')
     expect(adapterIds).not.toContain('walletconnect')
   })
 
-  it('only reports Otsu as available when its injected provider marker is present', async () => {
-    const otsu = createXrplConnectAdapters().find((adapter) => adapter.id === 'otsu')
-    expect(otsu).toBeDefined()
-
-    vi.stubGlobal('xrpl', {})
-    await expect(otsu?.isAvailable()).resolves.toBe(false)
-    vi.stubGlobal('xrpl', { isOtsu: true })
-    await expect(otsu?.isAvailable()).resolves.toBe(true)
-  })
-
-  it('forces the Xaman OAuth sign-in request onto Testnet', () => {
-    expect(
-      forceXamanOAuthNetwork(
-        'https://oauth2.xumm.app/auth?client_id=public-app-id&redirect_uri=http%3A%2F%2F127.0.0.1%3A3000',
-      ),
-    ).toBe(
-      'https://oauth2.xumm.app/auth?client_id=public-app-id&redirect_uri=http%3A%2F%2F127.0.0.1%3A3000&force_network=TESTNET',
-    )
-    expect(forceXamanOAuthNetwork('https://example.com/auth?client_id=other')).toBe(
-      'https://example.com/auth?client_id=other',
-    )
-  })
-
-  it('uses one stable Xaman redirect for every application route', () => {
-    expect(resolveXamanRedirectUrl(undefined, 'https://xcs.example/studio?draft=1#form')).toBe(
-      'https://xcs.example/',
-    )
-    expect(resolveXamanRedirectUrl(undefined, 'https://xcs.example/verify/credential')).toBe(
-      'https://xcs.example/',
-    )
-    expect(
-      resolveXamanRedirectUrl('  http://127.0.0.1:3000/  ', 'http://127.0.0.1:3000/issue'),
-    ).toBe('http://127.0.0.1:3000/')
-  })
-
-  it('rejects unsafe or route-specific Xaman redirect configuration', () => {
-    expect(() =>
-      resolveXamanRedirectUrl('https://attacker.example/', 'https://xcs.example/studio'),
-    ).toThrow('must use the current application origin')
-    expect(() =>
-      resolveXamanRedirectUrl('https://xcs.example/studio', 'https://xcs.example/studio'),
-    ).toThrow('must be the application origin with a trailing slash')
-    expect(() =>
-      resolveXamanRedirectUrl('http://xcs.example/', 'http://xcs.example/studio'),
-    ).toThrow('requires HTTPS outside local loopback development')
-  })
-
-  it('binds the Xaman Testnet authorization request to the stable redirect', () => {
-    expect(
-      configureXamanOAuthRequest(
-        'https://oauth2.xumm.app/auth?client_id=public-app-id&redirect_uri=https%3A%2F%2Fxcs.example%2Fstudio',
-        'https://xcs.example/',
-      ),
-    ).toBe(
-      'https://oauth2.xumm.app/auth?client_id=public-app-id&redirect_uri=https%3A%2F%2Fxcs.example%2F&force_network=TESTNET',
-    )
-    expect(
-      configureXamanOAuthRequest(
-        'https://example.com/auth?redirect_uri=https%3A%2F%2Fxcs.example%2Fstudio',
-        'https://xcs.example/',
-      ),
-    ).toBe('https://example.com/auth?redirect_uri=https%3A%2F%2Fxcs.example%2Fstudio')
-  })
-
-  it('evicts only cached Xaman sessions that cannot prove the required network', () => {
-    const removeItem = vi.fn()
-    const mainnetStorage = {
-      getItem: vi.fn().mockReturnValue(JSON.stringify({ me: { networkId: '0' } })),
-      removeItem,
-    }
-
-    clearMismatchedXamanSession(mainnetStorage, 1)
-    expect(removeItem).toHaveBeenCalledWith('XummPkceJwt')
-
-    removeItem.mockClear()
-    const testnetStorage = {
-      getItem: vi.fn().mockReturnValue(JSON.stringify({ me: { networkId: '1' } })),
-      removeItem,
-    }
-    clearMismatchedXamanSession(testnetStorage, 1)
-    expect(removeItem).not.toHaveBeenCalled()
-  })
-
-  it('closes the Xaman sign window and restores focus after the wallet returns', async () => {
-    const close = vi.fn()
-    const focus = vi.fn()
-    const originalOpen = vi.fn(() => ({ closed: false, close }))
-    const browserWindow = { open: originalOpen, focus } as unknown as Window
-
-    await expect(
-      withXamanSignWindow(browserWindow, async () => {
-        browserWindow.open('https://xumm.app/sign/request', 'Xaman Sign')
-        return 'signed'
-      }),
-    ).resolves.toBe('signed')
-
-    expect(close).toHaveBeenCalledOnce()
-    expect(focus).toHaveBeenCalledOnce()
-    expect(browserWindow.open).toBe(originalOpen)
-  })
-
-  it('restores the application window when Xaman signing fails', async () => {
-    const close = vi.fn()
-    const focus = vi.fn()
-    const originalOpen = vi.fn(() => ({ closed: false, close }))
-    const browserWindow = { open: originalOpen, focus } as unknown as Window
-
-    await expect(
-      withXamanSignWindow(browserWindow, async () => {
-        browserWindow.open('https://xumm.app/sign/request', 'Xaman Sign')
-        throw new Error('SIGN_FAILED')
-      }),
-    ).rejects.toThrow('SIGN_FAILED')
-
-    expect(close).toHaveBeenCalledOnce()
-    expect(focus).toHaveBeenCalledOnce()
-    expect(browserWindow.open).toBe(originalOpen)
+  it('only reports Otsu as available when its browser provider marker is present', async () => {
+    const otsu = createXrplConnectAdapters().find((adapter) => adapter.id === 'otsu')!
+    vi.stubGlobal('window', { xrpl: {} })
+    await expect(otsu.isAvailable()).resolves.toBe(false)
+    vi.stubGlobal('window', { xrpl: { isOtsu: true } })
+    await expect(otsu.isAvailable()).resolves.toBe(true)
   })
 })
diff --git a/apps/web/test/walletCompatibility.test.ts b/apps/web/test/walletCompatibility.test.ts
index 070db1e..6970f64 100644
--- a/apps/web/test/walletCompatibility.test.ts
+++ b/apps/web/test/walletCompatibility.test.ts
@@ -1,45 +1,31 @@
-import { describe, expect, it } from 'vitest'
+import { CrossmarkAdapter, OtsuAdapter, WalletError, WalletErrorCode } from 'xrpl-connect'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import {
-  assertWalletSupportsXcsTransaction,
   normalizeWalletTransactionError,
+  OTSU_SIGNING_ACCOUNT_UNAVAILABLE,
   parseWalletCredentialTransactionError,
   walletCredentialSupport,
 } from '../app/utils/walletCompatibility'
 
-const gemWallet = { id: 'gemwallet', name: 'GemWallet' }
-const xaman = { id: 'xaman', name: 'Xaman' }
-const crossmark = { id: 'crossmark', name: 'Crossmark' }
+const crossmark = new CrossmarkAdapter()
 
 describe('wallet Credential transaction compatibility', () => {
-  it.each(['CredentialCreate', 'CredentialAccept', 'CredentialDelete'] as const)(
-    'blocks GemWallet before a %s signing attempt',
-    (transactionType) => {
-      expect(() => assertWalletSupportsXcsTransaction(gemWallet, transactionType)).toThrowError(
-        `WALLET_CREDENTIAL_TRANSACTION_UNSUPPORTED:gemwallet:${transactionType}`,
-      )
-    },
-  )
-
-  it('keeps GemWallet available for schema-registration Payments', () => {
-    expect(() => assertWalletSupportsXcsTransaction(gemWallet, 'Payment')).not.toThrow()
-  })
+  afterEach(() => vi.unstubAllGlobals())
 
   it('does not claim that unqualified adapters have native Credential support', () => {
     expect(walletCredentialSupport('xaman')).toBe('supported')
-    expect(walletCredentialSupport('gemwallet')).toBe('unsupported')
+    expect(walletCredentialSupport('gemwallet')).toBe('raw')
     expect(walletCredentialSupport('crossmark')).toBe('unverified')
-    expect(() => assertWalletSupportsXcsTransaction(xaman, 'CredentialCreate')).not.toThrow()
-    expect(() => assertWalletSupportsXcsTransaction(crossmark, 'CredentialCreate')).not.toThrow()
   })
 
-  it('maps the exact nested pre-Credentials codec error to an actionable stable code', () => {
+  it('maps the exact nested pre-Credentials codec error to an actionable stable code', async () => {
     const original = new Error('Invalid field TransactionType: CredentialCreate')
     const wrapped = Object.assign(new Error('Failed to sign transaction.'), {
       originalError: original,
     })
 
-    const normalized = normalizeWalletTransactionError(wrapped, crossmark, 'CredentialCreate')
+    const normalized = await normalizeWalletTransactionError(wrapped, crossmark, 'CredentialCreate')
 
     expect(normalized.message).toBe(
       'WALLET_CREDENTIAL_TRANSACTION_UNSUPPORTED:crossmark:CredentialCreate',
@@ -47,25 +33,48 @@ describe('wallet Credential transaction compatibility', () => {
     expect(normalized.cause).toBe(wrapped)
   })
 
-  it('preserves unrelated wallet errors and transaction types', () => {
+  it('preserves unrelated wallet errors and transaction types', async () => {
     const rejected = new Error('User rejected the request')
     const broaderDiagnostic = new Error(
       'Retry failed after Invalid field TransactionType: CredentialCreate while loading the account',
     )
 
-    expect(normalizeWalletTransactionError(rejected, crossmark, 'CredentialCreate')).toBe(rejected)
-    expect(normalizeWalletTransactionError(broaderDiagnostic, crossmark, 'CredentialCreate')).toBe(
-      broaderDiagnostic,
-    )
+    await expect(
+      normalizeWalletTransactionError(rejected, crossmark, 'CredentialCreate'),
+    ).resolves.toBe(rejected)
+    await expect(
+      normalizeWalletTransactionError(broaderDiagnostic, crossmark, 'CredentialCreate'),
+    ).resolves.toBe(broaderDiagnostic)
     expect(
-      normalizeWalletTransactionError(
-        new Error('Invalid field TransactionType: CredentialCreate'),
-        crossmark,
-        'Payment',
+      (
+        await normalizeWalletTransactionError(
+          new Error('Invalid field TransactionType: CredentialCreate'),
+          crossmark,
+          'Payment',
+        )
       ).message,
     ).toBe('Invalid field TransactionType: CredentialCreate')
   })
 
+  it('distinguishes an installed Otsu signing-account failure from a missing extension', async () => {
+    const otsu = new OtsuAdapter()
+    const original = new WalletError(
+      WalletErrorCode.WALLET_NOT_INSTALLED,
+      'Otsu Wallet is not installed',
+    )
+    vi.stubGlobal('window', { xrpl: { isOtsu: true } })
+    await expect(
+      normalizeWalletTransactionError(original, otsu, 'CredentialCreate'),
+    ).resolves.toMatchObject({
+      message: OTSU_SIGNING_ACCOUNT_UNAVAILABLE,
+      cause: original,
+    })
+    vi.stubGlobal('window', { xrpl: {} })
+    await expect(normalizeWalletTransactionError(original, otsu, 'CredentialCreate')).resolves.toBe(
+      original,
+    )
+  })
+
   it('parses only complete, safe compatibility codes for localized display', () => {
     expect(
       parseWalletCredentialTransactionError(
diff --git a/apps/web/test/walletConnection.test.ts b/apps/web/test/walletConnection.test.ts
new file mode 100644
index 0000000..e42c20a
--- /dev/null
+++ b/apps/web/test/walletConnection.test.ts
@@ -0,0 +1,226 @@
+import { createApp } from 'vue'
+import { createXrplConnect, useWallet } from '@xrpl-commons/xrpl-connect-vue'
+import { CrossmarkAdapter, CrossmarkSDK } from 'xrpl-connect'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { connectWallet, refreshWalletAccount } from '../app/utils/walletConnection'
+
+// Only the extension transport is doubled. Exercise the shipped Crossmark
+// adapter, WalletManager and Vue bindings together, not a fake app account.
+const signIn = { response: { data: { address: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh' } } }
+const testnet = {
+  response: {
+    data: {
+      network: {
+        protocol: 'XRPL',
+        label: 'xrp ledger',
+        type: 'testnet',
+        wss: 'wss://s.altnet.rippletest.net:51233',
+      },
+    },
+  },
+}
+
+function setup() {
+  vi.spyOn(CrossmarkSDK.default.sync, 'isInstalled').mockReturnValue(true)
+  const approval = vi
+    .spyOn(CrossmarkSDK.default.methods, 'signInAndWait')
+    .mockResolvedValue(signIn as never)
+  const network = vi
+    .spyOn(CrossmarkSDK.default.api, 'awaitRequest')
+    .mockResolvedValue(testnet as never)
+  const app = createApp({})
+  app.use(
+    createXrplConnect({
+      adapters: [new CrossmarkAdapter()],
+      network: 'testnet',
+      autoConnect: false,
+      logger: { level: 'silent' },
+      storage: {
+        get: async () => null,
+        set: async () => {},
+        remove: async () => {},
+        clear: async () => {},
+      },
+    }),
+  )
+  return { wallet: app.runWithContext(() => useWallet()), approval, network }
+}
+
+afterEach(() => {
+  CrossmarkSDK.default.emit('signout')
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('bounded account refresh through the official manager and Vue binding', () => {
+  async function connected() {
+    const state = setup()
+    await connectWallet(state.wallet, 'crossmark', new AbortController().signal)
+    CrossmarkSDK.default.emit('network-change', testnet.response.data)
+    state.network.mockResolvedValue(signIn as never)
+    return state
+  }
+
+  it('returns a real adapter refresh and releases its deadline', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = await connected()
+    await expect(refreshWalletAccount(wallet, 100)).resolves.toMatchObject({
+      address: signIn.response.data.address,
+      network: { id: 'testnet' },
+    })
+    expect(network).toHaveBeenLastCalledWith({ command: 'address' })
+    expect(wallet.connected.value).toBe(true)
+    expect(vi.getTimerCount()).toBe(0)
+    await wallet.disconnect()
+  })
+
+  it('clears the session on timeout without waiting for stalled extension teardown', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = await connected()
+    let reply!: (value: never) => void
+    network.mockImplementationOnce(() => new Promise((resolve) => (reply = resolve)))
+    vi.spyOn(wallet.manager.wallet!, 'disconnect').mockImplementation(() => new Promise(() => {}))
+    const result = expect(refreshWalletAccount(wallet, 100)).rejects.toThrow(
+      'WALLET_REFRESH_TIMEOUT',
+    )
+    await vi.advanceTimersByTimeAsync(100)
+    await result
+    expect(wallet.manager.connected).toBe(false)
+    expect(wallet.manager.account).toBeNull()
+    reply(signIn as never)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(wallet.manager.account).toBeNull()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('ignores a late response after timeout and reconnection', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = await connected()
+    let reply!: (value: never) => void
+    network.mockImplementationOnce(() => new Promise((resolve) => (reply = resolve)))
+    const result = expect(refreshWalletAccount(wallet, 100)).rejects.toThrow(
+      'WALLET_REFRESH_TIMEOUT',
+    )
+    await vi.advanceTimersByTimeAsync(100)
+    await result
+    network.mockResolvedValue(testnet as never)
+    await connectWallet(wallet, 'crossmark', new AbortController().signal)
+    reply({ response: { data: { address: 'stale-address' } } } as never)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(wallet.account.value?.address).toBe(signIn.response.data.address)
+    await wallet.disconnect()
+  })
+
+  it('cancels on disconnect and never times out a replacement session', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = await connected()
+    network.mockImplementationOnce(() => new Promise(() => {}))
+    const result = expect(refreshWalletAccount(wallet, 100)).rejects.toThrow(
+      'WALLET_CHANGED_AFTER_PREVIEW',
+    )
+    await wallet.disconnect()
+    await result
+    network.mockResolvedValue(testnet as never)
+    await connectWallet(wallet, 'crossmark', new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(100)
+    expect(wallet.connected.value).toBe(true)
+    expect(vi.getTimerCount()).toBe(0)
+    await wallet.disconnect()
+  })
+})
+
+describe('Crossmark connection through the official Vue binding', () => {
+  it('settles timeout even if the extension never finishes teardown', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = setup()
+    network.mockImplementation(() => new Promise(() => {}))
+    vi.spyOn(wallet.manager.wallets[0]!, 'disconnect').mockImplementation(
+      () => new Promise(() => {}),
+    )
+    const result = expect(
+      connectWallet(wallet, 'crossmark', new AbortController().signal, 100),
+    ).rejects.toThrow('WALLET_CONNECTION_TIMEOUT')
+    await vi.advanceTimersByTimeAsync(100)
+    await result
+    expect(wallet.account.value).toBeNull()
+    expect(wallet.connecting.value).toBe(false)
+    expect(wallet.manager.connectingWallet).toBeNull()
+  })
+  it('updates the shared account only after approval and network confirmation; clears it on disconnect', async () => {
+    const { wallet } = setup()
+    expect(wallet.account.value).toBeNull()
+    await connectWallet(wallet, 'crossmark', new AbortController().signal)
+    expect(wallet.connected.value).toBe(true)
+    expect(wallet.account.value?.address).toBe(signIn.response.data.address)
+    expect(wallet.account.value?.network.id).toBe('testnet')
+    expect(wallet.connecting.value).toBe(false)
+    await wallet.disconnect()
+    expect(wallet.account.value).toBeNull()
+  })
+
+  it('does not turn a rejected approval into a connected session', async () => {
+    const { wallet, approval } = setup()
+    approval.mockResolvedValue({ response: { data: { meta: { isRejected: true } } } } as never)
+    await expect(connectWallet(wallet, 'crossmark', new AbortController().signal)).rejects.toThrow()
+    expect(wallet.account.value).toBeNull()
+    expect(wallet.connecting.value).toBe(false)
+  })
+
+  it('rejects Mainnet rather than inventing a Testnet connection', async () => {
+    const { wallet, network } = setup()
+    network.mockResolvedValue({
+      response: {
+        data: {
+          network: {
+            ...testnet.response.data.network,
+            type: 'mainnet',
+            wss: 'wss://s1.ripple.com',
+          },
+        },
+      },
+    } as never)
+    await expect(connectWallet(wallet, 'crossmark', new AbortController().signal)).rejects.toThrow()
+    expect(wallet.account.value).toBeNull()
+  })
+
+  it('times out a missing post-approval network response and clears pending state', async () => {
+    vi.useFakeTimers()
+    const { wallet, network } = setup()
+    network.mockImplementation(() => new Promise(() => {}))
+    const attempt = connectWallet(wallet, 'crossmark', new AbortController().signal, 100)
+    const result = expect(attempt).rejects.toThrow('WALLET_CONNECTION_TIMEOUT')
+    await vi.advanceTimersByTimeAsync(50)
+    expect(network).toHaveBeenCalled()
+    expect(wallet.connecting.value).toBe(true)
+    expect(wallet.account.value).toBeNull()
+    await vi.advanceTimersByTimeAsync(50)
+    await result
+    expect(wallet.connecting.value).toBe(false)
+    expect(wallet.manager.connectingWallet).toBeNull()
+  })
+
+  it('ignores late approval after cancellation, including after a successful retry', async () => {
+    const { wallet, network } = setup()
+    let reply!: (value: never) => void
+    network.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          reply = resolve
+        }),
+    )
+    const controller = new AbortController()
+    const attempt = connectWallet(wallet, 'crossmark', controller.signal)
+    const result = expect(attempt).rejects.toThrow('WALLET_CONNECTION_CANCELLED')
+    await vi.waitFor(() => expect(network).toHaveBeenCalled())
+    controller.abort()
+    await result
+    expect(wallet.account.value).toBeNull()
+    expect(wallet.connecting.value).toBe(false)
+    await connectWallet(wallet, 'crossmark', new AbortController().signal)
+    reply(testnet as never)
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(wallet.connected.value).toBe(true)
+    expect(wallet.account.value?.address).toBe(signIn.response.data.address)
+    await wallet.disconnect()
+  })
+})
diff --git a/apps/web/test/walletDiscovery.test.ts b/apps/web/test/walletDiscovery.test.ts
new file mode 100644
index 0000000..b16ef68
--- /dev/null
+++ b/apps/web/test/walletDiscovery.test.ts
@@ -0,0 +1,59 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { CrossmarkAdapter, CrossmarkSDK, WalletManager } from 'xrpl-connect'
+import { observeWalletAvailability } from '../app/utils/walletDiscovery'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('live wallet availability', () => {
+  it('updates the same open chooser when the real SDK detects Crossmark after its first snapshot', async () => {
+    const installed = vi.spyOn(CrossmarkSDK.default.sync, 'isInstalled').mockReturnValue(false)
+    // The SDK's own detected listener also asks the extension for its session.
+    vi.spyOn(CrossmarkSDK.default.api, 'awaitRequest').mockResolvedValue({
+      response: { data: {} },
+    } as never)
+    const manager = new WalletManager({
+      adapters: [new CrossmarkAdapter()],
+      logger: { level: 'silent' },
+    })
+    const onChange = vi.fn()
+    const onError = vi.fn()
+    const stop = observeWalletAvailability({
+      manager,
+      events: CrossmarkSDK.default,
+      onChange,
+      onError,
+    })
+    await vi.waitFor(() => expect(onChange).toHaveBeenCalledWith([]))
+    installed.mockReturnValue(true)
+    CrossmarkSDK.default.emit('detected')
+    await vi.waitFor(() => expect(onChange).toHaveBeenLastCalledWith([manager.wallets[0]]))
+    expect(onError).not.toHaveBeenCalled()
+    stop()
+    CrossmarkSDK.default.emit('detected')
+    expect(onChange).toHaveBeenCalledTimes(2)
+  })
+
+  it('coalesces discovery during a snapshot and ignores completion after the chooser closes', async () => {
+    const events = new EventEmitter()
+    const adapter = new CrossmarkAdapter()
+    let finish!: (wallets: (typeof adapter)[]) => void
+    const manager = {
+      getAvailableWallets: vi.fn(
+        () => new Promise<(typeof adapter)[]>((resolve) => (finish = resolve)),
+      ),
+    }
+    const onChange = vi.fn()
+    const stop = observeWalletAvailability({ manager, events, onChange, onError: vi.fn() })
+    events.emit('detected')
+    events.emit('detected')
+    finish([])
+    await vi.waitFor(() => expect(manager.getAvailableWallets).toHaveBeenCalledTimes(2))
+    expect(onChange).not.toHaveBeenCalled()
+    stop()
+    finish([adapter])
+    await Promise.resolve()
+    expect(onChange).not.toHaveBeenCalled()
+    expect(events.listenerCount('detected')).toBe(0)
+  })
+})
diff --git a/apps/web/test/walletLinkProof.test.ts b/apps/web/test/walletLinkProof.test.ts
new file mode 100644
index 0000000..a70fd16
--- /dev/null
+++ b/apps/web/test/walletLinkProof.test.ts
@@ -0,0 +1,244 @@
+import { createHash, ECDH, generateKeyPairSync, sign as nodeSign } from 'node:crypto'
+
+import { deriveAddress, deriveKeypair, generateSeed, sign } from 'ripple-keypairs'
+import { describe, expect, it, vi } from 'vitest'
+import type { AccountInfo, WalletAdapter, WalletEvent } from 'xrpl-connect'
+
+import { signWalletLinkChallenge, type WalletProofManager } from '../app/utils/walletLinkProof'
+import { verifyWalletProof, type WalletProof } from '../server/xcs/auth/wallet-proof'
+
+const message = 'XCS wallet link\norigin:https://xcs.example\nnetwork:testnet\nnonce:one-use'
+const keypair = deriveKeypair(generateSeed({ algorithm: 'ecdsa-secp256k1' }))
+const address = deriveAddress(keypair.publicKey)
+
+function wallet(id = 'gemwallet') {
+  const account: AccountInfo = {
+    address,
+    publicKey: keypair.publicKey,
+    network: { id: 'testnet', name: 'Testnet', wss: 'wss://test.example' },
+  }
+  const listeners = new Map<WalletEvent, Set<() => void>>()
+  const manager = {
+    connected: true,
+    account,
+    wallet: { id } as WalletAdapter,
+    supports: vi.fn(() => true),
+    fetchAccount: vi.fn(async () => manager.account),
+    signMessage: vi.fn(async (input: string) => ({
+      message: input,
+      signature: sign(
+        id === 'metamask-snap' ? input : Buffer.from(input).toString('hex'),
+        keypair.privateKey,
+      ),
+      publicKey: keypair.publicKey,
+      signerAddress: address,
+    })),
+    on: vi.fn((event: WalletEvent, callback: () => void) => {
+      const callbacks = listeners.get(event) ?? new Set()
+      callbacks.add(callback)
+      listeners.set(event, callbacks)
+    }),
+    off: vi.fn((event: WalletEvent, callback: () => void) => {
+      listeners.get(event)?.delete(callback)
+    }),
+  }
+  return {
+    manager,
+    emit: (event: WalletEvent) => listeners.get(event)?.forEach((callback) => callback()),
+    api: manager as unknown as WalletProofManager,
+  }
+}
+
+describe('wallet proof cryptography', () => {
+  it.each(['ecdsa-secp256k1', 'ed25519'] as const)(
+    'verifies genuine ripple %s signatures',
+    (algorithm) => {
+      const keys = deriveKeypair(generateSeed({ algorithm }))
+      const proof: WalletProof = {
+        publicKey: keys.publicKey,
+        signature: sign(Buffer.from(message).toString('hex'), keys.privateKey),
+        scheme: 'ripple',
+      }
+      expect(verifyWalletProof(message, deriveAddress(keys.publicKey), proof)).toBe(true)
+      expect(
+        verifyWalletProof(`${message}-another-nonce`, deriveAddress(keys.publicKey), proof),
+      ).toBe(false)
+      expect(verifyWalletProof(message, 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh', proof)).toBe(false)
+      expect(
+        verifyWalletProof(message, deriveAddress(keys.publicKey), { ...proof, scheme: 'otsu' }),
+      ).toBe(false)
+    },
+  )
+
+  it('verifies the exact compact double-SHA256 signature produced by Otsu noble v2', () => {
+    // Generated with Otsu's installed noble/curves v2 sign(sha256(utf8), key).
+    const publicKey = '0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'
+    const proof: WalletProof = {
+      publicKey,
+      signature:
+        '00ce986cd9e70d524391229c2e9efd07f5000ecc948ee7f303b2eff807dd3d5a3133428382215669e4d17a7635f41fafd77de3de12aed8b0af09d8073bd13c12',
+      scheme: 'otsu',
+    }
+    expect(
+      verifyWalletProof(
+        'XCS wallet link compatibility fixture v1',
+        deriveAddress(publicKey),
+        proof,
+      ),
+    ).toBe(true)
+    expect(verifyWalletProof(message, deriveAddress(publicKey), proof)).toBe(false)
+  })
+
+  it('accepts compact Otsu signatures, rejects single-hash and wrong scheme', () => {
+    const keys = generateKeyPairSync('ec', { namedCurve: 'secp256k1' })
+    const der = keys.publicKey.export({ type: 'spki', format: 'der' })
+    const publicKey = Buffer.from(
+      ECDH.convertKey(der.subarray(-65), 'secp256k1', undefined, undefined, 'compressed'),
+    ).toString('hex')
+    const proof: WalletProof = {
+      publicKey,
+      signature: nodeSign('sha256', createHash('sha256').update(message).digest(), {
+        key: keys.privateKey,
+        dsaEncoding: 'ieee-p1363',
+      }).toString('hex'),
+      scheme: 'otsu',
+    }
+    expect(verifyWalletProof(message, deriveAddress(publicKey), proof)).toBe(true)
+    expect(
+      verifyWalletProof(message, deriveAddress(publicKey), { ...proof, scheme: 'ripple' }),
+    ).toBe(false)
+    const singleHash = nodeSign('sha256', Buffer.from(message), {
+      key: keys.privateKey,
+      dsaEncoding: 'ieee-p1363',
+    }).toString('hex')
+    expect(
+      verifyWalletProof(message, deriveAddress(publicKey), { ...proof, signature: singleHash }),
+    ).toBe(false)
+  })
+
+  it.each([
+    { signature: 'zz'.repeat(64) },
+    { signature: 'a'.repeat(127) },
+    { publicKey: '02' + '00'.repeat(32) },
+    { scheme: 'unknown' },
+    { publicKey: 'ED' },
+  ])('rejects malformed proof %j without throwing', (change) => {
+    const proof = {
+      publicKey: keypair.publicKey,
+      signature: sign(Buffer.from(message).toString('hex'), keypair.privateKey),
+      scheme: 'ripple',
+      ...change,
+    } as WalletProof
+    expect(verifyWalletProof(message, address, proof)).toBe(false)
+  })
+})
+
+describe('wallet link challenge signing', () => {
+  it('preserves the Otsu text challenge and selects its exact signature scheme', async () => {
+    const fixture = wallet('otsu')
+    const publicKey = '0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'
+    const otsuAddress = deriveAddress(publicKey)
+    const challenge = 'XCS wallet link compatibility fixture v1'
+    fixture.manager.account = { ...fixture.manager.account, address: otsuAddress, publicKey }
+    fixture.manager.signMessage.mockResolvedValueOnce({
+      message: challenge,
+      publicKey,
+      signature:
+        '00ce986cd9e70d524391229c2e9efd07f5000ecc948ee7f303b2eff807dd3d5a3133428382215669e4d17a7635f41fafd77de3de12aed8b0af09d8073bd13c12',
+      signerAddress: otsuAddress,
+    })
+    const proof = await signWalletLinkChallenge(fixture.api, { address: otsuAddress }, challenge)
+    expect(proof.scheme).toBe('otsu')
+    expect(fixture.manager.signMessage).toHaveBeenCalledWith(challenge)
+    expect(verifyWalletProof(challenge, otsuAddress, proof)).toBe(true)
+  })
+
+  it.each(['gemwallet', 'metamask-snap'])('signs verifiable challenges through %s', async (id) => {
+    const fixture = wallet(id)
+    const proof = await signWalletLinkChallenge(
+      fixture.api,
+      { address, networkId: 'testnet' },
+      message,
+    )
+    expect(verifyWalletProof(message, address, proof)).toBe(true)
+    expect(fixture.manager.signMessage).toHaveBeenCalledWith(
+      id === 'metamask-snap' ? Buffer.from(message).toString('hex') : message,
+    )
+    expect(fixture.manager.fetchAccount).toHaveBeenCalledTimes(2)
+    expect(fixture.manager.off).toHaveBeenCalledTimes(5)
+  })
+
+  it.each(['xaman', 'crossmark', 'walletconnect', 'ledger', 'xyra', 'custom'])(
+    'rejects unverified %s formats even when a capability is declared',
+    async (id) => {
+      const fixture = wallet(id)
+      await expect(signWalletLinkChallenge(fixture.api, { address }, message)).rejects.toThrow(
+        'WALLET_LINK_UNSUPPORTED',
+      )
+      expect(fixture.manager.signMessage).not.toHaveBeenCalled()
+    },
+  )
+
+  it('requires the capability and expected network before signing', async () => {
+    const fixture = wallet()
+    fixture.manager.supports.mockReturnValue(false)
+    await expect(signWalletLinkChallenge(fixture.api, { address }, message)).rejects.toThrow(
+      'WALLET_LINK_UNSUPPORTED',
+    )
+    fixture.manager.supports.mockReturnValue(true)
+    await expect(
+      signWalletLinkChallenge(fixture.api, { address, networkId: 'mainnet' }, message),
+    ).rejects.toThrow('WALLET_LINK_SESSION_CHANGED')
+    expect(fixture.manager.signMessage).not.toHaveBeenCalled()
+  })
+
+  it.each(['account', 'network', 'reconnect', 'adapter'])(
+    'rejects %s changes while the wallet signs',
+    async (change) => {
+      const fixture = wallet()
+      fixture.manager.signMessage.mockImplementationOnce(async (input) => {
+        if (change === 'account')
+          fixture.manager.account = { ...fixture.manager.account, address: 'different' }
+        if (change === 'network')
+          fixture.manager.account = {
+            ...fixture.manager.account,
+            network: { ...fixture.manager.account.network, id: 'mainnet' },
+          }
+        if (change === 'reconnect') fixture.emit('connect')
+        if (change === 'adapter') fixture.manager.wallet = { id: 'gemwallet' } as WalletAdapter
+        return {
+          message: input,
+          publicKey: keypair.publicKey,
+          signature: 'a'.repeat(128),
+          signerAddress: address,
+        }
+      })
+      await expect(signWalletLinkChallenge(fixture.api, { address }, message)).rejects.toThrow(
+        'WALLET_LINK_SESSION_CHANGED',
+      )
+      expect(fixture.manager.off).toHaveBeenCalledTimes(5)
+    },
+  )
+
+  it('rejects a changed returned message and a key that does not own the expected address', async () => {
+    const fixture = wallet()
+    const returned = {
+      message: 'different',
+      publicKey: keypair.publicKey,
+      signature: 'a'.repeat(128),
+      signerAddress: address,
+    }
+    fixture.manager.signMessage.mockResolvedValueOnce(returned)
+    await expect(signWalletLinkChallenge(fixture.api, { address }, message)).rejects.toThrow(
+      'WALLET_LINK_PROOF_INVALID',
+    )
+    fixture.manager.signMessage.mockResolvedValueOnce({
+      ...returned,
+      message,
+      publicKey: deriveKeypair(generateSeed()).publicKey,
+    })
+    await expect(signWalletLinkChallenge(fixture.api, { address }, message)).rejects.toThrow(
+      'WALLET_LINK_PROOF_INVALID',
+    )
+  })
+})
diff --git a/apps/web/test/walletOperationCleanup.test.ts b/apps/web/test/walletOperationCleanup.test.ts
new file mode 100644
index 0000000..cbe7709
--- /dev/null
+++ b/apps/web/test/walletOperationCleanup.test.ts
@@ -0,0 +1,73 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { finishWalletOperation } from '../app/utils/walletOperationCleanup'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('wallet operation cleanup', () => {
+  it('releases busy state when setup failed before creating an RPC client', async () => {
+    const busy = { value: true }
+    const refresh = vi.fn().mockResolvedValue([])
+    await finishWalletOperation(busy, refresh)
+    expect(refresh).toHaveBeenCalledOnce()
+    expect(busy.value).toBe(false)
+  })
+
+  it.each(['history', 'disconnect', 'both'] as const)(
+    'keeps the validated result and unlocks the UI despite a %s cleanup failure',
+    async (failure) => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      const busy = { value: true }
+      const refresh = vi.fn(async () => {
+        if (failure !== 'disconnect') throw new Error('history unavailable')
+      })
+      const client = {
+        isConnected: () => true,
+        disconnect: vi.fn(async () => {
+          if (failure !== 'history') throw new Error('connection close failed')
+        }),
+      }
+      const result = { status: 'validated', transactionResult: 'tesSUCCESS' }
+      const operation = async () => {
+        try {
+          return result
+        } finally {
+          await finishWalletOperation(busy, refresh, client)
+        }
+      }
+      await expect(operation()).resolves.toBe(result)
+      expect(client.disconnect).toHaveBeenCalledOnce()
+      expect(busy.value).toBe(false)
+    },
+  )
+
+  it('preserves the original operation error when cleanup also fails', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const busy = { value: true }
+    const original = new Error('wallet approval rejected')
+    const operation = async () => {
+      try {
+        throw original
+      } finally {
+        await finishWalletOperation(busy, async () => {}, {
+          isConnected: () => true,
+          disconnect: async () => {
+            throw new Error('connection close failed')
+          },
+        })
+      }
+    }
+    await expect(operation()).rejects.toBe(original)
+    expect(busy.value).toBe(false)
+  })
+
+  it('does not disconnect an already closed connection', async () => {
+    const busy = { value: true }
+    const disconnect = vi.fn()
+    await finishWalletOperation(busy, async () => {}, {
+      isConnected: () => false,
+      disconnect,
+    })
+    expect(disconnect).not.toHaveBeenCalled()
+    expect(busy.value).toBe(false)
+  })
+})
diff --git a/apps/web/test/walletSubmission.test.ts b/apps/web/test/walletSubmission.test.ts
index 976cdfb..f52d7de 100644
--- a/apps/web/test/walletSubmission.test.ts
+++ b/apps/web/test/walletSubmission.test.ts
@@ -28,9 +28,12 @@ import {
   applyJournalEntry,
   canAbandonOperation,
   canRetryOperation,
+  completeOperationPublication,
   operationBusinessKey,
+  operationConflictsWith,
   serializeOperationReceipts,
   toSanitizedOperationReceipt,
+  validateOperationBusinessContext,
   type StoredOperation,
 } from '../app/utils/operationJournal'
 import {
@@ -69,6 +72,57 @@ function storedOperation(overrides: Partial<StoredOperation> = {}): StoredOperat
 }
 
 describe('wallet sign-only normalization', () => {
+  it('releases the business lock when a fresh wallet signature expires before persistence or relay', async () => {
+    const wallet = Wallet.generate()
+    const subject = Wallet.generate().address
+    const schemaUid = '12'.repeat(32)
+    const transaction = {
+      TransactionType: 'CredentialCreate' as const,
+      Account: wallet.address,
+      Subject: subject,
+      CredentialType: schemaUid,
+      Fee: '12',
+      Sequence: 1,
+      LastLedgerSequence: 100,
+    }
+    const signed = wallet.sign(transaction)
+    const initial = storedOperation({
+      account: wallet.address,
+      transactionType: 'CredentialCreate',
+      business: { action: 'credential-issue', issuer: wallet.address, subject, schemaUid },
+    })
+    const entries: SubmissionJournalEntry[] = []
+    const submit = vi.fn()
+    const persist = vi.fn()
+    await expect(
+      signPreparedAndSubmit(
+        {
+          isConnected: () => true,
+          submit,
+          request: async () => ({ result: { ledger_current_index: 101 } }),
+        } as unknown as Client,
+        transaction,
+        createWalletSigner({ sign: async () => ({ hash: '', tx_blob: signed.tx_blob }) }),
+        {
+          journal: {
+            append: async (entry) => {
+              entries.push(entry)
+            },
+          },
+          onValidatedSignature: persist,
+        },
+      ),
+    ).rejects.toMatchObject({ code: 'XCS_SDK_TRANSACTION_EXPIRED' })
+    const failed = entries.reduce(applyJournalEntry, initial)
+    expect(failed.stage).toBe('failed')
+    expect(failed.txBlob).toBeUndefined()
+    expect(failed.txHash).toBeUndefined()
+    expect(persist).not.toHaveBeenCalled()
+    expect(submit).not.toHaveBeenCalled()
+    expect(operationConflictsWith(initial, { ...initial, operationId: 'fresh-review' })).toBe(true)
+    expect(operationConflictsWith(failed, { ...initial, operationId: 'fresh-review' })).toBe(false)
+  })
+
   it('derives the XRPL hash when the wallet returns an empty hash', () => {
     const { signed } = signedPayment()
     const normalized = normalizeWalletSignature({ hash: '', tx_blob: signed.tx_blob })
@@ -249,7 +303,11 @@ describe('wallet sign-only normalization', () => {
     const persist = vi.fn()
     const submit = vi.fn()
     const entries: SubmissionJournalEntry[] = []
-    const client = { isConnected: () => true, submit } as unknown as Client
+    const client = {
+      isConnected: () => true,
+      submit,
+      request: async () => ({ result: { ledger_current_index: 99 } }),
+    } as unknown as Client
 
     await expect(
       signPreparedAndSubmit(
@@ -276,7 +334,11 @@ describe('wallet sign-only normalization', () => {
     const changed = attacker.sign({ ...transaction, Account: attacker.address })
     const persist = vi.fn()
     const submit = vi.fn()
-    const client = { isConnected: () => true, submit } as unknown as Client
+    const client = {
+      isConnected: () => true,
+      submit,
+      request: async () => ({ result: { ledger_current_index: 99 } }),
+    } as unknown as Client
 
     await expect(
       signPreparedAndSubmit(
@@ -318,6 +380,7 @@ describe('wallet sign-only normalization', () => {
       request: async () => ({
         result: {
           validated: true,
+          ledger_current_index: 99,
           ledger_index: 99,
           meta: { TransactionResult: 'tesSUCCESS' },
         },
@@ -347,6 +410,40 @@ describe('wallet sign-only normalization', () => {
     ])
   })
 
+  it('retains publication recovery before a volatile submission guard rejects the signed operation', async () => {
+    const { transaction, signed } = signedPayment()
+    const events: string[] = []
+    const persistPublication = vi.fn(async () => {
+      events.push('publication:persisted')
+    })
+    const submit = vi.fn()
+    await expect(
+      signPreparedAndSubmit(
+        {
+          isConnected: () => true,
+          submit,
+          request: async () => ({ result: { ledger_current_index: 99 } }),
+        } as unknown as Client,
+        transaction,
+        createWalletSigner({ sign: async () => ({ hash: '', tx_blob: signed.tx_blob }) }),
+        {
+          journal: { append: async () => {} },
+          onValidatedSignature: async (signature) => {
+            events.push('signed:persisted')
+            expect(signature.lastLedgerSequence).toBe(transaction.LastLedgerSequence)
+            await persistPublication()
+          },
+          beforeSubmit: async () => {
+            events.push('guard:rejected')
+            throw new Error('READINESS_UNAVAILABLE')
+          },
+        },
+      ),
+    ).rejects.toThrow('READINESS_UNAVAILABLE')
+    expect(events).toEqual(['signed:persisted', 'publication:persisted', 'guard:rejected'])
+    expect(submit).not.toHaveBeenCalled()
+  })
+
   it('never persists or submits when issuer trust changes during the wallet dialog', async () => {
     const { transaction, signed } = signedPayment()
     const issuer = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
@@ -374,7 +471,11 @@ describe('wallet sign-only normalization', () => {
     const persistSigned = vi.fn()
     const submit = vi.fn()
     const entries: SubmissionJournalEntry[] = []
-    const client = { isConnected: () => true, submit } as unknown as Client
+    const client = {
+      isConnected: () => true,
+      submit,
+      request: async () => ({ result: { ledger_current_index: 99 } }),
+    } as unknown as Client
 
     await expect(
       signPreparedAndSubmit(
@@ -581,6 +682,78 @@ describe('reliable submission outcome', () => {
 })
 
 describe('operation journal state', () => {
+  const publicationJobId = '12345678-1234-4234-8234-123456789abc'
+  const hostedBusiness = {
+    action: 'credential-issue' as const,
+    issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+    subject: 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59',
+    schemaUid: '12'.repeat(32),
+    publicationJobId,
+  }
+
+  it('validates and preserves the publication link in stored and portable business context', () => {
+    expect(validateOperationBusinessContext(hostedBusiness)).toEqual(hostedBusiness)
+    expect(
+      toSanitizedOperationReceipt(storedOperation({ business: hostedBusiness })).business,
+    ).toEqual(hostedBusiness)
+    expect(() =>
+      validateOperationBusinessContext({ ...hostedBusiness, publicationJobId: '../invalid' }),
+    ).toThrow('OPERATION_PUBLICATION_JOB_ID_INVALID')
+  })
+
+  it.each(['validated', 'expired', 'failed'] as const)(
+    'retains a hosted signature after %s until explicit publication verification',
+    (stage) => {
+      const operation = storedOperation({
+        stage: 'pending',
+        business: hostedBusiness,
+        txBlob: 'SIGNED_BLOB',
+      })
+      const terminal = applyJournalEntry(operation, {
+        operationId: operation.operationId,
+        at: '2026-09-21T12:00:00.000Z',
+        stage,
+      })
+      expect(terminal.txBlob).toBe('SIGNED_BLOB')
+      expect(canRetryOperation(terminal)).toBe(false)
+      toSanitizedOperationReceipt(terminal)
+      expect(terminal.txBlob).toBe('SIGNED_BLOB')
+      const completed = completeOperationPublication(terminal, publicationJobId)
+      expect(completed.txBlob).toBeUndefined()
+      expect(completed.publicationCompleted).toBe(true)
+      expect(completeOperationPublication(completed, publicationJobId)).toEqual(completed)
+    },
+  )
+
+  it('keeps pending ledger recovery when publication verification finishes first', () => {
+    const pending = storedOperation({
+      stage: 'pending',
+      business: hostedBusiness,
+      txBlob: 'SIGNED_BLOB',
+    })
+    const published = completeOperationPublication(pending, publicationJobId)
+    expect(published.publicationCompleted).toBe(true)
+    expect(published.txBlob).toBe('SIGNED_BLOB')
+    expect(canRetryOperation(published)).toBe(true)
+    const validated = applyJournalEntry(published, {
+      operationId: pending.operationId,
+      at: '2026-09-21T12:00:00.000Z',
+      stage: 'validated',
+    })
+    expect(validated.txBlob).toBeUndefined()
+  })
+
+  it('does not purge an unrelated publication', () => {
+    const operation = storedOperation({
+      stage: 'validated',
+      business: hostedBusiness,
+      txBlob: 'SIGNED_BLOB',
+    })
+    expect(completeOperationPublication(operation, '87654321-1234-4234-8234-123456789abc')).toBe(
+      operation,
+    )
+  })
+
   it('uses action-independent business locks for one credential generation', () => {
     const profileId = 'xrpl-testnet-xcs-v0.1'
     const tuple = {
@@ -605,6 +778,71 @@ describe('operation journal state', () => {
     ).not.toBe(operationBusinessKey(profileId, { action: 'credential-accept', ...tuple }))
   })
 
+  it('preserves public tuple exclusion while locking one issuer invitation across recipient wallets', () => {
+    const business = validateOperationBusinessContext({
+      action: 'credential-issue',
+      issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+      subject: 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59',
+      schemaUid: 'a'.repeat(64),
+      issuerInviteId: '12345678-1234-4234-8234-123456789abc',
+    })
+    const existing = storedOperation({ business, stage: 'signed' })
+    const differentWallet = storedOperation({
+      operationId: 'second',
+      business: {
+        ...business,
+        action: 'credential-issue',
+        issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+        subject: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+        schemaUid: 'a'.repeat(64),
+      },
+    })
+    expect(operationConflictsWith(existing, differentWallet)).toBe(true)
+    const publicBusiness = validateOperationBusinessContext({
+      ...business,
+      issuerInviteId: undefined,
+    })
+    expect(operationConflictsWith(existing, storedOperation({ business: publicBusiness }))).toBe(
+      true,
+    )
+    expect(operationConflictsWith(storedOperation({ business: publicBusiness }), existing)).toBe(
+      true,
+    )
+    expect(
+      operationConflictsWith(
+        {
+          ...existing,
+          stage: 'validated',
+          engineResult: 'tesSUCCESS',
+          businessConfirmation: 'confirmed',
+        },
+        differentWallet,
+      ),
+    ).toBe(true)
+    expect(operationConflictsWith({ ...existing, stage: 'expired' }, differentWallet)).toBe(false)
+    expect(
+      operationConflictsWith(
+        { ...existing, stage: 'validated', engineResult: 'tecNO_TARGET' },
+        differentWallet,
+      ),
+    ).toBe(false)
+    expect(
+      operationConflictsWith(existing, { ...differentWallet, profileId: 'other-profile' }),
+    ).toBe(false)
+  })
+
+  it('rejects malformed portal invitation identifiers instead of silently dropping the lock', () => {
+    expect(() =>
+      validateOperationBusinessContext({
+        action: 'credential-issue',
+        issuer: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+        subject: 'r9cZA1mLK5R5Am25ArfXFmqgNwjZgnfk59',
+        schemaUid: 'a'.repeat(64),
+        issuerInviteId: 'bearer-token-is-not-an-invitation-UUID',
+      }),
+    ).toThrow('OPERATION_ISSUER_INVITE_ID_INVALID')
+  })
+
   it('allows abandoning only an unsigned prepared draft', () => {
     expect(canAbandonOperation(storedOperation())).toBe(true)
     expect(canAbandonOperation(storedOperation({ stage: 'signed', txHash: 'A'.repeat(64) }))).toBe(
diff --git a/apps/web/test/xamanAdapterNetworkRefresh.test.ts b/apps/web/test/xamanAdapterNetworkRefresh.test.ts
index 14f2a9e..81db063 100644
--- a/apps/web/test/xamanAdapterNetworkRefresh.test.ts
+++ b/apps/web/test/xamanAdapterNetworkRefresh.test.ts
@@ -1,271 +1,27 @@
-import { decode, Wallet, type CredentialCreate, type Payment } from 'xrpl'
-import { XamanAdapter, type NetworkInfo } from 'xrpl-connect'
-import { describe, expect, it, vi } from 'vitest'
+import { XamanAdapter, WalletErrorCode } from 'xrpl-connect'
+import { describe, expect, it } from 'vitest'
 
-import { normalizeWalletSignature } from '../app/utils/walletSubmission'
-
-const ACCOUNT = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
-const TESTNET: NetworkInfo = {
-  id: 'testnet',
-  name: 'Testnet',
-  wss: 'wss://s.altnet.rippletest.net:51233',
-  walletConnectId: 'xrpl:1',
-}
-
-function connectedAdapter(jwtData: Record<string, unknown>): XamanAdapter {
-  const adapter = new XamanAdapter()
-
-  Object.assign(adapter, {
-    client: {
-      ping: vi.fn().mockResolvedValue({ jwtData }),
-    },
-    currentAccount: {
-      address: ACCOUNT,
-      publicKey: undefined,
-      network: TESTNET,
-    },
-  })
-
-  return adapter
-}
-
-describe('Xaman live account refresh compatibility', () => {
-  it('accepts the numeric-string network id emitted by the Xaman OAuth provider', async () => {
-    const adapter = connectedAdapter({
-      sub: ACCOUNT,
-      network_endpoint: TESTNET.wss,
-      network_id: '1',
-    })
-
-    await expect(adapter.fetchAccount()).resolves.toEqual({
-      address: ACCOUNT,
-      publicKey: undefined,
-      network: TESTNET,
-    })
-  })
-
-  it('keeps the already validated network when a later ping only confirms its id', async () => {
-    const adapter = connectedAdapter({ sub: ACCOUNT, network_id: 1 })
-
-    await expect(adapter.fetchAccount()).resolves.toMatchObject({ network: TESTNET })
-  })
-
-  it("rejects OAuth metadata from a network that contradicts XCS's target", async () => {
-    const adapter = connectedAdapter({
-      sub: ACCOUNT,
-      network_endpoint: 'wss://xrplcluster.com',
-      network_id: '0',
-    })
-
-    await expect(adapter.fetchAccount()).rejects.toThrow('inconsistent network information')
-  })
-
-  it('rejects malformed network ids instead of silently ignoring them', async () => {
-    const adapter = connectedAdapter({ sub: ACCOUNT, network_id: '1e0' })
-
-    await expect(adapter.fetchAccount()).rejects.toThrow('invalid network information')
-  })
-})
-
-describe('Xaman signed payload compatibility', () => {
-  it('retries the authoritative payload fetch after a sign-only request resolves', async () => {
-    const resolvedPayload = { meta: { resolved: true, signed: true, submit: false } }
-    const get = vi
-      .fn()
-      .mockRejectedValueOnce(new Error('resolved payload is not readable yet'))
-      .mockResolvedValue(resolvedPayload)
+describe('Xaman public connection guards', () => {
+  it('requires application configuration before opening an approval', async () => {
     const adapter = new XamanAdapter()
-    const fetchResolvedPayload = (
-      adapter as unknown as {
-        getResolvedPayload: (
-          client: { payload: { get: typeof get } },
-          uuid: string,
-          submit: boolean,
-          signal: AbortSignal,
-        ) => Promise<unknown>
-      }
-    ).getResolvedPayload.bind(adapter)
-
-    await expect(
-      fetchResolvedPayload(
-        { payload: { get } },
-        '00000000-0000-4000-8000-000000000000',
-        false,
-        new AbortController().signal,
-      ),
-    ).resolves.toBe(resolvedPayload)
-    expect(get).toHaveBeenCalledTimes(2)
-  })
-
-  it('returns a verifiable CredentialCreate blob without submitting through Xaman', async () => {
-    const issuer = Wallet.generate()
-    const transaction: CredentialCreate = {
-      TransactionType: 'CredentialCreate',
-      Account: issuer.address,
-      Subject: Wallet.generate().address,
-      CredentialType: '12'.repeat(32),
-      URI: Buffer.from('https://issuer.example/credential.json', 'utf8')
-        .toString('hex')
-        .toLowerCase(),
-      Fee: '12',
-      Sequence: 1,
-      LastLedgerSequence: 100,
-    }
-    const signedTransaction = { ...transaction, LastLedgerSequence: 120 }
-    const signed = issuer.sign(signedTransaction)
-    const resolvedPayload = {
-      meta: {
-        resolved: true,
-        signed: true,
-        submit: false,
-        multisign: false,
-        signers: [issuer.address],
-      },
-      payload: { request_json: transaction },
-      response: {
-        hex: signed.tx_blob,
-        txid: signed.hash,
-        environment_networkid: 1,
-        environment_nodetype: 'TESTNET',
-        dispatched_nodetype: null,
-        dispatched_to_node: false,
-        account: issuer.address,
-        multisign_account: null,
-      },
-    }
-    const get = vi.fn().mockResolvedValue(resolvedPayload)
-    const createAndSubscribe = vi
-      .fn()
-      .mockImplementation(
-        async (
-          _body: unknown,
-          callback: (event: {
-            data: { opened: boolean; signed: boolean }
-            payload: { meta: { app_opened: boolean } }
-          }) => unknown,
-        ) => ({
-          created: {
-            uuid: '00000000-0000-4000-8000-000000000000',
-            next: { always: 'https://xumm.app/sign/00000000-0000-4000-8000-000000000000' },
-          },
-          resolved: Promise.resolve(
-            callback({
-              data: { opened: true, signed: true },
-              payload: { meta: { app_opened: true } },
-            }),
-          ),
-          resolve: vi.fn(),
-        }),
-      )
-    const adapter = new XamanAdapter()
-    Object.assign(adapter, {
-      client: { payload: { createAndSubscribe, get } },
-      currentAccount: {
-        address: issuer.address,
-        publicKey: undefined,
-        network: TESTNET,
-      },
+    await expect(adapter.connect({ network: 'testnet' })).rejects.toMatchObject({
+      code: WalletErrorCode.CONFIGURATION_REQUIRED,
     })
-
-    const walletResult = await adapter.sign(transaction)
-    const normalized = normalizeWalletSignature(walletResult)
-
-    expect(transaction.URI).toMatch(/[a-f]/)
-    expect(decode(signed.tx_blob).URI).toBe(transaction.URI?.toUpperCase())
-    expect(decode(signed.tx_blob).LastLedgerSequence).toBe(120)
-    expect(normalized).toEqual({ hash: signed.hash, txBlob: signed.tx_blob })
-    expect(createAndSubscribe).toHaveBeenCalledWith(
-      expect.objectContaining({
-        txjson: transaction,
-        options: expect.objectContaining({
-          submit: false,
-          force_network: 'TESTNET',
-          signers: [issuer.address],
-        }),
-      }),
-      expect.any(Function),
-    )
+    await expect(adapter.getAccount()).resolves.toBeNull()
   })
 
-  it('rejects a valid signature over transaction fields that differ from the request', () => {
-    const signer = Wallet.generate()
-    const requested: Payment = {
-      TransactionType: 'Payment',
-      Account: signer.address,
-      Destination: Wallet.generate().address,
-      Amount: '1',
-      Fee: '12',
-      Sequence: 1,
-      LastLedgerSequence: 100,
-    }
-    const changed = { ...requested, Amount: '2' } satisfies Payment
-    const signed = signer.sign(changed)
-    const adapter = new XamanAdapter()
-    const validate = (
-      adapter as unknown as {
-        validateSignedTransactionRequest: (
-          requested: Payment,
-          signed: ReturnType<typeof decode>,
-        ) => void
-      }
-    ).validateSignedTransactionRequest.bind(adapter)
-
-    expect(() => validate(requested, decode(signed.tx_blob))).toThrow('different fields: Amount')
-  })
-
-  it('accepts an inapplicable multisign_account on a valid single-signed transaction', () => {
-    const signer = Wallet.generate()
-    const transaction: Payment = {
-      TransactionType: 'Payment',
-      Account: signer.address,
-      Destination: Wallet.generate().address,
-      Amount: '1',
-      Fee: '12',
-      Sequence: 1,
-      LastLedgerSequence: 100,
-    }
-    const signed = signer.sign(transaction)
-    const adapter = new XamanAdapter()
-    const validate = (
-      adapter as unknown as {
-        validateSignedTransaction: (
-          transaction: ReturnType<typeof decode>,
-          txBlob: string,
-          connectedAccount: string,
-          isMultiSign: boolean,
-          responseAccount: string,
-          responseMultisignAccount: string | null | undefined,
-          network: { networkId: number },
-        ) => void
-      }
-    ).validateSignedTransaction.bind(adapter)
-
-    expect(() =>
-      validate(
-        decode(signed.tx_blob),
-        signed.tx_blob,
-        signer.address,
-        false,
-        signer.address,
-        undefined,
-        { networkId: 1 },
-      ),
-    ).not.toThrow()
-    expect(() =>
-      validate(decode(signed.tx_blob), signed.tx_blob, signer.address, false, signer.address, '', {
-        networkId: 1,
+  it('rejects contradictory network identifiers before opening an approval', async () => {
+    const adapter = new XamanAdapter({ apiKey: '00000000-0000-0000-0000-000000000000' })
+    await expect(
+      adapter.connect({
+        network: {
+          id: 'testnet',
+          name: 'Testnet',
+          wss: 'wss://s.altnet.rippletest.net:51233',
+          walletConnectId: 'xrpl:0',
+        },
       }),
-    ).not.toThrow()
-    expect(() =>
-      validate(
-        decode(signed.tx_blob),
-        signed.tx_blob,
-        signer.address,
-        false,
-        signer.address,
-        signer.address,
-        { networkId: 1 },
-      ),
-    ).toThrow('unexpected multi-signing account data')
+    ).rejects.toMatchObject({ code: WalletErrorCode.NETWORK_MISMATCH })
+    await expect(adapter.getAccount()).resolves.toBeNull()
   })
 })
diff --git a/conformance/README.md b/conformance/README.md
new file mode 100644
index 0000000..8a86078
--- /dev/null
+++ b/conformance/README.md
@@ -0,0 +1,17 @@
+# XCS conformance vectors
+
+`v0.1/` contains language-neutral JSON fixtures for the normative, deterministic
+parts of XCS. Implementations must consume the values as data; they must not call
+or embed another implementation.
+
+- `canonicalization.json`: strict JSON parsing and RFC 8785 output.
+- `schema-uid.json`: complete UID preimages and SHA-256 results.
+- `claims.json`: valid and invalid typed claim objects.
+- `payload-integrity.json`: HTTPS digests and raw CIDv1 values.
+
+The TypeScript core and the standalone Go verifier both execute these vectors in
+their test suites.
+
+Schema normalization is part of the wire contract: an explicit
+`"optional": false` is equivalent to the default and is omitted before JCS and
+UID computation. Implementations must never hash the unnormalized input object.
diff --git a/conformance/v0.1/canonicalization.json b/conformance/v0.1/canonicalization.json
new file mode 100644
index 0000000..b3cbd64
--- /dev/null
+++ b/conformance/v0.1/canonicalization.json
@@ -0,0 +1,20 @@
+{
+  "version": "0.1",
+  "cases": [
+    {
+      "name": "sorts object keys and removes insignificant whitespace",
+      "inputJson": "{ \"z\": 0, \"a\": [true, null, \"é\"] }",
+      "canonical": "{\"a\":[true,null,\"é\"],\"z\":0}"
+    },
+    {
+      "name": "uses ECMAScript number serialization",
+      "inputJson": "[333333333.33333329,1E30,4.50,2e-3,0.000000000000000000000000001]",
+      "canonical": "[333333333.3333333,1e+30,4.5,0.002,1e-27]"
+    },
+    {
+      "name": "sorts keys by UTF-16 code units",
+      "inputJson": "{\"€\":1,\"a\":2,\"😀\":3,\"ö\":4}",
+      "canonical": "{\"a\":2,\"ö\":4,\"€\":1,\"😀\":3}"
+    }
+  ]
+}
diff --git a/conformance/v0.1/claims.json b/conformance/v0.1/claims.json
new file mode 100644
index 0000000..090eab8
--- /dev/null
+++ b/conformance/v0.1/claims.json
@@ -0,0 +1,72 @@
+{
+  "version": "0.1",
+  "schema": {
+    "xcsVersion": "0.1",
+    "name": "Conformance Claims",
+    "description": "Exercises all XCS v0.1 claim types.",
+    "fields": {
+      "text": { "type": "string" },
+      "flag": { "type": "bool" },
+      "count": { "type": "uint" },
+      "delta": { "type": "int" },
+      "data": { "type": "bytes" },
+      "account": { "type": "address" },
+      "tags": { "type": "array", "items": { "type": "string" } },
+      "detail": {
+        "type": "object",
+        "fields": {
+          "code": { "type": "string" },
+          "note": { "type": "string", "optional": true }
+        }
+      },
+      "optionalText": { "type": "string", "optional": true }
+    }
+  },
+  "cases": [
+    {
+      "name": "all supported types",
+      "valid": true,
+      "claims": {
+        "text": "completed",
+        "flag": true,
+        "count": "115792089237316195423570985008687907853269984665640564039457584007913129639935",
+        "delta": "-57896044618658097711785492504343953926634992332820282019728792003956564819968",
+        "data": "SGVsbG8",
+        "account": "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+        "tags": ["xcs", "xrpl"],
+        "detail": { "code": "course-1" }
+      }
+    },
+    {
+      "name": "rejects a non-canonical integer",
+      "valid": false,
+      "errorCode": "CLAIMS_INVALID",
+      "claims": {
+        "text": "completed",
+        "flag": true,
+        "count": "01",
+        "delta": "0",
+        "data": "",
+        "account": "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+        "tags": [],
+        "detail": { "code": "course-1" }
+      }
+    },
+    {
+      "name": "rejects an additional claim",
+      "valid": false,
+      "errorCode": "CLAIMS_INVALID",
+      "claims": {
+        "text": "completed",
+        "flag": true,
+        "count": "1",
+        "delta": "0",
+        "data": "",
+        "account": "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+        "tags": [],
+        "detail": { "code": "course-1" },
+        "extra": true
+      }
+    }
+  ]
+}
diff --git a/conformance/v0.1/payload-integrity.json b/conformance/v0.1/payload-integrity.json
new file mode 100644
index 0000000..4f2875d
--- /dev/null
+++ b/conformance/v0.1/payload-integrity.json
@@ -0,0 +1,17 @@
+{
+  "version": "0.1",
+  "cases": [
+    {
+      "name": "hello as raw CIDv1",
+      "contentUtf8": "hello",
+      "sha256": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
+      "uri": "ipfs://bafkreibm6jg3ux5qumhcn2b3flc3tyu6dmlb4xa7u5bf44yegnrjhc4yeq"
+    },
+    {
+      "name": "hello over HTTPS",
+      "contentUtf8": "hello",
+      "sha256": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
+      "uri": "https://issuer.example/credentials/1.json#xcs-sha256=2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+    }
+  ]
+}
diff --git a/conformance/v0.1/schema-uid.json b/conformance/v0.1/schema-uid.json
new file mode 100644
index 0000000..c539023
--- /dev/null
+++ b/conformance/v0.1/schema-uid.json
@@ -0,0 +1,28 @@
+{
+  "version": "0.1",
+  "cases": [
+    {
+      "name": "course completion schema",
+      "input": {
+        "networkId": 1,
+        "ledgerHash": "ABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABAB",
+        "ledgerIndex": 100,
+        "transactionIndex": 2,
+        "publisher": "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+        "schema": {
+          "xcsVersion": "0.1",
+          "name": "XRPL Developer Course Completion",
+          "description": "Attests successful completion of the XRPL developer course.",
+          "fields": {
+            "programId": { "type": "string", "optional": false },
+            "programName": { "type": "string" },
+            "completedAt": { "type": "string" },
+            "achievement": { "type": "string", "optional": true }
+          }
+        }
+      },
+      "canonicalPreimage": "{\"ledgerHash\":\"abababababababababababababababababababababababababababababababab\",\"ledgerIndex\":100,\"networkId\":1,\"publisher\":\"rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh\",\"purpose\":\"xcs.schema.uid\",\"schema\":{\"description\":\"Attests successful completion of the XRPL developer course.\",\"fields\":{\"achievement\":{\"optional\":true,\"type\":\"string\"},\"completedAt\":{\"type\":\"string\"},\"programId\":{\"type\":\"string\"},\"programName\":{\"type\":\"string\"}},\"name\":\"XRPL Developer Course Completion\",\"xcsVersion\":\"0.1\"},\"transactionIndex\":2,\"version\":\"0.1\"}",
+      "uid": "e1e9e4a41ff0a4c846c9218e0cb345a05457abb6f9ba90d5bd9ee18e7d2ca9a3"
+    }
+  ]
+}
diff --git a/db/README.md b/db/README.md
index 8549e19..c77eff0 100644
--- a/db/README.md
+++ b/db/README.md
@@ -25,9 +25,13 @@ not a workspace member, so every command below uses `--dir` rather than `--filte
 pnpm --dir apps/indexer db:generate
 ```
 
-This changes into this folder and runs `drizzle-kit generate --config ./drizzle.config.ts`
-(drizzle-kit resolves `schema` and `out` against the working directory), then writes a new SQL file plus
-an updated snapshot under `db/migrations/`. Commit them: CI regenerates and fails on any diff.
+This runs Drizzle Kit from the indexer application with its own `node_modules` on `NODE_PATH`.
+The config resolves schema paths from this folder and computes the output path relative to the
+command's working directory; no root or shared-folder dependency installation is required. It writes
+a new SQL file and snapshot under `db/migrations/`. Commit them: CI regenerates and fails on any diff.
+
+Install the indexer's dependencies independently with
+`pnpm --dir apps/indexer install --ignore-workspace --frozen-lockfile` before using these commands.
 
 ### Apply migrations
 
@@ -36,10 +40,13 @@ XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@host:5432/xcs \
   pnpm --dir apps/indexer db:migrate
 ```
 
-Idempotent: `drizzle-orm`'s migrator records applied migrations in `drizzle.__drizzle_migrations`
-and a second run applies nothing. The migration folder defaults to `../../db/migrations` relative to
-the indexer application and can be overridden with `XCS_MIGRATIONS_DIR` (the container image sets it
-to the copy of `db/migrations` beside the built application).
+The runner validates the ordered journal and applied SQL hashes, rejects migration ownership
+conflicts, and records applied migrations in `drizzle.__drizzle_migrations`. A second run applies
+nothing. Migration DDL does not provision or rotate runtime roles. The folder is resolved from the
+source or compiled application and can be overridden with `XCS_MIGRATIONS_DIR` for container layouts.
+The bootstrap URL supports the `_FILE` secret convention as well as a direct environment value.
+
+Inspect applied and pending migrations without DDL using `pnpm --dir apps/indexer db:status`.
 
 ### Bootstrap a fresh database
 
@@ -47,16 +54,26 @@ to the copy of `db/migrations` beside the built application).
 pnpm --dir apps/indexer db:bootstrap
 ```
 
-Applies the migrations and then assigns the privileges of the runtime roles (`xcs_indexer`,
-`xcs_api`, `xcs_monitor`). It is grants-only: it does not create the roles and does not set their
-passwords. Create those three users with the managed database service first — the DigitalOcean
-control panel or `doctl databases user create` — and the step fails naming any that is missing. It
-requires `XCS_DATABASE_CLUSTER_SCOPE=dedicated` because the grants and role attributes it applies are
-cluster-visible.
-
-The local Compose stack has no managed service to create the users, so
-`db/compose-initdb/01-runtime-roles.sql` creates them there with published, local-development-only
-passwords when the postgres volume is first initialised.
+Before running it, create all eight users through the managed database service: `xcs_indexer`,
+`xcs_api`, `xcs_payload_writer`, `xcs_monitor`, `xcs_app`, `xcs_admin_app`, `xcs_notifier` and
+`xcs_issuer`. The bootstrap requires only the administrator URL and
+`XCS_DATABASE_CLUSTER_SCOPE=dedicated`. It checks every user before DDL, applies migrations and
+least-privilege grants atomically, and never creates a role or reads, changes or rotates a password.
+The operator-only `pnpm --dir apps/indexer admin:bootstrap` command grants the first administrator
+to an existing exact OIDC issuer/subject and writes an audit record; it never matches by email.
+
+## Application migrations and validation
+
+Migrations 0000–0006, their snapshots and journal entries retain the exact bytes from the previous
+application implementation. Additive migration `0007_recipient_verifier` supplies recipient and
+verifier history, and `0008_presentation_wallet_proof` binds presentation grants to a verified wallet
+signature. The complete deployment journal is therefore `0000`–`0008`. Schemas are shared here;
+clients, grants and application helpers remain local to each application.
+
+`pnpm --dir apps/indexer test:postgres` runs the migrated DB suites and indexer suite sequentially.
+Use only an isolated disposable cluster configured through `XCS_TEST_DATABASE_URL`: the tests create
+and remove cluster-wide stand-ins for the managed users. The regular `test` command skips database
+integration when that URL is absent.
 
 ### Never edit an applied migration
 
diff --git a/db/compose-initdb/01-runtime-roles.sql b/db/compose-initdb/01-runtime-roles.sql
index 8397c04..863ad03 100644
--- a/db/compose-initdb/01-runtime-roles.sql
+++ b/db/compose-initdb/01-runtime-roles.sql
@@ -1,18 +1,15 @@
--- Local development only. Mounted read-only into the Compose `postgres` service
--- at /docker-entrypoint-initdb.d and run once, when the data directory is first
--- initialised. It is never applied to a deployed database.
+-- Local development only. The PostgreSQL image runs this once for a fresh data
+-- directory. Production users and passwords are created by DigitalOcean; the
+-- XCS bootstrap only applies migrations and least-privilege grants.
 --
--- In a deployment the three runtime users are created by the managed database
--- service (DigitalOcean's control panel, `doctl` or its API), which generates
--- and stores their passwords. The `db-bootstrap` step is grants-only: it never
--- creates a role and never sets a password, so the local Compose cluster has to
--- supply the roles itself.
---
--- The passwords below are fixed, published literals that say so in their own
--- text. They are NOT secrets, they must never be used anywhere but this local
--- stack, and docker-compose.yml hardcodes the very same literals in the
--- connection URLs it composes.
+-- These fixed published literals are not secrets and must never be reused
+-- outside this local Compose stack.
 
 CREATE ROLE xcs_indexer LOGIN PASSWORD 'local-development-only-not-a-secret-indexer';
 CREATE ROLE xcs_api LOGIN PASSWORD 'local-development-only-not-a-secret-api';
+CREATE ROLE xcs_payload_writer LOGIN PASSWORD 'local-development-only-not-a-secret-payload';
 CREATE ROLE xcs_monitor LOGIN PASSWORD 'local-development-only-not-a-secret-monitor';
+CREATE ROLE xcs_app LOGIN PASSWORD 'local-development-only-not-a-secret-app';
+CREATE ROLE xcs_admin_app LOGIN PASSWORD 'local-development-only-not-a-secret-admin-app';
+CREATE ROLE xcs_notifier LOGIN PASSWORD 'local-development-only-not-a-secret-notifier';
+CREATE ROLE xcs_issuer LOGIN PASSWORD 'local-development-only-not-a-secret-issuer';
diff --git a/db/drizzle.config.ts b/db/drizzle.config.ts
index a80a712..f17a976 100644
--- a/db/drizzle.config.ts
+++ b/db/drizzle.config.ts
@@ -1,11 +1,16 @@
+import { fileURLToPath } from 'node:url'
+import { relative } from 'node:path'
 import { defineConfig } from 'drizzle-kit'
 
-// drizzle-kit resolves `schema` and `out` against the working directory, so the
-// scripts that run it change into this folder first (see `db/README.md`).
+// Resolve paths from this file so generation can use the owning indexer app’s
+// dependencies without installing a second dependency tree in the shared folder.
 export default defineConfig({
   dialect: 'postgresql',
-  schema: './schema/index.ts',
-  out: './migrations',
+  schema: [
+    fileURLToPath(new URL('./schema/index.ts', import.meta.url)),
+    fileURLToPath(new URL('./schema/app/index.ts', import.meta.url)),
+  ],
+  out: relative(process.cwd(), fileURLToPath(new URL('./migrations', import.meta.url))),
   dbCredentials: {
     url:
       process.env.XCS_BOOTSTRAP_DATABASE_URL ??
diff --git a/db/migrations/0001_hosted_payloads.sql b/db/migrations/0001_hosted_payloads.sql
new file mode 100644
index 0000000..0d7dc76
--- /dev/null
+++ b/db/migrations/0001_hosted_payloads.sql
@@ -0,0 +1,33 @@
+CREATE TABLE "hosted_payload_publications" (
+	"transaction_hash" text PRIMARY KEY NOT NULL,
+	"locator" text NOT NULL,
+	"profile_id" text NOT NULL,
+	"issuer" text NOT NULL,
+	"subject" text NOT NULL,
+	"schema_uid" text NOT NULL,
+	"requester_ip_hash" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "hosted_payload_publications_tx_hash" CHECK ("hosted_payload_publications"."transaction_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "hosted_payload_publications_issuer" CHECK ("hosted_payload_publications"."issuer" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'),
+	CONSTRAINT "hosted_payload_publications_subject" CHECK ("hosted_payload_publications"."subject" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'),
+	CONSTRAINT "hosted_payload_publications_schema" CHECK ("hosted_payload_publications"."schema_uid" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "hosted_payload_publications_ip_hash" CHECK ("hosted_payload_publications"."requester_ip_hash" ~ '^[0-9a-f]{64}$')
+);
+--> statement-breakpoint
+CREATE TABLE "hosted_payloads" (
+	"locator" text PRIMARY KEY NOT NULL,
+	"digest_hex" text NOT NULL,
+	"content" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "hosted_payloads_digest_hex_unique" UNIQUE("digest_hex"),
+	CONSTRAINT "hosted_payloads_locator" CHECK ("hosted_payloads"."locator" ~ '^[0-9a-f]{20}$'),
+	CONSTRAINT "hosted_payloads_digest" CHECK ("hosted_payloads"."digest_hex" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "hosted_payloads_size" CHECK (octet_length("hosted_payloads"."content") BETWEEN 1 AND 65536)
+);
+--> statement-breakpoint
+ALTER TABLE "hosted_payload_publications" ADD CONSTRAINT "hosted_payload_publications_locator_hosted_payloads_locator_fk" FOREIGN KEY ("locator") REFERENCES "public"."hosted_payloads"("locator") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "hosted_payload_publications" ADD CONSTRAINT "hosted_payload_publications_profile_id_network_profiles_profile_id_fk" FOREIGN KEY ("profile_id") REFERENCES "public"."network_profiles"("profile_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "hosted_payload_publications" ADD CONSTRAINT "hosted_payload_publications_schema_fk" FOREIGN KEY ("profile_id","schema_uid") REFERENCES "public"."schemas"("profile_id","schema_uid") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "hosted_payload_publications_wallet_quota_idx" ON "hosted_payload_publications" USING btree ("issuer","created_at");--> statement-breakpoint
+CREATE INDEX "hosted_payload_publications_ip_quota_idx" ON "hosted_payload_publications" USING btree ("requester_ip_hash","created_at");--> statement-breakpoint
+CREATE INDEX "hosted_payload_publications_locator_idx" ON "hosted_payload_publications" USING btree ("locator");
\ No newline at end of file
diff --git a/db/migrations/0002_hosted_payload_locator_compatibility.sql b/db/migrations/0002_hosted_payload_locator_compatibility.sql
new file mode 100644
index 0000000..84a22a9
--- /dev/null
+++ b/db/migrations/0002_hosted_payload_locator_compatibility.sql
@@ -0,0 +1,3 @@
+ALTER TABLE "hosted_payloads" DROP CONSTRAINT "hosted_payloads_digest_hex_unique";--> statement-breakpoint
+ALTER TABLE "hosted_payloads" DROP CONSTRAINT "hosted_payloads_locator";--> statement-breakpoint
+ALTER TABLE "hosted_payloads" ADD CONSTRAINT "hosted_payloads_locator" CHECK ("hosted_payloads"."locator" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$');
\ No newline at end of file
diff --git a/db/migrations/0003_application_model.sql b/db/migrations/0003_application_model.sql
new file mode 100644
index 0000000..450158c
--- /dev/null
+++ b/db/migrations/0003_application_model.sql
@@ -0,0 +1,197 @@
+CREATE TABLE "app_user_roles" (
+	"user_id" uuid NOT NULL,
+	"role" text NOT NULL,
+	"granted_by" uuid,
+	"granted_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"revoked_at" timestamp with time zone,
+	CONSTRAINT "app_user_roles_user_id_role_pk" PRIMARY KEY("user_id","role"),
+	CONSTRAINT "app_user_roles_role" CHECK ("app_user_roles"."role" IN ('admin', 'recipient'))
+);
+--> statement-breakpoint
+CREATE TABLE "app_users" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"identity_issuer" text,
+	"identity_subject" text,
+	"email" text,
+	"email_verified_at" timestamp with time zone,
+	"display_name" text,
+	"status" text DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"deleted_at" timestamp with time zone,
+	CONSTRAINT "app_users_status" CHECK ("app_users"."status" IN ('active', 'suspended', 'deleted')),
+	CONSTRAINT "app_users_identity" CHECK (("app_users"."status" <> 'deleted' AND length("app_users"."identity_issuer") > 0 AND "app_users"."identity_issuer" IS NOT NULL AND length("app_users"."identity_subject") > 0 AND "app_users"."identity_subject" IS NOT NULL AND "app_users"."deleted_at" IS NULL) OR ("app_users"."status" = 'deleted' AND "app_users"."identity_issuer" IS NULL AND "app_users"."identity_subject" IS NULL AND "app_users"."email" IS NULL AND "app_users"."email_verified_at" IS NULL AND "app_users"."display_name" IS NULL AND "app_users"."deleted_at" IS NOT NULL)),
+	CONSTRAINT "app_users_verified_email" CHECK ("app_users"."email_verified_at" IS NULL OR "app_users"."email" IS NOT NULL)
+);
+--> statement-breakpoint
+CREATE TABLE "app_wallets" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"network_id" bigint NOT NULL,
+	"address" text NOT NULL,
+	"verified_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone,
+	CONSTRAINT "app_wallets_network" CHECK ("app_wallets"."network_id" BETWEEN 0 AND 4294967295),
+	CONSTRAINT "app_wallets_address" CHECK ("app_wallets"."address" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'),
+	CONSTRAINT "app_wallets_revocation" CHECK ("app_wallets"."revoked_at" IS NULL OR "app_wallets"."revoked_at" >= "app_wallets"."verified_at")
+);
+--> statement-breakpoint
+CREATE TABLE "app_documents" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"application_role" text NOT NULL,
+	"storage_key" text NOT NULL,
+	"mime_type" text NOT NULL,
+	"byte_length" integer NOT NULL,
+	"sha256" text NOT NULL,
+	"uploaded_by" uuid NOT NULL,
+	"review_status" text DEFAULT 'pending' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_documents_storage_key_unique" UNIQUE("storage_key"),
+	CONSTRAINT "app_documents_size" CHECK ("app_documents"."byte_length" > 0),
+	CONSTRAINT "app_documents_digest" CHECK ("app_documents"."sha256" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_documents_storage_key" CHECK (length(btrim("app_documents"."storage_key")) > 0),
+	CONSTRAINT "app_documents_review" CHECK ("app_documents"."review_status" IN ('pending', 'approved', 'rejected'))
+);
+--> statement-breakpoint
+CREATE TABLE "app_organization_applications" (
+	"organization_id" uuid NOT NULL,
+	"role" text NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"website" text,
+	"contact" text,
+	"jurisdiction" text,
+	"description" text,
+	"purpose" text,
+	"submitted_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"reviewed_by" uuid,
+	"reviewed_at" timestamp with time zone,
+	"review_reason" text,
+	CONSTRAINT "app_organization_applications_organization_id_role_pk" PRIMARY KEY("organization_id","role"),
+	CONSTRAINT "app_organization_applications_role" CHECK ("app_organization_applications"."role" IN ('issuer', 'verifier')),
+	CONSTRAINT "app_organization_applications_status" CHECK ("app_organization_applications"."status" IN ('pending', 'approved', 'rejected', 'suspended')),
+	CONSTRAINT "app_organization_applications_review" CHECK (("app_organization_applications"."status" = 'pending' AND "app_organization_applications"."reviewed_by" IS NULL AND "app_organization_applications"."reviewed_at" IS NULL AND "app_organization_applications"."review_reason" IS NULL) OR ("app_organization_applications"."status" <> 'pending' AND "app_organization_applications"."reviewed_by" IS NOT NULL AND "app_organization_applications"."reviewed_at" IS NOT NULL AND "app_organization_applications"."reviewed_at" >= "app_organization_applications"."submitted_at")),
+	CONSTRAINT "app_organization_applications_reason" CHECK ("app_organization_applications"."status" NOT IN ('rejected', 'suspended') OR ("app_organization_applications"."review_reason" IS NOT NULL AND length(btrim("app_organization_applications"."review_reason")) > 0))
+);
+--> statement-breakpoint
+CREATE TABLE "app_organizations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"responsible_user_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"status" text DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_organizations_name" CHECK (length(btrim("app_organizations"."name")) > 0),
+	CONSTRAINT "app_organizations_status" CHECK ("app_organizations"."status" IN ('active', 'suspended', 'closed'))
+);
+--> statement-breakpoint
+CREATE TABLE "app_credential_metadata" (
+	"profile_id" text NOT NULL,
+	"generation_id" text NOT NULL,
+	"schema_uid" text NOT NULL,
+	"issuer_organization_id" uuid NOT NULL,
+	"recipient_user_id" uuid NOT NULL,
+	"invite_id" uuid,
+	"issuer_address" text NOT NULL,
+	"subject_address" text NOT NULL,
+	"visibility" text NOT NULL,
+	"public_fields" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"payload_storage_key" text,
+	"payload_digest" text NOT NULL,
+	"creation_transaction_hash" text NOT NULL,
+	"creation_ledger_index" bigint NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_credential_metadata_profile_id_generation_id_pk" PRIMARY KEY("profile_id","generation_id"),
+	CONSTRAINT "app_credential_metadata_invite_id_unique" UNIQUE("invite_id"),
+	CONSTRAINT "app_credential_metadata_recipient_uq" UNIQUE("profile_id","generation_id","recipient_user_id"),
+	CONSTRAINT "app_credential_metadata_generation" CHECK ("app_credential_metadata"."generation_id" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_credential_metadata_addresses" CHECK ("app_credential_metadata"."issuer_address" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND "app_credential_metadata"."subject_address" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'),
+	CONSTRAINT "app_credential_metadata_visibility" CHECK ("app_credential_metadata"."visibility" IN ('public', 'private')),
+	CONSTRAINT "app_credential_metadata_fields" CHECK (jsonb_typeof("app_credential_metadata"."public_fields") = 'array' AND NOT jsonb_path_exists("app_credential_metadata"."public_fields", '$[*] ? (@.type() != "string")')),
+	CONSTRAINT "app_credential_metadata_digest" CHECK ("app_credential_metadata"."payload_digest" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_credential_metadata_transaction" CHECK ("app_credential_metadata"."creation_transaction_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_credential_metadata_ledger" CHECK ("app_credential_metadata"."creation_ledger_index" BETWEEN 1 AND 4294967295),
+	CONSTRAINT "app_credential_metadata_storage" CHECK ("app_credential_metadata"."payload_storage_key" IS NULL OR length(btrim("app_credential_metadata"."payload_storage_key")) > 0)
+);
+--> statement-breakpoint
+CREATE TABLE "app_invites" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"profile_id" text NOT NULL,
+	"schema_uid" text NOT NULL,
+	"delivery_email" text,
+	"token_hash" text,
+	"created_by" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"claimed_by" uuid,
+	"claimed_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	CONSTRAINT "app_invites_token_hash_unique" UNIQUE("token_hash"),
+	CONSTRAINT "app_invites_claim_identity_uq" UNIQUE("id","organization_id","profile_id","schema_uid","claimed_by"),
+	CONSTRAINT "app_invites_token" CHECK ("app_invites"."token_hash" IS NULL OR "app_invites"."token_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_invites_unclaimed_token" CHECK ("app_invites"."claimed_at" IS NOT NULL OR "app_invites"."revoked_at" IS NOT NULL OR "app_invites"."token_hash" IS NOT NULL),
+	CONSTRAINT "app_invites_expiry" CHECK ("app_invites"."expires_at" > "app_invites"."created_at"),
+	CONSTRAINT "app_invites_claim" CHECK (("app_invites"."claimed_by" IS NULL AND "app_invites"."claimed_at" IS NULL) OR ("app_invites"."claimed_by" IS NOT NULL AND "app_invites"."claimed_at" IS NOT NULL AND "app_invites"."claimed_at" >= "app_invites"."created_at" AND "app_invites"."claimed_at" < "app_invites"."expires_at"))
+);
+--> statement-breakpoint
+CREATE TABLE "app_schema_metadata" (
+	"profile_id" text NOT NULL,
+	"schema_uid" text NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"display_name" text,
+	"category" text,
+	"registration_transaction_hash" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_schema_metadata_profile_id_schema_uid_pk" PRIMARY KEY("profile_id","schema_uid"),
+	CONSTRAINT "app_schema_metadata_owner_uq" UNIQUE("profile_id","schema_uid","organization_id"),
+	CONSTRAINT "app_schema_metadata_profile" CHECK (length("app_schema_metadata"."profile_id") > 0),
+	CONSTRAINT "app_schema_metadata_uid" CHECK ("app_schema_metadata"."schema_uid" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_schema_metadata_transaction" CHECK ("app_schema_metadata"."registration_transaction_hash" ~ '^[0-9a-f]{64}$')
+);
+--> statement-breakpoint
+CREATE TABLE "app_presentations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"profile_id" text NOT NULL,
+	"generation_id" text NOT NULL,
+	"recipient_user_id" uuid NOT NULL,
+	"verifier_organization_id" uuid,
+	"scope" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"revoked_at" timestamp with time zone,
+	CONSTRAINT "app_presentations_token_hash_unique" UNIQUE("token_hash"),
+	CONSTRAINT "app_presentations_scope" CHECK ("app_presentations"."scope" IN ('public', 'full')),
+	CONSTRAINT "app_presentations_audience" CHECK ("app_presentations"."scope" <> 'full' OR "app_presentations"."verifier_organization_id" IS NOT NULL),
+	CONSTRAINT "app_presentations_token" CHECK ("app_presentations"."token_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_presentations_revocation" CHECK ("app_presentations"."revoked_at" IS NULL OR "app_presentations"."revoked_at" >= "app_presentations"."created_at")
+);
+--> statement-breakpoint
+ALTER TABLE "app_user_roles" ADD CONSTRAINT "app_user_roles_user_id_app_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_user_roles" ADD CONSTRAINT "app_user_roles_granted_by_app_users_id_fk" FOREIGN KEY ("granted_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_wallets" ADD CONSTRAINT "app_wallets_user_id_app_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_documents" ADD CONSTRAINT "app_documents_uploaded_by_app_users_id_fk" FOREIGN KEY ("uploaded_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_documents" ADD CONSTRAINT "app_documents_application_fk" FOREIGN KEY ("organization_id","application_role") REFERENCES "public"."app_organization_applications"("organization_id","role") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_organization_applications" ADD CONSTRAINT "app_organization_applications_organization_id_app_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."app_organizations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_organization_applications" ADD CONSTRAINT "app_organization_applications_reviewed_by_app_users_id_fk" FOREIGN KEY ("reviewed_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_organizations" ADD CONSTRAINT "app_organizations_responsible_user_id_app_users_id_fk" FOREIGN KEY ("responsible_user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_credential_metadata" ADD CONSTRAINT "app_credential_metadata_recipient_user_id_app_users_id_fk" FOREIGN KEY ("recipient_user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_credential_metadata" ADD CONSTRAINT "app_credential_metadata_schema_owner_fk" FOREIGN KEY ("profile_id","schema_uid","issuer_organization_id") REFERENCES "public"."app_schema_metadata"("profile_id","schema_uid","organization_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_credential_metadata" ADD CONSTRAINT "app_credential_metadata_invite_claim_fk" FOREIGN KEY ("invite_id","issuer_organization_id","profile_id","schema_uid","recipient_user_id") REFERENCES "public"."app_invites"("id","organization_id","profile_id","schema_uid","claimed_by") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_invites" ADD CONSTRAINT "app_invites_created_by_app_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_invites" ADD CONSTRAINT "app_invites_claimed_by_app_users_id_fk" FOREIGN KEY ("claimed_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_invites" ADD CONSTRAINT "app_invites_schema_owner_fk" FOREIGN KEY ("profile_id","schema_uid","organization_id") REFERENCES "public"."app_schema_metadata"("profile_id","schema_uid","organization_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_schema_metadata" ADD CONSTRAINT "app_schema_metadata_organization_id_app_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."app_organizations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_presentations" ADD CONSTRAINT "app_presentations_verifier_organization_id_app_organizations_id_fk" FOREIGN KEY ("verifier_organization_id") REFERENCES "public"."app_organizations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_presentations" ADD CONSTRAINT "app_presentations_recipient_fk" FOREIGN KEY ("profile_id","generation_id","recipient_user_id") REFERENCES "public"."app_credential_metadata"("profile_id","generation_id","recipient_user_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "app_users_identity_uq" ON "app_users" USING btree ("identity_issuer","identity_subject");--> statement-breakpoint
+CREATE UNIQUE INDEX "app_wallets_network_address_uq" ON "app_wallets" USING btree ("network_id","address");--> statement-breakpoint
+CREATE INDEX "app_wallets_user_idx" ON "app_wallets" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "app_documents_application_idx" ON "app_documents" USING btree ("organization_id","application_role");--> statement-breakpoint
+CREATE INDEX "app_organization_applications_queue_idx" ON "app_organization_applications" USING btree ("status","submitted_at");--> statement-breakpoint
+CREATE INDEX "app_organizations_responsible_idx" ON "app_organizations" USING btree ("responsible_user_id");--> statement-breakpoint
+CREATE INDEX "app_credential_metadata_recipient_idx" ON "app_credential_metadata" USING btree ("recipient_user_id","created_at");--> statement-breakpoint
+CREATE INDEX "app_credential_metadata_issuer_idx" ON "app_credential_metadata" USING btree ("issuer_organization_id","created_at");--> statement-breakpoint
+CREATE INDEX "app_invites_organization_idx" ON "app_invites" USING btree ("organization_id","created_at");--> statement-breakpoint
+CREATE INDEX "app_invites_claimant_idx" ON "app_invites" USING btree ("claimed_by");--> statement-breakpoint
+CREATE INDEX "app_schema_metadata_organization_idx" ON "app_schema_metadata" USING btree ("organization_id");--> statement-breakpoint
+CREATE INDEX "app_presentations_recipient_idx" ON "app_presentations" USING btree ("recipient_user_id","created_at");--> statement-breakpoint
+CREATE INDEX "app_presentations_verifier_idx" ON "app_presentations" USING btree ("verifier_organization_id");
\ No newline at end of file
diff --git a/db/migrations/0004_auth_sessions.sql b/db/migrations/0004_auth_sessions.sql
new file mode 100644
index 0000000..f9ae047
--- /dev/null
+++ b/db/migrations/0004_auth_sessions.sql
@@ -0,0 +1,50 @@
+CREATE TABLE "app_auth_transactions" (
+	"state_hash" text PRIMARY KEY NOT NULL,
+	"browser_hash" text NOT NULL,
+	"nonce" text NOT NULL,
+	"code_verifier" text NOT NULL,
+	"return_to" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "app_auth_transactions_hashes" CHECK ("app_auth_transactions"."state_hash" ~ '^[0-9a-f]{64}$' AND "app_auth_transactions"."browser_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_auth_transactions_tokens" CHECK ("app_auth_transactions"."nonce" ~ '^[A-Za-z0-9_-]{43}$' AND "app_auth_transactions"."code_verifier" ~ '^[A-Za-z0-9_-]{43}$'),
+	CONSTRAINT "app_auth_transactions_return_to" CHECK (length("app_auth_transactions"."return_to") BETWEEN 1 AND 2048 AND left("app_auth_transactions"."return_to", 1) = '/' AND left("app_auth_transactions"."return_to", 2) <> '//' AND position(chr(92) in "app_auth_transactions"."return_to") = 0 AND "app_auth_transactions"."return_to" !~ '[[:cntrl:]]'),
+	CONSTRAINT "app_auth_transactions_dates" CHECK ("app_auth_transactions"."expires_at" > "app_auth_transactions"."created_at" AND isfinite("app_auth_transactions"."expires_at"))
+);
+--> statement-breakpoint
+CREATE TABLE "app_sessions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"token_hash" text NOT NULL,
+	"user_id" uuid NOT NULL,
+	"csrf_token" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"absolute_expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "app_sessions_token_hash_unique" UNIQUE("token_hash"),
+	CONSTRAINT "app_sessions_token" CHECK ("app_sessions"."token_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_sessions_csrf" CHECK ("app_sessions"."csrf_token" ~ '^[A-Za-z0-9_-]{43}$'),
+	CONSTRAINT "app_sessions_dates" CHECK ("app_sessions"."expires_at" > "app_sessions"."created_at" AND "app_sessions"."absolute_expires_at" >= "app_sessions"."expires_at" AND isfinite("app_sessions"."absolute_expires_at"))
+);
+--> statement-breakpoint
+CREATE TABLE "app_wallet_challenges" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"session_id" uuid NOT NULL,
+	"network_id" bigint NOT NULL,
+	"address" text NOT NULL,
+	"message" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "app_wallet_challenges_network" CHECK ("app_wallet_challenges"."network_id" BETWEEN 0 AND 4294967295),
+	CONSTRAINT "app_wallet_challenges_address" CHECK ("app_wallet_challenges"."address" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'),
+	CONSTRAINT "app_wallet_challenges_message" CHECK (length("app_wallet_challenges"."message") BETWEEN 1 AND 8192),
+	CONSTRAINT "app_wallet_challenges_dates" CHECK ("app_wallet_challenges"."expires_at" > "app_wallet_challenges"."created_at" AND isfinite("app_wallet_challenges"."expires_at"))
+);
+--> statement-breakpoint
+ALTER TABLE "app_user_roles" ALTER COLUMN "role" SET DEFAULT 'recipient';--> statement-breakpoint
+ALTER TABLE "app_sessions" ADD CONSTRAINT "app_sessions_user_id_app_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_wallet_challenges" ADD CONSTRAINT "app_wallet_challenges_session_id_app_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."app_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_auth_transactions_expiry_idx" ON "app_auth_transactions" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "app_sessions_user_idx" ON "app_sessions" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "app_sessions_expiry_idx" ON "app_sessions" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "app_wallet_challenges_session_idx" ON "app_wallet_challenges" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "app_wallet_challenges_expiry_idx" ON "app_wallet_challenges" USING btree ("expires_at");
\ No newline at end of file
diff --git a/db/migrations/0005_admin_review.sql b/db/migrations/0005_admin_review.sql
new file mode 100644
index 0000000..4c0c73b
--- /dev/null
+++ b/db/migrations/0005_admin_review.sql
@@ -0,0 +1,57 @@
+CREATE TABLE "app_admin_bootstrap_audit" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"operator" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_admin_bootstrap_operator" CHECK (length(btrim("app_admin_bootstrap_audit"."operator")) BETWEEN 1 AND 200)
+);
+--> statement-breakpoint
+CREATE TABLE "app_admin_decisions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"role" text NOT NULL,
+	"actor_id" uuid NOT NULL,
+	"action" text NOT NULL,
+	"before_status" text NOT NULL,
+	"after_status" text NOT NULL,
+	"reason" text,
+	"revision" integer NOT NULL,
+	"idempotency_key" uuid NOT NULL,
+	"request_hash" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_admin_decisions_revision" CHECK ("app_admin_decisions"."revision" > 0),
+	CONSTRAINT "app_admin_decisions_hash" CHECK ("app_admin_decisions"."request_hash" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_admin_decisions_transition" CHECK (("app_admin_decisions"."action" = 'approve' AND "app_admin_decisions"."before_status" = 'pending' AND "app_admin_decisions"."after_status" = 'approved') OR ("app_admin_decisions"."action" = 'reject' AND "app_admin_decisions"."before_status" = 'pending' AND "app_admin_decisions"."after_status" = 'rejected') OR ("app_admin_decisions"."action" = 'suspend' AND "app_admin_decisions"."role" = 'verifier' AND "app_admin_decisions"."before_status" = 'approved' AND "app_admin_decisions"."after_status" = 'suspended') OR ("app_admin_decisions"."action" = 'restore' AND "app_admin_decisions"."role" = 'verifier' AND "app_admin_decisions"."before_status" = 'suspended' AND "app_admin_decisions"."after_status" = 'approved')),
+	CONSTRAINT "app_admin_decisions_reason" CHECK ("app_admin_decisions"."action" NOT IN ('reject', 'suspend') OR ("app_admin_decisions"."reason" IS NOT NULL AND length(btrim("app_admin_decisions"."reason")) > 0))
+);
+--> statement-breakpoint
+CREATE TABLE "app_admin_notifications" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"decision_id" uuid NOT NULL,
+	"recipient_user_id" uuid NOT NULL,
+	"recipient_email" text,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"attempts" integer DEFAULT 0 NOT NULL,
+	"attempt_id" uuid,
+	"claimed_at" timestamp with time zone,
+	"sent_at" timestamp with time zone,
+	"error_code" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_admin_notifications_decision_id_unique" UNIQUE("decision_id"),
+	CONSTRAINT "app_admin_notifications_status" CHECK ("app_admin_notifications"."status" IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')),
+	CONSTRAINT "app_admin_notifications_attempts" CHECK ("app_admin_notifications"."attempts" >= 0),
+	CONSTRAINT "app_admin_notifications_sending" CHECK ("app_admin_notifications"."status" <> 'sending' OR ("app_admin_notifications"."attempt_id" IS NOT NULL AND "app_admin_notifications"."claimed_at" IS NOT NULL AND "app_admin_notifications"."recipient_email" IS NOT NULL)),
+	CONSTRAINT "app_admin_notifications_sent" CHECK (("app_admin_notifications"."status" = 'sent') = ("app_admin_notifications"."sent_at" IS NOT NULL))
+);
+--> statement-breakpoint
+ALTER TABLE "app_organization_applications" ADD COLUMN "revision" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_admin_bootstrap_audit" ADD CONSTRAINT "app_admin_bootstrap_audit_user_id_app_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_admin_decisions" ADD CONSTRAINT "app_admin_decisions_actor_id_app_users_id_fk" FOREIGN KEY ("actor_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_admin_decisions" ADD CONSTRAINT "app_admin_decisions_application_fk" FOREIGN KEY ("organization_id","role") REFERENCES "public"."app_organization_applications"("organization_id","role") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_admin_notifications" ADD CONSTRAINT "app_admin_notifications_decision_id_app_admin_decisions_id_fk" FOREIGN KEY ("decision_id") REFERENCES "public"."app_admin_decisions"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_admin_notifications" ADD CONSTRAINT "app_admin_notifications_recipient_user_id_app_users_id_fk" FOREIGN KEY ("recipient_user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "app_admin_decisions_idempotency_uq" ON "app_admin_decisions" USING btree ("actor_id","idempotency_key");--> statement-breakpoint
+CREATE UNIQUE INDEX "app_admin_decisions_revision_uq" ON "app_admin_decisions" USING btree ("organization_id","role","revision");--> statement-breakpoint
+CREATE INDEX "app_admin_decisions_history_idx" ON "app_admin_decisions" USING btree ("created_at","id");--> statement-breakpoint
+CREATE INDEX "app_admin_notifications_queue_idx" ON "app_admin_notifications" USING btree ("status","created_at");--> statement-breakpoint
+ALTER TABLE "app_organization_applications" ADD CONSTRAINT "app_organization_applications_revision" CHECK ("app_organization_applications"."revision" >= 0);
\ No newline at end of file
diff --git a/db/migrations/0006_issuer_workspace.sql b/db/migrations/0006_issuer_workspace.sql
new file mode 100644
index 0000000..cd7824e
--- /dev/null
+++ b/db/migrations/0006_issuer_workspace.sql
@@ -0,0 +1,38 @@
+CREATE TABLE "app_invite_deliveries" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"invite_id" uuid NOT NULL,
+	"kind" text NOT NULL,
+	"recipient_email" text NOT NULL,
+	"status" text NOT NULL,
+	"error_code" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_invite_deliveries_status" CHECK ("app_invite_deliveries"."status" IN ('sending', 'sent', 'failed', 'uncertain', 'cancelled')),
+	CONSTRAINT "app_invite_deliveries_kind" CHECK ("app_invite_deliveries"."kind" IN ('invitation', 'issued', 'revoked'))
+);
+--> statement-breakpoint
+CREATE TABLE "app_issuer_payloads" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"locator" text NOT NULL,
+	"invite_id" uuid NOT NULL,
+	"created_by" uuid NOT NULL,
+	"subject_address" text NOT NULL,
+	"canonical_payload" text NOT NULL,
+	"payload_digest" text NOT NULL,
+	"credential_uri" text NOT NULL,
+	"visibility" text NOT NULL,
+	"public_fields" jsonb NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_issuer_payloads_locator_unique" UNIQUE("locator"),
+	CONSTRAINT "app_issuer_payloads_locator" CHECK ("app_issuer_payloads"."locator" ~ '^[0-9a-f]{18}$'),
+	CONSTRAINT "app_issuer_payloads_digest" CHECK ("app_issuer_payloads"."payload_digest" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_issuer_payloads_size" CHECK (octet_length("app_issuer_payloads"."canonical_payload") BETWEEN 1 AND 1048576),
+	CONSTRAINT "app_issuer_payloads_visibility" CHECK ("app_issuer_payloads"."visibility" IN ('public', 'private')),
+	CONSTRAINT "app_issuer_payloads_fields" CHECK (jsonb_typeof("app_issuer_payloads"."public_fields") = 'array' AND NOT jsonb_path_exists("app_issuer_payloads"."public_fields", '$[*] ? (@.type() != "string")'))
+);
+--> statement-breakpoint
+ALTER TABLE "app_invite_deliveries" ADD CONSTRAINT "app_invite_deliveries_invite_id_app_invites_id_fk" FOREIGN KEY ("invite_id") REFERENCES "public"."app_invites"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_issuer_payloads" ADD CONSTRAINT "app_issuer_payloads_invite_id_app_invites_id_fk" FOREIGN KEY ("invite_id") REFERENCES "public"."app_invites"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_issuer_payloads" ADD CONSTRAINT "app_issuer_payloads_created_by_app_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_invite_deliveries_invite_idx" ON "app_invite_deliveries" USING btree ("invite_id","created_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "app_invite_deliveries_event_uq" ON "app_invite_deliveries" USING btree ("invite_id","kind") WHERE "app_invite_deliveries"."kind" <> 'invitation';--> statement-breakpoint
+CREATE INDEX "app_issuer_payloads_invite_idx" ON "app_issuer_payloads" USING btree ("invite_id");
\ No newline at end of file
diff --git a/db/migrations/0007_recipient_verifier.sql b/db/migrations/0007_recipient_verifier.sql
new file mode 100644
index 0000000..964567c
--- /dev/null
+++ b/db/migrations/0007_recipient_verifier.sql
@@ -0,0 +1,27 @@
+CREATE TABLE "app_verifier_history" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"verifier_organization_id" uuid NOT NULL,
+	"verifier_user_id" uuid NOT NULL,
+	"presentation_id" uuid NOT NULL,
+	"profile_id" text NOT NULL,
+	"generation_id" text NOT NULL,
+	"scope" text NOT NULL,
+	"on_chain" text NOT NULL,
+	"schema_status" text NOT NULL,
+	"payload_status" text NOT NULL,
+	"issuer_trust" text NOT NULL,
+	"checked_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_verifier_history_profile" CHECK (length("app_verifier_history"."profile_id") BETWEEN 1 AND 200),
+	CONSTRAINT "app_verifier_history_generation" CHECK ("app_verifier_history"."generation_id" ~ '^[0-9a-f]{64}$'),
+	CONSTRAINT "app_verifier_history_scope" CHECK ("app_verifier_history"."scope" IN ('public', 'full')),
+	CONSTRAINT "app_verifier_history_chain" CHECK ("app_verifier_history"."on_chain" IN ('not_found', 'pending', 'active', 'expired', 'deleted')),
+	CONSTRAINT "app_verifier_history_schema" CHECK ("app_verifier_history"."schema_status" IN ('valid', 'unknown')),
+	CONSTRAINT "app_verifier_history_payload" CHECK ("app_verifier_history"."payload_status" IN ('valid', 'unavailable', 'tampered', 'invalid', 'not_checked')),
+	CONSTRAINT "app_verifier_history_trust" CHECK ("app_verifier_history"."issuer_trust" IN ('trusted', 'untrusted', 'unknown'))
+);
+--> statement-breakpoint
+ALTER TABLE "app_verifier_history" ADD CONSTRAINT "app_verifier_history_verifier_organization_id_app_organizations_id_fk" FOREIGN KEY ("verifier_organization_id") REFERENCES "public"."app_organizations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_verifier_history" ADD CONSTRAINT "app_verifier_history_verifier_user_id_app_users_id_fk" FOREIGN KEY ("verifier_user_id") REFERENCES "public"."app_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_verifier_history" ADD CONSTRAINT "app_verifier_history_presentation_id_app_presentations_id_fk" FOREIGN KEY ("presentation_id") REFERENCES "public"."app_presentations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_verifier_history_user_idx" ON "app_verifier_history" USING btree ("verifier_user_id","checked_at","id");--> statement-breakpoint
+CREATE INDEX "app_verifier_history_organization_idx" ON "app_verifier_history" USING btree ("verifier_organization_id","checked_at","id");
\ No newline at end of file
diff --git a/db/migrations/0008_presentation_wallet_proof.sql b/db/migrations/0008_presentation_wallet_proof.sql
new file mode 100644
index 0000000..6e4743a
--- /dev/null
+++ b/db/migrations/0008_presentation_wallet_proof.sql
@@ -0,0 +1,33 @@
+CREATE TABLE "app_presentation_challenges" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"session_id" uuid NOT NULL,
+	"presentation_id" uuid NOT NULL,
+	"request" jsonb NOT NULL,
+	"message" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "app_presentation_challenges_presentation_id_unique" UNIQUE("presentation_id"),
+	CONSTRAINT "app_presentation_challenges_request" CHECK (jsonb_typeof("app_presentation_challenges"."request") = 'object'),
+	CONSTRAINT "app_presentation_challenges_message" CHECK (octet_length("app_presentation_challenges"."message") BETWEEN 1 AND 8192),
+	CONSTRAINT "app_presentation_challenges_dates" CHECK ("app_presentation_challenges"."expires_at" > "app_presentation_challenges"."created_at" AND "app_presentation_challenges"."expires_at" <= "app_presentation_challenges"."created_at" + interval '5 minutes' AND isfinite("app_presentation_challenges"."expires_at"))
+);
+--> statement-breakpoint
+CREATE TABLE "app_presentation_proofs" (
+	"presentation_id" uuid PRIMARY KEY NOT NULL,
+	"request" jsonb NOT NULL,
+	"message" text NOT NULL,
+	"signature" text NOT NULL,
+	"public_key" text NOT NULL,
+	"scheme" text NOT NULL,
+	"verified_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_presentation_proofs_request" CHECK (jsonb_typeof("app_presentation_proofs"."request") = 'object'),
+	CONSTRAINT "app_presentation_proofs_message" CHECK (octet_length("app_presentation_proofs"."message") BETWEEN 1 AND 8192),
+	CONSTRAINT "app_presentation_proofs_signature" CHECK ("app_presentation_proofs"."signature" ~ '^[0-9A-Fa-f]{128,144}$'),
+	CONSTRAINT "app_presentation_proofs_key" CHECK ("app_presentation_proofs"."public_key" ~ '^(02|03|ED|ed)[0-9A-Fa-f]{64}$'),
+	CONSTRAINT "app_presentation_proofs_scheme" CHECK ("app_presentation_proofs"."scheme" IN ('ripple', 'otsu'))
+);
+--> statement-breakpoint
+ALTER TABLE "app_presentation_challenges" ADD CONSTRAINT "app_presentation_challenges_session_id_app_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."app_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_presentation_proofs" ADD CONSTRAINT "app_presentation_proofs_presentation_id_app_presentations_id_fk" FOREIGN KEY ("presentation_id") REFERENCES "public"."app_presentations"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_presentation_challenges_session_idx" ON "app_presentation_challenges" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "app_presentation_challenges_expiry_idx" ON "app_presentation_challenges" USING btree ("expires_at");
\ No newline at end of file
diff --git a/db/migrations/meta/0001_snapshot.json b/db/migrations/meta/0001_snapshot.json
new file mode 100644
index 0000000..a4b1d92
--- /dev/null
+++ b/db/migrations/meta/0001_snapshot.json
@@ -0,0 +1,2110 @@
+{
+  "id": "d03daadc-770c-4ac8-ab74-90274a6caefd",
+  "prevId": "bd51fdfe-5c40-4e4c-995d-4bf5c9877561",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "hosted_payloads_digest_hex_unique": {
+          "name": "hosted_payloads_digest_hex_unique",
+          "nullsNotDistinct": false,
+          "columns": ["digest_hex"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^[0-9a-f]{20}$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0002_snapshot.json b/db/migrations/meta/0002_snapshot.json
new file mode 100644
index 0000000..d493b3f
--- /dev/null
+++ b/db/migrations/meta/0002_snapshot.json
@@ -0,0 +1,2104 @@
+{
+  "id": "8c531e24-4c32-4f12-8c21-aaaeae0f81b5",
+  "prevId": "d03daadc-770c-4ac8-ab74-90274a6caefd",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0003_snapshot.json b/db/migrations/meta/0003_snapshot.json
new file mode 100644
index 0000000..07a10c9
--- /dev/null
+++ b/db/migrations/meta/0003_snapshot.json
@@ -0,0 +1,3428 @@
+{
+  "id": "c0ab9eac-2540-4c21-b4c3-4945c54c8086",
+  "prevId": "8c531e24-4c32-4f12-8c21-aaaeae0f81b5",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0004_snapshot.json b/db/migrations/meta/0004_snapshot.json
new file mode 100644
index 0000000..a23be61
--- /dev/null
+++ b/db/migrations/meta/0004_snapshot.json
@@ -0,0 +1,3750 @@
+{
+  "id": "3f9deb9a-1604-43ee-ab8b-b494534fc6ee",
+  "prevId": "c0ab9eac-2540-4c21-b4c3-4945c54c8086",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recipient'"
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_auth_transactions": {
+      "name": "app_auth_transactions",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "browser_hash": {
+          "name": "browser_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "nonce": {
+          "name": "nonce",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_auth_transactions_expiry_idx": {
+          "name": "app_auth_transactions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_auth_transactions_hashes": {
+          "name": "app_auth_transactions_hashes",
+          "value": "\"app_auth_transactions\".\"state_hash\" ~ '^[0-9a-f]{64}$' AND \"app_auth_transactions\".\"browser_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_auth_transactions_tokens": {
+          "name": "app_auth_transactions_tokens",
+          "value": "\"app_auth_transactions\".\"nonce\" ~ '^[A-Za-z0-9_-]{43}$' AND \"app_auth_transactions\".\"code_verifier\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_auth_transactions_return_to": {
+          "name": "app_auth_transactions_return_to",
+          "value": "length(\"app_auth_transactions\".\"return_to\") BETWEEN 1 AND 2048 AND left(\"app_auth_transactions\".\"return_to\", 1) = '/' AND left(\"app_auth_transactions\".\"return_to\", 2) <> '//' AND position(chr(92) in \"app_auth_transactions\".\"return_to\") = 0 AND \"app_auth_transactions\".\"return_to\" !~ '[[:cntrl:]]'"
+        },
+        "app_auth_transactions_dates": {
+          "name": "app_auth_transactions_dates",
+          "value": "\"app_auth_transactions\".\"expires_at\" > \"app_auth_transactions\".\"created_at\" AND isfinite(\"app_auth_transactions\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_sessions": {
+      "name": "app_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "csrf_token": {
+          "name": "csrf_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_expires_at": {
+          "name": "absolute_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_sessions_user_idx": {
+          "name": "app_sessions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_sessions_expiry_idx": {
+          "name": "app_sessions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_sessions_user_id_app_users_id_fk": {
+          "name": "app_sessions_user_id_app_users_id_fk",
+          "tableFrom": "app_sessions",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_sessions_token_hash_unique": {
+          "name": "app_sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_sessions_token": {
+          "name": "app_sessions_token",
+          "value": "\"app_sessions\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_sessions_csrf": {
+          "name": "app_sessions_csrf",
+          "value": "\"app_sessions\".\"csrf_token\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_sessions_dates": {
+          "name": "app_sessions_dates",
+          "value": "\"app_sessions\".\"expires_at\" > \"app_sessions\".\"created_at\" AND \"app_sessions\".\"absolute_expires_at\" >= \"app_sessions\".\"expires_at\" AND isfinite(\"app_sessions\".\"absolute_expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallet_challenges": {
+      "name": "app_wallet_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_wallet_challenges_session_idx": {
+          "name": "app_wallet_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallet_challenges_expiry_idx": {
+          "name": "app_wallet_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallet_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_wallet_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_wallet_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallet_challenges_network": {
+          "name": "app_wallet_challenges_network",
+          "value": "\"app_wallet_challenges\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallet_challenges_address": {
+          "name": "app_wallet_challenges_address",
+          "value": "\"app_wallet_challenges\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallet_challenges_message": {
+          "name": "app_wallet_challenges_message",
+          "value": "length(\"app_wallet_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_wallet_challenges_dates": {
+          "name": "app_wallet_challenges_dates",
+          "value": "\"app_wallet_challenges\".\"expires_at\" > \"app_wallet_challenges\".\"created_at\" AND isfinite(\"app_wallet_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0005_snapshot.json b/db/migrations/meta/0005_snapshot.json
new file mode 100644
index 0000000..bbd023e
--- /dev/null
+++ b/db/migrations/meta/0005_snapshot.json
@@ -0,0 +1,4155 @@
+{
+  "id": "5cee2b7a-b4ee-4936-b8ab-0144e5f8553f",
+  "prevId": "3f9deb9a-1604-43ee-ab8b-b494534fc6ee",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recipient'"
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_revision": {
+          "name": "app_organization_applications_revision",
+          "value": "\"app_organization_applications\".\"revision\" >= 0"
+        },
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_auth_transactions": {
+      "name": "app_auth_transactions",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "browser_hash": {
+          "name": "browser_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "nonce": {
+          "name": "nonce",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_auth_transactions_expiry_idx": {
+          "name": "app_auth_transactions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_auth_transactions_hashes": {
+          "name": "app_auth_transactions_hashes",
+          "value": "\"app_auth_transactions\".\"state_hash\" ~ '^[0-9a-f]{64}$' AND \"app_auth_transactions\".\"browser_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_auth_transactions_tokens": {
+          "name": "app_auth_transactions_tokens",
+          "value": "\"app_auth_transactions\".\"nonce\" ~ '^[A-Za-z0-9_-]{43}$' AND \"app_auth_transactions\".\"code_verifier\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_auth_transactions_return_to": {
+          "name": "app_auth_transactions_return_to",
+          "value": "length(\"app_auth_transactions\".\"return_to\") BETWEEN 1 AND 2048 AND left(\"app_auth_transactions\".\"return_to\", 1) = '/' AND left(\"app_auth_transactions\".\"return_to\", 2) <> '//' AND position(chr(92) in \"app_auth_transactions\".\"return_to\") = 0 AND \"app_auth_transactions\".\"return_to\" !~ '[[:cntrl:]]'"
+        },
+        "app_auth_transactions_dates": {
+          "name": "app_auth_transactions_dates",
+          "value": "\"app_auth_transactions\".\"expires_at\" > \"app_auth_transactions\".\"created_at\" AND isfinite(\"app_auth_transactions\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_sessions": {
+      "name": "app_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "csrf_token": {
+          "name": "csrf_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_expires_at": {
+          "name": "absolute_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_sessions_user_idx": {
+          "name": "app_sessions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_sessions_expiry_idx": {
+          "name": "app_sessions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_sessions_user_id_app_users_id_fk": {
+          "name": "app_sessions_user_id_app_users_id_fk",
+          "tableFrom": "app_sessions",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_sessions_token_hash_unique": {
+          "name": "app_sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_sessions_token": {
+          "name": "app_sessions_token",
+          "value": "\"app_sessions\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_sessions_csrf": {
+          "name": "app_sessions_csrf",
+          "value": "\"app_sessions\".\"csrf_token\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_sessions_dates": {
+          "name": "app_sessions_dates",
+          "value": "\"app_sessions\".\"expires_at\" > \"app_sessions\".\"created_at\" AND \"app_sessions\".\"absolute_expires_at\" >= \"app_sessions\".\"expires_at\" AND isfinite(\"app_sessions\".\"absolute_expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallet_challenges": {
+      "name": "app_wallet_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_wallet_challenges_session_idx": {
+          "name": "app_wallet_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallet_challenges_expiry_idx": {
+          "name": "app_wallet_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallet_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_wallet_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_wallet_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallet_challenges_network": {
+          "name": "app_wallet_challenges_network",
+          "value": "\"app_wallet_challenges\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallet_challenges_address": {
+          "name": "app_wallet_challenges_address",
+          "value": "\"app_wallet_challenges\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallet_challenges_message": {
+          "name": "app_wallet_challenges_message",
+          "value": "length(\"app_wallet_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_wallet_challenges_dates": {
+          "name": "app_wallet_challenges_dates",
+          "value": "\"app_wallet_challenges\".\"expires_at\" > \"app_wallet_challenges\".\"created_at\" AND isfinite(\"app_wallet_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_bootstrap_audit": {
+      "name": "app_admin_bootstrap_audit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "operator": {
+          "name": "operator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_admin_bootstrap_audit_user_id_app_users_id_fk": {
+          "name": "app_admin_bootstrap_audit_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_bootstrap_audit",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_bootstrap_operator": {
+          "name": "app_admin_bootstrap_operator",
+          "value": "length(btrim(\"app_admin_bootstrap_audit\".\"operator\")) BETWEEN 1 AND 200"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_decisions": {
+      "name": "app_admin_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "before_status": {
+          "name": "before_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_status": {
+          "name": "after_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_decisions_idempotency_uq": {
+          "name": "app_admin_decisions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_revision_uq": {
+          "name": "app_admin_decisions_revision_uq",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_history_idx": {
+          "name": "app_admin_decisions_history_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_decisions_actor_id_app_users_id_fk": {
+          "name": "app_admin_decisions_actor_id_app_users_id_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_users",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_decisions_application_fk": {
+          "name": "app_admin_decisions_application_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_decisions_revision": {
+          "name": "app_admin_decisions_revision",
+          "value": "\"app_admin_decisions\".\"revision\" > 0"
+        },
+        "app_admin_decisions_hash": {
+          "name": "app_admin_decisions_hash",
+          "value": "\"app_admin_decisions\".\"request_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_admin_decisions_transition": {
+          "name": "app_admin_decisions_transition",
+          "value": "(\"app_admin_decisions\".\"action\" = 'approve' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'approved') OR (\"app_admin_decisions\".\"action\" = 'reject' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'rejected') OR (\"app_admin_decisions\".\"action\" = 'suspend' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'approved' AND \"app_admin_decisions\".\"after_status\" = 'suspended') OR (\"app_admin_decisions\".\"action\" = 'restore' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'suspended' AND \"app_admin_decisions\".\"after_status\" = 'approved')"
+        },
+        "app_admin_decisions_reason": {
+          "name": "app_admin_decisions_reason",
+          "value": "\"app_admin_decisions\".\"action\" NOT IN ('reject', 'suspend') OR (\"app_admin_decisions\".\"reason\" IS NOT NULL AND length(btrim(\"app_admin_decisions\".\"reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_notifications": {
+      "name": "app_admin_notifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attempt_id": {
+          "name": "attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_notifications_queue_idx": {
+          "name": "app_admin_notifications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_notifications_decision_id_app_admin_decisions_id_fk": {
+          "name": "app_admin_notifications_decision_id_app_admin_decisions_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_admin_decisions",
+          "columnsFrom": ["decision_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_notifications_recipient_user_id_app_users_id_fk": {
+          "name": "app_admin_notifications_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_admin_notifications_decision_id_unique": {
+          "name": "app_admin_notifications_decision_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["decision_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_notifications_status": {
+          "name": "app_admin_notifications_status",
+          "value": "\"app_admin_notifications\".\"status\" IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')"
+        },
+        "app_admin_notifications_attempts": {
+          "name": "app_admin_notifications_attempts",
+          "value": "\"app_admin_notifications\".\"attempts\" >= 0"
+        },
+        "app_admin_notifications_sending": {
+          "name": "app_admin_notifications_sending",
+          "value": "\"app_admin_notifications\".\"status\" <> 'sending' OR (\"app_admin_notifications\".\"attempt_id\" IS NOT NULL AND \"app_admin_notifications\".\"claimed_at\" IS NOT NULL AND \"app_admin_notifications\".\"recipient_email\" IS NOT NULL)"
+        },
+        "app_admin_notifications_sent": {
+          "name": "app_admin_notifications_sent",
+          "value": "(\"app_admin_notifications\".\"status\" = 'sent') = (\"app_admin_notifications\".\"sent_at\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0006_snapshot.json b/db/migrations/meta/0006_snapshot.json
new file mode 100644
index 0000000..061e449
--- /dev/null
+++ b/db/migrations/meta/0006_snapshot.json
@@ -0,0 +1,4418 @@
+{
+  "id": "a2e1fc72-1d85-4117-9bf4-66d0a8f99595",
+  "prevId": "5cee2b7a-b4ee-4936-b8ab-0144e5f8553f",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recipient'"
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_revision": {
+          "name": "app_organization_applications_revision",
+          "value": "\"app_organization_applications\".\"revision\" >= 0"
+        },
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_auth_transactions": {
+      "name": "app_auth_transactions",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "browser_hash": {
+          "name": "browser_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "nonce": {
+          "name": "nonce",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_auth_transactions_expiry_idx": {
+          "name": "app_auth_transactions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_auth_transactions_hashes": {
+          "name": "app_auth_transactions_hashes",
+          "value": "\"app_auth_transactions\".\"state_hash\" ~ '^[0-9a-f]{64}$' AND \"app_auth_transactions\".\"browser_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_auth_transactions_tokens": {
+          "name": "app_auth_transactions_tokens",
+          "value": "\"app_auth_transactions\".\"nonce\" ~ '^[A-Za-z0-9_-]{43}$' AND \"app_auth_transactions\".\"code_verifier\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_auth_transactions_return_to": {
+          "name": "app_auth_transactions_return_to",
+          "value": "length(\"app_auth_transactions\".\"return_to\") BETWEEN 1 AND 2048 AND left(\"app_auth_transactions\".\"return_to\", 1) = '/' AND left(\"app_auth_transactions\".\"return_to\", 2) <> '//' AND position(chr(92) in \"app_auth_transactions\".\"return_to\") = 0 AND \"app_auth_transactions\".\"return_to\" !~ '[[:cntrl:]]'"
+        },
+        "app_auth_transactions_dates": {
+          "name": "app_auth_transactions_dates",
+          "value": "\"app_auth_transactions\".\"expires_at\" > \"app_auth_transactions\".\"created_at\" AND isfinite(\"app_auth_transactions\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_sessions": {
+      "name": "app_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "csrf_token": {
+          "name": "csrf_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_expires_at": {
+          "name": "absolute_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_sessions_user_idx": {
+          "name": "app_sessions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_sessions_expiry_idx": {
+          "name": "app_sessions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_sessions_user_id_app_users_id_fk": {
+          "name": "app_sessions_user_id_app_users_id_fk",
+          "tableFrom": "app_sessions",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_sessions_token_hash_unique": {
+          "name": "app_sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_sessions_token": {
+          "name": "app_sessions_token",
+          "value": "\"app_sessions\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_sessions_csrf": {
+          "name": "app_sessions_csrf",
+          "value": "\"app_sessions\".\"csrf_token\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_sessions_dates": {
+          "name": "app_sessions_dates",
+          "value": "\"app_sessions\".\"expires_at\" > \"app_sessions\".\"created_at\" AND \"app_sessions\".\"absolute_expires_at\" >= \"app_sessions\".\"expires_at\" AND isfinite(\"app_sessions\".\"absolute_expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallet_challenges": {
+      "name": "app_wallet_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_wallet_challenges_session_idx": {
+          "name": "app_wallet_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallet_challenges_expiry_idx": {
+          "name": "app_wallet_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallet_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_wallet_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_wallet_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallet_challenges_network": {
+          "name": "app_wallet_challenges_network",
+          "value": "\"app_wallet_challenges\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallet_challenges_address": {
+          "name": "app_wallet_challenges_address",
+          "value": "\"app_wallet_challenges\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallet_challenges_message": {
+          "name": "app_wallet_challenges_message",
+          "value": "length(\"app_wallet_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_wallet_challenges_dates": {
+          "name": "app_wallet_challenges_dates",
+          "value": "\"app_wallet_challenges\".\"expires_at\" > \"app_wallet_challenges\".\"created_at\" AND isfinite(\"app_wallet_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_bootstrap_audit": {
+      "name": "app_admin_bootstrap_audit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "operator": {
+          "name": "operator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_admin_bootstrap_audit_user_id_app_users_id_fk": {
+          "name": "app_admin_bootstrap_audit_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_bootstrap_audit",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_bootstrap_operator": {
+          "name": "app_admin_bootstrap_operator",
+          "value": "length(btrim(\"app_admin_bootstrap_audit\".\"operator\")) BETWEEN 1 AND 200"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_decisions": {
+      "name": "app_admin_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "before_status": {
+          "name": "before_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_status": {
+          "name": "after_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_decisions_idempotency_uq": {
+          "name": "app_admin_decisions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_revision_uq": {
+          "name": "app_admin_decisions_revision_uq",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_history_idx": {
+          "name": "app_admin_decisions_history_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_decisions_actor_id_app_users_id_fk": {
+          "name": "app_admin_decisions_actor_id_app_users_id_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_users",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_decisions_application_fk": {
+          "name": "app_admin_decisions_application_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_decisions_revision": {
+          "name": "app_admin_decisions_revision",
+          "value": "\"app_admin_decisions\".\"revision\" > 0"
+        },
+        "app_admin_decisions_hash": {
+          "name": "app_admin_decisions_hash",
+          "value": "\"app_admin_decisions\".\"request_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_admin_decisions_transition": {
+          "name": "app_admin_decisions_transition",
+          "value": "(\"app_admin_decisions\".\"action\" = 'approve' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'approved') OR (\"app_admin_decisions\".\"action\" = 'reject' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'rejected') OR (\"app_admin_decisions\".\"action\" = 'suspend' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'approved' AND \"app_admin_decisions\".\"after_status\" = 'suspended') OR (\"app_admin_decisions\".\"action\" = 'restore' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'suspended' AND \"app_admin_decisions\".\"after_status\" = 'approved')"
+        },
+        "app_admin_decisions_reason": {
+          "name": "app_admin_decisions_reason",
+          "value": "\"app_admin_decisions\".\"action\" NOT IN ('reject', 'suspend') OR (\"app_admin_decisions\".\"reason\" IS NOT NULL AND length(btrim(\"app_admin_decisions\".\"reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_notifications": {
+      "name": "app_admin_notifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attempt_id": {
+          "name": "attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_notifications_queue_idx": {
+          "name": "app_admin_notifications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_notifications_decision_id_app_admin_decisions_id_fk": {
+          "name": "app_admin_notifications_decision_id_app_admin_decisions_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_admin_decisions",
+          "columnsFrom": ["decision_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_notifications_recipient_user_id_app_users_id_fk": {
+          "name": "app_admin_notifications_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_admin_notifications_decision_id_unique": {
+          "name": "app_admin_notifications_decision_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["decision_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_notifications_status": {
+          "name": "app_admin_notifications_status",
+          "value": "\"app_admin_notifications\".\"status\" IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')"
+        },
+        "app_admin_notifications_attempts": {
+          "name": "app_admin_notifications_attempts",
+          "value": "\"app_admin_notifications\".\"attempts\" >= 0"
+        },
+        "app_admin_notifications_sending": {
+          "name": "app_admin_notifications_sending",
+          "value": "\"app_admin_notifications\".\"status\" <> 'sending' OR (\"app_admin_notifications\".\"attempt_id\" IS NOT NULL AND \"app_admin_notifications\".\"claimed_at\" IS NOT NULL AND \"app_admin_notifications\".\"recipient_email\" IS NOT NULL)"
+        },
+        "app_admin_notifications_sent": {
+          "name": "app_admin_notifications_sent",
+          "value": "(\"app_admin_notifications\".\"status\" = 'sent') = (\"app_admin_notifications\".\"sent_at\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invite_deliveries": {
+      "name": "app_invite_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_invite_deliveries_invite_idx": {
+          "name": "app_invite_deliveries_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invite_deliveries_event_uq": {
+          "name": "app_invite_deliveries_event_uq",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"app_invite_deliveries\".\"kind\" <> 'invitation'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invite_deliveries_invite_id_app_invites_id_fk": {
+          "name": "app_invite_deliveries_invite_id_app_invites_id_fk",
+          "tableFrom": "app_invite_deliveries",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_invite_deliveries_status": {
+          "name": "app_invite_deliveries_status",
+          "value": "\"app_invite_deliveries\".\"status\" IN ('sending', 'sent', 'failed', 'uncertain', 'cancelled')"
+        },
+        "app_invite_deliveries_kind": {
+          "name": "app_invite_deliveries_kind",
+          "value": "\"app_invite_deliveries\".\"kind\" IN ('invitation', 'issued', 'revoked')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_issuer_payloads": {
+      "name": "app_issuer_payloads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_payload": {
+          "name": "canonical_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_uri": {
+          "name": "credential_uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_issuer_payloads_invite_idx": {
+          "name": "app_issuer_payloads_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_issuer_payloads_invite_id_app_invites_id_fk": {
+          "name": "app_issuer_payloads_invite_id_app_invites_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_issuer_payloads_created_by_app_users_id_fk": {
+          "name": "app_issuer_payloads_created_by_app_users_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_issuer_payloads_locator_unique": {
+          "name": "app_issuer_payloads_locator_unique",
+          "nullsNotDistinct": false,
+          "columns": ["locator"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_issuer_payloads_locator": {
+          "name": "app_issuer_payloads_locator",
+          "value": "\"app_issuer_payloads\".\"locator\" ~ '^[0-9a-f]{18}$'"
+        },
+        "app_issuer_payloads_digest": {
+          "name": "app_issuer_payloads_digest",
+          "value": "\"app_issuer_payloads\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_issuer_payloads_size": {
+          "name": "app_issuer_payloads_size",
+          "value": "octet_length(\"app_issuer_payloads\".\"canonical_payload\") BETWEEN 1 AND 1048576"
+        },
+        "app_issuer_payloads_visibility": {
+          "name": "app_issuer_payloads_visibility",
+          "value": "\"app_issuer_payloads\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_issuer_payloads_fields": {
+          "name": "app_issuer_payloads_fields",
+          "value": "jsonb_typeof(\"app_issuer_payloads\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_issuer_payloads\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0007_snapshot.json b/db/migrations/meta/0007_snapshot.json
new file mode 100644
index 0000000..0aad028
--- /dev/null
+++ b/db/migrations/meta/0007_snapshot.json
@@ -0,0 +1,4617 @@
+{
+  "id": "284bbf1c-ee6f-43bf-9c24-4c0275bceb23",
+  "prevId": "a2e1fc72-1d85-4117-9bf4-66d0a8f99595",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recipient'"
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_revision": {
+          "name": "app_organization_applications_revision",
+          "value": "\"app_organization_applications\".\"revision\" >= 0"
+        },
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_verifier_history": {
+      "name": "app_verifier_history",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_user_id": {
+          "name": "verifier_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation_id": {
+          "name": "presentation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "on_chain": {
+          "name": "on_chain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_status": {
+          "name": "schema_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_status": {
+          "name": "payload_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_trust": {
+          "name": "issuer_trust",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checked_at": {
+          "name": "checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_verifier_history_user_idx": {
+          "name": "app_verifier_history_user_idx",
+          "columns": [
+            {
+              "expression": "verifier_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "checked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_verifier_history_organization_idx": {
+          "name": "app_verifier_history_organization_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "checked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_verifier_history_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_verifier_history_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_verifier_history_verifier_user_id_app_users_id_fk": {
+          "name": "app_verifier_history_verifier_user_id_app_users_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_users",
+          "columnsFrom": ["verifier_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_verifier_history_presentation_id_app_presentations_id_fk": {
+          "name": "app_verifier_history_presentation_id_app_presentations_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_presentations",
+          "columnsFrom": ["presentation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_verifier_history_profile": {
+          "name": "app_verifier_history_profile",
+          "value": "length(\"app_verifier_history\".\"profile_id\") BETWEEN 1 AND 200"
+        },
+        "app_verifier_history_generation": {
+          "name": "app_verifier_history_generation",
+          "value": "\"app_verifier_history\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_verifier_history_scope": {
+          "name": "app_verifier_history_scope",
+          "value": "\"app_verifier_history\".\"scope\" IN ('public', 'full')"
+        },
+        "app_verifier_history_chain": {
+          "name": "app_verifier_history_chain",
+          "value": "\"app_verifier_history\".\"on_chain\" IN ('not_found', 'pending', 'active', 'expired', 'deleted')"
+        },
+        "app_verifier_history_schema": {
+          "name": "app_verifier_history_schema",
+          "value": "\"app_verifier_history\".\"schema_status\" IN ('valid', 'unknown')"
+        },
+        "app_verifier_history_payload": {
+          "name": "app_verifier_history_payload",
+          "value": "\"app_verifier_history\".\"payload_status\" IN ('valid', 'unavailable', 'tampered', 'invalid', 'not_checked')"
+        },
+        "app_verifier_history_trust": {
+          "name": "app_verifier_history_trust",
+          "value": "\"app_verifier_history\".\"issuer_trust\" IN ('trusted', 'untrusted', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_auth_transactions": {
+      "name": "app_auth_transactions",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "browser_hash": {
+          "name": "browser_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "nonce": {
+          "name": "nonce",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_auth_transactions_expiry_idx": {
+          "name": "app_auth_transactions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_auth_transactions_hashes": {
+          "name": "app_auth_transactions_hashes",
+          "value": "\"app_auth_transactions\".\"state_hash\" ~ '^[0-9a-f]{64}$' AND \"app_auth_transactions\".\"browser_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_auth_transactions_tokens": {
+          "name": "app_auth_transactions_tokens",
+          "value": "\"app_auth_transactions\".\"nonce\" ~ '^[A-Za-z0-9_-]{43}$' AND \"app_auth_transactions\".\"code_verifier\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_auth_transactions_return_to": {
+          "name": "app_auth_transactions_return_to",
+          "value": "length(\"app_auth_transactions\".\"return_to\") BETWEEN 1 AND 2048 AND left(\"app_auth_transactions\".\"return_to\", 1) = '/' AND left(\"app_auth_transactions\".\"return_to\", 2) <> '//' AND position(chr(92) in \"app_auth_transactions\".\"return_to\") = 0 AND \"app_auth_transactions\".\"return_to\" !~ '[[:cntrl:]]'"
+        },
+        "app_auth_transactions_dates": {
+          "name": "app_auth_transactions_dates",
+          "value": "\"app_auth_transactions\".\"expires_at\" > \"app_auth_transactions\".\"created_at\" AND isfinite(\"app_auth_transactions\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_sessions": {
+      "name": "app_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "csrf_token": {
+          "name": "csrf_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_expires_at": {
+          "name": "absolute_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_sessions_user_idx": {
+          "name": "app_sessions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_sessions_expiry_idx": {
+          "name": "app_sessions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_sessions_user_id_app_users_id_fk": {
+          "name": "app_sessions_user_id_app_users_id_fk",
+          "tableFrom": "app_sessions",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_sessions_token_hash_unique": {
+          "name": "app_sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_sessions_token": {
+          "name": "app_sessions_token",
+          "value": "\"app_sessions\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_sessions_csrf": {
+          "name": "app_sessions_csrf",
+          "value": "\"app_sessions\".\"csrf_token\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_sessions_dates": {
+          "name": "app_sessions_dates",
+          "value": "\"app_sessions\".\"expires_at\" > \"app_sessions\".\"created_at\" AND \"app_sessions\".\"absolute_expires_at\" >= \"app_sessions\".\"expires_at\" AND isfinite(\"app_sessions\".\"absolute_expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallet_challenges": {
+      "name": "app_wallet_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_wallet_challenges_session_idx": {
+          "name": "app_wallet_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallet_challenges_expiry_idx": {
+          "name": "app_wallet_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallet_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_wallet_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_wallet_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallet_challenges_network": {
+          "name": "app_wallet_challenges_network",
+          "value": "\"app_wallet_challenges\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallet_challenges_address": {
+          "name": "app_wallet_challenges_address",
+          "value": "\"app_wallet_challenges\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallet_challenges_message": {
+          "name": "app_wallet_challenges_message",
+          "value": "length(\"app_wallet_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_wallet_challenges_dates": {
+          "name": "app_wallet_challenges_dates",
+          "value": "\"app_wallet_challenges\".\"expires_at\" > \"app_wallet_challenges\".\"created_at\" AND isfinite(\"app_wallet_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_bootstrap_audit": {
+      "name": "app_admin_bootstrap_audit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "operator": {
+          "name": "operator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_admin_bootstrap_audit_user_id_app_users_id_fk": {
+          "name": "app_admin_bootstrap_audit_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_bootstrap_audit",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_bootstrap_operator": {
+          "name": "app_admin_bootstrap_operator",
+          "value": "length(btrim(\"app_admin_bootstrap_audit\".\"operator\")) BETWEEN 1 AND 200"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_decisions": {
+      "name": "app_admin_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "before_status": {
+          "name": "before_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_status": {
+          "name": "after_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_decisions_idempotency_uq": {
+          "name": "app_admin_decisions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_revision_uq": {
+          "name": "app_admin_decisions_revision_uq",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_history_idx": {
+          "name": "app_admin_decisions_history_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_decisions_actor_id_app_users_id_fk": {
+          "name": "app_admin_decisions_actor_id_app_users_id_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_users",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_decisions_application_fk": {
+          "name": "app_admin_decisions_application_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_decisions_revision": {
+          "name": "app_admin_decisions_revision",
+          "value": "\"app_admin_decisions\".\"revision\" > 0"
+        },
+        "app_admin_decisions_hash": {
+          "name": "app_admin_decisions_hash",
+          "value": "\"app_admin_decisions\".\"request_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_admin_decisions_transition": {
+          "name": "app_admin_decisions_transition",
+          "value": "(\"app_admin_decisions\".\"action\" = 'approve' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'approved') OR (\"app_admin_decisions\".\"action\" = 'reject' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'rejected') OR (\"app_admin_decisions\".\"action\" = 'suspend' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'approved' AND \"app_admin_decisions\".\"after_status\" = 'suspended') OR (\"app_admin_decisions\".\"action\" = 'restore' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'suspended' AND \"app_admin_decisions\".\"after_status\" = 'approved')"
+        },
+        "app_admin_decisions_reason": {
+          "name": "app_admin_decisions_reason",
+          "value": "\"app_admin_decisions\".\"action\" NOT IN ('reject', 'suspend') OR (\"app_admin_decisions\".\"reason\" IS NOT NULL AND length(btrim(\"app_admin_decisions\".\"reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_notifications": {
+      "name": "app_admin_notifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attempt_id": {
+          "name": "attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_notifications_queue_idx": {
+          "name": "app_admin_notifications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_notifications_decision_id_app_admin_decisions_id_fk": {
+          "name": "app_admin_notifications_decision_id_app_admin_decisions_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_admin_decisions",
+          "columnsFrom": ["decision_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_notifications_recipient_user_id_app_users_id_fk": {
+          "name": "app_admin_notifications_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_admin_notifications_decision_id_unique": {
+          "name": "app_admin_notifications_decision_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["decision_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_notifications_status": {
+          "name": "app_admin_notifications_status",
+          "value": "\"app_admin_notifications\".\"status\" IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')"
+        },
+        "app_admin_notifications_attempts": {
+          "name": "app_admin_notifications_attempts",
+          "value": "\"app_admin_notifications\".\"attempts\" >= 0"
+        },
+        "app_admin_notifications_sending": {
+          "name": "app_admin_notifications_sending",
+          "value": "\"app_admin_notifications\".\"status\" <> 'sending' OR (\"app_admin_notifications\".\"attempt_id\" IS NOT NULL AND \"app_admin_notifications\".\"claimed_at\" IS NOT NULL AND \"app_admin_notifications\".\"recipient_email\" IS NOT NULL)"
+        },
+        "app_admin_notifications_sent": {
+          "name": "app_admin_notifications_sent",
+          "value": "(\"app_admin_notifications\".\"status\" = 'sent') = (\"app_admin_notifications\".\"sent_at\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invite_deliveries": {
+      "name": "app_invite_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_invite_deliveries_invite_idx": {
+          "name": "app_invite_deliveries_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invite_deliveries_event_uq": {
+          "name": "app_invite_deliveries_event_uq",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"app_invite_deliveries\".\"kind\" <> 'invitation'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invite_deliveries_invite_id_app_invites_id_fk": {
+          "name": "app_invite_deliveries_invite_id_app_invites_id_fk",
+          "tableFrom": "app_invite_deliveries",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_invite_deliveries_status": {
+          "name": "app_invite_deliveries_status",
+          "value": "\"app_invite_deliveries\".\"status\" IN ('sending', 'sent', 'failed', 'uncertain', 'cancelled')"
+        },
+        "app_invite_deliveries_kind": {
+          "name": "app_invite_deliveries_kind",
+          "value": "\"app_invite_deliveries\".\"kind\" IN ('invitation', 'issued', 'revoked')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_issuer_payloads": {
+      "name": "app_issuer_payloads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_payload": {
+          "name": "canonical_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_uri": {
+          "name": "credential_uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_issuer_payloads_invite_idx": {
+          "name": "app_issuer_payloads_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_issuer_payloads_invite_id_app_invites_id_fk": {
+          "name": "app_issuer_payloads_invite_id_app_invites_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_issuer_payloads_created_by_app_users_id_fk": {
+          "name": "app_issuer_payloads_created_by_app_users_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_issuer_payloads_locator_unique": {
+          "name": "app_issuer_payloads_locator_unique",
+          "nullsNotDistinct": false,
+          "columns": ["locator"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_issuer_payloads_locator": {
+          "name": "app_issuer_payloads_locator",
+          "value": "\"app_issuer_payloads\".\"locator\" ~ '^[0-9a-f]{18}$'"
+        },
+        "app_issuer_payloads_digest": {
+          "name": "app_issuer_payloads_digest",
+          "value": "\"app_issuer_payloads\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_issuer_payloads_size": {
+          "name": "app_issuer_payloads_size",
+          "value": "octet_length(\"app_issuer_payloads\".\"canonical_payload\") BETWEEN 1 AND 1048576"
+        },
+        "app_issuer_payloads_visibility": {
+          "name": "app_issuer_payloads_visibility",
+          "value": "\"app_issuer_payloads\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_issuer_payloads_fields": {
+          "name": "app_issuer_payloads_fields",
+          "value": "jsonb_typeof(\"app_issuer_payloads\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_issuer_payloads\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/0008_snapshot.json b/db/migrations/meta/0008_snapshot.json
new file mode 100644
index 0000000..71b879b
--- /dev/null
+++ b/db/migrations/meta/0008_snapshot.json
@@ -0,0 +1,4820 @@
+{
+  "id": "824215b7-9ec1-41ec-9d58-bbf665e5ed4c",
+  "prevId": "284bbf1c-ee6f-43bf-9c24-4c0275bceb23",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ledger_checkpoints": {
+      "name": "ledger_checkpoints",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_hash": {
+          "name": "parent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "close_time": {
+          "name": "close_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_count": {
+          "name": "transaction_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_root": {
+          "name": "transaction_root",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ledger_checkpoints_profile_hash_uq": {
+          "name": "ledger_checkpoints_profile_hash_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "ledger_checkpoints_profile_id_network_profiles_profile_id_fk": {
+          "name": "ledger_checkpoints_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "ledger_checkpoints",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "ledger_checkpoints_pk": {
+          "name": "ledger_checkpoints_pk",
+          "columns": ["profile_id", "ledger_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "ledger_checkpoints_index_uint32": {
+          "name": "ledger_checkpoints_index_uint32",
+          "value": "\"ledger_checkpoints\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_hash": {
+          "name": "ledger_checkpoints_hash",
+          "value": "\"ledger_checkpoints\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_parent": {
+          "name": "ledger_checkpoints_parent",
+          "value": "\"ledger_checkpoints\".\"parent_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "ledger_checkpoints_close_time_uint32": {
+          "name": "ledger_checkpoints_close_time_uint32",
+          "value": "\"ledger_checkpoints\".\"close_time\" BETWEEN 0 AND 4294967295"
+        },
+        "ledger_checkpoints_tx_count": {
+          "name": "ledger_checkpoints_tx_count",
+          "value": "\"ledger_checkpoints\".\"transaction_count\" >= 0"
+        },
+        "ledger_checkpoints_transaction_root": {
+          "name": "ledger_checkpoints_transaction_root",
+          "value": "\"ledger_checkpoints\".\"transaction_root\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.network_profiles": {
+      "name": "network_profiles",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "xcs_version": {
+          "name": "xcs_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "required_amendment": {
+          "name": "required_amendment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registry_address": {
+          "name": "registry_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_amount_drops": {
+          "name": "registration_amount_drops",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_index": {
+          "name": "activation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activation_ledger_hash": {
+          "name": "activation_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "network_profiles_xcs_version": {
+          "name": "network_profiles_xcs_version",
+          "value": "\"network_profiles\".\"xcs_version\" = '0.1'"
+        },
+        "network_profiles_network_id": {
+          "name": "network_profiles_network_id",
+          "value": "\"network_profiles\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "network_profiles_registration_amount": {
+          "name": "network_profiles_registration_amount",
+          "value": "\"network_profiles\".\"registration_amount_drops\" = 1"
+        },
+        "network_profiles_activation_index": {
+          "name": "network_profiles_activation_index",
+          "value": "\"network_profiles\".\"activation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "network_profiles_activation_hash": {
+          "name": "network_profiles_activation_hash",
+          "value": "\"network_profiles\".\"activation_ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "network_profiles_registry_address": {
+          "name": "network_profiles_registry_address",
+          "value": "\"network_profiles\".\"registry_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_incidents": {
+      "name": "indexer_incidents",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_incidents_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_incidents_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_incidents",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "indexer_incidents_pk": {
+          "name": "indexer_incidents_pk",
+          "columns": ["profile_id", "writer_epoch"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_incidents_writer_epoch": {
+          "name": "indexer_incidents_writer_epoch",
+          "value": "\"indexer_incidents\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_incidents_error_code": {
+          "name": "indexer_incidents_error_code",
+          "value": "\"indexer_incidents\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_incidents_primary_tip": {
+          "name": "indexer_incidents_primary_tip",
+          "value": "\"indexer_incidents\".\"primary_source_tip\" IS NULL OR \"indexer_incidents\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_secondary_tip": {
+          "name": "indexer_incidents_secondary_tip",
+          "value": "\"indexer_incidents\".\"secondary_source_tip\" IS NULL OR \"indexer_incidents\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_incidents_agreed_ledger": {
+          "name": "indexer_incidents_agreed_ledger",
+          "value": "(\"indexer_incidents\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_incidents\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_incidents\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_incidents\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.indexer_status": {
+      "name": "indexer_status",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_source_tip": {
+          "name": "primary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secondary_source_tip": {
+          "name": "secondary_source_tip",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_index": {
+          "name": "last_agreed_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_agreed_ledger_hash": {
+          "name": "last_agreed_ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_id": {
+          "name": "writer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "writer_epoch": {
+          "name": "writer_epoch",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "indexer_status_profile_id_network_profiles_profile_id_fk": {
+          "name": "indexer_status_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "indexer_status",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "indexer_status_state": {
+          "name": "indexer_status_state",
+          "value": "\"indexer_status\".\"state\" IN ('starting', 'catching_up', 'ready', 'halted')"
+        },
+        "indexer_status_primary_tip": {
+          "name": "indexer_status_primary_tip",
+          "value": "\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"primary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_secondary_tip": {
+          "name": "indexer_status_secondary_tip",
+          "value": "\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"secondary_source_tip\" BETWEEN 0 AND 4294967295"
+        },
+        "indexer_status_agreed_ledger": {
+          "name": "indexer_status_agreed_ledger",
+          "value": "(\"indexer_status\".\"last_agreed_ledger_index\" IS NULL AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NULL)\n          OR (\"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" BETWEEN 0 AND 4294967295\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" ~ '^[0-9a-f]{64}$')"
+        },
+        "indexer_status_agreed_not_ahead": {
+          "name": "indexer_status_agreed_not_ahead",
+          "value": "\"indexer_status\".\"state\" = 'halted'\n          OR \"indexer_status\".\"last_agreed_ledger_index\" IS NULL\n          OR ((\"indexer_status\".\"primary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"primary_source_tip\")\n          AND (\"indexer_status\".\"secondary_source_tip\" IS NULL OR \"indexer_status\".\"last_agreed_ledger_index\" <= \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_ready_shape": {
+          "name": "indexer_status_ready_shape",
+          "value": "\"indexer_status\".\"state\" <> 'ready'\n          OR (\"indexer_status\".\"primary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"secondary_source_tip\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_hash\" IS NOT NULL\n          AND \"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"last_agreed_ledger_index\" = LEAST(\"indexer_status\".\"primary_source_tip\", \"indexer_status\".\"secondary_source_tip\"))"
+        },
+        "indexer_status_error_code": {
+          "name": "indexer_status_error_code",
+          "value": "\"indexer_status\".\"error_code\" IS NULL OR \"indexer_status\".\"error_code\" ~ '^[A-Z][A-Z0-9_]{0,63}$'"
+        },
+        "indexer_status_error_shape": {
+          "name": "indexer_status_error_shape",
+          "value": "(\"indexer_status\".\"state\" = 'halted' AND \"indexer_status\".\"error_code\" IS NOT NULL)\n          OR (\"indexer_status\".\"state\" <> 'halted' AND \"indexer_status\".\"error_code\" IS NULL)"
+        },
+        "indexer_status_writer_id": {
+          "name": "indexer_status_writer_id",
+          "value": "\"indexer_status\".\"writer_id\" IS NULL OR \"indexer_status\".\"writer_id\" ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'"
+        },
+        "indexer_status_writer_epoch": {
+          "name": "indexer_status_writer_epoch",
+          "value": "\"indexer_status\".\"writer_epoch\" BETWEEN 1 AND 9007199254740991"
+        },
+        "indexer_status_lease_window": {
+          "name": "indexer_status_lease_window",
+          "value": "(\"indexer_status\".\"writer_id\" IS NULL AND \"indexer_status\".\"lease_expires_at\" IS NULL)\n          OR (\"indexer_status\".\"writer_id\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" IS NOT NULL\n          AND \"indexer_status\".\"lease_expires_at\" >= \"indexer_status\".\"updated_at\"\n          AND \"indexer_status\".\"lease_expires_at\" <= \"indexer_status\".\"updated_at\" + interval '5 minutes')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schema_events": {
+      "name": "schema_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memo_json": {
+          "name": "memo_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schema_events_ledger_idx": {
+          "name": "schema_events_ledger_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_activity_idx": {
+          "name": "schema_events_activity_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schema_events_publisher_idx": {
+          "name": "schema_events_publisher_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schema_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "schema_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schema_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schema_events_pk": {
+          "name": "schema_events_pk",
+          "columns": ["profile_id", "transaction_hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schema_events_tx_hash": {
+          "name": "schema_events_tx_hash",
+          "value": "\"schema_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_hash": {
+          "name": "schema_events_ledger_hash",
+          "value": "\"schema_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schema_events_ledger_index_uint32": {
+          "name": "schema_events_ledger_index_uint32",
+          "value": "\"schema_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schema_events_tx_index": {
+          "name": "schema_events_tx_index",
+          "value": "\"schema_events\".\"transaction_index\" >= 0"
+        },
+        "schema_events_status": {
+          "name": "schema_events_status",
+          "value": "\"schema_events\".\"status\" IN ('accepted', 'rejected')"
+        },
+        "schema_events_result_shape": {
+          "name": "schema_events_result_shape",
+          "value": "(\"schema_events\".\"status\" = 'accepted' AND \"schema_events\".\"schema_uid\" IS NOT NULL AND \"schema_events\".\"reason_code\" IS NULL AND \"schema_events\".\"memo_json\" IS NOT NULL)\n          OR (\"schema_events\".\"status\" = 'rejected' AND \"schema_events\".\"schema_uid\" IS NULL AND \"schema_events\".\"reason_code\" IS NOT NULL)"
+        },
+        "schema_events_schema_uid": {
+          "name": "schema_events_schema_uid",
+          "value": "\"schema_events\".\"schema_uid\" IS NULL OR \"schema_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.schemas": {
+      "name": "schemas",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_uid": {
+          "name": "parent_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "supersedes_uid": {
+          "name": "supersedes_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "definition": {
+          "name": "definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_definition": {
+          "name": "resolved_definition",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "registered_at": {
+          "name": "registered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "schemas_registration_tx_uq": {
+          "name": "schemas_registration_tx_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_transaction_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_publisher_order_idx": {
+          "name": "schemas_publisher_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_order_idx": {
+          "name": "schemas_order_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "schemas_search_idx": {
+          "name": "schemas_search_idx",
+          "columns": [
+            {
+              "expression": "to_tsvector('simple', \"name\" || ' ' || \"description\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "schemas_profile_id_network_profiles_profile_id_fk": {
+          "name": "schemas_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "schemas",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "schemas_registration_event_fk": {
+          "name": "schemas_registration_event_fk",
+          "tableFrom": "schemas",
+          "tableTo": "schema_events",
+          "columnsFrom": ["profile_id", "registration_transaction_hash"],
+          "columnsTo": ["profile_id", "transaction_hash"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "schemas_pk": {
+          "name": "schemas_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "schemas_uid": {
+          "name": "schemas_uid",
+          "value": "\"schemas\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_parent_uid": {
+          "name": "schemas_parent_uid",
+          "value": "\"schemas\".\"parent_uid\" IS NULL OR \"schemas\".\"parent_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_supersedes_uid": {
+          "name": "schemas_supersedes_uid",
+          "value": "\"schemas\".\"supersedes_uid\" IS NULL OR \"schemas\".\"supersedes_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_registration_tx_hash": {
+          "name": "schemas_registration_tx_hash",
+          "value": "\"schemas\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "schemas_ledger_index_uint32": {
+          "name": "schemas_ledger_index_uint32",
+          "value": "\"schemas\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "schemas_transaction_index": {
+          "name": "schemas_transaction_index",
+          "value": "\"schemas\".\"transaction_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_events": {
+      "name": "credential_events",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "node_index": {
+          "name": "node_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_index": {
+          "name": "ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_hash": {
+          "name": "ledger_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "transaction_index": {
+          "name": "transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_events_generation_idx": {
+          "name": "credential_events_generation_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "transaction_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "node_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_events_exact_idx": {
+          "name": "credential_events_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_events_profile_id_network_profiles_profile_id_fk": {
+          "name": "credential_events_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_schema_fk": {
+          "name": "credential_events_schema_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_events_generation_fk": {
+          "name": "credential_events_generation_fk",
+          "tableFrom": "credential_events",
+          "tableTo": "credential_generations",
+          "columnsFrom": ["profile_id", "generation_id"],
+          "columnsTo": ["profile_id", "generation_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_events_pk": {
+          "name": "credential_events_pk",
+          "columns": ["profile_id", "transaction_hash", "node_index"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_events_tx_hash": {
+          "name": "credential_events_tx_hash",
+          "value": "\"credential_events\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_object": {
+          "name": "credential_events_object",
+          "value": "\"credential_events\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_ledger_hash": {
+          "name": "credential_events_ledger_hash",
+          "value": "\"credential_events\".\"ledger_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_schema": {
+          "name": "credential_events_schema",
+          "value": "\"credential_events\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_events_node_index": {
+          "name": "credential_events_node_index",
+          "value": "\"credential_events\".\"node_index\" >= 0"
+        },
+        "credential_events_ledger_index_uint32": {
+          "name": "credential_events_ledger_index_uint32",
+          "value": "\"credential_events\".\"ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_transaction_index": {
+          "name": "credential_events_transaction_index",
+          "value": "\"credential_events\".\"transaction_index\" >= 0"
+        },
+        "credential_events_expiration_uint32": {
+          "name": "credential_events_expiration_uint32",
+          "value": "\"credential_events\".\"expiration\" IS NULL OR \"credential_events\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_events_type": {
+          "name": "credential_events_type",
+          "value": "\"credential_events\".\"event_type\" IN ('created', 'accepted', 'deleted')"
+        },
+        "credential_events_delete_shape": {
+          "name": "credential_events_delete_shape",
+          "value": "(\"credential_events\".\"event_type\" = 'deleted' AND \"credential_events\".\"deletion_cause\" IS NOT NULL)\n          OR (\"credential_events\".\"event_type\" <> 'deleted' AND \"credential_events\".\"deletion_cause\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_generations": {
+      "name": "credential_generations",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ledger_object_id": {
+          "name": "ledger_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uri_hex": {
+          "name": "uri_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiration": {
+          "name": "expiration",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted": {
+          "name": "accepted",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_ledger_index": {
+          "name": "created_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_transaction_index": {
+          "name": "created_transaction_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_ledger_index": {
+          "name": "last_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_ledger_index": {
+          "name": "deleted_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deletion_cause": {
+          "name": "deletion_cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_generations_live_uq": {
+          "name": "credential_generations_live_uq",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"credential_generations\".\"deleted_ledger_index\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_exact_idx": {
+          "name": "credential_generations_exact_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "schema_uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_generations_stats_idx": {
+          "name": "credential_generations_stats_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_ledger_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expiration",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_generations_profile_fk": {
+          "name": "credential_generations_profile_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "credential_generations_schema_fk": {
+          "name": "credential_generations_schema_fk",
+          "tableFrom": "credential_generations",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "credential_generations_pk": {
+          "name": "credential_generations_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_generations_id": {
+          "name": "credential_generations_id",
+          "value": "\"credential_generations\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_object": {
+          "name": "credential_generations_object",
+          "value": "\"credential_generations\".\"ledger_object_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_schema": {
+          "name": "credential_generations_schema",
+          "value": "\"credential_generations\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "credential_generations_expiration_uint32": {
+          "name": "credential_generations_expiration_uint32",
+          "value": "\"credential_generations\".\"expiration\" IS NULL OR \"credential_generations\".\"expiration\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_ledger_uint32": {
+          "name": "credential_generations_created_ledger_uint32",
+          "value": "\"credential_generations\".\"created_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_created_transaction_index": {
+          "name": "credential_generations_created_transaction_index",
+          "value": "\"credential_generations\".\"created_transaction_index\" >= 0"
+        },
+        "credential_generations_last_ledger_uint32": {
+          "name": "credential_generations_last_ledger_uint32",
+          "value": "\"credential_generations\".\"last_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_deleted_ledger_uint32": {
+          "name": "credential_generations_deleted_ledger_uint32",
+          "value": "\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" BETWEEN 0 AND 4294967295"
+        },
+        "credential_generations_ledger_order": {
+          "name": "credential_generations_ledger_order",
+          "value": "\"credential_generations\".\"last_ledger_index\" >= \"credential_generations\".\"created_ledger_index\"\n          AND (\"credential_generations\".\"deleted_ledger_index\" IS NULL OR \"credential_generations\".\"deleted_ledger_index\" = \"credential_generations\".\"last_ledger_index\")"
+        },
+        "credential_generations_deletion": {
+          "name": "credential_generations_deletion",
+          "value": "(\"credential_generations\".\"deleted_ledger_index\" IS NULL AND \"credential_generations\".\"deletion_cause\" IS NULL)\n          OR (\"credential_generations\".\"deleted_ledger_index\" IS NOT NULL AND \"credential_generations\".\"deletion_cause\" IS NOT NULL)"
+        },
+        "credential_generations_deletion_cause": {
+          "name": "credential_generations_deletion_cause",
+          "value": "\"credential_generations\".\"deletion_cause\" IS NULL OR \"credential_generations\".\"deletion_cause\" IN ('issuer_revoked', 'subject_rejected', 'subject_removed', 'expired_cleanup', 'account_deleted', 'self_deleted')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.demo_pins": {
+      "name": "demo_pins",
+      "schema": "",
+      "columns": {
+        "pin_id": {
+          "name": "pin_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cid": {
+          "name": "cid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "unpinned_at": {
+          "name": "unpinned_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "demo_pins_wallet_quota_idx": {
+          "name": "demo_pins_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_ip_quota_idx": {
+          "name": "demo_pins_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_expiry_idx": {
+          "name": "demo_pins_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "demo_pins_cid_active_idx": {
+          "name": "demo_pins_cid_active_idx",
+          "columns": [
+            {
+              "expression": "cid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "demo_pins_challenge_id_pin_challenges_challenge_id_fk": {
+          "name": "demo_pins_challenge_id_pin_challenges_challenge_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "pin_challenges",
+          "columnsFrom": ["challenge_id"],
+          "columnsTo": ["challenge_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "demo_pins_profile_id_network_profiles_profile_id_fk": {
+          "name": "demo_pins_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "demo_pins",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "demo_pins_challenge_id_unique": {
+          "name": "demo_pins_challenge_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["challenge_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "demo_pins_id": {
+          "name": "demo_pins_id",
+          "value": "\"demo_pins\".\"pin_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_ip_hash": {
+          "name": "demo_pins_ip_hash",
+          "value": "\"demo_pins\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "demo_pins_wallet": {
+          "name": "demo_pins_wallet",
+          "value": "\"demo_pins\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "demo_pins_cid": {
+          "name": "demo_pins_cid",
+          "value": "\"demo_pins\".\"cid\" ~ '^b[a-z2-7]+$'"
+        },
+        "demo_pins_byte_length": {
+          "name": "demo_pins_byte_length",
+          "value": "\"demo_pins\".\"byte_length\" BETWEEN 1 AND 65536"
+        },
+        "demo_pins_status": {
+          "name": "demo_pins_status",
+          "value": "\"demo_pins\".\"status\" IN ('pending', 'pinned', 'failed', 'unpinned')"
+        },
+        "demo_pins_failure_shape": {
+          "name": "demo_pins_failure_shape",
+          "value": "(\"demo_pins\".\"status\" = 'failed' AND \"demo_pins\".\"failure_code\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'failed' AND \"demo_pins\".\"failure_code\" IS NULL)"
+        },
+        "demo_pins_unpinned_shape": {
+          "name": "demo_pins_unpinned_shape",
+          "value": "(\"demo_pins\".\"status\" = 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NOT NULL)\n          OR (\"demo_pins\".\"status\" <> 'unpinned' AND \"demo_pins\".\"unpinned_at\" IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pin_challenges": {
+      "name": "pin_challenges",
+      "schema": "",
+      "columns": {
+        "challenge_id": {
+          "name": "challenge_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wallet": {
+          "name": "wallet",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pin_challenges_wallet_created_idx": {
+          "name": "pin_challenges_wallet_created_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "wallet",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_ip_created_idx": {
+          "name": "pin_challenges_ip_created_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pin_challenges_expiry_idx": {
+          "name": "pin_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pin_challenges_profile_id_network_profiles_profile_id_fk": {
+          "name": "pin_challenges_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "pin_challenges",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pin_challenges_id": {
+          "name": "pin_challenges_id",
+          "value": "\"pin_challenges\".\"challenge_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_ip_hash": {
+          "name": "pin_challenges_ip_hash",
+          "value": "\"pin_challenges\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "pin_challenges_wallet": {
+          "name": "pin_challenges_wallet",
+          "value": "\"pin_challenges\".\"wallet\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "pin_challenges_expiry": {
+          "name": "pin_challenges_expiry",
+          "value": "\"pin_challenges\".\"expires_at\" > \"pin_challenges\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payload_publications": {
+      "name": "hosted_payload_publications",
+      "schema": "",
+      "columns": {
+        "transaction_hash": {
+          "name": "transaction_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requester_ip_hash": {
+          "name": "requester_ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hosted_payload_publications_wallet_quota_idx": {
+          "name": "hosted_payload_publications_wallet_quota_idx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_ip_quota_idx": {
+          "name": "hosted_payload_publications_ip_quota_idx",
+          "columns": [
+            {
+              "expression": "requester_ip_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "hosted_payload_publications_locator_idx": {
+          "name": "hosted_payload_publications_locator_idx",
+          "columns": [
+            {
+              "expression": "locator",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hosted_payload_publications_locator_hosted_payloads_locator_fk": {
+          "name": "hosted_payload_publications_locator_hosted_payloads_locator_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "hosted_payloads",
+          "columnsFrom": ["locator"],
+          "columnsTo": ["locator"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_profile_id_network_profiles_profile_id_fk": {
+          "name": "hosted_payload_publications_profile_id_network_profiles_profile_id_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "network_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["profile_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "hosted_payload_publications_schema_fk": {
+          "name": "hosted_payload_publications_schema_fk",
+          "tableFrom": "hosted_payload_publications",
+          "tableTo": "schemas",
+          "columnsFrom": ["profile_id", "schema_uid"],
+          "columnsTo": ["profile_id", "schema_uid"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payload_publications_tx_hash": {
+          "name": "hosted_payload_publications_tx_hash",
+          "value": "\"hosted_payload_publications\".\"transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_issuer": {
+          "name": "hosted_payload_publications_issuer",
+          "value": "\"hosted_payload_publications\".\"issuer\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_subject": {
+          "name": "hosted_payload_publications_subject",
+          "value": "\"hosted_payload_publications\".\"subject\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "hosted_payload_publications_schema": {
+          "name": "hosted_payload_publications_schema",
+          "value": "\"hosted_payload_publications\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payload_publications_ip_hash": {
+          "name": "hosted_payload_publications_ip_hash",
+          "value": "\"hosted_payload_publications\".\"requester_ip_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.hosted_payloads": {
+      "name": "hosted_payloads",
+      "schema": "",
+      "columns": {
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "digest_hex": {
+          "name": "digest_hex",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "hosted_payloads_locator": {
+          "name": "hosted_payloads_locator",
+          "value": "\"hosted_payloads\".\"locator\" ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'"
+        },
+        "hosted_payloads_digest": {
+          "name": "hosted_payloads_digest",
+          "value": "\"hosted_payloads\".\"digest_hex\" ~ '^[0-9a-f]{64}$'"
+        },
+        "hosted_payloads_size": {
+          "name": "hosted_payloads_size",
+          "value": "octet_length(\"hosted_payloads\".\"content\") BETWEEN 1 AND 65536"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_user_roles": {
+      "name": "app_user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recipient'"
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_at": {
+          "name": "granted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_user_roles_user_id_app_users_id_fk": {
+          "name": "app_user_roles_user_id_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_user_roles_granted_by_app_users_id_fk": {
+          "name": "app_user_roles_granted_by_app_users_id_fk",
+          "tableFrom": "app_user_roles",
+          "tableTo": "app_users",
+          "columnsFrom": ["granted_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_user_roles_user_id_role_pk": {
+          "name": "app_user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_user_roles_role": {
+          "name": "app_user_roles_role",
+          "value": "\"app_user_roles\".\"role\" IN ('admin', 'recipient')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_users": {
+      "name": "app_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "identity_issuer": {
+          "name": "identity_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identity_subject": {
+          "name": "identity_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_users_identity_uq": {
+          "name": "app_users_identity_uq",
+          "columns": [
+            {
+              "expression": "identity_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "identity_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_users_status": {
+          "name": "app_users_status",
+          "value": "\"app_users\".\"status\" IN ('active', 'suspended', 'deleted')"
+        },
+        "app_users_identity": {
+          "name": "app_users_identity",
+          "value": "(\"app_users\".\"status\" <> 'deleted' AND length(\"app_users\".\"identity_issuer\") > 0 AND \"app_users\".\"identity_issuer\" IS NOT NULL AND length(\"app_users\".\"identity_subject\") > 0 AND \"app_users\".\"identity_subject\" IS NOT NULL AND \"app_users\".\"deleted_at\" IS NULL) OR (\"app_users\".\"status\" = 'deleted' AND \"app_users\".\"identity_issuer\" IS NULL AND \"app_users\".\"identity_subject\" IS NULL AND \"app_users\".\"email\" IS NULL AND \"app_users\".\"email_verified_at\" IS NULL AND \"app_users\".\"display_name\" IS NULL AND \"app_users\".\"deleted_at\" IS NOT NULL)"
+        },
+        "app_users_verified_email": {
+          "name": "app_users_verified_email",
+          "value": "\"app_users\".\"email_verified_at\" IS NULL OR \"app_users\".\"email\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallets": {
+      "name": "app_wallets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_wallets_network_address_uq": {
+          "name": "app_wallets_network_address_uq",
+          "columns": [
+            {
+              "expression": "network_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "address",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallets_user_idx": {
+          "name": "app_wallets_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallets_user_id_app_users_id_fk": {
+          "name": "app_wallets_user_id_app_users_id_fk",
+          "tableFrom": "app_wallets",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallets_network": {
+          "name": "app_wallets_network",
+          "value": "\"app_wallets\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallets_address": {
+          "name": "app_wallets_address",
+          "value": "\"app_wallets\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallets_revocation": {
+          "name": "app_wallets_revocation",
+          "value": "\"app_wallets\".\"revoked_at\" IS NULL OR \"app_wallets\".\"revoked_at\" >= \"app_wallets\".\"verified_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_documents": {
+      "name": "app_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_role": {
+          "name": "application_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_length": {
+          "name": "byte_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_status": {
+          "name": "review_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_documents_application_idx": {
+          "name": "app_documents_application_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_documents_uploaded_by_app_users_id_fk": {
+          "name": "app_documents_uploaded_by_app_users_id_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_documents_application_fk": {
+          "name": "app_documents_application_fk",
+          "tableFrom": "app_documents",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "application_role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_documents_storage_key_unique": {
+          "name": "app_documents_storage_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["storage_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_documents_size": {
+          "name": "app_documents_size",
+          "value": "\"app_documents\".\"byte_length\" > 0"
+        },
+        "app_documents_digest": {
+          "name": "app_documents_digest",
+          "value": "\"app_documents\".\"sha256\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_documents_storage_key": {
+          "name": "app_documents_storage_key",
+          "value": "length(btrim(\"app_documents\".\"storage_key\")) > 0"
+        },
+        "app_documents_review": {
+          "name": "app_documents_review",
+          "value": "\"app_documents\".\"review_status\" IN ('pending', 'approved', 'rejected')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organization_applications": {
+      "name": "app_organization_applications",
+      "schema": "",
+      "columns": {
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "website": {
+          "name": "website",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contact": {
+          "name": "contact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "jurisdiction": {
+          "name": "jurisdiction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "purpose": {
+          "name": "purpose",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "submitted_at": {
+          "name": "submitted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_by": {
+          "name": "reviewed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "review_reason": {
+          "name": "review_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_organization_applications_queue_idx": {
+          "name": "app_organization_applications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "submitted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organization_applications_organization_id_app_organizations_id_fk": {
+          "name": "app_organization_applications_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_organization_applications_reviewed_by_app_users_id_fk": {
+          "name": "app_organization_applications_reviewed_by_app_users_id_fk",
+          "tableFrom": "app_organization_applications",
+          "tableTo": "app_users",
+          "columnsFrom": ["reviewed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_organization_applications_organization_id_role_pk": {
+          "name": "app_organization_applications_organization_id_role_pk",
+          "columns": ["organization_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organization_applications_revision": {
+          "name": "app_organization_applications_revision",
+          "value": "\"app_organization_applications\".\"revision\" >= 0"
+        },
+        "app_organization_applications_role": {
+          "name": "app_organization_applications_role",
+          "value": "\"app_organization_applications\".\"role\" IN ('issuer', 'verifier')"
+        },
+        "app_organization_applications_status": {
+          "name": "app_organization_applications_status",
+          "value": "\"app_organization_applications\".\"status\" IN ('pending', 'approved', 'rejected', 'suspended')"
+        },
+        "app_organization_applications_review": {
+          "name": "app_organization_applications_review",
+          "value": "(\"app_organization_applications\".\"status\" = 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NULL AND \"app_organization_applications\".\"reviewed_at\" IS NULL AND \"app_organization_applications\".\"review_reason\" IS NULL) OR (\"app_organization_applications\".\"status\" <> 'pending' AND \"app_organization_applications\".\"reviewed_by\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" IS NOT NULL AND \"app_organization_applications\".\"reviewed_at\" >= \"app_organization_applications\".\"submitted_at\")"
+        },
+        "app_organization_applications_reason": {
+          "name": "app_organization_applications_reason",
+          "value": "\"app_organization_applications\".\"status\" NOT IN ('rejected', 'suspended') OR (\"app_organization_applications\".\"review_reason\" IS NOT NULL AND length(btrim(\"app_organization_applications\".\"review_reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_organizations": {
+      "name": "app_organizations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_organizations_responsible_idx": {
+          "name": "app_organizations_responsible_idx",
+          "columns": [
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_organizations_responsible_user_id_app_users_id_fk": {
+          "name": "app_organizations_responsible_user_id_app_users_id_fk",
+          "tableFrom": "app_organizations",
+          "tableTo": "app_users",
+          "columnsFrom": ["responsible_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_organizations_name": {
+          "name": "app_organizations_name",
+          "value": "length(btrim(\"app_organizations\".\"name\")) > 0"
+        },
+        "app_organizations_status": {
+          "name": "app_organizations_status",
+          "value": "\"app_organizations\".\"status\" IN ('active', 'suspended', 'closed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_credential_metadata": {
+      "name": "app_credential_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_organization_id": {
+          "name": "issuer_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issuer_address": {
+          "name": "issuer_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "payload_storage_key": {
+          "name": "payload_storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_transaction_hash": {
+          "name": "creation_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "creation_ledger_index": {
+          "name": "creation_ledger_index",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_credential_metadata_recipient_idx": {
+          "name": "app_credential_metadata_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_credential_metadata_issuer_idx": {
+          "name": "app_credential_metadata_issuer_idx",
+          "columns": [
+            {
+              "expression": "issuer_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_credential_metadata_recipient_user_id_app_users_id_fk": {
+          "name": "app_credential_metadata_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_schema_owner_fk": {
+          "name": "app_credential_metadata_schema_owner_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "issuer_organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_credential_metadata_invite_claim_fk": {
+          "name": "app_credential_metadata_invite_claim_fk",
+          "tableFrom": "app_credential_metadata",
+          "tableTo": "app_invites",
+          "columnsFrom": [
+            "invite_id",
+            "issuer_organization_id",
+            "profile_id",
+            "schema_uid",
+            "recipient_user_id"
+          ],
+          "columnsTo": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_credential_metadata_profile_id_generation_id_pk": {
+          "name": "app_credential_metadata_profile_id_generation_id_pk",
+          "columns": ["profile_id", "generation_id"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_credential_metadata_invite_id_unique": {
+          "name": "app_credential_metadata_invite_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["invite_id"]
+        },
+        "app_credential_metadata_recipient_uq": {
+          "name": "app_credential_metadata_recipient_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "generation_id", "recipient_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_credential_metadata_generation": {
+          "name": "app_credential_metadata_generation",
+          "value": "\"app_credential_metadata\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_addresses": {
+          "name": "app_credential_metadata_addresses",
+          "value": "\"app_credential_metadata\".\"issuer_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$' AND \"app_credential_metadata\".\"subject_address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_credential_metadata_visibility": {
+          "name": "app_credential_metadata_visibility",
+          "value": "\"app_credential_metadata\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_credential_metadata_fields": {
+          "name": "app_credential_metadata_fields",
+          "value": "jsonb_typeof(\"app_credential_metadata\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_credential_metadata\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        },
+        "app_credential_metadata_digest": {
+          "name": "app_credential_metadata_digest",
+          "value": "\"app_credential_metadata\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_transaction": {
+          "name": "app_credential_metadata_transaction",
+          "value": "\"app_credential_metadata\".\"creation_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_credential_metadata_ledger": {
+          "name": "app_credential_metadata_ledger",
+          "value": "\"app_credential_metadata\".\"creation_ledger_index\" BETWEEN 1 AND 4294967295"
+        },
+        "app_credential_metadata_storage": {
+          "name": "app_credential_metadata_storage",
+          "value": "\"app_credential_metadata\".\"payload_storage_key\" IS NULL OR length(btrim(\"app_credential_metadata\".\"payload_storage_key\")) > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invites": {
+      "name": "app_invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_email": {
+          "name": "delivery_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_invites_organization_idx": {
+          "name": "app_invites_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invites_claimant_idx": {
+          "name": "app_invites_claimant_idx",
+          "columns": [
+            {
+              "expression": "claimed_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invites_created_by_app_users_id_fk": {
+          "name": "app_invites_created_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_claimed_by_app_users_id_fk": {
+          "name": "app_invites_claimed_by_app_users_id_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_users",
+          "columnsFrom": ["claimed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_invites_schema_owner_fk": {
+          "name": "app_invites_schema_owner_fk",
+          "tableFrom": "app_invites",
+          "tableTo": "app_schema_metadata",
+          "columnsFrom": ["profile_id", "schema_uid", "organization_id"],
+          "columnsTo": ["profile_id", "schema_uid", "organization_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_invites_token_hash_unique": {
+          "name": "app_invites_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        },
+        "app_invites_claim_identity_uq": {
+          "name": "app_invites_claim_identity_uq",
+          "nullsNotDistinct": false,
+          "columns": ["id", "organization_id", "profile_id", "schema_uid", "claimed_by"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_invites_token": {
+          "name": "app_invites_token",
+          "value": "\"app_invites\".\"token_hash\" IS NULL OR \"app_invites\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_invites_unclaimed_token": {
+          "name": "app_invites_unclaimed_token",
+          "value": "\"app_invites\".\"claimed_at\" IS NOT NULL OR \"app_invites\".\"revoked_at\" IS NOT NULL OR \"app_invites\".\"token_hash\" IS NOT NULL"
+        },
+        "app_invites_expiry": {
+          "name": "app_invites_expiry",
+          "value": "\"app_invites\".\"expires_at\" > \"app_invites\".\"created_at\""
+        },
+        "app_invites_claim": {
+          "name": "app_invites_claim",
+          "value": "(\"app_invites\".\"claimed_by\" IS NULL AND \"app_invites\".\"claimed_at\" IS NULL) OR (\"app_invites\".\"claimed_by\" IS NOT NULL AND \"app_invites\".\"claimed_at\" IS NOT NULL AND \"app_invites\".\"claimed_at\" >= \"app_invites\".\"created_at\" AND \"app_invites\".\"claimed_at\" < \"app_invites\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_schema_metadata": {
+      "name": "app_schema_metadata",
+      "schema": "",
+      "columns": {
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_uid": {
+          "name": "schema_uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_transaction_hash": {
+          "name": "registration_transaction_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_schema_metadata_organization_idx": {
+          "name": "app_schema_metadata_organization_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_schema_metadata_organization_id_app_organizations_id_fk": {
+          "name": "app_schema_metadata_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_schema_metadata",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "app_schema_metadata_profile_id_schema_uid_pk": {
+          "name": "app_schema_metadata_profile_id_schema_uid_pk",
+          "columns": ["profile_id", "schema_uid"]
+        }
+      },
+      "uniqueConstraints": {
+        "app_schema_metadata_owner_uq": {
+          "name": "app_schema_metadata_owner_uq",
+          "nullsNotDistinct": false,
+          "columns": ["profile_id", "schema_uid", "organization_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_schema_metadata_profile": {
+          "name": "app_schema_metadata_profile",
+          "value": "length(\"app_schema_metadata\".\"profile_id\") > 0"
+        },
+        "app_schema_metadata_uid": {
+          "name": "app_schema_metadata_uid",
+          "value": "\"app_schema_metadata\".\"schema_uid\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_schema_metadata_transaction": {
+          "name": "app_schema_metadata_transaction",
+          "value": "\"app_schema_metadata\".\"registration_transaction_hash\" ~ '^[0-9a-f]{64}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentation_challenges": {
+      "name": "app_presentation_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation_id": {
+          "name": "presentation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request": {
+          "name": "request",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_presentation_challenges_session_idx": {
+          "name": "app_presentation_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentation_challenges_expiry_idx": {
+          "name": "app_presentation_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentation_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_presentation_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_presentation_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentation_challenges_presentation_id_unique": {
+          "name": "app_presentation_challenges_presentation_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["presentation_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentation_challenges_request": {
+          "name": "app_presentation_challenges_request",
+          "value": "jsonb_typeof(\"app_presentation_challenges\".\"request\") = 'object'"
+        },
+        "app_presentation_challenges_message": {
+          "name": "app_presentation_challenges_message",
+          "value": "octet_length(\"app_presentation_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_presentation_challenges_dates": {
+          "name": "app_presentation_challenges_dates",
+          "value": "\"app_presentation_challenges\".\"expires_at\" > \"app_presentation_challenges\".\"created_at\" AND \"app_presentation_challenges\".\"expires_at\" <= \"app_presentation_challenges\".\"created_at\" + interval '5 minutes' AND isfinite(\"app_presentation_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentation_proofs": {
+      "name": "app_presentation_proofs",
+      "schema": "",
+      "columns": {
+        "presentation_id": {
+          "name": "presentation_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "request": {
+          "name": "request",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signature": {
+          "name": "signature",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_key": {
+          "name": "public_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scheme": {
+          "name": "scheme",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_presentation_proofs_presentation_id_app_presentations_id_fk": {
+          "name": "app_presentation_proofs_presentation_id_app_presentations_id_fk",
+          "tableFrom": "app_presentation_proofs",
+          "tableTo": "app_presentations",
+          "columnsFrom": ["presentation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_presentation_proofs_request": {
+          "name": "app_presentation_proofs_request",
+          "value": "jsonb_typeof(\"app_presentation_proofs\".\"request\") = 'object'"
+        },
+        "app_presentation_proofs_message": {
+          "name": "app_presentation_proofs_message",
+          "value": "octet_length(\"app_presentation_proofs\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_presentation_proofs_signature": {
+          "name": "app_presentation_proofs_signature",
+          "value": "\"app_presentation_proofs\".\"signature\" ~ '^[0-9A-Fa-f]{128,144}$'"
+        },
+        "app_presentation_proofs_key": {
+          "name": "app_presentation_proofs_key",
+          "value": "\"app_presentation_proofs\".\"public_key\" ~ '^(02|03|ED|ed)[0-9A-Fa-f]{64}$'"
+        },
+        "app_presentation_proofs_scheme": {
+          "name": "app_presentation_proofs_scheme",
+          "value": "\"app_presentation_proofs\".\"scheme\" IN ('ripple', 'otsu')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_presentations": {
+      "name": "app_presentations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "app_presentations_recipient_idx": {
+          "name": "app_presentations_recipient_idx",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_presentations_verifier_idx": {
+          "name": "app_presentations_verifier_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_presentations_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_presentations_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_presentations_recipient_fk": {
+          "name": "app_presentations_recipient_fk",
+          "tableFrom": "app_presentations",
+          "tableTo": "app_credential_metadata",
+          "columnsFrom": ["profile_id", "generation_id", "recipient_user_id"],
+          "columnsTo": ["profile_id", "generation_id", "recipient_user_id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_presentations_token_hash_unique": {
+          "name": "app_presentations_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_presentations_scope": {
+          "name": "app_presentations_scope",
+          "value": "\"app_presentations\".\"scope\" IN ('public', 'full')"
+        },
+        "app_presentations_audience": {
+          "name": "app_presentations_audience",
+          "value": "\"app_presentations\".\"scope\" <> 'full' OR \"app_presentations\".\"verifier_organization_id\" IS NOT NULL"
+        },
+        "app_presentations_token": {
+          "name": "app_presentations_token",
+          "value": "\"app_presentations\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_presentations_revocation": {
+          "name": "app_presentations_revocation",
+          "value": "\"app_presentations\".\"revoked_at\" IS NULL OR \"app_presentations\".\"revoked_at\" >= \"app_presentations\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_verifier_history": {
+      "name": "app_verifier_history",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "verifier_organization_id": {
+          "name": "verifier_organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "verifier_user_id": {
+          "name": "verifier_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation_id": {
+          "name": "presentation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_id": {
+          "name": "generation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "on_chain": {
+          "name": "on_chain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_status": {
+          "name": "schema_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_status": {
+          "name": "payload_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issuer_trust": {
+          "name": "issuer_trust",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checked_at": {
+          "name": "checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_verifier_history_user_idx": {
+          "name": "app_verifier_history_user_idx",
+          "columns": [
+            {
+              "expression": "verifier_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "checked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_verifier_history_organization_idx": {
+          "name": "app_verifier_history_organization_idx",
+          "columns": [
+            {
+              "expression": "verifier_organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "checked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_verifier_history_verifier_organization_id_app_organizations_id_fk": {
+          "name": "app_verifier_history_verifier_organization_id_app_organizations_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_organizations",
+          "columnsFrom": ["verifier_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_verifier_history_verifier_user_id_app_users_id_fk": {
+          "name": "app_verifier_history_verifier_user_id_app_users_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_users",
+          "columnsFrom": ["verifier_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_verifier_history_presentation_id_app_presentations_id_fk": {
+          "name": "app_verifier_history_presentation_id_app_presentations_id_fk",
+          "tableFrom": "app_verifier_history",
+          "tableTo": "app_presentations",
+          "columnsFrom": ["presentation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_verifier_history_profile": {
+          "name": "app_verifier_history_profile",
+          "value": "length(\"app_verifier_history\".\"profile_id\") BETWEEN 1 AND 200"
+        },
+        "app_verifier_history_generation": {
+          "name": "app_verifier_history_generation",
+          "value": "\"app_verifier_history\".\"generation_id\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_verifier_history_scope": {
+          "name": "app_verifier_history_scope",
+          "value": "\"app_verifier_history\".\"scope\" IN ('public', 'full')"
+        },
+        "app_verifier_history_chain": {
+          "name": "app_verifier_history_chain",
+          "value": "\"app_verifier_history\".\"on_chain\" IN ('not_found', 'pending', 'active', 'expired', 'deleted')"
+        },
+        "app_verifier_history_schema": {
+          "name": "app_verifier_history_schema",
+          "value": "\"app_verifier_history\".\"schema_status\" IN ('valid', 'unknown')"
+        },
+        "app_verifier_history_payload": {
+          "name": "app_verifier_history_payload",
+          "value": "\"app_verifier_history\".\"payload_status\" IN ('valid', 'unavailable', 'tampered', 'invalid', 'not_checked')"
+        },
+        "app_verifier_history_trust": {
+          "name": "app_verifier_history_trust",
+          "value": "\"app_verifier_history\".\"issuer_trust\" IN ('trusted', 'untrusted', 'unknown')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_auth_transactions": {
+      "name": "app_auth_transactions",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "browser_hash": {
+          "name": "browser_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "nonce": {
+          "name": "nonce",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_auth_transactions_expiry_idx": {
+          "name": "app_auth_transactions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_auth_transactions_hashes": {
+          "name": "app_auth_transactions_hashes",
+          "value": "\"app_auth_transactions\".\"state_hash\" ~ '^[0-9a-f]{64}$' AND \"app_auth_transactions\".\"browser_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_auth_transactions_tokens": {
+          "name": "app_auth_transactions_tokens",
+          "value": "\"app_auth_transactions\".\"nonce\" ~ '^[A-Za-z0-9_-]{43}$' AND \"app_auth_transactions\".\"code_verifier\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_auth_transactions_return_to": {
+          "name": "app_auth_transactions_return_to",
+          "value": "length(\"app_auth_transactions\".\"return_to\") BETWEEN 1 AND 2048 AND left(\"app_auth_transactions\".\"return_to\", 1) = '/' AND left(\"app_auth_transactions\".\"return_to\", 2) <> '//' AND position(chr(92) in \"app_auth_transactions\".\"return_to\") = 0 AND \"app_auth_transactions\".\"return_to\" !~ '[[:cntrl:]]'"
+        },
+        "app_auth_transactions_dates": {
+          "name": "app_auth_transactions_dates",
+          "value": "\"app_auth_transactions\".\"expires_at\" > \"app_auth_transactions\".\"created_at\" AND isfinite(\"app_auth_transactions\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_sessions": {
+      "name": "app_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "csrf_token": {
+          "name": "csrf_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_expires_at": {
+          "name": "absolute_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_sessions_user_idx": {
+          "name": "app_sessions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_sessions_expiry_idx": {
+          "name": "app_sessions_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_sessions_user_id_app_users_id_fk": {
+          "name": "app_sessions_user_id_app_users_id_fk",
+          "tableFrom": "app_sessions",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_sessions_token_hash_unique": {
+          "name": "app_sessions_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_sessions_token": {
+          "name": "app_sessions_token",
+          "value": "\"app_sessions\".\"token_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_sessions_csrf": {
+          "name": "app_sessions_csrf",
+          "value": "\"app_sessions\".\"csrf_token\" ~ '^[A-Za-z0-9_-]{43}$'"
+        },
+        "app_sessions_dates": {
+          "name": "app_sessions_dates",
+          "value": "\"app_sessions\".\"expires_at\" > \"app_sessions\".\"created_at\" AND \"app_sessions\".\"absolute_expires_at\" >= \"app_sessions\".\"expires_at\" AND isfinite(\"app_sessions\".\"absolute_expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_wallet_challenges": {
+      "name": "app_wallet_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "network_id": {
+          "name": "network_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "app_wallet_challenges_session_idx": {
+          "name": "app_wallet_challenges_session_idx",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_wallet_challenges_expiry_idx": {
+          "name": "app_wallet_challenges_expiry_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_wallet_challenges_session_id_app_sessions_id_fk": {
+          "name": "app_wallet_challenges_session_id_app_sessions_id_fk",
+          "tableFrom": "app_wallet_challenges",
+          "tableTo": "app_sessions",
+          "columnsFrom": ["session_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_wallet_challenges_network": {
+          "name": "app_wallet_challenges_network",
+          "value": "\"app_wallet_challenges\".\"network_id\" BETWEEN 0 AND 4294967295"
+        },
+        "app_wallet_challenges_address": {
+          "name": "app_wallet_challenges_address",
+          "value": "\"app_wallet_challenges\".\"address\" ~ '^r[1-9A-HJ-NP-Za-km-z]{24,34}$'"
+        },
+        "app_wallet_challenges_message": {
+          "name": "app_wallet_challenges_message",
+          "value": "length(\"app_wallet_challenges\".\"message\") BETWEEN 1 AND 8192"
+        },
+        "app_wallet_challenges_dates": {
+          "name": "app_wallet_challenges_dates",
+          "value": "\"app_wallet_challenges\".\"expires_at\" > \"app_wallet_challenges\".\"created_at\" AND isfinite(\"app_wallet_challenges\".\"expires_at\")"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_bootstrap_audit": {
+      "name": "app_admin_bootstrap_audit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "operator": {
+          "name": "operator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "app_admin_bootstrap_audit_user_id_app_users_id_fk": {
+          "name": "app_admin_bootstrap_audit_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_bootstrap_audit",
+          "tableTo": "app_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_bootstrap_operator": {
+          "name": "app_admin_bootstrap_operator",
+          "value": "length(btrim(\"app_admin_bootstrap_audit\".\"operator\")) BETWEEN 1 AND 200"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_decisions": {
+      "name": "app_admin_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "before_status": {
+          "name": "before_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_status": {
+          "name": "after_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_decisions_idempotency_uq": {
+          "name": "app_admin_decisions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_revision_uq": {
+          "name": "app_admin_decisions_revision_uq",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_admin_decisions_history_idx": {
+          "name": "app_admin_decisions_history_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_decisions_actor_id_app_users_id_fk": {
+          "name": "app_admin_decisions_actor_id_app_users_id_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_users",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_decisions_application_fk": {
+          "name": "app_admin_decisions_application_fk",
+          "tableFrom": "app_admin_decisions",
+          "tableTo": "app_organization_applications",
+          "columnsFrom": ["organization_id", "role"],
+          "columnsTo": ["organization_id", "role"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_decisions_revision": {
+          "name": "app_admin_decisions_revision",
+          "value": "\"app_admin_decisions\".\"revision\" > 0"
+        },
+        "app_admin_decisions_hash": {
+          "name": "app_admin_decisions_hash",
+          "value": "\"app_admin_decisions\".\"request_hash\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_admin_decisions_transition": {
+          "name": "app_admin_decisions_transition",
+          "value": "(\"app_admin_decisions\".\"action\" = 'approve' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'approved') OR (\"app_admin_decisions\".\"action\" = 'reject' AND \"app_admin_decisions\".\"before_status\" = 'pending' AND \"app_admin_decisions\".\"after_status\" = 'rejected') OR (\"app_admin_decisions\".\"action\" = 'suspend' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'approved' AND \"app_admin_decisions\".\"after_status\" = 'suspended') OR (\"app_admin_decisions\".\"action\" = 'restore' AND \"app_admin_decisions\".\"role\" = 'verifier' AND \"app_admin_decisions\".\"before_status\" = 'suspended' AND \"app_admin_decisions\".\"after_status\" = 'approved')"
+        },
+        "app_admin_decisions_reason": {
+          "name": "app_admin_decisions_reason",
+          "value": "\"app_admin_decisions\".\"action\" NOT IN ('reject', 'suspend') OR (\"app_admin_decisions\".\"reason\" IS NOT NULL AND length(btrim(\"app_admin_decisions\".\"reason\")) > 0)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_admin_notifications": {
+      "name": "app_admin_notifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attempt_id": {
+          "name": "attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_admin_notifications_queue_idx": {
+          "name": "app_admin_notifications_queue_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_admin_notifications_decision_id_app_admin_decisions_id_fk": {
+          "name": "app_admin_notifications_decision_id_app_admin_decisions_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_admin_decisions",
+          "columnsFrom": ["decision_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_admin_notifications_recipient_user_id_app_users_id_fk": {
+          "name": "app_admin_notifications_recipient_user_id_app_users_id_fk",
+          "tableFrom": "app_admin_notifications",
+          "tableTo": "app_users",
+          "columnsFrom": ["recipient_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_admin_notifications_decision_id_unique": {
+          "name": "app_admin_notifications_decision_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["decision_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_admin_notifications_status": {
+          "name": "app_admin_notifications_status",
+          "value": "\"app_admin_notifications\".\"status\" IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')"
+        },
+        "app_admin_notifications_attempts": {
+          "name": "app_admin_notifications_attempts",
+          "value": "\"app_admin_notifications\".\"attempts\" >= 0"
+        },
+        "app_admin_notifications_sending": {
+          "name": "app_admin_notifications_sending",
+          "value": "\"app_admin_notifications\".\"status\" <> 'sending' OR (\"app_admin_notifications\".\"attempt_id\" IS NOT NULL AND \"app_admin_notifications\".\"claimed_at\" IS NOT NULL AND \"app_admin_notifications\".\"recipient_email\" IS NOT NULL)"
+        },
+        "app_admin_notifications_sent": {
+          "name": "app_admin_notifications_sent",
+          "value": "(\"app_admin_notifications\".\"status\" = 'sent') = (\"app_admin_notifications\".\"sent_at\" IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_invite_deliveries": {
+      "name": "app_invite_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_email": {
+          "name": "recipient_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_invite_deliveries_invite_idx": {
+          "name": "app_invite_deliveries_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "app_invite_deliveries_event_uq": {
+          "name": "app_invite_deliveries_event_uq",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"app_invite_deliveries\".\"kind\" <> 'invitation'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_invite_deliveries_invite_id_app_invites_id_fk": {
+          "name": "app_invite_deliveries_invite_id_app_invites_id_fk",
+          "tableFrom": "app_invite_deliveries",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "app_invite_deliveries_status": {
+          "name": "app_invite_deliveries_status",
+          "value": "\"app_invite_deliveries\".\"status\" IN ('sending', 'sent', 'failed', 'uncertain', 'cancelled')"
+        },
+        "app_invite_deliveries_kind": {
+          "name": "app_invite_deliveries_kind",
+          "value": "\"app_invite_deliveries\".\"kind\" IN ('invitation', 'issued', 'revoked')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.app_issuer_payloads": {
+      "name": "app_issuer_payloads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "locator": {
+          "name": "locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_address": {
+          "name": "subject_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_payload": {
+          "name": "canonical_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_uri": {
+          "name": "credential_uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_fields": {
+          "name": "public_fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "app_issuer_payloads_invite_idx": {
+          "name": "app_issuer_payloads_invite_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "app_issuer_payloads_invite_id_app_invites_id_fk": {
+          "name": "app_issuer_payloads_invite_id_app_invites_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_invites",
+          "columnsFrom": ["invite_id"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "app_issuer_payloads_created_by_app_users_id_fk": {
+          "name": "app_issuer_payloads_created_by_app_users_id_fk",
+          "tableFrom": "app_issuer_payloads",
+          "tableTo": "app_users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_issuer_payloads_locator_unique": {
+          "name": "app_issuer_payloads_locator_unique",
+          "nullsNotDistinct": false,
+          "columns": ["locator"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "app_issuer_payloads_locator": {
+          "name": "app_issuer_payloads_locator",
+          "value": "\"app_issuer_payloads\".\"locator\" ~ '^[0-9a-f]{18}$'"
+        },
+        "app_issuer_payloads_digest": {
+          "name": "app_issuer_payloads_digest",
+          "value": "\"app_issuer_payloads\".\"payload_digest\" ~ '^[0-9a-f]{64}$'"
+        },
+        "app_issuer_payloads_size": {
+          "name": "app_issuer_payloads_size",
+          "value": "octet_length(\"app_issuer_payloads\".\"canonical_payload\") BETWEEN 1 AND 1048576"
+        },
+        "app_issuer_payloads_visibility": {
+          "name": "app_issuer_payloads_visibility",
+          "value": "\"app_issuer_payloads\".\"visibility\" IN ('public', 'private')"
+        },
+        "app_issuer_payloads_fields": {
+          "name": "app_issuer_payloads_fields",
+          "value": "jsonb_typeof(\"app_issuer_payloads\".\"public_fields\") = 'array' AND NOT jsonb_path_exists(\"app_issuer_payloads\".\"public_fields\", '$[*] ? (@.type() != \"string\")')"
+        }
+      },
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/db/migrations/meta/_journal.json b/db/migrations/meta/_journal.json
index a0f74e0..33b2766 100644
--- a/db/migrations/meta/_journal.json
+++ b/db/migrations/meta/_journal.json
@@ -8,6 +8,62 @@
       "when": 1788476248914,
       "tag": "0000_baseline",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1788803750924,
+      "tag": "0001_hosted_payloads",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1788959680306,
+      "tag": "0002_hosted_payload_locator_compatibility",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1790192599816,
+      "tag": "0003_application_model",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1790194700162,
+      "tag": "0004_auth_sessions",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1790195791971,
+      "tag": "0005_admin_review",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1790199613077,
+      "tag": "0006_issuer_workspace",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1790254197326,
+      "tag": "0007_recipient_verifier",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1790268969419,
+      "tag": "0008_presentation_wallet_proof",
+      "breakpoints": true
     }
   ]
 }
diff --git a/db/schema/app/admin.ts b/db/schema/app/admin.ts
new file mode 100644
index 0000000..f8dbc8a
--- /dev/null
+++ b/db/schema/app/admin.ts
@@ -0,0 +1,112 @@
+import { sql } from 'drizzle-orm'
+import {
+  check,
+  foreignKey,
+  index,
+  integer,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from 'drizzle-orm/pg-core'
+import { HASH_PATTERN } from '../common.js'
+import { appUsers } from './identity.js'
+import { appOrganizationApplications } from './organizations.js'
+
+export const appAdminDecisions = pgTable(
+  'app_admin_decisions',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    organizationId: uuid('organization_id').notNull(),
+    role: text('role', { enum: ['issuer', 'verifier'] }).notNull(),
+    actorId: uuid('actor_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    action: text('action', { enum: ['approve', 'reject', 'suspend', 'restore'] }).notNull(),
+    beforeStatus: text('before_status').notNull(),
+    afterStatus: text('after_status').notNull(),
+    reason: text('reason'),
+    revision: integer('revision').notNull(),
+    idempotencyKey: uuid('idempotency_key').notNull(),
+    requestHash: text('request_hash').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    foreignKey({
+      name: 'app_admin_decisions_application_fk',
+      columns: [t.organizationId, t.role],
+      foreignColumns: [
+        appOrganizationApplications.organizationId,
+        appOrganizationApplications.role,
+      ],
+    }).onDelete('restrict'),
+    uniqueIndex('app_admin_decisions_idempotency_uq').on(t.actorId, t.idempotencyKey),
+    uniqueIndex('app_admin_decisions_revision_uq').on(t.organizationId, t.role, t.revision),
+    index('app_admin_decisions_history_idx').on(t.createdAt, t.id),
+    check('app_admin_decisions_revision', sql`${t.revision} > 0`),
+    check('app_admin_decisions_hash', sql`${t.requestHash} ~ ${HASH_PATTERN}`),
+    check(
+      'app_admin_decisions_transition',
+      sql`(${t.action} = 'approve' AND ${t.beforeStatus} = 'pending' AND ${t.afterStatus} = 'approved') OR (${t.action} = 'reject' AND ${t.beforeStatus} = 'pending' AND ${t.afterStatus} = 'rejected') OR (${t.action} = 'suspend' AND ${t.role} = 'verifier' AND ${t.beforeStatus} = 'approved' AND ${t.afterStatus} = 'suspended') OR (${t.action} = 'restore' AND ${t.role} = 'verifier' AND ${t.beforeStatus} = 'suspended' AND ${t.afterStatus} = 'approved')`,
+    ),
+    check(
+      'app_admin_decisions_reason',
+      sql`${t.action} NOT IN ('reject', 'suspend') OR (${t.reason} IS NOT NULL AND length(btrim(${t.reason})) > 0)`,
+    ),
+  ],
+)
+
+export const appAdminNotifications = pgTable(
+  'app_admin_notifications',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    decisionId: uuid('decision_id')
+      .notNull()
+      .unique()
+      .references(() => appAdminDecisions.id, { onDelete: 'restrict' }),
+    recipientUserId: uuid('recipient_user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    recipientEmail: text('recipient_email'),
+    status: text('status', {
+      enum: ['pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain'],
+    })
+      .notNull()
+      .default('pending'),
+    attempts: integer('attempts').notNull().default(0),
+    attemptId: uuid('attempt_id'),
+    claimedAt: timestamp('claimed_at', { withTimezone: true }),
+    sentAt: timestamp('sent_at', { withTimezone: true }),
+    errorCode: text('error_code'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('app_admin_notifications_queue_idx').on(t.status, t.createdAt),
+    check(
+      'app_admin_notifications_status',
+      sql`${t.status} IN ('pending', 'sending', 'sent', 'failed', 'blocked', 'uncertain')`,
+    ),
+    check('app_admin_notifications_attempts', sql`${t.attempts} >= 0`),
+    check(
+      'app_admin_notifications_sending',
+      sql`${t.status} <> 'sending' OR (${t.attemptId} IS NOT NULL AND ${t.claimedAt} IS NOT NULL AND ${t.recipientEmail} IS NOT NULL)`,
+    ),
+    check('app_admin_notifications_sent', sql`(${t.status} = 'sent') = (${t.sentAt} IS NOT NULL)`),
+  ],
+)
+
+export const appAdminBootstrapAudit = pgTable(
+  'app_admin_bootstrap_audit',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    operator: text('operator').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    check('app_admin_bootstrap_operator', sql`length(btrim(${t.operator})) BETWEEN 1 AND 200`),
+  ],
+)
diff --git a/db/schema/app/auth.ts b/db/schema/app/auth.ts
new file mode 100644
index 0000000..923b33c
--- /dev/null
+++ b/db/schema/app/auth.ts
@@ -0,0 +1,90 @@
+import { sql } from 'drizzle-orm'
+import { bigint, check, index, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'
+
+import { ADDRESS_PATTERN, HASH_PATTERN } from '../common.js'
+import { appUsers } from './identity.js'
+
+const TOKEN_PATTERN = sql.raw("'^[A-Za-z0-9_-]{43}$'")
+
+export const appSessions = pgTable(
+  'app_sessions',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    tokenHash: text('token_hash').notNull().unique(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    csrfToken: text('csrf_token').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    absoluteExpiresAt: timestamp('absolute_expires_at', { withTimezone: true }).notNull(),
+  },
+  (t) => [
+    index('app_sessions_user_idx').on(t.userId),
+    index('app_sessions_expiry_idx').on(t.expiresAt),
+    check('app_sessions_token', sql`${t.tokenHash} ~ ${HASH_PATTERN}`),
+    check('app_sessions_csrf', sql`${t.csrfToken} ~ ${TOKEN_PATTERN}`),
+    check(
+      'app_sessions_dates',
+      sql`${t.expiresAt} > ${t.createdAt} AND ${t.absoluteExpiresAt} >= ${t.expiresAt} AND isfinite(${t.absoluteExpiresAt})`,
+    ),
+  ],
+)
+
+export const appAuthTransactions = pgTable(
+  'app_auth_transactions',
+  {
+    stateHash: text('state_hash').primaryKey(),
+    browserHash: text('browser_hash').notNull(),
+    nonce: text('nonce').notNull(),
+    codeVerifier: text('code_verifier').notNull(),
+    returnTo: text('return_to').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  },
+  (t) => [
+    index('app_auth_transactions_expiry_idx').on(t.expiresAt),
+    check(
+      'app_auth_transactions_hashes',
+      sql`${t.stateHash} ~ ${HASH_PATTERN} AND ${t.browserHash} ~ ${HASH_PATTERN}`,
+    ),
+    check(
+      'app_auth_transactions_tokens',
+      sql`${t.nonce} ~ ${TOKEN_PATTERN} AND ${t.codeVerifier} ~ ${TOKEN_PATTERN}`,
+    ),
+    check(
+      'app_auth_transactions_return_to',
+      sql`length(${t.returnTo}) BETWEEN 1 AND 2048 AND left(${t.returnTo}, 1) = '/' AND left(${t.returnTo}, 2) <> '//' AND position(chr(92) in ${t.returnTo}) = 0 AND ${t.returnTo} !~ '[[:cntrl:]]'`,
+    ),
+    check(
+      'app_auth_transactions_dates',
+      sql`${t.expiresAt} > ${t.createdAt} AND isfinite(${t.expiresAt})`,
+    ),
+  ],
+)
+
+export const appWalletChallenges = pgTable(
+  'app_wallet_challenges',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    sessionId: uuid('session_id')
+      .notNull()
+      .references(() => appSessions.id, { onDelete: 'cascade' }),
+    networkId: bigint('network_id', { mode: 'number' }).notNull(),
+    address: text('address').notNull(),
+    message: text('message').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  },
+  (t) => [
+    index('app_wallet_challenges_session_idx').on(t.sessionId),
+    index('app_wallet_challenges_expiry_idx').on(t.expiresAt),
+    check('app_wallet_challenges_network', sql`${t.networkId} BETWEEN 0 AND 4294967295`),
+    check('app_wallet_challenges_address', sql`${t.address} ~ ${ADDRESS_PATTERN}`),
+    check('app_wallet_challenges_message', sql`length(${t.message}) BETWEEN 1 AND 8192`),
+    check(
+      'app_wallet_challenges_dates',
+      sql`${t.expiresAt} > ${t.createdAt} AND isfinite(${t.expiresAt})`,
+    ),
+  ],
+)
diff --git a/db/schema/app/identity.ts b/db/schema/app/identity.ts
new file mode 100644
index 0000000..b1fc5c4
--- /dev/null
+++ b/db/schema/app/identity.ts
@@ -0,0 +1,84 @@
+import { sql } from 'drizzle-orm'
+import {
+  bigint,
+  check,
+  index,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from 'drizzle-orm/pg-core'
+
+import { ADDRESS_PATTERN } from '../common.js'
+
+export const appUsers = pgTable(
+  'app_users',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    identityIssuer: text('identity_issuer'),
+    identitySubject: text('identity_subject'),
+    email: text('email'),
+    emailVerifiedAt: timestamp('email_verified_at', { withTimezone: true }),
+    displayName: text('display_name'),
+    status: text('status', { enum: ['active', 'suspended', 'deleted'] })
+      .notNull()
+      .default('active'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+  },
+  (t) => [
+    uniqueIndex('app_users_identity_uq').on(t.identityIssuer, t.identitySubject),
+    check('app_users_status', sql`${t.status} IN ('active', 'suspended', 'deleted')`),
+    check(
+      'app_users_identity',
+      sql`(${t.status} <> 'deleted' AND length(${t.identityIssuer}) > 0 AND ${t.identityIssuer} IS NOT NULL AND length(${t.identitySubject}) > 0 AND ${t.identitySubject} IS NOT NULL AND ${t.deletedAt} IS NULL) OR (${t.status} = 'deleted' AND ${t.identityIssuer} IS NULL AND ${t.identitySubject} IS NULL AND ${t.email} IS NULL AND ${t.emailVerifiedAt} IS NULL AND ${t.displayName} IS NULL AND ${t.deletedAt} IS NOT NULL)`,
+    ),
+    check('app_users_verified_email', sql`${t.emailVerifiedAt} IS NULL OR ${t.email} IS NOT NULL`),
+  ],
+)
+
+// Issuer/verifier approval belongs to an organization; these are personal roles only.
+export const appUserRoles = pgTable(
+  'app_user_roles',
+  {
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    role: text('role', { enum: ['admin', 'recipient'] })
+      .notNull()
+      .default('recipient'),
+    grantedBy: uuid('granted_by').references(() => appUsers.id, { onDelete: 'restrict' }),
+    grantedAt: timestamp('granted_at', { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+  },
+  (t) => [
+    primaryKey({ columns: [t.userId, t.role] }),
+    check('app_user_roles_role', sql`${t.role} IN ('admin', 'recipient')`),
+  ],
+)
+
+export const appWallets = pgTable(
+  'app_wallets',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    networkId: bigint('network_id', { mode: 'number' }).notNull(),
+    address: text('address').notNull(),
+    verifiedAt: timestamp('verified_at', { withTimezone: true }).notNull(),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+  },
+  (t) => [
+    uniqueIndex('app_wallets_network_address_uq').on(t.networkId, t.address),
+    index('app_wallets_user_idx').on(t.userId),
+    check('app_wallets_network', sql`${t.networkId} BETWEEN 0 AND 4294967295`),
+    check('app_wallets_address', sql`${t.address} ~ ${ADDRESS_PATTERN}`),
+    check(
+      'app_wallets_revocation',
+      sql`${t.revokedAt} IS NULL OR ${t.revokedAt} >= ${t.verifiedAt}`,
+    ),
+  ],
+)
diff --git a/db/schema/app/index.ts b/db/schema/app/index.ts
new file mode 100644
index 0000000..e0f9ea0
--- /dev/null
+++ b/db/schema/app/index.ts
@@ -0,0 +1,7 @@
+export * from './identity.js'
+export * from './organizations.js'
+export * from './issuance.js'
+export * from './presentations.js'
+export * from './auth.js'
+export * from './admin.js'
+export * from './issuer.js'
diff --git a/db/schema/app/issuance.ts b/db/schema/app/issuance.ts
new file mode 100644
index 0000000..4314741
--- /dev/null
+++ b/db/schema/app/issuance.ts
@@ -0,0 +1,168 @@
+import { sql } from 'drizzle-orm'
+import {
+  bigint,
+  check,
+  foreignKey,
+  index,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  unique,
+  uuid,
+} from 'drizzle-orm/pg-core'
+
+import { ADDRESS_PATTERN, HASH_PATTERN } from '../common.js'
+import { appUsers } from './identity.js'
+import { appOrganizations } from './organizations.js'
+
+// Stable ledger references, deliberately not FKs into the rebuildable projection.
+export const appSchemaMetadata = pgTable(
+  'app_schema_metadata',
+  {
+    profileId: text('profile_id').notNull(),
+    schemaUid: text('schema_uid').notNull(),
+    organizationId: uuid('organization_id')
+      .notNull()
+      .references(() => appOrganizations.id, { onDelete: 'restrict' }),
+    displayName: text('display_name'),
+    category: text('category'),
+    registrationTransactionHash: text('registration_transaction_hash').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    primaryKey({ columns: [t.profileId, t.schemaUid] }),
+    unique('app_schema_metadata_owner_uq').on(t.profileId, t.schemaUid, t.organizationId),
+    index('app_schema_metadata_organization_idx').on(t.organizationId),
+    check('app_schema_metadata_profile', sql`length(${t.profileId}) > 0`),
+    check('app_schema_metadata_uid', sql`${t.schemaUid} ~ ${HASH_PATTERN}`),
+    check(
+      'app_schema_metadata_transaction',
+      sql`${t.registrationTransactionHash} ~ ${HASH_PATTERN}`,
+    ),
+  ],
+)
+
+export const appInvites = pgTable(
+  'app_invites',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    organizationId: uuid('organization_id').notNull(),
+    profileId: text('profile_id').notNull(),
+    schemaUid: text('schema_uid').notNull(),
+    deliveryEmail: text('delivery_email'),
+    tokenHash: text('token_hash').unique(),
+    createdBy: uuid('created_by')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    claimedBy: uuid('claimed_by').references(() => appUsers.id, { onDelete: 'restrict' }),
+    claimedAt: timestamp('claimed_at', { withTimezone: true }),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+  },
+  (t) => [
+    foreignKey({
+      columns: [t.profileId, t.schemaUid, t.organizationId],
+      foreignColumns: [
+        appSchemaMetadata.profileId,
+        appSchemaMetadata.schemaUid,
+        appSchemaMetadata.organizationId,
+      ],
+      name: 'app_invites_schema_owner_fk',
+    }).onDelete('restrict'),
+    unique('app_invites_claim_identity_uq').on(
+      t.id,
+      t.organizationId,
+      t.profileId,
+      t.schemaUid,
+      t.claimedBy,
+    ),
+    index('app_invites_organization_idx').on(t.organizationId, t.createdAt),
+    index('app_invites_claimant_idx').on(t.claimedBy),
+    check('app_invites_token', sql`${t.tokenHash} IS NULL OR ${t.tokenHash} ~ ${HASH_PATTERN}`),
+    check(
+      'app_invites_unclaimed_token',
+      sql`${t.claimedAt} IS NOT NULL OR ${t.revokedAt} IS NOT NULL OR ${t.tokenHash} IS NOT NULL`,
+    ),
+    check('app_invites_expiry', sql`${t.expiresAt} > ${t.createdAt}`),
+    check(
+      'app_invites_claim',
+      sql`(${t.claimedBy} IS NULL AND ${t.claimedAt} IS NULL) OR (${t.claimedBy} IS NOT NULL AND ${t.claimedAt} IS NOT NULL AND ${t.claimedAt} >= ${t.createdAt} AND ${t.claimedAt} < ${t.expiresAt})`,
+    ),
+  ],
+)
+
+export const appCredentialMetadata = pgTable(
+  'app_credential_metadata',
+  {
+    profileId: text('profile_id').notNull(),
+    generationId: text('generation_id').notNull(),
+    schemaUid: text('schema_uid').notNull(),
+    issuerOrganizationId: uuid('issuer_organization_id').notNull(),
+    recipientUserId: uuid('recipient_user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    inviteId: uuid('invite_id').unique(),
+    issuerAddress: text('issuer_address').notNull(),
+    subjectAddress: text('subject_address').notNull(),
+    visibility: text('visibility', { enum: ['public', 'private'] }).notNull(),
+    publicFields: jsonb('public_fields').$type<string[]>().notNull().default([]),
+    payloadStorageKey: text('payload_storage_key'),
+    payloadDigest: text('payload_digest').notNull(),
+    creationTransactionHash: text('creation_transaction_hash').notNull(),
+    creationLedgerIndex: bigint('creation_ledger_index', { mode: 'number' }).notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    primaryKey({ columns: [t.profileId, t.generationId] }),
+    unique('app_credential_metadata_recipient_uq').on(
+      t.profileId,
+      t.generationId,
+      t.recipientUserId,
+    ),
+    foreignKey({
+      columns: [t.profileId, t.schemaUid, t.issuerOrganizationId],
+      foreignColumns: [
+        appSchemaMetadata.profileId,
+        appSchemaMetadata.schemaUid,
+        appSchemaMetadata.organizationId,
+      ],
+      name: 'app_credential_metadata_schema_owner_fk',
+    }).onDelete('restrict'),
+    foreignKey({
+      columns: [t.inviteId, t.issuerOrganizationId, t.profileId, t.schemaUid, t.recipientUserId],
+      foreignColumns: [
+        appInvites.id,
+        appInvites.organizationId,
+        appInvites.profileId,
+        appInvites.schemaUid,
+        appInvites.claimedBy,
+      ],
+      name: 'app_credential_metadata_invite_claim_fk',
+    }).onDelete('restrict'),
+    index('app_credential_metadata_recipient_idx').on(t.recipientUserId, t.createdAt),
+    index('app_credential_metadata_issuer_idx').on(t.issuerOrganizationId, t.createdAt),
+    check('app_credential_metadata_generation', sql`${t.generationId} ~ ${HASH_PATTERN}`),
+    check(
+      'app_credential_metadata_addresses',
+      sql`${t.issuerAddress} ~ ${ADDRESS_PATTERN} AND ${t.subjectAddress} ~ ${ADDRESS_PATTERN}`,
+    ),
+    check('app_credential_metadata_visibility', sql`${t.visibility} IN ('public', 'private')`),
+    check(
+      'app_credential_metadata_fields',
+      sql`jsonb_typeof(${t.publicFields}) = 'array' AND NOT jsonb_path_exists(${t.publicFields}, '$[*] ? (@.type() != "string")')`,
+    ),
+    check('app_credential_metadata_digest', sql`${t.payloadDigest} ~ ${HASH_PATTERN}`),
+    check(
+      'app_credential_metadata_transaction',
+      sql`${t.creationTransactionHash} ~ ${HASH_PATTERN}`,
+    ),
+    check('app_credential_metadata_ledger', sql`${t.creationLedgerIndex} BETWEEN 1 AND 4294967295`),
+    check(
+      'app_credential_metadata_storage',
+      sql`${t.payloadStorageKey} IS NULL OR length(btrim(${t.payloadStorageKey})) > 0`,
+    ),
+  ],
+)
diff --git a/db/schema/app/issuer.ts b/db/schema/app/issuer.ts
new file mode 100644
index 0000000..bc3341f
--- /dev/null
+++ b/db/schema/app/issuer.ts
@@ -0,0 +1,78 @@
+import { sql } from 'drizzle-orm'
+import {
+  check,
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from 'drizzle-orm/pg-core'
+import { appInvites } from './issuance.js'
+import { appUsers } from './identity.js'
+
+// Application-private drafts never enter the public hosted-payload store or indexer.
+export const appIssuerPayloads = pgTable(
+  'app_issuer_payloads',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    locator: text('locator').notNull().unique(),
+    inviteId: uuid('invite_id')
+      .notNull()
+      .references(() => appInvites.id, { onDelete: 'restrict' }),
+    createdBy: uuid('created_by')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    subjectAddress: text('subject_address').notNull(),
+    canonicalPayload: text('canonical_payload').notNull(),
+    payloadDigest: text('payload_digest').notNull(),
+    credentialUri: text('credential_uri').notNull(),
+    visibility: text('visibility', { enum: ['public', 'private'] }).notNull(),
+    publicFields: jsonb('public_fields').$type<string[]>().notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('app_issuer_payloads_invite_idx').on(t.inviteId),
+    check('app_issuer_payloads_locator', sql`${t.locator} ~ '^[0-9a-f]{18}$'`),
+    check('app_issuer_payloads_digest', sql`${t.payloadDigest} ~ '^[0-9a-f]{64}$'`),
+    check(
+      'app_issuer_payloads_size',
+      sql`octet_length(${t.canonicalPayload}) BETWEEN 1 AND 1048576`,
+    ),
+    check('app_issuer_payloads_visibility', sql`${t.visibility} IN ('public', 'private')`),
+    check(
+      'app_issuer_payloads_fields',
+      sql`jsonb_typeof(${t.publicFields}) = 'array' AND NOT jsonb_path_exists(${t.publicFields}, '$[*] ? (@.type() != "string")')`,
+    ),
+  ],
+)
+
+// Bearer invitation tokens exist only in memory during the single delivery attempt.
+export const appInviteDeliveries = pgTable(
+  'app_invite_deliveries',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    inviteId: uuid('invite_id')
+      .notNull()
+      .references(() => appInvites.id, { onDelete: 'restrict' }),
+    kind: text('kind', { enum: ['invitation', 'issued', 'revoked'] }).notNull(),
+    recipientEmail: text('recipient_email').notNull(),
+    status: text('status', {
+      enum: ['sending', 'sent', 'failed', 'uncertain', 'cancelled'],
+    }).notNull(),
+    errorCode: text('error_code'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('app_invite_deliveries_invite_idx').on(t.inviteId, t.createdAt),
+    uniqueIndex('app_invite_deliveries_event_uq')
+      .on(t.inviteId, t.kind)
+      .where(sql`${t.kind} <> 'invitation'`),
+    check(
+      'app_invite_deliveries_status',
+      sql`${t.status} IN ('sending', 'sent', 'failed', 'uncertain', 'cancelled')`,
+    ),
+    check('app_invite_deliveries_kind', sql`${t.kind} IN ('invitation', 'issued', 'revoked')`),
+  ],
+)
diff --git a/db/schema/app/organizations.ts b/db/schema/app/organizations.ts
new file mode 100644
index 0000000..a90f6d2
--- /dev/null
+++ b/db/schema/app/organizations.ts
@@ -0,0 +1,112 @@
+import { sql } from 'drizzle-orm'
+import {
+  check,
+  foreignKey,
+  index,
+  integer,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uuid,
+} from 'drizzle-orm/pg-core'
+
+import { HASH_PATTERN } from '../common.js'
+import { appUsers } from './identity.js'
+
+export const appOrganizations = pgTable(
+  'app_organizations',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    responsibleUserId: uuid('responsible_user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    name: text('name').notNull(),
+    status: text('status', { enum: ['active', 'suspended', 'closed'] })
+      .notNull()
+      .default('active'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('app_organizations_responsible_idx').on(t.responsibleUserId),
+    check('app_organizations_name', sql`length(btrim(${t.name})) > 0`),
+    check('app_organizations_status', sql`${t.status} IN ('active', 'suspended', 'closed')`),
+  ],
+)
+
+// One application/profile per organization and role; approvals are independent.
+export const appOrganizationApplications = pgTable(
+  'app_organization_applications',
+  {
+    organizationId: uuid('organization_id')
+      .notNull()
+      .references(() => appOrganizations.id, { onDelete: 'restrict' }),
+    role: text('role', { enum: ['issuer', 'verifier'] }).notNull(),
+    revision: integer('revision').notNull().default(0),
+    status: text('status', { enum: ['pending', 'approved', 'rejected', 'suspended'] })
+      .notNull()
+      .default('pending'),
+    website: text('website'),
+    contact: text('contact'),
+    jurisdiction: text('jurisdiction'),
+    description: text('description'),
+    purpose: text('purpose'),
+    submittedAt: timestamp('submitted_at', { withTimezone: true }).notNull().defaultNow(),
+    reviewedBy: uuid('reviewed_by').references(() => appUsers.id, { onDelete: 'restrict' }),
+    reviewedAt: timestamp('reviewed_at', { withTimezone: true }),
+    reviewReason: text('review_reason'),
+  },
+  (t) => [
+    primaryKey({ columns: [t.organizationId, t.role] }),
+    index('app_organization_applications_queue_idx').on(t.status, t.submittedAt),
+    check('app_organization_applications_revision', sql`${t.revision} >= 0`),
+    check('app_organization_applications_role', sql`${t.role} IN ('issuer', 'verifier')`),
+    check(
+      'app_organization_applications_status',
+      sql`${t.status} IN ('pending', 'approved', 'rejected', 'suspended')`,
+    ),
+    check(
+      'app_organization_applications_review',
+      sql`(${t.status} = 'pending' AND ${t.reviewedBy} IS NULL AND ${t.reviewedAt} IS NULL AND ${t.reviewReason} IS NULL) OR (${t.status} <> 'pending' AND ${t.reviewedBy} IS NOT NULL AND ${t.reviewedAt} IS NOT NULL AND ${t.reviewedAt} >= ${t.submittedAt})`,
+    ),
+    check(
+      'app_organization_applications_reason',
+      sql`${t.status} NOT IN ('rejected', 'suspended') OR (${t.reviewReason} IS NOT NULL AND length(btrim(${t.reviewReason})) > 0)`,
+    ),
+  ],
+)
+
+export const appDocuments = pgTable(
+  'app_documents',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    organizationId: uuid('organization_id').notNull(),
+    applicationRole: text('application_role', { enum: ['issuer', 'verifier'] }).notNull(),
+    storageKey: text('storage_key').notNull().unique(),
+    mimeType: text('mime_type').notNull(),
+    byteLength: integer('byte_length').notNull(),
+    sha256: text('sha256').notNull(),
+    uploadedBy: uuid('uploaded_by')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    reviewStatus: text('review_status', { enum: ['pending', 'approved', 'rejected'] })
+      .notNull()
+      .default('pending'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    foreignKey({
+      columns: [t.organizationId, t.applicationRole],
+      foreignColumns: [
+        appOrganizationApplications.organizationId,
+        appOrganizationApplications.role,
+      ],
+      name: 'app_documents_application_fk',
+    }).onDelete('restrict'),
+    index('app_documents_application_idx').on(t.organizationId, t.applicationRole),
+    check('app_documents_size', sql`${t.byteLength} > 0`),
+    check('app_documents_digest', sql`${t.sha256} ~ ${HASH_PATTERN}`),
+    check('app_documents_storage_key', sql`length(btrim(${t.storageKey})) > 0`),
+    check('app_documents_review', sql`${t.reviewStatus} IN ('pending', 'approved', 'rejected')`),
+  ],
+)
diff --git a/db/schema/app/presentations.ts b/db/schema/app/presentations.ts
new file mode 100644
index 0000000..e0e0340
--- /dev/null
+++ b/db/schema/app/presentations.ts
@@ -0,0 +1,175 @@
+import { sql } from 'drizzle-orm'
+import {
+  check,
+  foreignKey,
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from 'drizzle-orm/pg-core'
+
+import { HASH_PATTERN } from '../common.js'
+import { appCredentialMetadata } from './issuance.js'
+import { appOrganizations } from './organizations.js'
+import { appUsers } from './identity.js'
+import { appSessions } from './auth.js'
+
+export const appPresentations = pgTable(
+  'app_presentations',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    profileId: text('profile_id').notNull(),
+    generationId: text('generation_id').notNull(),
+    recipientUserId: uuid('recipient_user_id').notNull(),
+    verifierOrganizationId: uuid('verifier_organization_id').references(() => appOrganizations.id, {
+      onDelete: 'restrict',
+    }),
+    scope: text('scope', { enum: ['public', 'full'] }).notNull(),
+    tokenHash: text('token_hash').notNull().unique(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+  },
+  (t) => [
+    foreignKey({
+      columns: [t.profileId, t.generationId, t.recipientUserId],
+      foreignColumns: [
+        appCredentialMetadata.profileId,
+        appCredentialMetadata.generationId,
+        appCredentialMetadata.recipientUserId,
+      ],
+      name: 'app_presentations_recipient_fk',
+    }).onDelete('restrict'),
+    index('app_presentations_recipient_idx').on(t.recipientUserId, t.createdAt),
+    index('app_presentations_verifier_idx').on(t.verifierOrganizationId),
+    check('app_presentations_scope', sql`${t.scope} IN ('public', 'full')`),
+    check(
+      'app_presentations_audience',
+      sql`${t.scope} <> 'full' OR ${t.verifierOrganizationId} IS NOT NULL`,
+    ),
+    check('app_presentations_token', sql`${t.tokenHash} ~ ${HASH_PATTERN}`),
+    check(
+      'app_presentations_revocation',
+      sql`${t.revokedAt} IS NULL OR ${t.revokedAt} >= ${t.createdAt}`,
+    ),
+  ],
+)
+
+// Verification history retains evidence summaries only: never claim values or link tokens.
+export const appVerifierHistory = pgTable(
+  'app_verifier_history',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    verifierOrganizationId: uuid('verifier_organization_id')
+      .notNull()
+      .references(() => appOrganizations.id, { onDelete: 'restrict' }),
+    verifierUserId: uuid('verifier_user_id')
+      .notNull()
+      .references(() => appUsers.id, { onDelete: 'restrict' }),
+    presentationId: uuid('presentation_id')
+      .notNull()
+      .references(() => appPresentations.id, { onDelete: 'restrict' }),
+    profileId: text('profile_id').notNull(),
+    generationId: text('generation_id').notNull(),
+    scope: text('scope', { enum: ['public', 'full'] }).notNull(),
+    onChain: text('on_chain').notNull(),
+    schemaStatus: text('schema_status').notNull(),
+    payloadStatus: text('payload_status').notNull(),
+    issuerTrust: text('issuer_trust').notNull(),
+    checkedAt: timestamp('checked_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('app_verifier_history_user_idx').on(t.verifierUserId, t.checkedAt, t.id),
+    index('app_verifier_history_organization_idx').on(t.verifierOrganizationId, t.checkedAt, t.id),
+    check('app_verifier_history_profile', sql`length(${t.profileId}) BETWEEN 1 AND 200`),
+    check('app_verifier_history_generation', sql`${t.generationId} ~ ${HASH_PATTERN}`),
+    check('app_verifier_history_scope', sql`${t.scope} IN ('public', 'full')`),
+    check(
+      'app_verifier_history_chain',
+      sql`${t.onChain} IN ('not_found', 'pending', 'active', 'expired', 'deleted')`,
+    ),
+    check('app_verifier_history_schema', sql`${t.schemaStatus} IN ('valid', 'unknown')`),
+    check(
+      'app_verifier_history_payload',
+      sql`${t.payloadStatus} IN ('valid', 'unavailable', 'tampered', 'invalid', 'not_checked')`,
+    ),
+    check(
+      'app_verifier_history_trust',
+      sql`${t.issuerTrust} IN ('trusted', 'untrusted', 'unknown')`,
+    ),
+  ],
+)
+
+// A separate purpose prevents a presentation signature from being consumed as a wallet link.
+export const appPresentationChallenges = pgTable(
+  'app_presentation_challenges',
+  {
+    id: uuid('id').primaryKey(),
+    sessionId: uuid('session_id')
+      .notNull()
+      .references(() => appSessions.id, { onDelete: 'cascade' }),
+    presentationId: uuid('presentation_id').notNull().unique(),
+    request: jsonb('request').$type<PresentationProofRequest>().notNull(),
+    message: text('message').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  },
+  (t) => [
+    index('app_presentation_challenges_session_idx').on(t.sessionId),
+    index('app_presentation_challenges_expiry_idx').on(t.expiresAt),
+    check('app_presentation_challenges_request', sql`jsonb_typeof(${t.request}) = 'object'`),
+    check(
+      'app_presentation_challenges_message',
+      sql`octet_length(${t.message}) BETWEEN 1 AND 8192`,
+    ),
+    check(
+      'app_presentation_challenges_dates',
+      sql`${t.expiresAt} > ${t.createdAt} AND ${t.expiresAt} <= ${t.createdAt} + interval '5 minutes' AND isfinite(${t.expiresAt})`,
+    ),
+  ],
+)
+
+export interface PresentationProofRequest {
+  version: 1
+  origin: string
+  challengeId: string
+  presentationId: string
+  nonce: string
+  issuedAt: string
+  expiresAt: string
+  profileId: string
+  networkId: number
+  generationId: string
+  issuerAddress: string
+  subjectAddress: string
+  schemaUid: string
+  payloadDigest: string | null
+  visibility: 'public' | 'private'
+  publicFields: string[]
+  scope: 'public' | 'full'
+  verifierOrganizationId: string | null
+}
+
+// Public signature evidence only; share tokens remain hashed in app_presentations.
+export const appPresentationProofs = pgTable(
+  'app_presentation_proofs',
+  {
+    presentationId: uuid('presentation_id')
+      .primaryKey()
+      .references(() => appPresentations.id, { onDelete: 'restrict' }),
+    request: jsonb('request').$type<PresentationProofRequest>().notNull(),
+    message: text('message').notNull(),
+    signature: text('signature').notNull(),
+    publicKey: text('public_key').notNull(),
+    scheme: text('scheme', { enum: ['ripple', 'otsu'] }).notNull(),
+    verifiedAt: timestamp('verified_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    check('app_presentation_proofs_request', sql`jsonb_typeof(${t.request}) = 'object'`),
+    check('app_presentation_proofs_message', sql`octet_length(${t.message}) BETWEEN 1 AND 8192`),
+    check('app_presentation_proofs_signature', sql`${t.signature} ~ '^[0-9A-Fa-f]{128,144}$'`),
+    check('app_presentation_proofs_key', sql`${t.publicKey} ~ '^(02|03|ED|ed)[0-9A-Fa-f]{64}$'`),
+    check('app_presentation_proofs_scheme', sql`${t.scheme} IN ('ripple', 'otsu')`),
+  ],
+)
diff --git a/db/schema/index.ts b/db/schema/index.ts
index 5668f47..d8b49b5 100644
--- a/db/schema/index.ts
+++ b/db/schema/index.ts
@@ -3,3 +3,4 @@ export * from './indexer.js'
 export * from './catalog.js'
 export * from './credentials.js'
 export * from './pinning.js'
+export * from './payloads.js'
diff --git a/db/schema/payloads.ts b/db/schema/payloads.ts
new file mode 100644
index 0000000..fec6fe6
--- /dev/null
+++ b/db/schema/payloads.ts
@@ -0,0 +1,51 @@
+import { HASH_PATTERN, ADDRESS_PATTERN } from './common.js'
+import { schemas } from './catalog.js'
+import { networkProfiles } from './profiles.js'
+import { sql } from 'drizzle-orm'
+import { check, foreignKey, index, pgTable, text, timestamp } from 'drizzle-orm/pg-core'
+export const hostedPayloads = pgTable(
+  'hosted_payloads',
+  {
+    locator: text('locator').primaryKey(),
+    digestHex: text('digest_hex').notNull(),
+    content: text('content').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    check('hosted_payloads_locator', sql`${table.locator} ~ '^(?:[0-9a-f]{18}|[0-9a-f]{20})$'`),
+    check('hosted_payloads_digest', sql`${table.digestHex} ~ ${HASH_PATTERN}`),
+    check('hosted_payloads_size', sql`octet_length(${table.content}) BETWEEN 1 AND 65536`),
+  ],
+)
+export const hostedPayloadPublications = pgTable(
+  'hosted_payload_publications',
+  {
+    transactionHash: text('transaction_hash').primaryKey(),
+    locator: text('locator')
+      .notNull()
+      .references(() => hostedPayloads.locator, { onDelete: 'restrict' }),
+    profileId: text('profile_id')
+      .notNull()
+      .references(() => networkProfiles.profileId, { onDelete: 'restrict' }),
+    issuer: text('issuer').notNull(),
+    subject: text('subject').notNull(),
+    schemaUid: text('schema_uid').notNull(),
+    requesterIpHash: text('requester_ip_hash').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'hosted_payload_publications_schema_fk',
+      columns: [table.profileId, table.schemaUid],
+      foreignColumns: [schemas.profileId, schemas.schemaUid],
+    }).onDelete('restrict'),
+    index('hosted_payload_publications_wallet_quota_idx').on(table.issuer, table.createdAt),
+    index('hosted_payload_publications_ip_quota_idx').on(table.requesterIpHash, table.createdAt),
+    index('hosted_payload_publications_locator_idx').on(table.locator),
+    check('hosted_payload_publications_tx_hash', sql`${table.transactionHash} ~ ${HASH_PATTERN}`),
+    check('hosted_payload_publications_issuer', sql`${table.issuer} ~ ${ADDRESS_PATTERN}`),
+    check('hosted_payload_publications_subject', sql`${table.subject} ~ ${ADDRESS_PATTERN}`),
+    check('hosted_payload_publications_schema', sql`${table.schemaUid} ~ ${HASH_PATTERN}`),
+    check('hosted_payload_publications_ip_hash', sql`${table.requesterIpHash} ~ ${HASH_PATTERN}`),
+  ],
+)
diff --git a/docker-compose.application.yml b/docker-compose.application.yml
new file mode 100644
index 0000000..362a7d3
--- /dev/null
+++ b/docker-compose.application.yml
@@ -0,0 +1,64 @@
+# Optional local auth/admin/issuer validation, on top of docker-compose.yml.
+services:
+  web:
+    environment:
+      XCS_AUTH_ORIGIN: ${XCS_AUTH_ORIGIN:?Set exact local HTTPS origin}
+      XCS_IDENTITY_CLIENT_ID: ${XCS_IDENTITY_CLIENT_ID:?Set identity client ID}
+      XCS_IDENTITY_CLIENT_SECRET: ${XCS_IDENTITY_CLIENT_SECRET:?Set identity client secret}
+      NUXT_APP_DATABASE_URL: postgres://xcs_app:local-development-only-not-a-secret-app@postgres:5432/xcs
+      NUXT_ADMIN_DATABASE_URL: postgres://xcs_admin_app:local-development-only-not-a-secret-admin-app@postgres:5432/xcs
+      XCS_ADMIN_DOCUMENT_KEY: ${XCS_ADMIN_DOCUMENT_KEY:?Set document signing key}
+      NUXT_ISSUER_DATABASE_URL: postgres://xcs_issuer:local-development-only-not-a-secret-issuer@postgres:5432/xcs
+      XCS_DOCUMENT_STORAGE_DRIVER: filesystem
+      XCS_DOCUMENT_FILESYSTEM_DIRECTORY: /var/lib/xcs-review
+      XCS_DOCUMENT_FILESYSTEM_LOCAL: '1'
+      XCS_SMTP_HOST: mailpit
+      XCS_SMTP_PORT: '1025'
+    volumes:
+      - xcs-review-documents:/var/lib/xcs-review
+    networks: [edge, database, monitoring, application-mail]
+  admin-notifier:
+    image: ${XCS_NOTIFIER_IMAGE:-xcs-notifier:local}
+    build:
+      context: .
+      dockerfile: apps/notifier/Dockerfile
+    user: node
+    environment:
+      XCS_NOTIFIER_DATABASE_URL: postgres://xcs_notifier:local-development-only-not-a-secret-notifier@postgres:5432/xcs
+      XCS_AUTH_ORIGIN: ${XCS_AUTH_ORIGIN:?Set exact local HTTPS origin}
+      XCS_SMTP_HOST: mailpit
+      XCS_SMTP_PORT: '1025'
+    depends_on:
+      db-bootstrap:
+        condition: service_completed_successfully
+      mailpit:
+        condition: service_healthy
+    networks: [database, application-mail]
+    init: true
+    read_only: true
+    tmpfs: ['/tmp:rw,noexec,nosuid,size=64m']
+    cap_drop: [ALL]
+    security_opt: ['no-new-privileges:true']
+    pids_limit: 100
+    stop_grace_period: 75s
+    restart: unless-stopped
+  mailpit:
+    image: axllent/mailpit:v1.29.2
+    user: '1000:1000'
+    environment:
+      MP_DISABLE_VERSION_CHECK: 'true'
+      MP_SMTP_DISABLE_RDNS: 'true'
+      MP_MAX_MESSAGES: '0'
+    ports: ['127.0.0.1:${XCS_MAILPIT_PORT:-8025}:8025']
+    networks: [application-mail, mail-ui]
+    read_only: true
+    tmpfs: ['/tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000']
+    cap_drop: [ALL]
+    security_opt: ['no-new-privileges:true']
+    restart: unless-stopped
+networks:
+  application-mail:
+    internal: true
+  mail-ui:
+volumes:
+  xcs-review-documents:
diff --git a/docker-compose.hosted-payloads.yml b/docker-compose.hosted-payloads.yml
new file mode 100644
index 0000000..be1566e
--- /dev/null
+++ b/docker-compose.hosted-payloads.yml
@@ -0,0 +1,8 @@
+# Optional public hosted payloads for local validation; never private issuer claims.
+services:
+  web:
+    environment:
+      XCS_PAYLOAD_DATABASE_URL: postgres://xcs_payload_writer:local-development-only-not-a-secret-payload@postgres:5432/xcs
+      XCS_PUBLIC_PAYLOAD_BASE_URL: ${XCS_PUBLIC_PAYLOAD_BASE_URL:?Set HTTPS payload origin}
+      XCS_PAYLOAD_STORAGE_IP_HASH_SECRET: ${XCS_PAYLOAD_STORAGE_IP_HASH_SECRET:?Set quota hashing secret}
+      XCS_HOSTED_PAYLOAD_NETWORKS: ${XCS_HOSTED_PAYLOAD_NETWORKS:?Set allowed profiles}
diff --git a/docker-compose.yml b/docker-compose.yml
index 4acc572..f4f8dcc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,7 +61,7 @@ services:
     expose: ['5432']
     volumes:
       - xcs-postgres:/var/lib/postgresql
-      # Local development only: creates xcs_indexer, xcs_api and xcs_monitor with
+      # Local development only: creates all eight XCS runtime roles with
       # published non-secret passwords, because there is no managed database
       # service here to create them. Runs once, on a fresh data directory.
       - ./db/compose-initdb:/docker-entrypoint-initdb.d:ro
@@ -84,8 +84,7 @@ services:
         max-size: ${XCS_LOG_MAX_SIZE:-10m}
         max-file: ${XCS_LOG_MAX_FILES:-5}
 
-  # Migrations plus the privileges of the xcs_indexer, xcs_api and xcs_monitor
-  # roles, from the indexer image. It does not create the roles and does not set
+  # Migrations plus least-privilege grants for all eight runtime roles, from the indexer image. It does not create the roles and does not set
   # their passwords: it fails naming any role that is missing. Restart-safe:
   # running it again is a no-op.
   db-bootstrap:
diff --git a/docs/TESTING.md b/docs/TESTING.md
index b140b21..e86670a 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -60,6 +60,11 @@ pnpm --dir apps/indexer test:postgres
 pnpm --dir apps/web test:postgres
 ```
 
+When `XCS_TEST_DATABASE_URL` is set, the indexer's Vitest configuration runs test files in
+sequence, including through `test` and `verify`. Separate databases still share cluster-wide
+roles, so concurrent provisioning can collide or replace another suite's role credentials.
+Unit-only runs retain file parallelism; assertions and timeouts are unchanged.
+
 Install Chromium once and run browser flows with:
 
 ```bash
@@ -101,3 +106,107 @@ nothing about the applications' copies of that code. A protocol change must be m
 affected application's suite rerun in the same pull request; see [`CONTRIBUTING.md`](../CONTRIBUTING.md).
 
 If a required environment is unavailable, report the exact skipped command and do not describe it as passing.
+
+## Authentication
+
+`pnpm --dir apps/web test:e2e:auth` runs the isolated OIDC browser flow on port 3127.
+It verifies sign-in, reload, denied issuer access, wallet link/unlink, logout and FR/EN copy.
+`pnpm test:postgres` also covers auth schema/grants and repository behavior through `xcs_app`.
+See [authentication boundaries and real-provider limitations](runbooks/authentication.md).
+
+## Administrator portal (#30)
+
+Use a disposable PostgreSQL cluster: provisioning changes cluster-wide runtime role credentials,
+so database integration suites must run sequentially. Do not reuse the running #27 cluster.
+
+```sh
+pnpm --dir apps/web exec vitest run test/admin-config.test.ts test/admin-documents.test.ts test/admin-notifications.test.ts
+# With XCS_TEST_DATABASE_URL configured privately:
+pnpm --dir apps/web exec vitest run test/admin-postgres.integration.test.ts
+# Also exercise actual SMTP receipt when local Mailpit is available:
+XCS_TEST_MAILPIT_URL=http://127.0.0.1:8025 XCS_TEST_SMTP_PORT=1025 \
+  pnpm --dir apps/web exec vitest run test/admin-postgres.integration.test.ts
+# Real compiled Nitro, PostgreSQL sessions and browser; no mocked admin endpoints:
+pnpm --dir apps/web build
+XCS_ADMIN_RUNTIME_TEST=1 pnpm --dir apps/web exec vitest run test/admin-postgres.integration.test.ts
+# Deterministic UI failure states use intercepted API responses:
+XCS_E2E_PORT=3130 pnpm --dir apps/web exec playwright test e2e/admin.spec.ts
+```
+
+The runtime browser test creates a short-lived synthetic TLS certificate and trusts only its
+public-key fingerprint in the test Chromium process; no OS trust is changed. It inserts synthetic
+sessions using the same PostgreSQL repository as authentication, exercises direct protected
+navigation and a real persisted decision, and revokes the admin role. It does not perform a real
+XRP Identity login. The mockup's human usability sessions remain unperformed.
+
+## Issuer workspace (#31)
+
+`XCS_E2E_PORT=3131 pnpm --dir apps/web exec playwright test e2e/issuer.spec.ts`
+checks onboarding, own-schema/invitation interfaces, FR/EN copy, denial states and fragment handling
+with API fixtures. `test/issuer-postgres.integration.test.ts` exercises actual restricted grants,
+claim concurrency, exact-generation recording and full/filtered payload responses. Storage, mail,
+input validation and engine recovery have focused unit suites. Run PostgreSQL suites sequentially
+on a disposable cluster. These checks do not prove live Identity login, real wallet consent or
+external email delivery. See [issuer deployment and privacy boundaries](runbooks/issuer.md).
+
+After building, the optional runtime suite uses real compiled Nitro, restricted PostgreSQL roles,
+Chromium HTTPS and local Mailpit. Set `XCS_TEST_DATABASE_URL` to an isolated disposable cluster and
+start Mailpit on the chosen ports, then run:
+
+```sh
+XCS_ISSUER_RUNTIME_TEST=1 XCS_ISSUER_RUNTIME_SMTP_PORT=5531 \
+  XCS_ISSUER_RUNTIME_MAILPIT_ORIGIN=http://127.0.0.1:8031 \
+  pnpm --dir apps/web exec vitest run test/issuer-runtime.integration.test.ts
+```
+
+This exercises application upload, invitation delivery and claim, and private payload disclosure
+without intercepting issuer endpoints. Approval, sessions and indexed ledger evidence are synthetic
+fixtures; no external mailbox, real Identity client or wallet signature is required.
+
+The default browser suite also runs `issuer-journal.spec.ts`: two real Chromium tabs contend for
+one invitation in native IndexedDB, then reload/recover it. To run only this test without a Nuxt
+server, use `pnpm --dir apps/web exec playwright test --config playwright.issuer-journal.config.ts`.
+
+## Recipient and verifier workspaces (#32 / #33)
+
+`test:postgres` includes `recipient-postgres.integration.test.ts` and
+`verifier-postgres.integration.test.ts`. These exercise real restricted roles, owner/audience
+isolation, current approval, presentation revocation, public field filtering, trust/freshness,
+metadata-only history and CSV. Run against an isolated cluster, sequentially with other role tests.
+
+`e2e/recipient-verifier.spec.ts` covers EN/FR inbox, consented views, sharing/QR/revocation,
+application/history, response invalidation, anti-CSRF reopening and fragment/console hygiene using
+API fixtures. `recipientPayload.test.ts` checks the private same-origin canonical-byte reader and
+login return allowlist; `auth-http.test.ts` covers secure cookie handoff and CSRF.
+
+After building, run the compiled Nitro/HTTPS/Chromium scenario with the same isolated database:
+
+```sh
+XCS_RECIPIENT_RUNTIME_TEST=1 pnpm --dir apps/web exec vitest run \
+  --no-file-parallelism test/recipient-verifier-runtime.integration.test.ts
+```
+
+The root `test:runtime` script includes this scenario. It uses synthetic sessions and indexed evidence
+through actual routes and restricted roles, without live Identity, external SMTP or wallet signing.
+It checks anonymous/wrong-audience/full disclosure, history reopening, revocation and suspension.
+
+## Connected role journey
+
+`e2e/role-journey.spec.ts` checks guided wallet onboarding and factual presentation evidence.
+`role-journey-postgres.integration.test.ts` checks issuer admission and invitation readiness against
+restricted SQL roles. Recipient PostgreSQL tests also cover fresh purpose-bound challenges, signature
+replay, scope/audience mutation, expiration, session changes and legacy links without a signature.
+
+After the production build, the connected HTTPS scenario is included in `test:runtime`, or run:
+
+```sh
+XCS_ROLE_JOURNEY_RUNTIME_TEST=1 pnpm --dir apps/web exec vitest run   --no-file-parallelism test/role-journey-runtime.integration.test.ts
+```
+
+Supply the same isolated `XCS_TEST_DATABASE_URL` and local Mailpit settings used by issuer runtime.
+The test drives actual role APIs and production UI through application approval, invitation delivery,
+claim, wallet-link signing, issuer `CredentialCreate`, recipient `CredentialAccept`, signed sharing
+and verifier disclosure. The GemWallet extension transport and XRPL WebSocket are controlled fixtures;
+the real SDK signs ephemeral synthetic keys held only in Node. Only verified submitted blobs trigger
+synthetic ledger projection changes. Identity sessions, administrator bootstrap and schema/indexer
+prerequisites are fixtures; this is not a live Identity registration or XRPL consensus/indexer test.
diff --git a/docs/adr/0002-public-product-and-discovery.md b/docs/adr/0002-public-product-and-discovery.md
index db6cefd..abc1d50 100644
--- a/docs/adr/0002-public-product-and-discovery.md
+++ b/docs/adr/0002-public-product-and-discovery.md
@@ -1,6 +1,7 @@
 # ADR 0002: Public Testnet product and discovery boundaries
 
-Status: Accepted
+Status: Accepted for the public discovery and accountless Studio boundary. Optional application
+accounts and managed payloads extend the original baseline under [ADR 0005](0005-role-based-application.md).
 
 Date: 2026-08-25
 
@@ -45,18 +46,22 @@ Commons remains neutral. The product displays addresses and the four independent
 dimensions, but provides no issuer badge, ranking, reputation score or universal trust decision.
 Schema registration remains permissionless; visibility does not mean endorsement.
 
-For the beta, credential payloads are public HTTPS documents hosted by the issuer. The browser
-fetches an exact payload only after displaying its host and obtaining consent, then checks its
-integrity locally and sends the parsed object for schema verification. Commons does not store,
-cache, enumerate or search payload claims.
+The original public baseline uses issuer-hosted HTTPS payloads. The browser fetches an exact public
+payload only after displaying its host and obtaining consent, checks integrity locally and sends
+the parsed object for schema verification. Optional signed-upload hosting now stores explicitly
+consented public payloads; the issuer workspace separately stores managed public/private payloads
+under the access rules in ADR 0005. Public discovery still neither enumerates nor searches claims.
 
-The beta has no XCS user account, organization account or custodial signing service. Signing keys
+Public Studio and verification require no application account. Optional account, admin and issuer
+workspaces add server sessions and organization records without a custodial signing service. Signing keys
 remain in the issuer- or subject-controlled wallet behind the pinned XRPL Connect sign-only
 boundary, and the browser journal remains local to the device. The factory covers Xaman, Crossmark,
 GemWallet, WalletConnect, Ledger, Xyra, Otsu and MetaMask Snap, with Xaman and WalletConnect enabled
 only when their public application identifiers are configured. XCS never delegates submission
 through `signAndSubmit`: it verifies, persists and submits the signed transaction itself. Issuance is
-unitary; batch issuance, teams, role-based access and hosted automation are outside the beta.
+unitary; batch issuance, team membership and hosted automation remain outside this implementation.
+The optional issuer portal requires current approval; this does not restrict permissionless protocol
+transactions or the accountless public Studio.
 
 This surface does not promise that every wallet is compatible. WalletConnect discovery is useful
 only when the selected wallet supports the XRPL Testnet namespace and native `Credential*`
@@ -68,8 +73,9 @@ diploma-style credentials.
 
 XRPL Commons operates the shared web application, dual-source indexer, read API and PostgreSQL
 projection for convenience. PostgreSQL is a reconstructible cache of validated ledger history, not
-protocol truth. Commons holds neither signing keys nor credential claims, and independent operators
-may rebuild and compare the same projection.
+protocol truth. The projection holds neither signing keys nor credential claims, and independent
+operators may rebuild and compare it. Optional application/payload storage is separate, contains
+claims and cannot be reconstructed from ledger history; it requires its own access controls and backups.
 
 ## Consequences
 
@@ -78,9 +84,10 @@ may rebuild and compare the same projection.
   browsing remains unavailable.
 - The Explorer cannot offer a global attestation feed identical to EASScan. This is an intentional
   privacy/product boundary, not an indexing limitation.
-- Issuers must operate a CORS-compatible HTTPS payload host and retain the exact canonical bytes.
-- The accountless beta avoids authentication and multi-tenant authorization state, but its local
-  operation history does not automatically follow an issuer across browsers or devices.
+- External payload hosts must support browser CORS and retain exact canonical bytes. Optional hosted
+  storage adds deployment and retention responsibilities without changing protocol integrity rules.
+- Accountless public routes remain available alongside optional authenticated workspaces. Browser-local
+  operation recovery does not automatically follow an issuer across browsers or devices.
 - Xaman and WalletConnect application identifiers are public browser configuration, not signing
   secrets. Removing them or restricting the adapter factory is a wallet-only rollback with no
   protocol or database-schema migration.
@@ -88,7 +95,10 @@ may rebuild and compare the same projection.
   moderation must never rewrite protocol validity.
 - Product and API additions remain non-normative and backward-compatible with frozen v0.1 data.
 
-## Alternatives rejected for the beta
+## Alternatives rejected for the original public baseline
+
+The payload-hosting and account exclusions below describe the initial decision. ADR 0005 and the
+implemented optional hosting/portal flows now extend those two boundaries; the other exclusions remain.
 
 - cloning the EAS protocol or storing attestations in an EVM contract;
 - a public feed or subject-address directory of every indexed Credential;
diff --git a/docs/adr/0004-two-standalone-apps.md b/docs/adr/0004-two-standalone-apps.md
index caa7992..12f563e 100644
--- a/docs/adr/0004-two-standalone-apps.md
+++ b/docs/adr/0004-two-standalone-apps.md
@@ -41,9 +41,11 @@ ran it. In practice it is an externally managed instance.
   same origin: `/v1/**`, `/health/*`, `/internal/metrics*` and `/documentation`.
 
 Each carries its own `package.json`, `pnpm-lock.yaml`, `.npmrc`, `.prettierrc.json`, tsconfig,
-`Dockerfile` and `.env.example`, and is deployed on its own with `gh deploy-setup` run from its own
-directory. Both Dockerfiles use the repository root as build context so the image can also copy `db/`
-and `config/`; nothing under `packages/` enters either image.
+`Dockerfile` and `.env.example`. Two one-purpose component directories package existing artifacts:
+`apps/notifier` runs the compiled web notification worker and `apps/db-bootstrap` runs the compiled
+indexer bootstrap command. `gh deploy-setup` discovers all four components from the repository root
+and creates one deployment with a web service, two workers and one pre-deploy job. All Dockerfiles use
+the repository root as build context; nothing under `packages/` enters a runtime image.
 
 **No shared code between the applications.** Neither imports `@xcs-protocol/*` or any other workspace
 package. The protocol and database code each one needs is copied into it as plain source:
@@ -73,8 +75,8 @@ applications.
 
 ### What this buys
 
-- Each application deploys, scales, rolls back and is audited on its own. A web rollback touches
-  nothing the indexer writes.
+- Each long-running application scales and rolls back independently inside one deployment. A web
+  rollback touches nothing the indexer writes.
 - The SSR hop is gone, and with it `NUXT_API_BASE_URL`, `NUXT_API_INTERNAL_TOKEN`,
   `NUXT_PUBLIC_API_BASE_URL`, the internal-token plugin, the SSR rate-limit middleware and the
   `x-xcs-internal-token` / `x-xcs-client-key` headers. One fewer process, one fewer shared secret,
@@ -82,32 +84,32 @@ applications.
 - Each lockfile describes exactly one deployable, so `pnpm audit` and `pnpm licenses list` report on
   what actually ships.
 - An image contains only its own application, `db/` and `config/`.
-- Removing the production Compose overlay removed every `*_FILE` secret variable and the class of
-  bind-mount permission problems that came with them.
+- Removing the production Compose overlay removes its prescribed secret-file bind mounts.
+  Hosted secret provisioning now belongs to the deployment operator; local Compose is not a
+  production secret-management contract.
 
 ### What it costs
 
-- **The copies are maintained by hand, and nothing enforces it.** A protocol fix in `packages/core`
-  with a green package suite changes nothing in either application until a human mirrors it — no
-  build, type check or test will say so. The rule (land in `packages/core` first, mirror into both
-  applications in the same pull request, keep the header comments current) lives in
-  `CONTRIBUTING.md`, and code review is the only control. For a security-relevant fix this is a real
-  correctness risk, accepted deliberately in exchange for independent deployability.
-- Drift can also run the other way: a change made only in an application copy leaves the published
-  library stale.
-- The same third-party dependency now appears in two lockfiles. `drizzle-orm` in particular must stay
-  identical in both, because `db/schema/` is compiled by each application against its own copy, and
-  nothing checks this automatically.
+- **The copies are maintained by hand.** CI's `ops/ci/check-vendored-copies.mjs` checks parity with
+  the reference source, allowing import rewrites and explicitly reviewed divergences pinned to a
+  source digest. It detects an unmirrored source change or an unreviewed application-only edit,
+  but does not generate the copies or validate deployed behavior. Follow `CONTRIBUTING.md`: land
+  protocol changes in the reference source, mirror both applications and run the owning app gates.
+- A change made only in an application copy does not update the published library. The parity gate
+  and review must accompany independent application builds and tests.
+- The same third-party dependency appears in two lockfiles. `drizzle-orm` must stay identical because
+  `db/schema/` is compiled by each application against its own copy;
+  `ops/ci/check-drizzle-parity.mjs` enforces this in CI.
 - **`--ignore-workspace` is mandatory** on every per-app pnpm command that resolves dependencies
   (`install`, `audit`, `licenses list`). Without it pnpm silently operates on the root workspace and
   still exits 0, so a report can look green while covering the wrong lockfile.
 - Three separate CI units (packages, web, indexer) with three installs; more wall-clock time.
-- The repository no longer ships a production deployment topology. Database provisioning, secret
-  storage and a hosted monitoring stack are now the operator's design. `ops/monitoring/` still
-  provides the alert rules, dashboard and scrape configuration.
-- The two applications are versioned and deployed independently, so a deployment can run mismatched
-  revisions. They share only database rows and there is no version negotiation between them; a schema
-  change must be rolled out in a compatible order.
+- The repository declares the four DigitalOcean application components, while PostgreSQL, private
+  object storage, SMTP, identity registration, secrets and hosted monitoring remain operator-managed.
+  `ops/monitoring/` provides the alert rules, dashboard and scrape configuration.
+- The two applications share only database rows and there is no runtime version negotiation between
+  them. App Platform now builds them from one repository revision, but a database change still needs
+  a compatible PRE_DEPLOY migration and rollback plan.
 
 ### Unchanged
 
diff --git a/docs/adr/0005-role-based-application.md b/docs/adr/0005-role-based-application.md
new file mode 100644
index 0000000..5ebf96f
--- /dev/null
+++ b/docs/adr/0005-role-based-application.md
@@ -0,0 +1,219 @@
+# ADR 0005: role-based application boundary
+
+Status: accepted. Optional authentication, admin approval, issuer, recipient/presentation and
+verifier workspaces are implemented.
+
+Date: 2026-09-23
+
+Tracks [issue #24](https://github.com/XRPL-Commons/XCS/issues/24).
+
+## Context
+
+[ADR 0002](0002-public-product-and-discovery.md) defines the public discovery and accountless Studio
+boundary. Optional accounts and operator-approved roles now coexist with those public routes.
+This record distinguishes accepted access decisions from their implementation: authentication,
+admin review, issuer onboarding/issuance, recipient acceptance/sharing and verifier history are
+implemented alongside the accountless public routes.
+
+## Accepted decision: portal approval, not protocol permission
+
+Option A was selected: an organization must apply and receive an administrator's approval before
+publishing schemas or issuing credentials through the optional issuer portal. Verifiers
+also apply for an approved role; access to private details additionally requires the recipient's
+authorization as defined below.
+
+Recipients claim an issuer's invitation, link their own wallet and accept the credential through
+that wallet. Public schema discovery and exact public credential verification remain available
+without an application account. An approved verifier role is not required to check public evidence.
+
+Approval means permission to use the relevant portal features, not Commons endorsement of an
+organization, its claims or the trustworthiness of a credential.
+
+These restrictions belong to the Commons application, not the XCS protocol. Independent operators
+can deploy their own instance and choose their admission policy without Commons approval.
+Permissionless XRPL schema registration and credential transactions remain possible outside the
+portal. The indexer must not reject otherwise valid protocol records because their issuer lacks a
+Commons account or approval.
+
+## Invariants
+
+- Validated XRPL ledgers remain authoritative for schemas and credential lifecycle.
+- Application accounts, invitations and approvals do not redefine protocol validity.
+- Signing keys remain in user wallets through the XRPL Connect sign-only boundary.
+- Public discovery does not become a subject-wide credential directory or a claims search engine.
+- Private claims must not be exposed by public APIs, search or ledger projections. Public on-chain
+  metadata cannot become private through an application visibility setting.
+
+## Accepted decision: organizations are distinct from user accounts
+
+For issue #25, option A was selected: an organization has its own stable application identity,
+separate from the human account that manages it. The first version has one responsible user per
+organization, without team invitations, shared logins or a general membership/permissions system.
+
+Application ownership of an organization's schemas and its identity as the designated verifier
+must reference the organization, not be conflated with its responsible user's personal identity.
+Private access requires an authenticated user authorized to act for that specific organization,
+its current verifier approval and the recipient's matching sharing grant.
+
+This application ownership does not replace the XRPL publisher or issuer address and does not
+prove control of an organization's signing wallet. Linking a wallet still requires proof of control.
+Changing the responsible user must not silently transfer wallet control or rewrite ledger history;
+an ownership-transfer workflow is outside this initial scope.
+
+## Accepted decision: invitation possession authorizes claiming
+
+For issue #25, option B was selected: any authenticated account holding a valid, unclaimed
+invitation link may claim it. The account does not need to prove ownership of the invited email
+address. That address is a delivery contact, not evidence of the claimant's identity or ownership
+of their account. Claiming an invitation must not mark an email as verified.
+
+Claiming requires an explicit authenticated action, not opening the link or following an email
+scanner's request. Bind the invitation atomically to the first successful claimant; replay or a
+concurrent claim cannot assign it to a second account. Store only the token hash, generate tokens
+with a standard cryptographically secure random source, and exclude raw tokens from logs and
+analytics. Revoked or expired invitations cannot be claimed. The exact invitation lifetime remains
+a separate decision from unlimited private sharing.
+
+The claimant must still prove control of a linked wallet before issuance. Claiming does not emit
+or accept a credential: those remain separate wallet-authorized actions. The issuer must see the
+actual claimant and verified wallet before signing, rather than treating the delivery email as
+proof that the intended person claimed the link.
+
+Forwarding or leaking an unclaimed invitation can therefore let another account claim it. This is
+the accepted trade-off of the link-based policy; single-use redemption does not prevent a stolen
+link from being used first. It never changes the separate requirement that private presentations
+be bound to a designated, approved verifier.
+
+## Accepted decision: recipient-authorized verifier access
+
+Option B was selected: an approved verifier must also have a recipient-authorized presentation
+to access a credential's private details. Approval alone, knowledge of an exact credential reference,
+or the credential's on-chain acceptance is not consent to disclose private claims.
+
+This deliberately narrows issue #24's proposed approved-verifier access. The grant must be limited
+to the credential and disclosure scope authorized by its recipient, and revocable.
+The server must check both the verifier's current approval and the presentation's current validity
+before returning private data. Revocation prevents further access; it cannot erase copies
+already retrieved. Revoking a presentation does not revoke the on-chain credential.
+
+## Accepted decision: bind sharing to a specific verifier
+
+Option A was selected: the recipient chooses the verifier organization when authorizing a private
+presentation. Access is bound to that verifier's application identity and requires authentication;
+another approved verifier cannot use a forwarded link to read the private details. Possession of
+the link is not an access grant by itself.
+
+The server must match the authenticated verifier identity to the presentation's intended audience
+as well as checking approval, disclosure scope and revocation. The audience must be bound
+to a stable application identifier, not merely a display name or a client-supplied organization.
+This decision does not introduce shared logins or an organization-wide team membership model.
+
+## Accepted decision: no automatic sharing expiry
+
+The recipient's sharing authorization has no automatic time limit or renewal requirement. It
+remains revocable by the recipient, and access still requires the designated verifier's authenticated
+identity and current approval on every request. Loss of approval blocks access even when the
+recipient has not revoked the grant.
+
+This replaces the earlier time-bounded sharing proposal. Do not implement an implicit presentation
+TTL or use a distant sentinel date to represent unlimited duration. Authentication sessions may
+still expire and require sign-in again; that is independent of the sharing authorization.
+
+Unlimited sharing does not extend a credential's validity, undo its on-chain revocation or guarantee
+permanent payload availability. Verification must continue to report the actual credential state.
+
+## Accepted decision: no automatic administrator access
+
+Option A was selected: the application administrator role grants no automatic access to private
+credential claims. Managing accounts and approvals must not bypass the private-data authorization
+checks or expose claims through administrative views, exports or support tooling.
+
+An administrator seeking access as a verifier must hold an approved verifier role and receive a
+recipient-authorized presentation addressed to that verifier identity, under the same rules as
+other verifiers. An administrator who is independently the credential's issuer or recipient relies
+on that relationship, not on an administrator override.
+
+This is an application authorization boundary, not a claim of end-to-end encryption or protection
+against privileged infrastructure operators. Access to application-review documents is a separate
+administrative function and must not be confused with access to private credential claims.
+
+## Accepted decision: global verifier approval, no issuer allowlist
+
+Option A was selected: global portal approval is sufficient for a verifier to be eligible for a
+recipient's sharing grant. Access still requires authentication as the designated verifier and a
+non-revoked grant covering the credential and requested disclosure scope. Global approval alone
+never grants access to private claims.
+
+There is no additional per-issuer verifier allowlist. Do not introduce an issuer-verifier approval
+table, issuer-specific access gate or allowlist management screen for this flow. This changes the
+per-issuer allowlist proposal in issues #25 and #30; implementation must follow this decision.
+
+## Implementation status
+
+### Managed issuer payload storage (#31)
+
+The issuer workspace stores canonical payload bytes in private PostgreSQL application tables through
+a separate restricted `xcs_issuer` connection. The on-chain HTTPS URI uses an opaque `/q/` locator
+and the digest of the full canonical bytes. Publication records are bound to an exact validated
+credential generation, schema, issuer wallet and recipient wallet before disclosure begins.
+
+For private credentials, the issuer's current responsible account and the recipient may retrieve
+full bytes. Anonymous requests receive only the issuer-selected public claim fields after validated
+issuance; full payload digests cannot be verified from this projection. Administrator status confers
+no extra access. Verifier presentation endpoints use the same authorization boundary, including
+the recipient's designated audience, current approval and revocation.
+
+Private bytes are never written to the accountless public hosting endpoint or browser recovery
+storage. This is application authorization, not end-to-end encryption: database administrators and
+backups can contain full payloads. Public disclosure is irreversible in practice; a later setting
+cannot recall copies. Keep private backups and document their retention with the deployment.
+
+The recipient workspace reviews private bytes only after explicit consent, using same-origin
+authenticated reads and local digest/schema checks. Private claims never pass through `/v1/verify`.
+Existing accountless Studio routes and previously public payloads retain their public behavior.
+
+Issue #25 implements the [application data model and server-side helpers](../database-app.md).
+Issue #27 adds optional authentication, sessions and wallet linking; see the [authentication runbook](../runbooks/authentication.md).
+Issues #30 and #31 add admin approval and the issuer workspace, including authorization-aware
+private payload reads and role-protected mutations; see the [issuer runbook](../runbooks/issuer.md).
+Issues #32 and #33 add recipient presentations and verifier application/history; see the
+[recipient/verifier runbook](../runbooks/recipient-verifier.md).
+
+## Presentation boundary (#32 / #33)
+
+Recipients create public projections or full presentations for a designated verifier organization.
+A private credential's public presentation always contains only issuer-selected public fields, even
+for its owner. Already-public credentials retain their public claims. Anonymous or wrong-audience
+viewers of a full grant receive the public projection and an authorization hint. Revoked or unknown
+grants return the same unavailable response. Successful authorized resolution holds the grant lock
+through disclosure and metadata-history insertion, serializing revocation against that disclosure.
+
+The recipient sees all active links for each credential and can revoke them. Creation is limited to
+200 active links per credential under a transaction lock; revoked history is bounded. Tokens are
+returned once and stored only as hashes. `/presentations#token` removes the fragment before an
+explicit POST. Login handoff uses a ten-minute Secure, HttpOnly, SameSite=Lax cookie; its expiry
+is independent of the unlimited sharing grant. No token or private claim enters browser recovery.
+
+Verifier history and CSV contain metadata and verification dimensions, never claims or bearer tokens.
+Reopening history is an authenticated CSRF-protected POST that rechecks current grant and approval.
+Portal approval remains distinct from issuer trust. Projected public claims cannot prove full-payload
+integrity: successful internal validation is exposed as `not_checked` for that partial view.
+
+## Dated holder proof and visible portal admission
+
+The completed issuer/recipient/verifier journey shows current portal admission as a factual
+application status, separate from issuer trust and ledger verification. It does not infer approval
+at issuance from the current organization row or endorse the truth of claims. The presentation link
+resolves all technical references; the viewer does not enter an address, URI or schema manually.
+
+Each new presentation requires a fresh text signature from the credential subject's currently linked
+wallet. Its server-generated challenge is purpose-separated from wallet linking and binds the exact
+credential, site, scope, audience and public disclosure. Atomic consumption prevents replay or a
+second grant from the same signature. The challenge expires after five minutes, independently of
+the existing unlimited, revocable grant. Signature evidence is stored separately from metadata-only
+verification history and is checked again on resolution. Legacy unsigned links are explicitly marked
+as lacking this evidence; they do not inherit a proof from the account's earlier wallet-link event.
+
+This is a dated master-key signature, not proof of the current visitor's identity, current wallet
+presence or current ledger authorization after master-key disabling. Existing private-field audience
+checks remain mandatory even with a valid signature. Anonymous minimal verification remains available.
diff --git a/docs/adr/0006-nuxt-api-boundary.md b/docs/adr/0006-nuxt-api-boundary.md
new file mode 100644
index 0000000..0020c47
--- /dev/null
+++ b/docs/adr/0006-nuxt-api-boundary.md
@@ -0,0 +1,59 @@
+# ADR 0006: serve the API in Nuxt with separate database privileges
+
+Status: accepted for issue #28.
+
+## Decision
+
+Nuxt owns the site and the existing REST API through native Nitro handlers. The indexer remains
+an independent worker; PostgreSQL remains external to both processes (managed in production,
+available in local Compose). The standalone `apps/api` service is removed, not proxied internally.
+Existing `/v1/...`, payload, health and operational endpoints keep their paths and contracts.
+
+Two server-only Nuxt connections enforce different privileges:
+
+- `XCS_DATABASE_URL` uses `xcs_api` for read-only ledger projections.
+- Optional `XCS_PAYLOAD_DATABASE_URL` uses `xcs_payload_writer` for hosted payloads and demo
+  pinning. It can insert immutable hosted content and publication records and modify demo-pinning
+  tables; it cannot write ledger projections or perform DDL.
+
+The independent indexer keeps `xcs_indexer`; only administrative bootstrap owns schema changes.
+Credentials are distinct and no database URL enters browser runtime configuration.
+
+## Rationale and consequences
+
+The issue asks for two application services without removing existing public payload hosting.
+A read-only Nuxt connection alone cannot publish payloads. A second restricted pool preserves
+that feature without granting publication code the indexer's authority or keeping a third service.
+This is a privilege boundary, not process isolation: compromising Nuxt exposes both configured
+pools. The grants still prevent projection writes by either pool.
+
+Browser calls are same-origin by default. SSR calls the same handlers locally, so the former
+shared SSR token/HMAC forwarding scheme and private API URL disappear. Public IP request budgets,
+bounded bodies, CORS, payload checks and fail-closed readiness remain. Ingress client-IP forwarding
+is trusted only for explicitly configured narrow `XCS_TRUSTED_PROXY_CIDRS`.
+
+Nitro entry points live in `server/routes`, not `server/api`, to preserve `/v1` rather than
+introducing an `/api/v1` prefix. Domain services live under `server/xcs` and remain independent
+of Nuxt's auto-imports. `/documentation` is an HTML endpoint index linked to the OpenAPI JSON;
+the standalone Swagger UI dependency is removed.
+
+The API transport owns body limits and quotas rather than enabling duplicate Nuxt Security
+middleware. The installed module's limiter trusts forwarding headers directly, while its size
+guard relies on Content-Length. Native H3 handlers preserve explicit proxy trust, bounded chunked
+reads and the existing JSON error contract; Ajv and fast-json-stringify reuse the API schemas.
+
+## Rollout and rollback
+
+Stop the old API writers, back up the database, rerun administrative bootstrap with the new writer
+password, then deploy Nuxt with the restricted pools. No ledger replay, database reset or schema
+rewrite is required for this boundary change. Preserve existing API and payload hostnames through
+ingress routing and preserve the site's origin so signed-operation recovery remains available.
+
+The old API loses publication rights when bootstrap runs. Rolling its image back requires an
+explicit grant rollback as well; administrator credentials are never an acceptable workaround.
+See [deployment](../runbooks/deployment.md) and [API surfaces](../api-surfaces.md).
+
+## Non-goals
+
+This decision does not introduce accounts, organizations, roles, private payloads, protocol changes,
+or additional API capabilities. Those require separate issues and product decisions.
diff --git a/docs/adr/0007-guided-role-portals.md b/docs/adr/0007-guided-role-portals.md
new file mode 100644
index 0000000..f17e005
--- /dev/null
+++ b/docs/adr/0007-guided-role-portals.md
@@ -0,0 +1,60 @@
+# ADR 0007: make role portals the only web mutation journeys
+
+Status: accepted.
+
+## Decision
+
+The web application exposes three task-oriented entry points: `/issuer`, `/recipient`, and
+`/presentations`. Each presenter derives one next business action from server-authorized state. The
+derived state is guidance only; every server mutation continues to enforce the session, role,
+organization, wallet, disclosure, audience, freshness, and anti-replay rules that existed before
+this decision.
+
+The browser no longer asks a business user to enter an XRPL address, UID, hash, URI, network
+profile, generation identifier, or JSON. Internal DTOs and internal URLs may retain those values so
+the change requires neither a protocol change nor a database migration. Public read-only Explorer
+pages, `/v1`, the CLI, and developer documentation retain their exact technical interfaces.
+
+The former mutation pages remain only as locale-preserving redirects which discard query strings
+and fragments:
+
+| Previous path       | Destination           |
+| ------------------- | --------------------- |
+| `/studio`           | `/`                   |
+| `/schemas/register` | `/issuer/schemas/new` |
+| `/issue`            | `/issuer/recipients`  |
+| `/accept`           | `/recipient`          |
+| `/revoke`           | `/issuer/credentials` |
+| `/verify`           | `/presentations`      |
+| `/operations`       | `/account`            |
+
+Wallet signatures remain explicit. A readable summary precedes every signature, and the existing
+transaction engine rechecks the session, selected organization, wallet, recipient, network,
+credential generation, and current ledger evidence immediately before and after signing. XCS does
+not create, recover, or retain private keys.
+
+Invitation and presentation bearers stay in URL fragments. The browser removes the fragment before
+an API call and uses the existing one-time, HttpOnly OIDC handoff when authentication is required.
+Only bearer hashes persist in PostgreSQL. Presentation authorization proofs remain distinct from
+account wallet-link proofs and each sharing grant requires a fresh recipient-wallet challenge.
+
+## Structure
+
+Application-facing DTOs and discriminated `nextAction` values live in `app/types/portal.ts`.
+Pure presenters produce issuer, recipient, and invitation progress states. Shared portal utilities
+own the route allowlists, mutation state, readable errors, wallet progression, and organization
+application form. They never replace repository authorization.
+
+Issuer and verifier applications share a neutral server application domain. The issuer,
+recipient, presentation, verifier, and admin repositories otherwise keep their existing boundaries;
+this decision does not introduce a workflow framework or a broad repository rewrite.
+
+## Compatibility and rollback
+
+There is no change to the XCS protocol, ledger formats, cryptographic proof formats, public `/v1`
+contracts, or migrations `0000`–`0008`. Existing bookmarks reach the new portals through the fixed
+redirects, but technical query inputs are intentionally ignored.
+
+Rollback is the previous application image. No data restoration or down migration is needed.
+Operators must keep managed private payload readers available at already-issued URLs during either
+version, as required by the issuer runbook.
diff --git a/docs/api-surfaces.md b/docs/api-surfaces.md
new file mode 100644
index 0000000..d2bdf4d
--- /dev/null
+++ b/docs/api-surfaces.md
@@ -0,0 +1,237 @@
+# XCS API surfaces in Nuxt
+
+The API exposes rebuildable, read-only XCS projections. Ledger-derived routes run in a read-only
+repeatable-read snapshot and fail with `503` unless the indexer has a live writer lease, a fresh
+checkpoint, and consistent dual-source evidence. The API is served by native Nitro handlers in `apps/web/server/routes`; there is no separate API
+service. `/documentation` lists routes; `/documentation/json` serves their OpenAPI contract.
+
+This REST API is the public integration contract for the accountless Testnet beta; GraphQL is not
+part of the beta. XRPL Commons may operate a shared instance, but PostgreSQL remains a reconstructible
+ledger projection rather than protocol truth. The API never accepts a signing seed or private key,
+and it does not persist credential payload claims submitted for verification.
+The separately enabled Testnet publication service below stores explicitly published public
+payloads; it is not enabled by verification requests.
+
+Nuxt serves `/v1/*`, `/p/*`, health and protected metrics on the site origin. Server-side page
+requests call the same handlers locally; there is no private HTTP hop or shared SSR token.
+`XCS_DATABASE_URL` is the read-only projection connection (`xcs_api`). Optional publication
+and demo pinning require a separate `XCS_PAYLOAD_DATABASE_URL` (`xcs_payload_writer`), whose
+writes are restricted to hosting and pinning tables. Neither pool can alter indexed evidence.
+
+When the public API is behind a reverse proxy, set `XCS_TRUSTED_PROXY_CIDRS` to the exact IP/CIDR of
+that proxy only after configuring it to remove any client-supplied forwarding headers and write its
+own canonical `X-Forwarded-For`. With the variable unset, the server deliberately ignores forwarded
+addresses and rate-limits by the direct peer. Wildcards and named proxy presets are rejected.
+Catch-all IPv4 or IPv6 `/0` ranges are also rejected; keep every allowed range as narrow as the
+actual ingress network.
+
+## Deployment probes
+
+`GET /health/live` and its compatibility alias `GET /health` report only that the API process can
+serve requests. `GET /health/ready` additionally checks PostgreSQL plus every configured network's
+live writer lease, dual-source agreement, checkpoint root and freshness. Use liveness to decide
+whether to restart the container; use readiness to decide whether the deployment may receive
+authoritative traffic. A catching-up or halted indexer must make readiness return `503` without
+restarting an otherwise healthy API process.
+
+All three probes return `Cache-Control: no-store` and are intentionally outside the public request
+rate-limit budget so monitoring cannot make its own next check fail. Restrict direct probe access to
+the load balancer and monitoring network at the ingress; this is especially important for
+`/health/ready`, which performs database reads. The Compose healthcheck uses `/health/live` without
+requiring a second service.
+
+## Operational metrics
+
+Set a dedicated `XCS_METRICS_TOKEN` to expose `GET /internal/metrics`. Its presence is the only
+enablement switch. The token must contain 32–256 URL-safe characters and is presented as
+`Authorization: Bearer <token>`. The route is absent
+when the token is absent, hidden from OpenAPI, non-cacheable, and outside public request budgets. Restrict it
+to the monitoring network at the ingress even though the token is mandatory.
+
+The versioned JSON snapshot reports each enabled profile's source tips, ledger lag, current
+checkpoint hash/age, active continuity halt, and accepted/rejected schema-registration totals. It
+also reports cluster client-connection count, configured PostgreSQL connection ceiling, logical
+database size, process-local rate-limit totals, and server-side payload-resolution outcomes. It
+never stores an IP, client key, URI, issuer, subject, payload, or error message. If PostgreSQL is
+unavailable, the route deliberately remains `200`, marks the database unavailable, and preserves
+the process counters; `/health/ready` remains the deployment availability signal. The stable
+`database.errorCode` distinguishes `DATABASE_UNAVAILABLE` from `METRICS_EVIDENCE_INVALID`; the
+latter means PostgreSQL answered but its projection evidence could not be represented safely.
+
+The response's `coverage` object is part of the honesty boundary. Continuity covers only the
+currently durable halt, payload counters cover only the optional server resolver, and browser-local
+XRPL submission outcomes are not visible to the API. `logicalSizeBytes` is not physical free disk,
+and cluster connection count is not postgres.js pool saturation. Those missing signals require
+separate infrastructure exporters or a privacy-reviewed design rather than invented API metrics.
+
+## Discovery boundary
+
+All valid permissionless schemas and aggregate network statistics are public. Schema visibility is
+not Commons endorsement, and the API returns no issuer badge, ranking or universal trust decision.
+Credential reads remain exact: the caller supplies shared generation, transaction or complete
+issuer/subject/schema coordinates. There is no subject feed, account-wide Credential enumeration or
+claims search. A future browsable Credential catalog requires a separately designed explicit opt-in
+signal. See [`ADR 0002`](./adr/0002-public-product-and-discovery.md).
+
+The Commons-hosted instance must leave `XCS_TRUSTED_ISSUERS` and `XCS_UNTRUSTED_ISSUERS` empty, so
+its `issuerTrust` result remains `unknown`. A self-hosted verifier may configure those lists as its
+own local policy; that result is not a Commons or protocol-level assertion.
+
+## Discovery routes
+
+The implemented discovery reads are:
+
+| Route                                                            | Public result                                                                                                    | Pagination and scope                                                                                               |
+| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| `GET /v1/networks/:network/stats`                                | Schema/publisher totals, Credential generation lifecycle counts and the authoritative checkpoint                 | Aggregate only; lifecycle state is evaluated at checkpoint close time                                              |
+| `GET /v1/networks/:network/schemas`                              | Valid schema projections, optionally restricted by exact `publisher`                                             | Opaque `cursor`; `limit` defaults to 20 and is capped at 100                                                       |
+| `GET /v1/networks/:network/search?q=...`                         | Schema text/publisher matches, or exact hash matches for a schema UID, generation ID and indexed XCS transaction | `q` must be trimmed, contain a letter/number and have 2–128 characters; `limit` defaults to 20 and is capped at 50 |
+| `GET /v1/networks/:network/activity`                             | Accepted and rejected schema-registration events in reverse ledger order                                         | Schema registrations only; opaque `cursor`; `limit` defaults to 20 and is capped at 100                            |
+| `GET /v1/networks/:network/credential-generations/:generationId` | One exact generation, its checkpoint-relative lifecycle state and validated event timeline                       | No subject or issuer listing                                                                                       |
+| `GET /v1/networks/:network/transactions/:transactionHash`        | One exact indexed XCS transaction with an optional schema registration and Credential events                     | Credential events use a node-index cursor; `limit` defaults to 20 and is capped at 100                             |
+
+Search deliberately changes behavior by input shape. A 64-digit hexadecimal value is treated only
+as an exact UID/generation/transaction coordinate. A classic XRPL address returns schemas published
+by that address, never Credentials where it is issuer or subject. Other text searches only schema
+names and descriptions. Search is a bounded entry point: it returns `hasMore` but has no cursor; use
+the schema list for paginated browsing. All routes above validate the same live checkpoint and
+projection evidence as existing authoritative reads and return `503` rather than serve stale or
+inconsistent data. They return ledger metadata only and never fetch or return payload claims.
+
+## Signing readiness
+
+`GET /v1/networks/:network/readiness` is the profile-bound authorization for starting a wallet
+signing side effect. A `200 ready` response contains the authoritative checkpoint after validating
+the live writer lease, dual-source quorum, checkpoint root and freshness. Invalid profile input
+returns `400`, a missing profile returns `404`, exhausted request budget returns `429`, unavailable
+authority returns `503`, and an unexpected server failure returns `500`.
+
+Every outcome carries `Cache-Control: private, no-store`; the browser also requests `no-store`.
+Ingresses and CDNs must preserve that response header and must never cache or synthesize readiness
+responses. `/v1/networks/:network/status` remains diagnostic and may return `200` while the indexer
+is starting, catching up, halted or no longer authoritative. `/health/ready` is a deployment-wide
+load-balancer probe and is not a substitute for the per-profile decision.
+
+Schema changes use reviewed migrations and an administrative bootstrap; never reset a running
+projection merely to deploy Nuxt. See the [deployment runbook](./runbooks/deployment.md).
+
+An organization can reconcile a schema registration transaction without receiving its full memo:
+
+```text
+GET /v1/networks/:network/schema-registrations/:transactionHash
+```
+
+The response contains `registration: null` until that transaction has been indexed. Accepted
+registrations include the schema UID and the SHA-256 digest of the exact canonical registration-memo
+JSON, before schema normalization; rejected registrations include only their protocol reason code.
+`memoJson` is never exposed by this route.
+
+Credential verification and demo pinning fail with `SCHEMA_PROJECTION_INVALID` and HTTP `503` when
+an indexed schema definition, resolved field set, or inheritance lineage is inconsistent. They never
+validate or pin a payload against a partial schema projection. Exact-schema, schema-list,
+verification, and pinning reads load every claimed ancestor and its accepted registration event in
+the same repeatable-read snapshot. The API recomputes every schema UID and every inherited field set
+before trusting or exposing the stored projection.
+
+## Payload verification outcomes
+
+`POST /v1/verify` reports payload state independently as `valid`, `unavailable`, `tampered`,
+`invalid`, or `not_checked`. A non-conforming native URI is `invalid`; DNS, timeout, transport,
+redirect, and non-success HTTP failures are `unavailable`; more than 1 MiB of actually received
+bytes is `invalid`; a digest mismatch is `tampered`; and digest-matching bytes still have to pass
+UTF-8, strict JSON, JCS, envelope linkage, and resolved-claim validation before becoming `valid`.
+Low-level network errors and payload contents are never copied into the report.
+
+The resolver uses one five-second deadline across HTTPS DNS lookup, redirects, response headers and
+body reading. It reads at most 1 MiB plus the byte needed to prove a size violation, preserves DNS
+pinning and rejects private answers or unsafe redirects. `Content-Length` and `Content-Type` are not
+used as normative evidence: either can be missing or inaccurate, while the received bytes and
+on-ledger SHA-256 binding are authoritative. Issuers should still serve the JSON media type for
+browser interoperability.
+
+When the request supplies a parsed `payload` JSON value instead of `resolvePayload: true`, the API
+recanonicalizes that value, then applies the same integrity-first classification and structural
+validation as the retrieval path. This path cannot prove the caller's pre-parse byte order or detect
+duplicate keys already discarded by an upstream JSON parser; use retrieval of the exact
+issuer-hosted bytes when byte-level JCS evidence is required. Server-side retrieval remains disabled
+by default and in the Commons-hosted beta configuration.
+
+Demo pinning additionally requires a live indexer writer lease and a fresh, matching dual-source
+checkpoint. Freshness is evaluated with PostgreSQL time, and every schema-ancestor ledger must fall
+between network activation and that checkpoint. Authority failures return the same stable indexer
+`503` errors as verification and occur before the challenge is consumed, quota is reserved, or
+content is written.
+
+Credential event history and exact-transaction responses expose the event's `ledgerHash`,
+`transactionIndex`, and resulting `accepted` flag in addition to the transaction and credential
+tuple. Transaction hashes supplied in uppercase are accepted and returned as lowercase hexadecimal.
+
+## Optional hosted Testnet payloads
+
+Disabled when its deployment contract is absent. Supplying any hosted-payload value requires the
+complete contract: a short HTTPS origin in `XCS_PUBLIC_PAYLOAD_BASE_URL` (no path or trailing slash),
+comma-separated profile IDs in `XCS_HOSTED_PAYLOAD_NETWORKS`, a distinct
+`XCS_PAYLOAD_STORAGE_IP_HASH_SECRET` of at least 32 bytes and the `xcs_payload_writer` connection in
+`XCS_PAYLOAD_DATABASE_URL`. The browser-visible origin is derived from that same validated contract;
+there is no second public setting to keep synchronized. The origin must keep the complete credential
+URI within XRPL's 128-byte limit.
+
+- `POST /v1/payloads/:locator` accepts `network`, `payloadBase64` and `signedTransactionBlob`.
+  It verifies the signature, exact URI/digest, issuer, subject, resolved schema and indexed
+  successful creation under fresh ledger evidence. Only Testnet network ID 1 is accepted.
+- `GET /p/:locator` (and HEAD) serves the exact canonical bytes with an immutable cache header.
+  Existing 20-hex locators remain readable; new publications use 18 hex characters.
+- Maximum size is 64 KiB; publication is idempotent for the same transaction and content.
+  Daily quotas are 50 publications per issuer and hashed requester IP. An existing locator
+  cannot be overwritten with different bytes. Claims field names are not a privacy filter;
+  publish only deliberately public, non-sensitive test data.
+
+The payload and quota records persist in PostgreSQL. Include these tables in backups: replaying
+XRPL cannot reconstruct off-chain payload bytes. Quota or availability failures can occur after
+the ledger transaction succeeds; the browser's publication recovery retries the same signed
+transaction without creating another credential. See [web recovery](../apps/web/README.md#hosted-https-payloads).
+
+## Optional recipient and verifier APIs
+
+These same-origin `/api` routes share the enabled issuer service and its restricted application pool.
+They are private, `no-store` and `no-referrer`, with session authorization, bounded request bodies and
+rate limits. Authenticated mutations require CSRF. They are separate from the public `/v1` contract.
+
+| Route                                                     | Purpose                                                                      |
+| --------------------------------------------------------- | ---------------------------------------------------------------------------- |
+| `GET /api/recipient/workspace`                            | Owned invitations, credentials and event notifications                       |
+| `GET /api/recipient/verifiers`                            | Eligible approved verifier organizations                                     |
+| `GET /api/recipient/credentials/:profileId/:generationId` | Owned exact credential and disclosure metadata                               |
+| `GET …/payload`                                           | Explicit authenticated full payload review/report                            |
+| `POST …/reconcile`                                        | Check exact indexed accept/reject/remove transaction                         |
+| `GET /api/recipient/presentations`                        | Own grants, optionally filtered by profile/generation                        |
+| `POST /api/recipient/presentation-challenges`             | Issue a five-minute, session-bound wallet challenge for exact sharing intent |
+| `POST /api/recipient/presentations`                       | Create grant after fresh wallet proof; consume challenge atomically          |
+| `POST /api/recipient/presentations/:id/revoke`            | Revoke own grant                                                             |
+| `POST /api/presentations/resolve`                         | Explicit token resolution; full access rechecks audience and approval        |
+| `GET /api/verifier/workspace`                             | Application status and metadata-only history                                 |
+| `POST /api/verifier/applications`                         | Submit organization and review documents                                     |
+| `GET /api/verifier/history.csv`                           | Approved actor's metadata export                                             |
+| `POST /api/verifier/history/:id/presentation`             | Reauthorize and record reopening; empty JSON body                            |
+| `POST /api/auth/link-handoff`                             | Same-origin invitation/presentation token cookie before login                |
+| `POST /api/auth/link-handoff/consume`                     | Authenticated, CSRF-protected one-time cookie retrieval                      |
+
+Bearer links use fragments, then explicit JSON POSTs, never token query parameters. The browser
+purges the fragment before resolution. The private handler distinguishes invalid, revoked,
+holder-proof-invalid and temporarily unavailable links so the guided page can give the correct next
+action; it never returns the bearer. Wrong-audience full grants disclose only the public projection.
+See [recipient/verifier boundaries and limits](runbooks/recipient-verifier.md).
+
+Presentation creation now requires `proof: { challengeId, signature, publicKey, scheme }` alongside
+profile, generation, scope and optional designated organization. `scheme` is `ripple` or `otsu`, as in
+wallet linking, but a wallet-link challenge cannot authorize sharing. Resolution adds `issuerAdmission`
+(current portal status, organization and observation/review timestamps) and `holderProof` (dated
+signature evidence, or `not_provided` for legacy links). These facts do not change issuer trust,
+payload-integrity dimensions or private-field access. Corrupted stored proofs produce the bounded
+`PRESENTATION_HOLDER_PROOF_INVALID` portal error and no claims.
+Issuer workspace invitations additionally report recipient readiness and wallet verification time;
+the issuance context distinguishes delivery email from the actual claimant's linked address.
+
+The former web mutation pages are not integration APIs. They now issue fixed redirects to the role
+portals and discard all legacy query/fragment input. Public `/v1` paths, the CLI, documentation and
+read-only Explorer pages are unchanged by this UI routing decision.
diff --git a/docs/architecture.md b/docs/architecture.md
index 9a3476d..36afc15 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -18,8 +18,8 @@ issuer/subject wallet -> unsigned transaction from SDK/web/CLI -> XRPL
 
 ## Ownership
 
-Two deployable applications, one shared schema folder, and a library that neither application
-imports. See [ADR 0004](./adr/0004-two-standalone-apps.md).
+Two application runtimes, two one-purpose deployment components, one shared schema folder, and a
+library that neither application imports. See [ADR 0004](./adr/0004-two-standalone-apps.md).
 
 - `apps/indexer` is the projection writer and the only normal writer to protocol projections. It
   advances only on validated ledger evidence agreed by its configured sources, and it owns the
@@ -28,12 +28,30 @@ imports. See [ADR 0004](./adr/0004-two-standalone-apps.md).
   the projection and fetches off-ledger payloads for verification, failing closed when projection
   evidence is stale or inconsistent; its `app/` half presents the workflows and connects user
   wallets. Browser-visible RPC configuration is separate from the private indexer sources.
+- `apps/notifier` runs the compiled SMTP outbox worker with only its restricted database and mail
+  credentials. It has no HTTP surface and no wallet or XRPL signing key.
+- `apps/db-bootstrap` runs migrations and role provisioning as a pre-deploy job. Its managed
+  PostgreSQL administrator URL never reaches a long-running component.
 - `db/` defines the rebuildable PostgreSQL model — Drizzle tables and generated SQL migrations. It
   is not a package: both applications compile it as their own source through the `#db/*` alias.
 - `core` parses and validates protocol values. It is browser-safe and performs no I/O.
 - `sdk` builds and validates XRPL transaction JSON and submits signed blobs. It never owns keys.
 - `cli` is a thin command layer over core and SDK.
 
+## Guided application boundary
+
+The browser mutation surface is role-oriented: `/issuer` derives the issuer's next action,
+`/recipient` joins invitation, wallet, review, acceptance and sharing, and `/presentations` resolves
+public or audience-restricted sharing links. Pure application presenters build those views from
+DTOs; their `nextAction` values are never authorization. Server repositories remain authoritative
+for roles, organization approval, wallet ownership, current ledger evidence, audience and replay
+protection.
+
+Technical identifiers remain in internal coordinates and in the public integration surfaces, but
+the role portals do not ask users to type or interpret them. The public `/v1` API, CLI and read-only
+Explorer pages are unchanged. See
+[ADR 0007](./adr/0007-guided-role-portals.md).
+
 The applications do not import `core` or `sdk`. Each carries hand-maintained copies of the protocol
 code it needs, every file headed with its origin; `packages/core` remains the reference
 implementation and the place a protocol change lands first. The mirroring rule is in
diff --git a/docs/database-app.md b/docs/database-app.md
new file mode 100644
index 0000000..1d4055a
--- /dev/null
+++ b/docs/database-app.md
@@ -0,0 +1,428 @@
+# Application data model — issue #25
+
+This is the implemented database model and server-side helper boundary.
+[ADR 0005](adr/0005-role-based-application.md) records the accepted policy. Optional authentication
+is implemented in #27, admin review in #30, issuer mutations/private delivery in #31, and recipient
+presentations/verifier history in #32–#33; see the
+[issuer runbook](runbooks/issuer.md) for deployment and remaining release checks.
+
+## Ownership and authority
+
+The original ten `app_*` tables are defined under `db/schema/app/` and exported from
+the app-local database modules. Migration `0003_application_model.sql` adds them; migrations 0000–0002 and the
+projection definitions are unchanged. Drizzle generation includes both the existing projection
+entry point and the separate application entry point.
+
+Migrations 0004–0006 extend that model with sessions, review/audit and issuer delivery storage.
+`0006_issuer_workspace.sql` adds `app_issuer_payloads` (canonical payloads bounded to 1 MiB,
+unique opaque locator, invite/creator/subject, digest, URI and disclosure selectors) and
+`app_invite_deliveries` (attempt kind, destination, status and sanitized error code). Only token
+hashes persist in invitations; delivery rows contain no raw invitation bearer. Issuance and
+revocation delivery records are unique per invitation and event kind to prevent automatic resend.
+The dedicated `xcs_issuer` role cannot approve organizations, grant admins or write projection rows.
+
+`0007_recipient_verifier.sql` adds only `app_verifier_history`. Existing presentation rows retain
+their unlimited, revocable authorization; there are no expiry or consumption columns. Migrations
+0000–0006 remain unchanged. The recipient and verifier handlers reuse the restricted portal pool:
+`xcs_issuer` additionally reads ledger checkpoints/integrity status, creates presentations, updates
+only their `revoked_at` column, and reads/appends verifier history. Authentication, public API and
+administrator roles receive no new private-payload or verifier-history grants.
+
+`0008_presentation_wallet_proof.sql` adds `app_presentation_challenges` and
+`app_presentation_proofs`, preserving deployed migrations 0000–0007 and existing grants. Challenges
+are session-bound, single-use and limited to five minutes. This lifetime applies only to signing;
+presentation links still have no automatic expiration. The portal role may select/insert both tables
+and delete challenges to consume them. It cannot update or delete persisted signature evidence.
+No new privileges are granted to authentication, public API or administrator roles.
+
+An organization has one responsible human account, not a shared login. Issuer and verifier
+applications are independent. Personal roles are `admin` and `recipient`; organization roles are
+`issuer` and `verifier`. Application approval never proves the validity of a ledger transaction or
+the truth of a claim.
+
+Ledger references are `(profile_id, schema_uid)` and `(profile_id, generation_id)`. They deliberately
+have no foreign key into the disposable ledger projection: rebuilding it must not destroy accounts,
+invitations or sharing grants. Issuance handlers validate indexed ledger evidence, schema
+publisher ownership and wallet control before recording metadata. Database references and hashes
+alone are not cryptographic evidence. No mutable `accepted`/`revoked` lifecycle mirror is stored in
+the application model; current state is read from validated ledger evidence. Invitations exist
+before a credential generation, in their own table.
+
+```mermaid
+erDiagram
+    app_users ||--o{ app_user_roles : holds
+    app_users ||--o{ app_wallets : proves_control
+    app_users ||--o{ app_organizations : responsible_for
+    app_organizations ||--o{ app_organization_applications : applies
+    app_organization_applications ||--o{ app_documents : documents
+    app_organizations ||--o{ app_schema_metadata : owns
+    app_schema_metadata ||--o{ app_invites : invites
+    app_users o|--o{ app_invites : claims
+    app_schema_metadata ||--o{ app_credential_metadata : describes
+    app_users ||--o{ app_credential_metadata : recipient
+    app_invites o|--o| app_credential_metadata : leads_to
+    app_credential_metadata ||--o{ app_presentations : shared_as
+    app_organizations o|--o{ app_presentations : designated_verifier
+    app_sessions ||--o{ app_presentation_challenges : requests_signature
+    app_presentations ||--o| app_presentation_proofs : carries_signature
+    app_presentations ||--o{ app_verifier_history : checked_as
+    app_users ||--o{ app_verifier_history : consulted
+    app_organizations ||--o{ app_verifier_history : verifier
+```
+
+The diagram omits reviewer/uploader/creator references for readability. Durable history uses
+`ON DELETE RESTRICT`; transient wallet/presentation challenges cascade when their session is deleted.
+No account deletion cascades into credential or ledger history.
+
+## Data dictionary
+
+`uuid` primary keys default to PostgreSQL `gen_random_uuid()`. All timestamps are `timestamptz`.
+Columns are **not nullable** unless marked `?`. `now` denotes the database time default. Text hashes
+are lowercase 64-character hexadecimal strings checked in SQL. Enum-like text columns have SQL
+`CHECK` constraints, not just TypeScript annotations. Source and generated SQL contain exact names.
+
+### `app_users`
+
+| Columns                                 | Type / default | Meaning                                               |
+| --------------------------------------- | -------------- | ----------------------------------------------------- |
+| `id`                                    | uuid PK        | Stable human account identity                         |
+| `identity_issuer?`, `identity_subject?` | text           | Identity-provider issuer and subject; unique together |
+| `email?`                                | text           | Contact address; not the account identifier           |
+| `email_verified_at?`                    | timestamp      | Independent email-verification evidence               |
+| `display_name?`                         | text           | Recipient/personal display profile                    |
+| `status`                                | text, `active` | `active`, `suspended`, `deleted`                      |
+| `created_at`                            | timestamp, now | Account creation                                      |
+| `deleted_at?`                           | timestamp      | Anonymized tombstone time                             |
+
+Active/suspended accounts require nonempty issuer and subject, with no deletion timestamp. A deleted
+account requires the deletion timestamp and null identity, email, email-verification and name fields.
+Email verification requires an email. The unique `(identity_issuer, identity_subject)` index prevents
+cross-provider subject collisions without making email a unique or trusted identity key.
+
+### `app_user_roles`
+
+| Columns           | Type / default              | Meaning                                     |
+| ----------------- | --------------------------- | ------------------------------------------- |
+| `user_id`, `role` | uuid FK, text; composite PK | Personal `admin` or `recipient` role        |
+| `granted_by?`     | uuid FK → users             | Reviewer, nullable for initial provisioning |
+| `granted_at`      | timestamp, now              | Grant time                                  |
+| `revoked_at?`     | timestamp                   | Role withdrawn                              |
+
+No personal admin role grants private-claim access. Role provisioning remains a future authenticated
+administrative operation; inserting a row is not itself proof of authorization.
+
+### `app_wallets`
+
+| Columns       | Type / default         | Meaning                                  |
+| ------------- | ---------------------- | ---------------------------------------- |
+| `id`          | uuid PK                | Link identity                            |
+| `user_id`     | uuid FK → users        | Account that proved control              |
+| `network_id`  | bigint, safe JS number | XRPL uint32 network identifier           |
+| `address`     | text                   | Classic XRPL address                     |
+| `verified_at` | timestamp              | Successful signed-challenge verification |
+| `revoked_at?` | timestamp              | Link no longer usable                    |
+
+Unique `(network_id, address)` prevents a wallet being linked to multiple accounts on the same
+network; `user_id` is indexed. Network range, address shape and timestamp ordering are checked.
+The authentication implementation must verify the signature, nonce and network; this table does not
+perform signature verification or store a private key, seed or reusable challenge secret. There is
+no automatic wallet reassignment or organization wallet-control transfer.
+
+### `app_organizations`
+
+| Columns               | Type / default  | Meaning                                         |
+| --------------------- | --------------- | ----------------------------------------------- |
+| `id`                  | uuid PK         | Stable issuer/verifier organization identity    |
+| `responsible_user_id` | uuid FK → users | Single responsible account; indexed             |
+| `name`                | nonblank text   | Display name, never an authorization identifier |
+| `status`              | text, `active`  | `active`, `suspended`, `closed`                 |
+| `created_at`          | timestamp, now  | Creation                                        |
+
+One account may be referenced by several organizations; each organization has exactly one responsible
+account. Team membership and responsibility-transfer workflows are not implemented.
+
+### `app_organization_applications`
+
+| Columns                                                             | Type / default              | Meaning                                        |
+| ------------------------------------------------------------------- | --------------------------- | ---------------------------------------------- |
+| `organization_id`, `role`                                           | uuid FK, text; composite PK | `issuer` or `verifier` application             |
+| `status`                                                            | text, `pending`             | `pending`, `approved`, `rejected`, `suspended` |
+| `website?`, `contact?`, `jurisdiction?`, `description?`, `purpose?` | text                        | Deletable application profile details          |
+| `submitted_at`                                                      | timestamp, now              | Submission time                                |
+| `reviewed_by?`                                                      | uuid FK → users             | Reviewing administrator                        |
+| `reviewed_at?`                                                      | timestamp                   | Decision time                                  |
+| `review_reason?`                                                    | text                        | Required and nonblank for rejection/suspension |
+
+Pending applications have no decision fields. Other statuses require reviewer/time, not preceding
+submission. Queue index: `(status, submitted_at)`. The admin API must check reviewer authority and
+provide audit history when implemented; the row stores the current decision, not a full audit log.
+Profile fields can be cleared without inventing a new identity or discarding approval references.
+
+### `app_documents`
+
+| Columns                               | Type / default                          | Meaning                                                     |
+| ------------------------------------- | --------------------------------------- | ----------------------------------------------------------- |
+| `id`                                  | uuid PK                                 | Review document identity                                    |
+| `organization_id`, `application_role` | uuid, text; composite FK → applications | Owning application; indexed together                        |
+| `storage_key`                         | nonblank text, unique                   | Private object-storage reference, not a public download URL |
+| `mime_type`                           | text                                    | Declared media type; upload handler must validate content   |
+| `byte_length`                         | positive integer                        | Size                                                        |
+| `sha256`                              | text hash                               | Content digest                                              |
+| `uploaded_by`                         | uuid FK → users                         | Uploader                                                    |
+| `review_status`                       | text, `pending`                         | `pending`, `approved`, `rejected`                           |
+| `created_at`                          | timestamp, now                          | Upload metadata creation                                    |
+
+Bytes live in private object storage, never in this table. Deleting a row does not remove its object;
+the future deletion workflow must coordinate both and handle storage failures.
+
+### `app_schema_metadata`
+
+| Columns                         | Type / default                         | Meaning                            |
+| ------------------------------- | -------------------------------------- | ---------------------------------- |
+| `profile_id`, `schema_uid`      | nonempty text, text hash; composite PK | Exact ledger schema reference      |
+| `organization_id`               | uuid FK → organizations                | Application owner; indexed         |
+| `display_name?`, `category?`    | text                                   | Presentation metadata              |
+| `registration_transaction_hash` | text hash                              | Reference to registration evidence |
+| `created_at`                    | timestamp, now                         | Metadata creation                  |
+
+Unique `(profile_id, schema_uid, organization_id)` supports ownership-consistent invitation and
+credential foreign keys. Only registered-schema metadata belongs here: no fake UID for drafts and no
+separate mutable `published` flag overriding ledger evidence.
+
+### `app_invites`
+
+| Columns                                       | Type / default                                        | Meaning                                                     |
+| --------------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------- |
+| `id`                                          | uuid PK                                               | Invitation identity                                         |
+| `organization_id`, `profile_id`, `schema_uid` | uuid, text, text hash; composite FK → schema metadata | Issuer-owned schema                                         |
+| `delivery_email?`                             | text                                                  | Removable delivery contact, not proof of claimant identity  |
+| `token_hash?`                                 | text hash, unique                                     | Hash of bearer token; may be cleared after claim/revocation |
+| `created_by`                                  | uuid FK → users                                       | Creating account                                            |
+| `created_at`                                  | timestamp, now                                        | Creation time                                               |
+| `expires_at`                                  | timestamp, **no default**                             | Caller must supply invitation expiry, after creation        |
+| `claimed_by?`, `claimed_at?`                  | uuid FK → users, timestamp                            | Both absent or both present; claim must predate expiry      |
+| `revoked_at?`                                 | timestamp                                             | Claim disabled                                              |
+
+An unclaimed, unrevoked invitation requires a token hash. Indexes: `(organization_id, created_at)` and
+`claimed_by`. Unique `(id, organization_id, profile_id, schema_uid, claimed_by)` allows a credential
+to reference only the actual claimant for the exact invitation and schema. A link is claimable once,
+with no matching-email requirement. Delivery contact is not disclosed by the claim helper.
+
+`claimInvitation(db, { token, userId })` uses one conditional UPDATE against an active account,
+unclaimed/unrevoked token hash and database-clock expiry. Concurrent claimants cannot both win.
+Invalid/unavailable claims return null; an authenticated POST handler must provide `userId` from the
+session and enforce CSRF/rate limits. Opening a link must never invoke the mutation. The helper does
+not link a wallet, verify email, sign, issue or accept a credential.
+
+### `app_credential_metadata`
+
+| Columns                                              | Type / default                | Meaning                                                             |
+| ---------------------------------------------------- | ----------------------------- | ------------------------------------------------------------------- |
+| `profile_id`, `generation_id`                        | text, text hash; composite PK | Exact credential generation                                         |
+| `schema_uid`, `issuer_organization_id`               | text hash, uuid               | Composite FK with profile → issuer-owned schema                     |
+| `recipient_user_id`                                  | uuid FK → users               | Owning recipient                                                    |
+| `invite_id?`                                         | uuid, unique                  | Optional composite FK to matching invitation claimant/schema/issuer |
+| `issuer_address`, `subject_address`                  | text                          | Issuance-time XRPL identities                                       |
+| `visibility`                                         | text, **no default**          | Explicit `public` or `private`                                      |
+| `public_fields`                                      | JSONB string array, `[]`      | Claim-relative JSON pointers allowed publicly                       |
+| `payload_storage_key?`                               | nonblank text                 | Object reference; nullable for deletion/unavailability              |
+| `payload_digest`                                     | text hash                     | Commitment to canonical payload bytes                               |
+| `creation_transaction_hash`, `creation_ledger_index` | text hash, bigint uint32 > 0  | Creation evidence reference                                         |
+| `created_at`                                         | timestamp, now                | Metadata creation                                                   |
+
+Unique `(profile_id, generation_id, recipient_user_id)` binds presentations to the actual recipient.
+Indexes cover `(recipient_user_id, created_at)` and `(issuer_organization_id, created_at)`. SQL checks
+visibility, public-field array/string shape, addresses, hashes and ledger range. No private claim
+bytes or authoritative lifecycle state are duplicated here. No visibility default is chosen on
+behalf of the parallel UX discussion.
+
+### `app_presentations`
+
+| Columns                                            | Type / default                                            | Meaning                           |
+| -------------------------------------------------- | --------------------------------------------------------- | --------------------------------- |
+| `id`                                               | uuid PK                                                   | Sharing authorization             |
+| `profile_id`, `generation_id`, `recipient_user_id` | text, text hash, uuid; composite FK → credential metadata | Owner-authorized exact generation |
+| `verifier_organization_id?`                        | uuid FK → organizations                                   | Mandatory for `full` scope        |
+| `scope`                                            | text                                                      | `public` or `full`                |
+| `token_hash`                                       | text hash, unique                                         | Link token hash                   |
+| `created_at`                                       | timestamp, now                                            | Creation time                     |
+| `revoked_at?`                                      | timestamp                                                 | Revocation, not before creation   |
+
+Indexes: `(recipient_user_id, created_at)`, `verifier_organization_id`. There is deliberately no expiry,
+consumption timestamp or per-issuer allowlist. Public-scope presentations do not require a verifier;
+full private access always does. Invite expiry, session expiry and credential expiry are independent.
+
+The recipient API permits at most 200 active presentations per credential. Creation takes a
+transaction advisory lock for the recipient and exact credential, then rechecks ownership,
+current session, ledger state and the quota under `READ COMMITTED` isolation. A full quota returns
+`409` with `error: RECIPIENT_PRESENTATION_LIMIT`; revoking an active presentation frees a slot.
+Per-credential lists place active grants before revoked history so all active grants remain
+reachable for revocation. The unfiltered list is a bounded view of 200 entries, also prioritizing
+active grants; use the credential filter for complete active-grant management.
+
+### `app_presentation_challenges` and `app_presentation_proofs`
+
+| Table      | Fields                                                                                                           | Retention and authority                                                                                                                                           |
+| ---------- | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Challenges | `id`, `session_id`, reserved `presentation_id`, JSON `request`, canonical `message`, `created_at`, `expires_at`  | Session/expiry indexes; expiry at most five minutes; atomic delete on successful creation; expired challenges are removed on the session's next challenge request |
+| Proofs     | `presentation_id` PK/FK, JSON `request`, canonical `message`, `signature`, `public_key`, `scheme`, `verified_at` | Immutable to the portal role; no private key, seed, session identifier or raw presentation bearer in the public proof                                             |
+
+The signed message has an explicit presentation-authorization purpose, origin, random nonce,
+challenge/presentation identifiers, issue/expiry times, profile/network, exact credential generation,
+issuer/subject addresses, schema UID, payload digest, visibility, sorted public-field selectors,
+scope and designated verifier organization. It explicitly excludes payments, transactions, wallet
+linking and ownership transfer. Challenges use a separate table so a signature cannot be consumed
+by the wallet-link endpoint. The public message contains neither user IDs nor session IDs.
+
+`POST /api/recipient/presentation-challenges` accepts the presentation reference/scope/audience and
+requires authentication and CSRF. The client signs the returned text with a supported wallet.
+`POST /api/recipient/presentations` requires the same input plus
+`proof: { challengeId, signature, publicKey, scheme }`. The server rechecks current session,
+recipient ownership, linked subject wallet, active credential and audience approval, verifies the
+signature over its stored message, then consumes the challenge and inserts the grant/proof in the
+same transaction as the serialized quota decision. Failed validation rolls the consumption back.
+No payload bytes or private claim values are required to authorize this operation.
+
+Resolution revalidates stored signature and exact disclosure bindings. `holderProof` is `verified`
+for intact signed records and `not_provided` for legacy links; corrupt/mismatched evidence produces
+a generic unavailable link. Signature evidence proves authorization at creation, not the holder's
+presence at consultation. It proves a master-key address only; regular keys, multisign and current
+ledger key-authority checks, including disabled master keys, are unsupported. Current Commons
+issuer admission is separate from signature evidence, ledger validity and issuer trust.
+
+### `app_verifier_history`
+
+| Columns                       | Type / default          | Meaning                                                        |
+| ----------------------------- | ----------------------- | -------------------------------------------------------------- |
+| `id`                          | uuid PK                 | One explicit verification consultation                         |
+| `verifier_organization_id`    | uuid FK → organizations | Approved organization acting as verifier                       |
+| `verifier_user_id`            | uuid FK → users         | Responsible account at consultation time                       |
+| `presentation_id`             | uuid FK → presentations | Exact sharing grant consulted                                  |
+| `profile_id`, `generation_id` | text, text hash         | Exact credential generation; no projection FK                  |
+| `scope`                       | text                    | Actual `public` or `full` disclosure                           |
+| `on_chain`                    | text                    | `not_found`, `pending`, `active`, `expired` or `deleted`       |
+| `schema_status`               | text                    | `valid` or `unknown`                                           |
+| `payload_status`              | text                    | `valid`, `unavailable`, `tampered`, `invalid` or `not_checked` |
+| `issuer_trust`                | text                    | `trusted`, `untrusted` or `unknown`                            |
+| `checked_at`                  | timestamp, now          | Evidence observation time, not a durable access grant          |
+
+Indexes cover `(verifier_user_id, checked_at, id)` and `(verifier_organization_id, checked_at, id)`.
+There are no claim values, raw presentation tokens, email addresses or payload bytes in these rows.
+History insertion rechecks the current session, responsible organization, approval and presentation
+inside the disclosure transaction. Anonymous visitors and callers lacking the full presentation's
+authorization do not create history. Reads and CSV exports require the same responsible account's
+current approval; they return at most 500 evidence summaries. Reopening a history entry resolves
+the presentation again, including revocation and current approval checks, rather than reading
+cached private claims.
+
+## Server-side visibility boundary
+
+`getCredentialAccess(db, { profileId, generationId, viewerUserId, presentationToken? })` reads the
+credential, current account/organization state, sharing grant and verifier approval in one SQL
+statement. `viewerUserId` must come from verified server authentication, never from a public body.
+
+| Caller                                                                                                                                         | Public credential | Private credential |
+| ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------------ |
+| Anonymous, unrelated account, admin role alone                                                                                                 | All claims        | Public fields only |
+| Active recipient                                                                                                                               | All claims        | All claims         |
+| Active account responsible for the active issuer organization                                                                                  | All claims        | All claims         |
+| Active account responsible for the designated, active and currently approved verifier, with a non-revoked full grant for this exact generation | All claims        | All claims         |
+| Approved verifier without its grant, wrong audience, suspended verifier, or revoked/public-scope grant                                         | All claims        | Public fields only |
+
+No credential metadata means null, not access. Approval and grant revocation are rechecked per call;
+do not cache this result as a durable permission or evaluate it only at sign-in. A caller may have
+several relationships: an owner does not lose their ownership access because an unrelated grant
+is invalid. This helper is not a presentation-link resolver: presentation routes separately reject
+invalid/revoked links and verify current ledger state. Neither an access result nor stored metadata
+means the credential itself is valid or accepted.
+
+`filterCredentialClaims(claims, access)` copies only the allowed claims. Do not spread the original
+private payload envelope into a public DTO. Object-field paths use RFC 6901, relative to `claims`:
+`/course/title`, with `~0` and `~1` escapes. Missing paths disclose nothing. Arrays are atomic: an
+explicit `/modules` shares the whole array; `/modules/0/name` is not supported and discloses nothing.
+Selecting an object explicitly shares its subtree; the issuer UI previews that fact. Invalid,
+overlong, overly deep or prototype-sensitive selectors fail closed. The empty root pointer cannot
+mean “all private claims.” No cryptographic selective-disclosure proof is implied by a filtered view.
+
+`validatePublicFields` must run when saving public selectors. The filter validates them again before
+public output; SQL also rejects non-array/non-string shapes. Limits: 256 selectors, 1024 characters
+per pointer, 32 path segments. Unknown access scopes throw rather than returning the full payload.
+
+Tokens use Node's standard `randomBytes(32)` and SHA-256, with no custom cryptography. A created
+presentation returns its raw token once in `/presentations#TOKEN`; lists contain no token or hash.
+The fragment is exchanged only by explicit same-origin JSON `POST /api/presentations/resolve`.
+Signed-in consultations additionally require CSRF. An optional login handoff uses a ten-minute
+Secure/HttpOnly cookie, consumed through an authenticated CSRF-protected POST. Raw tokens never
+enter application database columns, query strings, logs or analytics.
+
+Presentation resolution takes a share lock on the grant to serialize disclosure with revocation.
+It revalidates account/organization approval and reads canonical stored bytes, exact-generation
+ledger state, schema evidence and the configured ledger freshness/trust policy in one transaction.
+It performs no external payload fetch or public `/v1/verify` request. A valid full link opened by an
+anonymous or unauthorized caller returns only public claims with `requiresAuthorization: true`.
+Recipient/issuer ownership and administrator status do not widen the presentation's scope. For a
+private credential, public scope uses `public_fields`; for an already-public credential, all claims
+are public. Responses contain claims, not a private payload envelope. A filtered public result
+reports payload `not_checked` after internal canonical validation because the projection cannot
+prove the full payload digest; tampered/invalid bytes instead produce their actual failure status
+and no claims. Approval remains separate from the configured issuer trust decision.
+
+Recipient workspace/detail responses contain metadata and ledger events, never private claims.
+Private claims require the separate explicit owner-authorized payload request. Accept, reject and
+remove reconciliation validate the exact indexed transaction and a currently linked subject wallet;
+rejection/removal never loads payload bytes. In-app issuance/revocation notifications derive from
+durable credential events, including issuer revocations outside the portal. Email delivery remains
+the issuer workflow's separate delivery record. Lists are bounded to 200 credentials/invitations/
+notifications and 100 detail events; unavailable/stale ledger evidence yields an unknown inbox
+state and blocks authoritative private disclosure.
+
+## PII, deletion and deployment
+
+Identity subjects, names, email/contact fields, profile details, document references/content, wallet
+links and invitation ownership can identify people. Treat them as application PII even if some
+wallet addresses are already public. Grant and review history are also sensitive relationship data.
+Public ledger records cannot be erased; an internal tombstone is not a promise of anonymizing XRPL.
+
+The model supports clearing account PII into a disabled tombstone, clearing application profile
+fields, removing review-document metadata, clearing invitation delivery contacts and removing
+payload references without cascading deletion into issuance history. Future deletion processing
+must revoke affected grants/wallet links, remove object bytes where permitted, and coordinate
+backups. Restrictive FKs require deliberate handling of references; deleting a parent is not a
+shortcut. The lifetime of residual identifiers and backups, operational purge schedules and legally
+required retention are **not decided or implemented by this issue**. Do not claim complete account
+erasure merely because fields can be nulled.
+
+The forward SQL migration itself grants no runtime privileges. Existing projection readers/indexer and
+public-payload writers must not be reused as unrestricted application writers. Issue #27 now provisions an optional, restricted `xcs_app` role and server-only connection for authentication;
+see the [authentication runbook](runbooks/authentication.md). Nothing here
+enables production private hosting or converts a public payload into a private one.
+
+For 0007/0008, apply the additive migrations, reprovision the restricted portal grants, then deploy
+the updated application. Older app instances can still create unsigned links until replaced; such
+links remain explicitly marked as lacking a presentation proof. There is no data backfill or destructive DDL. An application rollback can
+leave the new tables, signature evidence and history intact; do not drop relationship history as a rollback shortcut.
+Grant provisioning remains separate from migration application. Existing deployments may continue
+using the previous application against the expanded schema during this sequence.
+
+## Verification
+
+Visibility tests: `apps/indexer/test/db/app-visibility.test.ts`. Actual SQL, invitation concurrency,
+access decisions and constraints: `apps/indexer/test/db/app-model.integration.test.ts`.
+`apps/indexer/test/db/migrations.integration.test.ts` covers fresh creation and the 0006→0007 and 0007→0008 upgrades,
+including unchanged accounts, presentation columns and applied migration history.
+`apps/web/test/recipient-http.test.ts`, `recipient-postgres.integration.test.ts` and the verifier tests
+cover CSRF, ownership, current approval, private/public projection, freshness, trust, quota races,
+rejection without payload reads, signed challenge scope/session binding, concurrent replay, expired
+challenges, wallet removal, legacy unsigned links, corrupted proofs and restricted SQL grants.
+
+```sh
+pnpm --dir apps/indexer typecheck
+pnpm --dir apps/indexer test
+# Use a disposable PostgreSQL cluster, never the active Testnet database.
+XCS_TEST_DATABASE_URL=postgres://USER:PASSWORD@127.0.0.1:PORT/postgres pnpm --dir apps/indexer test:postgres
+pnpm --dir apps/indexer build
+pnpm --dir apps/indexer db:generate
+```
+
+Generation after the checked-in artifacts must produce no new migration. Independent maintainer
+review and real identity/wallet flows remain release gates beyond synthetic authorization tests.
diff --git a/docs/database.md b/docs/database.md
index 1faf0a5..363cd1e 100644
--- a/docs/database.md
+++ b/docs/database.md
@@ -1,9 +1,15 @@
 # Database model
 
-PostgreSQL is a rebuildable read model of validated XRP Ledger history. It is not the source of XCS
-protocol truth and it stores neither XRPL signing keys nor Credential claim payloads. The application
-schema contains ten tables grouped around network evidence, indexer coordination, schema discovery,
-Credential lifecycle projection, and optional demo pinning.
+PostgreSQL contains a rebuildable read model of validated XRP Ledger history plus the optional
+role-based application's workflow state. It is not the source of XCS protocol truth and never stores
+XRPL signing keys. Managed private claim payloads are encrypted-at-rest application data in
+`app_issuer_payloads`; private review documents live in the configured filesystem or S3/Spaces
+backend, with only their metadata stored in PostgreSQL.
+
+The ten protocol-projection tables below cover network evidence, indexer coordination, schema
+discovery, Credential lifecycle projection, and optional demo pinning. Migrations `0003` through
+`0008` add the account, Commons review, issuer, recipient, verifier and wallet-proof tables described
+in [the application database model](database-app.md).
 
 The Drizzle bookkeeping table in the internal `drizzle` schema is not part of the application model.
 
@@ -162,22 +168,24 @@ finite replays.
 
 ## Database roles
 
-| Role          | Application-table access                                                                                                      | Intended lifetime                                   |
-| ------------- | ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
-| `xcs_admin`   | Owns the schema and grants; unrestricted bootstrap access.                                                                    | One-shot bootstrap and controlled maintenance only. |
-| `xcs_indexer` | Reads and inserts ledger-derived rows; receives column-limited updates only on `indexer_status` and `credential_generations`. | Indexer runtime.                                    |
-| `xcs_api`     | Reads ledger-derived projections and manages only `pin_challenges` and `demo_pins`.                                           | Web app (`/v1` API) runtime.                        |
-| `xcs_monitor` | No application-table DML; inherits PostgreSQL's `pg_monitor` role.                                                            | Metrics collection.                                 |
-
-Runtime roles own no objects, cannot create database objects, are not superusers, and have finite
-connection limits and statement timeouts. Bootstrap requires an explicit dedicated-cluster
-acknowledgement because those role attributes are cluster-visible.
-
-The runtime **users** are created by whoever owns the cluster, not by XCS. On DigitalOcean's managed
-PostgreSQL that is the control panel, `doctl` or the API, which also generates and stores each
-password. Bootstrap only assigns privileges and fails naming any of the three roles it cannot find.
-The local Compose stack has no such service, so `db/compose-initdb/01-runtime-roles.sql` creates the
-three roles there with published, local-development-only passwords.
+| Identity / role       | Access boundary                                                                                                                        | Intended lifetime                               |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
+| Bootstrap provisioner | Owns migrations and grants; requires DDL rights plus authority to administer the eight pre-created roles on the dedicated XCS cluster. | PRE_DEPLOY job and controlled maintenance only. |
+| `xcs_indexer`         | Reads and inserts ledger-derived rows; receives column-limited updates only on `indexer_status` and `credential_generations`.          | Indexer runtime.                                |
+| `xcs_api`             | Read-only access to public ledger projections.                                                                                         | Web app public `/v1` API pool.                  |
+| `xcs_payload_writer`  | Writes hosted public payloads, publication records, demo pin challenges and pins.                                                      | Web app publication pool.                       |
+| `xcs_monitor`         | No application-table DML; inherits PostgreSQL's `pg_monitor` role.                                                                     | Metrics collection.                             |
+| `xcs_app`             | Accounts, OIDC sessions, wallet-link challenges and proven wallet records.                                                             | Web app authentication pool.                    |
+| `xcs_admin_app`       | Commons application review, audit decisions and notification outbox creation.                                                          | Web app administrator pool.                     |
+| `xcs_notifier`        | Claims and updates Commons notification outbox rows.                                                                                   | Notifier worker.                                |
+| `xcs_issuer`          | Issuer applications, invitations, managed credentials, recipient access and presentations.                                             | Web app role-workspace pool.                    |
+
+Runtime roles own no objects and must be normal managed users with `LOGIN` and no elevated role
+attributes or unexpected memberships. The managed service creates them and owns their passwords;
+bootstrap validates that boundary, applies grants and attempts bounded connection limits and timeout
+defaults. Providers may refuse those resource controls or the `pg_monitor` membership without
+rolling back the grants, so bootstrap reports every control that remains unapplied. It requires an
+explicit dedicated-cluster acknowledgement because PostgreSQL roles are cluster-wide.
 
 ## Schema ownership, migrations and bootstrap
 
@@ -196,9 +204,8 @@ The Drizzle source is split by domain:
 - [`pinning.ts`](../db/schema/pinning.ts): optional demo-pinning administration.
 
 Generated SQL migrations live in [`db/migrations/`](../db/migrations); `migrations/meta/_journal.json`
-is the applied-migration ledger and must stay append-only.
-[`0000_baseline.sql`](../db/migrations/0000_baseline.sql) creates the entire schema for an empty
-database.
+is the applied-migration ledger and must stay append-only. The complete `0000`–`0008` journal creates
+the protocol projection and role-based application schema for an empty database.
 
 ### PostgreSQL is external
 
@@ -230,12 +237,11 @@ This is idempotent: `drizzle-orm`'s migrator records applied migrations in
 `db/migrations` relative to the indexer application and can be overridden with `XCS_MIGRATIONS_DIR`
 (the container image sets it to the copy of `db/migrations` beside the built application).
 
-### Bootstrap once, then migrate
+### Bootstrap and migrate atomically
 
-`db:bootstrap` is migration **plus** privilege provisioning. Create `xcs_indexer`, `xcs_api` and
-`xcs_monitor` with the managed database service first (the DigitalOcean control panel or
-`doctl databases user create`), keep the passwords it generates, then run this once against a fresh
-database as the administrator and use `db:migrate` for every later schema change:
+`db:bootstrap` is migration plus grants. Before the PRE_DEPLOY job, create all eight runtime users
+through DigitalOcean: `xcs_indexer`, `xcs_api`, `xcs_payload_writer`, `xcs_monitor`, `xcs_app`,
+`xcs_admin_app`, `xcs_notifier` and `xcs_issuer`. DigitalOcean owns their generated passwords.
 
 ```sh
 XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@host:5432/xcs \
@@ -243,12 +249,10 @@ XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@host:5432/xcs \
   pnpm --dir apps/indexer db:bootstrap
 ```
 
-It applies the migrations and then normalizes the fixed runtime roles' attributes, memberships and
-grants in one administrative transaction. It never creates a role and never sets, resets or reads a
-role password; a missing role fails the run by name, before anything is changed. It asserts `LOGIN`
-and never revokes it, so an interrupted run cannot lock a role out. Both operations are idempotent,
-so running it again is safe; a password rotation goes through the managed service and needs no rerun.
-`XCS_DATABASE_CLUSTER_SCOPE=dedicated` is required because the role attributes are cluster-visible
+It checks that all eight managed users exist before any DDL, applies migrations 0000–0008, then
+normalizes attributes and least-privilege grants in one administrative transaction. It never creates
+a role or reads, sets, resets or rotates a password. The command is idempotent.
+`XCS_DATABASE_CLUSTER_SCOPE=dedicated` is required because PostgreSQL login roles are cluster-wide
 even though the grants are scoped to the selected database. Bootstrap reports role names or a stable
 failure code, never URLs or password values.
 
diff --git a/docs/implementation-plan.md b/docs/implementation-plan.md
index 1786d1d..2000604 100644
--- a/docs/implementation-plan.md
+++ b/docs/implementation-plan.md
@@ -101,9 +101,11 @@ profiles, `exclusive-profile` rejects any different existing profile, and the co
 requires the exclusive mode.
 
 PostgreSQL bootstrap treats fixed cluster-wide roles as a dedicated-cluster boundary. It applies the
-single current-schema baseline, serializes role changes, removes unexpected direct memberships,
-normalizes role attributes and current-database grants, and writes SCRAM-SHA-256 passwords. A
-`pg_hba.conf` role-to-database SCRAM allowlist remains required defense in depth.
+single current-schema baseline, validates provider-created users and their membership graph, and
+normalizes current-database grants. The managed service alone creates users and manages passwords;
+bootstrap attempts bounded connection limits, timeout defaults and the monitoring membership, then
+reports any control the provider refuses. A provider-side role-to-database policy remains required
+defense in depth.
 
 Runtime database serialization no longer relies on advisory locks. Concurrent profile
 initialization and pin reservation use the same `SERIALIZABLE` helper with five bounded,
diff --git a/docs/issue-25-plan.md b/docs/issue-25-plan.md
new file mode 100644
index 0000000..b403b70
--- /dev/null
+++ b/docs/issue-25-plan.md
@@ -0,0 +1,105 @@
+# Issue #25: application data model
+
+Status: model and helpers implemented and locally verified; maintainer review and API integration
+remain pending. No live database or public route is changed.
+
+## Goal and boundaries
+
+Add a reviewed application model alongside the existing XRPL projections, following
+[ADR 0004](adr/0005-role-based-application.md). Deliver an ERD and data dictionary in
+`docs/database-app.md` linked from `docs/database.md`, Drizzle definitions under
+`packages/db/src/schema/app/`, and centrally tested
+private-claim visibility rules under `packages/db/src/app/visibility.ts`.
+
+Do not change projection definitions or historical migrations. Issue #26 owns migration tooling
+and rollout; issue #29 owns `docs/ux/` in another terminal. Authentication, live private hosting and
+role-specific pages are subsequent implementation work, not delivered by a schema definition.
+
+## Accepted ownership decision
+
+Separate human accounts from organizations. An organization has one responsible user initially;
+organization identity is stable independently of that user's identity. No team management or
+responsibility-transfer workflow is included. This refines the original issue's organization-as-user-
+profile proposal without creating a generic multi-tenant permissions framework.
+
+Implemented domain split; exact columns and constraints are in the application dictionary:
+
+- Accounts: identity-provider subjects, account state, verified contact information and wallet links.
+- Organizations: stable identity, responsible user, issuer/verifier applications, profiles and
+  approval evidence. Approval to issue does not automatically approve verifier access.
+- Documents: object-storage references and review metadata, not document bytes or private claims.
+- Issuance: invitations and organization-owned references to on-chain schemas and credential
+  generations, with explicit network-profile identity.
+- Sharing: recipient-authorized grants addressed to a verifier organization, without automatic
+  expiry or issuer-specific allowlists; revocation and current approval remain enforced.
+
+The ledger remains the lifecycle authority. An invitation is application state, not an on-chain
+credential generation. Existing public hosted payloads must not be reused as private storage.
+
+## Accepted invitation decision
+
+Possession of a valid invitation authorizes an authenticated account to claim it without matching
+the delivery email. Keep delivery email, claimant identity and proven wallet ownership separate.
+Persist only the token hash, bind the claimant once through atomic redemption, and reject subsequent
+claims by another account. Opening the invitation is read-only; claiming is an explicit action.
+The issuer reviews the actual claimant and proven wallet before signing. A forwarded or leaked
+link can be claimed by its holder first; this trade-off is explicit in ADR 0004.
+
+## Decisions and dependencies still to resolve
+
+- Invitation lifetime and retention remain separate from the no-expiry private-sharing policy.
+- Credential visibility selection belongs to the parallel UX discussion; do not choose public versus
+  private defaults or a decision-maker here without that outcome.
+- Specify retention/deletion behavior for profiles, documents, invitations and account links before
+  encoding cascades. Application deletion cannot delete public ledger history.
+- Review application runtime grants before the authenticated API is connected. Existing `xcs_api`
+  is projection-read-only; `xcs_payload_writer` is not a general application writer. The generated
+  forward migration grants no new runtime access.
+
+## Milestones
+
+1. **Complete — settle ownership and invitation claim binding.** Accepted choices are in ADR 0004.
+   Remaining product policies do not receive silent defaults: visibility is explicit, invitation
+   expiry is required from the caller, and deletion remains restrictive pending retention decisions.
+2. **Complete — ERD and dictionary.** Added `docs/database-app.md` with a link from `docs/database.md`,
+   preserving the other terminal's #26 migration documentation. Maintainer acceptance remains an
+   external review gate, not something inferred from an automated review.
+3. **Complete — Drizzle model and helpers.** Ten application tables, atomic link redemption and
+   current-state authorization/filtering implement the accepted decisions. The real PostgreSQL
+   tests cover concurrency, replay, expiry, revocation, wrong audience/network/generation, suspended
+   accounts, ownership and admin-only denial. A static review identified transaction-start expiry;
+   a failing PostgreSQL regression reproduced it and now passes with `statement_timestamp()`.
+4. **Complete — local verification and migration artifact.** Drizzle generated
+   `0003_application_model.sql`; historical SQL/snapshots and projection definitions are unchanged.
+   Fresh creation, upgrade retaining public payload bytes, repeated application and existing
+   indexer/API integration suites pass. No live migration or deployment was run.
+
+## Verification and rollout
+
+Checks performed on 2026-09-23 in the shared worktree, including the concurrent issue #26
+migration-tooling changes (which are committed separately):
+
+- `pnpm --filter @xcs-protocol/db test` with an isolated PostgreSQL 18 URL: **89 passed**, including
+  14 new claim-filter/token tests and 20 new application-model PostgreSQL tests.
+- `pnpm test:postgres` on that isolated cluster: **50 passed** (32 DB, 13 indexer, 5 API). The first
+  wider run rejected the disposable administrator password's length; rerun with a compliant test
+  password passed without weakening validation.
+- `pnpm typecheck` and `pnpm lint`: pass across all six packages (unchanged packages may use Turbo
+  cache); `pnpm --filter @xcs-protocol/db build`: pass.
+- `pnpm --filter @xcs-protocol/db db:generate`: no new migration; SQL, snapshot and journal bytes
+  unchanged by regeneration. Focused Prettier checks and `git diff --check`: pass.
+- Historical migration/snapshot and existing projection source diff: empty. A regression assertion
+  also compares every existing table definition between snapshots 0002 and 0003.
+
+No browser, live wallet or XRP Identity flow was tested: this work adds no UI/authentication route.
+No new dependencies or deployment. The tests used only disposable synthetic records.
+
+Before committing, the staged #25 tree was exported separately from the concurrent #26 work:
+54 database unit tests passed, followed by all 20 application-model tests on disposable PostgreSQL 18. Database typecheck and build also passed against that isolated tree; staged file formatting
+and whitespace checks passed.
+
+The intended rollout is additive: provision application tables and least-privilege runtime grants
+before deploying consumers. Existing projection reads must continue to work. Once application data
+exists, prefer application rollback or a forward fix over dropping populated tables. No live
+database operation was performed by this implementation. Application-role provisioning, private
+object delivery, retention schedules and end-to-end authentication remain separate release gates.
diff --git a/docs/issue-26-plan.md b/docs/issue-26-plan.md
new file mode 100644
index 0000000..81bbba7
--- /dev/null
+++ b/docs/issue-26-plan.md
@@ -0,0 +1,72 @@
+# Issue 26 — forward migration commands
+
+Baseline: `6aa23f5`, with concurrent ADR 0004 and issue 29 documentation preserved.
+
+## Goal and boundaries
+
+Provide `db:migrate` and read-only `db:status` for the existing Drizzle journal, retaining bootstrap
+for initial runtime-role provisioning. Keep all deployed SQL, snapshots and journal timestamps
+unchanged. No application tables, active database, wallet environment or running service is changed.
+
+## Milestones
+
+1. **Complete:** add shared migration/status implementation, immutable-history checks and
+   serialized migration execution; bootstrap reuses it and validates configuration first.
+2. **Complete:** add commands, database package export/build entries, one-shot Compose migration profile,
+   secret-file support and CI generation checks including untracked generated files.
+3. **Complete for the 0000–0002 baseline:** test fresh/repeated/upgrade/failure/concurrent/history-drift cases on isolated PostgreSQL
+   18, then existing indexer/API integration suites; build and smoke the unprivileged database image.
+4. **Complete:** synchronize operator documentation and review the #26 diff and preserved SQL hashes.
+
+## Execution evidence
+
+- `pnpm --filter @xcs-protocol/db typecheck` and package build passed.
+- Database unit suite: 43 passed; the 12 PostgreSQL cases were deliberately skipped there without
+  a database URL and were run separately below.
+- `pnpm test:postgres` against a newly created isolated PostgreSQL 18 cluster exposed only on
+  loopback port 55426: 12 migration, 13 indexer and 5 API integration tests passed. No active Testnet
+  service was stopped or its database contacted.
+- `db:generate` produced no diff or untracked artifact on the existing 0000–0002 catalog before
+  concurrent #25 migration generation started. Existing SQL bytes and journal prefix are preserved.
+- Base/dev/secrets/hosted-payload Compose configurations rendered with monitoring, demo-pinning
+  and maintenance profiles. The migration job uses the bootstrap image and only its admin secret.
+- Production database image built; status → migrate → migrate → status passed on a fresh isolated
+  database as uid 1000, with a read-only filesystem and mounted URL secret. Native built CLIs passed
+  the same sequence through the external loopback URL and returned redacted JSON on failure.
+- `sh ops/ci/test-node-entrypoint.sh` passed, including bootstrap-URL secret-file loading.
+- `pnpm verify` was attempted and stopped at formatting in concurrently added #25 files:
+  `schema/app/identity.ts`, `issuance.ts`, `organizations.ts`, `presentations.ts`. Those files were
+  not reformatted or fixed by #26. This is not a full-workspace green result; later stages did not run.
+
+The concurrent #25 task added application schemas, helpers and migration `0003_application_model`
+after the baseline checks above. That migration's constraints, runtime grants and complete combined
+workspace require the #25 validation; these results must not be represented as its release evidence.
+No production migration was performed for #26. Its implementation and the #29 design are committed
+separately from the concurrent #24/#25 work.
+
+## Validation and rollout
+
+- Narrow database unit/type checks, migration PostgreSQL suite, existing PostgreSQL suites.
+- Drizzle generation yields no changed or untracked migration artifact.
+- Render base, dev, secrets, hosted-payload and optional profiles without reading real secrets.
+- Run the database production image as its configured unprivileged user against a dedicated test
+  cluster, using mounted test-secret files; exercise status and migration twice.
+- Managed production PostgreSQL is external. Operators back it up and stop/fence indexer and web
+  writers before projection migrations, run migrations with an administrative identity, validate
+  status/privileges, then deploy services. Runtime accounts never receive DDL or admin credentials.
+- Recovery uses forward fixes. For an incompatible committed migration restore a verified backup
+  into a separate database and deploy its matching application version; never rewrite history.
+
+## Risks and assumptions
+
+Drizzle 0.45.2 selects migrations by timestamp without validating recorded hashes or serializing
+separate processes. The wrapper rejects a non-prefix/modified history before DDL and acquires
+a database-scoped transaction advisory lock. It uses Drizzle's SQL reader and existing journal
+format inside one postgres.js transaction: the stock Drizzle migrator cannot consume a reserved
+postgres.js connection. Provisioning remains a separate
+transaction after migrations because its grants refer to existing tables. This limitation must be
+documented rather than presenting bootstrap as one atomic migration-plus-role transaction.
+
+The existing integration suites alter cluster-wide roles; use a new disposable cluster, never the
+running Testnet PostgreSQL containers. Live managed-provider permission differences remain an
+operator qualification requirement, even after isolated external-URL tests pass.
diff --git a/docs/issue-27-plan.md b/docs/issue-27-plan.md
new file mode 100644
index 0000000..4775f6f
--- /dev/null
+++ b/docs/issue-27-plan.md
@@ -0,0 +1,69 @@
+# Issue 27 — XRP Identity and wallet linking
+
+Baseline: `ee39ba5`. Tracks [#27](https://github.com/XRPL-Commons/XCS/issues/27).
+
+## Goal and boundaries
+
+Add an optional XRP Identity authorization-code/PKCE login, PostgreSQL sessions, current role guards
+and non-transactional wallet ownership proofs. Keep existing public discovery and wallet transaction
+flows available. No issuer/verifier auto-approval, admin override, invitation or private delivery flow.
+
+## Evidence and decisions
+
+- The current Identity discovery document and its repository identify `https://account.xrpl.in`
+  as issuer; `identity.xrpl.in` in the issue no longer resolves in this environment.
+- Commons' `starter.2026.04/modules/1.auth/server/providers/xrplIdentity` uses `openid-client`.
+  Reuse that library and code-flow pattern, but bind XCS users by verified issuer/subject, not email;
+  validate ID-token signatures and nonce, and do not import provider roles into XCS approvals.
+- Existing `app_*` tables have no runtime grants or session tables. Add an isolated `xcs_app` pool
+  and a forward migration. Historical migrations and current public pools remain unchanged.
+- New accounts receive only the personal recipient role. Issuer/verifier access comes from the
+  current approval of an active organization managed by that account.
+- Default sessions: 30 minutes idle, at most 8 hours since sign-in; refresh rotates the opaque
+  cookie and CSRF value. Logout ends the current XCS session, not every Identity application.
+- Secure, httpOnly, SameSite=Lax cookies; no provider tokens or session bearer in browser storage.
+  Browser tests use an isolated provider and storage adapter only in explicit development E2E mode.
+- Real OIDC client registration/secrets remain an external prerequisite, requested from the user.
+  No credentials are copied into the repository or conversation.
+
+## Milestones
+
+1. **Complete:** verify provider and wallet contracts; add auth schema and least-privilege role.
+2. **Complete:** implement OIDC/session routes, CSRF, live permission guards and atomic wallet proofs.
+3. **Complete:** add bilingual account screens and navigation, with explicit unsupported-wallet states.
+4. **Complete:** test provider errors, session expiry/revocation, denied roles, invalid/replayed proofs,
+   restricted database grants, browser reload/logout and unchanged public routes.
+5. **Complete:** synchronize configuration, registration/deployment runbook and verification evidence.
+
+## Validation evidence
+
+- `pnpm lint`, `pnpm typecheck`, `pnpm test` and `pnpm build`: passed; 890 unit tests.
+- Focused authentication suites: 72 tests covering configuration, real OIDC exchanges with a
+  loopback provider, HTTP/session boundaries and wallet signatures.
+- `pnpm test:postgres`: 63 tests passed on a dedicated disposable PostgreSQL 18 cluster, including
+  restricted-role grants, additive migrations, concurrent proofs and logout during session rotation.
+- `pnpm --filter @xcs-protocol/web test:runtime`: 2 production Nuxt/PostgreSQL tests passed.
+- Browser suites: 42 tests passed (37 public flows, 3 production security, 2 OIDC/account flows).
+  The public suite used `XCS_E2E_PORT=3147` because the existing service on port 3100 was left running;
+  the security and auth suites used their normal isolated ports. Production builds completed first.
+- Compose base, development, secrets, auth and hosted-payload overlays rendered with their profiles.
+  Production DB/web images built and started with mounted secrets, read-only filesystems and uid 1000. Bootstrap, public liveness, unauthenticated session and denied issuer access passed.
+- `pnpm verify` stops at existing formatting in unchanged `docs/issue-25-plan.md`; its remaining
+  checks were run separately and passed. That unrelated document was left intact.
+- Real Identity client registration, provider login and extension consent remain unverified external
+  release prerequisites. See [the authentication runbook](runbooks/authentication.md).
+
+Validation caught and fixed raw PostgreSQL timestamp conversion, session-rotation/logout races and
+a nonreactive wallet-button dependency. Production image smoke also caught `pnpm deploy` stripping
+Nitro's nested dependency symlinks; the web image now preserves the complete generated output.
+
+## Verification and rollout
+
+Run focused unit/HTTP tests first, then isolated PostgreSQL tests, static checks and a production
+build. Exercise login/reload/link/unlink/logout with a stub OIDC provider through the browser.
+Render relevant Compose overlays and build/smoke the affected production image as required.
+Real provider sign-in and real extension approval are separate checks, never inferred from stubs.
+
+Apply additive migrations before enabling authentication, provision the optional application role,
+then configure its private URL and OIDC client. Disabling auth restores the current public-only
+deployment; retain application data and use forward fixes rather than destructive down migrations.
diff --git a/docs/issue-28-plan.md b/docs/issue-28-plan.md
new file mode 100644
index 0000000..9800535
--- /dev/null
+++ b/docs/issue-28-plan.md
@@ -0,0 +1,63 @@
+# Issue 28 — Nuxt API integration
+
+Base: `integration/current-flow` / PR #35, commit `212ba0c`. Branch: `issue/28-nuxt-api`.
+PR #35 is not merged; this change must remain a separate stacked PR until its base is accepted.
+
+## Approved scope
+
+Fold the standalone HTTP API into Nuxt/Nitro, preserve `/v1/**`, `/health/**`, `/p/**`,
+metrics and OpenAPI contracts. Use `xcs_api` for projection reads and a separate
+`xcs_payload_writer` connection for hosted payload/demo pinning writes. No new product roles,
+authentication, invitation flow, protocol changes or reset of the running site/database.
+
+## Milestones
+
+1. Complete: move the existing business logic and contract tests into the web server;
+   replace the Fastify boundary with native H3 handlers, preserving schema validation,
+   serialization, limits, CORS, exact error codes and ledger evidence checks.
+2. Complete: provision least-privilege DB identities, wire lifecycle-managed separate pools,
+   remove the SSR HTTP/token hop and use in-process same-origin requests.
+3. Complete: update deployment/env/OpenAPI documentation, test empty/upgrade databases and
+   denied writes, run unit/static/browser/production build and isolated Docker checks.
+4. Reviewed locally; prepare one issue-specific commit and a separate draft PR. PR #35 must merge
+   first. Upstream write permission is unavailable, so the PR targets upstream `main` from the fork
+   and must link the focused comparison against `212ba0c` until that dependency lands.
+
+## Validation and rollback
+
+Retain the existing API contract tests against the new HTTP stack. Add tests for oversized bodies,
+spoofed forwarding/internal headers, canonical responses, SSR identity and no network hop.
+Test SQL grants with independent restricted connections; neither web role can mutate the
+projection. Preserve all applied migration bytes. Verify bootstrap against an isolated external
+PostgreSQL URL, never the active pilot database. Build both production image paths and render
+Compose overlays without starting the active project.
+
+Retain the original API origin at the ingress when moving it to Nuxt. Preserve the browser origin
+and immutable payload URLs so local recovery records and ledger-bound URIs keep working. The
+read-role grant change requires coordinated rollout; rollback must restore old code/grants from
+the recorded baseline, not drop application data. Existing dependency-license and real-wallet
+release gates remain separate and cannot be bypassed by this migration.
+
+## Verification — 2026-09-23
+
+- `pnpm verify`: formatting, lint, types, 797 unit tests and all six package builds passed.
+- PostgreSQL 18: 13 indexer and five API integration tests passed on an isolated cluster,
+  including legacy privilege revocation and denied projection writes.
+- Production Nuxt runtime: two integration tests passed. Real PostgreSQL pools and local
+  cryptographic signing exercise hosted publication/idempotency/immutable bytes; the projection
+  is explicitly synthetic, not a claim of live XRPL validation. SSR ignores an unreachable
+  browser API URL. A real Nitro localFetch regression proves independent quota identities.
+- Playwright: 37 deterministic browser flows and three production security tests passed.
+  Fixed an existing host/browser clock race in the pending-wallet test; five repeated runs passed.
+- Both `Dockerfile` and `docker/Dockerfile.node` web images built and served health/docs/HTML,
+  HEAD and POST validation under UID 1000 with read-only filesystem, dropped capabilities and
+  file-mounted read/writer configuration. No live deployment was replaced.
+- Compose overlays/profiles rendered; entrypoint tests, ShellCheck, actionlint and immutable
+  workflow-reference checks passed. `db:generate` produced no migration changes.
+- Production advisory gate at `high`: passed (two low, one moderate remain).
+- License gate: still fails on pre-existing unknown metadata for `@gemwallet/api@3.8.0`,
+  `@walletconnect/types@2.24.0`, `vaul-vue@0.4.1`. No license exception was added.
+
+Not performed: live extension-wallet approvals, public deployment, production managed-provider
+bootstrap, remote CI execution or merging PR #35. This is reviewable implementation evidence,
+not a declaration that all release gates are cleared.
diff --git a/docs/issue-30-plan.md b/docs/issue-30-plan.md
new file mode 100644
index 0000000..701b8a6
--- /dev/null
+++ b/docs/issue-30-plan.md
@@ -0,0 +1,68 @@
+# Issue 30 — organization access administration
+
+Status: archived preparation notes. Implementation and current validation are recorded in
+[the completed admin plan](plans/issue-30.md). The reconciliation with #27 is included in the
+consolidated PR #35; the notes below preserve the earlier handoff context.
+
+## Sources and prerequisites
+
+The local [admin journey](ux/admin/README.md) and [ADR 0004](adr/0005-role-based-application.md)
+define the intended boundary. The live issue was retrieved on 2026-09-23 after transient GitHub
+API failures. It requires admin bootstrapping, A1–A4, expiring document links, exactly one email per
+decision and non-admin rejection. ADR 0004 supersedes its per-issuer allowlist requirement.
+
+Issue #27 supplies sessions, current personal admin grants, role middleware and CSRF protection.
+Its changes are committed and pushed as `2818ef2` on `issue/28-nuxt-api`. Real OIDC registration
+remains an activation prerequisite, not a prerequisite for isolated implementation tests.
+
+The existing `.data/xcs-admin30` worktree on `issue/30-admin` contains uncommitted admin
+implementation and its own `docs/plans/issue-30.md`. It started from `ee39ba5` with a copied #27
+snapshot. Preserve that work; reconcile it with committed #27 before integration. The milestones
+below describe this preparatory plan, not the status of that other worktree. No admin implementation
+or tests from that worktree were changed or rerun here.
+
+## Goal and non-goals
+
+Provide bilingual A1–A4 screens: oldest-first application queue, application review, global verifier
+approval management and metadata-only audit history. Admin authorization must be enforced by the
+server on every request, including document access and concurrent mutations.
+
+No issuer-specific verifier allowlist, private-claim override, ledger permission change, automatic
+admin enrollment or organization ownership transfer. Public routes remain available.
+
+## Repository evidence
+
+- `packages/db/src/schema/app/organizations.ts` already stores organization profiles, per-role
+  applications, current review decisions and private document metadata.
+- Application identity is `(organization_id, role)`, not a standalone application UUID. Routes must
+  preserve that identity rather than assuming the draft `:id` represents an existing primary key.
+- The schema requires a reason for rejection/suspension and records the reviewer and review time.
+  It does not provide a decision history, notification outbox or document-access token table.
+- `xcs_app` currently has only authentication grants; it cannot write application decisions.
+- No email delivery adapter or private review-document object storage was found in the inspected
+  server, database and Compose configuration. Choose and document these integration boundaries
+  before promising sent notifications or usable document links.
+
+## Milestones
+
+1. **In progress — scope:** reconcile the live issue, confirm the notification and document-storage
+   contracts, and inventory the exact grants needed. Preserve the accepted ADR decisions.
+2. **Pending — persistence:** add a forward migration for decision history and any required delivery
+   state. Implement atomic conditional transitions with audit and delivery intent in one transaction.
+   Concurrent reviewers must not overwrite an already-recorded decision or duplicate notifications.
+3. **Pending — server:** add admin-only bounded list/detail/mutation endpoints. Recheck the actor's
+   current admin role inside mutations; use exact-origin CSRF and explicit allowed transitions.
+   Document access must expire, remain authorized and expose neither storage keys nor private claims.
+4. **Pending — interface:** implement FR/EN A1–A4, reason validation, empty/error states, concurrent
+   decision feedback, access revocation and notification retry without repeating the decision.
+5. **Pending — verification:** test non-admin rejection, revoked/expired sessions, audit integrity,
+   concurrent decisions, notification failure/retry, expiring document access and unchanged public
+   flows. Run PostgreSQL, browser, static and affected production-image checks.
+
+## Rollout and recovery
+
+Apply additive migrations and provision only the required privileges before enabling the admin
+screens. Seed the first administrator through an explicit operator procedure, never provider roles
+or public signup. Configure private storage and notification delivery before advertising them as
+available. Disabling the feature must preserve recorded decisions and audit history; recover through
+forward fixes rather than deleting populated application tables.
diff --git a/docs/known-limitations.md b/docs/known-limitations.md
index 6421490..edc0c06 100644
--- a/docs/known-limitations.md
+++ b/docs/known-limitations.md
@@ -21,10 +21,14 @@ integrators.
   lists schema registrations, not Credential events.
 - Commons publishes no issuer badges, rankings or universal trust result. Issuer trust remains an
   application policy separate from ledger state, schema validity and payload integrity.
-- The beta has no XCS user or organization account. Wallet operations and receipts are local to one
-  browser, so clearing site data or moving devices loses that local history.
-- Issuance is one Credential at a time through a supported wallet. Batch issuance, teams, RBAC,
-  hosted automation and GraphQL are outside the beta scope.
+- Public Explorer reads and public presentation resolution remain accountless. OIDC accounts,
+  wallet linking, admin approval and role workspaces add server sessions and organization records;
+  approval is not issuer endorsement. See [ADR 0007](adr/0007-guided-role-portals.md). Wallet operations and
+  receipts still use browser-local recovery, lost on site-data clearing or a device change.
+- Issuance is one Credential at a time through a supported wallet. Batch issuance, team membership,
+  fine-grained team permissions, hosted automation and GraphQL remain outside this implementation.
+  Recipient inbox, consented private acceptance, revocable presentations and verifier history are
+  implemented. Real-user usability sessions and live wallet/OIDC qualification remain release gates.
 - `@xcs-protocol/core`, `@xcs-protocol/sdk`, and `@xcs-protocol/cli` have reproducible tarball and
   isolated-consumer gates, but they are not registry-installable until XRPL Commons completes the
   one-time npm scope bootstrap. Developers guidance therefore remains explicitly monorepo-local.
@@ -56,22 +60,28 @@ integrators.
 - PostgreSQL is a self-hostable, rebuildable reference projection, not a Commons authority and not a
   protocol requirement for third-party implementations. A MongoDB adapter would need to reproduce
   atomic checkpoints, single-writer fencing, snapshots, constraints, and deterministic replay.
-- The reference bootstrap supports only a fresh database on a dedicated cluster. It creates
-  cluster-wide fixed roles, applies current-database grants and forces SCRAM-SHA-256 verifiers, but
-  it is not a shared-cluster bootstrapper, forward-compatible upgrader or anti-administrator
-  attestation. The administrator and reviewed baseline remain trusted; transport security and an
-  explicit SCRAM `pg_hba.conf` policy remain operator responsibilities.
-- There is intentionally no pre-production upgrade history. Every current constraint and index is
-  created by `db/migrations/0000_baseline.sql`; before production a schema change means regenerating
-  that migration and recreating the projection database. The migration history must freeze before
-  production, after which changes require reviewed forward migrations. `db:migrate` exists and is
-  idempotent, but it has never been exercised across a real pre-existing deployment.
+- The reference bootstrap targets a dedicated cluster. DigitalOcean must create all eight runtime
+  users and owns their passwords; bootstrap only validates them and applies current-database grants.
+  It is not a shared-cluster bootstrapper or an upgrader for arbitrary database histories. The
+  administrator and reviewed migration history remain trusted; transport security remains an
+  operator responsibility.
+- The shared `db/migrations/` history supports upgrades from the committed projection baseline
+  through migrations 0000–0008, including hosted payload, application, authentication, admin,
+  issuer, recipient and signed-presentation storage. PostgreSQL integration tests exercise
+  populated-baseline upgrades, preserving
+  profiles and legacy payload bytes/locators, plus repeat migration runs. Use the standalone
+  indexer's migration commands before enabling the corresponding web features; retain applied
+  migration bytes and add forward migrations. This does not provide a migration from the former
+  Nuxt MVP or arbitrary schema drift. A particular live deployment still needs its own backup and
+  upgrade qualification. The projection is rebuildable from ledger data; application accounts,
+  documents and private payloads are not and need backups.
 - Signed PostgreSQL `integer` coordinate columns, including transaction and node indexes, still
   represent at most `2147483647`, not the full abstract uint32 range. The schema enforces their
   non-negative boundary but does not widen them.
 - XRPL Commons intends to host the shared Testnet indexer, read API and PostgreSQL projection. That
   projection remains a reconstructible cache and contains neither issuer/subject signing keys nor
-  credential claims.
+  credential claims. Optional application and payload services persist claims separately in the
+  same deployment using restricted writer roles; the database as a whole is not claim-free.
 - The `/v1` rate limiter is in-memory and suitable for the single-instance beta. Horizontal replicas
   require a shared edge/store limiter. The client address is resolved through
   `XCS_TRUSTED_PROXY_CIDRS`, which must be narrow and explicitly configured; catch-all `/0` trust
@@ -92,7 +102,7 @@ integrators.
   modal styles and images; the ingress must preserve one policy instead of appending its own.
   Inline `style` attributes are allowed (`style-src-attr 'unsafe-inline'`) because the Nuxt UI
   component library positions menus, popovers and toasts through them; script execution remains
-  nonce-gated with `'strict-dynamic'`, which is the XSS control.
+  nonce-based with `'strict-dynamic'`, but is not enforced while the policy is report-only.
 - The policy's `connect-src https:` allowance is intentional: permissionless issuer-hosted payload
   domains cannot be known at deployment time. Host display, explicit consent, exact-generation
   revalidation and payload integrity checks remain the application boundary. Narrowing this to a
@@ -108,28 +118,24 @@ integrators.
 
 - `apps/web` and `apps/indexer` are standalone deployables that import no workspace package. Each
   carries hand-maintained copies of the protocol and database code it needs, headed by a comment
-  naming the source file and the commit it was copied at. **Nothing enforces that they stay in
-  sync.** A fix landed in `packages/core` with green package tests changes nothing in either
-  application until a human mirrors it, and no build, type check or test fails to point that out.
-  The mirroring rule in [`CONTRIBUTING.md`](../CONTRIBUTING.md) and code review are the only
-  controls. This is the deliberate cost of independent deployability, and it is a real correctness
-  risk for security-relevant protocol fixes.
-- The copies can also drift silently in the other direction: a change made directly in an
-  application copy does not reach `packages/core`, `packages/sdk` or the CLI, so the published
-  library can become the stale one. Treat `packages/core` as the reference implementation and land
-  there first.
+  naming the source file and the commit it was copied at. CI's
+  `ops/ci/check-vendored-copies.mjs` checks source/copy parity while allowing import rewrites;
+  deliberate divergence pins a reviewed source digest. Changes still require manual mirroring
+  and app validation under [CONTRIBUTING.md](../CONTRIBUTING.md); package tests alone do not
+  exercise the deployed copies.
+- A direct application-copy edit does not update `packages/core`, `packages/sdk` or the CLI.
+  The parity gate rejects unreviewed differences; land protocol changes in the reference source
+  and mirror them in the same change.
 - The two applications pin their dependencies in separate lockfiles. `drizzle-orm` in particular must
   stay identical in both, because `db/schema/` is compiled by each application against its own copy;
-  nothing checks this automatically.
+  `ops/ci/check-drizzle-parity.mjs` enforces lockfile parity in CI.
 - `--ignore-workspace` is mandatory on every per-app pnpm command that resolves dependencies
   (`install`, `audit`, `licenses list`). Without it pnpm silently operates on the root workspace and
   still exits 0, so an audit or licence report can appear to pass while covering the wrong lockfile.
-- No CI job checks dependency licences. The self-imposed licence policy gate was removed once the
-  questions it existed to surface had been answered; those answers now live in
-  `docs/third-party-licenses.md`, which records each non-permissive licence, the permission or
-  review behind it, and the SHA-256 of the exact text that was reviewed. Nothing recomputes those
-  digests, so a change to upstream terms will pass unnoticed. Re-read that note before a release
-  that changes wallet dependencies.
+- Dependency licence decisions are recorded in [`third-party-licenses.md`](third-party-licenses.md).
+  The former automated allowlist gate was removed after Commons recorded the GemWallet permission,
+  WalletConnect conditions, Vaul notice restoration and permissive Nodemailer MIT-0 terms. Review
+  that record again whenever one of these exact versions changes.
 - PostgreSQL is provisioned outside this repository. The Compose stack — including the `monitoring`
   and `demo-pinning` profiles — is local development only: it carries no secret-file mechanism and
   passes Grafana's admin password and the exporter's database password as plain container
@@ -141,64 +147,39 @@ integrators.
 
 ## Wallets
 
-- The Nuxt alpha pins the release candidate `xrpl-connect@1.0.0-rc.0`. Its factory covers the eight
-  official adapters—Xaman, Crossmark, GemWallet, WalletConnect, Ledger, Xyra, Otsu and MetaMask
-  Snap—but only the six self-configuring adapters are registered by default. Xaman requires the
-  public `NUXT_PUBLIC_XAMAN_API_KEY`; its optional `NUXT_PUBLIC_XAMAN_REDIRECT_URL` is constrained
-  to the same-origin root and otherwise derived from the browser origin. The exact root URL must be
-  registered for that application in Xaman's Developer Console. WalletConnect requires the public
-  `NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID`. Their Compose inputs are
-  `XCS_PUBLIC_XAMAN_API_KEY`, `XCS_PUBLIC_XAMAN_REDIRECT_URL` and
-  `XCS_PUBLIC_WALLET_CONNECT_PROJECT_ID`. These values are not secrets, and absence of an
-  application identifier removes the corresponding adapter. Each self-hosted origin still needs a
-  Xaman application registration; the Commons public application ID cannot authorize arbitrary
-  third-party redirect origins.
-- The two wallet licences are covered by permission and review, recorded in
-  `docs/third-party-licenses.md`, not by reclassification. GemWallet's `LICENSE` is dual: its
-  MIT-like arm covers personal, educational and non-public research use only, and public, commercial
-  or beta use needs GemWallet's permission. Commons holds that permission, granted by Florent Bouron
-  in January 2026, and it covers public and beta use of the GemWallet API. The WalletConnect
-  Community License Agreement (release date 20 August 2025) is accepted on its attribution and
-  usage-threshold conditions: attribution is carried by the upstream
-  `packages/xrpl-connect/THIRD_PARTY_NOTICES.md` in `XRPL-Commons/xrpl-connect`, and the XCS
-  maintainer attested on 2026-09-28 that XRPL Commons is below the agreement's usage thresholds.
-  Neither licence may be restated as MIT: downgrading to `0.8.2`, removing only their lockfile entries
-  or reclassifying their licences would conceal rather than remove the bundled code, and the upstream
-  per-adapter packages are not currently published on npm.
-- XCS invokes only adapter `sign()`. It normalizes a returned `tx_blob` or signed `tx_json`, checks
-  the derived hash, XRPL signature, optional `signerAddress` and exact equality with the reviewed
-  transaction, then persists and submits the blob itself. Calling or falling back to
-  `signAndSubmit` would bypass the recovery and pre-submission controls and is forbidden.
-- Eight adapters do not mean every wallet is compatible. WalletConnect can discover more wallets,
-  but each one still needs the XRPL Testnet namespace and native `CredentialCreate`,
-  `CredentialAccept` and `CredentialDelete` support. Real browser extensions, Xaman popup,
-  WalletConnect QR/deep links and Ledger hardware access remain an adapter-by-adapter manual gate.
-- GemWallet 3.8.x is a known transaction-specific exception: its embedded XRPL validator predates
-  XLS-70 and rejects every native `Credential*` type before signing. XCS leaves GemWallet enabled for
-  schema-registration `Payment` transactions, labels its Credential limitation in the chooser and
-  rejects Credential preparation before a wallet popup or operation journal entry. Removing this
-  guard requires a newly released GemWallet version plus real Testnet evidence for create, accept
-  and delete; updating only `xrpl-connect` in XCS cannot replace the extension's embedded codec.
-- Xaman's current source includes native Credential handling, so XCS labels it as supported when the
-  public application identifier enables the adapter. This label is a capability indication, not
-  release qualification: the popup flow and all returned signed artifacts still need the manual
-  Testnet matrix gate.
-- The release candidate declares the peer range `xrpl ^3 || ^4`, while XCS uses `xrpl` 5. This
-  combination passes only repository-side compatibility checks until upstream declares or a stable
-  release proves support; it remains a release risk. The RC also adds a substantial browser
-  dependency tree and bundle cost that must be measured before the public beta.
-- The production dependency audit reports `CVE-2025-14505` in `elliptic@6.6.1`, pulled through
-  XRPL Connect's Crossmark declaration dependency. No patched `elliptic` release exists. The current
-  audit classifies it as low severity, but public release still requires either an upstream removal
-  of that dependency path or a documented security acceptance based on evidence that XCS never
-  executes it for signing.
-- The published RC reports Otsu available without checking the injected provider marker. XCS keeps
-  a narrow local availability override equivalent to the adapter's connect-time marker check. Drop
-  that workaround only after upgrading to a release containing the upstream correction.
-- The same RC asks Otsu for `read`, `sign`, `submit` and `switchNetwork` scopes even though XCS never
-  invokes wallet submission. It also proposes extra WalletConnect methods that some otherwise
-  sign-capable XRPL wallets may reject. Both permission surfaces need an upstream least-privilege
-  fix and real-wallet evidence before those adapters can be promoted beyond the controlled pilot.
+- The application pins `xrpl-connect@1.0.0-rc.2` and its official Vue bindings at the same version.
+  Crossmark, GemWallet, Ledger, Xyra, Otsu and MetaMask Snap are registered without deployment
+  identifiers. Xaman requires `NUXT_PUBLIC_XAMAN_API_KEY`; WalletConnect requires
+  `NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID`. These are browser-visible identifiers, never secrets.
+  Xaman's SDK selects redirects; the former redirect environment variable is no longer consumed.
+  Each deployment must register and qualify its actual origin and callback URLs.
+- XCS uses sign-only operations, validates the returned artifact's signature and exact reviewed
+  fields, journals it, then submits through its configured Testnet RPC. It never invokes
+  `signAndSubmit`. GemWallet's explicitly consented Credential path uses its public hex-message
+  signing API; it does not grant XCS custody or permission to sign without another approval.
+- GemWallet 3.8.x's transaction codec cannot sign native `Credential*` types. The Testnet raw path
+  validates and serializes the reviewed transaction, binds the master public key to the connected
+  account and verifies the returned signature before persistence/submission. GemWallet displays
+  hexadecimal data rather than decoded transaction fields, so explicit acknowledgement is required
+  for each attempt. Regular keys and multisigning are not supported by that path. See the
+  [recorded GemWallet qualification](runbooks/gemwallet-raw-signing.md).
+- Otsu selection disconnects a previous origin permission before reconnecting, so a stale granted
+  address cannot silently replace fresh approval. A locked signing account is reported separately
+  from an absent extension and requires unlocking/reconnection, without automatic signing retries.
+  Otsu and Crossmark must use separate local browser profiles: the inspected extensions collide
+  on injected globals. See the [recorded Otsu qualification](runbooks/otsu-live-flow.md).
+- The rc.2 ESM Crossmark adapter carries a narrow local patch for the approval/session network;
+  a missing or malformed network fails closed without falling back to cached Testnet. The patch
+  does not cover CommonJS/UMD consumers. Its tests emulate extension messages through the real SDK,
+  not a user's actual approval. See [patch scope](../apps/web/patches/README.md).
+- Real extension, popup, hardware and WalletConnect QR/deep-link qualification remains adapter
+  specific. Historical live-wallet reports describe their recorded checkout; they do not qualify
+  this new standalone integration automatically. WalletConnect discovery does not prove Testnet
+  namespace or native Credential transaction support. Automated tests prove the application boundary.
+- The release candidate declares `xrpl ^3 || ^4`, while the application uses xrpl.js 5. The peer
+  mismatch and browser dependency/bundle size remain compatibility concerns until independently
+  qualified. Consult a fresh standalone `pnpm --dir apps/web audit --ignore-workspace` and the license policy
+  rather than assuming a prior lockfile's vulnerability or permission results apply.
 
 ## URI interoperability
 
@@ -209,9 +190,12 @@ short HTTPS base URL until the upstream validator is fixed.
 
 ## Payload hosting and demo pinning
 
-The Commons Testnet beta uses issuer-hosted HTTPS payloads. The issuer must retain the exact
-canonical bytes, serve a JSON media type, enable CORS for the site, and keep the integrity-bound URL
-available. Commons does not store or index payload claims.
+Public issuance supports external issuer-hosted HTTPS and optional signed-upload hosting. External
+hosts must retain exact canonical bytes, serve a JSON media type, allow browser CORS and keep the
+integrity-bound URL available. Hosted publication stores explicitly consented public claims separately
+from the ledger projection and requires validated indexed transaction evidence. Its browser recovery
+queue retains public bytes until verified publication or explicit removal; it is not a cross-device
+backup. A transaction validated on XRPL does not itself prove the payload was published.
 
 The JSON media type is an interoperability recommendation for browsers, not normative verification
 evidence. The optional server resolver classifies the observed, integrity-bound bytes even when
@@ -234,4 +218,59 @@ not make personal data safe. Browser storage remains exposed to the same-origin/
 
 The browser acceptance pilot reads issuer-hosted HTTPS payloads directly only after consent. This
 reveals IP address and timing to that host; local/IP-literal hostnames are rejected, but DNS rebinding
-remains a browser-boundary risk. Private or sensitive claims are outside this pilot.
+remains a browser-boundary risk. Private or sensitive claims must not enter this public acceptance flow.
+
+## Application access, private payloads and recovery
+
+- Authentication and issuer features are optional and disabled by default. Real OIDC client
+  registration, production mail delivery and wallet message-format qualification are separate
+  deployment gates; tests using a local identity provider or SMTP sink do not complete them.
+- Admin approval gates portal access; it does not confer universal issuer trust, change protocol
+  validity or automatically expose private Credential claims. The server rechecks ownership and
+  current approval rather than trusting navigation or organization IDs from the browser.
+- An invitation email is a delivery address, not identity evidence. Any authenticated bearer-link
+  holder may claim it. Issuers must review the actual claimant and verified subject wallet before
+  signing. Invitation delivery, claim, issuance and ledger acceptance remain separate statuses.
+- Managed issuer payloads default to private and use authorization-aware `/q/:locator` reads.
+  Authorized issuer/recipient sessions may receive complete canonical bytes; anonymous views of
+  private records receive selected public claims only. This is server access control, not end-to-end
+  encryption. The operator retains database access, while on-chain addresses, schema, opaque URI and
+  full digest remain public. Public disclosure cannot recall downloaded copies.
+- Public payload readers omit session credentials. Filtered responses carry
+  `x-xcs-claim-scope: public` and produce `PAYLOAD_SCOPE_RESTRICTED`, not a false digest-tampering
+  result or a claim of verified full integrity. Authenticated recipient acceptance uses the separate
+  same-origin private reader and never submits private claims to the public verification endpoint.
+- Private canonical claims never enter the public publication queue or browser recovery storage.
+  Issuer recovery retains nonsecret references, transaction hashes and visibility selections only.
+  Confirmed ledger operations reconcile application metadata without requesting another signature.
+  Unknown or pending outcomes block retries; an explicit reset requires matching durable evidence
+  of expiry or validated transaction failure.
+- IndexedDB atomically excludes another managed issuance for the same invitation across tabs and
+  wallet choices in one browser profile. It does not lock another browser or device. Backend metadata
+  uniqueness rejects duplicate attachment but is not a distributed pre-signing reservation:
+  simultaneous devices can create an extra ledger object the application does not attach.
+- Notification failure cannot undo issuance or revocation. Ambiguous SMTP acknowledgements are
+  recorded as uncertain and require review rather than automatic retry. Application records,
+  document files and private payload storage need backups independently of the rebuildable indexer.
+
+- Recipient sharing has no automatic expiry or single-use consumption. Revocation and verifier
+  suspension prevent future disclosure, but cannot erase copies already downloaded. Each credential
+  is limited to 200 active grants; recent workspace/history lists are bounded, not archival exports.
+  Issuance/revocation emails use the existing issuer flow; external ledger revocations appear in the
+  recipient's in-app notifications without triggering an additional email delivery service.
+- Vaul's missing MIT licence file is restored from its exact published source. GemWallet,
+  WalletConnect, Nodemailer and Vaul decisions are recorded in
+  [third-party licence evidence](third-party-licenses.md); they are no longer an open release gate.
+
+- Recovery of an already signed `CredentialAccept` rechecks exact generation/lifecycle and indexer
+  readiness, but does not re-run issuer-trust consent or portal session authorization. A pending
+  signed transaction can therefore be retried after trust policy or session changes. It contains no
+  claims; new private reads still require current authorization. Explicit failed post-signature
+  validation clears the recoverable blob, but interrupted signing/revalidation remains a qualification
+  case for wallet recovery.
+
+- Presentation wallet proofs establish a dated master-key signature for the exact sharing intent.
+  They do not prove current presence, identity of the link viewer, or current ledger authority after
+  master-key disabling/regular-key changes. Legacy unsigned grants remain explicitly distinguishable.
+  Issuer admission shown on the link is the current portal decision; historical approval at issuance
+  is not inferred. Wallet creation/backup stays in the wallet provider, never the XCS application.
diff --git a/docs/plans/guided-role-portal.md b/docs/plans/guided-role-portal.md
new file mode 100644
index 0000000..fa93a33
--- /dev/null
+++ b/docs/plans/guided-role-portal.md
@@ -0,0 +1,38 @@
+# Guided role portal
+
+Goal: make `/issuer`, `/recipient`, and `/presentations` the three task-oriented entry points.
+People choose business objects and explicit wallet actions; they never enter or copy XRPL addresses,
+UIDs, hashes, URIs, generation/profile identifiers, or JSON in a portal journey. Public `/v1`, CLI,
+and read-only explorer contracts remain unchanged.
+
+## Constraints and non-goals
+
+- Preserve Commons authorization, wallet-ownership and presentation proofs, current-audience checks,
+  idempotency, optimistic review revisions, and pre/post-signature context validation.
+- Keep fragments ephemeral and hashed server-side; do not add token storage or database migrations.
+- Keep protocol DTO identifiers for internal URLs and requests, but do not label or expose them as
+  user tasks.
+- Do not introduce a workflow framework, new production dependency, repository-wide refactor, or
+  protocol/ledger-format change.
+- Work in the clean `integration/current-flow` worktree. The historical `main` worktree contains
+  unrelated user changes and must remain untouched.
+
+## Milestones
+
+1. **Complete — portal contracts and compatibility routing.** Add application-owned view models,
+   discriminated next actions, pure presenters, allowlisted portal destinations, typed problems and
+   mutation state. Convert retired technical pages to locale-preserving, query-dropping redirects.
+2. **Complete — role journeys.** Add the issuer next-action dashboard and wallet gates; make invitation,
+   acceptance, sharing and presentation resolution continuous and business-readable; remove protocol
+   panels from role journeys while retaining explicit wallet consent and context validation.
+3. **Complete — applications and administration.** Share the issuer/verifier application form and
+   server application domain; present admin review as a checklist and make decision notifications
+   actionable without exposing protocol data.
+4. **Complete — accessibility, localization and documentation.** Keep EN/FR catalogs structurally
+   identical, set language/focus/live states, document the durable portal boundary in an ADR and
+   synchronize user/runbook documentation.
+5. **In progress — verification and closeout.** Run focused unit tests first, then web lint/typecheck/test/
+   build and repository checks. Run PostgreSQL/runtime/Playwright/Docker tiers where the required
+   isolated services are available; report blocked external Testnet and wallet checks precisely.
+
+Rollback is the previous web image. No persistent data conversion or restoration is required.
diff --git a/docs/plans/issue-30.md b/docs/plans/issue-30.md
new file mode 100644
index 0000000..d727c6d
--- /dev/null
+++ b/docs/plans/issue-30.md
@@ -0,0 +1,81 @@
+# Issue 30 — espace administrateur
+
+Objectif livré : quatre écrans #29 bilingues, décisions atomiques, historique durable,
+justificatifs privés et emails Mailpit. Hors périmètre : formulaires, upload,
+claims privés, allowlists par issuer, gestion générale des admins, qualification production.
+
+## Base et isolation
+
+Worktree `issue/30-admin` à `.data/xcs-admin30`, base `ee39ba5` du chantier
+`.data/xcs-integration`. Les modifications #27 non commitées ont été copiées dans
+ce worktree (instantané local dans `.data/issue27-baseline.patch`), sans modification
+du chantier source. La migration 0004 d'auth précède la nouvelle migration 0005.
+Le checkout extérieur ancien n'est pas la base fonctionnelle du portail.
+Aucun commit, push ni changement de branche du chantier source.
+
+## Jalons terminés
+
+1. Lecture #25/#27/#29/ADR0004, isolation et interface commune #27.
+2. Décisions, audit, notifications, documents, rôles DB et bootstrap.
+3. Quatre écrans Nuxt UI, français/anglais et états d'erreur.
+4. PostgreSQL réel, Mailpit, navigateur, typage/lint/build et régressions.
+5. Documentation de déploiement/reprise et revue finale.
+
+## Architecture et corrections issues des vérifications
+
+Aucune seconde authentification : export du contrôle CSRF #27 et garde admin
+via le contexte serveur. Pools xcs_app (auth), xcs_admin_app (admin) et xcs_notifier
+(email) distincts; xcs_admin est déjà le compte opérateur PostgreSQL.
+Aucune dépendance à l'indexeur ni transaction XRPL pour une décision.
+Double clic/reprise protégé par clé par auteur; concurrence par révision et verrou.
+SMTP ambigu => statut uncertain, jamais renvoi automatique.
+
+La revue a corrigé la pagination lorsque la dernière candidature d'une page est
+traitée et l'identification de l'auteur sans display_name. Les tests SMTP ont
+confirmé qu'une erreur Nodemailer CONN peut survenir après DATA : seul un refus
+SMTP explicite ou un échec DNS/connect prouvé permet une reprise ordinaire.
+
+Le démarrage de l'image a révélé que pnpm deploy retire des liens de dépendances
+tracées par Nitro. Dockerfile.node recopie désormais la sortie autonome après deploy.
+Le test avant correction échouait sur @noble/hashes ; le démarrage et les parcours
+Docker ci-dessous réussissent après correction, sans dépendance supplémentaire.
+Mailpit possède un bridge UI dédié pour que Docker publie effectivement son port
+loopback ; le worker reste sur les réseaux internes uniquement.
+
+## Vérifications du 23 septembre 2026
+
+| Contrôle                                                                                     | Résultat                                                                                                                                                          |
+| -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pnpm lint`, `pnpm typecheck`                                                                | Réussis ; nouveau helper runtime également typé et linté.                                                                                                         |
+| `pnpm test`                                                                                  | Réussi : core14, SDK36, CLI9, DB61, indexeur212, web600 tests ; suites externes séparées.                                                                         |
+| `pnpm build`                                                                                 | Réussi, y compris le worker compilé.                                                                                                                              |
+| `pnpm test:postgres` sur cluster Docker isolé                                                | 42 DB,13 indexeur,22 web réussis ; navigateur runtime opt-in séparé.                                                                                              |
+| `XCS_ADMIN_RUNTIME_TEST=1 … vitest run test/admin-postgres.integration.test.ts` avec Mailpit | 10 réussis : vraie base, SMTP reçu, panne/reprise, serveur compilé HTTPS, quatre écrans, décision navigateur et révocation.                                       |
+| `pnpm test:runtime`                                                                          | 2 réussis : SSR/publication publique avec base réelle.                                                                                                            |
+| `XCS_E2E_PORT=3130 … playwright test e2e/admin.spec.ts`                                      | 8 réussis : états UI avec API simulée, dont FR/EN, conflit, session expirée, droits, documents et pagination.                                                     |
+| Suite navigateur générale                                                                    | 43 réussis,1 échec CSP hérité décrit ci-dessous. Les parcours découverte/wallet existants réussissent avec adaptateurs synthétiques.                              |
+| Images Docker DB et web                                                                      | Construites ; stack séparée, secrets montés, UID node, racine read-only. Session réelle, document depuis volume privé, décision et notification Mailpit vérifiés. |
+| Compose quatre overlays + tous profils                                                       | Rendu et isolation vérifiés ; Mailpit démarré et joignable uniquement sur le port UI loopback publié.                                                             |
+| `sh ops/ci/test-node-entrypoint.sh`                                                          | Réussi.                                                                                                                                                           |
+| `git diff --check`                                                                           | Réussi.                                                                                                                                                           |
+| `pnpm format:check`                                                                          | Seul échec : fichier préexistant docs/issue-25-plan.md. Les fichiers de cette livraison passent.                                                                  |
+
+L'échec navigateur général est dans `e2e/security.spec.ts` : l'assertion attend
+`form-action 'self'`, tandis que le nuxt.config copié de #27 ajoute déjà
+`https://account.xrpl.in`. Le même écart existe dans le chantier source ; #30 ne
+modifie ni cette politique ni l'assertion. Le formatage de docs/issue-25-plan.md
+échoue également sur le contenu HEAD inchangé. Ces écarts ne sont pas masqués.
+
+Les tests ne constituent ni une connexion réelle à XRP Identity, ni des sessions
+utilisateurs des maquettes, ni une vérification avec une extension wallet réelle.
+Le navigateur runtime utilise un certificat synthétique limité à la clé publique
+de ce test, sans modification de confiance système. Les tests TLS/SMTP/DB utilisent
+des données synthétiques, jamais de données de production.
+
+## Livraison et retour arrière
+
+Consulter [le runbook](../runbooks/admin.md). Intégrer #27 et #30 ensemble,
+appliquer0004 puis0005 et les droits minimaux avant activation. Conserver toutes les
+données lors d'un retour arrière applicatif ; arrêter le worker et inspecter les
+envois incertains avant reprise. Les services de validation sont isolés des autres
+terminaux et les volumes sont durables.
diff --git a/docs/plans/issue-31.md b/docs/plans/issue-31.md
new file mode 100644
index 0000000..c2f3a47
--- /dev/null
+++ b/docs/plans/issue-31.md
@@ -0,0 +1,96 @@
+# Issue 31 — issuer workspace
+
+## Goal and baseline
+
+Deliver the issuer journey I1–I6 using the existing wallet signing and ledger-confirmation engine:
+application with private documents, own schemas, email invitations, derived recipient wallets,
+public/private issuance, tracking and revocation. Keep the accountless Studio working.
+
+Worktree `.data/xcs-issuer31`, branch `issue/31-issuer`, starts at admin commit `4e39747`.
+Port the final #27 corrections from `2818ef2`; preserve both other worktrees and active services.
+The admin commit contains the earlier auth snapshot, so its dependency version, account reactivity,
+CSP assertion and missing auth documentation must be reconciled before validation.
+
+Sources: [issue #31](https://github.com/XRPL-Commons/XCS/issues/31), issuer UX boards and ADR 0004.
+
+## Decisions and boundaries
+
+- New accounts may submit applications. Only the current responsible user of an active, approved
+  issuer organization may publish its schemas, invite, issue or revoke through this workspace.
+  Server transactions recheck the session, approval, ownership and exact ledger evidence.
+- Add migration 0006 after admin 0005 and a dedicated restricted issuer pool. Existing public pools
+  never acquire access to private application payload bytes.
+- Managed payloads live in private PostgreSQL storage, bounded to 1 MiB, with full canonical bytes
+  and their digest. The on-chain HTTPS URI resolves through authorization-aware application routes.
+  Private full bytes never enter public hosting or browser persistence. Public subsets are claims
+  projections, not full-payload digest proofs. Admin role alone grants no access.
+- Review documents use the existing private document directory, opaque server filenames and
+  bounded PDF/PNG/JPEG validation. Their upload requires a private writable volume.
+- Reuse the admin SMTP transport, with separate issuer delivery records. Invitation tokens exist
+  in memory during delivery and only their hashes persist. An explicit resend rotates the link;
+  uncertain delivery is never retried automatically. No actual email is sent outside local fixtures.
+- Invitation lifetime defaults to seven days, configurable; no alternative preference was received.
+  This is distinct from recipient sharing, which has no automatic expiry under ADR 0004.
+- Minimal invitation preview/explicit claim allows the email link to work; full recipient inbox,
+  acceptance workspace and presentation management belong to #32. OIDC activation remains pending
+  actual client registration; automated flows use isolated fixtures.
+
+## Milestones
+
+1. **Complete:** scope, dependency audit, isolated branch and API/storage contracts.
+2. **Complete:** persistence, restricted grants, bounded document storage, mail and HTTP endpoints.
+3. **Complete:** bilingual application/workspace and existing signing-engine integration.
+4. **Complete:** PostgreSQL ownership/privacy/concurrency tests, mail failures, browser flows,
+   regression/static/build checks and production images with Compose overlays.
+5. **Complete:** deployment/retention documentation, actual evidence and residual limitations.
+
+## Recovery and verification
+
+Use dedicated disposable PostgreSQL, Mailpit and browser ports. Never migrate the running pilot.
+Private payload preparation is separate from signing; metadata recovery after a validated ledger
+transaction must reuse its transaction hash and not ask for a second issuance. Apply additive
+migrations before enabling the workspace. Disabling it retains ledger state, payloads, application
+records and existing public routes; use forward fixes rather than destructive rollback.
+
+## Verification evidence
+
+Validated on the isolated worktree and disposable services; no pilot migration or external mail.
+
+- `pnpm lint`, `pnpm typecheck`, `pnpm test`, `pnpm build`: passed; 1,024 unit tests.
+- `pnpm test:postgres` with a dedicated cluster: 87 tests passed across DB, indexer and web.
+- Compiled Nitro runtime: issuer HTTPS/SMTP journey, admin regression and two public API/SSR tests
+  passed. Sessions, approval and indexed ledger events are synthetic; issuer HTTP calls are real.
+- Browser suites: 58 tests passed (53 general, 2 auth and 3 production security), covering Studio,
+  admin, issuer, native IndexedDB invitation concurrency, OIDC fixture login/wallet linking and CSP.
+- Both production images built. Database bootstrap and Nuxt startup passed as UID1000 with
+  mounted secret files, read-only root, writable private document directory, issuer authorization
+  denial, payload lookup and public liveness checks. Compose overlay/profile checks passed.
+- Global `pnpm format:check` reports only the unchanged baseline `docs/issue-25-plan.md`;
+  changed-file formatting and `git diff --check` pass.
+
+Review also corrected document cleanup after an ambiguous COMMIT (three regression tests),
+invitation exclusion across browser tabs, and account actions exposed before hydration.
+
+Release checks still require a registered Identity client, real extension-wallet consent and a
+qualified external SMTP provider. Invitation signing exclusion is browser-profile-local; concurrent
+devices require a future server-side reservation. Recipient inbox/acceptance and presentation
+workspaces remain #32/#33. The user subsequently requested committing and pushing this work into the consolidated PR #35.
+This publication does not deploy or enable a running service.
+
+## PR #35 consolidation follow-up
+
+Issuer commit `d8c5a2c` includes the completed issuer implementation, the restored auth testing
+section/runbook, the admin handoff note and the existing Playwright locale instruction from #27/#30.
+Merge `9a31c17` records both independent auth/admin histories without changing that validated tree.
+Commit `cb6c3d8` fixes the inherited plan formatting and builds the SDK before PostgreSQL tests.
+
+`pnpm verify` now passes in full, including global formatting and all 1,024 unit tests. A new checkout
+with no SDK build output also passes all 87 PostgreSQL tests with local SMTP enabled. The first
+repeat encountered cleanup dependencies left by our earlier Docker smoke database; removing only
+that recorded disposable database restored the isolated test boundary, with no product change.
+
+The 58 browser and four runtime results above still apply: consolidation changes only documentation,
+Git ancestry and the PostgreSQL validation command. Immutable Actions pinning (33 references) and
+actionlint v1.7.12 pass. The current license policy fails on three `Unknown` entries
+(`@gemwallet/api@3.8.0`, `@walletconnect/types@2.24.0`, `vaul-vue@0.4.1`) and `nodemailer@10.0.10`
+(`MIT-0`, not allowlisted). The policy is unchanged; keep the aggregate PR in draft for review.
diff --git a/docs/plans/issues-32-33.md b/docs/plans/issues-32-33.md
new file mode 100644
index 0000000..0cf7ba2
--- /dev/null
+++ b/docs/plans/issues-32-33.md
@@ -0,0 +1,86 @@
+# Recipient and verifier workspaces (#32 / #33)
+
+Base: PR #35 standalone integration, 9b22913. Preserve both independently installed apps,
+public Studio and public payload routes, protocol invariants and migrations 0000–0006.
+
+Goal: authenticated recipients can discover their issued credentials, accept/reject through their
+own wallet, and grant/revoke public or named-verifier presentations; verifier applicants can be
+reviewed by the existing admin flow and approved verifiers can inspect authorized presentations
+with separate verification dimensions and metadata-only history/CSV.
+
+Accepted decisions from ADR 0005 override older issue wording: no automatic sharing expiry or
+implicit single-use consumption, no issuer allowlist, no administrator private-claim override,
+full sharing bound to one currently approved verifier organization. `/p` remains public payload
+hosting; presentation tokens travel in a fragment and explicit POST, never a URL query or log.
+
+1. Complete: froze API/UI contracts and implemented recipient inbox, exact ledger reconciliation,
+   private consented payload review and presentation authorization. Reuse existing portal pool with
+   narrowly extended grants and existing wallet signing/verification checks.
+2. Complete: verifier application/status, resolution and metadata-only history/CSV; additive migration
+   only where persisted history requires it. Maintain source-copy provenance and SQL grants tests.
+3. Complete: EN/FR screens and QR links; focused unit/HTTP/SQL/browser/runtime coverage, full repository
+   checks, architecture/operations docs and independent privacy review.
+4. Complete: final review and commit preparation with actual evidence and remaining release gates.
+   Publication and remote check results are tracked in PR #35.
+
+Ownership: root integrates wallet acceptance, auth return/session handoff, navigation, contracts and
+validation; frontend agent owns new recipient/verifier/presentation screens and locale sections;
+backend agent owns recipient/presentation API and shared schema/provision changes; license agent
+first investigates exact package evidence and then owns separate verifier backend implementation.
+No concurrent writes to shared files without explicit handoff. Root owns test environment scheduling.
+
+Security checks: owner isolation, exact generation/subject binding, no payload fetch on reject,
+consent before private bytes, no credential cookies to external payload hosts, current session and
+verifier approval on each disclosure, revoked grants rejected, no tokens/claims in lists/history,
+rate/body limits and CSRF for mutations, no secrets in logs or committed artifacts.
+
+Non-goals: production deployment, real identity registration, wallet approval, unsolicited email,
+new verifier trust score, protocol changes or broad dependency upgrades. UX sessions with real users
+remain a human validation gate. License policy is not relaxed: correct only provable packaging defects.
+
+Recovery: disable optional portal configuration and deploy previous compatible image; retain existing
+application data and forward migration history. Tests use isolated local PostgreSQL/SMTP only.
+
+## Review and verification record
+
+Independent reviews found and corrected a missing active-link quota (concurrent creation now
+serializes at 200 per credential), a history GET with a write side effect (now POST + CSRF),
+a router console warning exposing fragments, and same-component navigation retaining the previous
+presentation. Browser visibility hides claims without invalidating consent during an external wallet
+signature; identity and generation checks remain in force.
+
+Initial broad verification passed format/provenance, lint/types and 835 web + 59 package unit tests.
+Indexer migration fixtures needed their catalog, truncation list and table count updated for 0007;
+after correction all 287 indexer unit tests passed. Full PostgreSQL validation passed 56 indexer and
+49 web tests. Migration generation produced no changes. Original migrations 0000–0006 are unchanged.
+
+The first browser pass completed 60 standard, two auth and three production-security tests. Two
+additional presentation navigation regressions subsequently passed with the focused nine-test suite.
+The first compiled HTTPS run passed the four existing scenarios and caught the same-tab presentation
+bug; the final rebuilt scenario remains to be recorded below.
+
+Both Docker images built with production dependencies. The local isolated Compose upgrade ran
+migration/bootstrap, web and notifier as UID 1000, restricted SQL grants, private document volume
+writes and actual delivery to local Mailpit. No public XRPL writer/indexer was started for this check.
+
+Vaul's missing MIT file was restored with an exact-version/digest override. The unchanged license
+policy still rejects three entries: GemWallet custom terms, WalletConnect custom terms and Nodemailer
+MIT-0. Maintainer decisions remain necessary. Real OIDC/wallet/mobile/user qualification remains
+separate; already-signed transaction recovery's existing trust-recheck limitation is documented.
+
+## Final source validation
+
+`pnpm verify` passes end to end on the frozen implementation: **1,183 unit tests** (59 shared
+packages, 837 web, 287 indexer), format, copy provenance, Drizzle parity, lint, types and all builds.
+The final full browser run passes **65 standard scenarios**; two authentication and three production
+security scenarios also pass (**70 total**). Final private-link tests additionally inspect router
+history state on arrival, exit and back navigation. The web image was rebuilt after those fixes and
+the local Compose bootstrap/grants/UID/private-volume/SMTP smoke passed again. Indexer production
+code is unchanged since its successful image build. Migration generation remains clean.
+
+All **five compiled-runtime scenarios pass** against the final build, including synthetic-session
+HTTPS/Chromium tests with real restricted pools. The new test covers successive anonymous links,
+wrong audience, authorized full view, CSRF denial, read-only unsupported GET, metadata CSV/history,
+reopening, revocation and approval suspension. Fixture identity changes navigate through the app
+before opening a link; they do not bypass the UI's intentional session-change invalidation.
+The isolated Compose validation services are stopped; durable volumes and other worktrees are kept.
diff --git a/docs/plans/pr35-standalone.md b/docs/plans/pr35-standalone.md
new file mode 100644
index 0000000..cf53bcf
--- /dev/null
+++ b/docs/plans/pr35-standalone.md
@@ -0,0 +1,43 @@
+# PR 35 — adapt to standalone applications
+
+Goal: preserve tested wallet, authentication, admin, issuer and private payload behaviour while
+adopting Luc’s merged #36 architecture (25ea0b4). Original reference: a9777cc.
+
+Invariants: no apps/api or packages/db; apps install independently with --ignore-workspace;
+only db/schema and migrations are shared; protocol copies track root sources; PostgreSQL is external
+in production; Compose is local-only; no private claims in public projection; unchanged applied SQL.
+No live deployment, wallet approval, external email or new #32/#33 feature is included.
+
+1. Complete: port independent app/schema code, dependencies and existing regression coverage.
+2. Complete: adapt deployment/CI/docs and validate copy/schema/lockfile boundaries.
+3. Complete: per-app/root static/unit/build, isolated PostgreSQL/runtime/browser, images and local Compose.
+4. Delivery: review exact integration diff, preserve both histories and publish to PR35; remote CI
+   results are tracked on the PR, which remains draft for the gates below.
+
+Recovery: retain a9777cc and upstream main unchanged; forward-only migration history, no pilot DB touched.
+Main risks: duplicate public routes during port, least-privilege pools, migrations across moved paths,
+independent module resolution, drift of protocol copies, old CI license gates.
+
+## Validation on the standalone tree
+
+- `pnpm verify`: passed (59 shared-package, 766 web and 287 indexer unit tests; 1,112 total),
+  including format, copy provenance, Drizzle parity, lint, types and all builds.
+- Isolated PostgreSQL 18: 55 indexer/database and 32 web tests passed. The 15 SQL/snapshot/journal
+  files remain byte-identical to a9777cc; `pnpm --dir apps/indexer db:generate` emits no migration.
+- `pnpm --dir apps/web test:runtime`: four compiled Nitro scenarios passed: HTTP quotas versus
+  local SSR exemption, public publication/readiness/SSR, authenticated admin and issuer workflows.
+  The latter two use Chromium, restricted database pools, private documents and local SMTP.
+- Browser suites: 53 public/admin/issuer, two authentication and three production-security tests
+  passed (58 total). An initial schema-flow failure coincided with a source-edit HMR reload;
+  the isolated scenario and complete stable-source rerun passed without changing assertions.
+- Both standalone Docker images built with only their own app plus shared db/config, execute as
+  UID 1000 and contain no TypeScript/Vitest/tsx development tools. Local Compose validation covers
+  32 exact overlay/profile combinations, restricted grants and optional application/public hosting.
+- Dependency audits for all three independent lockfiles pass the high/critical threshold.
+- License policy remains blocked: `@gemwallet/api@3.8.0`, `@walletconnect/types@2.25.0` and
+  `vaul-vue@0.4.1` are reported Unknown; `nodemailer@10.0.10` reports MIT-0, outside the allowlist.
+  No policy exception or relaxation was added.
+
+Real XRP Identity registration, physical wallet consent, live Testnet transactions, mockup user
+acceptance and production deployment are separate gates; automated fixtures do not establish them.
+The full recipient/verifier flows (#32/#33) remain outside this port. Keep PR #35 in draft.
diff --git a/docs/plans/role-journeys.md b/docs/plans/role-journeys.md
new file mode 100644
index 0000000..be460fe
--- /dev/null
+++ b/docs/plans/role-journeys.md
@@ -0,0 +1,67 @@
+# Complete issuer → recipient → verifier journeys
+
+Base: PR #35, e2404ec. Goal: an approved issuer invites a recipient, the recipient proves control of
+a wallet, the issuer issues to that wallet, the recipient signs acceptance, and a verifier opens a
+single link showing issuer admission, exact ledger issuance/acceptance and recipient wallet proof.
+No manual URI or tuple entry is required. Existing private-field audience restrictions remain intact.
+
+## Milestones
+
+1. Complete — audit the actual routes, wallet signatures, approval/issuance bindings and browser
+   tests. Resolve whether each presentation requires a new wallet signature and whether minimal
+   public verification remains accountless. After offering the choices, proceed with a fresh signature for each new presentation and
+   accountless minimal evidence, retaining designated-verifier access to private fields. These
+   defaults strengthen the requested proof and preserve the existing disclosure policy.
+2. Complete — complete onboarding handoffs and issuer readiness visibility; present factual issuer
+   admission and recipient-address evidence without treating Commons approval as universal trust.
+   Implement the selected wallet-ownership proof and presentation behavior, using existing
+   message-signature support and atomic server authorization. Use additive migrations if needed;
+   preserve deployed 0000–0007, independent apps, restricted pools and no-secret signing boundary.
+3. Complete — exercise a connected multi-actor journey and denial paths, then run appropriate unit,
+   PostgreSQL, compiled runtime/browser and static/build checks. Documentation synchronized;
+   delivery continues through the existing draft PR #35.
+
+Closed gaps: wallet linking now has a guided return; recipient waiting and issuer claim states
+distinguish an unlinked wallet; presentations expose current issuer admission and a dated recipient
+signature. Tuple-free links and server-side scope enforcement are preserved. A connected runtime
+test drives approvals, invitation delivery, wallet linkage, issuance, acceptance and signed sharing.
+It exposed string-valued PostgreSQL network IDs in issuance DTOs; both wallet lists now normalize
+them to the numeric API contract, with regression coverage.
+
+Owners: root integration, issuer-admission evidence and contracts; UI agent onboarding/presentation
+screens; backend agent scoped wallet proof after the product answer; test agent connected multi-actor
+validation. Shared-file edits require explicit handoff. Root schedules PostgreSQL and Nuxt builds.
+
+Security: a connected wallet is not proof. Reuse verified text signatures, never collect seed/private
+keys or sign disguised transactions. Proof must bind the exact recipient, credential, scope, audience
+and site and reject replay/session changes. Admission status is checked server-side and does not
+rewrite ledger verification or issuer trust. Public links must not gain private claims. Master-key
+proof limitations and already-issued proof timestamps must be explicit.
+
+Non-goals: real production deployment, automatic Commons approval, live external email, custody or
+wallet creation inside XCS. Wallet installation/account creation stays in the wallet application.
+Roll back with the prior app image, keeping additive schema and records; test only isolated local
+PostgreSQL, SMTP and synthetic wallets/ledger evidence.
+
+## Validation evidence
+
+- Standalone web/indexer `pnpm verify`: format, lint, types, 851 + 287 unit tests and both builds pass.
+  Shared-package Turbo checks pass (59 unchanged unit tests, cached). Final web lint/typecheck and
+  build also pass after the issuance DTO correction and test-fixture fixes.
+- Sequential PostgreSQL suites: indexer 57, web 56; three readiness/admission tests rerun after the
+  numeric-network DTO fix. SMTP-only coverage uses the separate compiled runtime tier.
+- Browser suites: 70 standard, three production-security and two authentication scenarios pass.
+- Compiled HTTPS runtime: all six scenarios pass. The connected journey uses the real wallet SDK
+  with synthetic transports and verifies signed issuance/acceptance before fixture projection, then
+  fresh sharing signatures, the three public facts, private audience filtering and revocation.
+- Both Docker images build; the final web image includes the DTO fix. Isolated Compose applies
+  migration 0008, checks narrow grants, separate pools, UID 1000, document writes and Mailpit delivery.
+  Thirty-two overlay configurations pass. Validation containers are stopped with volumes retained.
+- Root formatting, vendored-copy and Drizzle parity pass; migration generation creates no changes.
+  All 16 deployed migration/snapshot files for versions 0000–0007 are byte-for-byte unchanged.
+- Runtime testing found a pre-hydration admin click race in the test; the fixture now waits for the
+  application's client-ready marker before interacting. No production authorization was weakened.
+
+Real Identity registration, installed extension/mobile flows and live Testnet consensus are not
+qualified by these fixtures. The pre-existing dependency-license gate remains unresolved; keep the
+PR draft. No production deployment or external invitation delivery was performed.
diff --git a/docs/plans/simple-user-journeys.md b/docs/plans/simple-user-journeys.md
new file mode 100644
index 0000000..7fdb7ef
--- /dev/null
+++ b/docs/plans/simple-user-journeys.md
@@ -0,0 +1,114 @@
+# Simple attestation journeys
+
+> Superseded by [ADR 0007](../adr/0007-guided-role-portals.md). Its secondary technical controls
+> were retired from web mutation journeys; public integration and read-only surfaces remain.
+
+Goal: let issuers, recipients and verifiers complete their work without entering or interpreting
+hashes, schema identifiers, JSON or ledger terminology. The existing technical tools remain
+available through explicit secondary controls. Base: 7080dce; its functional CI jobs passed,
+with the existing dependency-license policy failure unchanged.
+
+## Milestones
+
+1. Complete — inspect the role pages, signature review, results and navigation. Confirm that
+   admission, trust, ownership, consent and private-field authorization remain distinct.
+2. Complete — simplify the main navigation and link entry, make presentation results readable,
+   provide plain-language signature/finality summaries, and guide issuer/recipient actions.
+   Reuse the existing data and security boundaries; no database/API changes or new dependencies.
+3. Complete — exercise the relevant English/French browser journeys and failure states, run web
+   unit/static/build checks, inspect the real local site and document actual validation.
+
+Acceptance: the ordinary route shows names, content, next actions and understandable statuses.
+Technical references are collapsed by default and remain inspectable. A verifier can paste the
+received link, or open it directly, without entering technical identifiers. Before signing, the
+action, recipient context, network and cost remain clear; GemWallet's opaque-message limitation
+requires explicit consent. Unknown trust, missing holder proof, revoked/expired attestations and
+unavailable checks must never become a misleading success message. Private claims/tokens remain
+excluded from URLs, persistence and diagnostics according to the existing rules.
+
+Ownership: root handles shared transaction/result components, presentation display/link entry,
+navigation, translation integration and validation. Independent agents handle issuer and recipient
+page improvements in disjoint files. Translation changes are handed to root to prevent conflicts.
+
+Rollback: restore the preceding web image; no migration or persistent-data conversion is needed.
+This is a presentation change, not wallet custody, automatic approvals or production deployment.
+
+## Delivered behavior
+
+The portal home page has three entrances: Receive, Issue and Verify. Technical tools move to More;
+protocol-only deployments retain their existing navigation. Issuers select named attestation
+templates, keep that selection when inviting, and review readable public/private fields before
+signing. Recipients see their next action, can continue immediately when a wallet is already linked,
+and get the correct available actions after acceptance without reloading the page. Removal remains
+available as a secondary action. Shared components render nested claims and translated lifecycle
+states without JSON or protocol codes in the main view.
+
+Wallet approval displays the action, test network, fee and payment amount, where applicable.
+The full transaction remains inspectable, and GemWallet's coded-message consent is still mandatory.
+Transaction success, application confirmation, pending work and failures remain distinct. Sharing
+starts with audience and fields, then requests its separate wallet signature. Verification accepts
+only this portal's complete sharing links and keeps tokens out of navigation and persistent storage.
+The result prioritizes attestation name, issuer admission, acceptance and dated sharing proof;
+technical identifiers and detailed verification dimensions are collapsed, not removed.
+
+Review caught and corrected two simplification regressions: a successful invitation API response
+can contain failed/uncertain mail delivery, so only actual `sent` status announces success; schema
+errors retain their exact code/path/message behind their plain-language explanation. Regression
+coverage includes failed, uncertain and confirmed delivery, unsupported schema versions, invalid
+descriptions, and the same-page transition from pending to accepted.
+
+The real issuer browser retained an older public-content recovery record. Its global recovery
+panel now keeps retry, download and removal actions visible while collapsing URLs, transaction
+references and raw failure diagnostics. The existing journal and saved content are preserved.
+
+## Validation — 2026-09-25
+
+- `pnpm --dir apps/web exec vitest run`: 864 unit tests passed; 63 database/runtime tests skipped
+  because these invocations do not provide their isolated integration environments.
+- `pnpm --dir apps/web exec eslint .`, `pnpm --dir apps/web typecheck`, touched-file Prettier,
+  `pnpm check:repo` and `git diff --check`: passed.
+- Standard Playwright suite with `NUXT_PUBLIC_ISSUER_ENABLED=0`: 85 passed; four portal navigation
+  cases intentionally require the other configuration. With `NUXT_PUBLIC_ISSUER_ENABLED=1`, all
+  four portal navigation cases passed. Auth configuration: two passed. Production security
+  configuration: three passed. A final issuer-only run passed all eight tests, including the new
+  publication-recovery failure/download regression; the three delivery cases passed again after
+  correcting their fixture to the API’s actual `invited` state. These automated suites use their
+  documented synthetic fixtures.
+- Host production build and Docker build passed. Isolated live site `https://localhost:3445`
+  uses image `sha256:e42cb5ad8701cb18a6cd68d93defae0172fdcd20f5ad174b5ec6fdeabc32fa97`.
+  PostgreSQL, indexer, Identity and the previous port-3443 deployment were preserved.
+- A real anonymous Brave browser followed the French home page, pasted the existing signed
+  Testnet sharing link and retrieved live evidence. The public course was visible; private fields
+  were absent in both HTTP and DOM. Addresses/references were hidden until opening details.
+  Desktop and 390-pixel mobile screenshots were inspected; no horizontal overflow was observed.
+  This manual check used no network/provider/session mocks and submitted no new ledger transaction.
+- On the final image, the real issuer retained both existing recovery copies and their actions;
+  references were available only after opening details. Selecting a named template carried it into
+  the invitation form. No mutation was sent.
+- A real recipient reconnected through Identity OIDC, opened the French accepted-attestation inbox,
+  inspected the accepted attestation, then reviewed public and targeted full sharing. Audience and
+  exact selected fields appeared before signing; creation remained disabled without a connected
+  wallet. No new link or signature was created; the prior sharing tab was preserved.
+  These issuer/recipient checks used actual accounts and stored Testnet evidence without mocks.
+- CI exposed obsolete selectors in the compiled issuer and connected-journey tests after the
+  wording and disclosure changes. The tests now use current locale keys and explicitly open the
+  technical controls, preserving signature, recipient-address, disclosure and revocation assertions.
+  All six compiled runtime scenarios then passed locally against fresh, isolated PostgreSQL18 and
+  Mailpit services; nine unrelated cases were excluded by the runtime script’s test-name filter.
+  Real database/SMTP/HTTP boundaries are exercised here with synthetic sessions and XRPL transports,
+  separately from the manual live Testnet qualification. The isolated test services were stopped.
+  CI web, package and Docker jobs passed on the preceding UI commit; the existing license-policy
+  failure was confirmed unchanged.
+- A subsequent CI attempt timed out in an unchanged indexer migration test. An isolated replay
+  reproduced concurrent PostgreSQL role provisioning (`pg_authid_rolname_index`). Indexer test
+  files now run sequentially whenever a database URL is supplied, matching `test:postgres`;
+  unit-only parallelism and explicit concurrency tests remain unchanged. All 357 indexer tests
+  passed against a fresh PostgreSQL18 cluster, followed by 300 unit tests with 57 expected database
+  skips without a database URL. No timeout or assertion was relaxed. The final configuration and
+  test corrections are revalidated by the next CI run.
+
+Other wallet compatibility and external email delivery were not requalified by this UI change.
+The optional Crossmark live configuration's selectors were updated but that separate wallet-specific
+configuration was not run. Development auth tests emitted a Vite module-reload warning while still
+passing; compiled production security and the live browser check passed independently. The existing
+license-policy failure still keeps PR35 draft; approval and trust semantics remain unchanged.
diff --git a/docs/runbooks/admin.md b/docs/runbooks/admin.md
new file mode 100644
index 0000000..cc7277e
--- /dev/null
+++ b/docs/runbooks/admin.md
@@ -0,0 +1,199 @@
+> Deployment update: applications install independently (`pnpm --dir apps/web install --ignore-workspace --frozen-lockfile`).
+> Use the [standalone deployment runbook](deployment.md) and per-app environment contracts.
+> Previous production secret-file Compose overlays are retired; the local application overlay is `docker-compose.application.yml`.
+
+# Local administration
+
+Issue #30 adds applications, application review, verifier management and decision history in English
+and French. It uses the PostgreSQL sessions, server role checks and CSRF protection from #27. Deploy
+both changes together; there is no separate administrator login or automatic role assignment from
+email or identity-provider claims.
+
+The local procedure uses private filesystem documents and Mailpit. Production uses the common private
+S3/Spaces backend and the external TLS SMTP contract from the
+[deployment runbook](deployment.md). Real XRP Identity, provider delivery and bucket access remain
+deployment acceptance checks and must be reported separately from automated tests.
+
+## Prepare the database and secrets
+
+Apply the journaled migrations through `0008`. Existing migrations must remain unchanged. Create
+the managed `xcs_admin_app` and `xcs_notifier` users in DigitalOcean, retain their generated URLs in
+the two components, then run the grants-only bootstrap:
+
+| Private variable                    | Purpose                                             |
+| ----------------------------------- | --------------------------------------------------- |
+| `NUXT_ADMIN_DATABASE_URL`           | Web administrative connection as `xcs_admin_app`    |
+| `XCS_NOTIFIER_DATABASE_URL`         | Worker connection as `xcs_notifier`                 |
+| `XCS_ADMIN_DOCUMENT_KEY`            | Random signing key of at least 32 UTF-8 bytes       |
+| `XCS_AUTH_ORIGIN`                   | Exact HTTPS origin used in decision email buttons   |
+| `XCS_DOCUMENT_STORAGE_DRIVER`       | `filesystem` locally; `s3` in production            |
+| `XCS_DOCUMENT_FILESYSTEM_DIRECTORY` | Absolute local-only private directory               |
+| `XCS_DOCUMENT_S3_*`                 | Private production bucket, endpoint, region and key |
+
+The secret variables support an alternative `_FILE` variable. Supply one source only, with a
+single-line value in a readable regular file. Never put them in `NUXT_PUBLIC_*`, commit secret files,
+or reuse the PostgreSQL operator role `xcs_admin` as a runtime account. The notifier cannot modify
+applications, decisions or account roles; the administrative connection has no private-claim access.
+
+Keep source worktrees, private environment files and synthetic documents in durable private
+directories, outside the OS temporary directory. Hosted deployments use the standalone images and
+external PostgreSQL described in [deployment](deployment.md).
+
+## Start the local stack
+
+Populate the base Compose passwords and the additional application, admin, notifier and issuer
+passwords, OIDC client configuration and document signing key required by the application overlay:
+
+```sh
+export COMPOSE_FILE=docker-compose.yml:docker-compose.application.yml
+export COMPOSE_PROJECT_NAME=xcs-admin-local
+docker compose config --quiet
+docker compose build db-bootstrap web
+docker compose up -d postgres
+docker compose run --rm db-bootstrap
+docker compose up -d web mailpit admin-notifier
+```
+
+Serve the exact HTTPS `XCS_AUTH_ORIGIN` through the established local HTTPS ingress. Verify its
+certificate in the actual browser before testing sessions or wallet providers.
+
+Bootstrap migrates before granting the restricted roles. The image initializes the private
+`xcs-review-documents` volume for UID 1000. Web needs a writable mount for issuer uploads;
+public assets and public payload hosting never receive these files. The notifier uses the same web
+image's compiled `dist/admin/admin-notifier.js`, without the document volume or OIDC configuration.
+
+Mailpit is local test capture only. Its SMTP listener is internal and its UI is bound to loopback
+at `http://127.0.0.1:8025` (or `XCS_MAILPIT_PORT`). The notifier joins only internal database/mail
+networks. This overlay's inbox is ephemeral: retain evidence of ambiguous deliveries before
+recreating Mailpit, and never infer non-delivery from an empty inbox after recreation.
+
+## Initialize the first administrator
+
+The intended person must already have an active account created by the shared login flow. Obtain
+their exact OIDC issuer and subject from the trusted account record. An email address is not an
+identity key. Provide the operator database connection and audit label privately:
+
+```sh
+export XCS_ADMIN_IDENTITY_ISSUER='https://account.xrpl.in'
+export XCS_ADMIN_IDENTITY_SUBJECT='existing-oidc-subject'
+export XCS_ADMIN_BOOTSTRAP_OPERATOR='local-operator'
+pnpm --dir apps/indexer admin:bootstrap
+```
+
+`XCS_BOOTSTRAP_DATABASE_URL` must already be configured for this operator command. It grants the
+first administrator explicitly and records the operation durably. Repeating it for the same
+account is idempotent; it is not a general administrator-management mechanism. Nothing runs this
+command automatically at login. The four screens do not provide account or administrator management.
+
+## Populate synthetic review data
+
+Use a separate local database whose name begins `xcs_admin_demo`, migrated and bootstrapped with the
+same role boundaries. The fixture command accepts loopback or the Docker `postgres` hostname only.
+Configure `XCS_ADMIN_FIXTURE_DATABASE_URL` with an operator connection to that disposable database,
+and `XCS_DOCUMENT_FILESYSTEM_DIRECTORY` with an absolute durable private directory, then run:
+
+```sh
+pnpm --dir apps/web admin:fixtures
+```
+
+Point all application pools to that same demo database for fixture validation. Never point the
+fixture connection at the normal application database. For Compose validation, copy the generated
+synthetic documents into `xcs-review-documents` through a one-shot operator container, then keep the volume private to web. Files inside the volume must be owned by UID 1000 and readable by that
+user (for example mode `0640`); ensure a copy does not preserve inaccessible host ownership. The fixture
+directory's file bytes and database metadata must travel together.
+
+For the fixture script's `synthetic-*.png` files, with the host document directory configured above:
+
+```sh
+docker compose run --rm --no-deps --user 0 --cap-add CHOWN --cap-add DAC_OVERRIDE \
+  --volume "${XCS_DOCUMENT_FILESYSTEM_DIRECTORY}:/fixtures:ro" \
+  --volume "${COMPOSE_PROJECT_NAME}_xcs-review-documents:/var/lib/xcs-review" \
+  --entrypoint sh admin-notifier -c \
+  'for file in /fixtures/synthetic-*.png; do
+     test -f "$file" || exit 1
+     target="/var/lib/xcs-review/${file##*/}"
+     test ! -e "$target" || exit 1
+     cp "$file" "$target" || exit 1
+     chmod 0640 "$target" || exit 1
+     chown 1000:1000 "$target" || exit 1
+   done'
+```
+
+The copy refuses to overwrite existing documents. Its temporary root container uses `CHOWN` to set
+file ownership and `DAC_OVERRIDE` to enter the private source and target directories. It exits after
+copying; the running web container keeps all capabilities dropped and uses the private volume for issuer writes and authorized administrative reads.
+
+Each document metadata record identifies one opaque basename, its MIME type, byte length and
+SHA-256 digest. The reader accepts PDF, PNG and JPEG only, checks file signatures and integrity, and
+limits each file to 20 MiB. Traversal, symlinks, missing files and altered content produce explicit
+errors. Links expire after five minutes and are bound to the requesting administrator session;
+download rechecks the active role and disables caching. Rotating the signing key invalidates existing
+links. The document volume is private even though the filenames themselves are opaque.
+
+## Decisions and email recovery
+
+A candidature is identified by organization and role. Pending applications can be approved or
+rejected; an approved verifier can be suspended and reinstated. Rejection and suspension require
+a reason. The detail page presents organization, requested role, responsible person, documents,
+declared wallet and history as a checklist, with the current decision summary kept alongside it.
+The application update, before/after audit record and one logical notification are committed
+atomically. Revision conflicts expose the decision already recorded; repeating the same idempotency
+key does not create another decision. Approval is administrative and requires no XRPL transaction
+or running indexer. Linked wallets belong to the responsible person and do not prove organization
+identity.
+
+The worker claims one pending notification per transaction, rechecks the current verified email
+against its stored recipient, and persists an attempt before SMTP. It emits a bilingual message
+with the resulting status, optional decision reason and one button to the appropriate role space.
+It includes no decision identifier, documents, wallet data, private claims or token. Missing, unverified,
+changed or unavailable recipients produce `blocked`; the decision remains effective. SMTP failures
+also leave the decision intact.
+
+To process a single pending notification locally with the worker's private variables configured:
+
+```sh
+pnpm --dir apps/web admin:notify --once
+```
+
+In Compose, the equivalent is:
+
+```sh
+docker compose run --rm --no-deps admin-notifier node dist/admin/admin-notifier.js --once
+```
+
+Only `pending` entries are processed automatically. `failed` and `blocked` entries can be retried
+independently from the administration interface after fixing Mailpit or the responsible person's
+verified email. Retry revalidates the recipient and reuses the existing logical notification; it
+never records another access decision. `sent` entries cannot be retried.
+
+An interrupted `sending` attempt becomes `uncertain` after five minutes. SMTP timeouts or resets may
+also be uncertain: the server might have accepted the message before the acknowledgement was lost.
+The worker has a 60-second overall deadline and never automatically resends an uncertain message.
+The SMTP command label alone cannot prove non-delivery; Nodemailer can report `CONN` after DATA.
+
+For an uncertain entry, stop automatic processing of that entry (it is already excluded), inspect
+Mailpit for the stable Message-ID `admin-decision-<decision UUID>@xcs.test`, and retain evidence of the
+result. Presence proves local capture; absence alone does not prove non-delivery if messages or the
+Mailpit database were removed. An operator must explicitly resolve the delivery state using the
+operator database connection after investigation. Do not change the access decision, delete the
+notification, or blindly reset its status to pending. There is no automatic uncertain-retry API and
+no claim of exactly-once SMTP delivery.
+
+[ADR 0005](../adr/0005-role-based-application.md) continues to apply: there is no issuer allowlist and
+an administrative role does not grant access to private claims.
+
+## Verification and rollback
+
+Run the focused admin unit/integration tests and the repository's type, lint and build checks.
+PostgreSQL verification must cover transitions, atomic audit/outbox writes, concurrent revisions,
+idempotency and restricted roles. Exercise Mailpit receipt, outage/retry and ambiguous delivery;
+browser checks must cover both languages, direct navigation, revoked admin access, session expiry,
+CSRF rejection, missing documents and errors. Recheck public discovery and existing wallet behavior.
+Report which checks actually ran; synthetic OIDC tests are not a real XRP Identity connection or
+mockup user acceptance testing.
+
+For an application rollback, stop `admin-notifier`, remove the administration component contract,
+and deploy the compatible previous web image. Keep migration `0005`, decisions, audit rows,
+notification records and private document storage. Do not run `docker compose down --volumes` as rollback.
+Before re-enabling, verify migrations, minimum grants, document integrity and pending/uncertain
+notification states. An indexer outage does not prevent reading the stored decision history.
diff --git a/docs/runbooks/authentication.md b/docs/runbooks/authentication.md
new file mode 100644
index 0000000..76acb2c
--- /dev/null
+++ b/docs/runbooks/authentication.md
@@ -0,0 +1,169 @@
+> Deployment update: applications install independently (`pnpm --dir apps/web install --ignore-workspace --frozen-lockfile`).
+> Use the [standalone deployment runbook](deployment.md) and per-app environment contracts.
+> Previous production secret-file Compose overlays are retired; the local application overlay is `docker-compose.application.yml`.
+
+# XRP Identity authentication
+
+Issue #27 adds optional sign-in, PostgreSQL sessions, current role guards and wallet linking to the
+Nuxt application. Authentication is disabled by default. Public discovery and public presentation
+resolution remain available without an account. Business mutations are available through the
+optional role workspaces; see the [recipient/verifier journey](recipient-verifier.md).
+
+## Register the client
+
+The canonical issuer is `https://account.xrpl.in`, confirmed by its
+[discovery document](https://account.xrpl.in/.well-known/openid-configuration) and the
+[XRP Identity repository](https://github.com/XRPL-Commons/xrp-identity). The older
+`identity.xrpl.in` host in #27 did not resolve during implementation.
+
+An Identity administrator must register the XCS development and production clients. Registration
+has **not** been performed by this change. Configure each environment with:
+
+- Confidential web client; `client_secret_basic` at the token endpoint.
+- Grant `authorization_code`, response `code`, PKCE S256 required.
+- Scopes `openid profile email`. No provider admin scopes or offline access are needed.
+- Exact callback: `https://YOUR-XCS-ORIGIN/api/auth/callback` (no locale prefix).
+- Separate development and production secrets. Use local HTTPS for manual development; do not
+  disable cookie security or TLS verification. The automated loopback provider is test-only.
+
+The provider integration follows Commons' `starter.2026.04/modules/1.auth` and its `openid-client`
+pattern, adapted to issuer/subject account identity and PostgreSQL opaque sessions. Its ID-token
+signature, issuer, audience, nonce and time bounds are validated. Provider roles are never imported.
+Provider access/refresh/ID tokens are not persisted or returned to the browser.
+
+## Provision and enable
+
+Back up and follow [Migrate](deployment.md#migrate). Create the managed `xcs_app` user in
+DigitalOcean, retain its generated URL as `NUXT_APP_DATABASE_URL`, then run the grants-only
+bootstrap, which applies `0004_auth_sessions` and the later migrations.
+The optional `xcs_app` role has only the table/column access needed for authentication. It cannot
+write approvals, insert an admin role, move wallet ownership, read private payloads or modify the
+projection. Its connection must never replace `xcs_api` or `xcs_payload_writer`.
+
+Authentication is enabled when its origin, Identity client credentials and `xcs_app` URL are all
+present; a partial contract fails at startup. Rotate its password through DigitalOcean and replace
+only the application URL. Bootstrap never manages passwords.
+
+Nuxt private runtime configuration:
+
+| Variable                           | Meaning                                                                   |
+| ---------------------------------- | ------------------------------------------------------------------------- |
+| `XCS_AUTH_ORIGIN`                  | Exact HTTPS site origin, without a path; defines callback and CSRF origin |
+| `XCS_IDENTITY_ISSUER`              | Defaults to `https://account.xrpl.in`                                     |
+| `XCS_LOCAL_IDENTITY_QUALIFICATION` | Local qualification only; see the restricted contract below               |
+| `XCS_IDENTITY_CLIENT_ID`           | Private client identifier; `_FILE` supported                              |
+| `XCS_IDENTITY_CLIENT_SECRET`       | Private client secret; `_FILE` supported                                  |
+| `NUXT_APP_DATABASE_URL`            | Private `xcs_app` PostgreSQL URL; `_FILE` supported                       |
+
+Session lifetimes and the Identity issuer endpoint are checked-in settings in
+`apps/web/server/xcs/settings.ts`, so changing them requires review and a new image. For a local
+end-to-end qualification against a real provider, and only for that purpose, set
+`XCS_LOCAL_IDENTITY_QUALIFICATION=1` and supply both `XCS_AUTH_ORIGIN` and
+`XCS_IDENTITY_ISSUER` as exact HTTPS loopback origins (`localhost`, `127.0.0.1` or `::1`). The
+process refuses this switch for HTTP, a path, a remote host or a non-loopback XCS origin. Never set
+it in a shared or production deployment.
+
+Use the provider's verified database TLS connection configuration. Never put these values in
+`NUXT_PUBLIC_*`, source files or logs. Direct values and matching `_FILE` values are mutually
+exclusive. Secret files must contain one line, at most 16 KiB.
+
+For local Compose with an HTTPS gateway, use the combined application overlay. Populate its
+four additional role passwords, OIDC client configuration and document signing key privately:
+
+```sh
+export COMPOSE_FILE=docker-compose.yml:docker-compose.application.yml
+docker compose config --quiet
+docker compose run --rm db-bootstrap
+docker compose up -d web mailpit admin-notifier
+```
+
+This overlay enables authentication, administration and the issuer workspace together. It builds
+restricted connection URLs from the separate passwords; only web receives the OIDC configuration.
+For an auth-only deployment, configure the standalone web image with the variables above and
+provision only the application role required by that deployment. Production uses external PostgreSQL
+and the hosting platform's private environment configuration; Compose is for local validation.
+
+## Sessions and authorization
+
+The `__Host-xcs-session` cookie is Secure, httpOnly, SameSite=Lax and host-only. PostgreSQL stores
+only its SHA-256 hash. Login state also requires an independent httpOnly browser cookie and is
+consumed once; the PKCE verifier and nonce exist only in the short-lived server transaction.
+
+A first sign-in creates a user by `(identity_issuer, identity_subject)` and a recipient grant. Email
+is neither a unique account key nor a reason to merge users. `email_verified` must be exactly true
+before recording verification. Admin is an operator-managed personal grant; issuer/verifier grants
+belong to approved, active organizations whose responsible user is the authenticated account.
+Current account, personal grants and organization approvals are checked on requests, not copied
+into an indefinitely trusted cookie. Admin does not imply private-claim access.
+
+`/account` shows profile, approved organizations, linked wallets and session controls. `/issuer`
+derives the next approved issuer action; `/recipient` resumes claimed invitations and attestations.
+Middleware `auth` and `role` with `requiredRole` metadata
+protect navigation; API handlers enforce their own server authorization. Future organization
+mutations must also scope the exact organization ID and recheck authorization in their transaction.
+Retired technical mutation URLs redirect to the role portals and discard their old inputs.
+
+`POST /api/auth/refresh` rotates the bearer and CSRF value without extending the eight-hour absolute
+limit. The account page offers an explicit extension action. `POST /api/auth/logout` revokes the
+stable session ID, including a concurrent rotation. It does not log out other XCS sessions or the
+Identity provider, and does not disconnect the wallet. Mutations require the exact site Origin and
+session-bound `x-xcs-csrf` header. Auth responses and personalized SSR HTML are `private, no-store`.
+Request bodies are bounded while streaming. IP and account quotas apply within each Nuxt process;
+multi-replica/global abuse control also requires ingress controls.
+
+Expired rows cannot authorize requests. Login cleans expired login transactions and sessions;
+logout removes its challenges through the session FK. For deployments without new logins, include
+expired `app_auth_transactions`, `app_sessions` and `app_wallet_challenges` in administrative retention
+cleanup. Do not log callback query strings, cookies, CSRF values or signature bodies at ingress.
+
+## Wallet proof boundary
+
+Linking uses a server-issued five-minute, single-use message bound to origin, user, session,
+Testnet network ID, address and random nonce. The wallet signs a message, never a submittable
+transaction. Signature verification precedes atomic challenge consumption. A revoked link can be
+renewed by the same account; another account cannot take the address through unlink/relink.
+Unlinking revokes this profile association, not an XRPL credential or wallet transaction.
+
+Supported message formats:
+
+- GemWallet: UTF-8 message signed through `ripple-keypairs`.
+- MetaMask XRP Snap: the same message encoded as hex for its `signMessage` API.
+- Otsu: compact secp256k1 signature over its current double-SHA256 message format (its SHA256
+  preprocessing plus noble v2 default prehash), checked with Node crypto.
+
+Only keys that derive the claimed master address are accepted. Regular-key and multisign accounts
+are not supported. Linking proves that key's ownership; it is not a fresh ledger authorization or
+network-readiness check for issuance. Existing transaction flows still perform their separate
+network and signing checks. Crossmark, Xaman, Ledger, WalletConnect and unverified message formats
+are explicitly unsupported for linking by this implementation; their existing transaction features
+are preserved. A live extension round-trip for each supported format remains a release check.
+
+Source contracts: [GemWallet](https://github.com/GemWallet/gemwallet-extension/blob/master/packages/extension/src/contexts/LedgerContext/LedgerContext.tsx),
+[MetaMask XRP Snap](https://github.com/Peersyst/xrpl-snap/blob/main/packages/snap/src/core/Wallet.ts),
+and the inspected Otsu `packages/core/src/keyring/keyring.ts` at `ee4d823fa4d3f6e472ab61f15313490e45dfa69c`.
+
+## Test and recover
+
+```sh
+pnpm --dir apps/web exec vitest run test/auth-config.test.ts test/auth-oidc.test.ts test/auth-http.test.ts test/walletLinkProof.test.ts
+# Set XCS_TEST_DATABASE_URL to a disposable PostgreSQL 18 cluster first.
+pnpm test:postgres
+pnpm --dir apps/web test:e2e:auth
+```
+
+The browser harness requires both `XCS_BROWSER_E2E=1` and `XCS_AUTH_BROWSER_E2E=1` in development.
+It uses a real loopback OIDC code/token/JWKS exchange and synthetic in-memory application storage;
+separate integration tests exercise PostgreSQL with the restricted role. Production rejects the
+harness flag and excludes its runtime branch. Stubs are not evidence of real Identity registration,
+real wallet consent or successful production login.
+
+Remove the complete auth secret group to disable account navigation and reject auth endpoints while
+keeping public routes available. Retain the additive tables and use forward fixes. Do not roll back
+by removing populated users, wallet links or the migration journal.
+
+The guided Account wallet picker offers only the three supported message-proof adapters. Its
+installation links come from those adapters; setup, backup and private keys stay inside the wallet.
+An invitation supplies an allowlisted return to the recipient workspace, exposed after successful
+linking. Connected alone, wrong-network, unsupported-message and unlinked states never qualify as
+verified ownership. New credential presentations use a distinct, purpose-bound five-minute challenge
+and a fresh signature; the wallet-link signature itself cannot create a presentation.
diff --git a/docs/runbooks/current-flow-integration.md b/docs/runbooks/current-flow-integration.md
new file mode 100644
index 0000000..928dcbf
--- /dev/null
+++ b/docs/runbooks/current-flow-integration.md
@@ -0,0 +1,82 @@
+# Current flow integration — 2026-09-23
+
+> Historical validation record for the first integration on PR #34. Its deployment commands,
+> API split and future-work scope are superseded by the [standalone adaptation](../plans/pr35-standalone.md),
+> [current deployment runbook](deployment.md) and PR #35. The test counts below describe that earlier commit.
+
+## Scope and provenance
+
+Base: Commons `main` at `61fb809` (merged PR #34). Keep its Nuxt UI/Tailwind implementation,
+deployment split and security policy. Integrate the existing local functionality, not the future
+role-based application. Issues #24–33 remain open; this work does not implement authentication,
+issuer approval, invites, private claims, or the API-to-Nuxt migration.
+
+The local running source was preserved on `backup/local-flow-20260923` before integration:
+
+- `b63ffd5`: protocol/indexer changes;
+- `18e6f85`: recovered payload API and migrations;
+- `8c2a64f`: wallet, recipient and publication/recovery flows.
+
+Three earlier local fixes missing from the merged base were also retained: `18db6e8` (malformed
+Unicode), `27fd837` (unresolved submission recovery), `808f3e9` (wallet cleanup failure handling).
+The integration branch is `integration/current-flow`. The old running checkout and database were
+not replaced or reset.
+
+## Preserved behavior
+
+- XRPL Connect Vue rc.2, bounded connection/discovery, explicit session actions and network checks;
+  the narrow, pinned Crossmark package patch is documented in `patches/README.md`.
+- Schema registration, hosted/external payload issuance, recipient inbox, explicit acceptance,
+  verification, deletion and operation reconciliation, adapted to Nuxt UI components.
+- GemWallet raw Credential signing remains Testnet-only and requires explicit transaction consent.
+- Hosted public payload bytes persist in PostgreSQL; interrupted publication is recoverable after
+  reload without signing another credential. The API remains a separate service.
+- English default with French available. Upstream payload-review safety checks and external-host
+  validation are retained; regression coverage protects failed review with stale claims.
+
+## Verification performed
+
+- `pnpm install --frozen-lockfile` and `pnpm verify`: passed (791 unit tests; format, lint,
+  typecheck and all seven package builds).
+- `XCS_E2E_PORT=3198 pnpm --filter @xcs-protocol/web test:e2e`: 37 passed.
+- `pnpm --filter @xcs-protocol/web test:e2e:security`: 3 passed against the production build;
+  deterministic fixture routes are unavailable there.
+- Isolated PostgreSQL 18: 13 indexer + 5 API integration tests passed. Includes fresh bootstrap,
+  repeated bootstrap, upgrade from baseline and legacy hosted storage, retained profiles/bytes,
+  exact runtime grants and publication quotas/collision handling.
+- `pnpm --filter @xcs-protocol/db db:generate`: no schema changes. Applied SQL files remain
+  byte-identical to the preserved local source; only JSON snapshot formatting was normalized.
+- API production Docker image and App Platform web image built; both served HTTP successfully as
+  uid 1000. API used mounted secret files and the restricted API database role on the isolated DB.
+- Base + secret + hosted-payload overlays rendered with site/monitoring/demo-pinning profiles.
+  Entrypoint secret-loading tests passed.
+- `pnpm audit --prod --audit-level high`: passed threshold; 2 low and 1 moderate advisories remain.
+
+Browser suites above use explicit deterministic fixtures. They are not evidence that a real
+Crossmark/Otsu/GemWallet/Xaman extension signed through this new UI. Historical live-wallet reports
+describe the earlier checkout only. A real fresh Testnet journey on this branch remains a
+pre-merge requirement; do not market this integration as release-ready.
+
+## Outstanding gates
+
+- License policy check still fails for `@gemwallet/api@3.8.0`, `@walletconnect/types@2.24.0`,
+  and `vaul-vue@0.4.1` (reported `Unknown`). No license exception or policy relaxation was added.
+- XRPL Connect rc.2 declares an xrpl.js 3/4 peer range while this repository uses 5. Automated
+  checks pass, but a peer warning is not a real-wallet compatibility guarantee.
+- Xaman redirect selection is delegated to its SDK; the old redirect environment variable is no
+  longer consumed. Qualify homepage and deep-link sign-in against the deployment's registered URLs.
+- Quota exhaustion or an outage can prevent hosted publication after ledger validation. Recovery
+  preserves the signed transaction and bytes, but does not guarantee immediate host availability.
+- Public deployment/domain durability, cloud amd64 build, enforced CSP and real wallet matrix are
+  not established here. Localhost-only payloads remain inaccessible from another device.
+
+Keep the integration PR in draft until these applicable gates are resolved. After integration,
+start separate issue branches from the merged Commons `main`, beginning with the role flows in
+#29 before data/auth/API architecture work. Do not mix that redesign into this reconciliation PR.
+
+## Deployment and recovery
+
+See [optional Testnet hosting](deployment.md#optional-hosted-payloads-for-testnet-testing).
+Back up the DB and profile, bootstrap migrations/grants, then deploy API and web together. Keep
+immutable payload reads available when rolling back writes; ledger replay cannot recover payload
+bytes. The preserved local branch is a code fallback, not a substitute for a database backup.
diff --git a/docs/runbooks/deployment.md b/docs/runbooks/deployment.md
index fbe1ad8..82a2dea 100644
--- a/docs/runbooks/deployment.md
+++ b/docs/runbooks/deployment.md
@@ -1,20 +1,22 @@
 # Deploying XCS
 
-XCS deploys as **two independent applications** against a PostgreSQL instance provisioned outside
-this repository:
+XCS deploys as one DigitalOcean App Platform application with four independently configured
+components. PostgreSQL, private object storage, SMTP and OIDC are provisioned outside this repository.
 
-| Application    | What it is                                                                                             | Contract                    | Image                     |
-| -------------- | ------------------------------------------------------------------------------------------------------ | --------------------------- | ------------------------- |
-| `apps/indexer` | Validated-ledger ingestion worker. No HTTP surface. Owns database tooling.                             | `apps/indexer/.env.example` | `apps/indexer/Dockerfile` |
-| `apps/web`     | Nuxt UI **and** the `/v1` read/verification API, health, metrics, `/documentation`, all on one origin. | `apps/web/.env.example`     | `apps/web/Dockerfile`     |
+| Component           | Kind               | Purpose                                                                                  | Environment contract             |
+| ------------------- | ------------------ | ---------------------------------------------------------------------------------------- | -------------------------------- |
+| `apps/web`          | service, port 3000 | Nuxt UI, `/v1` API, auth, issuer, recipient, verifier, health, metrics and documentation | `apps/web/.env.example`          |
+| `apps/indexer`      | worker             | Validated-ledger ingestion and rebuildable projections; no HTTP surface                  | `apps/indexer/.env.example`      |
+| `apps/notifier`     | worker             | Restricted SMTP outbox processor; no HTTP surface                                        | `apps/notifier/.env.example`     |
+| `apps/db-bootstrap` | PRE_DEPLOY job     | Atomic migrations `0000`–`0008` and least-privilege database-role provisioning           | `apps/db-bootstrap/.env.example` |
 
-Each is deployed on its own, from its own directory, with its own lockfile and its own environment
-contract. There is no shared runtime component and no service-to-service call between them: they
-communicate only through PostgreSQL rows. See [ADR 0004](../adr/0004-two-standalone-apps.md).
+The web and indexer remain independent application runtimes and communicate through PostgreSQL rows.
+The notifier packages the worker compiled by the web build; the bootstrap job packages the database
+command compiled by the indexer. Every component has its own Passbolt folder and receives only its
+own environment contract. See [ADR 0004](../adr/0004-two-standalone-apps.md).
 
-Both Dockerfiles use the **repository root** as build context, because each image also needs `db/`
-(migrations and schema) and `config/` (network profiles) beside the application. Nothing under
-`packages/` is copied into either image.
+Every Dockerfile uses the **repository root** as build context so it can copy its application plus
+`db/` and `config/` where needed. Nothing under `packages/` enters a runtime image.
 
 ## What Compose is, and is not
 
@@ -28,8 +30,8 @@ They are **not** a deployment template:
 - the PostgreSQL container is disposable local state, not a managed database;
 - every published port binds to `127.0.0.1` and no port is meant to be exposed.
 
-Never run this Compose stack on a public host. A deployment runs the two images directly, against an
-external database, with the variables named in the two `.env.example` contracts.
+Never run this Compose stack on a public host. A hosted deployment uses the four component contracts
+above against managed services.
 
 ```sh
 cp .env.compose.example .env
@@ -91,12 +93,9 @@ XCS_REGISTRY_POLICY=controlled-testnet-pilot
 XCS_CONTROLLED_PILOT_ACK=DISPOSABLE_PROFILE_AND_DATABASE
 ```
 
-plus `XCS_DATABASE_SCOPE=exclusive-profile`, and both services name the pilot's profile file in
-`XCS_NETWORK_PROFILE`. The web app derives the browser-visible identifier
-(`commons-testnet-xcs-v0.1-controlled-pilot`) from that file; there is no separate variable for it.
-These four are the only settings the environment may still override -- the safe defaults
-(`blackholed`, `shared`, no acknowledgement) live in `apps/indexer/src/settings.ts`, and the
-acknowledgement itself has no default.
+Both services receive the same profile file through `XCS_NETWORK_PROFILE`; the web app derives the
+browser-visible ID from the parsed file. The pilot also requires
+`XCS_DATABASE_SCOPE=exclusive-profile`.
 
 This registry, profile and database cannot be promoted. Before public beta, create a different
 registry, complete and independently audit the normal blackhole ceremony, publish a new profile ID
@@ -105,8 +104,8 @@ as explicitly labelled staging evidence.
 
 ## Preparing the external database
 
-PostgreSQL 18 is provisioned outside this repository — a managed instance or an operator-run cluster.
-Nothing here creates the server.
+PostgreSQL 16 or newer is provisioned outside this repository — a managed instance or an
+operator-run cluster. The integration suite qualifies PostgreSQL 18. Nothing here creates the server.
 
 The indexer owns every database command. `--ignore-workspace` is mandatory on any per-app pnpm
 command that resolves dependencies (`install`, `audit`, `licenses list`); commands that only run a
@@ -116,29 +115,12 @@ script do not need it.
 pnpm --dir apps/indexer install --ignore-workspace --frozen-lockfile
 ```
 
-### Create the database users first
+### Create managed users, then bootstrap
 
-DigitalOcean owns the users of a managed PostgreSQL cluster: it creates them, and it generates and
-stores their passwords. XCS does not create them in SQL, because a role created that way is invisible
-to the managed service and carries a password DigitalOcean neither knows nor can rotate.
-
-So, before anything else, create the three users in the DigitalOcean control panel
-(**Databases → the cluster → Users → Add user**) or with `doctl`:
-
-```sh
-doctl databases user create <cluster-id> xcs_indexer
-doctl databases user create <cluster-id> xcs_api
-doctl databases user create <cluster-id> xcs_monitor
-```
-
-Take the password DigitalOcean generated for each (`doctl databases user get <cluster-id> <name>`,
-or the control panel) and put it in the corresponding runtime connection URL
-(`XCS_INDEXER_DATABASE_URL`, `XCS_DATABASE_URL`, and the exporter's credential). Rotate a runtime
-password through DigitalOcean; nothing in this repository needs rerunning afterwards.
-
-### Bootstrap once, on a fresh database
-
-Then, with all three users in place, run the grants step once as the administrator:
+Create all eight runtime users in the DigitalOcean database control panel or with `doctl`:
+`xcs_indexer`, `xcs_api`, `xcs_payload_writer`, `xcs_monitor`, `xcs_app`, `xcs_admin_app`,
+`xcs_notifier` and `xcs_issuer`. Store the eight generated connection URLs in the corresponding
+component secrets. XCS never receives the individual passwords during bootstrap.
 
 ```sh
 XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@db.example:5432/xcs \
@@ -146,48 +128,49 @@ XCS_BOOTSTRAP_DATABASE_URL=postgres://xcs_admin:…@db.example:5432/xcs \
   pnpm --dir apps/indexer db:bootstrap
 ```
 
-Run it from an operator machine, or as a one-off job using the indexer image
-(`node dist/lib/db/bin/bootstrap.js`), which is exactly what Compose's `db-bootstrap` service does
-locally.
-
-Bootstrap applies the committed migrations and then assigns the fixed runtime roles' privileges in
-one administrative transaction. It is **grants-only**: it never creates a role and never sets, resets
-or reads a role password. If `xcs_indexer`, `xcs_api` or `xcs_monitor` does not exist it fails before
-changing anything and names the missing role. It is idempotent: a second run reapplies the same role
-attributes and grants.
-
-| Identity      | Use                                       | Database rights                                                                                                                                                                                                      |
-| ------------- | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `xcs_admin`   | One-shot bootstrap and migrations         | Schema/DDL and role administration; never given to a long-running service                                                                                                                                            |
-| `xcs_indexer` | Indexer service and maintenance replay    | `SELECT`/`INSERT` on `network_profiles`, `ledger_checkpoints`, `schema_events`, `schemas`, `credential_events`, and `indexer_incidents`; `SELECT`/`INSERT`/`UPDATE` on `indexer_status` and `credential_generations` |
-| `xcs_api`     | Web app (`/v1`) and optional demo pinning | `SELECT` on projections; CRUD on `pin_challenges` and `demo_pins` only                                                                                                                                               |
-| `xcs_monitor` | PostgreSQL exporter                       | `pg_monitor`; no DML rights on XCS application tables                                                                                                                                                                |
-
-`XCS_DATABASE_CLUSTER_SCOPE=dedicated` is mandatory: the role attributes and memberships bootstrap
-normalizes are cluster-visible, so it must only ever run on a cluster dedicated to XCS. Grants and `PUBLIC` revocations are
-scoped to the database named by `XCS_BOOTSTRAP_DATABASE_URL`. All runtime roles are denied schema
-creation and `CREATE` on `public` is revoked from `PUBLIC`. The single-replica alpha caps connections
-at 12 for `xcs_indexer`, 12 for `xcs_api` and 3 for `xcs_monitor`, leaving capacity for
-administration and recovery; raise them deliberately before scaling replicas or pool sizes.
-
-Bootstrap never touches authentication. It asserts `LOGIN` on each role and never revokes it, not
-even transiently, so an interrupted run cannot lock the DigitalOcean-created users out; it leaves
-`VALID UNTIL` alone, because password metadata belongs to whoever issues the password. Configure the
-matching `pg_hba.conf` entries with `scram-sha-256`, and restrict each runtime role to the XCS
-database: verifier storage does not replace an authentication policy. Bootstrap reports role names or
-a stable failure code, never URLs or password values.
+Hosted deployments run the same command as the `apps/db-bootstrap` PRE_DEPLOY job. The operator
+machine command remains useful for local recovery and is exactly what Compose's `db-bootstrap`
+service executes.
+
+Bootstrap first checks that all eight users exist, then applies migrations 0000–0008 and grants in
+one administrative transaction. It is grants-only and idempotent: it never creates a role and never
+reads, sets, resets or rotates a password. Rotate credentials in DigitalOcean, update only the
+affected component URL, then restart that component; bootstrap does not participate in rotation.
+
+| Identity              | Runtime use                                        |
+| --------------------- | -------------------------------------------------- |
+| bootstrap provisioner | PRE_DEPLOY migrations and role administration only |
+| `xcs_indexer`         | Ledger projection writer and maintenance replay    |
+| `xcs_api`             | Public `/v1` projection reads and demo pinning     |
+| `xcs_payload_writer`  | Optional hosted public-payload publication         |
+| `xcs_monitor`         | PostgreSQL monitoring                              |
+| `xcs_app`             | Authenticated accounts and sessions                |
+| `xcs_admin_app`       | Commons review decisions                           |
+| `xcs_notifier`        | Notification outbox worker                         |
+| `xcs_issuer`          | Issuer, recipient and presentation workspaces      |
+
+`XCS_DATABASE_CLUSTER_SCOPE=dedicated` is mandatory: PostgreSQL login roles are cluster-wide, so
+bootstrap must only ever run on a cluster dedicated to XCS. A DigitalOcean-style non-superuser
+administrator is supported on PostgreSQL 16+ when it owns the target database and schema objects and
+can grant `pg_monitor`. Before touching the schema, bootstrap checks that all eight managed users
+exist, have `LOGIN`, carry no elevated role attributes and have no unexpected memberships. It fails
+closed on drift instead of trying to alter provider-owned users. Grants and `PUBLIC` revocations
+remain scoped to the selected database; only `pg_monitor` membership for `xcs_monitor` is added.
+
+Bootstrap never issues `ALTER ROLE`, so it leaves password verifiers, `VALID UNTIL`, connection
+limits and role defaults under DigitalOcean's control. Configure client transport and authentication
+at the managed database boundary, and restrict each runtime role to the XCS database: verifier
+storage does not replace an authentication policy. Failures expose only role names and the stable
+`DATABASE_ROLES_MISSING` or `DATABASE_ROLES_UNSAFE` code, never URLs or password values.
 
 Treat the PostgreSQL administrator and reviewed migrations as trusted administrative inputs.
 Bootstrap is not an anti-administrator attestation: it does not audit ownership or ACLs outside the
 selected database, which is why the dedicated-cluster requirement is part of the security boundary.
 
-Bootstrap also resets operational role defaults: `xcs_indexer` receives a 5-minute statement timeout
-and 30-second lock and idle-in-transaction timeouts; `xcs_api` receives 30-second statement/idle and
-15-second lock timeouts; `xcs_monitor` receives 30-second statement/idle and 10-second lock timeouts.
-These PostgreSQL settings are `USERSET`, so a client holding the runtime secret can override them;
-they are not security ceilings. Keep independently enforced connection/query/resource quotas. The
-residual denial-of-service boundary, including SQL `LISTEN`/`NOTIFY`, is documented in
-[`threat-model.md`](../threat-model.md).
+Each application pool is bounded to ten connections in code. Set stricter connection, query and
+resource quotas through DigitalOcean when the selected plan supports them; bootstrap cannot enforce
+cluster-level ceilings on provider-owned users. The residual denial-of-service boundary, including
+SQL `LISTEN`/`NOTIFY`, is documented in [`threat-model.md`](../threat-model.md).
 
 ### Migrate on every later schema change
 
@@ -218,26 +201,42 @@ The committed migrations are the complete current schema for this indexer's proj
 Rollback means restoring the former application against its untouched legacy database; do not point
 an older application at the new projection schema.
 
-## Deploying each application
+## Creating the Commons deployment
+
+Use the current multi-component `gh deploy-setup` extension from the repository root. One repository
+maps to one DigitalOcean app; each `apps/*` directory containing both `Dockerfile` and `.env.example`
+maps to one component and one Passbolt folder.
+
+```sh
+gh extension upgrade deploy-setup
+cd /path/to/xcs-protocol
+gh deploy-setup setup
+```
 
-Deployment is per application. `gh deploy-setup` is run **from that application's own directory**,
-where it finds that application's `Dockerfile` and reads that application's `.env.example` as the
-environment contract (names only; values live in the deployment's secret store). Each contract marks
-every variable with `# config`, `# optional`, `# generate` or `# held`.
+Choose `service` on port `3000` for `web`, `worker` for `indexer` and `notifier`, and `job` with the
+`PRE_DEPLOY` phase for `db-bootstrap`. Review the proposed four-component topology before it is
+applied. Run environment commands from the component directory when setting or importing values;
+push and deploy remain app-wide:
 
 ```sh
-cd apps/indexer && gh deploy-setup     # worker, no HTTP port
-cd apps/web && gh deploy-setup         # HTTP service, port 3000
+cd apps/web && gh deploy-setup env import .env.prod
+cd ../indexer && gh deploy-setup env import .env.prod
+cd ../notifier && gh deploy-setup env import .env.prod
+cd ../db-bootstrap && gh deploy-setup env import .env.prod
+cd ../.. && gh deploy-setup env status
+gh deploy-setup env push
+gh deploy-setup deploy --if-behind --watch
 ```
 
-Both build with the **repository root** as build context. The web service listens on `3000` and
-serves the UI, `/v1`, `/health/*`, `/internal/metrics*` and `/documentation` from that one port. The
-indexer exposes nothing.
+The `.env.prod` files in this example are private and gitignored. Each must contain only variables
+from the adjacent `.env.example`; shared values are deliberately copied into the specific Passbolt
+folders that need them. Never put `XCS_BOOTSTRAP_DATABASE_URL` or role passwords in `web`, `indexer`
+or `notifier`.
 
 ### Indexer configuration
 
-The long-running worker reads only the first ten variables of `apps/indexer/.env.example`; the last
-two are read by `db:bootstrap` alone and must not be given to the service.
+The long-running worker receives only variables from `apps/indexer/.env.example`. Bootstrap variables
+exist only in `apps/db-bootstrap/.env.example`.
 
 - `XCS_INDEXER_DATABASE_URL` authenticates as the least-privilege `xcs_indexer` role. Never give the
   service the admin URL.
@@ -247,10 +246,9 @@ two are read by `db:bootstrap` alone and must not be given to the service.
   logged. Distinct URLs alone are not evidence of independent operation; record the two operators in
   the deployment review. Plain `ws://` is accepted only on loopback for local development. Clio is
   not a supported source.
-- The polling interval, the writer-lease duration and the batch size are checked-in settings in
-  `apps/indexer/src/settings.ts`, not deployment inputs. The lease stays between 10 seconds and 5
-  minutes and at least three times the polling interval; the same validation rejects a bad edit at
-  start-up.
+- Polling, lease and batch settings are checked-in in `apps/indexer/src/settings.ts`; changing them is
+  a reviewed image change. Validation keeps the lease between 10 seconds and 5 minutes and at least
+  three times the polling interval.
 - Run the preflight before enabling the service:
 
   ```sh
@@ -269,48 +267,63 @@ two are read by `db:bootstrap` alone and must not be given to the service.
   discard incoming forwarding headers and write its own canonical client address. Leave it empty for
   direct exposure; never use a wildcard or a catch-all `/0`. An undeclared proxy is safe but
   collapses its visitors into one shared rate-limit budget.
-- The readiness staleness threshold (120 seconds) is a checked-in setting in
-  `apps/web/server/xcs/settings.ts`, and it governs readiness and every authoritative ledger-derived
-  route. Stale, inconsistent or implausibly future evidence returns `503`.
-- `XCS_NETWORK_PROFILE` names the profile file this deployment serves -- the same published file the
-  indexer indexes. The browser-visible profile identifier is that file's `profileId`, so it cannot
-  disagree with the profile the indexer writes.
+- The checked-in readiness threshold in `apps/web/server/xcs/settings.ts` governs readiness and every
+  authoritative ledger-derived route. Stale, inconsistent or implausibly future evidence returns
+  `503`.
+- `XCS_NETWORK_PROFILE` names the same published profile file used by the indexer. The browser ID is
+  derived from it.
 - `NUXT_PUBLIC_RPC_URL` is browser-visible and is used for wallet submission only. It must be a
   genuinely public endpoint with no embedded credentials — never a private indexer source. The
   server rejects userinfo and non-TLS public endpoints at startup (`ws://` is loopback-only), but it
   cannot tell whether an opaque path or query parameter is a provider secret.
-- `NUXT_PUBLIC_XAMAN_API_KEY`, `NUXT_PUBLIC_XAMAN_REDIRECT_URL` and
+- `NUXT_PUBLIC_XAMAN_API_KEY` and
   `NUXT_PUBLIC_WALLET_CONNECT_PROJECT_ID` are optional public application identifiers, visible in
   browser JavaScript. Register the exact redirect URL — this deployment's HTTPS origin with a
   trailing slash — in the Xaman Developer Console; each self-hosted origin needs its own Xaman
   application. Omitting an identifier removes only that adapter and leaves the six self-configuring
   XRPL Connect adapters registered.
-- `XCS_METRICS_TOKEN` both guards and enables the operational snapshot: setting it registers the
-  `/internal/metrics*` routes, leaving it unset leaves them absent, and a value that is not 32 to
-  256 URL-safe characters fails start-up. See [`monitoring.md`](./monitoring.md).
+- The presence of a valid `XCS_METRICS_TOKEN` enables and guards the operational snapshot; see
+  [`monitoring.md`](./monitoring.md).
+- Production document uploads require `XCS_DOCUMENT_STORAGE_DRIVER=s3` and a private
+  S3-compatible bucket such as DigitalOcean Spaces. Set its exact HTTPS endpoint, region, bucket,
+  optional single-segment prefix and `XCS_DOCUMENT_S3_PRIVATE_BUCKET=1`. Give the access key only
+  Read/Write/Delete Objects permission. Every upload explicitly uses the private ACL; the app does
+  not need bucket-administration access and never produces a public object URL. Filesystem storage is
+  limited to local development.
+- Configure `XCS_SMTP_*` on both `web` and `notifier`. External providers must use `starttls` or
+  `tls`, with a verified sender address and optional envelope sender. `disabled` transport security
+  is accepted only for local Mailpit. The web service sends issuer invitations and lifecycle mail;
+  the notifier drains Commons review decisions. Delivery attempts are durable, and an uncertain SMTP
+  result is never retried automatically.
+- Register `XCS_AUTH_ORIGIN` as the exact HTTPS redirect origin at XRP Identity and deliver the OIDC
+  client ID and secret to `web` only. Redirect URI or origin drift fails closed.
 
 For both the private controlled pilot and the Commons-hosted Testnet beta, also enforce the product
 boundary from [`ADR 0002`](../adr/0002-public-product-and-discovery.md):
 
-The three settings that carry that boundary are already checked in with the safe values in
-`apps/web/server/xcs/settings.ts`, so a deployment cannot cross it from a secret store:
-
-- `XCS_TRUSTED_ISSUERS` and `XCS_UNTRUSTED_ISSUERS` are empty, so Commons publishes no trust badge
+- leave `XCS_TRUSTED_ISSUERS` and `XCS_UNTRUSTED_ISSUERS` empty so Commons publishes no trust badge
   or issuer allowlist decision;
-- `XCS_PAYLOAD_FETCH_ENABLED` is `false`; the browser retrieves issuer-hosted HTTPS payloads only
+- keep `XCS_PAYLOAD_FETCH_ENABLED=false`; the browser retrieves issuer-hosted HTTPS payloads only
   after consent and sends parsed content for validation without server-side resolution;
-- `XCS_DEMO_PINNING_ENABLED` is `false`; the issuer, not Commons, operates the public HTTPS payload
+- keep `XCS_DEMO_PINNING_ENABLED=false`; the issuer, not Commons, operates the public HTTPS payload
   host;
 - do not add a subject feed, account-wide Credential export or claims ingestion to the deployment.
 
 ### Deployment order
 
-1. Bootstrap the external database (above).
-2. Run `pnpm --dir apps/indexer preflight` against the audited profile and both sources.
-3. Deploy the indexer and let it reach `ready`.
-4. Deploy the web app. Its `/health/live` succeeds immediately; `/health/ready` stays `503` until the
+1. Provision the empty dedicated managed database, private Spaces bucket, SMTP sender and OIDC
+   client. Keep the former database untouched if replacing the legacy MVP.
+2. Fill and push all four Passbolt component folders, then verify `gh deploy-setup env status` is
+   green.
+3. Run `pnpm --dir apps/indexer preflight` against the audited profile and both XRPL sources.
+4. Start the app-wide deployment. DigitalOcean runs `db-bootstrap` in `PRE_DEPLOY`; any preflight,
+   migration or grant failure prevents the runtime rollout.
+5. Let the indexer reach `ready`, then verify the notifier is running and the web service's
+   `/health/live` succeeds. `/health/ready` stays `503` until the
    indexer owns a live lease and its status exactly matches a transaction-root-bearing checkpoint at
    the effective tip.
+6. Exercise one review email, one issuer invitation, one recipient acceptance/presentation and one
+   anonymous verifier link against the deployed integrations before opening access.
 
 Use `/health/live` for the platform's container health check. Do **not** use `/health/ready` for it:
 a normal catch-up must not restart the web service. `/health`, `/health/live` and `/health/ready` all
@@ -389,7 +402,7 @@ representative localized route:
 
 ```sh
 curl --fail --silent --show-error --dump-header - --output /dev/null https://xcs.example/
-curl --fail --silent --show-error --dump-header - --output /dev/null https://xcs.example/studio
+curl --fail --silent --show-error --dump-header - --output /dev/null https://xcs.example/issuer
 ```
 
 Verify in the output that there is exactly one `Content-Security-Policy-Report-Only`, no
@@ -398,7 +411,7 @@ Verify in the output that there is exactly one `Content-Security-Policy-Report-O
 fingerprinted `/_nuxt/` asset must remain `public, max-age=31536000, immutable`. Then use a clean
 Chromium profile with DevTools open:
 
-1. Load Explorer, Studio, Developers and an exact Credential permalink; record every CSP violation
+1. Load Explorer, the role portals, Developers and an exact Credential permalink; record every CSP violation
    from the Console and the document's response headers from the Network panel.
 2. For each configured adapter—Xaman, Crossmark, GemWallet, WalletConnect, Ledger, Xyra, Otsu and
    MetaMask Snap—exercise connect, cancellation, schema registration, `CredentialCreate`,
@@ -429,21 +442,14 @@ schema and requires no database rollback. Never route around an adapter failure
 
 ## Optional Testnet demo pinning
 
-Pinning is disabled by default. It is only intended for public, non-sensitive Testnet examples.
-Because it is a feature flag, enabling it is a reviewed code change in
-`apps/web/server/xcs/settings.ts` followed by an image rebuild, not a deployment variable:
-
-```ts
-XCS_DEMO_PINNING_ENABLED: 'true',
-XCS_PINNING_NETWORKS: '<exact-profile-id>',
-XCS_IPFS_API_URL: '<kubo-rpc-endpoint>',
-```
-
-The one value that stays in the deployment contract is the secret, which is read only once the flag
-above is on:
+Pinning is disabled by default. It is only intended for public, non-sensitive Testnet examples. To
+enable it on the web app, set all of the following:
 
 ```dotenv
+XCS_DEMO_PINNING_ENABLED=true
+XCS_PINNING_NETWORKS=<exact-profile-id>
 XCS_PINNING_IP_HASH_SECRET=<at-least-32-random-bytes>
+XCS_IPFS_API_URL=<kubo-rpc-endpoint>
 ```
 
 Locally, the `demo-pinning` Compose profile provides an isolated Kubo node:
@@ -452,8 +458,8 @@ Locally, the `demo-pinning` Compose profile provides an isolated Kubo node:
 docker compose --profile demo-pinning up --build
 ```
 
-If server-side verification should read from that node, also set `XCS_PAYLOAD_FETCH_ENABLED` to
-`'true'` in the same settings module and point `XCS_IPFS_GATEWAY_URL` there at it. The wallet challenge, per-wallet/IP quotas, 64 KiB demo limit,
+If server-side verification should read from that node, also set `XCS_PAYLOAD_FETCH_ENABLED=true` and
+point `XCS_IPFS_GATEWAY_URL` at it. The wallet challenge, per-wallet/IP quotas, 64 KiB demo limit,
 90-day retention and cleanup job reduce abuse; they cannot detect all personal data. Never pin PII,
 secrets or production credentials.
 
@@ -464,16 +470,34 @@ secrets or production credentials.
 - Monitor checkpoint age, rejected registrations, ledger continuity failures, pin-store failures and
   disk usage. Signal definitions, SLO/RTO/RPO semantics and the recovery drill are in
   [`monitoring.md`](./monitoring.md).
-- The two applications roll back independently. A web rollback is always safe: the web app never
-  writes protocol projections. Roll either back only to a version compatible with the applied
-  migrations.
+- App Platform deploys the four components as one revision. A rollback must select a revision
+  compatible with the already-applied forward migrations; never roll the database journal backward.
 - Before production, an incompatible schema change means rebuilding and replaying the database; never
   skip a ledger.
-- A runtime-password rotation is a DigitalOcean operation: reset the user's password there, then
-  restart the affected application with the new connection URL. `db:bootstrap` sets no password and
-  does not need rerunning for a rotation. Keep `xcs_admin` credentials out of runtime services and
-  logs.
+- Rotate a runtime password in DigitalOcean, replace the affected component URL, then restart that
+  component. Do not rerun bootstrap for password rotation. Keep `xcs_admin` out of runtime services.
 - Retain a `pg_hba.conf` role-to-database allowlist as defense in depth.
-- Record the deployed revision of each application separately: they are versioned and deployed
-  independently, and a protocol change mirrored into only one of them is a real failure mode (see
+- Record the deployed repository revision and the component `COMMIT_SHA` values. A protocol change
+  mirrored into only one application remains a real failure mode (see
   [`CONTRIBUTING.md`](../../CONTRIBUTING.md)).
+
+## Optional authenticated workspaces and hosted payloads
+
+The same web app enables auth, admin review, issuer, recipient and verifier workflows when each
+deployment contract is complete. The PRE_DEPLOY job applies migrations 0000–0008 and grants access
+to the eight DigitalOcean-managed users. The public API continues to use `xcs_api`. Never grant one
+runtime role to another.
+
+The notification worker runs `node dist/admin/admin-notifier.js` from its dedicated component and
+requires no XRPL signing key. Production uploads live in the private S3/Spaces bucket; PostgreSQL
+stores metadata, workflow state and private claim payloads. Backups of either system require the same
+access controls as live application data.
+
+For local use only, add `docker-compose.application.yml` for auth/admin/issuer/Mailpit, and/or
+`docker-compose.hosted-payloads.yml` for public hosted publication. Supply variables through a private
+local environment file. Mailpit is a synthetic test destination, not a qualified external provider.
+Live Identity registration, wallet consent, SMTP delivery, Spaces access and managed-database rollout
+remain operator release checks.
+
+See [authentication](authentication.md), [admin](admin.md) and [issuer](issuer.md) for authorization,
+review, invitation, notification and recovery semantics.
diff --git a/docs/runbooks/gemwallet-raw-signing.md b/docs/runbooks/gemwallet-raw-signing.md
new file mode 100644
index 0000000..6a8f720
--- /dev/null
+++ b/docs/runbooks/gemwallet-raw-signing.md
@@ -0,0 +1,69 @@
+# GemWallet raw-signing qualification — 2026-09-21
+
+GemWallet 3.8.2's native `signTransaction` rejects Credential transaction types. Its official
+`signMessage(hex, true)` API signs XRPL signing bytes without that legacy transaction validator.
+XCS uses this API only for `CredentialCreate`, `CredentialAccept` and `CredentialDelete` after
+explicit consent. Schema registration still uses native Payment signing.
+
+## Boundaries
+
+- XRPL Connect rc.2 still owns connection, discovery and account/network refresh. Its exported
+  `GemWalletAPI` supplies hex signing; the generic adapter message method loses the hex flag.
+- The complete transaction is displayed before approval. GemWallet displays hexadecimal data and
+  calls it a message, so XCS explicitly explains that approval authorizes a transaction and its fee.
+- Consent binds the exact encoded preview and is consumed on each attempt. No silent fallback,
+  automatic re-signing or extension/provider replacement is used.
+- `xrpl.js` validates and serializes fields, derives the master address and assembles the signed
+  blob. The existing SDK verifies its signature and exact reviewed fields before publication,
+  journaling and submission. No application signing keys or custom cryptography were introduced.
+- Testnet master-key accounts only. Regular-key and multisigned accounts are not supported by this
+  raw path. The extension wait is bounded to 90 seconds; a late response is not submitted.
+
+## Real extension evidence
+
+The production Docker site at `https://localhost:3443` was exercised in isolated durable Brave
+profiles with the actual installed GemWallet 3.8.2 extension and two newly created disposable
+Testnet accounts. Browser TLS verification remained enabled. There were no simulated wallet,
+ledger or API responses in this qualification.
+
+Issuer: `r9ztbJ9n3XpNF4gja5pAnmy4Uxihsc5JGi`
+
+Subject: `rpzdE7FHnr3DjkLKRxdDsDkJJShPLhiusE`
+Schema: `06ad39d9a5ec1e55e9e3a15a95e1c2c3ffdd4337de63f8e213edabe6e6671459`
+
+| Action                             | Transaction hash                                                   | Validated ledger |
+| ---------------------------------- | ------------------------------------------------------------------ | ---------------- |
+| Schema Payment                     | `5A4AE1116EEF92AE94B06621385D6166417A211B5883A3E846844B830E65E5CE` | 20937631         |
+| CredentialCreate                   | `4D6AC2B8BE67987990F5ABBA7BB815A3FE4B05033421C9BACB78B45EB092DD11` | 20937727         |
+| CredentialAccept                   | `14D92F360E88C5B7FFCBE0F80F6D83A18B3EB2480911847F754DAA96C6C0D239` | 20937825         |
+| CredentialDelete (subject removal) | `33835AF0EDC48C8E98BED9529AB56E9229258DD6F0CEB06261918A01281B6266` | 20937872         |
+
+All four returned `validated: true` and `tesSUCCESS`, with matching indexed business evidence.
+Their canonical blobs were fetched independently using `tx` with `binary: true`, and checked with
+`xrpl.verifySignature`. Both live wallets used Ed25519; secp256k1 was exercised by unit tests only.
+
+The 248-byte synthetic payload was published, fetched over HTTPS and verified. The recipient's
+inbox discovered the pending credential; acceptance changed it to ACTIVE with VALID schema and
+payload. Subject removal changed it to DELETED with `subject_removed`. A fresh page with no wallet
+connection still verified the schema, payload and complete lifecycle. No existing credential was
+removed. The disposable generation cannot be restored; issuing again creates another generation.
+
+One acceptance attempt timed out with its browser window in the background. A late prompt was
+rejected, and a fresh review succeeded after reconnecting with that test browser focused and the
+other test browser closed. The precise extension scheduling cause was not established: do not
+claim every popup attempt is reliable. Close a stale wallet request, reconnect if needed, and
+prepare a fresh preview before retrying; do not approve an old hexadecimal prompt.
+
+## Checks and local deployment
+
+- `pnpm --filter @xcs-protocol/web test`: 249 tests passed. Unit wallet boundaries are simulated;
+  the signatures themselves use XRPL libraries, including wrong-key/changed-field rejection.
+- `pnpm --filter @xcs-protocol/web typecheck`: passed.
+- `XCS_E2E_PORT=3198 pnpm --filter @xcs-protocol/web exec playwright test e2e/pilot.spec.ts --grep 'requires explicit GemWallet'`:
+  passed; this isolated deterministic browser check proves consent gating, not extension support.
+- Production Docker build from source with the frozen lockfile passed. The local web image is
+  `xcs-web:gemwallet-raw-signing`; database, API, indexer and checkpoints were left unchanged.
+
+Rollback: select `xcs-web:publication-recovery` in `.data/local-https/compose.yml` and recreate only
+the web service. That image restores the old GemWallet credential restriction, not the live ledger
+state. The prior image remains available; no database rollback is needed.
diff --git a/docs/runbooks/issuer.md b/docs/runbooks/issuer.md
new file mode 100644
index 0000000..b1baa17
--- /dev/null
+++ b/docs/runbooks/issuer.md
@@ -0,0 +1,118 @@
+> Deployment update: applications install independently (`pnpm --dir apps/web install --ignore-workspace --frozen-lockfile`).
+> Use the [standalone deployment runbook](deployment.md) and per-app environment contracts.
+> Previous production secret-file Compose overlays are retired; the local application overlay is `docker-compose.application.yml`.
+
+# Issuer workspace
+
+The issuer portal provides onboarding, owned templates, invitations, managed payloads and issuance
+tracking. It derives one next action at `/issuer`; the former public mutation pages now redirect to
+the role portals. Real OIDC registration, external delivery and extension-wallet approvals remain
+separate release checks.
+
+## Provision and enable
+
+Apply migration `0006_issuer_workspace` after auth 0004 and admin 0005. Create the managed
+`xcs_issuer` user in DigitalOcean, store its generated URL as `NUXT_ISSUER_DATABASE_URL`, then run
+the grants-only bootstrap. Supplying the complete issuer and auth contracts enables the workspace.
+The restricted `xcs_issuer` pool cannot approve applications, grant admins or modify the projection.
+
+| Variable                             | Purpose                                                     |
+| ------------------------------------ | ----------------------------------------------------------- |
+| `NUXT_ISSUER_DATABASE_URL` / `_FILE` | Private `xcs_issuer` connection                             |
+| `XCS_DOCUMENT_STORAGE_DRIVER`        | `filesystem` locally; `s3` in production                    |
+| `XCS_DOCUMENT_FILESYSTEM_DIRECTORY`  | Absolute local-only directory shared with admin review      |
+| `XCS_DOCUMENT_S3_*`                  | Private bucket endpoint, region, prefix and object key      |
+| `XCS_SMTP_*`                         | TLS mode, credentials and verified sender for external SMTP |
+| `XCS_AUTH_ORIGIN`                    | Exact HTTPS origin for invitation and payload URLs          |
+
+Never expose credentials in `NUXT_PUBLIC_*`. Browser navigation is derived from the validated server
+contract. Payload URIs must fit XRPL's 128-byte limit including the digest; use a short HTTPS origin.
+
+For local validation, supply the variables named by `docker-compose.application.yml`, then render:
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.application.yml config --quiet
+```
+
+Run the grants-only PRE_DEPLOY component after DigitalOcean has created all eight users. Production
+uses managed PostgreSQL, a private S3-compatible bucket and an external
+SMTP provider with `starttls` or `tls`; filesystem storage and Mailpit remain local-only. Use a bucket
+key limited to Read/Write/Delete Objects, keep the bucket private and back up its objects together
+with database metadata. Qualify the sender domain and provider delivery before inviting users. The
+deployment operator must register the exact HTTPS origin with the OIDC provider.
+
+## Application and approval
+
+`/issuer/apply` accepts organization information and bounded PDF/PNG/JPEG documents. Opaque filenames,
+restrictive modes and recorded MIME/length/digest support the existing verified admin reader.
+Organizations start pending. `/issuer/application` shows the actual status and decision reason.
+Approval grants portal permission, not endorsement; ordinary signup cannot grant admin.
+
+Approved users navigate templates, recipients, credentials and settings. Template creation and
+issuance first require a linked Testnet issuer wallet. The server derives the
+organization owner from the session and checks current approval on mutations. Schema association
+requires an accepted indexed registration and a linked publisher wallet. The public and issuer
+pages reuse the same signing components; URL parameters are never treated as authorization.
+
+## Invitations and delivery
+
+Invitations select an owned schema and one delivery mailbox. Their random bearer is in a URL
+fragment, absent from HTTP requests and referrers. Only its hash persists; email construction keeps
+the bearer in memory. The claim page removes the fragment and does not persist it in browser
+storage. Signed-out users sign in and reopen their email link. Preview does not claim: the explicit
+authenticated button performs the atomic claim.
+
+Any authenticated holder may claim an unclaimed link. The delivery email is not identity evidence
+and is never marked verified. Review the actual claimant and linked wallet before signing. The
+minimal claim page links to account wallet settings; the full recipient inbox/presentation flow is
+issue #32. Invite expiration limits claiming, not an already claimed recipient or unlimited sharing.
+
+Resend requires confirmation, rotates the token and renews the deadline. Only unclaimed, unrevoked
+invitations may be resent or revoked. An already-issued invitation cannot issue again. Email
+delivery, claiming, wallet readiness and ledger acceptance are separate states.
+
+Invitation mail contains the organization, template, expiry, one action link and a wallet-safety
+warning; it contains no protocol identifier. SMTP attempts are recorded before sending. Lost acknowledgement/timeout produces `uncertain`,
+never automatic retry. Interrupted `sending` records are shown as uncertain after their bound.
+Issuance/revocation notifications target the actual claimant's current verified email, not an
+unverified delivery contact. A missing verified address blocks notification without undoing the
+ledger operation. Do not log SMTP bodies, fragments or payload bytes.
+
+## Private payloads and recovery
+
+Private is the initial choice. Review the public-field and full-authorized previews before signing.
+Public disclosure cannot recall downloaded copies. On-chain addresses, schema, opaque URI and full
+digest remain public in both modes.
+
+Canonical payload bytes are in private PostgreSQL application storage, bounded to 1 MiB. Drafts are
+visible only to the currently authorized preparing issuer. Recording checks the exact indexed
+generation, profile, schema, issuer, subject, URI and digest. `/q/:locator` then returns full bytes
+to authorized issuer/recipient accounts, or only selected public claims for an anonymous private
+credential view. Filtered responses carry `x-xcs-claim-scope: public`; they do not verify the complete
+payload digest. Responses are `private, no-store`.
+
+Admin alone grants no access. Verifier presentation routes remain #33 and must also require current
+approval and the recipient's matching designated grant. Public API/hosting roles cannot read the
+private tables. Database operators and backups can contain full claims: this is not end-to-end
+encryption. Preserve private backup and retention controls.
+
+Signing retains existing profile/account/network/freshness checks. Recording follows validated
+ledger evidence. Recovery stores only user-scoped operation references, transaction hashes and
+visibility selectors, never claims or bearer tokens. Retry reconciles the original transaction
+instead of signing another one. Acceptance, expiry, deletion cause and unavailable projection
+states remain separate; a missing row is never presented as accepted.
+
+The durable browser journal also locks each managed invitation across tabs, even when different
+linked recipient wallets are selected. It retains the lock after ledger success while metadata
+recording is pending. A new attempt is allowed only after proven transaction expiry or a validated
+failure. This lock is scoped to one browser profile: use one device/profile per in-flight invitation.
+Different devices can still race before metadata recording; database uniqueness prevents duplicate
+metadata, but does not reserve an invitation across devices before on-ledger signing.
+
+## Disable and retain
+
+Disable both issuer flags to hide navigation and reject workspace routes. This also makes managed
+payload routes unavailable, so a rollback must retain a compatible authorized reader at existing
+on-chain URLs. Keep payloads, application records and migration history; use forward fixes.
+Unreferenced drafts and orphaned uploads require administrative retention cleanup, never deletion
+of a payload referenced by issued metadata during deployment.
diff --git a/docs/runbooks/local-source-recovery.md b/docs/runbooks/local-source-recovery.md
new file mode 100644
index 0000000..66b552d
--- /dev/null
+++ b/docs/runbooks/local-source-recovery.md
@@ -0,0 +1,116 @@
+# Local source recovery — 2026-09-15
+
+Historical incident record for the deployments recovered on September 15–21, 2026. Commands,
+package names and grants below describe those revisions, not current deployment instructions.
+Issue #28 moved the API into Nuxt and split publication privileges into `xcs_payload_writer`.
+For current builds, rollout and rollback use [deployment](./deployment.md) and
+[ADR 0005](../adr/0006-nuxt-api-boundary.md).
+
+The running local HTTPS site was built from `/private/tmp/xcs-pr22-ready`, whose source files had
+expired. The top-level checkout is an older implementation and must not replace that deployment.
+
+The durable development checkout is now `/Users/sanka/dev/xcs-protocol/.data/xcs-live`.
+It was cloned locally from `fix/pr22-ready` (`3fced395`), without modifying the original checkout.
+Newer web application files, configuration, assets and documentation were recovered from the
+running `xcs-local-site-web-1` container. The deployed core bundle differs only by the public
+`payloadDigest` export, restored in source. The deployed SDK source map supplied the exact newer
+`submission.ts`. No wallet profiles, environment secrets or database contents were copied.
+
+Recovered changes predate the current wallet fix. Git diff against the PR therefore includes both
+recovered work and the new fixes; do not treat the whole diff as newly authored work.
+
+## Payload API recovery — 2026-09-21
+
+The deployed API's readable JavaScript modules and declarations were used to restore the missing
+hosted-payload service, repository, resolver, HTTP routes, configuration and startup wiring. The API
+declares its existing SDK dependency explicitly. The recovered database schema, runtime grants and
+original migrations `0001_hosted_payloads` / `0002_hosted_payload_locator_compatibility` are restored
+alongside the source. Their SQL bytes match the deployed migrations; do not reformat or rewrite them.
+The original `0000` baseline is unchanged. Existing deployed databases already have these migrations.
+
+The restored service keeps the deployed authorization boundary: Testnet allowlist, canonical payload
+and schema checks, a cryptographically valid matching `CredentialCreate`, fresh indexed creation
+evidence, 64 KiB limit, quotas and immutable content. Legacy 20-character
+locators remain readable; new publications use 18 characters. No private keys are handled by the API.
+
+Hosted Testnet publication no longer rejects claims based on field names such as `prenom`,
+`firstname` or `email`. Claims must still match the registered schema. Use synthetic data only:
+payloads are public, and accepting a field name does not establish that its value is non-personal.
+The separate demo-pinning and browser-local test-storage policies are unchanged.
+
+The following rebuild commands were used for that recovered revision only:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm --filter @xcs-protocol/api... build
+docker build -f docker/Dockerfile.node --build-arg XCS_PACKAGE=@xcs-protocol/api -t xcs-api:hosted-source-recovery .
+docker build -f docker/Dockerfile.node --build-arg XCS_PACKAGE=@xcs-protocol/web -t xcs-web:publication-recovery .
+```
+
+For a fresh database or an older baseline-only deployment, run the existing secret-file bootstrap
+workflow before starting the recovered API. It applies migrations and provisions append-only
+`xcs_api` access to the hosted tables. Back up an existing database first; never reset the projection
+or delete payloads as part of this rollout. Roll back application images without reversing these
+compatible table additions. Use the same fixed HTTPS origin and existing secret files.
+
+API hosting activates when its complete contract is present:
+`XCS_PUBLIC_PAYLOAD_BASE_URL` (exact short HTTPS origin), `XCS_HOSTED_PAYLOAD_NETWORKS`
+(allowed Testnet profile IDs), `XCS_PAYLOAD_STORAGE_IP_HASH_SECRET` (at least 32 bytes) and the
+`xcs_payload_writer` connection in `XCS_PAYLOAD_DATABASE_URL`. Nitro derives the browser-visible
+origin from this contract. Keep secrets out of source and command output. GET `/p/:locator` serves
+immutable JSON; POST `/v1/payloads/:locator` publishes only after validating its signed transaction
+and indexed evidence.
+
+The web now rejects oversized hosted payloads before signing and keeps consented recovery jobs
+across reloads. See the web README for retry, retention and cleanup semantics.
+
+Verification on 2026-09-21:
+
+- Web: 244 unit tests and Nuxt typecheck passed; API: 231 unit tests; DB: 38 unit tests.
+- Five API integration tests passed against an isolated PostgreSQL 18 instance, including bootstrap,
+  append-only permissions, hosted idempotency/quotas, legacy locators and size constraints.
+- API/DB builds and typechecks passed. `pnpm --filter @xcs-protocol/db db:generate` reported no drift.
+- Both Docker images built from source with the frozen lockfile. The local API and web were replaced
+  without replacing the database or indexer; the API still reported signing readiness `ready`.
+- Brave, with normal certificate validation and the real Crossmark extension, showed Crossmark
+  available on the first chooser opening. This is discovery evidence, not a new credential-signing
+  compatibility claim; Crossmark 0.2.19 still rejects native Credential transactions.
+- A recovery drill used an existing validated Testnet `CredentialCreate` blob fetched with
+  `binary:true`, and its real hosted payload. Reloading the recovery UI and retrying against the
+  rebuilt API returned 200. The unsigned-copy/signed-journal interruption case also recovered;
+  browser IndexedDB confirmed terminal signature cleanup. These were idempotent publication retries,
+  not new ledger transactions or simulated wallet approvals. The credential remained ACTIVE with
+  VALID schema and payload when checked without a connected wallet.
+
+## Historical recovery verification (2026-09-15)
+
+Original repair scope:
+
+- Wallet pending/connected/error states, bounded cancellation, and Crossmark session invalidation.
+- Official adapter/Vue-binding regression coverage; removal of obsolete rc.0 patch tests.
+- Indexer normalization of synthetic API metadata, retaining strict canonical ledger comparison.
+
+Use the existing local HTTPS Compose deployment and its private runtime env file. Do not copy
+secrets into this checkout. Keep prior Docker images available for rollback; no ledger checkpoints
+or PostgreSQL data should be reset for these repairs.
+
+## Verification and limitations
+
+- `pnpm --filter @xcs-protocol/web typecheck` passes.
+- The web unit suite passes, including official Crossmark adapter + Vue binding integration
+  against extension-transport test doubles, not injected production accounts.
+- Wallet UI and essential schema/issue/accept/verify Playwright cases pass in the explicitly
+  isolated browser test environment. These are not real extension approvals or live ledger writes.
+- Production web and indexer Docker builds pass. Brave loads `/learn` with normal certificate
+  validation (HTTP 200, TLS 1.3), no page errors and no production E2E adapter.
+- The indexer resumed past ledger `20711127`; its API reports `catching_up` with no source error.
+  Signing readiness remains blocked by the existing backlog. No checkpoint was skipped.
+- The user's real Crossmark approval remains a manual retest. No wallet secrets were accessed.
+- rc.2 declares an `xrpl` 3/4 peer range; this existing application uses `xrpl` 5. The tested paths
+  pass, but the warning remains and does not establish compatibility for every supported wallet.
+
+Rollback images remain `xcs-web:local-https` and
+`sha256:f8fc6b5f4c758a6cbfa5f477d15ba6e7c63d45f94c057e214e3d13b261478ddd` (indexer).
+Restore only the corresponding Compose image entry and recreate that service; leave databases,
+profile files, wallet profiles and certificates untouched. The prior indexer image retains the
+known synthetic-metadata divergence bug.
diff --git a/docs/runbooks/otsu-live-flow.md b/docs/runbooks/otsu-live-flow.md
new file mode 100644
index 0000000..04e7f33
--- /dev/null
+++ b/docs/runbooks/otsu-live-flow.md
@@ -0,0 +1,114 @@
+# Real Otsu Testnet flow — 2026-09-20
+
+## Scope
+
+Tested the production XCS website at `https://localhost:3443` in Brave, using an
+isolated persistent profile and the actual unpacked Otsu extension. Otsu source:
+`ee4d823fa4d3f6e472ab61f15313490e45dfa69c`, manifest version `1.0.0`.
+XRPL Connect Vue and XRPL Connect: `1.0.0-rc.2`, official `OtsuAdapter`.
+
+Playwright operated the real extension's creation, approval and signing screens.
+No provider injection, wallet-response substitution, fixture ledger, disabled TLS
+validation or external signing key was used for this live run. Otsu generated
+the disposable accounts; both received 100 Testnet XRP through its faucet UI.
+Recovery material and passwords are not part of this report.
+
+The web image was rebuilt from this worktree as `xcs-web:live-flow-review`.
+The previous deployed web image was older. A new disposable projection started
+at validated ledger `20910186`; older databases were preserved. The existing API
+image was retained because its recovered source is incomplete.
+
+## Public accounts and ledger evidence
+
+- Account A: `rsRW5YzPHe4DRoxh96dHsQ938RZbRwTtsp`
+- Account B: `rLyYcvM1fKFDQERzUUZzuiZiNqQJ9CEa2r`
+
+Every transaction below was independently queried using `xrpl.Client` against
+`wss://testnet.xrpl-labs.com`: `validated: true`, `tesSUCCESS`. XCS also confirmed
+its indexed evidence.
+
+| Run                         | Action              | Ledger   | Transaction hash                                                   |
+| --------------------------- | ------------------- | -------- | ------------------------------------------------------------------ |
+| A issues to B               | Schema registration | 20910418 | `11B6C799401148B79A4A276F1BC8A6AB6F4ADEA71FCABE015957949AFA33D513` |
+| A issues to B               | CredentialCreate    | 20910485 | `45290EFB2A2E3D65C72B31D202D06D92F88E29D705674D0CAD059619F60B5617` |
+| A issues to B               | CredentialAccept    | 20910519 | `BB3C7F0F5BEA3C9C30D0AC5E66ECCA56D44C4F74C53C7B9DC4B78AD9A819B6DC` |
+| B issues to A, after UI fix | Schema registration | 20910624 | `62FF415D6016046107335CE4177EE155349CD729A2CD8A99DB3BCF051147738B` |
+| B issues to A, after UI fix | CredentialCreate    | 20910639 | `08605AADCCD7C8AC6D0AB8BB586FDAAB587DBF93DEE10CA1E8FB1B3FE9B69144` |
+| B issues to A, after UI fix | CredentialAccept    | 20910649 | `A8BFF1AD9F05F4857790D9FCF841E945EC2249304153246B670B4D9F1C015271` |
+
+Both generation pages returned `ACTIVE / VALID / VALID / UNKNOWN` for on-ledger
+state, schema, payload and issuer trust. Unknown trust is intentional: these are
+not authenticated organizational identities. The first credential's accepted
+flag was additionally read directly through `account_objects` (`Flags: 65536`).
+
+## Repeat the UI checks
+
+1. Use a Testnet-only Otsu profile, with normal trusted HTTPS. Create/fund two
+   accounts through Otsu. Do not export their keys into XCS or a test script.
+2. Connect A through XCS; approve in Otsu. Check the displayed address and Testnet.
+3. Create a course-completion schema with synthetic fields. Prepare, sign in
+   Otsu, and wait for both ledger validation and XCS indexing.
+4. Open the confirmed schema and issue to B. Enter synthetic claims, prepare,
+   approve the exact hosted payload, sign and wait for publication verification.
+5. Disconnect XCS, select B in Otsu, wait for its account switch to finish, then
+   reconnect and approve. Check B's full address before proceeding.
+6. Open **My credentials**. The pending item must appear without entering its
+   identifier. Review it, allow payload loading, recognize the test issuer,
+   then accept in Otsu.
+7. Once validated, the pre-signing review and acceptance controls must disappear;
+   the transaction result and exact-generation evidence link remain. The old
+   `PENDING` snapshot must not appear to describe the post-acceptance state.
+8. Follow the evidence link and fetch the payload. Check `ACTIVE / VALID / VALID`.
+   The accepted credential must no longer appear in the pending inbox.
+9. Disconnect the wallet. Use **Verify** with the issuance transaction hash to
+   open and verify the same generation without authentication.
+10. Separately reject a schema signing request in Otsu. XCS must show the
+    rejection, show no ledger-success result, and release the form for retry.
+
+Steps 1–8 were completed twice, with account roles reversed. Step 9 and the
+rejection/retry path were also exercised against the real site and extension.
+Opening the first generation's acceptance link while connected as A (its issuer,
+not its subject) returned `CREDENTIAL_LINK_SUBJECT_WALLET_MISMATCH` and exposed no
+accept-signing control.
+
+## Fix and validation
+
+`accept.vue` kept displaying the pre-signing review after successful acceptance.
+It now hides that snapshot when ledger validation supplies a result; finality
+and the exact-generation page remain the authoritative post-submission UI.
+Post-validation errors remain visible outside the hidden review card.
+
+Additional automated checks (separate from live-wallet evidence):
+
+```sh
+pnpm --filter @xcs-protocol/web test
+pnpm --filter @xcs-protocol/web typecheck
+XCS_E2E_PORT=3114 pnpm --filter @xcs-protocol/web exec playwright test e2e/pilot.spec.ts --grep 'issues, reconfirms, then accepts a credential with exact indexed evidence'
+```
+
+The existing deterministic browser fixture guards the stale-review regression;
+it does not establish wallet compatibility. The second live acceptance above
+also verified the corrected production UI.
+
+Results: 223 web unit tests passed, web typecheck passed, the focused regression
+above passed, and the existing `issues, accepts and reviews a public HTTPS payload
+without browser storage` scenario passed. The production Docker web build and
+`git diff --check` passed. The initial fixture launch found port 3100 occupied;
+it was rerun on 3114 without stopping that existing service. The first added
+assertion incorrectly expected uppercase text instead of CSS-transformed
+`pending`; the case-independent status assertion passed on rerun.
+
+## Limits
+
+- This validates Otsu in an isolated profile, not Crossmark, Xaman, mobile wallets
+  or multiple simultaneously installed providers.
+- Select the intended Otsu account before reconnecting XCS. Do not treat an
+  account switch inside the extension as proof the dApp permission changed.
+- Payloads are served over trusted local HTTPS and stored by the running API,
+  not in browser storage. `localhost` is not public hosting and is inaccessible
+  to a recipient on another machine. Use a stable public HTTPS origin before
+  issuing credentials intended for remote verification.
+- The fresh projection is for disposable testing, not a complete historical
+  production index. No mainnet or real funds were used.
+- This run does not prove every external-service failure, expiration or
+  revocation path. Keep the API image until its missing source is recovered.
diff --git a/docs/runbooks/recipient-verifier.md b/docs/runbooks/recipient-verifier.md
new file mode 100644
index 0000000..86c9a27
--- /dev/null
+++ b/docs/runbooks/recipient-verifier.md
@@ -0,0 +1,124 @@
+# Recipient and verifier workspaces
+
+These optional workspaces implement issues #32 and #33 under [ADR 0005](../adr/0005-role-based-application.md).
+Enable the existing authentication and issuer services, with their separate restricted database
+connections. No additional recipient/verifier pool or environment variable is required. Public
+presentation resolution remains accountless; portal approval does not establish issuer trust.
+
+## Upgrade and recovery
+
+Run the indexer's existing database migration/provisioning procedure before deploying the new web
+image. Migration `0007_recipient_verifier` adds `app_verifier_history`; additive migration
+`0008_presentation_wallet_proof` adds separate presentation challenges and signature proofs.
+Migrations 0000–0007 remain unchanged. Reprovision `xcs_issuer` grants for challenges, proofs,
+presentation creation/revocation, metadata history and readiness evidence. The projection reader, auth and admin roles gain no private-payload access.
+See [application database](../database-app.md) and the [issuer runbook](issuer.md).
+
+Rollback deploys the previous compatible web image and leaves the additive table and records intact.
+Do not drop history or rewrite migration history. Payloads and application records require backups;
+replaying XRPL cannot reconstruct off-chain claims or sharing grants.
+
+## Everyday interface
+
+With the authenticated portals enabled, the home page and main navigation offer Receive, Issue
+and Verify. Technical exploration remains under More. Verification accepts the complete sharing
+link, including when pasted into the verification page; it never fetches an arbitrary pasted URL.
+Attestation names, organizations, readable fields and next actions are primary. Wallet addresses,
+hashes, raw transactions and verification dimensions remain available in collapsed details.
+Expired/revoked states, missing proofs and incomplete checks still appear before those details.
+Wallet approval still requires explicit consent, including GemWallet’s coded-message limitation.
+Recipient acceptance updates the available actions on the same page; removal is a secondary action.
+
+## Issuer journey
+
+Apply as an organization and wait for Commons' administrator decision. Issuance remains blocked
+until current approval. Register/select an owned schema, send the invitation and review the actual
+claimant. The workspace distinguishes invitation pending, wallet still required, ready to issue,
+already issued and unavailable. Readiness is refreshed from active wallet links; it is not inferred
+from possession of the invitation. The issuance review shows the delivery contact separately from
+the claimant and the wallet's verification timestamp. The existing wallet engine signs issuance;
+the recipient receives its notification after exact validated ledger evidence is recorded.
+
+## Recipient journey
+
+1. Open the invitation, sign in and explicitly claim it. The guided Account step offers only wallets
+   with supported ownership signatures (GemWallet, MetaMask XRP Snap, Otsu), installation/setup
+   guidance and Testnet fee information. Create/recover the wallet inside its own application; XCS
+   never asks for its seed or private key. Sign the wallet-link message, then continue to the inbox.
+2. Open `/recipient` for invitations, issued credentials and issuance/revocation notifications.
+3. Review the exact credential. Private content requires explicit consent and an authenticated
+   same-origin read. Local canonical-byte/digest/schema checks precede wallet approval; the server
+   rechecks ownership, linked wallet, generation and current indexed state. Reject/remove reads no
+   payload. Ledger confirmation is reconciled by exact transaction hash without another signature.
+4. Choose a public link, or a currently approved verifier organization for full disclosure. Connect
+   the same linked wallet and sign the explicit presentation-authorization message. This is separate
+   from ledger acceptance, creates no payment and binds one exact credential, scope and audience.
+   Copy the resulting link or locally generated QR code; raw tokens are returned only at creation.
+5. Revoke a grant from that credential's presentation list. All active grants remain visible, up to
+   200 per credential. Revoke an existing grant before creating another at the limit.
+
+Notifications reflect indexed events, including revocations outside the portal. Email delivery
+continues through the existing issuer issuance/revocation flow; an external ledger event does not
+start a new mail service. Workspace lists are bounded to 200 and credential event lists to 100.
+The unfiltered presentations API is a bounded recent view; the credential-specific list prioritizes
+all active grants ahead of revoked history.
+
+## Presentation and verifier journey
+
+`/presentations#token` (also `/fr/presentations`) removes the fragment from the address bar. Reading
+requires an explicit POST; merely navigating does not disclose claims. Login can carry the token in
+a Secure, HttpOnly, SameSite=Lax cookie for ten minutes. The cookie is consumed after authentication;
+the grant itself has no automatic expiration. Raw tokens are hashed in PostgreSQL and excluded from
+history, CSV, console warnings, browser persistent storage and server URL paths/queries.
+
+`/verifier/apply` submits an organization application through the existing document-review process.
+An approved organization can open its designated full presentations and inspect `/verifier` history.
+Reopening a history entry rechecks its grant, actor, organization and current approval. History and
+CSV contain metadata and the four verification dimensions, never claims or tokens. CSV text cells
+are protected against spreadsheet formula evaluation.
+
+Private credentials' public views contain only issuer-selected public fields. A wrong audience or
+anonymous viewer of a full link receives that public subset and an authorization hint. Already-public
+credentials retain their public claims. The private portal response distinguishes invalid, revoked,
+holder-proof-invalid and temporarily unavailable links without returning the bearer.
+An administrator has no special private-view permission. Suspension blocks subsequent full access.
+
+Opening a link requires no manually entered URI, address or schema identifier. Three factual cards
+show the issuer organization's **current** portal admission, the credential's indexed lifecycle,
+and the dated recipient signature authorizing this presentation. Addresses, hashes, UIDs and
+network profiles are not rendered in this business result. Admission is
+read from the application database; no historical approval at issuance is invented. A suspension
+changes that admission result without rewriting the ledger or revoking the credential.
+
+New presentation creation requires a separate five-minute, one-use challenge bound to the session,
+site, exact credential, wallet, payload digest, public-field selection, scope and intended verifier.
+The signature is checked before atomic challenge consumption and grant creation. The five-minute
+challenge deadline is not a grant expiry. Legacy links remain readable with proof explicitly marked
+as not provided; recreate a link to add a signature. A corrupted or mismatched stored proof makes
+the link unavailable. Public keys, signed message and signature may be returned as verification
+evidence; neither raw bearer tokens nor private keys are part of that proof.
+
+The proof demonstrates control of the master key corresponding to the address at signing time.
+It does not prove the viewer's identity or current presence, nor current XRPL key authority after
+master-key disabling or regular-key changes. Regular-key and multisign proof schemes are not
+supported. A verifier needing a new signature can ask the recipient for a newly created link.
+
+The four dimensions remain separate: credential state, payload integrity, schema validity and issuer
+trust. Configured trust policy and readiness freshness apply; approval is not trust. A public
+projection cannot verify the complete payload digest and reports `not_checked` after successful
+internal validation. Detected corruption still reports failure. Claims remain in browser memory;
+private claims never travel through `/v1/verify`, receipt exports or the wallet recovery journal.
+
+Revocation cannot recall copies already viewed. This is server authorization, not end-to-end
+encryption: infrastructure operators and database backups remain within the trust boundary.
+
+## Validation boundaries
+
+See [testing](../TESTING.md) for unit, restricted-role PostgreSQL, browser and compiled HTTPS tests.
+The connected runtime test submits applications and administrator approvals through real HTTP,
+delivers invitations to local Mailpit and signs messages and transactions through the actual wallet
+SDK with synthetic extension/RPC transports. Sessions, funded ledger accounts and indexed evidence
+are local fixtures; this does not exercise live consensus or a real installed extension. A separate [live Testnet qualification](standalone-live-testnet.md) exercises actual Identity
+registration, installed desktop GemWallet, live consensus and local SMTP with synthetic accounts.
+Other wallets, mobile return flows, external mail delivery and representative production
+user sessions still need operator qualification.
diff --git a/docs/runbooks/standalone-live-testnet.md b/docs/runbooks/standalone-live-testnet.md
new file mode 100644
index 0000000..ba65680
--- /dev/null
+++ b/docs/runbooks/standalone-live-testnet.md
@@ -0,0 +1,126 @@
+# Standalone live Testnet qualification — 2026-09-24
+
+The standalone application was exercised through real browser controls, the installed
+GemWallet 3.8.2 extension, two newly created and faucet-funded Testnet wallets, live XRPL
+transactions, PostgreSQL, local SMTP and the actual XRP Identity application. No browser
+provider, HTTP handler, OIDC session, RPC response or ledger projection was mocked or
+injected in this manual qualification. Automated suites have their own fixture boundaries.
+
+## Environment and scope
+
+The isolated site runs at `https://localhost:3445`; the previous deployment on port 3443
+was preserved. Identity authentication and account applications run on ports 3446 and
+3447, using a real confidential client, password login, email verification and OIDC consent.
+Identity's development email output supplied actual verification codes; external email
+delivery was not qualified. XCS invitations and notifications used actual local Mailpit SMTP.
+The first administrator was established using the application's bootstrap procedure after
+real login. Other accounts and approvals were created through their respective interfaces.
+
+All identities, application documents, claims and organization names are synthetic.
+Approval of **Synthetic Testnet Academy** and **Synthetic Testnet Verifier** is a decision
+in this isolated portal, not an endorsement by Commons in production. Wallets, browser
+profiles, data volumes and extension files use durable local directories. No wallet seeds,
+passwords, client secrets, presentation tokens or invitation tokens belong in this report.
+Browser and service TLS checks remained enabled with the existing local CA.
+
+The tested source is `9158eea` plus the binary-ledger and signature-expiry fixes committed
+with this report. Immutable image IDs identify the tested binaries:
+
+- Web: `sha256:47300ed5b16d5dd76c5f517e43a98e7e3c41ac78a2ac9c5d02a97e34746fee1c`.
+- Indexer: `sha256:9178dd88b95c771d7c2da87e0bf93e5a653c054a3f30d826f983ba4e5a467bf0`.
+
+## Observed journeys
+
+1. The issuer signed its wallet-link challenge, submitted an organization application and
+   uploaded a synthetic PDF. Managed schema registration was denied before approval.
+   A separate administrator reviewed the document and approved the application through
+   the UI; the audit trail and SMTP notification recorded the decision.
+2. The issuer registered a schema, sent an invitation and reviewed the actual claimant's
+   verified wallet. The recipient signed up, proved wallet control and claimed the invitation
+   opened from the actual received email. The issuer then saw that recipient as ready.
+3. The issuer reviewed public/private fields and signed a real `CredentialCreate`. The
+   recipient saw the issuance notification, explicitly reviewed the private payload and
+   signed `CredentialAccept`. Both transactions reached validated `tesSUCCESS` and the
+   application's indexed state became active.
+4. The recipient signed a separate presentation authorization. An anonymous browser opened
+   the resulting public link without entering a URI, address or schema. It displayed the
+   issuer's current portal approval, accepted recipient address and verified dated wallet
+   signature. `course = Synthetic managed course` was visible; the private `internalNote`
+   field and value were absent. The URL fragment was removed. Schema was valid, ledger
+   state active, issuer trust unknown and full-payload integrity correctly `not_checked`
+   for this public subset.
+
+5. A second, separately signed link targeted the approved verifier organization. Its
+   authenticated responsible user saw both fields and valid complete-payload integrity.
+   An anonymous browser and an authenticated administrator opening the same link received
+   only the public field and an explanation that full access requires the designated approved
+   organization. Their actual HTTP responses also contained no private field or value.
+   The verifier history recorded the check and successfully reopened the authorized content.
+
+The separate protocol-only journey also completed schema registration, issuance,
+acceptance and anonymous public-payload verification. Its full hosted payload passed
+digest/schema checks, while issuer trust correctly remained unknown. Portal admission,
+configured issuer trust and truth of claims remain separate concepts.
+
+## Public ledger evidence
+
+Issuer: `rwf6aeT1Lg7uBsToqged1HzGTP39j7esmc`.
+Recipient: `raWE6BHACp52NevUpFCErkQ2rj1D9xqHUV`.
+Both wallets received Testnet faucet funds through GemWallet; validated `account_info`
+confirmed their balances before the journey.
+
+| Journey         | Transaction      | Validated ledger | Hash                                                               |
+| --------------- | ---------------- | ---------------- | ------------------------------------------------------------------ |
+| Public protocol | Schema Payment   | 21021272         | `C0E43270C3DF9FD18B55AD455A05F3E7836094B4E3F6B46DD1531E90709E8B33` |
+| Public protocol | CredentialCreate | 21021295         | `1ADF50A886B9100DCCA3BABA1FF306018C4550FCA08889A43847CF5E963BD5DD` |
+| Public protocol | CredentialAccept | 21021498         | `DA1749FD86B2E5F1227B623E046E2722888195D934E6550DA5540C9D87309347` |
+| Managed issuer  | Schema Payment   | 21021715         | `49C61726499099D1C5ECCF3576B883B415506092D4B08DD9CA2987907E2C2D7B` |
+| Managed issuer  | CredentialCreate | 21021840         | `114A0A4E538D97161459701543B99215DA3952C5E61BBD5D4D0E9FC58E5A171A` |
+| Managed issuer  | CredentialAccept | 21022025         | `6E32B8BB65320A31EEC41A2E0EEFDE0F535ED9743830D1E838948E0B16BB2D6A` |
+
+Public protocol schema: `aa44ac6900b47a2187a68ab1a2b99aef1309a54a644d8850fb31b7f73d59bf41`.
+Managed schema: `d565a37adb1c511b7f7140dfbfd6da7c9ed3df8a871ce57e2e32bc57f7e92779`.
+
+The six transactions were independently fetched from live RPC with `tx` and `binary: true`.
+Each canonical blob passed signature verification and hash recomputation; each response was
+validated with decoded metadata `tesSUCCESS`. The managed Create/Accept issuer, subject and
+credential type matched.
+
+## Defects and operating lessons
+
+- The old indexer stalled on ledger 20987719: its 7,120 expanded transactions exceeded
+  what the secondary server reliably returned. Binary transport reduced the response from
+  approximately 10.7 MB to 6.85 MB. Canonical decoding, header/transaction hashes, transaction
+  ordering and full two-source quorum remain enforced. Archived live JSON/binary equivalence passed
+  for all transactions from the primary source. The initially observed two-source success
+  was not retained in an execution log; later archived attempts record disconnections.
+  The secondary endpoint can still
+  disconnect on repeated large requests; this fix does not guarantee upstream availability.
+- A delayed wallet approval exposed submission after `LastLedgerSequence`. The SDK now
+  checks expiry after signing, before publishing a newly signed transaction to recovery,
+  and again after asynchronous pre-submit guards. An already exposed transaction remains
+  conservatively recoverable. The earlier ambiguous journal entry was preserved; the
+  application does not infer definitive non-submission from an unvalidated cached response.
+- One full-presentation creation returned HTTP 503. Its exact service error was not
+  captured. After readiness returned 200, a new challenge and wallet signature succeeded;
+  the failed signature was not replayed.
+- An off-screen browser caused GemWallet's window creation to fail with a bounds error,
+  surfaced by the extension as user rejection. Moving the test window onto the screen
+  restored connection. A subsequent refresh timeout was an actual locked extension popup,
+  despite an old wallet tab still showing its balance. Unlocking the real popup restored
+  signing; no timeout, permission or review guard was weakened.
+
+## Verification boundaries
+
+After the production changes, 855 web unit tests, 300 indexer unit tests and 39 SDK tests
+passed. Database-dependent tests were explicitly skipped in those unit invocations;
+previous PostgreSQL/browser/runtime qualification remains separately documented. Relevant
+types, lint, vendor parity, formatting, builds and both production Docker builds passed.
+
+This qualification covers desktop GemWallet with the two generated Ed25519 wallets.
+Other extensions, mobile return paths, production Identity hosting and external email
+delivery remain unqualified. A presentation signature proves address control when the
+link was authorized, not the current identity or presence of whoever opens it. Copies of
+already disclosed claims cannot be recalled. See the [recipient/verifier runbook](recipient-verifier.md)
+for authorization and proof limits. The dependency license gate remains unresolved;
+the PR stays draft and no production deployment was performed.
diff --git a/docs/third-party-licenses.md b/docs/third-party-licenses.md
index 3c6a2c3..63db619 100644
--- a/docs/third-party-licenses.md
+++ b/docs/third-party-licenses.md
@@ -78,6 +78,20 @@ The patch restores that MIT text verbatim into the installed package. **Keep the
 nothing now verifies it**, because distributing the component without its licence text would breach
 the MIT notice condition. Drop it only when upstream publishes a version that ships its own licence.
 
+## Nodemailer
+
+Nodemailer is the direct SMTP client used by invitation and lifecycle delivery.
+
+|                  |                                                                    |
+| ---------------- | ------------------------------------------------------------------ |
+| Version reviewed | 10.0.10                                                            |
+| Licence file     | `LICENSE`                                                          |
+| Licence          | MIT-0                                                              |
+| SHA-256          | `4f814dcacd2da618d62829ea1f6238701cf421f18a6b36c91c5d8212245e2c78` |
+
+MIT-0 is a permissive licence and imposes no attribution condition. Commons accepts it for this
+direct production dependency. Re-review the installed licence when the exact version changes.
+
 ## tosource
 
 Declares no SPDX field. Its bundled `LICENSE` is the permissive zlib licence, SHA-256
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 8b31a65..08a7cc4 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -115,18 +115,16 @@ a separate data-flow, retention and access review.
   applies the current-database grants but does not constitute an anti-administrator attestation or
   audit unrelated databases. Protect and audit the administrator identity and build supply chain
   independently.
-- Bootstrap forces SCRAM-SHA-256 password verifiers for runtime roles, but the
-  operator still owns client transport and `pg_hba.conf` authentication policy. Require TLS where
-  traffic crosses a host boundary and explicit `scram-sha-256` role-to-database allow entries; do
-  not treat verifier format as a network-access control.
-- PostgreSQL connection limits and container limits provide coarse resource bounds, but the
-  provisioned statement, lock and idle-in-transaction timeouts are `USERSET` role defaults rather
-  than security ceilings. A client holding a stolen runtime credential can override them for its
-  session, consume every allowed connection, hold permitted row locks and run expensive authorized
-  work. Operators still need independently enforced connection/query/resource quotas, workload
-  isolation and alerts on long transactions, row-lock pressure and disk growth. The bootstrap's
-  advisory lock only serializes concurrent administrative runs; it is not a runtime security
-  boundary.
+- The managed PostgreSQL service owns runtime-user passwords, rotation metadata and the client
+  authentication policy. Bootstrap never reads or changes those values. Require TLS where traffic
+  crosses a host boundary, keep each generated connection URL in its owning component only, and do
+  not treat a password-verifier format as a network-access control.
+- Application pool limits and container limits provide coarse resource bounds, but they are not
+  database security ceilings. A client holding a stolen runtime credential can open independent
+  connections, hold permitted row locks and run expensive authorized work. Operators still need
+  DigitalOcean connection/query/resource quotas, workload isolation and alerts on long transactions,
+  row-lock pressure and disk growth. The bootstrap's advisory lock only serializes concurrent
+  administrative runs; it is not a runtime security boundary.
 - PostgreSQL's default function and `LISTEN`/`NOTIFY` capabilities are not narrowed by bootstrap. A
   stolen runtime credential can use capabilities PostgreSQL grants through `PUBLIC` and create a
   denial-of-service workload. Operators must constrain connections and workload externally and
diff --git a/docs/ux/README.md b/docs/ux/README.md
new file mode 100644
index 0000000..41a991a
--- /dev/null
+++ b/docs/ux/README.md
@@ -0,0 +1,140 @@
+# Role-based journeys — issue #29
+
+Status: design draft for review. No participant sessions have taken place. These screens describe
+proposed behavior for issues #30–33, not functionality implemented by this change.
+
+On 2026-09-23 the user deferred the participant sessions and requested the next implementation
+issue. Work may proceed; the research criterion remains unperformed, not passed.
+
+Baseline: `6aa23f5` (issue #28, API served by Nuxt/Nitro). The application remains accountless today.
+[ADR 0005](../adr/0006-nuxt-api-boundary.md) implements the transport boundary only; the role-based
+ADR 0004 (`docs/adr/0005-role-based-application.md`), prepared concurrently for
+[#24](https://github.com/XRPL-Commons/XCS/issues/24), records accepted product decisions in the local
+checkout and will be committed separately with that work. This
+draft follows that ADR, including where it supersedes the original issue text: designated verifier,
+global approval, revocable sharing without automatic expiry, and no implicit admin access.
+
+## Review the designs
+
+Open [the local gallery](./index.html) in a browser: choose French or English, then a role. It is an
+offline, static review artifact with fictional examples; buttons drawn inside screens do not perform
+transactions. Each role has editable Excalidraw boards and one SVG per screen, in both languages.
+
+| Role      | Journey, screen inventory and wireframes                            | Implementing issue                                   |
+| --------- | ------------------------------------------------------------------- | ---------------------------------------------------- |
+| Admin     | [Review applications and manage access](./admin/README.md)          | [#30](https://github.com/XRPL-Commons/XCS/issues/30) |
+| Issuer    | [Apply, publish, invite and issue](./issuer/README.md)              | [#31](https://github.com/XRPL-Commons/XCS/issues/31) |
+| Recipient | [Claim, link, accept and present](./recipient/README.md)            | [#32](https://github.com/XRPL-Commons/XCS/issues/32) |
+| Verifier  | [Read a result and request authorized detail](./verifier/README.md) | [#33](https://github.com/XRPL-Commons/XCS/issues/33) |
+
+[Shared patterns](./shared/README.md) define states, bilingual copy and privacy rules.
+[Usability sessions](./usability.md) contains the test script and the unfilled evidence register.
+[Issue handoffs](./handoffs.md) contains screen lists and links ready for the four implementation
+issues. Those GitHub issue bodies have not been edited.
+
+## Scope and working assumptions
+
+- Course completion is the first fictional example; diploma is the second schema template. Names,
+  organizations and dates in screens are synthetic. No real identities, invitation tokens or claims.
+- Users may hold multiple roles and switch workspace. XRP Identity sign-in and wallet connection
+  are distinct: an identity session does not prove control of an XRPL address.
+- Schema selection derives the schema UID. The claimed invite and verified wallet derive the
+  recipient address. Technical evidence remains available in a secondary disclosure.
+- Signing stays in the wallet. Submission is not success until validated ledger evidence exists.
+  Unknown outcomes resume the original operation instead of prompting a duplicate signature.
+- Private means restricted off-ledger fields, not an invisible XRPL transaction. Issuer, subject,
+  schema reference and ledger lifecycle remain public. Nothing erases ledger history.
+- An issuer selects public/private visibility and the public subset at issuance. A recipient can
+  narrow a presentation's scope; they cannot make an already public payload private. For private
+  sharing, the recipient chooses a globally approved verifier, bound to its stable application
+  identity. Both that authenticated identity and the current recipient grant are checked per access.
+- Default presentation scope is public. Sharing has no automatic expiry or renewal and remains
+  revocable; credential expiry and session expiry still apply independently. No single-use control,
+  implicit TTL or per-issuer verifier allowlist is introduced. A QR carries the same link, not extra
+  authorization. No public subject feed or claim search is introduced.
+- Private payload storage and application authorization are dependencies of #25/#27/#31/#33.
+  Existing public payload hosting must never be used as a shortcut for private credentials.
+
+## Plan and completion gates
+
+| Milestone                                          | Status                 | Evidence / next step                                           |
+| -------------------------------------------------- | ---------------------- | -------------------------------------------------------------- |
+| Inventory current pages and protocol constraints   | Complete               | Baseline and route table below; per-role simplification tables |
+| Draft four journeys, failures and EN/FR wireframes | Complete               | Role folders; shared screen catalog and renderer               |
+| Verify exports, links, mobile layout and handoffs  | Complete               | Actual check results recorded below                            |
+| Observe two people per role and revise             | Pending external input | Eight sessions in [usability.md](./usability.md)               |
+| Maintainer reviews UX and links flow issues        | Pending review         | Follow accepted ADR 0004; publish [handoffs.md](./handoffs.md) |
+
+Changes are confined to `docs/ux/`. No production routes, translations, schema, dependencies,
+services or deployment files are changed. Rollback is removal of this new design directory only;
+no application or persistent data rollback is involved.
+
+## Existing pages: preserve or adapt
+
+Paths below are existing Nuxt pages. Role paths in the journey documents are proposals, not routes
+available in this checkout. Keep the accountless Studio until ADR 0004 explicitly retires it.
+
+| Existing route               | Decision for this design                                           | Future role use                                                       |
+| ---------------------------- | ------------------------------------------------------------------ | --------------------------------------------------------------------- |
+| `/`                          | Keep public Explorer entry and aggregate overview                  | Add a separate signed-in workspace entry later                        |
+| `/schemas`, `/schemas/:uid`  | Keep public permissionless discovery and exact schema detail       | Issuer workspace filters its own registered schemas                   |
+| `/search`                    | Keep exact credential lookup and schema discovery; no subject feed | Role pickers use owned records, not public claim search               |
+| `/activity`                  | Keep public schema registration activity                           | Never replace with a public recipient activity feed                   |
+| `/transactions/:hash`        | Keep exact public ledger evidence                                  | Secondary technical details after an operation                        |
+| `/credentials/:generationId` | Keep exact ledger metadata and consented public payload review     | Private payload bytes must remain behind application authorization    |
+| `/verify`                    | Keep accountless exact verification and separate dimensions        | New `/p/:token` offers presentation-aware, authorized views           |
+| `/status`                    | Keep public network readiness                                      | Shared degraded-state link; do not expose infrastructure internals    |
+| `/learn`, `/developers`      | Keep public learning and REST documentation                        | Explain role features separately once implemented                     |
+| `/studio`                    | Keep existing accountless action hub                               | Add separate role workspaces; do not require login here yet           |
+| `/schemas/register`          | Keep accountless guided/advanced editor                            | Reuse templates inside issuer schema step I3                          |
+| `/issue`                     | Keep current public-payload unit issuance                          | I5 derives recipient/schema and adds private-hosting prerequisites    |
+| `/credentials`               | Keep current connected-wallet inbox of unaccepted credentials      | R3 proposes a session-owned inbox including accepted/history states   |
+| `/accept`                    | Keep exact accept/reject and payload consent boundaries            | R4 embeds the same review and wallet-signing engine                   |
+| `/revoke`                    | Keep wallet-authorized deletion                                    | I6 provides an owned-credential entry and confirmation                |
+| `/operations`                | Keep local signed-operation recovery                               | Role views link to unresolved work; no claim of cross-device recovery |
+
+Current sources: [pages](../../apps/web/app/pages),
+[credential review](../../apps/web/app/utils/credentialReview.ts),
+[status tones](../../apps/web/app/components/StatusPill.vue),
+[API surfaces](../api-surfaces.md). Nothing here overrides frozen protocol semantics or the existing
+exact-lookup privacy boundary.
+
+## Edit and regenerate
+
+The bilingual [screen catalog](./screens.json) is the editable source for all visual exports. Edit
+copy there and behavior in the role README; regenerate rather than editing SVG/Excalidraw output.
+
+```sh
+node docs/ux/render-wireframes.mjs
+pnpm exec prettier --write docs/ux
+pnpm exec prettier --check docs/ux
+node docs/ux/render-wireframes.mjs --check
+```
+
+The renderer uses only Node built-ins. Its `.excalidraw` files follow the
+[Excalidraw scene format](https://docs.excalidraw.com/docs/codebase/json-schema). Import a board into
+Excalidraw for collaborative review; port accepted edits back into the catalog to keep exports in
+sync. SVG exports and the HTML gallery also work without an editor or external requests.
+
+## Verification evidence
+
+On 2026-09-23, for this design directory:
+
+| Check                                 | Command or method                                                               | Result                                                                                                                   |
+| ------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| Formatting                            | `pnpm exec prettier --check docs/ux`                                            | Passed for Markdown, HTML, JSON and MJS; SVG and Excalidraw have no configured formatter                                 |
+| Export synchronization                | `node docs/ux/render-wireframes.mjs --check`                                    | Passed: 22 bilingual screens, 44 SVGs, 10 native boards and one gallery                                                  |
+| Renderer syntax                       | `node --check docs/ux/render-wireframes.mjs`                                    | Passed                                                                                                                   |
+| References and native scene structure | Local Markdown/HTML link walk, JSON parsing, unique element IDs and dimensions  | Passed: 59 local Markdown links; 10 scene files                                                                          |
+| Browser rendering                     | Installed Playwright/Chromium against local files, 390 × 844 and 1440 × 1000    | Passed: FR/EN toggle, image loading, all SVG text bounds, no horizontal overflow, JavaScript errors or external requests |
+| Visual review                         | Gallery plus public-verifier, recipient-review and presentation SVG screenshots | Reviewed; headline and its qualification precede details on mobile                                                       |
+| Product consistency                   | Read-only comparison of role docs and catalog with accepted ADR 0004            | No remaining audience/approval/duration/admin-access contradiction found                                                 |
+
+Chromium's initial launch was blocked by the sandbox; the checks above ran successfully with
+permission outside it. Excalidraw JSON structure was checked, but import into the Excalidraw editor
+was not manually exercised. No application unit, integration, wallet or production build suite was
+rerun for this documentation-only change. No real participants have tested these screens.
+
+Automated artifact checks are not usability validation, real-wallet testing or evidence that
+role-based product behavior has been implemented. The accepted ADR and adjacent documentation
+appeared through concurrent work; they were read for alignment and not edited by this task.
diff --git a/docs/ux/admin/README.md b/docs/ux/admin/README.md
new file mode 100644
index 0000000..65e24ed
--- /dev/null
+++ b/docs/ux/admin/README.md
@@ -0,0 +1,75 @@
+# Admin — review an organization and grant access
+
+Draft for [#30](https://github.com/XRPL-Commons/XCS/issues/30).
+
+User goal: “I want to decide who can use issuer or verifier features, with enough evidence to
+explain my decision.” Approval is application access, not endorsement of an issuer's claims.
+
+[French board](./wireframes.fr.excalidraw) · [English board](./wireframes.en.excalidraw) ·
+[Gallery](../index.html#admin)
+
+## Journey and screens
+
+```mermaid
+flowchart LR
+  A1[Queue: oldest first] --> A2[Review organization and evidence]
+  A2 --> Approve[Approve access]
+  A2 --> Reject[Decline with reason]
+  Approve --> A1
+  Reject --> A1
+  A1 --> A3[Verifier permissions]
+  A1 --> A4[Audit history]
+```
+
+| Screen / suggested route                    | Question answered                                                       | Main action and data                                          | Exit                               |
+| ------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------------- |
+| [A1](./a1.fr.svg) `/admin`                  | What needs my attention?                                                | Oldest pending applications; role filter and counts; open one | A2                                 |
+| [A2](./a2.fr.svg) `/admin/applications/:id` | Is this organization who it says it is, and which access am I granting? | Profile, documents, wallets, timeline; approve or decline     | Queue updates and announces result |
+| [A3](./a3.fr.svg) `/admin/verifiers`        | Is this verifier still approved to use the portal?                      | Global approval state; confirm suspension or restoration      | Updated approval and audit entry   |
+| [A4](./a4.fr.svg) `/admin/audit`            | Who changed access, and why?                                            | Actor, target, time, before/after and reason; metadata only   | Back to queue                      |
+
+A2 opens documents in a new tab through an expiring authorized URL, announced in the link label.
+Decline expands a required reason field on A2; missing reason stays on the same screen with a field
+error. Approval previews the exact role. Both actions disable while pending, then return to the
+same queue position. Concurrent review shows the already-recorded decision rather than overwriting
+it. Document-access errors retain the application and offer retry; never approve automatically.
+
+## Remove unnecessary work
+
+There is no existing admin screen. Current ledger pages expose raw addresses and identifiers but
+cannot establish an organization's identity. Do not repurpose them as an approval console.
+
+| Information                           | Source / handling                                                             |
+| ------------------------------------- | ----------------------------------------------------------------------------- |
+| User ID, application ID, reviewer ID  | Session and selected record; never typed                                      |
+| Organization and supporting documents | Application form from issuer/verifier                                         |
+| Role and current state                | Application; preview before approving                                         |
+| Reason for refusal                    | Admin must supply; never inferred                                             |
+| Verifier approval target              | Select the verifier application identity, not a raw address or an issuer list |
+
+## Failure, empty and authorization states
+
+- Empty queue: “No applications to review” / “Aucune demande à examiner”; link to audit history.
+- Session expired/non-admin: sign in or a clear access-denied page, no redirect loop and no profile
+  data in the response. Deep links must enforce the same check as the workspace.
+- Wallet missing (F1): does not block reviewing application documents; never asks the admin to sign
+  an XRPL transaction. Applicant wallet incompleteness is visible only when relevant to the role.
+- Invite unusable (F2): not an approval prerequisite; do not conflate recipient invites with role
+  applications or repair invites by changing role approval.
+- Indexer unavailable (F3): app-only document review may continue; ledger-dependent evidence is
+  unavailable, never “verified”. Approval cannot invent that evidence.
+- Notification failure: decision remains recorded once; show notification pending and offer a safe
+  retry. Do not repeat the approval to resend mail.
+
+## Review and acceptance tasks
+
+Two admin participants each review one complete issuer application, decline another with a reason,
+and suspend a verifier's global approval. Observe time to first decision (target under one minute
+after opening a complete application), whether “approval ≠ endorsement” is understood, and whether
+they understand that only a recipient can grant that designated verifier private-claim access.
+Record results in [the session log](../usability.md). ADR 0004 supersedes #30's issuer-allowlist UI;
+do not implement that screen or give admins a private-claim override.
+
+#30 must test non-admin page/API rejection, audit before/after records, exact notification behavior,
+concurrent review, expiring document links and access revocation. Its implementation screen set is
+A1–A4; shared patterns apply. No usability approval has been obtained yet.
diff --git a/docs/ux/admin/a1.en.svg b/docs/ux/admin/a1.en.svg
new file mode 100644
index 0000000..14e6431
--- /dev/null
+++ b/docs/ux/admin/a1.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">A1 — Applications to review</title>
+<desc id="desc">Start with the oldest application. Approving application access does not endorse an issuer’s attestations.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Applications to review</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Start with the oldest application.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">2 applications pending</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Filter by role</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">All · Issuer · Verifier</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop · Issuer</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Received 21 September · Complete file</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Office · Verifier</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Received 22 September · Needs review</tspan></text>
+<rect x="24" y="397.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Other actions</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Verifier permissions · Audit history</tspan></text>
+<rect x="24" y="472.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="485.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Review Example Workshop</tspan></text>
+<text x="24" y="529.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Approving application access does not endorse an</tspan><tspan x="24" dy="15.600000000000001">issuer’s attestations.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a1.fr.svg b/docs/ux/admin/a1.fr.svg
new file mode 100644
index 0000000..f889aa7
--- /dev/null
+++ b/docs/ux/admin/a1.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">A1 — Demandes à examiner</title>
+<desc id="desc">Commencer par la demande la plus ancienne. Autoriser l’accès à l’application ne valide pas les attestations d’un émetteur.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Demandes à examiner</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Commencer par la demande la plus ancienne.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">2 demandes en attente</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Filtrer par rôle</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Tous · Émetteur · Vérificateur</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple · Émetteur</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Reçue le 21 septembre · Dossier complet</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bureau Exemple · Vérificateur</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Reçue le 22 septembre · À examiner</tspan></text>
+<rect x="24" y="397.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Autres actions</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Accès des vérificateurs · Journal</tspan></text>
+<rect x="24" y="472.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="485.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Examiner Atelier Exemple</tspan></text>
+<text x="24" y="529.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Autoriser l’accès à l’application ne valide pas</tspan><tspan x="24" dy="15.600000000000001">les attestations d’un émetteur.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a2.en.svg b/docs/ux/admin/a2.en.svg
new file mode 100644
index 0000000..d789a4d
--- /dev/null
+++ b/docs/ux/admin/a2.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">A2 — Review application</title>
+<desc id="desc">Can I identify this organization? Which access should I grant? The decision is audited. A notification will be queued for sending.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Review application</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Can I identify this organization? Which</tspan><tspan x="24" dy="18.2">access should I grant?</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Issuer · Awaiting review</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Training · France · Contact provided</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Supporting documents</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">View document ↗ New tab</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Wallet and timeline</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Address linked · Applied on 21 Sep</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">If declining</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Required reason: explain the decision</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Approve issuer access</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Decline with a reason</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">The decision is audited. A notification will be</tspan><tspan x="24" dy="15.600000000000001">queued for sending.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a2.fr.svg b/docs/ux/admin/a2.fr.svg
new file mode 100644
index 0000000..19cbc80
--- /dev/null
+++ b/docs/ux/admin/a2.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">A2 — Examiner la demande</title>
+<desc id="desc">L’organisation est-elle identifiable ? Quel accès autoriser ? La décision sera journalisée. Une notification sera mise en attente d’envoi.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Examiner la demande</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">L’organisation est-elle identifiable ? Quel</tspan><tspan x="24" dy="18.2">accès autoriser ?</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Émetteur · En attente d’examen</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Formation · France · Contact fourni</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Justificatifs</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Voir le document ↗ Nouvel onglet</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Portefeuille et historique</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Adresse liée · Demande reçue le 21/09</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">En cas de refus</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Motif obligatoire : expliquer la décision</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Autoriser le rôle émetteur</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Refuser avec un motif</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">La décision sera journalisée. Une notification</tspan><tspan x="24" dy="15.600000000000001">sera mise en attente d’envoi.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a3.en.svg b/docs/ux/admin/a3.en.svg
new file mode 100644
index 0000000..1ba2b51
--- /dev/null
+++ b/docs/ux/admin/a3.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">A3 — Verifier approval</title>
+<desc id="desc">Manage portal access without unlocking private fields. No issuer allowlist. An administrator cannot grant themselves access to private claims.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Verifier approval</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Manage portal access without unlocking</tspan><tspan x="24" dy="18.2">private fields.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Office · Access approved</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Office · Verified identity</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Global approval</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Active · Verifier role approved</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Reading private fields</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Recipient grant for this verifier required</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Withdraw approval</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Blocks future private access</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Suspend approval…</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">View decisions</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">No issuer allowlist. An administrator cannot</tspan><tspan x="24" dy="15.600000000000001">grant themselves access to private claims.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a3.fr.svg b/docs/ux/admin/a3.fr.svg
new file mode 100644
index 0000000..8393bda
--- /dev/null
+++ b/docs/ux/admin/a3.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">A3 — Autorisation du vérificateur</title>
+<desc id="desc">Gérer son accès au portail, sans ouvrir les champs privés. Aucune liste par émetteur. L’administrateur ne peut pas s’accorder la lecture des champs privés.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Autorisation du</tspan><tspan x="24" dy="29.900000000000002">vérificateur</tspan></text>
+<text x="24" y="133.8" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Gérer son accès au portail, sans ouvrir les</tspan><tspan x="24" dy="18.2">champs privés.</tspan></text>
+<rect x="24" y="185.20000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="195.20000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bureau Exemple · Accès autorisé</tspan></text>
+<rect x="24" y="238.20000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="247.20000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organisation</tspan></text>
+<text x="34" y="267.20000000000005" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bureau Exemple · Identité vérifiée</tspan></text>
+<rect x="24" y="307.40000000000003" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="316.40000000000003" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Autorisation globale</tspan></text>
+<text x="34" y="336.40000000000003" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Active · Le rôle vérificateur est autorisé</tspan></text>
+<rect x="24" y="376.6" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="385.6" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Lecture des champs privés</tspan></text>
+<text x="34" y="405.6" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Accord du destinataire pour ce vérificateur</tspan><tspan x="34" dy="18.2">requis</tspan></text>
+<rect x="24" y="464" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="473" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Retirer l’autorisation</tspan></text>
+<text x="34" y="493" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bloque les prochains accès privés</tspan></text>
+<rect x="24" y="539.2" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="552.1" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Suspendre l’autorisation…</tspan></text>
+<rect x="24" y="593.2" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="606.1" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Voir les décisions</tspan></text>
+<text x="24" y="650.2" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Aucune liste par émetteur. L’administrateur ne</tspan><tspan x="24" dy="15.600000000000001">peut pas s’accorder la lecture des champs privés.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a4.en.svg b/docs/ux/admin/a4.en.svg
new file mode 100644
index 0000000..a528712
--- /dev/null
+++ b/docs/ux/admin/a4.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">A4 — Decision history</title>
+<desc id="desc">Who changed access, when, and why? The audit contains no credential claims or private document contents.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Decision history</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Who changed access, when, and why?</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Administrative audit</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 September · Admin A</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop: pending → approved</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 September · Admin B</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Office: approval suspended</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Before / After</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Approval active → Suspended</tspan></text>
+<rect x="24" y="397.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Reason</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Supporting evidence review completed</tspan></text>
+<rect x="24" y="472.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="485.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Back to applications</tspan></text>
+<text x="24" y="529.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">The audit contains no credential claims or</tspan><tspan x="24" dy="15.600000000000001">private document contents.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/admin/a4.fr.svg b/docs/ux/admin/a4.fr.svg
new file mode 100644
index 0000000..01e7579
--- /dev/null
+++ b/docs/ux/admin/a4.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">A4 — Historique des décisions</title>
+<desc id="desc">Qui a modifié les accès, quand et pourquoi ? Le journal ne contient ni contenu d’attestation ni document privé.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Administration</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Historique des décisions</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Qui a modifié les accès, quand et pourquoi</tspan><tspan x="24" dy="18.2">?</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Journal administratif</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 septembre · Admin A</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple : en attente → autorisé</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 septembre · Admin B</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bureau Exemple : autorisation suspendue</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Avant / Après</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Autorisation active → Suspendue</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Motif</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Examen des justificatifs terminé</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Retour aux demandes</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Le journal ne contient ni contenu d’attestation</tspan><tspan x="24" dy="15.600000000000001">ni document privé.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/admin/wireframes.en.excalidraw b/docs/ux/admin/wireframes.en.excalidraw
new file mode 100644
index 0000000..1a4e738
--- /dev/null
+++ b/docs/ux/admin/wireframes.en.excalidraw
@@ -0,0 +1,3258 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "A1-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Applications to review",
+      "originalText": "Applications to review",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Start with the oldest application.",
+      "originalText": "Start with the oldest application.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 137.10000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 147.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "2 applications pending",
+      "originalText": "2 applications pending",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 190.10000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 199.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Filter by role",
+      "originalText": "Filter by role",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 219.10000000000002,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "All · Issuer · Verifier",
+      "originalText": "All · Issuer · Verifier",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 259.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 268.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop · Issuer",
+      "originalText": "Example Workshop · Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 288.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Received 21 September · Complete file",
+      "originalText": "Received 21 September · Complete file",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 328.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 337.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Office · Verifier",
+      "originalText": "Example Office · Verifier",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 357.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Received 22 September · Needs review",
+      "originalText": "Received 22 September · Needs review",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 397.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 406.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Other actions",
+      "originalText": "Other actions",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 426.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Verifier permissions · Audit history",
+      "originalText": "Verifier permissions · Audit history",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 472.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 485.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review Example Workshop",
+      "originalText": "Review Example Workshop",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 529.9,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Approving application access does not endorse an\nissuer’s attestations.",
+      "originalText": "Approving application access does not endorse an\nissuer’s attestations.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-en-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review application",
+      "originalText": "Review application",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Can I identify this organization? Which\naccess should I grant?",
+      "originalText": "Can I identify this organization? Which\naccess should I grant?",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issuer · Awaiting review",
+      "originalText": "Issuer · Awaiting review",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop",
+      "originalText": "Example Workshop",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Training · France · Contact provided",
+      "originalText": "Training · France · Contact provided",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Supporting documents",
+      "originalText": "Supporting documents",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View document ↗ New tab",
+      "originalText": "View document ↗ New tab",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Wallet and timeline",
+      "originalText": "Wallet and timeline",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Address linked · Applied on 21 Sep",
+      "originalText": "Address linked · Applied on 21 Sep",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "If declining",
+      "originalText": "If declining",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Required reason: explain the decision",
+      "originalText": "Required reason: explain the decision",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Approve issuer access",
+      "originalText": "Approve issuer access",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 545.0999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-en-22",
+      "type": "text",
+      "x": 476,
+      "y": 557.9999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Decline with a reason",
+      "originalText": "Decline with a reason",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-23",
+      "type": "text",
+      "x": 464,
+      "y": 602.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The decision is audited. A notification will be\nqueued for sending.",
+      "originalText": "The decision is audited. A notification will be\nqueued for sending.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-en-24",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Verifier approval",
+      "originalText": "Verifier approval",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Manage portal access without unlocking\nprivate fields.",
+      "originalText": "Manage portal access without unlocking\nprivate fields.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Office · Access approved",
+      "originalText": "Example Office · Access approved",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization",
+      "originalText": "Organization",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Office · Verified identity",
+      "originalText": "Example Office · Verified identity",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Global approval",
+      "originalText": "Global approval",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Active · Verifier role approved",
+      "originalText": "Active · Verifier role approved",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Reading private fields",
+      "originalText": "Reading private fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Recipient grant for this verifier required",
+      "originalText": "Recipient grant for this verifier required",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-17",
+      "type": "text",
+      "x": 914,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Withdraw approval",
+      "originalText": "Withdraw approval",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-18",
+      "type": "text",
+      "x": 914,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Blocks future private access",
+      "originalText": "Blocks future private access",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-20",
+      "type": "text",
+      "x": 916,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Suspend approval…",
+      "originalText": "Suspend approval…",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 545.0999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-en-22",
+      "type": "text",
+      "x": 916,
+      "y": 557.9999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View decisions",
+      "originalText": "View decisions",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-23",
+      "type": "text",
+      "x": 904,
+      "y": 602.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "No issuer allowlist. An administrator cannot\ngrant themselves access to private claims.",
+      "originalText": "No issuer allowlist. An administrator cannot\ngrant themselves access to private claims.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-en-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Decision history",
+      "originalText": "Decision history",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Who changed access, when, and why?",
+      "originalText": "Who changed access, when, and why?",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1061.1,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 1071.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Administrative audit",
+      "originalText": "Administrative audit",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1114.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 1123.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 September · Admin A",
+      "originalText": "23 September · Admin A",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 1143.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop: pending → approved",
+      "originalText": "Example Workshop: pending → approved",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1183.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 1192.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 September · Admin B",
+      "originalText": "23 September · Admin B",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 1212.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Office: approval suspended",
+      "originalText": "Example Office: approval suspended",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1252.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 1261.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Before / After",
+      "originalText": "Before / After",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 1281.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Approval active → Suspended",
+      "originalText": "Approval active → Suspended",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1321.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 1330.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Reason",
+      "originalText": "Reason",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 1350.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Supporting evidence review completed",
+      "originalText": "Supporting evidence review completed",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1396.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 1409.8,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Back to applications",
+      "originalText": "Back to applications",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 1453.9,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The audit contains no credential claims or\nprivate document contents.",
+      "originalText": "The audit contains no credential claims or\nprivate document contents.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-en-22",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/admin/wireframes.fr.excalidraw b/docs/ux/admin/wireframes.fr.excalidraw
new file mode 100644
index 0000000..848564b
--- /dev/null
+++ b/docs/ux/admin/wireframes.fr.excalidraw
@@ -0,0 +1,3258 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "A1-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Demandes à examiner",
+      "originalText": "Demandes à examiner",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Commencer par la demande la plus ancienne.",
+      "originalText": "Commencer par la demande la plus ancienne.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 137.10000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 147.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "2 demandes en attente",
+      "originalText": "2 demandes en attente",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 190.10000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 199.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Filtrer par rôle",
+      "originalText": "Filtrer par rôle",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 219.10000000000002,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Tous · Émetteur · Vérificateur",
+      "originalText": "Tous · Émetteur · Vérificateur",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 259.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 268.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple · Émetteur",
+      "originalText": "Atelier Exemple · Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 288.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Reçue le 21 septembre · Dossier complet",
+      "originalText": "Reçue le 21 septembre · Dossier complet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 328.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 337.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bureau Exemple · Vérificateur",
+      "originalText": "Bureau Exemple · Vérificateur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 357.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Reçue le 22 septembre · À examiner",
+      "originalText": "Reçue le 22 septembre · À examiner",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 397.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 406.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autres actions",
+      "originalText": "Autres actions",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 426.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Accès des vérificateurs · Journal",
+      "originalText": "Accès des vérificateurs · Journal",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 472.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A1-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 485.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Examiner Atelier Exemple",
+      "originalText": "Examiner Atelier Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 529.9,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autoriser l’accès à l’application ne valide pas\nles attestations d’un émetteur.",
+      "originalText": "Autoriser l’accès à l’application ne valide pas\nles attestations d’un émetteur.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A1-fr-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Examiner la demande",
+      "originalText": "Examiner la demande",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "L’organisation est-elle identifiable ? Quel\naccès autoriser ?",
+      "originalText": "L’organisation est-elle identifiable ? Quel\naccès autoriser ?",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émetteur · En attente d’examen",
+      "originalText": "Émetteur · En attente d’examen",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple",
+      "originalText": "Atelier Exemple",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Formation · France · Contact fourni",
+      "originalText": "Formation · France · Contact fourni",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Justificatifs",
+      "originalText": "Justificatifs",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir le document ↗ Nouvel onglet",
+      "originalText": "Voir le document ↗ Nouvel onglet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Portefeuille et historique",
+      "originalText": "Portefeuille et historique",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Adresse liée · Demande reçue le 21/09",
+      "originalText": "Adresse liée · Demande reçue le 21/09",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "En cas de refus",
+      "originalText": "En cas de refus",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Motif obligatoire : expliquer la décision",
+      "originalText": "Motif obligatoire : expliquer la décision",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autoriser le rôle émetteur",
+      "originalText": "Autoriser le rôle émetteur",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 545.0999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A2-fr-22",
+      "type": "text",
+      "x": 476,
+      "y": 557.9999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Refuser avec un motif",
+      "originalText": "Refuser avec un motif",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-23",
+      "type": "text",
+      "x": 464,
+      "y": 602.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "La décision sera journalisée. Une notification\nsera mise en attente d’envoi.",
+      "originalText": "La décision sera journalisée. Une notification\nsera mise en attente d’envoi.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A2-fr-24",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 59.800000000000004,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autorisation du\nvérificateur",
+      "originalText": "Autorisation du\nvérificateur",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 133.8,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Gérer son accès au portail, sans ouvrir les\nchamps privés.",
+      "originalText": "Gérer son accès au portail, sans ouvrir les\nchamps privés.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 185.20000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 195.20000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bureau Exemple · Accès autorisé",
+      "originalText": "Bureau Exemple · Accès autorisé",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 238.20000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 247.20000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organisation",
+      "originalText": "Organisation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 267.20000000000005,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bureau Exemple · Identité vérifiée",
+      "originalText": "Bureau Exemple · Identité vérifiée",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 307.40000000000003,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 316.40000000000003,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autorisation globale",
+      "originalText": "Autorisation globale",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 336.40000000000003,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Active · Le rôle vérificateur est autorisé",
+      "originalText": "Active · Le rôle vérificateur est autorisé",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 376.6,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 385.6,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Lecture des champs privés",
+      "originalText": "Lecture des champs privés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 405.6,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Accord du destinataire pour ce vérificateur\nrequis",
+      "originalText": "Accord du destinataire pour ce vérificateur\nrequis",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 464,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-17",
+      "type": "text",
+      "x": 914,
+      "y": 473,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retirer l’autorisation",
+      "originalText": "Retirer l’autorisation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-18",
+      "type": "text",
+      "x": 914,
+      "y": 493,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bloque les prochains accès privés",
+      "originalText": "Bloque les prochains accès privés",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 539.2,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-20",
+      "type": "text",
+      "x": 916,
+      "y": 552.1,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Suspendre l’autorisation…",
+      "originalText": "Suspendre l’autorisation…",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 593.2,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A3-fr-22",
+      "type": "text",
+      "x": 916,
+      "y": 606.1,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir les décisions",
+      "originalText": "Voir les décisions",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-23",
+      "type": "text",
+      "x": 904,
+      "y": 650.2,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aucune liste par émetteur. L’administrateur ne\npeut pas s’accorder la lecture des champs privés.",
+      "originalText": "Aucune liste par émetteur. L’administrateur ne\npeut pas s’accorder la lecture des champs privés.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A3-fr-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Administration",
+      "originalText": "XCS / Administration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Historique des décisions",
+      "originalText": "Historique des décisions",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Qui a modifié les accès, quand et pourquoi\n?",
+      "originalText": "Qui a modifié les accès, quand et pourquoi\n?",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Journal administratif",
+      "originalText": "Journal administratif",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 septembre · Admin A",
+      "originalText": "23 septembre · Admin A",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple : en attente → autorisé",
+      "originalText": "Atelier Exemple : en attente → autorisé",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 septembre · Admin B",
+      "originalText": "23 septembre · Admin B",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bureau Exemple : autorisation suspendue",
+      "originalText": "Bureau Exemple : autorisation suspendue",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Avant / Après",
+      "originalText": "Avant / Après",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autorisation active → Suspendue",
+      "originalText": "Autorisation active → Suspendue",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Motif",
+      "originalText": "Motif",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Examen des justificatifs terminé",
+      "originalText": "Examen des justificatifs terminé",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "A4-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retour aux demandes",
+      "originalText": "Retour aux demandes",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 1472.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Le journal ne contient ni contenu d’attestation\nni document privé.",
+      "originalText": "Le journal ne contient ni contenu d’attestation\nni document privé.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "A4-fr-22",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/handoffs.md b/docs/ux/handoffs.md
new file mode 100644
index 0000000..338124a
--- /dev/null
+++ b/docs/ux/handoffs.md
@@ -0,0 +1,28 @@
+# Links and screen lists for implementation issues
+
+Ready-to-use handoff text; not posted to GitHub. Link to the committed design on the eventual #29
+branch/PR when publishing; a working-directory path is not a reviewable GitHub URL. The user deferred
+participant sessions on 2026-09-23 and authorized moving on. Keep that unperformed criterion visible
+in #29; do not present the empty [session register](./usability.md) as validated research.
+
+| Issue                                                | Design to link                                                                           | Screens implemented                                                          | Shared dependencies                                           |
+| ---------------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| [#30](https://github.com/XRPL-Commons/XCS/issues/30) | [Admin journey](./admin/README.md), `docs/ux/admin/wireframes.en.excalidraw`             | A1 queue; A2 application review; A3 verifier permissions; A4 audit           | #25/#26/#27, #28 boundary, accepted admin UX                  |
+| [#31](https://github.com/XRPL-Commons/XCS/issues/31) | [Issuer journey](./issuer/README.md), `docs/ux/issuer/wireframes.en.excalidraw`          | I1 apply; I2 status; I3 schema; I4 invite; I5 issue; I6 credential lifecycle | #25/#26/#27/#30, private hosting decision, accepted issuer UX |
+| [#32](https://github.com/XRPL-Commons/XCS/issues/32) | [Recipient journey](./recipient/README.md), `docs/ux/recipient/wireframes.en.excalidraw` | R1 claim; R2 wallet; R3 inbox; R4 consent/review/accept; R5 presentations    | #25/#26/#27/#31, accepted recipient UX                        |
+| [#33](https://github.com/XRPL-Commons/XCS/issues/33) | [Verifier journey](./verifier/README.md), `docs/ux/verifier/wireframes.en.excalidraw`    | V1 application/status; V2 public result; V3 authorized result; V4 history    | #25/#26/#27/#30/#32, accepted verifier UX                     |
+
+All four issues must link the [shared patterns](./shared/README.md), the matching bilingual screen
+exports and the actual usability evidence. F1–F3 are reusable states, not independent new journeys.
+API and server authorization tests belong in their implementation issues; static wireframes do
+not demonstrate those controls.
+
+## Maintainer checklist
+
+- [ ] Confirm that implementation follows accepted ADR 0004: designated verifier, current global
+      approval, recipient grant, no automatic sharing expiry, no issuer allowlist or admin override.
+- [ ] Run and record two sessions per role; revise and retest material problems.
+- [ ] Publish the reviewed design and put stable design links plus the screen lists above into #30–33.
+- [ ] Confirm that implementation scope preserves the protocol, independent verification dimensions,
+      wallet custody, exact public lookup, and authorized private fields.
+- [ ] Record the user's decision to proceed without participant sessions; do not mark research passed.
diff --git a/docs/ux/index.html b/docs/ux/index.html
new file mode 100644
index 0000000..a2a4f80
--- /dev/null
+++ b/docs/ux/index.html
@@ -0,0 +1,659 @@
+<!doctype html>
+<html lang="fr">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>XCS — parcours et maquettes / journeys and wireframes</title>
+    <style>
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        margin: 0;
+        background: #f4f4f4;
+        color: #242424;
+        font:
+          16px/1.5 system-ui,
+          sans-serif;
+      }
+      header,
+      main {
+        max-width: 1360px;
+        margin: auto;
+        padding: 24px;
+      }
+      h1 {
+        font-size: clamp(1.6rem, 4vw, 2.5rem);
+        line-height: 1.15;
+      }
+      a {
+        color: #222;
+        text-underline-offset: 3px;
+      }
+      a:focus-visible,
+      input:focus-visible {
+        outline: 3px solid #333;
+        outline-offset: 4px;
+      }
+      nav {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 8px 24px;
+        margin: 16px 0;
+      }
+      nav a,
+      .downloads a {
+        display: inline-block;
+        padding: 10px 0;
+        min-height: 44px;
+      }
+      .notice {
+        border-left: 4px solid #555;
+        padding: 12px 16px;
+        background: #fff;
+        max-width: 850px;
+      }
+      .language {
+        display: inline-block;
+        padding: 12px 8px 12px 0;
+        cursor: pointer;
+      }
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(auto-fit, minmax(min(100%, 340px), 1fr));
+        gap: 24px;
+        align-items: start;
+      }
+      figure {
+        margin: 0;
+        min-width: 0;
+      }
+      figcaption {
+        margin: 10px 0;
+        font-size: 14px;
+      }
+      img {
+        display: block;
+        width: 100%;
+        max-width: 390px;
+        height: auto;
+        margin: 0 auto;
+      }
+      section {
+        scroll-margin-top: 12px;
+        margin: 36px 0 56px;
+      }
+      .en {
+        display: none;
+      }
+      body:has(#locale-en:checked) .fr {
+        display: none;
+      }
+      body:has(#locale-en:checked) .en {
+        display: revert;
+      }
+      @media print {
+        nav,
+        .language,
+        input {
+          display: none;
+        }
+        figure {
+          break-inside: avoid;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <p>ISSUE #29 / XCS</p>
+      <h1>Parcours et maquettes<br /><span lang="en">Journeys and wireframes</span></h1>
+      <p class="notice fr">
+        Proposition à tester avec deux personnes par rôle. Aucune session réalisée. Données fictives
+        ; les boutons dessinés ne réalisent aucune action.
+      </p>
+      <p class="notice en" lang="en">
+        Draft for testing with two people per role. No sessions conducted. Fictional data; controls
+        drawn in the screens perform no action.
+      </p>
+      <input type="radio" id="locale-fr" name="locale" checked /><label
+        class="language"
+        for="locale-fr"
+        >Français</label
+      >
+      <input type="radio" id="locale-en" name="locale" /><label
+        class="language"
+        for="locale-en"
+        lang="en"
+        >English</label
+      >
+      <nav aria-label="Rôles / Roles">
+        <a href="#admin"
+          ><span class="fr">Administration</span><span class="en" lang="en">Administration</span></a
+        ><a href="#issuer"
+          ><span class="fr">Émetteur</span><span class="en" lang="en">Issuer</span></a
+        ><a href="#recipient"
+          ><span class="fr">Destinataire</span><span class="en" lang="en">Recipient</span></a
+        ><a href="#verifier"
+          ><span class="fr">Vérificateur</span><span class="en" lang="en">Verifier</span></a
+        ><a href="#shared"
+          ><span class="fr">États partagés</span><span class="en" lang="en">Shared states</span></a
+        >
+      </nav>
+      <p>
+        <a href="README.md">Contexte et décisions / Context and decisions</a> ·
+        <a href="usability.md">Protocole et sessions / Protocol and sessions</a>
+      </p>
+    </header>
+    <main>
+      <section id="admin">
+        <h2>
+          <span class="fr">Administration</span><span class="en" lang="en">Administration</span>
+        </h2>
+        <p class="downloads">
+          <a href="admin/README.md">Parcours / Journey</a> ·
+          <a href="admin/wireframes.fr.excalidraw" download>Excalidraw FR</a> ·
+          <a href="admin/wireframes.en.excalidraw" download>Excalidraw EN</a>
+        </p>
+        <div class="grid">
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="admin/a1.fr.svg">A1 — Demandes à examiner</a></figcaption>
+              <img
+                src="admin/a1.fr.svg"
+                width="390"
+                height="844"
+                alt="Demandes à examiner. Commencer par la demande la plus ancienne."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="admin/a1.en.svg">A1 — Applications to review</a></figcaption>
+              <img
+                src="admin/a1.en.svg"
+                width="390"
+                height="844"
+                alt="Applications to review. Start with the oldest application."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="admin/a2.fr.svg">A2 — Examiner la demande</a></figcaption>
+              <img
+                src="admin/a2.fr.svg"
+                width="390"
+                height="844"
+                alt="Examiner la demande. L’organisation est-elle identifiable ? Quel accès autoriser ?"
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="admin/a2.en.svg">A2 — Review application</a></figcaption>
+              <img
+                src="admin/a2.en.svg"
+                width="390"
+                height="844"
+                alt="Review application. Can I identify this organization? Which access should I grant?"
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption>
+                <a href="admin/a3.fr.svg">A3 — Autorisation du vérificateur</a>
+              </figcaption>
+              <img
+                src="admin/a3.fr.svg"
+                width="390"
+                height="844"
+                alt="Autorisation du vérificateur. Gérer son accès au portail, sans ouvrir les champs privés."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="admin/a3.en.svg">A3 — Verifier approval</a></figcaption>
+              <img
+                src="admin/a3.en.svg"
+                width="390"
+                height="844"
+                alt="Verifier approval. Manage portal access without unlocking private fields."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="admin/a4.fr.svg">A4 — Historique des décisions</a></figcaption>
+              <img
+                src="admin/a4.fr.svg"
+                width="390"
+                height="844"
+                alt="Historique des décisions. Qui a modifié les accès, quand et pourquoi ?"
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="admin/a4.en.svg">A4 — Decision history</a></figcaption>
+              <img
+                src="admin/a4.en.svg"
+                width="390"
+                height="844"
+                alt="Decision history. Who changed access, when, and why?"
+              />
+            </div>
+          </figure>
+        </div>
+      </section>
+      <section id="issuer">
+        <h2><span class="fr">Émetteur</span><span class="en" lang="en">Issuer</span></h2>
+        <p class="downloads">
+          <a href="issuer/README.md">Parcours / Journey</a> ·
+          <a href="issuer/wireframes.fr.excalidraw" download>Excalidraw FR</a> ·
+          <a href="issuer/wireframes.en.excalidraw" download>Excalidraw EN</a>
+        </p>
+        <div class="grid">
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i1.fr.svg">I1 — Devenir émetteur</a></figcaption>
+              <img
+                src="issuer/i1.fr.svg"
+                width="390"
+                height="844"
+                alt="Devenir émetteur. Présenter votre organisation pour demander l’accès."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i1.en.svg">I1 — Apply as an issuer</a></figcaption>
+              <img
+                src="issuer/i1.en.svg"
+                width="390"
+                height="844"
+                alt="Apply as an issuer. Tell us about your organization to request access."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i2.fr.svg">I2 — Votre demande</a></figcaption>
+              <img
+                src="issuer/i2.fr.svg"
+                width="390"
+                height="844"
+                alt="Votre demande. Vous serez informé après son examen."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i2.en.svg">I2 — Your application</a></figcaption>
+              <img
+                src="issuer/i2.en.svg"
+                width="390"
+                height="844"
+                alt="Your application. You will be notified after the review."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i3.fr.svg">I3 — Créer un modèle</a></figcaption>
+              <img
+                src="issuer/i3.fr.svg"
+                width="390"
+                height="844"
+                alt="Créer un modèle. Définir les informations de votre attestation."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i3.en.svg">I3 — Create a template</a></figcaption>
+              <img
+                src="issuer/i3.en.svg"
+                width="390"
+                height="844"
+                alt="Create a template. Choose what your attestation will contain."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i4.fr.svg">I4 — Inviter un destinataire</a></figcaption>
+              <img
+                src="issuer/i4.fr.svg"
+                width="390"
+                height="844"
+                alt="Inviter un destinataire. Il choisira son compte et liera son portefeuille."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i4.en.svg">I4 — Invite a learner</a></figcaption>
+              <img
+                src="issuer/i4.en.svg"
+                width="390"
+                height="844"
+                alt="Invite a learner. They will choose their account and link a wallet."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i5.fr.svg">I5 — Vérifier et émettre</a></figcaption>
+              <img
+                src="issuer/i5.fr.svg"
+                width="390"
+                height="844"
+                alt="Vérifier et émettre. Confirmer le contenu, le destinataire et la visibilité."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i5.en.svg">I5 — Review and issue</a></figcaption>
+              <img
+                src="issuer/i5.en.svg"
+                width="390"
+                height="844"
+                alt="Review and issue. Confirm the content, recipient and visibility."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="issuer/i6.fr.svg">I6 — Suivre l’attestation</a></figcaption>
+              <img
+                src="issuer/i6.fr.svg"
+                width="390"
+                height="844"
+                alt="Suivre l’attestation. Suivre l’émission, le contenu et l’acceptation."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="issuer/i6.en.svg">I6 — Track attestation</a></figcaption>
+              <img
+                src="issuer/i6.en.svg"
+                width="390"
+                height="844"
+                alt="Track attestation. Track issuance, content and acceptance separately."
+              />
+            </div>
+          </figure>
+        </div>
+      </section>
+      <section id="recipient">
+        <h2><span class="fr">Destinataire</span><span class="en" lang="en">Recipient</span></h2>
+        <p class="downloads">
+          <a href="recipient/README.md">Parcours / Journey</a> ·
+          <a href="recipient/wireframes.fr.excalidraw" download>Excalidraw FR</a> ·
+          <a href="recipient/wireframes.en.excalidraw" download>Excalidraw EN</a>
+        </p>
+        <div class="grid">
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption>
+                <a href="recipient/r1.fr.svg">R1 — Une attestation pour vous</a>
+              </figcaption>
+              <img
+                src="recipient/r1.fr.svg"
+                width="390"
+                height="844"
+                alt="Une attestation pour vous. Atelier Exemple vous invite à recevoir une attestation."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="recipient/r1.en.svg">R1 — An attestation for you</a></figcaption>
+              <img
+                src="recipient/r1.en.svg"
+                width="390"
+                height="844"
+                alt="An attestation for you. Example Workshop invites you to receive an attestation."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="recipient/r2.fr.svg">R2 — Lier mon portefeuille</a></figcaption>
+              <img
+                src="recipient/r2.fr.svg"
+                width="390"
+                height="844"
+                alt="Lier mon portefeuille. Prouver que l’adresse de réception vous appartient."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="recipient/r2.en.svg">R2 — Link my wallet</a></figcaption>
+              <img
+                src="recipient/r2.en.svg"
+                width="390"
+                height="844"
+                alt="Link my wallet. Prove that you control the receiving address."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="recipient/r3.fr.svg">R3 — Mes attestations</a></figcaption>
+              <img
+                src="recipient/r3.fr.svg"
+                width="390"
+                height="844"
+                alt="Mes attestations. Retrouver ce qui est prêt et ce qui attend encore."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="recipient/r3.en.svg">R3 — My attestations</a></figcaption>
+              <img
+                src="recipient/r3.en.svg"
+                width="390"
+                height="844"
+                alt="My attestations. See what is ready and what is still pending."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption>
+                <a href="recipient/r4.fr.svg">R4 — Examiner avant d’accepter</a>
+              </figcaption>
+              <img
+                src="recipient/r4.fr.svg"
+                width="390"
+                height="844"
+                alt="Examiner avant d’accepter. Lire le contenu seulement après votre accord."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption>
+                <a href="recipient/r4.en.svg">R4 — Review before accepting</a>
+              </figcaption>
+              <img
+                src="recipient/r4.en.svg"
+                width="390"
+                height="844"
+                alt="Review before accepting. Read the content only with your consent."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption>
+                <a href="recipient/r5.fr.svg">R5 — Présenter mon attestation</a>
+              </figcaption>
+              <img
+                src="recipient/r5.fr.svg"
+                width="390"
+                height="844"
+                alt="Présenter mon attestation. Choisir qui peut lire les champs, puis gérer le partage."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="recipient/r5.en.svg">R5 — Present my attestation</a></figcaption>
+              <img
+                src="recipient/r5.en.svg"
+                width="390"
+                height="844"
+                alt="Present my attestation. Choose who can read the fields, then manage sharing."
+              />
+            </div>
+          </figure>
+        </div>
+      </section>
+      <section id="verifier">
+        <h2><span class="fr">Vérificateur</span><span class="en" lang="en">Verifier</span></h2>
+        <p class="downloads">
+          <a href="verifier/README.md">Parcours / Journey</a> ·
+          <a href="verifier/wireframes.fr.excalidraw" download>Excalidraw FR</a> ·
+          <a href="verifier/wireframes.en.excalidraw" download>Excalidraw EN</a>
+        </p>
+        <div class="grid">
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption>
+                <a href="verifier/v1.fr.svg">V1 — Demander l’accès complet</a>
+              </figcaption>
+              <img
+                src="verifier/v1.fr.svg"
+                width="390"
+                height="844"
+                alt="Demander l’accès complet. Présenter votre organisation et votre besoin."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption>
+                <a href="verifier/v1.en.svg">V1 — Request full-detail access</a>
+              </figcaption>
+              <img
+                src="verifier/v1.en.svg"
+                width="390"
+                height="844"
+                alt="Request full-detail access. Explain your organization and your need."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="verifier/v2.fr.svg">V2 — Vérification partielle</a></figcaption>
+              <img
+                src="verifier/v2.fr.svg"
+                width="390"
+                height="844"
+                alt="Vérification partielle. L’attestation est active. Le contenu complet n’a pas été contrôlé."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="verifier/v2.en.svg">V2 — Partially checked</a></figcaption>
+              <img
+                src="verifier/v2.en.svg"
+                width="390"
+                height="844"
+                alt="Partially checked. The attestation is active. Full content has not been checked."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="verifier/v3.fr.svg">V3 — Émetteur non reconnu</a></figcaption>
+              <img
+                src="verifier/v3.fr.svg"
+                width="390"
+                height="844"
+                alt="Émetteur non reconnu. Les contrôles techniques ont réussi. Évaluez l’émetteur séparément."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="verifier/v3.en.svg">V3 — Issuer not recognized</a></figcaption>
+              <img
+                src="verifier/v3.en.svg"
+                width="390"
+                height="844"
+                alt="Issuer not recognized. Technical checks passed. Assess the issuer separately."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="verifier/v4.fr.svg">V4 — Mes vérifications</a></figcaption>
+              <img
+                src="verifier/v4.fr.svg"
+                width="390"
+                height="844"
+                alt="Mes vérifications. Retrouver les résultats sans conserver les contenus."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="verifier/v4.en.svg">V4 — My verification history</a></figcaption>
+              <img
+                src="verifier/v4.en.svg"
+                width="390"
+                height="844"
+                alt="My verification history. Find past results without retaining credential contents."
+              />
+            </div>
+          </figure>
+        </div>
+      </section>
+      <section id="shared">
+        <h2>
+          <span class="fr">États partagés</span><span class="en" lang="en">Shared states</span>
+        </h2>
+        <p class="downloads">
+          <a href="shared/README.md">Parcours / Journey</a> ·
+          <a href="shared/wireframes.fr.excalidraw" download>Excalidraw FR</a> ·
+          <a href="shared/wireframes.en.excalidraw" download>Excalidraw EN</a>
+        </p>
+        <div class="grid">
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="shared/f1.fr.svg">F1 — Portefeuille indisponible</a></figcaption>
+              <img
+                src="shared/f1.fr.svg"
+                width="390"
+                height="844"
+                alt="Portefeuille indisponible. Votre progression est conservée. Préparons le portefeuille."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="shared/f1.en.svg">F1 — Wallet unavailable</a></figcaption>
+              <img
+                src="shared/f1.en.svg"
+                width="390"
+                height="844"
+                alt="Wallet unavailable. Your progress is preserved. Let us get the wallet ready."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="shared/f2.fr.svg">F2 — Invitation inutilisable</a></figcaption>
+              <img
+                src="shared/f2.fr.svg"
+                width="390"
+                height="844"
+                alt="Invitation inutilisable. Ce lien a expiré ou ne peut plus être utilisé."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="shared/f2.en.svg">F2 — Invitation unavailable</a></figcaption>
+              <img
+                src="shared/f2.en.svg"
+                width="390"
+                height="844"
+                alt="Invitation unavailable. This link has expired or can no longer be used."
+              />
+            </div>
+          </figure>
+          <figure>
+            <div class="fr" lang="fr">
+              <figcaption><a href="shared/f3.fr.svg">F3 — Vérification indisponible</a></figcaption>
+              <img
+                src="shared/f3.fr.svg"
+                width="390"
+                height="844"
+                alt="Vérification indisponible. L’état actuel de l’attestation ne peut pas être confirmé."
+              />
+            </div>
+            <div class="en" lang="en">
+              <figcaption><a href="shared/f3.en.svg">F3 — Cannot verify now</a></figcaption>
+              <img
+                src="shared/f3.en.svg"
+                width="390"
+                height="844"
+                alt="Cannot verify now. The current attestation state cannot be confirmed."
+              />
+            </div>
+          </figure>
+        </div>
+      </section>
+    </main>
+  </body>
+</html>
diff --git a/docs/ux/issuer/README.md b/docs/ux/issuer/README.md
new file mode 100644
index 0000000..14c12d7
--- /dev/null
+++ b/docs/ux/issuer/README.md
@@ -0,0 +1,90 @@
+# Issuer — from application to a recipient's credential
+
+Draft for [#31](https://github.com/XRPL-Commons/XCS/issues/31).
+
+User goal: “I want to give a learner an attestation without learning ledger identifiers or handling
+their wallet.” Example: fictional Atelier Exemple, course completion, learner Camille Exemple.
+
+[French board](./wireframes.fr.excalidraw) · [English board](./wireframes.en.excalidraw) ·
+[Gallery](../index.html#issuer)
+
+## Journey and screens
+
+```mermaid
+flowchart LR
+  I1[Apply] --> I2[Await review]
+  I2 -->|Approved| I3[Publish template-based schema]
+  I3 --> I4[Invite learner]
+  I4 -->|Learner links wallet| I5[Review and issue]
+  I5 -->|Ledger validated| I6[Track credential]
+  I6 -->|Confirm revocation and sign| I6
+```
+
+| Screen / suggested route                    | User question                                 | Action and state                                                                            |
+| ------------------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| [I1](./i1.fr.svg) `/issuer/apply`           | What must I provide?                          | Organization, website, contact, jurisdiction, purpose and document upload; apply            |
+| [I2](./i2.fr.svg) `/issuer/application`     | Can I issue yet?                              | Pending/declined/approved status; reason and next step; no issuance while pending           |
+| [I3](./i3.fr.svg) `/issuer/schemas/new`     | What will this attestation contain?           | Course/diploma template, plain-language field types; preview and publish using wallet       |
+| [I4](./i4.fr.svg) `/issuer/recipients`      | Who should receive it and are they ready?     | Email, own schema, optional message; invite list, resend/revoke and readiness               |
+| [I5](./i5.fr.svg) `/issuer/issue/:inviteId` | Exactly what am I signing and who can see it? | Derived subject/schema; fill claims; select public/private subset; review fee and sign      |
+| [I6](./i6.fr.svg) `/issuer/credentials/:id` | Has it been accepted, and can I revoke it?    | Validated issuance, subject acceptance and publication separately; revoke with confirmation |
+
+The `/issuer` workspace opens the schemas/recipients/credentials tabs represented by I3–I6; settings
+links to the existing application profile and linked-wallet settings once #27 exists. Schema
+publication and issuance reuse the current engine rather than duplicating it.
+
+I3's template uses course title (text), completion date (date) and learner name (text); it explains
+which fields are required. The diploma alternative uses qualification, award date and institution.
+Advanced schema JSON is optional, not a first screen. On publish, keep the chosen schema and derived
+UID together. I4 only offers the issuer's schemas and enables issuance after verified wallet linking.
+
+Invitation delivery email is not proof of the claimant's identity. Under ADR 0004's link-possession
+policy, an authenticated holder may claim a forwarded invitation. I5 must show the actual claimant
+and proven wallet for issuer review before signature, distinct from the delivery email.
+
+I5 defaults to a proposed private setting with no public claim fields selected; the issuer must
+review it. A two-column preview (“Anyone with the link” / “Authorized people”) shows each subset
+before signing. The private option stays blocked until authorized private hosting exists. Public
+selection clearly states that publication cannot be made private later. Schema, recipient, claim
+values, visibility and fee remain visible in the final summary; raw transaction JSON is secondary.
+
+I6 treats “issued on ledger, payload publication pending” as incomplete, not “ready to accept”.
+Retry publication for the original operation; do not issue again. Revocation requires a confirmation
+that identifies the learner and schema, then wallet approval and validated evidence. Cancellation
+returns to the same detail screen; failed or unknown results reconcile the original operation.
+
+## Current asks → proposed simplification
+
+| Today in `/schemas/register` or `/issue`              | Proposed role flow                                                          |
+| ----------------------------------------------------- | --------------------------------------------------------------------------- |
+| Registry/network profile and canonical schema details | Configured Testnet profile; expand technical details only                   |
+| Schema UID                                            | Select an owned schema by name; derive UID                                  |
+| Subject address                                       | Claimed invite's verified wallet; never ask issuer to paste it              |
+| Claims JSON                                           | Labelled template fields with local validation; advanced view optional      |
+| Payload URL / hosting and digest                      | Managed private hosting when available; human-readable visibility preview   |
+| Expiration timestamp                                  | Template suggestion, editable before signing; show exact date and timezone  |
+| Transaction blob/hash and confirmation                | Human-readable approval, then pending/validated state and optional evidence |
+
+## Failure and empty states
+
+- No schemas: offer I3; no recipients: offer I4; claimed but no linked wallet: “Waiting for learner”
+  / “En attente du destinataire”. No synthetic recipient address fallback.
+- Missing wallet (F1): retain non-sensitive schema draft; install/unlock/select compatible wallet.
+- Expired invitation (F2): show expired in I4, explicitly revoke/replace; never issue to a stale link.
+- Indexer unavailable (F3): browsing app-owned drafts can continue; publish/issue/revoke are disabled
+  until fresh checks. Pending transactions use recovery, not another wallet prompt.
+- Wallet rejection/network/account change: preserve the human-readable draft and recheck identity
+  before another signature. No success toast.
+- Declined application: show reason and contact/reapplication policy once decided; do not promise
+  an automatic appeal endpoint. Uploaded documents are not public credential claims.
+
+## Review and acceptance tasks
+
+Two issuer participants apply, choose the course template, invite a learner, explain both visibility
+previews, then issue after the supplied “wallet linked” fixture. Probe an expired invite, wallet
+absence and publication pending. Success means no UID/address entry, accurate explanation of who
+sees the learner's name, and no duplicate issuance during recovery.
+
+#31 implements I1–I6 with shared F1–F3, private-storage authorization, own-schema filtering and ledger
+evidence. Keep the accountless Studio until ADR 0004 explicitly retires it. Participant observations
+and maintainer acceptance are still pending in [the session log](../usability.md).
diff --git a/docs/ux/issuer/i1.en.svg b/docs/ux/issuer/i1.en.svg
new file mode 100644
index 0000000..689c586
--- /dev/null
+++ b/docs/ux/issuer/i1.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I1 — Apply as an issuer</title>
+<desc id="desc">Tell us about your organization to request access. These documents support the application review. They will not be published on the ledger.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Apply as an issuer</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Tell us about your organization to request</tspan><tspan x="24" dy="18.2">access.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Signed in · Access required</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization and website</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop · Organization website</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact and jurisdiction</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Work contact · France</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Intended use</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Issue course completion attestations</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization evidence</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choose a file · Restricted access</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Submit application</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">These documents support the application review.</tspan><tspan x="24" dy="15.600000000000001">They will not be published on the ledger.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i1.fr.svg b/docs/ux/issuer/i1.fr.svg
new file mode 100644
index 0000000..72885ef
--- /dev/null
+++ b/docs/ux/issuer/i1.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I1 — Devenir émetteur</title>
+<desc id="desc">Présenter votre organisation pour demander l’accès. Ces justificatifs servent à l’examen de la demande. Ils ne seront pas publiés sur le ledger.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Devenir émetteur</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Présenter votre organisation pour demander</tspan><tspan x="24" dy="18.2">l’accès.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Compte connecté · Accès à demander</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organisation et site web</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple · Site de l’organisation</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact et pays</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact professionnel · France</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Usage prévu</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attester la fin d’une formation</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Justificatif de l’organisation</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choisir un fichier · Accès restreint</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Envoyer ma demande</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Ces justificatifs servent à l’examen de la</tspan><tspan x="24" dy="15.600000000000001">demande. Ils ne seront pas publiés sur le ledger.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i2.en.svg b/docs/ux/issuer/i2.en.svg
new file mode 100644
index 0000000..685a9db
--- /dev/null
+++ b/docs/ux/issuer/i2.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I2 — Your application</title>
+<desc id="desc">You will be notified after the review. Issuing from this workspace becomes available after approval.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Your application</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">You will be notified after the review.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Awaiting review</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Application submitted</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 September · Issuer role</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Next step</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Once approved: create your template</tspan></text>
+<rect x="24" y="397.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">If the application is declined</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">The reason and next step appear here</tspan></text>
+<rect x="24" y="472.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="485.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Browse public schemas</tspan></text>
+<text x="24" y="529.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Issuing from this workspace becomes available</tspan><tspan x="24" dy="15.600000000000001">after approval.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i2.fr.svg b/docs/ux/issuer/i2.fr.svg
new file mode 100644
index 0000000..3a53ee7
--- /dev/null
+++ b/docs/ux/issuer/i2.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I2 — Votre demande</title>
+<desc id="desc">Vous serez informé après son examen. L’émission depuis cet espace sera disponible après autorisation.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Votre demande</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vous serez informé après son examen.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">En attente d’examen</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organisation</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Demande envoyée</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 septembre · Rôle émetteur</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Étape suivante</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Après autorisation : créer votre modèle</tspan></text>
+<rect x="24" y="397.7" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Si la demande est refusée</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Le motif et la prochaine étape s’affichent</tspan><tspan x="34" dy="18.2">ici</tspan></text>
+<rect x="24" y="491.1" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="504" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Consulter les schémas publics</tspan></text>
+<text x="24" y="548.1" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">L’émission depuis cet espace sera disponible</tspan><tspan x="24" dy="15.600000000000001">après autorisation.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i3.en.svg b/docs/ux/issuer/i3.en.svg
new file mode 100644
index 0000000..815f14c
--- /dev/null
+++ b/docs/ux/issuer/i3.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I3 — Create a template</title>
+<desc id="desc">Choose what your attestation will contain. The schema becomes public. No actual learner data is entered at this step.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Create a template</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Choose what your attestation will contain.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Step 1 · Public schema</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Start from a template</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Course completion ✓ · Diploma</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Template fields</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Name: text · Course: text · Date: date</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Preview</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Learner name · Course · Completion date</tspan></text>
+<rect x="24" y="397.7" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Before signing</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Account: Example Workshop · Testnet · Show</tspan><tspan x="34" dy="18.2">fee</tspan></text>
+<rect x="24" y="491.1" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="504" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Review and publish</tspan></text>
+<rect x="24" y="545.1" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="558" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Technical details</tspan></text>
+<text x="24" y="602.1" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">The schema becomes public. No actual learner data</tspan><tspan x="24" dy="15.600000000000001">is entered at this step.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i3.fr.svg b/docs/ux/issuer/i3.fr.svg
new file mode 100644
index 0000000..627a709
--- /dev/null
+++ b/docs/ux/issuer/i3.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I3 — Créer un modèle</title>
+<desc id="desc">Définir les informations de votre attestation. Le schéma devient public. Aucune donnée réelle de destinataire n’est saisie à cette étape.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Créer un modèle</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Définir les informations de votre</tspan><tspan x="24" dy="18.2">attestation.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Étape 1 · Schéma public</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Partir d’un modèle</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Fin de formation ✓ · Diplôme</tspan></text>
+<rect x="24" y="277.5" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Champs du modèle</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Nom : texte · Formation : texte · Date :</tspan><tspan x="34" dy="18.2">date</tspan></text>
+<rect x="24" y="364.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Aperçu</tspan></text>
+<text x="34" y="393.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Nom du destinataire · Formation · Date de</tspan><tspan x="34" dy="18.2">fin</tspan></text>
+<rect x="24" y="452.29999999999995" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="461.29999999999995" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Avant signature</tspan></text>
+<text x="34" y="481.29999999999995" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Compte : Atelier Exemple · Testnet · Frais</tspan><tspan x="34" dy="18.2">à afficher</tspan></text>
+<rect x="24" y="545.6999999999999" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="558.5999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Vérifier puis publier</tspan></text>
+<rect x="24" y="599.6999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="612.5999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Détails techniques</tspan></text>
+<text x="24" y="656.6999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Le schéma devient public. Aucune donnée réelle de</tspan><tspan x="24" dy="15.600000000000001">destinataire n’est saisie à cette étape.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i4.en.svg b/docs/ux/issuer/i4.en.svg
new file mode 100644
index 0000000..295d61b
--- /dev/null
+++ b/docs/ux/issuer/i4.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I4 — Invite a learner</title>
+<desc id="desc">They will choose their account and link a wallet. Resend or revoke from the list. Issue only after the wallet is linked.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Invite a learner</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">They will choose their account and link a</tspan><tspan x="24" dy="18.2">wallet.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Step 2 · Invitation</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Learner email</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">camille@example.invalid</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Your schema</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Course completion · Example Workshop</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Optional message</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Your attestation will be available soon.</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Invitation tracking</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Sent → Claimed → Wallet linked</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Send invitation</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">View invitations</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Resend or revoke from the list. Issue only after</tspan><tspan x="24" dy="15.600000000000001">the wallet is linked.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i4.fr.svg b/docs/ux/issuer/i4.fr.svg
new file mode 100644
index 0000000..3f34170
--- /dev/null
+++ b/docs/ux/issuer/i4.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I4 — Inviter un destinataire</title>
+<desc id="desc">Il choisira son compte et liera son portefeuille. Renvoyer ou révoquer depuis la liste. Émettre seulement après la liaison du portefeuille.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Inviter un destinataire</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Il choisira son compte et liera son</tspan><tspan x="24" dy="18.2">portefeuille.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Étape 2 · Invitation</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">E-mail du destinataire</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">camille@example.invalid</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Votre schéma</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Fin de formation · Atelier Exemple</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Message facultatif</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Votre attestation sera bientôt disponible.</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Suivi des invitations</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Envoyée → Récupérée → Portefeuille lié</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Envoyer l’invitation</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Voir les invitations</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Renvoyer ou révoquer depuis la liste. Émettre</tspan><tspan x="24" dy="15.600000000000001">seulement après la liaison du portefeuille.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i5.en.svg b/docs/ux/issuer/i5.en.svg
new file mode 100644
index 0000000..9ad837e
--- /dev/null
+++ b/docs/ux/issuer/i5.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I5 — Review and issue</title>
+<desc id="desc">Confirm the content, recipient and visibility. Private hosting required. Address and lifecycle remain public on XRPL. Technical details available.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Review and issue</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Confirm the content, recipient and</tspan><tspan x="24" dy="18.2">visibility.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Example · Wallet linked</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attestation</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Course completion · XRPL introduction</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Fields to complete</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Name: Camille Example · Date: 23 Sep 2026</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Visibility: private</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public: course · Restricted: name, date</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Signature</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop · Testnet · Show fee</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Sign in my wallet</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Change visibility</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Private hosting required. Address and lifecycle</tspan><tspan x="24" dy="15.600000000000001">remain public on XRPL. Technical details</tspan><tspan x="24" dy="15.600000000000001">available.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i5.fr.svg b/docs/ux/issuer/i5.fr.svg
new file mode 100644
index 0000000..78b00cd
--- /dev/null
+++ b/docs/ux/issuer/i5.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I5 — Vérifier et émettre</title>
+<desc id="desc">Confirmer le contenu, le destinataire et la visibilité. Hébergement privé requis. Adresse et cycle de vie restent publics sur XRPL. Détails techniques disponibles.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vérifier et émettre</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Confirmer le contenu, le destinataire et la</tspan><tspan x="24" dy="18.2">visibilité.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Exemple · Portefeuille lié</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attestation</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Fin de formation · Initiation XRPL</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Champs à remplir</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Nom : Camille Exemple · Date : 23/09/2026</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Visibilité : privée</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public : formation · Restreint : nom, date</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Signature</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple · Testnet · Frais à</tspan><tspan x="34" dy="18.2">afficher</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Signer dans mon portefeuille</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Modifier la visibilité</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Hébergement privé requis. Adresse et cycle de vie</tspan><tspan x="24" dy="15.600000000000001">restent publics sur XRPL. Détails techniques</tspan><tspan x="24" dy="15.600000000000001">disponibles.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i6.en.svg b/docs/ux/issuer/i6.en.svg
new file mode 100644
index 0000000..6971aff
--- /dev/null
+++ b/docs/ux/issuer/i6.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">I6 — Track attestation</title>
+<desc id="desc">Track issuance, content and acceptance separately. Revocation needs confirmation and signing. Pending publication resumes without issuing again.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Issuer</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Track attestation</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Track issuance, content and acceptance</tspan><tspan x="24" dy="18.2">separately.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Issued · Awaiting acceptance</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Learner and course</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Example · XRPL introduction</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">XRPL issuance</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Validated on the ledger</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Content availability</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Published · Restricted access</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Acceptance and notification</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Acceptance pending · Notification queued</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Refresh status</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Revoke attestation…</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Revocation needs confirmation and signing.</tspan><tspan x="24" dy="15.600000000000001">Pending publication resumes without issuing</tspan><tspan x="24" dy="15.600000000000001">again.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/i6.fr.svg b/docs/ux/issuer/i6.fr.svg
new file mode 100644
index 0000000..1e394f7
--- /dev/null
+++ b/docs/ux/issuer/i6.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">I6 — Suivre l’attestation</title>
+<desc id="desc">Suivre l’émission, le contenu et l’acceptation. Révoquer demande confirmation et signature. Une publication en attente se reprend sans réémettre.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Émetteur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Suivre l’attestation</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Suivre l’émission, le contenu et</tspan><tspan x="24" dy="18.2">l’acceptation.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Émise · En attente d’acceptation</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Destinataire et formation</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Exemple · Initiation XRPL</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Émission sur XRPL</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Confirmée sur le ledger</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Disponibilité du contenu</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Publié · Accès privé</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Acceptation et notification</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Acceptation en attente · Notification en</tspan><tspan x="34" dy="18.2">file</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Actualiser le statut</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Révoquer l’attestation…</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Révoquer demande confirmation et signature. Une</tspan><tspan x="24" dy="15.600000000000001">publication en attente se reprend sans réémettre.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/issuer/wireframes.en.excalidraw b/docs/ux/issuer/wireframes.en.excalidraw
new file mode 100644
index 0000000..5ba4fc1
--- /dev/null
+++ b/docs/ux/issuer/wireframes.en.excalidraw
@@ -0,0 +1,4946 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "I1-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Apply as an issuer",
+      "originalText": "Apply as an issuer",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Tell us about your organization to request\naccess.",
+      "originalText": "Tell us about your organization to request\naccess.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Signed in · Access required",
+      "originalText": "Signed in · Access required",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization and website",
+      "originalText": "Organization and website",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop · Organization website",
+      "originalText": "Example Workshop · Organization website",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact and jurisdiction",
+      "originalText": "Contact and jurisdiction",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Work contact · France",
+      "originalText": "Work contact · France",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Intended use",
+      "originalText": "Intended use",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issue course completion attestations",
+      "originalText": "Issue course completion attestations",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization evidence",
+      "originalText": "Organization evidence",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose a file · Restricted access",
+      "originalText": "Choose a file · Restricted access",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Submit application",
+      "originalText": "Submit application",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "These documents support the application review.\nThey will not be published on the ledger.",
+      "originalText": "These documents support the application review.\nThey will not be published on the ledger.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-en-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your application",
+      "originalText": "Your application",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "You will be notified after the review.",
+      "originalText": "You will be notified after the review.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 137.10000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 147.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Awaiting review",
+      "originalText": "Awaiting review",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 190.10000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 199.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization",
+      "originalText": "Organization",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 219.10000000000002,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop",
+      "originalText": "Example Workshop",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 259.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 268.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Application submitted",
+      "originalText": "Application submitted",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 288.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 September · Issuer role",
+      "originalText": "23 September · Issuer role",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 328.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 337.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Next step",
+      "originalText": "Next step",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 357.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Once approved: create your template",
+      "originalText": "Once approved: create your template",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 397.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 406.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "If the application is declined",
+      "originalText": "If the application is declined",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 426.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The reason and next step appear here",
+      "originalText": "The reason and next step appear here",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 472.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 485.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Browse public schemas",
+      "originalText": "Browse public schemas",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-21",
+      "type": "text",
+      "x": 464,
+      "y": 529.9,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issuing from this workspace becomes available\nafter approval.",
+      "originalText": "Issuing from this workspace becomes available\nafter approval.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-en-22",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Create a template",
+      "originalText": "Create a template",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose what your attestation will contain.",
+      "originalText": "Choose what your attestation will contain.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 137.10000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 147.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Step 1 · Public schema",
+      "originalText": "Step 1 · Public schema",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 190.10000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 199.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Start from a template",
+      "originalText": "Start from a template",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 219.10000000000002,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Course completion ✓ · Diploma",
+      "originalText": "Course completion ✓ · Diploma",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 259.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 268.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Template fields",
+      "originalText": "Template fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 288.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Name: text · Course: text · Date: date",
+      "originalText": "Name: text · Course: text · Date: date",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 328.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 337.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Preview",
+      "originalText": "Preview",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 357.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Learner name · Course · Completion date",
+      "originalText": "Learner name · Course · Completion date",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 397.7,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-17",
+      "type": "text",
+      "x": 914,
+      "y": 406.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Before signing",
+      "originalText": "Before signing",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-18",
+      "type": "text",
+      "x": 914,
+      "y": 426.7,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Account: Example Workshop · Testnet · Show\nfee",
+      "originalText": "Account: Example Workshop · Testnet · Show\nfee",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 491.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-20",
+      "type": "text",
+      "x": 916,
+      "y": 504,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review and publish",
+      "originalText": "Review and publish",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 545.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-en-22",
+      "type": "text",
+      "x": 916,
+      "y": 558,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Technical details",
+      "originalText": "Technical details",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-23",
+      "type": "text",
+      "x": 904,
+      "y": 602.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The schema becomes public. No actual learner data\nis entered at this step.",
+      "originalText": "The schema becomes public. No actual learner data\nis entered at this step.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-en-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Invite a learner",
+      "originalText": "Invite a learner",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "They will choose their account and link a\nwallet.",
+      "originalText": "They will choose their account and link a\nwallet.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Step 2 · Invitation",
+      "originalText": "Step 2 · Invitation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Learner email",
+      "originalText": "Learner email",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "camille@example.invalid",
+      "originalText": "camille@example.invalid",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your schema",
+      "originalText": "Your schema",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Course completion · Example Workshop",
+      "originalText": "Course completion · Example Workshop",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Optional message",
+      "originalText": "Optional message",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your attestation will be available soon.",
+      "originalText": "Your attestation will be available soon.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Invitation tracking",
+      "originalText": "Invitation tracking",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sent → Claimed → Wallet linked",
+      "originalText": "Sent → Claimed → Wallet linked",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Send invitation",
+      "originalText": "Send invitation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1469.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-en-22",
+      "type": "text",
+      "x": 36,
+      "y": 1482,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View invitations",
+      "originalText": "View invitations",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-23",
+      "type": "text",
+      "x": 24,
+      "y": 1526.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Resend or revoke from the list. Issue only after\nthe wallet is linked.",
+      "originalText": "Resend or revoke from the list. Issue only after\nthe wallet is linked.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-en-24",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review and issue",
+      "originalText": "Review and issue",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Confirm the content, recipient and\nvisibility.",
+      "originalText": "Confirm the content, recipient and\nvisibility.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Example · Wallet linked",
+      "originalText": "Camille Example · Wallet linked",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attestation",
+      "originalText": "Attestation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Course completion · XRPL introduction",
+      "originalText": "Course completion · XRPL introduction",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Fields to complete",
+      "originalText": "Fields to complete",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Name: Camille Example · Date: 23 Sep 2026",
+      "originalText": "Name: Camille Example · Date: 23 Sep 2026",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Visibility: private",
+      "originalText": "Visibility: private",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public: course · Restricted: name, date",
+      "originalText": "Public: course · Restricted: name, date",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Signature",
+      "originalText": "Signature",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop · Testnet · Show fee",
+      "originalText": "Example Workshop · Testnet · Show fee",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sign in my wallet",
+      "originalText": "Sign in my wallet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1469.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-en-22",
+      "type": "text",
+      "x": 476,
+      "y": 1482,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Change visibility",
+      "originalText": "Change visibility",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-23",
+      "type": "text",
+      "x": 464,
+      "y": 1526.1,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Private hosting required. Address and lifecycle\nremain public on XRPL. Technical details\navailable.",
+      "originalText": "Private hosting required. Address and lifecycle\nremain public on XRPL. Technical details\navailable.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-en-24",
+      "type": "text",
+      "x": 464,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Issuer",
+      "originalText": "XCS / Issuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Track attestation",
+      "originalText": "Track attestation",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Track issuance, content and acceptance\nseparately.",
+      "originalText": "Track issuance, content and acceptance\nseparately.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issued · Awaiting acceptance",
+      "originalText": "Issued · Awaiting acceptance",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Learner and course",
+      "originalText": "Learner and course",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Example · XRPL introduction",
+      "originalText": "Camille Example · XRPL introduction",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XRPL issuance",
+      "originalText": "XRPL issuance",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Validated on the ledger",
+      "originalText": "Validated on the ledger",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Content availability",
+      "originalText": "Content availability",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Published · Restricted access",
+      "originalText": "Published · Restricted access",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-17",
+      "type": "text",
+      "x": 914,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Acceptance and notification",
+      "originalText": "Acceptance and notification",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-18",
+      "type": "text",
+      "x": 914,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Acceptance pending · Notification queued",
+      "originalText": "Acceptance pending · Notification queued",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-20",
+      "type": "text",
+      "x": 916,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Refresh status",
+      "originalText": "Refresh status",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1469.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-en-22",
+      "type": "text",
+      "x": 916,
+      "y": 1482,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Revoke attestation…",
+      "originalText": "Revoke attestation…",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-23",
+      "type": "text",
+      "x": 904,
+      "y": 1526.1,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Revocation needs confirmation and signing.\nPending publication resumes without issuing\nagain.",
+      "originalText": "Revocation needs confirmation and signing.\nPending publication resumes without issuing\nagain.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-en-24",
+      "type": "text",
+      "x": 904,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/issuer/wireframes.fr.excalidraw b/docs/ux/issuer/wireframes.fr.excalidraw
new file mode 100644
index 0000000..e4f9b7a
--- /dev/null
+++ b/docs/ux/issuer/wireframes.fr.excalidraw
@@ -0,0 +1,4946 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "I1-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Devenir émetteur",
+      "originalText": "Devenir émetteur",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Présenter votre organisation pour demander\nl’accès.",
+      "originalText": "Présenter votre organisation pour demander\nl’accès.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Compte connecté · Accès à demander",
+      "originalText": "Compte connecté · Accès à demander",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organisation et site web",
+      "originalText": "Organisation et site web",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple · Site de l’organisation",
+      "originalText": "Atelier Exemple · Site de l’organisation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact et pays",
+      "originalText": "Contact et pays",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact professionnel · France",
+      "originalText": "Contact professionnel · France",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Usage prévu",
+      "originalText": "Usage prévu",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attester la fin d’une formation",
+      "originalText": "Attester la fin d’une formation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Justificatif de l’organisation",
+      "originalText": "Justificatif de l’organisation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choisir un fichier · Accès restreint",
+      "originalText": "Choisir un fichier · Accès restreint",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I1-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Envoyer ma demande",
+      "originalText": "Envoyer ma demande",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ces justificatifs servent à l’examen de la\ndemande. Ils ne seront pas publiés sur le ledger.",
+      "originalText": "Ces justificatifs servent à l’examen de la\ndemande. Ils ne seront pas publiés sur le ledger.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I1-fr-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre demande",
+      "originalText": "Votre demande",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vous serez informé après son examen.",
+      "originalText": "Vous serez informé après son examen.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 137.10000000000002,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 147.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "En attente d’examen",
+      "originalText": "En attente d’examen",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 190.10000000000002,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 199.10000000000002,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organisation",
+      "originalText": "Organisation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 219.10000000000002,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple",
+      "originalText": "Atelier Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 259.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 268.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Demande envoyée",
+      "originalText": "Demande envoyée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 288.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 septembre · Rôle émetteur",
+      "originalText": "23 septembre · Rôle émetteur",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 328.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 337.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Étape suivante",
+      "originalText": "Étape suivante",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 357.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Après autorisation : créer votre modèle",
+      "originalText": "Après autorisation : créer votre modèle",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 397.7,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 406.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Si la demande est refusée",
+      "originalText": "Si la demande est refusée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 426.7,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Le motif et la prochaine étape s’affichent\nici",
+      "originalText": "Le motif et la prochaine étape s’affichent\nici",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 491.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I2-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 504,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Consulter les schémas publics",
+      "originalText": "Consulter les schémas publics",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-21",
+      "type": "text",
+      "x": 464,
+      "y": 548.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "L’émission depuis cet espace sera disponible\naprès autorisation.",
+      "originalText": "L’émission depuis cet espace sera disponible\naprès autorisation.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I2-fr-22",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Créer un modèle",
+      "originalText": "Créer un modèle",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Définir les informations de votre\nattestation.",
+      "originalText": "Définir les informations de votre\nattestation.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Étape 1 · Schéma public",
+      "originalText": "Étape 1 · Schéma public",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Partir d’un modèle",
+      "originalText": "Partir d’un modèle",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Fin de formation ✓ · Diplôme",
+      "originalText": "Fin de formation ✓ · Diplôme",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Champs du modèle",
+      "originalText": "Champs du modèle",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Nom : texte · Formation : texte · Date :\ndate",
+      "originalText": "Nom : texte · Formation : texte · Date :\ndate",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 364.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 373.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aperçu",
+      "originalText": "Aperçu",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 393.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Nom du destinataire · Formation · Date de\nfin",
+      "originalText": "Nom du destinataire · Formation · Date de\nfin",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 452.29999999999995,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-17",
+      "type": "text",
+      "x": 914,
+      "y": 461.29999999999995,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Avant signature",
+      "originalText": "Avant signature",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-18",
+      "type": "text",
+      "x": 914,
+      "y": 481.29999999999995,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Compte : Atelier Exemple · Testnet · Frais\nà afficher",
+      "originalText": "Compte : Atelier Exemple · Testnet · Frais\nà afficher",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 545.6999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-20",
+      "type": "text",
+      "x": 916,
+      "y": 558.5999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifier puis publier",
+      "originalText": "Vérifier puis publier",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 599.6999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I3-fr-22",
+      "type": "text",
+      "x": 916,
+      "y": 612.5999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Détails techniques",
+      "originalText": "Détails techniques",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-23",
+      "type": "text",
+      "x": 904,
+      "y": 656.6999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Le schéma devient public. Aucune donnée réelle de\ndestinataire n’est saisie à cette étape.",
+      "originalText": "Le schéma devient public. Aucune donnée réelle de\ndestinataire n’est saisie à cette étape.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I3-fr-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Inviter un destinataire",
+      "originalText": "Inviter un destinataire",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Il choisira son compte et liera son\nportefeuille.",
+      "originalText": "Il choisira son compte et liera son\nportefeuille.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Étape 2 · Invitation",
+      "originalText": "Étape 2 · Invitation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "E-mail du destinataire",
+      "originalText": "E-mail du destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "camille@example.invalid",
+      "originalText": "camille@example.invalid",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre schéma",
+      "originalText": "Votre schéma",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Fin de formation · Atelier Exemple",
+      "originalText": "Fin de formation · Atelier Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Message facultatif",
+      "originalText": "Message facultatif",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre attestation sera bientôt disponible.",
+      "originalText": "Votre attestation sera bientôt disponible.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Suivi des invitations",
+      "originalText": "Suivi des invitations",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Envoyée → Récupérée → Portefeuille lié",
+      "originalText": "Envoyée → Récupérée → Portefeuille lié",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Envoyer l’invitation",
+      "originalText": "Envoyer l’invitation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1469.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I4-fr-22",
+      "type": "text",
+      "x": 36,
+      "y": 1482,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir les invitations",
+      "originalText": "Voir les invitations",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-23",
+      "type": "text",
+      "x": 24,
+      "y": 1526.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Renvoyer ou révoquer depuis la liste. Émettre\nseulement après la liaison du portefeuille.",
+      "originalText": "Renvoyer ou révoquer depuis la liste. Émettre\nseulement après la liaison du portefeuille.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I4-fr-24",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifier et émettre",
+      "originalText": "Vérifier et émettre",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Confirmer le contenu, le destinataire et la\nvisibilité.",
+      "originalText": "Confirmer le contenu, le destinataire et la\nvisibilité.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Exemple · Portefeuille lié",
+      "originalText": "Camille Exemple · Portefeuille lié",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attestation",
+      "originalText": "Attestation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Fin de formation · Initiation XRPL",
+      "originalText": "Fin de formation · Initiation XRPL",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Champs à remplir",
+      "originalText": "Champs à remplir",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Nom : Camille Exemple · Date : 23/09/2026",
+      "originalText": "Nom : Camille Exemple · Date : 23/09/2026",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Visibilité : privée",
+      "originalText": "Visibilité : privée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public : formation · Restreint : nom, date",
+      "originalText": "Public : formation · Restreint : nom, date",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1339.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Signature",
+      "originalText": "Signature",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 1368.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple · Testnet · Frais à\nafficher",
+      "originalText": "Atelier Exemple · Testnet · Frais à\nafficher",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Signer dans mon portefeuille",
+      "originalText": "Signer dans mon portefeuille",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1487.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I5-fr-22",
+      "type": "text",
+      "x": 476,
+      "y": 1500.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Modifier la visibilité",
+      "originalText": "Modifier la visibilité",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-23",
+      "type": "text",
+      "x": 464,
+      "y": 1544.3,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Hébergement privé requis. Adresse et cycle de vie\nrestent publics sur XRPL. Détails techniques\ndisponibles.",
+      "originalText": "Hébergement privé requis. Adresse et cycle de vie\nrestent publics sur XRPL. Détails techniques\ndisponibles.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I5-fr-24",
+      "type": "text",
+      "x": 464,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Émetteur",
+      "originalText": "XCS / Émetteur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Suivre l’attestation",
+      "originalText": "Suivre l’attestation",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Suivre l’émission, le contenu et\nl’acceptation.",
+      "originalText": "Suivre l’émission, le contenu et\nl’acceptation.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émise · En attente d’acceptation",
+      "originalText": "Émise · En attente d’acceptation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Destinataire et formation",
+      "originalText": "Destinataire et formation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Exemple · Initiation XRPL",
+      "originalText": "Camille Exemple · Initiation XRPL",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émission sur XRPL",
+      "originalText": "Émission sur XRPL",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Confirmée sur le ledger",
+      "originalText": "Confirmée sur le ledger",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Disponibilité du contenu",
+      "originalText": "Disponibilité du contenu",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Publié · Accès privé",
+      "originalText": "Publié · Accès privé",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1339.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-17",
+      "type": "text",
+      "x": 914,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Acceptation et notification",
+      "originalText": "Acceptation et notification",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-18",
+      "type": "text",
+      "x": 914,
+      "y": 1368.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Acceptation en attente · Notification en\nfile",
+      "originalText": "Acceptation en attente · Notification en\nfile",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-20",
+      "type": "text",
+      "x": 916,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Actualiser le statut",
+      "originalText": "Actualiser le statut",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 1487.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "I6-fr-22",
+      "type": "text",
+      "x": 916,
+      "y": 1500.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Révoquer l’attestation…",
+      "originalText": "Révoquer l’attestation…",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-23",
+      "type": "text",
+      "x": 904,
+      "y": 1544.3,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Révoquer demande confirmation et signature. Une\npublication en attente se reprend sans réémettre.",
+      "originalText": "Révoquer demande confirmation et signature. Une\npublication en attente se reprend sans réémettre.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "I6-fr-24",
+      "type": "text",
+      "x": 904,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/recipient/README.md b/docs/ux/recipient/README.md
new file mode 100644
index 0000000..859df11
--- /dev/null
+++ b/docs/ux/recipient/README.md
@@ -0,0 +1,114 @@
+# Recipient — claim, accept and share deliberately
+
+Draft for [#32](https://github.com/XRPL-Commons/XCS/issues/32).
+
+User goal: “I want to receive my attestation and show the right information to someone checking it.”
+
+[French board](./wireframes.fr.excalidraw) · [English board](./wireframes.en.excalidraw) ·
+[Gallery](../index.html#recipient)
+
+## Journey and screen budget
+
+```mermaid
+flowchart LR
+  Email[Email invitation] --> R1[Claim and sign in]
+  R1 --> R2[Link wallet]
+  R2 --> R3[Inbox: wait for issuance]
+  R3 --> R4[Review and accept]
+  R4 -->|Validated| R5[Present by link or QR]
+```
+
+Four application screens from email to acceptance (R1–R4); presenting adds R5. The externally owned
+XRP Identity and wallet consent/install screens are explicit handoffs, not hidden steps in this
+count. Measure both application-screen count and real handoff effort during tests; the five-screen
+goal must not conceal a difficult wallet setup. There may be a wait for issuer action after R2.
+
+| Screen / suggested route                               | Question answered                             | Main action                                                                               |
+| ------------------------------------------------------ | --------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| [R1](./r1.fr.svg) `/invites/:token`                    | Who is offering me what?                      | Sign in with XRP Identity and claim invite; confirm intended account                      |
+| [R2](./r2.fr.svg) `/recipient/wallet`                  | Why do I need a wallet, and is mine ready?    | Select compatible wallet; prove ownership with a nonce challenge, not a transaction       |
+| [R3](./r3.fr.svg) `/recipient`                         | Is my attestation ready?                      | Waiting, ready to accept, accepted and inactive sections; select one                      |
+| [R4](./r4.fr.svg) `/recipient/credentials/:id`         | What will accepting do?                       | Inspect issuer and ledger metadata; consent to read content; review and accept or decline |
+| [R5](./r5.fr.svg) `/recipient/credentials/:id/present` | Who can see what, and how can I stop sharing? | Choose scope and designated verifier for private access; link/QR; list and revoke grants  |
+
+R1 reveals only minimal invitation context before authentication. Under the updated ADR 0004,
+possession of a valid invitation permits an authenticated account to claim it without matching the
+delivery email. Opening is read-only; claiming is explicit and atomic. A forwarded unclaimed link
+can be claimed first by its holder, but an already claimed link cannot reassign the claimant.
+Explain this before confirmation and let the issuer review the actual claimant and proven wallet
+before signing. Claiming is not email verification. Avoid account-existence disclosures in errors.
+
+R2 explains wallet custody and address visibility in ordinary language. Installation guidance must
+come from the maintained adapter compatibility list, not a promise that every wallet works. The
+ownership challenge can never be submitted as an XRPL transaction. Connecting is not linking;
+server verification of the current nonce completes the step and informs the issuer.
+
+R4 has two phases on the same screen. Before fetch, show host, issuer and basic ledger evidence with
+“Read attestation content” consent. Decline remains possible without any payload request. After
+consent and integrity checks, show claims and the signing preview. Acceptance requires a current
+valid review and subject wallet; declining signs the existing subject-delete flow and never fetches
+payload. Warn that either signing action may incur the displayed fee. A canceled wallet prompt
+changes nothing; an unresolved transaction remains pending. Announce accepted only after validation.
+
+Preserve the existing trust guard: an `untrusted` issuer blocks acceptance; `unknown` requires an
+explicit acknowledgement for this exact issuer, subject, generation and network profile. Copy:
+“I have checked this issuer and choose to accept” / “J’ai vérifié cet émetteur et je choisis
+d’accepter”. This does not change the issuer's global trust status. Recheck after the wallet returns.
+If generation, host, account, network or trust changes, invalidate the preview/consent and show
+“The attestation changed; review it again” / “L’attestation a changé ; examinez-la à nouveau”.
+Declining stays possible on current ledger metadata without payload access or a trust acknowledgement.
+
+R5 defaults to public scope. Selecting private/full sharing requires choosing one globally approved
+verifier organization, bound server-side to its stable application identity. Preview that audience
+and the authorized fields before creation; a forwarded link cannot authorize another verifier.
+The R5 wireframe illustrates this full-sharing selection with name, course and completion date.
+The public-only default instead previews only the public fields and does not need a verifier picker.
+Sharing lasts until the recipient revokes it, with no automatic expiry or renewal. The recipient
+may narrow sharing, not retroactively hide already public claims. QR and copy button
+appear only after creation; before that the wireframe's QR area is a labeled placeholder, not an
+encoded token. Revoking a presentation stops future opens; it neither revokes the credential nor
+erases copies already seen by a viewer. There is no single-use setting or issuer allowlist. Loss of
+the designated verifier's approval blocks access even while the recipient's grant remains active.
+
+## Current asks → proposed simplification
+
+| Today in inbox, `/accept` and exact detail               | Proposed role flow                                                       |
+| -------------------------------------------------------- | ------------------------------------------------------------------------ |
+| Shared generation ID or full issuer/subject/schema tuple | Resolve from invite or owned inbox item                                  |
+| Subject wallet address                                   | Derived from proven linked wallet; shortened confirmation with details   |
+| URI, digest and technical verification report            | Plain consent host and integrity explanation; evidence expandable        |
+| Raw transaction preview                                  | Visible action/fee summary and secondary JSON before wallet approval     |
+| Manual sharing of identifiers                            | Named presentation with scope, intended verifier, revocation and link/QR |
+
+The current connected-wallet inbox enumerates unaccepted objects through the browser RPC. R3's
+session-owned accepted/history view is new application work, not an existing public account feed.
+
+## Failure and empty states
+
+- No issued item yet: “Your issuer is preparing the attestation” / “L’émetteur prépare l’attestation”;
+  retain claim and linked wallet, no repeated acceptance prompt.
+- Wallet not installed (F1): setup guidance and return to R2 without reclaiming the invite.
+- Invite expired (F2): ask the known issuer for a replacement; no account or previous-claim disclosure.
+- Indexer unavailable (F3): keep inbox context; do not allow accept/decline on stale metadata.
+- Content unavailable or altered: explain why acceptance is blocked; decline remains metadata-only
+  when ledger readiness permits. No automatic payload retry before consent.
+- Revoked/expired credential: show its actual lifecycle and stop offering acceptance or a misleading
+  valid presentation. Existing presentation must reflect lifecycle changes on resolution.
+- Revoked/invalid presentation: show a generic unusable link; recipient creates a new grant from
+  their authenticated workspace if still allowed. No automatic sharing expiration is introduced.
+- Wrong verifier identity or suspended approval: no private fields; recipient can revoke the old
+  grant and choose a different approved verifier. Renaming an organization cannot transfer access.
+
+## Review and acceptance tasks
+
+Two recipient participants start from the fictional email, claim, link, accept, and create a
+public-only presentation, then share privately with one designated verifier. Ask them to predict
+which fields an anonymous visitor or a different approved verifier sees. Repeat with
+an expired invite, wallet unavailable and indexer failure. Test declining without content fetch and
+distinguish “revoke this link” from “delete my credential”. Record both step count and handoff time.
+
+#32 implements R1–R5 with F1–F3 and the shared scope matrix. At API level, assert invite expiry,
+grant revocation, intended audience, current approval, no automatic sharing expiry and no hidden
+claims in public responses. The older expiry/single-use proposal is superseded by ADR 0004.
+Usability evidence is pending in
+[the session log](../usability.md).
diff --git a/docs/ux/recipient/r1.en.svg b/docs/ux/recipient/r1.en.svg
new file mode 100644
index 0000000..327278e
--- /dev/null
+++ b/docs/ux/recipient/r1.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">R1 — An attestation for you</title>
+<desc id="desc">Example Workshop invites you to receive an attestation. Check the account before claiming the invitation. Signing in does not require a wallet.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Recipient</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">An attestation for you</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Example Workshop invites you to receive an</tspan><tspan x="24" dy="18.2">attestation.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">1 of 4 · Claim invitation</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Offered by</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attestation type</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Course completion</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Your account</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Sign in or create an XRP Identity account</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Next step</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Link a wallet to receive the attestation</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Continue with XRP Identity</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Check the account before claiming the invitation.</tspan><tspan x="24" dy="15.600000000000001">Signing in does not require a wallet.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r1.fr.svg b/docs/ux/recipient/r1.fr.svg
new file mode 100644
index 0000000..d7b4380
--- /dev/null
+++ b/docs/ux/recipient/r1.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">R1 — Une attestation pour vous</title>
+<desc id="desc">Atelier Exemple vous invite à recevoir une attestation. Vérifiez le compte utilisé avant de récupérer l’invitation. Aucun portefeuille requis pour se connecter.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Destinataire</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Une attestation pour vous</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Atelier Exemple vous invite à recevoir une</tspan><tspan x="24" dy="18.2">attestation.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">1 sur 4 · Récupérer l’invitation</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Proposée par</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Type d’attestation</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Fin de formation</tspan></text>
+<rect x="24" y="346.7" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Votre compte</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Se connecter ou créer un compte XRP</tspan><tspan x="34" dy="18.2">Identity</tspan></text>
+<rect x="24" y="434.1" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="443.1" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Prochaine étape</tspan></text>
+<text x="34" y="463.1" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Lier un portefeuille pour recevoir</tspan><tspan x="34" dy="18.2">l’attestation</tspan></text>
+<rect x="24" y="527.5" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="540.4" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Continuer avec XRP Identity</tspan></text>
+<text x="24" y="584.5" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vérifiez le compte utilisé avant de récupérer</tspan><tspan x="24" dy="15.600000000000001">l’invitation. Aucun portefeuille requis pour se</tspan><tspan x="24" dy="15.600000000000001">connecter.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r2.en.svg b/docs/ux/recipient/r2.en.svg
new file mode 100644
index 0000000..7b3f7d8
--- /dev/null
+++ b/docs/ux/recipient/r2.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">R2 — Link my wallet</title>
+<desc id="desc">Prove that you control the receiving address. Your keys stay in the wallet. The issuer is notified after the proof is verified.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Recipient</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Link my wallet</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Prove that you control the receiving</tspan><tspan x="24" dy="18.2">address.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">2 of 4 · Wallet</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choose a wallet</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Detected compatible wallets</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Do not have one?</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">See installation guidance</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Check before continuing</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Selected account · Testnet network</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">What you authorize</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Proof of control, not a transaction</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Connect and prove control</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Your keys stay in the wallet. The issuer is</tspan><tspan x="24" dy="15.600000000000001">notified after the proof is verified.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r2.fr.svg b/docs/ux/recipient/r2.fr.svg
new file mode 100644
index 0000000..61089e4
--- /dev/null
+++ b/docs/ux/recipient/r2.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">R2 — Lier mon portefeuille</title>
+<desc id="desc">Prouver que l’adresse de réception vous appartient. Vos clés restent dans le portefeuille. L’émetteur sera informé après vérification de la preuve.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Destinataire</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Lier mon portefeuille</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Prouver que l’adresse de réception vous</tspan><tspan x="24" dy="18.2">appartient.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">2 sur 4 · Portefeuille</tspan></text>
+<rect x="24" y="208.3" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choisir un portefeuille</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Liste des portefeuilles compatibles</tspan><tspan x="34" dy="18.2">détectés</tspan></text>
+<rect x="24" y="295.70000000000005" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="304.70000000000005" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vous n’en avez pas ?</tspan></text>
+<text x="34" y="324.70000000000005" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Voir les instructions d’installation</tspan></text>
+<rect x="24" y="364.90000000000003" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.90000000000003" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vérifier avant de continuer</tspan></text>
+<text x="34" y="393.90000000000003" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Compte choisi · Réseau Testnet</tspan></text>
+<rect x="24" y="434.1" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="443.1" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ce que vous autorisez</tspan></text>
+<text x="34" y="463.1" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Une preuve de contrôle, pas une transaction</tspan></text>
+<rect x="24" y="509.3" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.2" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Connecter puis prouver le contrôle</tspan></text>
+<text x="24" y="566.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vos clés restent dans le portefeuille. L’émetteur</tspan><tspan x="24" dy="15.600000000000001">sera informé après vérification de la preuve.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r3.en.svg b/docs/ux/recipient/r3.en.svg
new file mode 100644
index 0000000..3b71ce1
--- /dev/null
+++ b/docs/ux/recipient/r3.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">R3 — My attestations</title>
+<desc id="desc">See what is ready and what is still pending. This workspace is private. It does not create a public list of your attestations.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Recipient</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">My attestations</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">See what is ready and what is still</tspan><tspan x="24" dy="18.2">pending.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">3 of 4 · Inbox</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ready to accept · 1</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">XRPL introduction · Example Workshop</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Being prepared · 0</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Invitations awaiting issuance appear here</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Accepted · 0</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Accepted attestations appear here</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Inactive · 0</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Expired, revoked or declined</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Review attestation</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">This workspace is private. It does not create a</tspan><tspan x="24" dy="15.600000000000001">public list of your attestations.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r3.fr.svg b/docs/ux/recipient/r3.fr.svg
new file mode 100644
index 0000000..2766059
--- /dev/null
+++ b/docs/ux/recipient/r3.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">R3 — Mes attestations</title>
+<desc id="desc">Retrouver ce qui est prêt et ce qui attend encore. Cet espace est privé. Il ne crée pas de liste publique de vos attestations.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Destinataire</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Mes attestations</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Retrouver ce qui est prêt et ce qui attend</tspan><tspan x="24" dy="18.2">encore.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">3 sur 4 · Boîte de réception</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">À accepter · 1</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Initiation XRPL · Atelier Exemple</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">En préparation · 0</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vos invitations en attente apparaîtront ici</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Acceptées · 0</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vos attestations acceptées apparaîtront ici</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Inactives · 0</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Expirées, révoquées ou refusées</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Examiner l’attestation</tspan></text>
+<text x="24" y="548.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Cet espace est privé. Il ne crée pas de liste</tspan><tspan x="24" dy="15.600000000000001">publique de vos attestations.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r4.en.svg b/docs/ux/recipient/r4.en.svg
new file mode 100644
index 0000000..62e580e
--- /dev/null
+++ b/docs/ux/recipient/r4.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">R4 — Review before accepting</title>
+<desc id="desc">Read the content only with your consent. Unknown issuer: acknowledge before accepting. Untrusted issuer: acceptance blocked. Declining downloads nothing.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Recipient</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Review before accepting</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Read the content only with your consent.</tspan></text>
+<rect x="24" y="137.10000000000002" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="147.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">4 of 4 · Ready to accept</tspan></text>
+<rect x="24" y="190.10000000000002" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="199.10000000000002" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Issuer and attestation</tspan></text>
+<text x="34" y="219.10000000000002" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Workshop · Course completion</tspan></text>
+<rect x="24" y="259.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="268.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Content source</tspan></text>
+<text x="34" y="288.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Private XCS storage · Authorized reading</tspan></text>
+<rect x="24" y="328.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="337.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">After reading and checks</tspan></text>
+<text x="34" y="357.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Show the fields and signing summary</tspan></text>
+<rect x="24" y="397.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="406.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Before signing</tspan></text>
+<text x="34" y="426.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Your account · Testnet · Show fee</tspan></text>
+<rect x="24" y="472.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="485.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Allow reading the content</tspan></text>
+<rect x="24" y="526.9" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="539.8" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Decline without reading content</tspan></text>
+<text x="24" y="583.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Unknown issuer: acknowledge before accepting.</tspan><tspan x="24" dy="15.600000000000001">Untrusted issuer: acceptance blocked. Declining</tspan><tspan x="24" dy="15.600000000000001">downloads nothing.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r4.fr.svg b/docs/ux/recipient/r4.fr.svg
new file mode 100644
index 0000000..088c011
--- /dev/null
+++ b/docs/ux/recipient/r4.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">R4 — Examiner avant d’accepter</title>
+<desc id="desc">Lire le contenu seulement après votre accord. Émetteur inconnu : accord explicite avant acceptation. Émetteur non fiable : acceptation bloquée. Refuser ne télécharge rien.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Destinataire</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Examiner avant d’accepter</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Lire le contenu seulement après votre</tspan><tspan x="24" dy="18.2">accord.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">4 sur 4 · À accepter</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Émetteur et attestation</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Atelier Exemple · Fin de formation</tspan></text>
+<rect x="24" y="277.5" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Source du contenu</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Hébergement privé XCS · Lecture sur</tspan><tspan x="34" dy="18.2">autorisation</tspan></text>
+<rect x="24" y="364.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Après lecture et contrôles</tspan></text>
+<text x="34" y="393.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Afficher les champs et le résumé à signer</tspan></text>
+<rect x="24" y="434.09999999999997" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="443.09999999999997" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Avant signature</tspan></text>
+<text x="34" y="463.09999999999997" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Votre compte · Testnet · Frais à afficher</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Autoriser la lecture du contenu</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Refuser sans lire le contenu</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Émetteur inconnu : accord explicite avant</tspan><tspan x="24" dy="15.600000000000001">acceptation. Émetteur non fiable : acceptation</tspan><tspan x="24" dy="15.600000000000001">bloquée. Refuser ne télécharge rien.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r5.en.svg b/docs/ux/recipient/r5.en.svg
new file mode 100644
index 0000000..26abbb1
--- /dev/null
+++ b/docs/ux/recipient/r5.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">R5 — Present my attestation</title>
+<desc id="desc">Choose who can read the fields, then manage sharing. After creation: link and QR. A forwarded link does not give another verifier the private fields.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Recipient</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Present my attestation</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Choose who can read the fields, then manage</tspan><tspan x="24" dy="18.2">sharing.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attestation accepted</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Sharing scope</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public fields only · All fields ✓</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">To share private fields</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choose an approved verifier: Example Office</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Sharing duration</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Until revoked · No renewal required</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Preview for Example Office</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Name, course, date · Sign-in required</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Review and create sharing</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">View and revoke my sharing</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">After creation: link and QR. A forwarded link</tspan><tspan x="24" dy="15.600000000000001">does not give another verifier the private</tspan><tspan x="24" dy="15.600000000000001">fields.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/r5.fr.svg b/docs/ux/recipient/r5.fr.svg
new file mode 100644
index 0000000..2a528f3
--- /dev/null
+++ b/docs/ux/recipient/r5.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">R5 — Présenter mon attestation</title>
+<desc id="desc">Choisir qui peut lire les champs, puis gérer le partage. Après création : lien et QR. Un lien transféré ne donne pas les champs privés à un autre vérificateur.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Destinataire</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Présenter mon attestation</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Choisir qui peut lire les champs, puis</tspan><tspan x="24" dy="18.2">gérer le partage.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attestation acceptée</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Portée du partage</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Champs publics seuls · Tous les champs ✓</tspan></text>
+<rect x="24" y="277.5" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Pour partager les champs privés</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Choisir un vérificateur autorisé : Bureau</tspan><tspan x="34" dy="18.2">Exemple</tspan></text>
+<rect x="24" y="364.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Durée du partage</tspan></text>
+<text x="34" y="393.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Jusqu’à révocation · Aucun renouvellement</tspan></text>
+<rect x="24" y="434.09999999999997" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="443.09999999999997" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Aperçu pour Bureau Exemple</tspan></text>
+<text x="34" y="463.09999999999997" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Nom, formation, date · Connexion requise</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Vérifier puis créer le partage</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Voir et révoquer mes partages</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Après création : lien et QR. Un lien transféré ne</tspan><tspan x="24" dy="15.600000000000001">donne pas les champs privés à un autre</tspan><tspan x="24" dy="15.600000000000001">vérificateur.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/recipient/wireframes.en.excalidraw b/docs/ux/recipient/wireframes.en.excalidraw
new file mode 100644
index 0000000..2f301bd
--- /dev/null
+++ b/docs/ux/recipient/wireframes.en.excalidraw
@@ -0,0 +1,4037 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "R1-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Recipient",
+      "originalText": "XCS / Recipient",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "An attestation for you",
+      "originalText": "An attestation for you",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop invites you to receive an\nattestation.",
+      "originalText": "Example Workshop invites you to receive an\nattestation.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "1 of 4 · Claim invitation",
+      "originalText": "1 of 4 · Claim invitation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Offered by",
+      "originalText": "Offered by",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop",
+      "originalText": "Example Workshop",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attestation type",
+      "originalText": "Attestation type",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Course completion",
+      "originalText": "Course completion",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your account",
+      "originalText": "Your account",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sign in or create an XRP Identity account",
+      "originalText": "Sign in or create an XRP Identity account",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Next step",
+      "originalText": "Next step",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Link a wallet to receive the attestation",
+      "originalText": "Link a wallet to receive the attestation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Continue with XRP Identity",
+      "originalText": "Continue with XRP Identity",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Check the account before claiming the invitation.\nSigning in does not require a wallet.",
+      "originalText": "Check the account before claiming the invitation.\nSigning in does not require a wallet.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-en-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Recipient",
+      "originalText": "XCS / Recipient",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Link my wallet",
+      "originalText": "Link my wallet",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Prove that you control the receiving\naddress.",
+      "originalText": "Prove that you control the receiving\naddress.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "2 of 4 · Wallet",
+      "originalText": "2 of 4 · Wallet",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose a wallet",
+      "originalText": "Choose a wallet",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Detected compatible wallets",
+      "originalText": "Detected compatible wallets",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Do not have one?",
+      "originalText": "Do not have one?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "See installation guidance",
+      "originalText": "See installation guidance",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Check before continuing",
+      "originalText": "Check before continuing",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Selected account · Testnet network",
+      "originalText": "Selected account · Testnet network",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "What you authorize",
+      "originalText": "What you authorize",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Proof of control, not a transaction",
+      "originalText": "Proof of control, not a transaction",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Connect and prove control",
+      "originalText": "Connect and prove control",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-21",
+      "type": "text",
+      "x": 464,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your keys stay in the wallet. The issuer is\nnotified after the proof is verified.",
+      "originalText": "Your keys stay in the wallet. The issuer is\nnotified after the proof is verified.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-en-22",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Recipient",
+      "originalText": "XCS / Recipient",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "My attestations",
+      "originalText": "My attestations",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "See what is ready and what is still\npending.",
+      "originalText": "See what is ready and what is still\npending.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "3 of 4 · Inbox",
+      "originalText": "3 of 4 · Inbox",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ready to accept · 1",
+      "originalText": "Ready to accept · 1",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XRPL introduction · Example Workshop",
+      "originalText": "XRPL introduction · Example Workshop",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Being prepared · 0",
+      "originalText": "Being prepared · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Invitations awaiting issuance appear here",
+      "originalText": "Invitations awaiting issuance appear here",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Accepted · 0",
+      "originalText": "Accepted · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Accepted attestations appear here",
+      "originalText": "Accepted attestations appear here",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-17",
+      "type": "text",
+      "x": 914,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Inactive · 0",
+      "originalText": "Inactive · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-18",
+      "type": "text",
+      "x": 914,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Expired, revoked or declined",
+      "originalText": "Expired, revoked or declined",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-en-20",
+      "type": "text",
+      "x": 916,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review attestation",
+      "originalText": "Review attestation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-21",
+      "type": "text",
+      "x": 904,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "This workspace is private. It does not create a\npublic list of your attestations.",
+      "originalText": "This workspace is private. It does not create a\npublic list of your attestations.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-en-22",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Recipient",
+      "originalText": "XCS / Recipient",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review before accepting",
+      "originalText": "Review before accepting",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Read the content only with your consent.",
+      "originalText": "Read the content only with your consent.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1061.1,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 1071.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "4 of 4 · Ready to accept",
+      "originalText": "4 of 4 · Ready to accept",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1114.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 1123.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issuer and attestation",
+      "originalText": "Issuer and attestation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 1143.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Workshop · Course completion",
+      "originalText": "Example Workshop · Course completion",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1183.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 1192.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Content source",
+      "originalText": "Content source",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 1212.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Private XCS storage · Authorized reading",
+      "originalText": "Private XCS storage · Authorized reading",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1252.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 1261.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "After reading and checks",
+      "originalText": "After reading and checks",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 1281.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Show the fields and signing summary",
+      "originalText": "Show the fields and signing summary",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1321.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 1330.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Before signing",
+      "originalText": "Before signing",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 1350.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your account · Testnet · Show fee",
+      "originalText": "Your account · Testnet · Show fee",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1396.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 1409.8,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Allow reading the content",
+      "originalText": "Allow reading the content",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1450.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-en-22",
+      "type": "text",
+      "x": 36,
+      "y": 1463.8,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Decline without reading content",
+      "originalText": "Decline without reading content",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-23",
+      "type": "text",
+      "x": 24,
+      "y": 1507.9,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Unknown issuer: acknowledge before accepting.\nUntrusted issuer: acceptance blocked. Declining\ndownloads nothing.",
+      "originalText": "Unknown issuer: acknowledge before accepting.\nUntrusted issuer: acceptance blocked. Declining\ndownloads nothing.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-en-24",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Recipient",
+      "originalText": "XCS / Recipient",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Present my attestation",
+      "originalText": "Present my attestation",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose who can read the fields, then manage\nsharing.",
+      "originalText": "Choose who can read the fields, then manage\nsharing.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attestation accepted",
+      "originalText": "Attestation accepted",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sharing scope",
+      "originalText": "Sharing scope",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public fields only · All fields ✓",
+      "originalText": "Public fields only · All fields ✓",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "To share private fields",
+      "originalText": "To share private fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose an approved verifier: Example Office",
+      "originalText": "Choose an approved verifier: Example Office",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sharing duration",
+      "originalText": "Sharing duration",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Until revoked · No renewal required",
+      "originalText": "Until revoked · No renewal required",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1339.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Preview for Example Office",
+      "originalText": "Preview for Example Office",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 1368.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Name, course, date · Sign-in required",
+      "originalText": "Name, course, date · Sign-in required",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1415.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 1428,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Review and create sharing",
+      "originalText": "Review and create sharing",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1469.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-en-22",
+      "type": "text",
+      "x": 476,
+      "y": 1482,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View and revoke my sharing",
+      "originalText": "View and revoke my sharing",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-23",
+      "type": "text",
+      "x": 464,
+      "y": 1526.1,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "After creation: link and QR. A forwarded link\ndoes not give another verifier the private\nfields.",
+      "originalText": "After creation: link and QR. A forwarded link\ndoes not give another verifier the private\nfields.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-en-24",
+      "type": "text",
+      "x": 464,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/recipient/wireframes.fr.excalidraw b/docs/ux/recipient/wireframes.fr.excalidraw
new file mode 100644
index 0000000..98f61ab
--- /dev/null
+++ b/docs/ux/recipient/wireframes.fr.excalidraw
@@ -0,0 +1,4037 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "R1-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Destinataire",
+      "originalText": "XCS / Destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Une attestation pour vous",
+      "originalText": "Une attestation pour vous",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple vous invite à recevoir une\nattestation.",
+      "originalText": "Atelier Exemple vous invite à recevoir une\nattestation.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "1 sur 4 · Récupérer l’invitation",
+      "originalText": "1 sur 4 · Récupérer l’invitation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Proposée par",
+      "originalText": "Proposée par",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple",
+      "originalText": "Atelier Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Type d’attestation",
+      "originalText": "Type d’attestation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Fin de formation",
+      "originalText": "Fin de formation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre compte",
+      "originalText": "Votre compte",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Se connecter ou créer un compte XRP\nIdentity",
+      "originalText": "Se connecter ou créer un compte XRP\nIdentity",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 434.1,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 443.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Prochaine étape",
+      "originalText": "Prochaine étape",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 463.1,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Lier un portefeuille pour recevoir\nl’attestation",
+      "originalText": "Lier un portefeuille pour recevoir\nl’attestation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 527.5,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R1-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 540.4,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Continuer avec XRP Identity",
+      "originalText": "Continuer avec XRP Identity",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 584.5,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifiez le compte utilisé avant de récupérer\nl’invitation. Aucun portefeuille requis pour se\nconnecter.",
+      "originalText": "Vérifiez le compte utilisé avant de récupérer\nl’invitation. Aucun portefeuille requis pour se\nconnecter.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R1-fr-22",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Destinataire",
+      "originalText": "XCS / Destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Lier mon portefeuille",
+      "originalText": "Lier mon portefeuille",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Prouver que l’adresse de réception vous\nappartient.",
+      "originalText": "Prouver que l’adresse de réception vous\nappartient.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "2 sur 4 · Portefeuille",
+      "originalText": "2 sur 4 · Portefeuille",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choisir un portefeuille",
+      "originalText": "Choisir un portefeuille",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Liste des portefeuilles compatibles\ndétectés",
+      "originalText": "Liste des portefeuilles compatibles\ndétectés",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 295.70000000000005,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 304.70000000000005,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vous n’en avez pas ?",
+      "originalText": "Vous n’en avez pas ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 324.70000000000005,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir les instructions d’installation",
+      "originalText": "Voir les instructions d’installation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 364.90000000000003,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 373.90000000000003,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifier avant de continuer",
+      "originalText": "Vérifier avant de continuer",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 393.90000000000003,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Compte choisi · Réseau Testnet",
+      "originalText": "Compte choisi · Réseau Testnet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 434.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 443.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ce que vous autorisez",
+      "originalText": "Ce que vous autorisez",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 463.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Une preuve de contrôle, pas une transaction",
+      "originalText": "Une preuve de contrôle, pas une transaction",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 509.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R2-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 522.2,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Connecter puis prouver le contrôle",
+      "originalText": "Connecter puis prouver le contrôle",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-21",
+      "type": "text",
+      "x": 464,
+      "y": 566.3,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vos clés restent dans le portefeuille. L’émetteur\nsera informé après vérification de la preuve.",
+      "originalText": "Vos clés restent dans le portefeuille. L’émetteur\nsera informé après vérification de la preuve.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R2-fr-22",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Destinataire",
+      "originalText": "XCS / Destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Mes attestations",
+      "originalText": "Mes attestations",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retrouver ce qui est prêt et ce qui attend\nencore.",
+      "originalText": "Retrouver ce qui est prêt et ce qui attend\nencore.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "3 sur 4 · Boîte de réception",
+      "originalText": "3 sur 4 · Boîte de réception",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "À accepter · 1",
+      "originalText": "À accepter · 1",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Initiation XRPL · Atelier Exemple",
+      "originalText": "Initiation XRPL · Atelier Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "En préparation · 0",
+      "originalText": "En préparation · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vos invitations en attente apparaîtront ici",
+      "originalText": "Vos invitations en attente apparaîtront ici",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Acceptées · 0",
+      "originalText": "Acceptées · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vos attestations acceptées apparaîtront ici",
+      "originalText": "Vos attestations acceptées apparaîtront ici",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-17",
+      "type": "text",
+      "x": 914,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Inactives · 0",
+      "originalText": "Inactives · 0",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-18",
+      "type": "text",
+      "x": 914,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Expirées, révoquées ou refusées",
+      "originalText": "Expirées, révoquées ou refusées",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R3-fr-20",
+      "type": "text",
+      "x": 916,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Examiner l’attestation",
+      "originalText": "Examiner l’attestation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-21",
+      "type": "text",
+      "x": 904,
+      "y": 548.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Cet espace est privé. Il ne crée pas de liste\npublique de vos attestations.",
+      "originalText": "Cet espace est privé. Il ne crée pas de liste\npublique de vos attestations.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R3-fr-22",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Destinataire",
+      "originalText": "XCS / Destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Examiner avant d’accepter",
+      "originalText": "Examiner avant d’accepter",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Lire le contenu seulement après votre\naccord.",
+      "originalText": "Lire le contenu seulement après votre\naccord.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "4 sur 4 · À accepter",
+      "originalText": "4 sur 4 · À accepter",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émetteur et attestation",
+      "originalText": "Émetteur et attestation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Atelier Exemple · Fin de formation",
+      "originalText": "Atelier Exemple · Fin de formation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Source du contenu",
+      "originalText": "Source du contenu",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Hébergement privé XCS · Lecture sur\nautorisation",
+      "originalText": "Hébergement privé XCS · Lecture sur\nautorisation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1288.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 1297.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Après lecture et contrôles",
+      "originalText": "Après lecture et contrôles",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 1317.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Afficher les champs et le résumé à signer",
+      "originalText": "Afficher les champs et le résumé à signer",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1358.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 1367.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Avant signature",
+      "originalText": "Avant signature",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 1387.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre compte · Testnet · Frais à afficher",
+      "originalText": "Votre compte · Testnet · Frais à afficher",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Autoriser la lecture du contenu",
+      "originalText": "Autoriser la lecture du contenu",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1487.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R4-fr-22",
+      "type": "text",
+      "x": 36,
+      "y": 1500.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Refuser sans lire le contenu",
+      "originalText": "Refuser sans lire le contenu",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-23",
+      "type": "text",
+      "x": 24,
+      "y": 1544.3,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émetteur inconnu : accord explicite avant\nacceptation. Émetteur non fiable : acceptation\nbloquée. Refuser ne télécharge rien.",
+      "originalText": "Émetteur inconnu : accord explicite avant\nacceptation. Émetteur non fiable : acceptation\nbloquée. Refuser ne télécharge rien.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R4-fr-24",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Destinataire",
+      "originalText": "XCS / Destinataire",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Présenter mon attestation",
+      "originalText": "Présenter mon attestation",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choisir qui peut lire les champs, puis\ngérer le partage.",
+      "originalText": "Choisir qui peut lire les champs, puis\ngérer le partage.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attestation acceptée",
+      "originalText": "Attestation acceptée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Portée du partage",
+      "originalText": "Portée du partage",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Champs publics seuls · Tous les champs ✓",
+      "originalText": "Champs publics seuls · Tous les champs ✓",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1201.5,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Pour partager les champs privés",
+      "originalText": "Pour partager les champs privés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 1230.5,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choisir un vérificateur autorisé : Bureau\nExemple",
+      "originalText": "Choisir un vérificateur autorisé : Bureau\nExemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1288.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 1297.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Durée du partage",
+      "originalText": "Durée du partage",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 1317.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Jusqu’à révocation · Aucun renouvellement",
+      "originalText": "Jusqu’à révocation · Aucun renouvellement",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1358.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 1367.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aperçu pour Bureau Exemple",
+      "originalText": "Aperçu pour Bureau Exemple",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 1387.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Nom, formation, date · Connexion requise",
+      "originalText": "Nom, formation, date · Connexion requise",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifier puis créer le partage",
+      "originalText": "Vérifier puis créer le partage",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 1487.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "R5-fr-22",
+      "type": "text",
+      "x": 476,
+      "y": 1500.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir et révoquer mes partages",
+      "originalText": "Voir et révoquer mes partages",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-23",
+      "type": "text",
+      "x": 464,
+      "y": 1544.3,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Après création : lien et QR. Un lien transféré ne\ndonne pas les champs privés à un autre\nvérificateur.",
+      "originalText": "Après création : lien et QR. Un lien transféré ne\ndonne pas les champs privés à un autre\nvérificateur.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "R5-fr-24",
+      "type": "text",
+      "x": 464,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/render-wireframes.mjs b/docs/ux/render-wireframes.mjs
new file mode 100644
index 0000000..7a2b1f3
--- /dev/null
+++ b/docs/ux/render-wireframes.mjs
@@ -0,0 +1,298 @@
+// Generate offline review artifacts from the bilingual screen catalog; no application code runs.
+import { readFile, writeFile, mkdir } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const root = dirname(fileURLToPath(import.meta.url))
+const screens = JSON.parse(await readFile(join(root, 'screens.json'), 'utf8'))
+const check = process.argv.includes('--check')
+const roles = {
+  admin: ['Administration', 'Administration'],
+  issuer: ['Émetteur', 'Issuer'],
+  recipient: ['Destinataire', 'Recipient'],
+  verifier: ['Vérificateur', 'Verifier'],
+  shared: ['États partagés', 'Shared states'],
+}
+const locales = ['fr', 'en']
+const W = 390
+const H = 844
+const outputs = new Map()
+const escape = (value) =>
+  String(value).replace(
+    /[&<>"']/g,
+    (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c],
+  )
+
+function wrap(value, max) {
+  const lines = ['']
+  for (const word of value.split(/\s+/)) {
+    if ((lines.at(-1) + ' ' + word).trim().length > max && lines.at(-1)) lines.push('')
+    lines[lines.length - 1] = (lines.at(-1) + ' ' + word).trim()
+  }
+  return lines.join('\n')
+}
+
+function primitives(screen, locale) {
+  const index = locales.indexOf(locale)
+  const list = []
+  const rect = (x, y, width, height, fill = '#ffffff', stroke = '#b4b4b4') =>
+    list.push({ type: 'rectangle', x, y, width, height, fill, stroke })
+  const text = (value, x, y, fontSize = 14, max = 44, color = '#252525') => {
+    const content = wrap(value, max)
+    const height = content.split('\n').length * fontSize * 1.3
+    list.push({ type: 'text', x, y, width: W - x - 24, height, fontSize, content, color })
+    return height
+  }
+  rect(0, 0, W, H, '#ffffff', '#777777')
+  rect(0, 0, W, 42, '#eeeeee', '#777777')
+  text(`XCS  /  ${roles[screen.role][index]}`, 20, 12, 13)
+  let y = 62
+  y += text(screen.title[index], 24, y, 23, 25) + 12
+  y += text(screen.intro[index], 24, y, 14, 43) + 15
+  const statusText = wrap(screen.status[index], 43)
+  const statusHeight = statusText.split('\n').length * 17 + 20
+  rect(24, y, 342, statusHeight, '#eeeeee')
+  text(screen.status[index], 34, y + 10, 13, 43)
+  y += statusHeight + 16
+  for (const [label, value] of screen.rows) {
+    const labelHeight = wrap(label[index], 43).split('\n').length * 17
+    const valueHeight = wrap(value[index], 43).split('\n').length * 18.2
+    const height = labelHeight + valueHeight + 24
+    rect(24, y, 342, height)
+    text(label[index], 34, y + 9, 13, 43, '#555555')
+    text(value[index], 34, y + 12 + labelHeight, 14, 43)
+    y += height + 10
+  }
+  y += 6
+  for (const [actionIndex, action] of screen.actions.entries()) {
+    const label = wrap(action[index], 40)
+    const height = Math.max(44, label.split('\n').length * 18.2 + 20)
+    rect(24, y, 342, height, actionIndex === 0 ? '#333333' : '#ffffff', '#333333')
+    text(
+      action[index],
+      36,
+      y + (height - label.split('\n').length * 18.2) / 2,
+      14,
+      40,
+      actionIndex === 0 ? '#ffffff' : '#252525',
+    )
+    y += height + 10
+  }
+  y += text(screen.note[index], 24, y + 3, 12, 49, '#555555') + 9
+  if (y > H - 30) throw new Error(`${screen.id}/${locale}: content exceeds mobile frame (${y})`)
+  text(
+    index === 0
+      ? 'MAQUETTE · Exemple fictif · Non fonctionnel'
+      : 'WIREFRAME · Fictional example · Non-functional',
+    24,
+    H - 23,
+    10,
+    60,
+    '#666666',
+  )
+  return list
+}
+
+function svg(screen, locale, items) {
+  const index = locales.indexOf(locale)
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${W}" height="${H}" viewBox="0 0 ${W} ${H}" role="img" aria-labelledby="title desc" xml:lang="${locale}">
+<title id="title">${screen.id} — ${escape(screen.title[index])}</title>
+<desc id="desc">${escape(screen.intro[index])} ${escape(screen.note[index])}</desc>
+${items
+  .map((item) =>
+    item.type === 'rectangle'
+      ? `<rect x="${item.x}" y="${item.y}" width="${item.width}" height="${item.height}" rx="3" fill="${item.fill}" stroke="${item.stroke}"/>`
+      : `<text x="${item.x}" y="${item.y}" font-family="Arial, sans-serif" font-size="${item.fontSize}" fill="${item.color}" dominant-baseline="text-before-edge">${item.content
+          .split('\n')
+          .map(
+            (line, i) =>
+              `<tspan x="${item.x}" dy="${i === 0 ? 0 : item.fontSize * 1.3}">${escape(line)}</tspan>`,
+          )
+          .join('')}</text>`,
+  )
+  .join('\n')}
+</svg>\n`
+}
+
+function sceneElement(item, id, offsetX, offsetY) {
+  const base = {
+    id,
+    type: item.type,
+    x: item.x + offsetX,
+    y: item.y + offsetY,
+    width: item.width,
+    height: item.height,
+    angle: 0,
+    strokeColor: item.type === 'text' ? item.color : item.stroke,
+    backgroundColor: item.fill ?? 'transparent',
+    fillStyle: 'solid',
+    strokeWidth: 1,
+    strokeStyle: 'solid',
+    roughness: 0,
+    opacity: 100,
+    groupIds: [],
+    frameId: null,
+    roundness: null,
+    seed: 1,
+    version: 1,
+    versionNonce: 1,
+    isDeleted: false,
+    boundElements: null,
+    updated: 1,
+    created: null,
+    link: null,
+    locked: false,
+  }
+  if (item.type === 'text')
+    Object.assign(base, {
+      text: item.content,
+      originalText: item.content,
+      fontSize: item.fontSize,
+      fontFamily: 2,
+      textAlign: 'left',
+      verticalAlign: 'top',
+      containerId: null,
+      autoResize: true,
+      lineHeight: 1.3,
+    })
+  return base
+}
+
+const seen = new Set()
+for (const screen of screens) {
+  if (seen.has(screen.id) || !/^[AIRVF][1-6]$/.test(screen.id) || !roles[screen.role])
+    throw new Error(`Invalid screen: ${screen.id}`)
+  seen.add(screen.id)
+  const pairs = [
+    screen.title,
+    screen.intro,
+    screen.status,
+    screen.note,
+    ...screen.actions,
+    ...screen.rows.flat(),
+  ]
+  if (
+    pairs.some(
+      (pair) =>
+        !Array.isArray(pair) ||
+        pair.length !== 2 ||
+        pair.some((value) => typeof value !== 'string' || !value.trim()),
+    )
+  )
+    throw new Error(`Missing FR/EN copy: ${screen.id}`)
+}
+
+for (const role of Object.keys(roles)) {
+  const roleScreens = screens.filter((screen) => screen.role === role)
+  for (const locale of locales) {
+    const elements = []
+    for (const [screenIndex, screen] of roleScreens.entries()) {
+      const items = primitives(screen, locale)
+      outputs.set(`${role}/${screen.id.toLowerCase()}.${locale}.svg`, svg(screen, locale, items))
+      const x = (screenIndex % 3) * (W + 50)
+      const y = Math.floor(screenIndex / 3) * (H + 80)
+      items.forEach((item, i) =>
+        elements.push(sceneElement(item, `${screen.id}-${locale}-${i}`, x, y)),
+      )
+    }
+    outputs.set(
+      `${role}/wireframes.${locale}.excalidraw`,
+      JSON.stringify(
+        {
+          type: 'excalidraw',
+          version: 2,
+          source: 'https://excalidraw.com',
+          elements,
+          appState: { viewBackgroundColor: '#f5f5f5', gridSize: null },
+          files: {},
+        },
+        null,
+        2,
+      ) + '\n',
+    )
+  }
+}
+
+const html = `<!doctype html>
+<html lang="fr">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>XCS — parcours et maquettes / journeys and wireframes</title>
+<style>
+* { box-sizing: border-box; }
+body { margin: 0; background: #f4f4f4; color: #242424; font: 16px/1.5 system-ui, sans-serif; }
+header, main { max-width: 1360px; margin: auto; padding: 24px; }
+h1 { font-size: clamp(1.6rem, 4vw, 2.5rem); line-height: 1.15; }
+a { color: #222; text-underline-offset: 3px; }
+a:focus-visible, input:focus-visible { outline: 3px solid #333; outline-offset: 4px; }
+nav { display: flex; flex-wrap: wrap; gap: 8px 24px; margin: 16px 0; }
+nav a, .downloads a { display: inline-block; padding: 10px 0; min-height: 44px; }
+.notice { border-left: 4px solid #555; padding: 12px 16px; background: #fff; max-width: 850px; }
+.language { display: inline-block; padding: 12px 8px 12px 0; cursor: pointer; }
+.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 340px), 1fr)); gap: 24px; align-items: start; }
+figure { margin: 0; min-width: 0; }
+figcaption { margin: 10px 0; font-size: 14px; }
+img { display: block; width: 100%; max-width: 390px; height: auto; margin: 0 auto; }
+section { scroll-margin-top: 12px; margin: 36px 0 56px; }
+.en { display: none; }
+body:has(#locale-en:checked) .fr { display: none; }
+body:has(#locale-en:checked) .en { display: revert; }
+@media print { nav, .language, input { display: none; } figure { break-inside: avoid; } }
+</style></head>
+<body><header>
+<p>ISSUE #29 / XCS</p>
+<h1>Parcours et maquettes<br><span lang="en">Journeys and wireframes</span></h1>
+<p class="notice fr">Proposition à tester avec deux personnes par rôle. Aucune session réalisée. Données fictives ; les boutons dessinés ne réalisent aucune action.</p>
+<p class="notice en" lang="en">Draft for testing with two people per role. No sessions conducted. Fictional data; controls drawn in the screens perform no action.</p>
+<input type="radio" id="locale-fr" name="locale" checked><label class="language" for="locale-fr">Français</label>
+<input type="radio" id="locale-en" name="locale"><label class="language" for="locale-en" lang="en">English</label>
+<nav aria-label="Rôles / Roles">${Object.entries(roles)
+  .map(
+    ([role, names]) =>
+      `<a href="#${role}"><span class="fr">${escape(names[0])}</span><span class="en" lang="en">${escape(names[1])}</span></a>`,
+  )
+  .join('')}</nav>
+<p><a href="README.md">Contexte et décisions / Context and decisions</a> · <a href="usability.md">Protocole et sessions / Protocol and sessions</a></p>
+</header><main>
+${Object.entries(roles)
+  .map(
+    ([
+      role,
+      names,
+    ]) => `<section id="${role}"><h2><span class="fr">${escape(names[0])}</span><span class="en" lang="en">${escape(names[1])}</span></h2>
+<p class="downloads"><a href="${role}/README.md">Parcours / Journey</a> · <a href="${role}/wireframes.fr.excalidraw" download>Excalidraw FR</a> · <a href="${role}/wireframes.en.excalidraw" download>Excalidraw EN</a></p>
+<div class="grid">${screens
+      .filter((screen) => screen.role === role)
+      .map(
+        (screen) =>
+          `<figure>${locales.map((locale, index) => `<div class="${locale}" lang="${locale}"><figcaption><a href="${role}/${screen.id.toLowerCase()}.${locale}.svg">${screen.id} — ${escape(screen.title[index])}</a></figcaption><img src="${role}/${screen.id.toLowerCase()}.${locale}.svg" width="${W}" height="${H}" alt="${escape(screen.title[index])}. ${escape(screen.intro[index])}"></div>`).join('')}</figure>`,
+      )
+      .join('')}</div></section>`,
+  )
+  .join('\n')}
+</main></body></html>\n`
+outputs.set('index.html', html)
+
+// HTML is intentionally compared structurally so Prettier may normalize whitespace on disk.
+const normalizeHtml = (value) => value.replace(/\s+/g, '').replace(/\/>/g, '>').replace(/;}/g, '}')
+let failures = 0
+for (const [relative, content] of outputs) {
+  const path = join(root, relative)
+  if (check) {
+    const existing = await readFile(path, 'utf8').catch(() => '')
+    const equal = relative.endsWith('.html')
+      ? normalizeHtml(existing) === normalizeHtml(content)
+      : existing === content
+    if (!equal) {
+      console.error(`Out of date: ${relative}`)
+      failures++
+    }
+  } else {
+    await mkdir(dirname(path), { recursive: true })
+    await writeFile(path, content)
+  }
+}
+if (failures) process.exitCode = 1
+else
+  console.log(
+    `${check ? 'Checked' : 'Generated'} ${screens.length} bilingual screens, ${outputs.size} artifacts.`,
+  )
diff --git a/docs/ux/screens.json b/docs/ux/screens.json
new file mode 100644
index 0000000..c02501a
--- /dev/null
+++ b/docs/ux/screens.json
@@ -0,0 +1,782 @@
+[
+  {
+    "id": "A1",
+    "role": "admin",
+    "title": ["Demandes à examiner", "Applications to review"],
+    "intro": ["Commencer par la demande la plus ancienne.", "Start with the oldest application."],
+    "status": ["2 demandes en attente", "2 applications pending"],
+    "rows": [
+      [
+        ["Filtrer par rôle", "Filter by role"],
+        ["Tous · Émetteur · Vérificateur", "All · Issuer · Verifier"]
+      ],
+      [
+        ["Atelier Exemple · Émetteur", "Example Workshop · Issuer"],
+        ["Reçue le 21 septembre · Dossier complet", "Received 21 September · Complete file"]
+      ],
+      [
+        ["Bureau Exemple · Vérificateur", "Example Office · Verifier"],
+        ["Reçue le 22 septembre · À examiner", "Received 22 September · Needs review"]
+      ],
+      [
+        ["Autres actions", "Other actions"],
+        ["Accès des vérificateurs · Journal", "Verifier permissions · Audit history"]
+      ]
+    ],
+    "actions": [["Examiner Atelier Exemple", "Review Example Workshop"]],
+    "note": [
+      "Autoriser l’accès à l’application ne valide pas les attestations d’un émetteur.",
+      "Approving application access does not endorse an issuer’s attestations."
+    ]
+  },
+  {
+    "id": "A2",
+    "role": "admin",
+    "title": ["Examiner la demande", "Review application"],
+    "intro": [
+      "L’organisation est-elle identifiable ? Quel accès autoriser ?",
+      "Can I identify this organization? Which access should I grant?"
+    ],
+    "status": ["Émetteur · En attente d’examen", "Issuer · Awaiting review"],
+    "rows": [
+      [
+        ["Atelier Exemple", "Example Workshop"],
+        ["Formation · France · Contact fourni", "Training · France · Contact provided"]
+      ],
+      [
+        ["Justificatifs", "Supporting documents"],
+        ["Voir le document ↗ Nouvel onglet", "View document ↗ New tab"]
+      ],
+      [
+        ["Portefeuille et historique", "Wallet and timeline"],
+        ["Adresse liée · Demande reçue le 21/09", "Address linked · Applied on 21 Sep"]
+      ],
+      [
+        ["En cas de refus", "If declining"],
+        ["Motif obligatoire : expliquer la décision", "Required reason: explain the decision"]
+      ]
+    ],
+    "actions": [
+      ["Autoriser le rôle émetteur", "Approve issuer access"],
+      ["Refuser avec un motif", "Decline with a reason"]
+    ],
+    "note": [
+      "La décision sera journalisée. Une notification sera mise en attente d’envoi.",
+      "The decision is audited. A notification will be queued for sending."
+    ]
+  },
+  {
+    "id": "A3",
+    "role": "admin",
+    "title": ["Autorisation du vérificateur", "Verifier approval"],
+    "intro": [
+      "Gérer son accès au portail, sans ouvrir les champs privés.",
+      "Manage portal access without unlocking private fields."
+    ],
+    "status": ["Bureau Exemple · Accès autorisé", "Example Office · Access approved"],
+    "rows": [
+      [
+        ["Organisation", "Organization"],
+        ["Bureau Exemple · Identité vérifiée", "Example Office · Verified identity"]
+      ],
+      [
+        ["Autorisation globale", "Global approval"],
+        ["Active · Le rôle vérificateur est autorisé", "Active · Verifier role approved"]
+      ],
+      [
+        ["Lecture des champs privés", "Reading private fields"],
+        [
+          "Accord du destinataire pour ce vérificateur requis",
+          "Recipient grant for this verifier required"
+        ]
+      ],
+      [
+        ["Retirer l’autorisation", "Withdraw approval"],
+        ["Bloque les prochains accès privés", "Blocks future private access"]
+      ]
+    ],
+    "actions": [
+      ["Suspendre l’autorisation…", "Suspend approval…"],
+      ["Voir les décisions", "View decisions"]
+    ],
+    "note": [
+      "Aucune liste par émetteur. L’administrateur ne peut pas s’accorder la lecture des champs privés.",
+      "No issuer allowlist. An administrator cannot grant themselves access to private claims."
+    ]
+  },
+  {
+    "id": "A4",
+    "role": "admin",
+    "title": ["Historique des décisions", "Decision history"],
+    "intro": ["Qui a modifié les accès, quand et pourquoi ?", "Who changed access, when, and why?"],
+    "status": ["Journal administratif", "Administrative audit"],
+    "rows": [
+      [
+        ["23 septembre · Admin A", "23 September · Admin A"],
+        ["Atelier Exemple : en attente → autorisé", "Example Workshop: pending → approved"]
+      ],
+      [
+        ["23 septembre · Admin B", "23 September · Admin B"],
+        ["Bureau Exemple : autorisation suspendue", "Example Office: approval suspended"]
+      ],
+      [
+        ["Avant / Après", "Before / After"],
+        ["Autorisation active → Suspendue", "Approval active → Suspended"]
+      ],
+      [
+        ["Motif", "Reason"],
+        ["Examen des justificatifs terminé", "Supporting evidence review completed"]
+      ]
+    ],
+    "actions": [["Retour aux demandes", "Back to applications"]],
+    "note": [
+      "Le journal ne contient ni contenu d’attestation ni document privé.",
+      "The audit contains no credential claims or private document contents."
+    ]
+  },
+  {
+    "id": "I1",
+    "role": "issuer",
+    "title": ["Devenir émetteur", "Apply as an issuer"],
+    "intro": [
+      "Présenter votre organisation pour demander l’accès.",
+      "Tell us about your organization to request access."
+    ],
+    "status": ["Compte connecté · Accès à demander", "Signed in · Access required"],
+    "rows": [
+      [
+        ["Organisation et site web", "Organization and website"],
+        ["Atelier Exemple · Site de l’organisation", "Example Workshop · Organization website"]
+      ],
+      [
+        ["Contact et pays", "Contact and jurisdiction"],
+        ["Contact professionnel · France", "Work contact · France"]
+      ],
+      [
+        ["Usage prévu", "Intended use"],
+        ["Attester la fin d’une formation", "Issue course completion attestations"]
+      ],
+      [
+        ["Justificatif de l’organisation", "Organization evidence"],
+        ["Choisir un fichier · Accès restreint", "Choose a file · Restricted access"]
+      ]
+    ],
+    "actions": [["Envoyer ma demande", "Submit application"]],
+    "note": [
+      "Ces justificatifs servent à l’examen de la demande. Ils ne seront pas publiés sur le ledger.",
+      "These documents support the application review. They will not be published on the ledger."
+    ]
+  },
+  {
+    "id": "I2",
+    "role": "issuer",
+    "title": ["Votre demande", "Your application"],
+    "intro": ["Vous serez informé après son examen.", "You will be notified after the review."],
+    "status": ["En attente d’examen", "Awaiting review"],
+    "rows": [
+      [
+        ["Organisation", "Organization"],
+        ["Atelier Exemple", "Example Workshop"]
+      ],
+      [
+        ["Demande envoyée", "Application submitted"],
+        ["23 septembre · Rôle émetteur", "23 September · Issuer role"]
+      ],
+      [
+        ["Étape suivante", "Next step"],
+        ["Après autorisation : créer votre modèle", "Once approved: create your template"]
+      ],
+      [
+        ["Si la demande est refusée", "If the application is declined"],
+        ["Le motif et la prochaine étape s’affichent ici", "The reason and next step appear here"]
+      ]
+    ],
+    "actions": [["Consulter les schémas publics", "Browse public schemas"]],
+    "note": [
+      "L’émission depuis cet espace sera disponible après autorisation.",
+      "Issuing from this workspace becomes available after approval."
+    ]
+  },
+  {
+    "id": "I3",
+    "role": "issuer",
+    "title": ["Créer un modèle", "Create a template"],
+    "intro": [
+      "Définir les informations de votre attestation.",
+      "Choose what your attestation will contain."
+    ],
+    "status": ["Étape 1 · Schéma public", "Step 1 · Public schema"],
+    "rows": [
+      [
+        ["Partir d’un modèle", "Start from a template"],
+        ["Fin de formation ✓ · Diplôme", "Course completion ✓ · Diploma"]
+      ],
+      [
+        ["Champs du modèle", "Template fields"],
+        ["Nom : texte · Formation : texte · Date : date", "Name: text · Course: text · Date: date"]
+      ],
+      [
+        ["Aperçu", "Preview"],
+        ["Nom du destinataire · Formation · Date de fin", "Learner name · Course · Completion date"]
+      ],
+      [
+        ["Avant signature", "Before signing"],
+        [
+          "Compte : Atelier Exemple · Testnet · Frais à afficher",
+          "Account: Example Workshop · Testnet · Show fee"
+        ]
+      ]
+    ],
+    "actions": [
+      ["Vérifier puis publier", "Review and publish"],
+      ["Détails techniques", "Technical details"]
+    ],
+    "note": [
+      "Le schéma devient public. Aucune donnée réelle de destinataire n’est saisie à cette étape.",
+      "The schema becomes public. No actual learner data is entered at this step."
+    ]
+  },
+  {
+    "id": "I4",
+    "role": "issuer",
+    "title": ["Inviter un destinataire", "Invite a learner"],
+    "intro": [
+      "Il choisira son compte et liera son portefeuille.",
+      "They will choose their account and link a wallet."
+    ],
+    "status": ["Étape 2 · Invitation", "Step 2 · Invitation"],
+    "rows": [
+      [
+        ["E-mail du destinataire", "Learner email"],
+        ["camille@example.invalid", "camille@example.invalid"]
+      ],
+      [
+        ["Votre schéma", "Your schema"],
+        ["Fin de formation · Atelier Exemple", "Course completion · Example Workshop"]
+      ],
+      [
+        ["Message facultatif", "Optional message"],
+        ["Votre attestation sera bientôt disponible.", "Your attestation will be available soon."]
+      ],
+      [
+        ["Suivi des invitations", "Invitation tracking"],
+        ["Envoyée → Récupérée → Portefeuille lié", "Sent → Claimed → Wallet linked"]
+      ]
+    ],
+    "actions": [
+      ["Envoyer l’invitation", "Send invitation"],
+      ["Voir les invitations", "View invitations"]
+    ],
+    "note": [
+      "Renvoyer ou révoquer depuis la liste. Émettre seulement après la liaison du portefeuille.",
+      "Resend or revoke from the list. Issue only after the wallet is linked."
+    ]
+  },
+  {
+    "id": "I5",
+    "role": "issuer",
+    "title": ["Vérifier et émettre", "Review and issue"],
+    "intro": [
+      "Confirmer le contenu, le destinataire et la visibilité.",
+      "Confirm the content, recipient and visibility."
+    ],
+    "status": ["Camille Exemple · Portefeuille lié", "Camille Example · Wallet linked"],
+    "rows": [
+      [
+        ["Attestation", "Attestation"],
+        ["Fin de formation · Initiation XRPL", "Course completion · XRPL introduction"]
+      ],
+      [
+        ["Champs à remplir", "Fields to complete"],
+        ["Nom : Camille Exemple · Date : 23/09/2026", "Name: Camille Example · Date: 23 Sep 2026"]
+      ],
+      [
+        ["Visibilité : privée", "Visibility: private"],
+        ["Public : formation · Restreint : nom, date", "Public: course · Restricted: name, date"]
+      ],
+      [
+        ["Signature", "Signature"],
+        ["Atelier Exemple · Testnet · Frais à afficher", "Example Workshop · Testnet · Show fee"]
+      ]
+    ],
+    "actions": [
+      ["Signer dans mon portefeuille", "Sign in my wallet"],
+      ["Modifier la visibilité", "Change visibility"]
+    ],
+    "note": [
+      "Hébergement privé requis. Adresse et cycle de vie restent publics sur XRPL. Détails techniques disponibles.",
+      "Private hosting required. Address and lifecycle remain public on XRPL. Technical details available."
+    ]
+  },
+  {
+    "id": "I6",
+    "role": "issuer",
+    "title": ["Suivre l’attestation", "Track attestation"],
+    "intro": [
+      "Suivre l’émission, le contenu et l’acceptation.",
+      "Track issuance, content and acceptance separately."
+    ],
+    "status": ["Émise · En attente d’acceptation", "Issued · Awaiting acceptance"],
+    "rows": [
+      [
+        ["Destinataire et formation", "Learner and course"],
+        ["Camille Exemple · Initiation XRPL", "Camille Example · XRPL introduction"]
+      ],
+      [
+        ["Émission sur XRPL", "XRPL issuance"],
+        ["Confirmée sur le ledger", "Validated on the ledger"]
+      ],
+      [
+        ["Disponibilité du contenu", "Content availability"],
+        ["Publié · Accès privé", "Published · Restricted access"]
+      ],
+      [
+        ["Acceptation et notification", "Acceptance and notification"],
+        [
+          "Acceptation en attente · Notification en file",
+          "Acceptance pending · Notification queued"
+        ]
+      ]
+    ],
+    "actions": [
+      ["Actualiser le statut", "Refresh status"],
+      ["Révoquer l’attestation…", "Revoke attestation…"]
+    ],
+    "note": [
+      "Révoquer demande confirmation et signature. Une publication en attente se reprend sans réémettre.",
+      "Revocation needs confirmation and signing. Pending publication resumes without issuing again."
+    ]
+  },
+  {
+    "id": "R1",
+    "role": "recipient",
+    "title": ["Une attestation pour vous", "An attestation for you"],
+    "intro": [
+      "Atelier Exemple vous invite à recevoir une attestation.",
+      "Example Workshop invites you to receive an attestation."
+    ],
+    "status": ["1 sur 4 · Récupérer l’invitation", "1 of 4 · Claim invitation"],
+    "rows": [
+      [
+        ["Proposée par", "Offered by"],
+        ["Atelier Exemple", "Example Workshop"]
+      ],
+      [
+        ["Type d’attestation", "Attestation type"],
+        ["Fin de formation", "Course completion"]
+      ],
+      [
+        ["Votre compte", "Your account"],
+        [
+          "Se connecter ou créer un compte XRP Identity",
+          "Sign in or create an XRP Identity account"
+        ]
+      ],
+      [
+        ["Prochaine étape", "Next step"],
+        [
+          "Lier un portefeuille pour recevoir l’attestation",
+          "Link a wallet to receive the attestation"
+        ]
+      ]
+    ],
+    "actions": [["Continuer avec XRP Identity", "Continue with XRP Identity"]],
+    "note": [
+      "Vérifiez le compte utilisé avant de récupérer l’invitation. Aucun portefeuille requis pour se connecter.",
+      "Check the account before claiming the invitation. Signing in does not require a wallet."
+    ]
+  },
+  {
+    "id": "R2",
+    "role": "recipient",
+    "title": ["Lier mon portefeuille", "Link my wallet"],
+    "intro": [
+      "Prouver que l’adresse de réception vous appartient.",
+      "Prove that you control the receiving address."
+    ],
+    "status": ["2 sur 4 · Portefeuille", "2 of 4 · Wallet"],
+    "rows": [
+      [
+        ["Choisir un portefeuille", "Choose a wallet"],
+        ["Liste des portefeuilles compatibles détectés", "Detected compatible wallets"]
+      ],
+      [
+        ["Vous n’en avez pas ?", "Do not have one?"],
+        ["Voir les instructions d’installation", "See installation guidance"]
+      ],
+      [
+        ["Vérifier avant de continuer", "Check before continuing"],
+        ["Compte choisi · Réseau Testnet", "Selected account · Testnet network"]
+      ],
+      [
+        ["Ce que vous autorisez", "What you authorize"],
+        ["Une preuve de contrôle, pas une transaction", "Proof of control, not a transaction"]
+      ]
+    ],
+    "actions": [["Connecter puis prouver le contrôle", "Connect and prove control"]],
+    "note": [
+      "Vos clés restent dans le portefeuille. L’émetteur sera informé après vérification de la preuve.",
+      "Your keys stay in the wallet. The issuer is notified after the proof is verified."
+    ]
+  },
+  {
+    "id": "R3",
+    "role": "recipient",
+    "title": ["Mes attestations", "My attestations"],
+    "intro": [
+      "Retrouver ce qui est prêt et ce qui attend encore.",
+      "See what is ready and what is still pending."
+    ],
+    "status": ["3 sur 4 · Boîte de réception", "3 of 4 · Inbox"],
+    "rows": [
+      [
+        ["À accepter · 1", "Ready to accept · 1"],
+        ["Initiation XRPL · Atelier Exemple", "XRPL introduction · Example Workshop"]
+      ],
+      [
+        ["En préparation · 0", "Being prepared · 0"],
+        ["Vos invitations en attente apparaîtront ici", "Invitations awaiting issuance appear here"]
+      ],
+      [
+        ["Acceptées · 0", "Accepted · 0"],
+        ["Vos attestations acceptées apparaîtront ici", "Accepted attestations appear here"]
+      ],
+      [
+        ["Inactives · 0", "Inactive · 0"],
+        ["Expirées, révoquées ou refusées", "Expired, revoked or declined"]
+      ]
+    ],
+    "actions": [["Examiner l’attestation", "Review attestation"]],
+    "note": [
+      "Cet espace est privé. Il ne crée pas de liste publique de vos attestations.",
+      "This workspace is private. It does not create a public list of your attestations."
+    ]
+  },
+  {
+    "id": "R4",
+    "role": "recipient",
+    "title": ["Examiner avant d’accepter", "Review before accepting"],
+    "intro": [
+      "Lire le contenu seulement après votre accord.",
+      "Read the content only with your consent."
+    ],
+    "status": ["4 sur 4 · À accepter", "4 of 4 · Ready to accept"],
+    "rows": [
+      [
+        ["Émetteur et attestation", "Issuer and attestation"],
+        ["Atelier Exemple · Fin de formation", "Example Workshop · Course completion"]
+      ],
+      [
+        ["Source du contenu", "Content source"],
+        [
+          "Hébergement privé XCS · Lecture sur autorisation",
+          "Private XCS storage · Authorized reading"
+        ]
+      ],
+      [
+        ["Après lecture et contrôles", "After reading and checks"],
+        ["Afficher les champs et le résumé à signer", "Show the fields and signing summary"]
+      ],
+      [
+        ["Avant signature", "Before signing"],
+        ["Votre compte · Testnet · Frais à afficher", "Your account · Testnet · Show fee"]
+      ]
+    ],
+    "actions": [
+      ["Autoriser la lecture du contenu", "Allow reading the content"],
+      ["Refuser sans lire le contenu", "Decline without reading content"]
+    ],
+    "note": [
+      "Émetteur inconnu : accord explicite avant acceptation. Émetteur non fiable : acceptation bloquée. Refuser ne télécharge rien.",
+      "Unknown issuer: acknowledge before accepting. Untrusted issuer: acceptance blocked. Declining downloads nothing."
+    ]
+  },
+  {
+    "id": "R5",
+    "role": "recipient",
+    "title": ["Présenter mon attestation", "Present my attestation"],
+    "intro": [
+      "Choisir qui peut lire les champs, puis gérer le partage.",
+      "Choose who can read the fields, then manage sharing."
+    ],
+    "status": ["Attestation acceptée", "Attestation accepted"],
+    "rows": [
+      [
+        ["Portée du partage", "Sharing scope"],
+        ["Champs publics seuls · Tous les champs ✓", "Public fields only · All fields ✓"]
+      ],
+      [
+        ["Pour partager les champs privés", "To share private fields"],
+        [
+          "Choisir un vérificateur autorisé : Bureau Exemple",
+          "Choose an approved verifier: Example Office"
+        ]
+      ],
+      [
+        ["Durée du partage", "Sharing duration"],
+        ["Jusqu’à révocation · Aucun renouvellement", "Until revoked · No renewal required"]
+      ],
+      [
+        ["Aperçu pour Bureau Exemple", "Preview for Example Office"],
+        ["Nom, formation, date · Connexion requise", "Name, course, date · Sign-in required"]
+      ]
+    ],
+    "actions": [
+      ["Vérifier puis créer le partage", "Review and create sharing"],
+      ["Voir et révoquer mes partages", "View and revoke my sharing"]
+    ],
+    "note": [
+      "Après création : lien et QR. Un lien transféré ne donne pas les champs privés à un autre vérificateur.",
+      "After creation: link and QR. A forwarded link does not give another verifier the private fields."
+    ]
+  },
+  {
+    "id": "V1",
+    "role": "verifier",
+    "title": ["Demander l’accès complet", "Request full-detail access"],
+    "intro": [
+      "Présenter votre organisation et votre besoin.",
+      "Explain your organization and your need."
+    ],
+    "status": ["Vérification publique sans compte", "Public verification needs no account"],
+    "rows": [
+      [
+        ["Organisation", "Organization"],
+        ["Bureau Exemple", "Example Office"]
+      ],
+      [
+        ["But des vérifications", "Verification purpose"],
+        ["Vérifier les formations déclarées", "Check declared course completions"]
+      ],
+      [
+        ["Contact", "Contact"],
+        ["Contact professionnel de l’organisation", "Organization work contact"]
+      ],
+      [
+        ["Après l’envoi", "After submission"],
+        ["En attente ; si refus, motif affiché", "Pending; if declined, show the reason"]
+      ]
+    ],
+    "actions": [
+      ["Envoyer ma demande", "Submit application"],
+      ["Retour à la présentation", "Back to presentation"]
+    ],
+    "note": [
+      "Après autorisation globale, le destinataire doit partager avec votre identité de vérificateur.",
+      "After global approval, the recipient must share with your verifier identity."
+    ]
+  },
+  {
+    "id": "V2",
+    "role": "verifier",
+    "title": ["Vérification partielle", "Partially checked"],
+    "intro": [
+      "L’attestation est active. Le contenu complet n’a pas été contrôlé.",
+      "The attestation is active. Full content has not been checked."
+    ],
+    "status": ["Vue publique · Champs limités", "Public view · Limited fields"],
+    "rows": [
+      [
+        ["Quatre contrôles indépendants", "Four independent checks"],
+        ["Ledger : active · Schéma : valide", "Ledger: active · Schema: valid"]
+      ],
+      [
+        ["Contenu et confiance", "Content and trust"],
+        ["Contenu : non contrôlé · Émetteur : inconnu", "Payload: not checked · Issuer: unknown"]
+      ],
+      [
+        ["Champs publics", "Public fields"],
+        ["Formation : Initiation XRPL", "Course: XRPL introduction"]
+      ],
+      [
+        ["Pour lire les champs privés", "To read private fields"],
+        [
+          "Connexion + rôle autorisé + partage à votre nom",
+          "Sign-in + approved role + grant addressed to you"
+        ]
+      ]
+    ],
+    "actions": [
+      ["Se connecter ou demander l’accès", "Sign in or request access"],
+      ["Voir les preuves disponibles", "View available evidence"]
+    ],
+    "note": [
+      "L’autorisation d’utiliser XCS n’est pas une garantie de l’émetteur. Aucun score de confiance.",
+      "Permission to use XCS is not an endorsement of the issuer. There is no trust score."
+    ]
+  },
+  {
+    "id": "V3",
+    "role": "verifier",
+    "title": ["Émetteur non reconnu", "Issuer not recognized"],
+    "intro": [
+      "Les contrôles techniques ont réussi. Évaluez l’émetteur séparément.",
+      "Technical checks passed. Assess the issuer separately."
+    ],
+    "status": [
+      "Vue complète · Destinataire du partage vérifié",
+      "Full view · Sharing audience verified"
+    ],
+    "rows": [
+      [
+        ["Quatre contrôles indépendants", "Four independent checks"],
+        ["Ledger : active · Schéma : valide", "Ledger: active · Schema: valid"]
+      ],
+      [
+        ["Contenu et confiance", "Content and trust"],
+        ["Contenu : valide · Émetteur : inconnu", "Payload: valid · Issuer: unknown"]
+      ],
+      [
+        ["Champs complets", "Full fields"],
+        [
+          "Camille Exemple · Initiation XRPL · 23/09/2026",
+          "Camille Example · XRPL introduction · 23 Sep 2026"
+        ]
+      ],
+      [
+        ["Preuves détaillées", "Detailed evidence"],
+        ["Empreinte, source du contrôle, état du ledger", "Digest, check provenance, ledger state"]
+      ]
+    ],
+    "actions": [
+      ["Consulter les preuves", "Inspect evidence"],
+      ["Mon historique", "My history"]
+    ],
+    "note": [
+      "Les contrôles ne prouvent pas la vérité des déclarations. Identité, autorisation et partage sont revérifiés.",
+      "Checks do not prove claims are true. Identity, approval and sharing permission are rechecked."
+    ]
+  },
+  {
+    "id": "V4",
+    "role": "verifier",
+    "title": ["Mes vérifications", "My verification history"],
+    "intro": [
+      "Retrouver les résultats sans conserver les contenus.",
+      "Find past results without retaining credential contents."
+    ],
+    "status": ["Historique privé · Métadonnées", "Private history · Metadata only"],
+    "rows": [
+      [
+        ["23 septembre · Présentation A", "23 September · Presentation A"],
+        ["Vérification partielle", "Partially checked"]
+      ],
+      [
+        ["23 septembre · Présentation B", "23 September · Presentation B"],
+        ["Émetteur non reconnu", "Issuer not recognized"]
+      ],
+      [
+        ["Export CSV", "CSV export"],
+        ["Dates et résultats ; aucun champ privé", "Dates and results; no private fields"]
+      ],
+      [
+        ["Consulter à nouveau", "Open again"],
+        [
+          "Revérifier identité, autorisation et partage",
+          "Recheck identity, approval and sharing grant"
+        ]
+      ]
+    ],
+    "actions": [["Exporter les métadonnées", "Export metadata"]],
+    "note": [
+      "Un ancien résultat n’est pas une preuve actuelle. Partage révoqué ou autorisation retirée : aucun accès privé.",
+      "A past result is not current evidence. Revoked sharing or withdrawn approval means no private access."
+    ]
+  },
+  {
+    "id": "F1",
+    "role": "shared",
+    "title": ["Portefeuille indisponible", "Wallet unavailable"],
+    "intro": [
+      "Votre progression est conservée. Préparons le portefeuille.",
+      "Your progress is preserved. Let us get the wallet ready."
+    ],
+    "status": ["Aucune signature demandée", "No signature requested"],
+    "rows": [
+      [
+        ["Déjà installé ?", "Already installed?"],
+        ["Déverrouiller puis relancer la détection", "Unlock it, then refresh detection"]
+      ],
+      [
+        ["Pas encore installé ?", "Not installed yet?"],
+        ["Instructions pour un portefeuille compatible", "Guidance for a compatible wallet"]
+      ],
+      [
+        ["Réseau requis", "Required network"],
+        ["Testnet · Vérifier le compte sélectionné", "Testnet · Check the selected account"]
+      ]
+    ],
+    "actions": [
+      ["Relancer la détection", "Refresh detection"],
+      ["Choisir un autre portefeuille", "Choose another wallet"]
+    ],
+    "note": [
+      "Un compte XRP Identity ne remplace pas un portefeuille. Lire une présentation publique n’en demande pas.",
+      "An XRP Identity account does not replace a wallet. Reading a public presentation needs no wallet."
+    ]
+  },
+  {
+    "id": "F2",
+    "role": "shared",
+    "title": ["Invitation inutilisable", "Invitation unavailable"],
+    "intro": [
+      "Ce lien a expiré ou ne peut plus être utilisé.",
+      "This link has expired or can no longer be used."
+    ],
+    "status": ["Aucune invitation récupérée", "No invitation claimed"],
+    "rows": [
+      [
+        ["Que faire ?", "What can I do?"],
+        ["Demander une nouvelle invitation à l’émetteur", "Ask the issuer for a new invitation"]
+      ],
+      [
+        ["Votre compte", "Your account"],
+        ["Vous pourrez continuer avec le même compte", "You can continue with the same account"]
+      ],
+      [
+        ["Confidentialité", "Privacy"],
+        ["Aucune information de destinataire affichée", "No recipient information is displayed"]
+      ]
+    ],
+    "actions": [["Retour à mon espace", "Back to my workspace"]],
+    "note": [
+      "Utilisez votre contact habituel chez l’émetteur. Ce message ne révèle pas qui a utilisé le lien.",
+      "Use your known issuer contact. This message does not reveal who used the link."
+    ]
+  },
+  {
+    "id": "F3",
+    "role": "shared",
+    "title": ["Vérification indisponible", "Cannot verify now"],
+    "intro": [
+      "L’état actuel de l’attestation ne peut pas être confirmé.",
+      "The current attestation state cannot be confirmed."
+    ],
+    "status": ["Attendre des données à jour", "Waiting for current evidence"],
+    "rows": [
+      [
+        ["Ce que cela signifie", "What this means"],
+        [
+          "Ce n’est ni un résultat valide ni invalide",
+          "This is neither a valid nor an invalid result"
+        ]
+      ],
+      [
+        ["Une opération est déjà signée ?", "Already signed an operation?"],
+        ["Reprendre son suivi sans signer à nouveau", "Resume tracking without signing again"]
+      ],
+      [
+        ["Que faire ?", "What can I do?"],
+        ["Réessayer plus tard ou consulter le statut", "Retry later or check service status"]
+      ]
+    ],
+    "actions": [
+      ["Réessayer la vérification", "Retry verification"],
+      ["Voir l’état du service", "View service status"]
+    ],
+    "note": [
+      "Les nouvelles signatures attendent un état fiable. Vos clés restent toujours dans le portefeuille.",
+      "New signatures wait for reliable evidence. Your keys always stay in your wallet."
+    ]
+  }
+]
diff --git a/docs/ux/shared/README.md b/docs/ux/shared/README.md
new file mode 100644
index 0000000..3b8170a
--- /dev/null
+++ b/docs/ux/shared/README.md
@@ -0,0 +1,106 @@
+# Shared patterns and boundaries
+
+Draft for all four journeys. The bilingual catalog supplies visible labels; the English and French
+versions are reviewed together, not translated after implementation. Technical screen IDs are for
+review and handoff only.
+
+## One layout and state grammar
+
+- One page title, one question answered, one primary action. Preserve entered non-sensitive data
+  when moving back. Do not put private documents, invitation tokens or claims in browser storage.
+- On mobile the result, its freshness/limitations and the next action precede expandable evidence.
+  Touch targets are at least 44 CSS pixels; status always has text and never relies on color alone.
+- Labels remain visible above inputs. Error summaries focus the first invalid field. Async status
+  uses a live region; keyboard focus returns to the initiating control after closing a dialog.
+- Loading: skeleton/list placeholder with “Loading…” / “Chargement…”, not an empty result. Prevent
+  repeated submissions while work is pending. A timeout is not proof of failure on the ledger.
+- Empty: bordered card, explanation and one useful next step, following the existing `EmptyState`.
+  “No applications to review” / “Aucune demande à examiner” is a neutral success for an admin.
+- Error: same card structure as `ExplorerError`/`StatusBox`: plain-language cause, retained context,
+  safe next action. Do not show stack traces, raw payloads or internal service addresses.
+- Technical detail: schema UID, addresses, transaction hash, digest, fees and preview are secondary,
+  but the human-readable operation summary and fee must be visible before wallet approval.
+
+## Status vocabulary
+
+Reuse `StatusPill`'s success / warning / error / neutral tones. This is a proposed display mapping;
+new application states need an explicit adapter, not a claim that the current component knows them.
+
+| Meaning                             | English               | French                    | Tone / existing compatible value               |
+| ----------------------------------- | --------------------- | ------------------------- | ---------------------------------------------- |
+| Application awaiting review         | Awaiting review       | En attente d’examen       | warning / pending                              |
+| Role grant approved                 | Access approved       | Accès autorisé            | success / accepted                             |
+| Role grant refused                  | Application declined  | Demande refusée           | error / rejected                               |
+| Invite awaiting claim               | Invitation sent       | Invitation envoyée        | neutral                                        |
+| Invite bound to an identity         | Invitation claimed    | Invitation récupérée      | neutral                                        |
+| Address ownership proven            | Wallet linked         | Portefeuille lié          | success / ready                                |
+| Ledger operation unresolved         | Confirmation pending  | Confirmation en attente   | warning / pending                              |
+| Credential ready for subject action | Ready to accept       | À accepter                | warning / pending                              |
+| Subject acceptance validated        | Accepted              | Acceptée                  | success / accepted                             |
+| Issuer revocation proved            | Revoked               | Révoquée                  | error / deleted, with deletion cause preserved |
+| Time elapsed                        | Expired               | Expirée                   | warning / expired                              |
+| Unable to obtain current evidence   | Cannot verify now     | Vérification indisponible | warning / unavailable                          |
+| Bytes do not match                  | Content mismatch      | Contenu altéré            | error / tampered                               |
+| Issuer trust not established        | Issuer not recognized | Émetteur non reconnu      | warning / unknown                              |
+
+Do not translate every deletion to “revoked”: subject rejection/deletion and expiry are distinct.
+Role approval grants access to the application; it is never a Commons endorsement or trust badge.
+
+## Three shared failure wireframes
+
+See [FR board](./wireframes.fr.excalidraw), [EN board](./wireframes.en.excalidraw) and the gallery.
+
+| Screen | Trigger                                             | Message and recovery                                                            | Preserve / prohibit                                                                            |
+| ------ | --------------------------------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| F1     | Wallet unavailable or unsupported                   | Explain installation/unlock, select a compatible wallet and retry detection     | Preserve form; no signature request until account/network/capability checks pass               |
+| F2     | Invite expired, revoked, already claimed or invalid | Generic unusable-link result; use known issuer contact to request a replacement | Do not reveal who claimed it or whether an email has an account; never silently extend a token |
+| F3     | Indexer stale/unavailable                           | Explain that current credential state cannot be checked; retry safely           | No success/valid label or new signature; retain unresolved operation and reconcile its hash    |
+
+A revoked or invalid presentation uses the unavailable-link layout with presentation-specific copy
+and “Ask the recipient to share again” / “Demander au destinataire de partager à nouveau”. It exposes
+no credential details. Sharing does not expire automatically under ADR 0004; an expired credential
+still shows its actual lifecycle to an authorized viewer. An expired identity session asks for
+sign-in again without invalidating the recipient's grant.
+
+## Privacy and presentation access
+
+These are proposed constraints for the later application API. Filtering is server-side before
+serialization, SSR/hydration, logs, exports and browser delivery; hiding a section in CSS is not
+authorization. Recheck authenticated audience, global verifier approval, scope and revocation on
+every resolution. A forwarded full-scope link never authorizes a different verifier.
+
+| Viewer on a valid presentation                                              | Public scope  | Full scope                                     |
+| --------------------------------------------------------------------------- | ------------- | ---------------------------------------------- |
+| Anonymous or no current verifier approval                                   | Public fields | Public fields + sign-in/access explanation     |
+| Approved verifier other than the intended audience                          | Public fields | Public fields only; no access to hidden claims |
+| Designated, authenticated verifier with current global approval             | Public fields | Fields within the recipient-authorized scope   |
+| Admin with no independent issuer/recipient/designated-verifier relationship | Public fields | Public fields only                             |
+
+The recipient and issuer use their separately authorized owner detail views for full fields. Admin
+status never substitutes for that relationship or for a designated verifier grant. There is no
+issuer allowlist, no shared organization login and no implicit team membership authorization.
+
+ADR 0004 now distinguishes the organization's stable identity from its responsible human account.
+Private verifier access checks that the signed-in human can act for the designated organization,
+that organization's current approval and the recipient grant. A personal login alone is not the
+designated verifier. The initial model has one responsible user, without a team-management workflow.
+
+For a public credential, its declared public fields are all claims; presenting it cannot undo
+previous disclosure. For a private credential they are exactly the issuer-approved subset, possibly
+empty. A revoked presentation URL is never revived by owner access; the owner detail view is separate.
+
+No full payload may be downloaded to compute a public-only preview in the browser. A subset is not
+independently hash-verifiable against the original full-payload digest: label payload integrity
+“Not checked” if no authorized full-byte check occurred. A server-side check, if later implemented,
+must identify its provenance and must not send hidden bytes. Issuer trust remains a separate
+viewer decision. Approval for application access does not resolve it.
+
+There is no automatic presentation expiry, renewal prompt, far-future sentinel expiry or single-use
+control in this design. State “Until you revoke sharing” / “Jusqu’à révocation du partage” before
+creation and in the active-grant list. Reopening must recheck authorization and current credential
+evidence. Loss of verifier approval blocks private access immediately; restoring approval must not
+revive a recipient-revoked grant. Revocation cannot erase information already retrieved.
+
+Email is a notification and navigation aid: no private claims or documents in message subjects or
+bodies. Resend/revoke invites explicitly; refreshing must not resend. Notifications and approvals
+need an idempotent delivery design in #30/#31, not an optimistic “email delivered” toast.
diff --git a/docs/ux/shared/f1.en.svg b/docs/ux/shared/f1.en.svg
new file mode 100644
index 0000000..eb4cb4f
--- /dev/null
+++ b/docs/ux/shared/f1.en.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">F1 — Wallet unavailable</title>
+<desc id="desc">Your progress is preserved. Let us get the wallet ready. An XRP Identity account does not replace a wallet. Reading a public presentation needs no wallet.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Shared states</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Wallet unavailable</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Your progress is preserved. Let us get the</tspan><tspan x="24" dy="18.2">wallet ready.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">No signature requested</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Already installed?</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Unlock it, then refresh detection</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Not installed yet?</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Guidance for a compatible wallet</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Required network</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Testnet · Check the selected account</tspan></text>
+<rect x="24" y="421.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="434.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Refresh detection</tspan></text>
+<rect x="24" y="475.9" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="488.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Choose another wallet</tspan></text>
+<text x="24" y="532.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">An XRP Identity account does not replace a</tspan><tspan x="24" dy="15.600000000000001">wallet. Reading a public presentation needs no</tspan><tspan x="24" dy="15.600000000000001">wallet.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/shared/f1.fr.svg b/docs/ux/shared/f1.fr.svg
new file mode 100644
index 0000000..2c988c1
--- /dev/null
+++ b/docs/ux/shared/f1.fr.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">F1 — Portefeuille indisponible</title>
+<desc id="desc">Votre progression est conservée. Préparons le portefeuille. Un compte XRP Identity ne remplace pas un portefeuille. Lire une présentation publique n’en demande pas.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / États partagés</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Portefeuille indisponible</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Votre progression est conservée. Préparons</tspan><tspan x="24" dy="18.2">le portefeuille.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Aucune signature demandée</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Déjà installé ?</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Déverrouiller puis relancer la détection</tspan></text>
+<rect x="24" y="277.5" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Pas encore installé ?</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Instructions pour un portefeuille</tspan><tspan x="34" dy="18.2">compatible</tspan></text>
+<rect x="24" y="364.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Réseau requis</tspan></text>
+<text x="34" y="393.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Testnet · Vérifier le compte sélectionné</tspan></text>
+<rect x="24" y="440.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="452.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Relancer la détection</tspan></text>
+<rect x="24" y="494.09999999999997" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="506.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Choisir un autre portefeuille</tspan></text>
+<text x="24" y="551.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Un compte XRP Identity ne remplace pas un</tspan><tspan x="24" dy="15.600000000000001">portefeuille. Lire une présentation publique n’en</tspan><tspan x="24" dy="15.600000000000001">demande pas.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/shared/f2.en.svg b/docs/ux/shared/f2.en.svg
new file mode 100644
index 0000000..b1eb0c3
--- /dev/null
+++ b/docs/ux/shared/f2.en.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">F2 — Invitation unavailable</title>
+<desc id="desc">This link has expired or can no longer be used. Use your known issuer contact. This message does not reveal who used the link.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Shared states</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Invitation unavailable</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">This link has expired or can no longer be</tspan><tspan x="24" dy="18.2">used.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">No invitation claimed</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">What can I do?</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ask the issuer for a new invitation</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Your account</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">You can continue with the same account</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Privacy</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">No recipient information is displayed</tspan></text>
+<rect x="24" y="421.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="434.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Back to my workspace</tspan></text>
+<text x="24" y="478.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Use your known issuer contact. This message does</tspan><tspan x="24" dy="15.600000000000001">not reveal who used the link.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/shared/f2.fr.svg b/docs/ux/shared/f2.fr.svg
new file mode 100644
index 0000000..9ec83c0
--- /dev/null
+++ b/docs/ux/shared/f2.fr.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">F2 — Invitation inutilisable</title>
+<desc id="desc">Ce lien a expiré ou ne peut plus être utilisé. Utilisez votre contact habituel chez l’émetteur. Ce message ne révèle pas qui a utilisé le lien.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / États partagés</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Invitation inutilisable</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Ce lien a expiré ou ne peut plus être</tspan><tspan x="24" dy="18.2">utilisé.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Aucune invitation récupérée</tspan></text>
+<rect x="24" y="208.3" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Que faire ?</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Demander une nouvelle invitation à</tspan><tspan x="34" dy="18.2">l’émetteur</tspan></text>
+<rect x="24" y="295.70000000000005" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="304.70000000000005" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Votre compte</tspan></text>
+<text x="34" y="324.70000000000005" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vous pourrez continuer avec le même compte</tspan></text>
+<rect x="24" y="364.90000000000003" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.90000000000003" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Confidentialité</tspan></text>
+<text x="34" y="393.90000000000003" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Aucune information de destinataire affichée</tspan></text>
+<rect x="24" y="440.1" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="453" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Retour à mon espace</tspan></text>
+<text x="24" y="497.1" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Utilisez votre contact habituel chez l’émetteur.</tspan><tspan x="24" dy="15.600000000000001">Ce message ne révèle pas qui a utilisé le lien.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/shared/f3.en.svg b/docs/ux/shared/f3.en.svg
new file mode 100644
index 0000000..e9e116b
--- /dev/null
+++ b/docs/ux/shared/f3.en.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">F3 — Cannot verify now</title>
+<desc id="desc">The current attestation state cannot be confirmed. New signatures wait for reliable evidence. Your keys always stay in your wallet.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Shared states</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Cannot verify now</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">The current attestation state cannot be</tspan><tspan x="24" dy="18.2">confirmed.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Waiting for current evidence</tspan></text>
+<rect x="24" y="208.3" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">What this means</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">This is neither a valid nor an invalid</tspan><tspan x="34" dy="18.2">result</tspan></text>
+<rect x="24" y="295.70000000000005" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="304.70000000000005" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Already signed an operation?</tspan></text>
+<text x="34" y="324.70000000000005" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Resume tracking without signing again</tspan></text>
+<rect x="24" y="364.90000000000003" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="373.90000000000003" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">What can I do?</tspan></text>
+<text x="34" y="393.90000000000003" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Retry later or check service status</tspan></text>
+<rect x="24" y="440.1" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="453" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Retry verification</tspan></text>
+<rect x="24" y="494.1" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="507" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">View service status</tspan></text>
+<text x="24" y="551.1" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">New signatures wait for reliable evidence. Your</tspan><tspan x="24" dy="15.600000000000001">keys always stay in your wallet.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/shared/f3.fr.svg b/docs/ux/shared/f3.fr.svg
new file mode 100644
index 0000000..f4c876a
--- /dev/null
+++ b/docs/ux/shared/f3.fr.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">F3 — Vérification indisponible</title>
+<desc id="desc">L’état actuel de l’attestation ne peut pas être confirmé. Les nouvelles signatures attendent un état fiable. Vos clés restent toujours dans le portefeuille.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / États partagés</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vérification indisponible</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">L’état actuel de l’attestation ne peut pas</tspan><tspan x="24" dy="18.2">être confirmé.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Attendre des données à jour</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ce que cela signifie</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ce n’est ni un résultat valide ni invalide</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Une opération est déjà signée ?</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Reprendre son suivi sans signer à nouveau</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Que faire ?</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Réessayer plus tard ou consulter le statut</tspan></text>
+<rect x="24" y="421.9" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="434.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Réessayer la vérification</tspan></text>
+<rect x="24" y="475.9" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="488.79999999999995" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Voir l’état du service</tspan></text>
+<text x="24" y="532.9" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Les nouvelles signatures attendent un état</tspan><tspan x="24" dy="15.600000000000001">fiable. Vos clés restent toujours dans le</tspan><tspan x="24" dy="15.600000000000001">portefeuille.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/shared/wireframes.en.excalidraw b/docs/ux/shared/wireframes.en.excalidraw
new file mode 100644
index 0000000..8141456
--- /dev/null
+++ b/docs/ux/shared/wireframes.en.excalidraw
@@ -0,0 +1,2173 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "F1-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Shared states",
+      "originalText": "XCS / Shared states",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Wallet unavailable",
+      "originalText": "Wallet unavailable",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your progress is preserved. Let us get the\nwallet ready.",
+      "originalText": "Your progress is preserved. Let us get the\nwallet ready.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "No signature requested",
+      "originalText": "No signature requested",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Already installed?",
+      "originalText": "Already installed?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Unlock it, then refresh detection",
+      "originalText": "Unlock it, then refresh detection",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Not installed yet?",
+      "originalText": "Not installed yet?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Guidance for a compatible wallet",
+      "originalText": "Guidance for a compatible wallet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Required network",
+      "originalText": "Required network",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Testnet · Check the selected account",
+      "originalText": "Testnet · Check the selected account",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 421.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-17",
+      "type": "text",
+      "x": 36,
+      "y": 434.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Refresh detection",
+      "originalText": "Refresh detection",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-18",
+      "type": "rectangle",
+      "x": 24,
+      "y": 475.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-en-19",
+      "type": "text",
+      "x": 36,
+      "y": 488.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choose another wallet",
+      "originalText": "Choose another wallet",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-20",
+      "type": "text",
+      "x": 24,
+      "y": 532.9,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "An XRP Identity account does not replace a\nwallet. Reading a public presentation needs no\nwallet.",
+      "originalText": "An XRP Identity account does not replace a\nwallet. Reading a public presentation needs no\nwallet.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Shared states",
+      "originalText": "XCS / Shared states",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Invitation unavailable",
+      "originalText": "Invitation unavailable",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "This link has expired or can no longer be\nused.",
+      "originalText": "This link has expired or can no longer be\nused.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "No invitation claimed",
+      "originalText": "No invitation claimed",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "What can I do?",
+      "originalText": "What can I do?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ask the issuer for a new invitation",
+      "originalText": "Ask the issuer for a new invitation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Your account",
+      "originalText": "Your account",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "You can continue with the same account",
+      "originalText": "You can continue with the same account",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Privacy",
+      "originalText": "Privacy",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "No recipient information is displayed",
+      "originalText": "No recipient information is displayed",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 421.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-en-17",
+      "type": "text",
+      "x": 476,
+      "y": 434.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Back to my workspace",
+      "originalText": "Back to my workspace",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-18",
+      "type": "text",
+      "x": 464,
+      "y": 478.9,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Use your known issuer contact. This message does\nnot reveal who used the link.",
+      "originalText": "Use your known issuer contact. This message does\nnot reveal who used the link.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-en-19",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Shared states",
+      "originalText": "XCS / Shared states",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Cannot verify now",
+      "originalText": "Cannot verify now",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The current attestation state cannot be\nconfirmed.",
+      "originalText": "The current attestation state cannot be\nconfirmed.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Waiting for current evidence",
+      "originalText": "Waiting for current evidence",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "What this means",
+      "originalText": "What this means",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "This is neither a valid nor an invalid\nresult",
+      "originalText": "This is neither a valid nor an invalid\nresult",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 295.70000000000005,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 304.70000000000005,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Already signed an operation?",
+      "originalText": "Already signed an operation?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 324.70000000000005,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Resume tracking without signing again",
+      "originalText": "Resume tracking without signing again",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 364.90000000000003,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 373.90000000000003,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "What can I do?",
+      "originalText": "What can I do?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 393.90000000000003,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retry later or check service status",
+      "originalText": "Retry later or check service status",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 440.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-17",
+      "type": "text",
+      "x": 916,
+      "y": 453,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retry verification",
+      "originalText": "Retry verification",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-18",
+      "type": "rectangle",
+      "x": 904,
+      "y": 494.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-en-19",
+      "type": "text",
+      "x": 916,
+      "y": 507,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View service status",
+      "originalText": "View service status",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-20",
+      "type": "text",
+      "x": 904,
+      "y": 551.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "New signatures wait for reliable evidence. Your\nkeys always stay in your wallet.",
+      "originalText": "New signatures wait for reliable evidence. Your\nkeys always stay in your wallet.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-en-21",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/shared/wireframes.fr.excalidraw b/docs/ux/shared/wireframes.fr.excalidraw
new file mode 100644
index 0000000..c27663f
--- /dev/null
+++ b/docs/ux/shared/wireframes.fr.excalidraw
@@ -0,0 +1,2173 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "F1-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / États partagés",
+      "originalText": "XCS / États partagés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Portefeuille indisponible",
+      "originalText": "Portefeuille indisponible",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre progression est conservée. Préparons\nle portefeuille.",
+      "originalText": "Votre progression est conservée. Préparons\nle portefeuille.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aucune signature demandée",
+      "originalText": "Aucune signature demandée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Déjà installé ?",
+      "originalText": "Déjà installé ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Déverrouiller puis relancer la détection",
+      "originalText": "Déverrouiller puis relancer la détection",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Pas encore installé ?",
+      "originalText": "Pas encore installé ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Instructions pour un portefeuille\ncompatible",
+      "originalText": "Instructions pour un portefeuille\ncompatible",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 364.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 373.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Réseau requis",
+      "originalText": "Réseau requis",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 393.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Testnet · Vérifier le compte sélectionné",
+      "originalText": "Testnet · Vérifier le compte sélectionné",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 440.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-17",
+      "type": "text",
+      "x": 36,
+      "y": 452.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Relancer la détection",
+      "originalText": "Relancer la détection",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-18",
+      "type": "rectangle",
+      "x": 24,
+      "y": 494.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F1-fr-19",
+      "type": "text",
+      "x": 36,
+      "y": 506.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Choisir un autre portefeuille",
+      "originalText": "Choisir un autre portefeuille",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-20",
+      "type": "text",
+      "x": 24,
+      "y": 551.0999999999999,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Un compte XRP Identity ne remplace pas un\nportefeuille. Lire une présentation publique n’en\ndemande pas.",
+      "originalText": "Un compte XRP Identity ne remplace pas un\nportefeuille. Lire une présentation publique n’en\ndemande pas.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F1-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / États partagés",
+      "originalText": "XCS / États partagés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Invitation inutilisable",
+      "originalText": "Invitation inutilisable",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ce lien a expiré ou ne peut plus être\nutilisé.",
+      "originalText": "Ce lien a expiré ou ne peut plus être\nutilisé.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aucune invitation récupérée",
+      "originalText": "Aucune invitation récupérée",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Que faire ?",
+      "originalText": "Que faire ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Demander une nouvelle invitation à\nl’émetteur",
+      "originalText": "Demander une nouvelle invitation à\nl’émetteur",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 295.70000000000005,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 304.70000000000005,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Votre compte",
+      "originalText": "Votre compte",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 324.70000000000005,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vous pourrez continuer avec le même compte",
+      "originalText": "Vous pourrez continuer avec le même compte",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 364.90000000000003,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 373.90000000000003,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Confidentialité",
+      "originalText": "Confidentialité",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 393.90000000000003,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Aucune information de destinataire affichée",
+      "originalText": "Aucune information de destinataire affichée",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 440.1,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F2-fr-17",
+      "type": "text",
+      "x": 476,
+      "y": 453,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retour à mon espace",
+      "originalText": "Retour à mon espace",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-18",
+      "type": "text",
+      "x": 464,
+      "y": 497.1,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Utilisez votre contact habituel chez l’émetteur.\nCe message ne révèle pas qui a utilisé le lien.",
+      "originalText": "Utilisez votre contact habituel chez l’émetteur.\nCe message ne révèle pas qui a utilisé le lien.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F2-fr-19",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / États partagés",
+      "originalText": "XCS / États partagés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérification indisponible",
+      "originalText": "Vérification indisponible",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "L’état actuel de l’attestation ne peut pas\nêtre confirmé.",
+      "originalText": "L’état actuel de l’attestation ne peut pas\nêtre confirmé.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Attendre des données à jour",
+      "originalText": "Attendre des données à jour",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ce que cela signifie",
+      "originalText": "Ce que cela signifie",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ce n’est ni un résultat valide ni invalide",
+      "originalText": "Ce n’est ni un résultat valide ni invalide",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Une opération est déjà signée ?",
+      "originalText": "Une opération est déjà signée ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Reprendre son suivi sans signer à nouveau",
+      "originalText": "Reprendre son suivi sans signer à nouveau",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Que faire ?",
+      "originalText": "Que faire ?",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Réessayer plus tard ou consulter le statut",
+      "originalText": "Réessayer plus tard ou consulter le statut",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 421.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-17",
+      "type": "text",
+      "x": 916,
+      "y": 434.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Réessayer la vérification",
+      "originalText": "Réessayer la vérification",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-18",
+      "type": "rectangle",
+      "x": 904,
+      "y": 475.9,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "F3-fr-19",
+      "type": "text",
+      "x": 916,
+      "y": 488.79999999999995,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir l’état du service",
+      "originalText": "Voir l’état du service",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-20",
+      "type": "text",
+      "x": 904,
+      "y": 532.9,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Les nouvelles signatures attendent un état\nfiable. Vos clés restent toujours dans le\nportefeuille.",
+      "originalText": "Les nouvelles signatures attendent un état\nfiable. Vos clés restent toujours dans le\nportefeuille.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "F3-fr-21",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/usability.md b/docs/ux/usability.md
new file mode 100644
index 0000000..f5db888
--- /dev/null
+++ b/docs/ux/usability.md
@@ -0,0 +1,94 @@
+# Usability protocol and evidence register
+
+Status: not conducted. No dates, participants, observations or approval are asserted by this file.
+The wireframes are hypotheses, not validated user research. On 2026-09-23 the user explicitly
+deferred these sessions and requested work on the next issue. Implementation may proceed on that
+basis; the two-people-per-role research criterion is deferred, not passed or waived as evidence.
+
+## Recruitment and safe setup
+
+Recruit two administrators who review organizations, two training/qualification issuers, two
+learners/recipients with limited ledger experience, and two people who check attestations. Note
+relevant experience without storing names, emails, identity documents or recordings in Git. If one
+person tests several roles, justify their fit and disclose the overlap rather than claiming eight
+independent participants. Obtain consent for notes; any recordings stay outside the repository
+under an agreed retention policy. Participation and retention dates are not invented here.
+
+Use the offline gallery or editable Excalidraw boards with fictional records. The facilitator moves
+between screens and describes external identity/wallet outcomes; this is a moderated static
+walkthrough, not a clickable production test. No real login, wallet signature, tokens or upload.
+Use both locales across the sample, record which one each person used, and inspect mobile at
+390 × 844 plus desktop. QR areas are placeholders and must not be scanned as real links.
+
+## Session script (25–35 minutes)
+
+1. Explain that the design is being tested, not the participant. Ask them to think aloud. Do not
+   explain ledger vocabulary first: note whether the design requires it.
+2. Give the role's task in the matching journey README without naming controls or explaining the
+   intended path. Ask at each step: “What do you expect to happen?”
+3. Record task completion, time, hesitations, wrong turns, requests for help, terminology and any
+   accidental disclosure prediction. Separate observed behavior from the facilitator's interpretation.
+4. Introduce wallet unavailable, invite expired and indexer unavailable as applicable. For admin and
+   verifier, verify they are not wrongly sent to wallet setup or recipient invitation handling.
+5. Ask the person to explain visibility, application approval versus issuer trust, pending versus
+   confirmed, and link revocation versus credential revocation in their own words.
+6. Debrief: one confusing moment, one missing piece, proposed wording. Record a concrete screen or
+   copy change, or explain why a suggestion was not adopted. Recheck material changes with users.
+
+## Task-specific observations
+
+| Role      | Main task                                                      | Signals to record                                                                                      |
+| --------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| Admin     | Approve one issuer, decline another, suspend a verifier        | Decision under one minute for complete evidence; no private-claim override or endorsement inference    |
+| Issuer    | Template → invite → linked learner → private issuance          | No raw UID/address typing; correct public-field prediction; no duplicate issuance on recovery          |
+| Recipient | Email → claim → wallet → accept → public presentation          | At most five app screens to acceptance; external handoff effort; reject needs no content fetch         |
+| Verifier  | Public view → authorized full view; interpret failure variants | Correct first-glance result on phone; no trust score; no expectation of private access from link alone |
+
+Completion requires recording all four journeys and all three failure categories, including why a
+failure is not applicable to a role. Do not count a designer or automated screenshot as a role user.
+
+## Session register
+
+Fill a row only after an actual session; preserve anonymity. “Pending” is not a date or evidence.
+
+| Session | Role      | Date / locale / device | Participant fit | Observation evidence | Revision and recheck |
+| ------- | --------- | ---------------------- | --------------- | -------------------- | -------------------- |
+| A-01    | Admin     | Pending                | Pending         | Not conducted        | Pending              |
+| A-02    | Admin     | Pending                | Pending         | Not conducted        | Pending              |
+| I-01    | Issuer    | Pending                | Pending         | Not conducted        | Pending              |
+| I-02    | Issuer    | Pending                | Pending         | Not conducted        | Pending              |
+| R-01    | Recipient | Pending                | Pending         | Not conducted        | Pending              |
+| R-02    | Recipient | Pending                | Pending         | Not conducted        | Pending              |
+| V-01    | Verifier  | Pending                | Pending         | Not conducted        | Pending              |
+| V-02    | Verifier  | Pending                | Pending         | Not conducted        | Pending              |
+
+Per-session notes template:
+
+```text
+Session ID / actual date / design commit / locale / viewport:
+Role fit and relevant experience (anonymous):
+Consent for notes obtained:
+Task / start and finish / result / assistance:
+Observed hesitation or incorrect prediction (screen ID):
+Failure states tried and recovery observed:
+Participant wording (only with consent; no PII):
+Interpretation (separate from observation):
+Change made (screen/copy ID and commit), or reason not to change:
+Recheck outcome / unresolved question / owner:
+```
+
+## Accepted decisions and remaining implementation questions
+
+| Decision                                             | Current draft                                                                                                                  | Acceptance owner / state                                          |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------- |
+| Role-based portal boundary                           | Admin approval gates issuer/verifier portal access, not protocol validity; current Studio remains                              | ADR 0004 accepted; implementation pending                         |
+| Private-sharing audience                             | Recipient selects a specific globally approved verifier; authenticated stable identity required                                | ADR 0004 accepted; usability wording to test                      |
+| Full-scope authorization                             | Current approval AND recipient grant AND matching audience/scope; admin has no override                                        | ADR 0004 accepted; server implementation pending                  |
+| Sharing duration and approval scope                  | No automatic expiry/renewal and no per-issuer allowlist                                                                        | ADR 0004 accepted; no TTL or single-use control in this design    |
+| Visibility default and template public fields        | Proposed private issuance default; recipient cannot retract previously public data                                             | Product / pending                                                 |
+| Invite account binding                               | Authenticated holder may explicitly claim without email matching; first claim binds atomically; issuer reviews actual claimant | ADR 0004 accepted; expiry and resend implementation still pending |
+| Private storage and integrity provenance             | Never use public hosting; do not hash a subset as full payload                                                                 | #31/#33 owners / pending                                          |
+| Retention, appeal contact and mail delivery behavior | No invented retention period, appeal endpoint or delivery guarantee                                                            | #25/#30 owners / pending                                          |
+
+The accepted ADR decisions supersede older expiry and allowlist wording in the issues. Remaining
+questions are implementation gates, not a claim that documentation work requires production approval.
diff --git a/docs/ux/verifier/README.md b/docs/ux/verifier/README.md
new file mode 100644
index 0000000..7e835de
--- /dev/null
+++ b/docs/ux/verifier/README.md
@@ -0,0 +1,120 @@
+# Verifier — understand the result without overstating trust
+
+Draft for [#33](https://github.com/XRPL-Commons/XCS/issues/33).
+
+User goal: “I want to know whether this shared attestation is current, what was checked, and whether
+I am allowed to see the details I need.”
+
+[French board](./wireframes.fr.excalidraw) · [English board](./wireframes.en.excalidraw) ·
+[Gallery](../index.html#verifier)
+
+## Journey and screens
+
+```mermaid
+flowchart LR
+  Link[Presentation link] --> V2[Result and public fields]
+  V2 -->|Needs private details| V1[Apply and await approval]
+  V1 -->|Signed in and authorized| V3[Full-scope detail]
+  V2 --> V4[Own verification history]
+  V3 --> V4
+```
+
+The anonymous happy path is one screen, V2. V1 is optional for public verification and must never
+block viewing the allowed subset. V3 is the authorized state of that same presentation page.
+
+| Screen / suggested route                      | Question answered                                | Action                                                                              |
+| --------------------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------- |
+| [V1](./v1.fr.svg) `/verifier/apply`           | How can I request full-detail access?            | Organization, purpose, contact; application/pending/declined states                 |
+| [V2](./v2.fr.svg) `/p/:token` public tier     | What can I conclude from the evidence I can see? | One headline, four separate dimensions, public fields, sign-in/access guidance      |
+| [V3](./v3.fr.svg) `/p/:token` authorized tier | Are these the complete, checked details?         | Full fields only if scope AND viewer authorization allow; digest evidence on demand |
+| [V4](./v4.fr.svg) `/verifier`                 | What did I check previously?                     | Own metadata-only history and CSV export; reopen rechecks access and token validity |
+
+V1 pending explains that global application approval and recipient-authorized sharing are distinct.
+Declined shows the reason and a contact route when defined, without implying an automatic appeal.
+An approved verifier still needs a full-scope recipient grant addressed to its own authenticated
+application identity. A forwarded link from another approved verifier does not qualify. A
+public-scope link never silently upgrades because the viewer signed in. Admin approval is portal
+permission, not issuer trust. No issuer-specific approval is required under ADR 0004.
+
+V4 may retain time, result category and an application record reference under a reviewed retention
+policy; never payload claims or reusable bearer tokens. CSV uses the same authorization and
+spreadsheet-safe escaping. Anonymous history is not recorded as an identified verifier's activity.
+
+## Headline and evidence
+
+The headline is a plain-language summary, never a numerical or universal trust score. The four
+dimensions remain visible separately: ledger lifecycle, schema validity, payload integrity and
+issuer trust. A 390 × 844 viewport must show the headline and its limitation without scrolling.
+
+1. Unusable presentation: show no credential details, even to a previously approved viewer.
+2. Missing/stale evidence: “Cannot verify now”, never a previous green result.
+3. With current evidence, disclose proven revocation/expiry/content mismatch as the headline;
+   if several apply, explain each in the dimension list rather than hiding them.
+4. Missing full-byte check: “Partially checked” / “Vérification partielle”; explicitly “Payload:
+   not checked”. Do not compute a full-payload digest from a filtered subset.
+5. Full technical checks passed but issuer trust is unknown: “Issuer not recognized”, with the
+   technical facts below. Unknown does not mean fraudulent, and approval does not make it trusted.
+6. “Checks passed” / “Contrôles réussis” requires current accepted lifecycle, valid schema and
+   payload, plus a separately established viewer trust decision. Explain that this does not prove
+   the real-world truth of claims. Never derive trust from Commons application approval.
+
+For an unapproved viewer, the access hint explains both steps: an administrator approves the global
+verifier role; the recipient then grants this particular verifier access to the credential. The
+recipient cannot approve a verifier role, and the administrator cannot grant access to private
+claims. Avoid implying that a login or approval alone unlocks private fields.
+
+Every current report value also needs an explicit display branch. Confirm presentation validity
+and evidence freshness first; then give known failures priority over partial checks. Always show
+the other dimensions alongside the headline, including when several fail.
+
+| Evidence                 | English headline / French headline                          | Meaning                                                                   |
+| ------------------------ | ----------------------------------------------------------- | ------------------------------------------------------------------------- |
+| `onChain: pending`       | Not yet accepted / Pas encore acceptée                      | Issuance exists; subject acceptance is not proved                         |
+| `onChain: not_found`     | Attestation not found / Attestation introuvable             | No matching generation in current evidence; not a schema or trust verdict |
+| `onChain: expired`       | Attestation expired / Attestation expirée                   | Credential expiry; sharing has no automatic time limit                    |
+| `onChain: deleted`       | Attestation no longer active / Attestation inactive         | Refine to revoked or declined only with the actual deletion cause         |
+| `schema: invalid`        | Invalid schema / Schéma invalide                            | An established failure; cannot be summarized as partly valid              |
+| `schema: unknown`        | Schema not resolved / Schéma non résolu                     | Incomplete evidence; no success headline                                  |
+| `payload: tampered`      | Content mismatch / Contenu altéré                           | Digest mismatch                                                           |
+| `payload: invalid`       | Invalid content / Contenu invalide                          | Full content fails format or schema checks                                |
+| `payload: unavailable`   | Content unavailable / Contenu indisponible                  | Retrieval failed; not proof of tampering                                  |
+| `payload: not_checked`   | Partially checked / Vérification partielle                  | Check not performed, including filtered public views                      |
+| `issuerTrust: untrusted` | Issuer not trusted / Émetteur non fiable selon vos critères | Explicit negative trust decision, not merely unknown                      |
+| `issuerTrust: unknown`   | Issuer not recognized / Émetteur non reconnu                | No trust conclusion; separate from application approval                   |
+
+For multiple current negative findings, order the headline by lifecycle, schema, payload, then
+issuer trust, with all failures visible. Known negatives precede unknown/unavailable dimensions.
+The no-score rule still applies: this ordering is display priority, not arithmetic over trust.
+
+## Current asks → proposed simplification
+
+| Existing `/verify` / exact credential detail        | Proposed presentation view                                                        |
+| --------------------------------------------------- | --------------------------------------------------------------------------------- |
+| Credential tuple / generation ID / transaction hash | Resolve server-side from valid presentation                                       |
+| Schema, digest, payload URL and separate reports    | Human-readable result first; preserve evidence on demand                          |
+| Explicit external-host fetch and trust choice       | Explain exactly what was checked and by whom; keep consent if fetching externally |
+| Manual record keeping                               | Authorized metadata-only history; no payload retention                            |
+
+## Failure and empty states
+
+- Wallet missing (F1): public verification does not need a wallet; never send the viewer through
+  wallet setup to read the public subset. Linking is only needed for separately requested features.
+- Invite expired (F2): applies to recipient onboarding, not verifier access. For a revoked sharing
+  grant, ask the recipient to share again; no presentation renewal or expiry countdown.
+- Indexer unavailable (F3): result is unavailable; retry with fresh evidence, no stale green card.
+- Unapproved/wrong designated identity: return only public fields plus access guidance, including
+  in SSR. A previously authorized viewer who loses approval cannot keep reading private data.
+- No history: “No checks recorded” / “Aucune vérification enregistrée”; open a presentation link.
+- Session expired: sign in again and recheck audience/approval/grant; the sharing grant itself has
+  no automatic expiry. Reopened history always uses current authorization and ledger evidence.
+
+## Review and acceptance tasks
+
+Two verifier participants explain a public-tier result at first glance, request access, inspect a
+full-scope authorized example, then distinguish revoked, expired, unknown issuer, tampered and
+unavailable cases. Ask what they can conclude about the truth of the attestation. Check that a
+different globally approved verifier does not expect private access from a forwarded link, and that
+recipient revocation or loss of approval blocks future access without changing ledger validity.
+
+#33 implements V1–V4 and F3; tests every viewer/scope combination from the shared matrix at the API
+boundary and keeps dimensions independent. Record actual results in [the session log](../usability.md).
diff --git a/docs/ux/verifier/v1.en.svg b/docs/ux/verifier/v1.en.svg
new file mode 100644
index 0000000..0f0c3fe
--- /dev/null
+++ b/docs/ux/verifier/v1.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">V1 — Request full-detail access</title>
+<desc id="desc">Explain your organization and your need. After global approval, the recipient must share with your verifier identity.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Verifier</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Request full-detail</tspan><tspan x="24" dy="29.900000000000002">access</tspan></text>
+<text x="24" y="133.8" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Explain your organization and your need.</tspan></text>
+<rect x="24" y="167" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="177" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public verification needs no account</tspan></text>
+<rect x="24" y="220" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="229" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization</tspan></text>
+<text x="34" y="249" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Example Office</tspan></text>
+<rect x="24" y="289.2" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="298.2" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Verification purpose</tspan></text>
+<text x="34" y="318.2" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Check declared course completions</tspan></text>
+<rect x="24" y="358.4" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="367.4" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact</tspan></text>
+<text x="34" y="387.4" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organization work contact</tspan></text>
+<rect x="24" y="427.59999999999997" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="436.59999999999997" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">After submission</tspan></text>
+<text x="34" y="456.59999999999997" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Pending; if declined, show the reason</tspan></text>
+<rect x="24" y="502.79999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="515.6999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Submit application</tspan></text>
+<rect x="24" y="556.8" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="569.6999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Back to presentation</tspan></text>
+<text x="24" y="613.8" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">After global approval, the recipient must share</tspan><tspan x="24" dy="15.600000000000001">with your verifier identity.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v1.fr.svg b/docs/ux/verifier/v1.fr.svg
new file mode 100644
index 0000000..5301ab3
--- /dev/null
+++ b/docs/ux/verifier/v1.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">V1 — Demander l’accès complet</title>
+<desc id="desc">Présenter votre organisation et votre besoin. Après autorisation globale, le destinataire doit partager avec votre identité de vérificateur.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Vérificateur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Demander l’accès complet</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Présenter votre organisation et votre</tspan><tspan x="24" dy="18.2">besoin.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vérification publique sans compte</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Organisation</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Bureau Exemple</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">But des vérifications</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vérifier les formations déclarées</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contact professionnel de l’organisation</tspan></text>
+<rect x="24" y="415.9" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Après l’envoi</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">En attente ; si refus, motif affiché</tspan></text>
+<rect x="24" y="491.09999999999997" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="503.99999999999994" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Envoyer ma demande</tspan></text>
+<rect x="24" y="545.0999999999999" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="557.9999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Retour à la présentation</tspan></text>
+<text x="24" y="602.0999999999999" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Après autorisation globale, le destinataire doit</tspan><tspan x="24" dy="15.600000000000001">partager avec votre identité de vérificateur.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v2.en.svg b/docs/ux/verifier/v2.en.svg
new file mode 100644
index 0000000..f4a9618
--- /dev/null
+++ b/docs/ux/verifier/v2.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">V2 — Partially checked</title>
+<desc id="desc">The attestation is active. Full content has not been checked. Permission to use XCS is not an endorsement of the issuer. There is no trust score.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Verifier</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Partially checked</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">The attestation is active. Full content has</tspan><tspan x="24" dy="18.2">not been checked.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public view · Limited fields</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Four independent checks</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ledger: active · Schema: valid</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Content and trust</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Payload: not checked · Issuer: unknown</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Public fields</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Course: XRPL introduction</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">To read private fields</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Sign-in + approved role + grant addressed</tspan><tspan x="34" dy="18.2">to you</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Sign in or request access</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">View available evidence</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Permission to use XCS is not an endorsement of</tspan><tspan x="24" dy="15.600000000000001">the issuer. There is no trust score.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v2.fr.svg b/docs/ux/verifier/v2.fr.svg
new file mode 100644
index 0000000..3e4ced0
--- /dev/null
+++ b/docs/ux/verifier/v2.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">V2 — Vérification partielle</title>
+<desc id="desc">L’attestation est active. Le contenu complet n’a pas été contrôlé. L’autorisation d’utiliser XCS n’est pas une garantie de l’émetteur. Aucun score de confiance.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Vérificateur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Vérification partielle</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">L’attestation est active. Le contenu</tspan><tspan x="24" dy="18.2">complet n’a pas été contrôlé.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vue publique · Champs limités</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Quatre contrôles indépendants</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ledger : active · Schéma : valide</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contenu et confiance</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contenu : non contrôlé · Émetteur : inconnu</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Champs publics</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Formation : Initiation XRPL</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Pour lire les champs privés</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Connexion + rôle autorisé + partage à votre</tspan><tspan x="34" dy="18.2">nom</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Se connecter ou demander l’accès</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Voir les preuves disponibles</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">L’autorisation d’utiliser XCS n’est pas une</tspan><tspan x="24" dy="15.600000000000001">garantie de l’émetteur. Aucun score de confiance.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v3.en.svg b/docs/ux/verifier/v3.en.svg
new file mode 100644
index 0000000..fc83305
--- /dev/null
+++ b/docs/ux/verifier/v3.en.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">V3 — Issuer not recognized</title>
+<desc id="desc">Technical checks passed. Assess the issuer separately. Checks do not prove claims are true. Identity, approval and sharing permission are rechecked.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Verifier</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Issuer not recognized</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Technical checks passed. Assess the issuer</tspan><tspan x="24" dy="18.2">separately.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Full view · Sharing audience verified</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Four independent checks</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ledger: active · Schema: valid</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Content and trust</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Payload: valid · Issuer: unknown</tspan></text>
+<rect x="24" y="346.7" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Full fields</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Example · XRPL introduction · 23</tspan><tspan x="34" dy="18.2">Sep 2026</tspan></text>
+<rect x="24" y="434.1" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="443.1" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Detailed evidence</tspan></text>
+<text x="34" y="463.1" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Digest, check provenance, ledger state</tspan></text>
+<rect x="24" y="509.3" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.2" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Inspect evidence</tspan></text>
+<rect x="24" y="563.3" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="576.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">My history</tspan></text>
+<text x="24" y="620.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Checks do not prove claims are true. Identity,</tspan><tspan x="24" dy="15.600000000000001">approval and sharing permission are rechecked.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v3.fr.svg b/docs/ux/verifier/v3.fr.svg
new file mode 100644
index 0000000..6df08f1
--- /dev/null
+++ b/docs/ux/verifier/v3.fr.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">V3 — Émetteur non reconnu</title>
+<desc id="desc">Les contrôles techniques ont réussi. Évaluez l’émetteur séparément. Les contrôles ne prouvent pas la vérité des déclarations. Identité, autorisation et partage sont revérifiés.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Vérificateur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Émetteur non reconnu</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Les contrôles techniques ont réussi.</tspan><tspan x="24" dy="18.2">Évaluez l’émetteur séparément.</tspan></text>
+<rect x="24" y="155.3" width="342" height="54" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vue complète · Destinataire du partage</tspan><tspan x="34" dy="16.900000000000002">vérifié</tspan></text>
+<rect x="24" y="225.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="234.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Quatre contrôles indépendants</tspan></text>
+<text x="34" y="254.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Ledger : active · Schéma : valide</tspan></text>
+<rect x="24" y="294.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="303.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contenu et confiance</tspan></text>
+<text x="34" y="323.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Contenu : valide · Émetteur : inconnu</tspan></text>
+<rect x="24" y="363.7" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="372.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Champs complets</tspan></text>
+<text x="34" y="392.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Camille Exemple · Initiation XRPL ·</tspan><tspan x="34" dy="18.2">23/09/2026</tspan></text>
+<rect x="24" y="451.1" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="460.1" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Preuves détaillées</tspan></text>
+<text x="34" y="480.1" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Empreinte, source du contrôle, état du</tspan><tspan x="34" dy="18.2">ledger</tspan></text>
+<rect x="24" y="544.5" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="557.4" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Consulter les preuves</tspan></text>
+<rect x="24" y="598.5" width="342" height="44" rx="3" fill="#ffffff" stroke="#333333"/>
+<text x="36" y="611.4" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Mon historique</tspan></text>
+<text x="24" y="655.5" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Les contrôles ne prouvent pas la vérité des</tspan><tspan x="24" dy="15.600000000000001">déclarations. Identité, autorisation et partage</tspan><tspan x="24" dy="15.600000000000001">sont revérifiés.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v4.en.svg b/docs/ux/verifier/v4.en.svg
new file mode 100644
index 0000000..4d75af7
--- /dev/null
+++ b/docs/ux/verifier/v4.en.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="en">
+<title id="title">V4 — My verification history</title>
+<desc id="desc">Find past results without retaining credential contents. A past result is not current evidence. Revoked sharing or withdrawn approval means no private access.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Verifier</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">My verification history</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Find past results without retaining</tspan><tspan x="24" dy="18.2">credential contents.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Private history · Metadata only</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 September · Presentation A</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Partially checked</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 September · Presentation B</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Issuer not recognized</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">CSV export</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Dates and results; no private fields</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Open again</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Recheck identity, approval and sharing</tspan><tspan x="34" dy="18.2">grant</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Export metadata</tspan></text>
+<text x="24" y="566.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">A past result is not current evidence. Revoked</tspan><tspan x="24" dy="15.600000000000001">sharing or withdrawn approval means no private</tspan><tspan x="24" dy="15.600000000000001">access.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">WIREFRAME · Fictional example · Non-functional</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/v4.fr.svg b/docs/ux/verifier/v4.fr.svg
new file mode 100644
index 0000000..eb7f0e5
--- /dev/null
+++ b/docs/ux/verifier/v4.fr.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="390" height="844" viewBox="0 0 390 844" role="img" aria-labelledby="title desc" xml:lang="fr">
+<title id="title">V4 — Mes vérifications</title>
+<desc id="desc">Retrouver les résultats sans conserver les contenus. Un ancien résultat n’est pas une preuve actuelle. Partage révoqué ou autorisation retirée : aucun accès privé.</desc>
+<rect x="0" y="0" width="390" height="844" rx="3" fill="#ffffff" stroke="#777777"/>
+<rect x="0" y="0" width="390" height="42" rx="3" fill="#eeeeee" stroke="#777777"/>
+<text x="20" y="12" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="20" dy="0">XCS / Vérificateur</tspan></text>
+<text x="24" y="62" font-family="Arial, sans-serif" font-size="23" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Mes vérifications</tspan></text>
+<text x="24" y="103.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Retrouver les résultats sans conserver les</tspan><tspan x="24" dy="18.2">contenus.</tspan></text>
+<rect x="24" y="155.3" width="342" height="37" rx="3" fill="#eeeeee" stroke="#b4b4b4"/>
+<text x="34" y="165.3" font-family="Arial, sans-serif" font-size="13" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Historique privé · Métadonnées</tspan></text>
+<rect x="24" y="208.3" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="217.3" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 septembre · Présentation A</tspan></text>
+<text x="34" y="237.3" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Vérification partielle</tspan></text>
+<rect x="24" y="277.5" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="286.5" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">23 septembre · Présentation B</tspan></text>
+<text x="34" y="306.5" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Émetteur non reconnu</tspan></text>
+<rect x="24" y="346.7" width="342" height="59.2" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="355.7" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Export CSV</tspan></text>
+<text x="34" y="375.7" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Dates et résultats ; aucun champ privé</tspan></text>
+<rect x="24" y="415.9" width="342" height="77.4" rx="3" fill="#ffffff" stroke="#b4b4b4"/>
+<text x="34" y="424.9" font-family="Arial, sans-serif" font-size="13" fill="#555555" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Consulter à nouveau</tspan></text>
+<text x="34" y="444.9" font-family="Arial, sans-serif" font-size="14" fill="#252525" dominant-baseline="text-before-edge"><tspan x="34" dy="0">Revérifier identité, autorisation et</tspan><tspan x="34" dy="18.2">partage</tspan></text>
+<rect x="24" y="509.29999999999995" width="342" height="44" rx="3" fill="#333333" stroke="#333333"/>
+<text x="36" y="522.1999999999999" font-family="Arial, sans-serif" font-size="14" fill="#ffffff" dominant-baseline="text-before-edge"><tspan x="36" dy="0">Exporter les métadonnées</tspan></text>
+<text x="24" y="566.3" font-family="Arial, sans-serif" font-size="12" fill="#555555" dominant-baseline="text-before-edge"><tspan x="24" dy="0">Un ancien résultat n’est pas une preuve actuelle.</tspan><tspan x="24" dy="15.600000000000001">Partage révoqué ou autorisation retirée : aucun</tspan><tspan x="24" dy="15.600000000000001">accès privé.</tspan></text>
+<text x="24" y="821" font-family="Arial, sans-serif" font-size="10" fill="#666666" dominant-baseline="text-before-edge"><tspan x="24" dy="0">MAQUETTE · Exemple fictif · Non fonctionnel</tspan></text>
+</svg>
diff --git a/docs/ux/verifier/wireframes.en.excalidraw b/docs/ux/verifier/wireframes.en.excalidraw
new file mode 100644
index 0000000..4721267
--- /dev/null
+++ b/docs/ux/verifier/wireframes.en.excalidraw
@@ -0,0 +1,3323 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "V1-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Verifier",
+      "originalText": "XCS / Verifier",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 59.800000000000004,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Request full-detail\naccess",
+      "originalText": "Request full-detail\naccess",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 133.8,
+      "width": 342,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Explain your organization and your need.",
+      "originalText": "Explain your organization and your need.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 167,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 177,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public verification needs no account",
+      "originalText": "Public verification needs no account",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 220,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 229,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization",
+      "originalText": "Organization",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 249,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Example Office",
+      "originalText": "Example Office",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 289.2,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 298.2,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Verification purpose",
+      "originalText": "Verification purpose",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 318.2,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Check declared course completions",
+      "originalText": "Check declared course completions",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 358.4,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 367.4,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact",
+      "originalText": "Contact",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 387.4,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organization work contact",
+      "originalText": "Organization work contact",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 427.59999999999997,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 436.59999999999997,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "After submission",
+      "originalText": "After submission",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 456.59999999999997,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Pending; if declined, show the reason",
+      "originalText": "Pending; if declined, show the reason",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 502.79999999999995,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 515.6999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Submit application",
+      "originalText": "Submit application",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 556.8,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-en-22",
+      "type": "text",
+      "x": 36,
+      "y": 569.6999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Back to presentation",
+      "originalText": "Back to presentation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-23",
+      "type": "text",
+      "x": 24,
+      "y": 613.8,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "After global approval, the recipient must share\nwith your verifier identity.",
+      "originalText": "After global approval, the recipient must share\nwith your verifier identity.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-en-24",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Verifier",
+      "originalText": "XCS / Verifier",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Partially checked",
+      "originalText": "Partially checked",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "The attestation is active. Full content has\nnot been checked.",
+      "originalText": "The attestation is active. Full content has\nnot been checked.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public view · Limited fields",
+      "originalText": "Public view · Limited fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Four independent checks",
+      "originalText": "Four independent checks",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ledger: active · Schema: valid",
+      "originalText": "Ledger: active · Schema: valid",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Content and trust",
+      "originalText": "Content and trust",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Payload: not checked · Issuer: unknown",
+      "originalText": "Payload: not checked · Issuer: unknown",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Public fields",
+      "originalText": "Public fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Course: XRPL introduction",
+      "originalText": "Course: XRPL introduction",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 415.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-17",
+      "type": "text",
+      "x": 474,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "To read private fields",
+      "originalText": "To read private fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-18",
+      "type": "text",
+      "x": 474,
+      "y": 444.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sign-in + approved role + grant addressed\nto you",
+      "originalText": "Sign-in + approved role + grant addressed\nto you",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 509.29999999999995,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-20",
+      "type": "text",
+      "x": 476,
+      "y": 522.1999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Sign in or request access",
+      "originalText": "Sign in or request access",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 563.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-en-22",
+      "type": "text",
+      "x": 476,
+      "y": 576.1999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "View available evidence",
+      "originalText": "View available evidence",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-23",
+      "type": "text",
+      "x": 464,
+      "y": 620.3,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Permission to use XCS is not an endorsement of\nthe issuer. There is no trust score.",
+      "originalText": "Permission to use XCS is not an endorsement of\nthe issuer. There is no trust score.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-en-24",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Verifier",
+      "originalText": "XCS / Verifier",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issuer not recognized",
+      "originalText": "Issuer not recognized",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Technical checks passed. Assess the issuer\nseparately.",
+      "originalText": "Technical checks passed. Assess the issuer\nseparately.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Full view · Sharing audience verified",
+      "originalText": "Full view · Sharing audience verified",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-8",
+      "type": "text",
+      "x": 914,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Four independent checks",
+      "originalText": "Four independent checks",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-9",
+      "type": "text",
+      "x": 914,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ledger: active · Schema: valid",
+      "originalText": "Ledger: active · Schema: valid",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-11",
+      "type": "text",
+      "x": 914,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Content and trust",
+      "originalText": "Content and trust",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-12",
+      "type": "text",
+      "x": 914,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Payload: valid · Issuer: unknown",
+      "originalText": "Payload: valid · Issuer: unknown",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 346.7,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-14",
+      "type": "text",
+      "x": 914,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Full fields",
+      "originalText": "Full fields",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-15",
+      "type": "text",
+      "x": 914,
+      "y": 375.7,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Example · XRPL introduction · 23\nSep 2026",
+      "originalText": "Camille Example · XRPL introduction · 23\nSep 2026",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 434.1,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-17",
+      "type": "text",
+      "x": 914,
+      "y": 443.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Detailed evidence",
+      "originalText": "Detailed evidence",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-18",
+      "type": "text",
+      "x": 914,
+      "y": 463.1,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Digest, check provenance, ledger state",
+      "originalText": "Digest, check provenance, ledger state",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 509.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-20",
+      "type": "text",
+      "x": 916,
+      "y": 522.2,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Inspect evidence",
+      "originalText": "Inspect evidence",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 563.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-en-22",
+      "type": "text",
+      "x": 916,
+      "y": 576.1999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "My history",
+      "originalText": "My history",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-23",
+      "type": "text",
+      "x": 904,
+      "y": 620.3,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Checks do not prove claims are true. Identity,\napproval and sharing permission are rechecked.",
+      "originalText": "Checks do not prove claims are true. Identity,\napproval and sharing permission are rechecked.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-en-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Verifier",
+      "originalText": "XCS / Verifier",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "My verification history",
+      "originalText": "My verification history",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Find past results without retaining\ncredential contents.",
+      "originalText": "Find past results without retaining\ncredential contents.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Private history · Metadata only",
+      "originalText": "Private history · Metadata only",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 September · Presentation A",
+      "originalText": "23 September · Presentation A",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Partially checked",
+      "originalText": "Partially checked",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 September · Presentation B",
+      "originalText": "23 September · Presentation B",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Issuer not recognized",
+      "originalText": "Issuer not recognized",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-14",
+      "type": "text",
+      "x": 34,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "CSV export",
+      "originalText": "CSV export",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-15",
+      "type": "text",
+      "x": 34,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Dates and results; no private fields",
+      "originalText": "Dates and results; no private fields",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1339.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-17",
+      "type": "text",
+      "x": 34,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Open again",
+      "originalText": "Open again",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-18",
+      "type": "text",
+      "x": 34,
+      "y": 1368.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Recheck identity, approval and sharing\ngrant",
+      "originalText": "Recheck identity, approval and sharing\ngrant",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-en-20",
+      "type": "text",
+      "x": 36,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Export metadata",
+      "originalText": "Export metadata",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-21",
+      "type": "text",
+      "x": 24,
+      "y": 1490.3,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "A past result is not current evidence. Revoked\nsharing or withdrawn approval means no private\naccess.",
+      "originalText": "A past result is not current evidence. Revoked\nsharing or withdrawn approval means no private\naccess.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-en-22",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "WIREFRAME · Fictional example · Non-functional",
+      "originalText": "WIREFRAME · Fictional example · Non-functional",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/docs/ux/verifier/wireframes.fr.excalidraw b/docs/ux/verifier/wireframes.fr.excalidraw
new file mode 100644
index 0000000..37a4986
--- /dev/null
+++ b/docs/ux/verifier/wireframes.fr.excalidraw
@@ -0,0 +1,3323 @@
+{
+  "type": "excalidraw",
+  "version": 2,
+  "source": "https://excalidraw.com",
+  "elements": [
+    {
+      "id": "V1-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Vérificateur",
+      "originalText": "XCS / Vérificateur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Demander l’accès complet",
+      "originalText": "Demander l’accès complet",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Présenter votre organisation et votre\nbesoin.",
+      "originalText": "Présenter votre organisation et votre\nbesoin.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérification publique sans compte",
+      "originalText": "Vérification publique sans compte",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Organisation",
+      "originalText": "Organisation",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Bureau Exemple",
+      "originalText": "Bureau Exemple",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "But des vérifications",
+      "originalText": "But des vérifications",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérifier les formations déclarées",
+      "originalText": "Vérifier les formations déclarées",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact",
+      "originalText": "Contact",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contact professionnel de l’organisation",
+      "originalText": "Contact professionnel de l’organisation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 415.9,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Après l’envoi",
+      "originalText": "Après l’envoi",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 444.9,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "En attente ; si refus, motif affiché",
+      "originalText": "En attente ; si refus, motif affiché",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 491.09999999999997,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 503.99999999999994,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Envoyer ma demande",
+      "originalText": "Envoyer ma demande",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-21",
+      "type": "rectangle",
+      "x": 24,
+      "y": 545.0999999999999,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V1-fr-22",
+      "type": "text",
+      "x": 36,
+      "y": 557.9999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retour à la présentation",
+      "originalText": "Retour à la présentation",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-23",
+      "type": "text",
+      "x": 24,
+      "y": 602.0999999999999,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Après autorisation globale, le destinataire doit\npartager avec votre identité de vérificateur.",
+      "originalText": "Après autorisation globale, le destinataire doit\npartager avec votre identité de vérificateur.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V1-fr-24",
+      "type": "text",
+      "x": 24,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-0",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-1",
+      "type": "rectangle",
+      "x": 440,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-2",
+      "type": "text",
+      "x": 460,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Vérificateur",
+      "originalText": "XCS / Vérificateur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-3",
+      "type": "text",
+      "x": 464,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérification partielle",
+      "originalText": "Vérification partielle",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-4",
+      "type": "text",
+      "x": 464,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "L’attestation est active. Le contenu\ncomplet n’a pas été contrôlé.",
+      "originalText": "L’attestation est active. Le contenu\ncomplet n’a pas été contrôlé.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-5",
+      "type": "rectangle",
+      "x": 464,
+      "y": 155.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-6",
+      "type": "text",
+      "x": 474,
+      "y": 165.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vue publique · Champs limités",
+      "originalText": "Vue publique · Champs limités",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-7",
+      "type": "rectangle",
+      "x": 464,
+      "y": 208.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-8",
+      "type": "text",
+      "x": 474,
+      "y": 217.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Quatre contrôles indépendants",
+      "originalText": "Quatre contrôles indépendants",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-9",
+      "type": "text",
+      "x": 474,
+      "y": 237.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ledger : active · Schéma : valide",
+      "originalText": "Ledger : active · Schéma : valide",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-10",
+      "type": "rectangle",
+      "x": 464,
+      "y": 277.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-11",
+      "type": "text",
+      "x": 474,
+      "y": 286.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contenu et confiance",
+      "originalText": "Contenu et confiance",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-12",
+      "type": "text",
+      "x": 474,
+      "y": 306.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contenu : non contrôlé · Émetteur : inconnu",
+      "originalText": "Contenu : non contrôlé · Émetteur : inconnu",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-13",
+      "type": "rectangle",
+      "x": 464,
+      "y": 346.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-14",
+      "type": "text",
+      "x": 474,
+      "y": 355.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Champs publics",
+      "originalText": "Champs publics",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-15",
+      "type": "text",
+      "x": 474,
+      "y": 375.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Formation : Initiation XRPL",
+      "originalText": "Formation : Initiation XRPL",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-16",
+      "type": "rectangle",
+      "x": 464,
+      "y": 415.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-17",
+      "type": "text",
+      "x": 474,
+      "y": 424.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Pour lire les champs privés",
+      "originalText": "Pour lire les champs privés",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-18",
+      "type": "text",
+      "x": 474,
+      "y": 444.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Connexion + rôle autorisé + partage à votre\nnom",
+      "originalText": "Connexion + rôle autorisé + partage à votre\nnom",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-19",
+      "type": "rectangle",
+      "x": 464,
+      "y": 509.29999999999995,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-20",
+      "type": "text",
+      "x": 476,
+      "y": 522.1999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Se connecter ou demander l’accès",
+      "originalText": "Se connecter ou demander l’accès",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-21",
+      "type": "rectangle",
+      "x": 464,
+      "y": 563.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V2-fr-22",
+      "type": "text",
+      "x": 476,
+      "y": 576.1999999999999,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Voir les preuves disponibles",
+      "originalText": "Voir les preuves disponibles",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-23",
+      "type": "text",
+      "x": 464,
+      "y": 620.3,
+      "width": 342,
+      "height": 31.200000000000003,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "L’autorisation d’utiliser XCS n’est pas une\ngarantie de l’émetteur. Aucun score de confiance.",
+      "originalText": "L’autorisation d’utiliser XCS n’est pas une\ngarantie de l’émetteur. Aucun score de confiance.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V2-fr-24",
+      "type": "text",
+      "x": 464,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-0",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-1",
+      "type": "rectangle",
+      "x": 880,
+      "y": 0,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-2",
+      "type": "text",
+      "x": 900,
+      "y": 12,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Vérificateur",
+      "originalText": "XCS / Vérificateur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-3",
+      "type": "text",
+      "x": 904,
+      "y": 62,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émetteur non reconnu",
+      "originalText": "Émetteur non reconnu",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-4",
+      "type": "text",
+      "x": 904,
+      "y": 103.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Les contrôles techniques ont réussi.\nÉvaluez l’émetteur séparément.",
+      "originalText": "Les contrôles techniques ont réussi.\nÉvaluez l’émetteur séparément.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-5",
+      "type": "rectangle",
+      "x": 904,
+      "y": 155.3,
+      "width": 342,
+      "height": 54,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-6",
+      "type": "text",
+      "x": 914,
+      "y": 165.3,
+      "width": 332,
+      "height": 33.800000000000004,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vue complète · Destinataire du partage\nvérifié",
+      "originalText": "Vue complète · Destinataire du partage\nvérifié",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-7",
+      "type": "rectangle",
+      "x": 904,
+      "y": 225.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-8",
+      "type": "text",
+      "x": 914,
+      "y": 234.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Quatre contrôles indépendants",
+      "originalText": "Quatre contrôles indépendants",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-9",
+      "type": "text",
+      "x": 914,
+      "y": 254.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Ledger : active · Schéma : valide",
+      "originalText": "Ledger : active · Schéma : valide",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-10",
+      "type": "rectangle",
+      "x": 904,
+      "y": 294.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-11",
+      "type": "text",
+      "x": 914,
+      "y": 303.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contenu et confiance",
+      "originalText": "Contenu et confiance",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-12",
+      "type": "text",
+      "x": 914,
+      "y": 323.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Contenu : valide · Émetteur : inconnu",
+      "originalText": "Contenu : valide · Émetteur : inconnu",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-13",
+      "type": "rectangle",
+      "x": 904,
+      "y": 363.7,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-14",
+      "type": "text",
+      "x": 914,
+      "y": 372.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Champs complets",
+      "originalText": "Champs complets",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-15",
+      "type": "text",
+      "x": 914,
+      "y": 392.7,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Camille Exemple · Initiation XRPL ·\n23/09/2026",
+      "originalText": "Camille Exemple · Initiation XRPL ·\n23/09/2026",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-16",
+      "type": "rectangle",
+      "x": 904,
+      "y": 451.1,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-17",
+      "type": "text",
+      "x": 914,
+      "y": 460.1,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Preuves détaillées",
+      "originalText": "Preuves détaillées",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-18",
+      "type": "text",
+      "x": 914,
+      "y": 480.1,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Empreinte, source du contrôle, état du\nledger",
+      "originalText": "Empreinte, source du contrôle, état du\nledger",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-19",
+      "type": "rectangle",
+      "x": 904,
+      "y": 544.5,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-20",
+      "type": "text",
+      "x": 916,
+      "y": 557.4,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Consulter les preuves",
+      "originalText": "Consulter les preuves",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-21",
+      "type": "rectangle",
+      "x": 904,
+      "y": 598.5,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V3-fr-22",
+      "type": "text",
+      "x": 916,
+      "y": 611.4,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Mon historique",
+      "originalText": "Mon historique",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-23",
+      "type": "text",
+      "x": 904,
+      "y": 655.5,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Les contrôles ne prouvent pas la vérité des\ndéclarations. Identité, autorisation et partage\nsont revérifiés.",
+      "originalText": "Les contrôles ne prouvent pas la vérité des\ndéclarations. Identité, autorisation et partage\nsont revérifiés.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V3-fr-24",
+      "type": "text",
+      "x": 904,
+      "y": 821,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-0",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 844,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-1",
+      "type": "rectangle",
+      "x": 0,
+      "y": 924,
+      "width": 390,
+      "height": 42,
+      "angle": 0,
+      "strokeColor": "#777777",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-2",
+      "type": "text",
+      "x": 20,
+      "y": 936,
+      "width": 346,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "XCS / Vérificateur",
+      "originalText": "XCS / Vérificateur",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-3",
+      "type": "text",
+      "x": 24,
+      "y": 986,
+      "width": 342,
+      "height": 29.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Mes vérifications",
+      "originalText": "Mes vérifications",
+      "fontSize": 23,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-4",
+      "type": "text",
+      "x": 24,
+      "y": 1027.9,
+      "width": 342,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Retrouver les résultats sans conserver les\ncontenus.",
+      "originalText": "Retrouver les résultats sans conserver les\ncontenus.",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-5",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1079.3,
+      "width": 342,
+      "height": 37,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#eeeeee",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-6",
+      "type": "text",
+      "x": 34,
+      "y": 1089.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Historique privé · Métadonnées",
+      "originalText": "Historique privé · Métadonnées",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-7",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1132.3,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-8",
+      "type": "text",
+      "x": 34,
+      "y": 1141.3,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 septembre · Présentation A",
+      "originalText": "23 septembre · Présentation A",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-9",
+      "type": "text",
+      "x": 34,
+      "y": 1161.3,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Vérification partielle",
+      "originalText": "Vérification partielle",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-10",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1201.5,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-11",
+      "type": "text",
+      "x": 34,
+      "y": 1210.5,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "23 septembre · Présentation B",
+      "originalText": "23 septembre · Présentation B",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-12",
+      "type": "text",
+      "x": 34,
+      "y": 1230.5,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Émetteur non reconnu",
+      "originalText": "Émetteur non reconnu",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-13",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1270.7,
+      "width": 342,
+      "height": 59.2,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-14",
+      "type": "text",
+      "x": 34,
+      "y": 1279.7,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Export CSV",
+      "originalText": "Export CSV",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-15",
+      "type": "text",
+      "x": 34,
+      "y": 1299.7,
+      "width": 332,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Dates et résultats ; aucun champ privé",
+      "originalText": "Dates et résultats ; aucun champ privé",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-16",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1339.9,
+      "width": 342,
+      "height": 77.4,
+      "angle": 0,
+      "strokeColor": "#b4b4b4",
+      "backgroundColor": "#ffffff",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-17",
+      "type": "text",
+      "x": 34,
+      "y": 1348.9,
+      "width": 332,
+      "height": 16.900000000000002,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Consulter à nouveau",
+      "originalText": "Consulter à nouveau",
+      "fontSize": 13,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-18",
+      "type": "text",
+      "x": 34,
+      "y": 1368.9,
+      "width": 332,
+      "height": 36.4,
+      "angle": 0,
+      "strokeColor": "#252525",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Revérifier identité, autorisation et\npartage",
+      "originalText": "Revérifier identité, autorisation et\npartage",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-19",
+      "type": "rectangle",
+      "x": 24,
+      "y": 1433.3,
+      "width": 342,
+      "height": 44,
+      "angle": 0,
+      "strokeColor": "#333333",
+      "backgroundColor": "#333333",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false
+    },
+    {
+      "id": "V4-fr-20",
+      "type": "text",
+      "x": 36,
+      "y": 1446.1999999999998,
+      "width": 330,
+      "height": 18.2,
+      "angle": 0,
+      "strokeColor": "#ffffff",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Exporter les métadonnées",
+      "originalText": "Exporter les métadonnées",
+      "fontSize": 14,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-21",
+      "type": "text",
+      "x": 24,
+      "y": 1490.3,
+      "width": 342,
+      "height": 46.800000000000004,
+      "angle": 0,
+      "strokeColor": "#555555",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "Un ancien résultat n’est pas une preuve actuelle.\nPartage révoqué ou autorisation retirée : aucun\naccès privé.",
+      "originalText": "Un ancien résultat n’est pas une preuve actuelle.\nPartage révoqué ou autorisation retirée : aucun\naccès privé.",
+      "fontSize": 12,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    },
+    {
+      "id": "V4-fr-22",
+      "type": "text",
+      "x": 24,
+      "y": 1745,
+      "width": 342,
+      "height": 13,
+      "angle": 0,
+      "strokeColor": "#666666",
+      "backgroundColor": "transparent",
+      "fillStyle": "solid",
+      "strokeWidth": 1,
+      "strokeStyle": "solid",
+      "roughness": 0,
+      "opacity": 100,
+      "groupIds": [],
+      "frameId": null,
+      "roundness": null,
+      "seed": 1,
+      "version": 1,
+      "versionNonce": 1,
+      "isDeleted": false,
+      "boundElements": null,
+      "updated": 1,
+      "created": null,
+      "link": null,
+      "locked": false,
+      "text": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "originalText": "MAQUETTE · Exemple fictif · Non fonctionnel",
+      "fontSize": 10,
+      "fontFamily": 2,
+      "textAlign": "left",
+      "verticalAlign": "top",
+      "containerId": null,
+      "autoResize": true,
+      "lineHeight": 1.3
+    }
+  ],
+  "appState": {
+    "viewBackgroundColor": "#f5f5f5",
+    "gridSize": null
+  },
+  "files": {}
+}
diff --git a/ops/ci/check-compose-overlays.mjs b/ops/ci/check-compose-overlays.mjs
new file mode 100644
index 0000000..66f73b6
--- /dev/null
+++ b/ops/ci/check-compose-overlays.mjs
@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+// Configuration-only checks: no images are built and no containers are started.
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+// Never inherit an operator's .env or application secrets into a rendered fixture.
+const fixture = Object.fromEntries(
+  Object.entries(process.env).filter(([key]) => !/^(XCS_|NUXT_|COMPOSE_)/.test(key)),
+)
+Object.assign(fixture, {
+  COMPOSE_PROJECT_NAME: 'xcs-config-validation',
+  XCS_AUTH_ORIGIN: 'https://xcs.invalid',
+  XCS_IDENTITY_CLIENT_ID: 'compose-fixture-client',
+  XCS_IDENTITY_CLIENT_SECRET: 'compose-fixture-identity-secret',
+  XCS_ADMIN_DOCUMENT_KEY: 'compose-fixture-document-signing-key-00001',
+  XCS_PUBLIC_PAYLOAD_BASE_URL: 'https://xcs.invalid',
+  XCS_PAYLOAD_STORAGE_IP_HASH_SECRET: 'compose-fixture-payload-hashing-key-00001',
+  XCS_HOSTED_PAYLOAD_NETWORKS: 'xrpl-testnet-xcs-v0.1',
+  XCS_GRAFANA_ADMIN_PASSWORD: 'compose-fixture-grafana-password',
+})
+fixture.XCS_POSTGRES_ADMIN_PASSWORD = 'compose-fixture-admin-password-00001'
+
+function check(condition, label) {
+  assert.ok(condition, label)
+}
+function role(environment, variable, expected) {
+  const url = new URL(environment[variable])
+  check(
+    url.protocol === 'postgres:' &&
+      url.hostname === 'postgres' &&
+      url.port === '5432' &&
+      url.pathname === '/xcs' &&
+      url.username === expected &&
+      Boolean(url.password),
+    `${variable} must use the dedicated ${expected} pool`,
+  )
+}
+
+for (const app of ['web', 'indexer']) {
+  const manifest = JSON.parse(readFileSync(`apps/${app}/package.json`, 'utf8'))
+  for (const dependencies of [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+  ]) {
+    for (const [name, version] of Object.entries(dependencies ?? {})) {
+      check(
+        !name.startsWith('@xcs-protocol/') && !/^(workspace:|link:|file:)/.test(version),
+        `${app} must resolve its dependencies independently`,
+      )
+    }
+  }
+}
+
+// The notifier and bootstrap are deliberately thin runtime images compiled from
+// the web and indexer applications. They have their own Dockerfiles and contracts,
+// but no duplicate package manifest that could drift from the owning application.
+for (const app of ['web', 'indexer', 'notifier', 'db-bootstrap']) {
+  const dockerfile = readFileSync(`apps/${app}/Dockerfile`, 'utf8')
+  check(
+    !/^COPY\s+(?:--\S+\s+)*(?:\.\s|packages\b|pnpm-workspace\.yaml\b|package\.json\b|pnpm-lock\.yaml\b)/m.test(
+      dockerfile,
+    ),
+    `${app} must not copy the root workspace into its image`,
+  )
+  check(/^USER node$/m.test(dockerfile), `${app} must run as node`)
+}
+
+let rendered = 0
+for (const application of [false, true]) {
+  for (const hosted of [false, true]) {
+    for (const development of [false, true]) {
+      for (const profiles of [
+        [],
+        ['monitoring'],
+        ['demo-pinning'],
+        ['monitoring', 'demo-pinning'],
+      ]) {
+        const args = ['compose', '--env-file', '/dev/null', '-f', 'docker-compose.yml']
+        if (application) args.push('-f', 'docker-compose.application.yml')
+        if (hosted) args.push('-f', 'docker-compose.hosted-payloads.yml')
+        if (development) args.push('-f', 'docker-compose.dev.yml')
+        for (const profile of profiles) args.push('--profile', profile)
+        const config = JSON.parse(
+          execFileSync('docker', [...args, 'config', '--format', 'json'], {
+            env: fixture,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+          }),
+        )
+        const services = config.services
+        const expected = ['db-bootstrap', 'indexer', 'postgres', 'web']
+        if (application) expected.push('admin-notifier', 'mailpit')
+        if (profiles.includes('monitoring'))
+          expected.push('prometheus', 'grafana', 'postgres-exporter', 'node-exporter')
+        if (profiles.includes('demo-pinning')) expected.push('ipfs')
+        assert.deepEqual(Object.keys(services).sort(), expected.sort())
+        check(config.networks.database.internal === true, 'database network must be internal')
+        check(config.networks.monitoring.internal === true, 'monitoring network must be internal')
+        role(services.web.environment, 'XCS_DATABASE_URL', 'xcs_api')
+        if (hosted) role(services.web.environment, 'XCS_PAYLOAD_DATABASE_URL', 'xcs_payload_writer')
+        role(services.indexer.environment, 'XCS_INDEXER_DATABASE_URL', 'xcs_indexer')
+        role(services['db-bootstrap'].environment, 'XCS_BOOTSTRAP_DATABASE_URL', 'xcs_admin')
+        for (const name of ['web', 'indexer']) {
+          check(
+            services[name].build.context === resolve('.'),
+            `${name} build context must be the repository root`,
+          )
+          check(
+            services[name].build.dockerfile === `apps/${name}/Dockerfile`,
+            `${name} must build its own Dockerfile`,
+          )
+          check(services[name].read_only === true, `${name} must retain read-only root filesystem`)
+        }
+        check(
+          services['db-bootstrap'].image === services.indexer.image,
+          'bootstrap must reuse the indexer image',
+        )
+        for (const [name, service] of Object.entries(services)) {
+          check(!service.image.endsWith(':latest'), `${name} image must be pinned`)
+          for (const port of service.ports ?? []) {
+            check(port.host_ip === '127.0.0.1', `${name} published ports must be loopback only`)
+            check(
+              name === 'web' ||
+                (application && name === 'mailpit') ||
+                (development && ['postgres', 'prometheus', 'grafana', 'ipfs'].includes(name)),
+              `${name} must not expose a port in this overlay`,
+            )
+          }
+          if (name !== 'web')
+            check(
+              !(service.volumes ?? []).some((volume) => volume.source === 'xcs-review-documents'),
+              `${name} must not mount private issuer documents`,
+            )
+          if (name !== 'web')
+            check(
+              !service.environment?.NUXT_ISSUER_DATABASE_URL,
+              `${name} must not receive the issuer pool`,
+            )
+        }
+        if (application) {
+          const environment = services.web.environment
+          check(
+            environment.XCS_AUTH_ORIGIN === fixture.XCS_AUTH_ORIGIN &&
+              environment.XCS_IDENTITY_CLIENT_ID === fixture.XCS_IDENTITY_CLIENT_ID &&
+              Boolean(environment.XCS_IDENTITY_CLIENT_SECRET),
+            'application overlay must supply the complete authentication contract',
+          )
+          role(environment, 'NUXT_APP_DATABASE_URL', 'xcs_app')
+          role(environment, 'NUXT_ADMIN_DATABASE_URL', 'xcs_admin_app')
+          role(environment, 'NUXT_ISSUER_DATABASE_URL', 'xcs_issuer')
+          role(services['admin-notifier'].environment, 'XCS_NOTIFIER_DATABASE_URL', 'xcs_notifier')
+          check(
+            config.networks['application-mail'].internal === true,
+            'SMTP network must be internal',
+          )
+          check(
+            !services.mailpit.networks.database && !services.mailpit.networks.edge,
+            'Mailpit must not join database or edge',
+          )
+          check(!services['admin-notifier'].networks.edge, 'notifier must not join edge')
+          check(
+            services['admin-notifier'].build.dockerfile === 'apps/notifier/Dockerfile',
+            'notifier must use its standalone image',
+          )
+          check(
+            services['admin-notifier'].user === 'node' &&
+              services['admin-notifier'].read_only === true,
+            'notifier must retain node user and read-only filesystem',
+          )
+          check(
+            environment.XCS_DOCUMENT_STORAGE_DRIVER === 'filesystem' &&
+              environment.XCS_DOCUMENT_FILESYSTEM_DIRECTORY === '/var/lib/xcs-review' &&
+              environment.XCS_DOCUMENT_FILESYSTEM_LOCAL === '1',
+            'reviewers and issuers must share the private document directory',
+          )
+          const documents = services.web.volumes.find(
+            (volume) => volume.target === '/var/lib/xcs-review',
+          )
+          check(
+            documents?.type === 'volume' &&
+              documents.source === 'xcs-review-documents' &&
+              !documents.read_only,
+            'private documents must use the durable writable named volume',
+          )
+        } else {
+          check(
+            !services.web.environment.NUXT_APP_DATABASE_URL &&
+              !services.web.environment.NUXT_ADMIN_DATABASE_URL &&
+              !services.web.environment.NUXT_ISSUER_DATABASE_URL,
+            'base stack must not enable private application pools',
+          )
+        }
+        if (hosted) {
+          check(
+            services.web.environment.XCS_PUBLIC_PAYLOAD_BASE_URL ===
+              fixture.XCS_PUBLIC_PAYLOAD_BASE_URL,
+            'hosted payload origin must be explicit',
+          )
+          check(
+            services.web.environment.XCS_PAYLOAD_STORAGE_IP_HASH_SECRET ===
+              fixture.XCS_PAYLOAD_STORAGE_IP_HASH_SECRET &&
+              services.web.environment.XCS_HOSTED_PAYLOAD_NETWORKS ===
+                fixture.XCS_HOSTED_PAYLOAD_NETWORKS,
+            'public payload quota secret and network allowlist must be explicit',
+          )
+        } else {
+          check(
+            !services.web.environment.XCS_PUBLIC_PAYLOAD_BASE_URL,
+            'base stack must keep hosted publishing disabled',
+          )
+          check(
+            !services.web.environment.XCS_PAYLOAD_DATABASE_URL,
+            'base stack must not receive the payload writer pool',
+          )
+        }
+        rendered += 1
+      }
+    }
+  }
+}
+console.log(
+  `Compose overlays validated: ${rendered} configurations; standalone images, private pools, networks and volumes.`,
+)
diff --git a/ops/security/trivyignore.yaml b/ops/security/trivyignore.yaml
index 26c968b..6a0ff3c 100644
--- a/ops/security/trivyignore.yaml
+++ b/ops/security/trivyignore.yaml
@@ -1,4 +1,20 @@
-vulnerabilities: []
+vulnerabilities:
+  - id: CVE-2026-85393
+    statement: >-
+      node-forge 1.4.0 is patched locally with the exact nested DigestAlgorithm
+      element-count fix proposed upstream in digitalbazaar/forge#1152; Trivy
+      identifies the published version and cannot recognize the pnpm patch.
+    expired_at: 2026-11-09
+    purls:
+      - pkg:npm/node-forge@1.4.0
+  - id: CVE-2026-93687
+    statement: >-
+      braces has no patched release; XCS reaches it through internal Nuxt build
+      globbing and does not pass request-controlled patterns to the package.
+      Recheck upstream and remove this exception when a fix is published.
+    expired_at: 2026-11-09
+    purls:
+      - pkg:npm/braces@3.0.3
 misconfigurations: []
 secrets: []
 licenses: []
diff --git a/package.json b/package.json
index 676555a..1a6f891 100644
--- a/package.json
+++ b/package.json
@@ -35,10 +35,11 @@
     "lint": "turbo run lint && pnpm --dir apps/web lint && pnpm --dir apps/indexer lint",
     "test": "turbo run test && pnpm --dir apps/web test && pnpm --dir apps/indexer test",
     "test:coverage": "turbo run test:coverage && pnpm --dir apps/web test:coverage && pnpm --dir apps/indexer test:coverage",
-    "test:e2e": "XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 pnpm --dir apps/web build && pnpm --dir apps/web test:e2e && pnpm --dir apps/web test:e2e:security",
+    "test:e2e": "XCS_BROWSER_E2E=0 XCS_LOCAL_PAYLOAD_STORE=0 pnpm --dir apps/web build && pnpm --dir apps/web test:e2e && pnpm --dir apps/web test:e2e:security && pnpm --dir apps/web test:e2e:auth",
     "test:postgres": "pnpm --dir apps/indexer test:postgres && pnpm --dir apps/web test:postgres",
     "typecheck": "turbo run typecheck && pnpm --dir apps/web typecheck && pnpm --dir apps/indexer typecheck",
-    "verify": "pnpm format:check && pnpm check:repo && pnpm lint && pnpm typecheck && pnpm test && pnpm build"
+    "verify": "pnpm format:check && pnpm check:repo && pnpm lint && pnpm typecheck && pnpm test && pnpm build",
+    "test:runtime": "pnpm --dir apps/web build && pnpm --dir apps/web test:runtime"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
diff --git a/packages/core/src/claims.ts b/packages/core/src/claims.ts
index aef527d..4876d04 100644
--- a/packages/core/src/claims.ts
+++ b/packages/core/src/claims.ts
@@ -32,46 +32,46 @@ function isCanonicalBase64Url(value: string): boolean {
 }
 
 function parseValue(value: unknown, descriptor: FieldDescriptor, path: string): JsonValue {
-  if (value === null) return fail('INVALID_CLAIMS', 'null is not allowed', path)
+  if (value === null) return fail('CLAIMS_INVALID', 'null is not allowed', path)
 
   switch (descriptor.type) {
     case 'string':
-      if (typeof value !== 'string') return fail('INVALID_CLAIMS', 'Expected a string', path)
+      if (typeof value !== 'string') return fail('CLAIMS_INVALID', 'Expected a string', path)
       return value
     case 'bool':
-      if (typeof value !== 'boolean') return fail('INVALID_CLAIMS', 'Expected a boolean', path)
+      if (typeof value !== 'boolean') return fail('CLAIMS_INVALID', 'Expected a boolean', path)
       return value
     case 'uint': {
       if (typeof value !== 'string' || !UNSIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical unsigned decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical unsigned decimal string', path)
       }
       if (value.length > 78 || BigInt(value) > UINT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Unsigned integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Unsigned integer exceeds 256 bits', path)
       }
       return value
     }
     case 'int': {
       if (typeof value !== 'string' || !SIGNED_INTEGER.test(value)) {
-        return fail('INVALID_CLAIMS', 'Expected a canonical signed decimal string', path)
+        return fail('CLAIMS_INVALID', 'Expected a canonical signed decimal string', path)
       }
       const integer = BigInt(value)
       if (value.length > 79 || integer < INT256_MIN || integer > INT256_MAX) {
-        return fail('INVALID_CLAIMS', 'Signed integer exceeds 256 bits', path)
+        return fail('CLAIMS_INVALID', 'Signed integer exceeds 256 bits', path)
       }
       return value
     }
     case 'bytes':
       if (typeof value !== 'string' || !isCanonicalBase64Url(value)) {
-        return fail('INVALID_CLAIMS', 'Expected unpadded canonical base64url', path)
+        return fail('CLAIMS_INVALID', 'Expected unpadded canonical base64url', path)
       }
       return value
     case 'address':
       if (typeof value !== 'string' || !isValidClassicAddress(value)) {
-        return fail('INVALID_CLAIMS', 'Expected an XRPL classic address', path)
+        return fail('CLAIMS_INVALID', 'Expected an XRPL classic address', path)
       }
       return value
     case 'array':
-      if (!Array.isArray(value)) return fail('INVALID_CLAIMS', 'Expected an array', path)
+      if (!Array.isArray(value)) return fail('CLAIMS_INVALID', 'Expected an array', path)
       return value.map((item, index) => parseValue(item, descriptor.items, `${path}[${index}]`))
     case 'object':
       return parseObject(value, descriptor.fields, path)
@@ -79,10 +79,10 @@ function parseValue(value: unknown, descriptor: FieldDescriptor, path: string):
 }
 
 function parseObject(input: unknown, fields: SchemaFields, path: string): JsonObject {
-  if (!isRecord(input)) return fail('INVALID_CLAIMS', 'Expected an object', path)
+  if (!isRecord(input)) return fail('CLAIMS_INVALID', 'Expected an object', path)
   for (const name of Object.keys(input)) {
     if (!Object.hasOwn(fields, name)) {
-      return fail('INVALID_CLAIMS', `Unknown claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Unknown claim ${name}`, `${path}.${name}`)
     }
   }
 
@@ -90,7 +90,7 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
   for (const [name, descriptor] of Object.entries(fields)) {
     if (!Object.hasOwn(input, name)) {
       if (descriptor.optional === true) continue
-      return fail('INVALID_CLAIMS', `Missing required claim ${name}`, `${path}.${name}`)
+      return fail('CLAIMS_INVALID', `Missing required claim ${name}`, `${path}.${name}`)
     }
     claims[name] = parseValue(input[name], descriptor, `${path}.${name}`)
   }
@@ -100,3 +100,15 @@ function parseObject(input: unknown, fields: SchemaFields, path: string): JsonOb
 export function parseClaims(input: unknown, fields: SchemaFields): JsonObject {
   return parseObject(input, fields, '$.claims')
 }
+
+export function validateClaims(
+  input: unknown,
+  schema: SchemaFields | { fields: SchemaFields; definition?: unknown; lineage?: unknown },
+): JsonObject {
+  const resolved = schema as { fields?: unknown; definition?: unknown; lineage?: unknown }
+  const fields =
+    resolved.definition !== undefined && resolved.lineage !== undefined
+      ? (resolved.fields as SchemaFields)
+      : (schema as SchemaFields)
+  return parseClaims(input, fields)
+}
diff --git a/packages/core/src/credential.ts b/packages/core/src/credential.ts
index f5902b2..76af34b 100644
--- a/packages/core/src/credential.ts
+++ b/packages/core/src/credential.ts
@@ -10,7 +10,9 @@ export interface CredentialContext {
   issuer: string
   subject: string
   schemaUid: string
-  fields: SchemaFields
+  fields?: SchemaFields
+  /** Backward-compatible XCS v0.1 context name. */
+  schema?: SchemaFields
 }
 
 export interface CredentialPayload extends JsonObject {
@@ -41,47 +43,52 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 
 function assertContext(context: CredentialContext): void {
   if (!isValidClassicAddress(context.issuer)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid issuer address', '$context.issuer')
+    fail('PAYLOAD_INVALID', 'Invalid issuer address', '$context.issuer')
   }
   if (!isValidClassicAddress(context.subject)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid subject address', '$context.subject')
+    fail('PAYLOAD_INVALID', 'Invalid subject address', '$context.subject')
   }
   if (!SCHEMA_UID.test(context.schemaUid)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema UID', '$context.schemaUid')
+    fail('PAYLOAD_INVALID', 'Invalid schema UID', '$context.schemaUid')
   }
-  if (!isRecord(context.fields)) {
-    fail('INVALID_CREDENTIAL_PAYLOAD', 'Invalid schema fields', '$context.fields')
+  if (!isRecord(context.fields ?? context.schema)) {
+    fail('PAYLOAD_INVALID', 'Invalid schema fields', '$context.fields')
   }
 }
 
-function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+function contextFields(context: CredentialContext): SchemaFields {
   assertContext(context)
+  return (context.fields ?? context.schema) as SchemaFields
+}
+
+function parsePayload(input: unknown, context: CredentialContext): CredentialPayload {
+  const fields = contextFields(context)
   if (!isRecord(input)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Credential payload must be an object', '$')
+    return fail('PAYLOAD_INVALID', 'Credential payload must be an object', '$')
   }
   for (const property of Object.keys(input)) {
     if (!PAYLOAD_PROPERTIES.has(property)) {
-      return fail('INVALID_CREDENTIAL_PAYLOAD', `Unknown property ${property}`, `$.${property}`)
+      return fail('PAYLOAD_INVALID', `Unknown property ${property}`, `$.${property}`)
     }
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('PAYLOAD_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (input.issuer !== context.issuer) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Issuer does not match the credential', '$.issuer')
+    return fail('PAYLOAD_INVALID', 'Issuer does not match the credential', '$.issuer')
   }
   if (input.subject !== context.subject) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Subject does not match the credential', '$.subject')
+    return fail('PAYLOAD_INVALID', 'Subject does not match the credential', '$.subject')
   }
   if (input.schema !== context.schemaUid) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Schema does not match CredentialType', '$.schema')
+    return fail('PAYLOAD_INVALID', 'Schema does not match CredentialType', '$.schema')
   }
   return {
     xcsVersion: '0.1',
     issuer: context.issuer,
     subject: context.subject,
     schema: context.schemaUid,
-    claims: parseClaims(input.claims, context.fields),
+    claims: parseClaims(input.claims, fields),
   }
 }
 
@@ -110,7 +117,21 @@ export function parseCredentialPayload(
   context: CredentialContext,
 ): CredentialPayload {
   const bytes = payloadBytes(content)
-  return parsePayload(parseCanonicalJson(bytes), context)
+  try {
+    return parsePayload(parseCanonicalJson(bytes), context)
+  } catch (error) {
+    if (
+      error instanceof XcsError &&
+      (error.code.startsWith('JSON_') ||
+        error.code === 'UTF8_INVALID' ||
+        error.code === 'CANONICALIZATION_UNSUPPORTED_VALUE')
+    ) {
+      return fail('PAYLOAD_INVALID', 'Credential payload must be canonical JSON', '$payload', {
+        cause: error.code,
+      })
+    }
+    throw error
+  }
 }
 
 export function verifyCredentialPayload(
diff --git a/packages/core/src/errors.ts b/packages/core/src/errors.ts
index 2ae0d25..81cc98e 100644
--- a/packages/core/src/errors.ts
+++ b/packages/core/src/errors.ts
@@ -1,15 +1,34 @@
-export type XcsErrorCode =
-  | 'INVALID_NETWORK_PROFILE'
-  | 'INVALID_SCHEMA'
-  | 'INVALID_SCHEMA_REFERENCE'
-  | 'INVALID_CLAIMS'
-  | 'INVALID_UID_INPUT'
-  | 'INVALID_CREDENTIAL_PAYLOAD'
-  | 'INVALID_PAYLOAD_URI'
-  | 'INVALID_RIPPLE_TIME'
-  | 'INVALID_JSON'
-  | 'NON_CANONICAL_JSON'
-  | 'UNSUPPORTED_JSON_VALUE'
+export const XCS_ERROR_CODES = [
+  'JSON_INVALID',
+  'JSON_DUPLICATE_KEY',
+  'JSON_INVALID_UNICODE',
+  'JSON_NON_IJSON_NUMBER',
+  'CANONICALIZATION_UNSUPPORTED_VALUE',
+  'HEX_INVALID',
+  'UTF8_INVALID',
+  'NETWORK_PROFILE_INVALID',
+  'SCHEMA_INVALID',
+  'SCHEMA_PARENT_NOT_FOUND',
+  'SCHEMA_PARENT_NOT_PRIOR',
+  'SCHEMA_PARENT_NETWORK_MISMATCH',
+  'SCHEMA_OVERRIDE_FORBIDDEN',
+  'SCHEMA_INHERITANCE_CYCLE',
+  'SCHEMA_DEPTH_EXCEEDED',
+  'SCHEMA_FIELD_LIMIT_EXCEEDED',
+  'SCHEMA_SUPERSEDES_NOT_FOUND',
+  'SCHEMA_SUPERSEDES_NOT_PRIOR',
+  'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
+  'SCHEMA_CATALOG_INVALID',
+  'SCHEMA_CATALOG_LIMIT_EXCEEDED',
+  'VERIFICATION_REPORT_INVALID',
+  'UID_INPUT_INVALID',
+  'CLAIMS_INVALID',
+  'PAYLOAD_INVALID',
+  'PAYLOAD_URI_INVALID',
+  'RIPPLE_TIME_INVALID',
+] as const
+
+export type XcsErrorCode = (typeof XCS_ERROR_CODES)[number]
 
 export class XcsError extends Error {
   readonly code: XcsErrorCode
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 28eaade..5d952c4 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -8,27 +8,41 @@ export {
   type EncodedCredentialPayload,
   type PayloadRetrieval,
 } from './credential.js'
-export { XcsError, type XcsErrorCode } from './errors.js'
+export { XCS_ERROR_CODES, XcsError, type XcsErrorCode } from './errors.js'
+export { parseClaims, validateClaims } from './claims.js'
 export {
+  canonicalize,
   canonicalJson,
+  decodeUtf8Hex,
   decodeHexUtf8,
   decodeUtf8,
   encodeCanonicalJson,
   encodeHexUtf8,
   encodeUtf8,
+  encodeUtf8Hex,
   parseCanonicalJson,
   parseJson,
+  parseJsonStrict,
   sha256Hex,
   utf8ByteLength,
   type JsonObject,
   type JsonPrimitive,
   type JsonValue,
 } from './json.js'
-export { parseNetworkProfile, rippleTimeToIso, type NetworkProfile } from './network.js'
 export {
+  parseNetworkProfile,
+  rippleTimeToIso,
+  validateNetworkProfile,
+  type NetworkProfile,
+} from './network.js'
+export {
+  computePayloadSha256Hex,
   createHttpsPayloadUri,
+  createIpfsRawPayloadUri,
   createIpfsPayloadUri,
+  inspectPayloadUri,
   parsePayloadUri,
+  payloadDigest,
   verifyPayloadIntegrity,
   type HttpsPayloadUri,
   type IpfsPayloadUri,
@@ -40,11 +54,19 @@ export {
   type CredentialLifecycleInput,
   type CredentialLifecycleState,
 } from './lifecycle.js'
+export {
+  iso8601ToRippleTime,
+  RIPPLE_EPOCH_UNIX_SECONDS,
+  rippleTimeToIso8601,
+  rippleTimeToUnixSeconds,
+  unixSecondsToRippleTime,
+} from './ripple-time.js'
 export { resolveSchema, type SchemaResolutionContext } from './schema-resolution.js'
 export {
   encodeSchema,
   parseSchema,
   parseSchemaBytes,
+  validateSchema,
   type ArrayFieldDescriptor,
   type FieldDescriptor,
   type ObjectFieldDescriptor,
diff --git a/packages/core/src/json.ts b/packages/core/src/json.ts
index 7ea7798..c044c83 100644
--- a/packages/core/src/json.ts
+++ b/packages/core/src/json.ts
@@ -21,12 +21,12 @@ function assertWellFormed(value: string, path: string): void {
     const codeUnit = value.charCodeAt(index)
     if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
       const next = value.charCodeAt(index + 1)
-      if (next < 0xdc00 || next > 0xdfff) {
-        fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      if (!(next >= 0xdc00 && next <= 0xdfff)) {
+        fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
       }
       index += 1
     } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON strings must contain valid Unicode', path)
+      fail('JSON_INVALID_UNICODE', 'JSON strings must contain valid Unicode', path)
     }
   }
 }
@@ -39,21 +39,25 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
   }
   if (typeof value === 'number') {
     if (!Number.isFinite(value)) {
-      fail('UNSUPPORTED_JSON_VALUE', 'JSON numbers must be finite', path)
+      fail('JSON_NON_IJSON_NUMBER', 'JSON numbers must be finite', path)
     }
     return
   }
   if (typeof value !== 'object') {
-    fail('UNSUPPORTED_JSON_VALUE', `Unsupported ${typeof value} value`, path)
+    fail('CANONICALIZATION_UNSUPPORTED_VALUE', `Unsupported ${typeof value} value`, path)
   }
-  if (stack.has(value)) fail('UNSUPPORTED_JSON_VALUE', 'Cyclic JSON value', path)
+  if (stack.has(value)) fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Cyclic JSON value', path)
 
   stack.add(value)
   try {
     if (Array.isArray(value)) {
       for (let index = 0; index < value.length; index += 1) {
         if (!Object.hasOwn(value, index)) {
-          fail('UNSUPPORTED_JSON_VALUE', 'Sparse arrays are not JSON values', `${path}[${index}]`)
+          fail(
+            'CANONICALIZATION_UNSUPPORTED_VALUE',
+            'Sparse arrays are not JSON values',
+            `${path}[${index}]`,
+          )
         }
         assertJsonValueInternal(value[index], `${path}[${index}]`, stack)
       }
@@ -62,7 +66,7 @@ function assertJsonValueInternal(value: unknown, path: string, stack: Set<object
 
     const prototype = Object.getPrototypeOf(value)
     if (prototype !== Object.prototype && prototype !== null) {
-      fail('UNSUPPORTED_JSON_VALUE', 'Only plain objects are JSON values', path)
+      fail('CANONICALIZATION_UNSUPPORTED_VALUE', 'Only plain objects are JSON values', path)
     }
     for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
       assertWellFormed(key, path)
@@ -81,7 +85,11 @@ export function canonicalJson(value: unknown): string {
   assertJsonValue(value)
   const serialized = canonicalizeRfc8785(value)
   if (serialized === undefined) {
-    return fail('UNSUPPORTED_JSON_VALUE', 'Value cannot be represented as canonical JSON', '$')
+    return fail(
+      'CANONICALIZATION_UNSUPPORTED_VALUE',
+      'Value cannot be represented as canonical JSON',
+      '$',
+    )
   }
   return serialized
 }
@@ -98,7 +106,7 @@ export function decodeUtf8(bytes: Uint8Array): string {
   try {
     return decoder.decode(bytes)
   } catch (cause) {
-    return fail('INVALID_JSON', 'Input is not valid UTF-8', '$', { cause: String(cause) })
+    return fail('UTF8_INVALID', 'Input is not valid UTF-8', '$', { cause: String(cause) })
   }
 }
 
@@ -123,7 +131,7 @@ export function parseJson(input: string | Uint8Array): JsonValue {
     allowEmptyContent: false,
   })
   if (!root || errors.length > 0) {
-    return fail('INVALID_JSON', 'Input is not valid JSON', '$')
+    return fail('JSON_INVALID', 'Input is not valid JSON', '$')
   }
   rejectDuplicateObjectKeys(root)
 
@@ -136,7 +144,7 @@ export function parseCanonicalJson(input: string | Uint8Array): JsonValue {
   const text = typeof input === 'string' ? input : decodeUtf8(input)
   const parsed = parseJson(text)
   if (canonicalJson(parsed) !== text) {
-    return fail('NON_CANONICAL_JSON', 'Input must use RFC 8785 canonical JSON', '$')
+    return fail('JSON_INVALID', 'Input must use RFC 8785 canonical JSON', '$')
   }
   assertJsonValue(parsed)
   return parsed
@@ -149,10 +157,10 @@ function rejectDuplicateObjectKeys(node: Node): void {
       const [keyNode, valueNode] = property.children ?? []
       const key = keyNode?.value
       if (typeof key !== 'string' || !valueNode) {
-        return fail('INVALID_JSON', 'Input contains an invalid JSON object', '$')
+        return fail('JSON_INVALID', 'Input contains an invalid JSON object', '$')
       }
       if (keys.has(key)) {
-        return fail('INVALID_JSON', `Input contains duplicate key ${key}`, '$')
+        return fail('JSON_DUPLICATE_KEY', `Input contains duplicate key ${key}`, '$')
       }
       keys.add(key)
       rejectDuplicateObjectKeys(valueNode)
@@ -166,3 +174,9 @@ export function utf8ByteLength(value: string): number {
   assertWellFormed(value, '$')
   return encoder.encode(value).length
 }
+
+/** Backward-compatible names from the normative XCS v0.1 interface. */
+export const canonicalize = canonicalJson
+export const parseJsonStrict = parseJson
+export const encodeUtf8Hex = (value: string): string => encodeHexUtf8(value).toUpperCase()
+export const decodeUtf8Hex = decodeHexUtf8
diff --git a/packages/core/src/lifecycle.ts b/packages/core/src/lifecycle.ts
index d200f39..e84853d 100644
--- a/packages/core/src/lifecycle.ts
+++ b/packages/core/src/lifecycle.ts
@@ -13,7 +13,7 @@ const UINT32_MAX = 0xffff_ffff
 
 function requireRippleTime(value: number): void {
   if (!Number.isInteger(value) || value < 0 || value > UINT32_MAX) {
-    return fail('INVALID_RIPPLE_TIME', 'Credential lifecycle time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Credential lifecycle time must be a uint32', '$time')
   }
 }
 
diff --git a/packages/core/src/network.ts b/packages/core/src/network.ts
index 0cba136..a2dd8cf 100644
--- a/packages/core/src/network.ts
+++ b/packages/core/src/network.ts
@@ -34,48 +34,48 @@ function isUint32(value: unknown): value is number {
 
 export function parseNetworkProfile(input: unknown): NetworkProfile {
   if (!isRecord(input)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Network profile must be an object', '$')
+    return fail('NETWORK_PROFILE_INVALID', 'Network profile must be an object', '$')
   }
   for (const key of Object.keys(input)) {
     if (!PROFILE_PROPERTIES.has(key)) {
-      return fail('INVALID_NETWORK_PROFILE', `Unknown property ${key}`, `$.${key}`)
+      return fail('NETWORK_PROFILE_INVALID', `Unknown property ${key}`, `$.${key}`)
     }
   }
   if (
     typeof input.profileId !== 'string' ||
     !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(input.profileId)
   ) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid profileId', '$.profileId')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid profileId', '$.profileId')
   }
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_NETWORK_PROFILE', 'Unsupported XCS version', '$.xcsVersion')
+    return fail('NETWORK_PROFILE_INVALID', 'Unsupported XCS version', '$.xcsVersion')
   }
   if (!isUint32(input.networkId)) {
-    return fail('INVALID_NETWORK_PROFILE', 'networkId must be a uint32', '$.networkId')
+    return fail('NETWORK_PROFILE_INVALID', 'networkId must be a uint32', '$.networkId')
   }
   if (
     typeof input.requiredAmendment !== 'string' ||
     !/^[0-9a-fA-F]{64}$/.test(input.requiredAmendment)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'requiredAmendment must be a 32-byte hexadecimal value',
       '$.requiredAmendment',
     )
   }
   if (typeof input.registryAddress !== 'string' || !isValidClassicAddress(input.registryAddress)) {
-    return fail('INVALID_NETWORK_PROFILE', 'Invalid XRPL registry address', '$.registryAddress')
+    return fail('NETWORK_PROFILE_INVALID', 'Invalid XRPL registry address', '$.registryAddress')
   }
   if (input.registrationAmountDrops !== '1') {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'registrationAmountDrops must equal "1"',
       '$.registrationAmountDrops',
     )
   }
   if (!isUint32(input.activationLedgerIndex) || input.activationLedgerIndex === 0) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerIndex must be a positive uint32',
       '$.activationLedgerIndex',
     )
@@ -85,7 +85,7 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
     !/^[0-9a-fA-F]{64}$/.test(input.activationLedgerHash)
   ) {
     return fail(
-      'INVALID_NETWORK_PROFILE',
+      'NETWORK_PROFILE_INVALID',
       'activationLedgerHash must be a 32-byte hexadecimal value',
       '$.activationLedgerHash',
     )
@@ -103,9 +103,12 @@ export function parseNetworkProfile(input: unknown): NetworkProfile {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateNetworkProfile = parseNetworkProfile
+
 export function rippleTimeToIso(rippleTime: number): string {
   if (!isUint32(rippleTime)) {
-    return fail('INVALID_RIPPLE_TIME', 'Ripple time must be a uint32', '$time')
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
   }
   return xrplRippleTimeToIso(rippleTime)
 }
diff --git a/packages/core/src/payload-uri.ts b/packages/core/src/payload-uri.ts
index 7345f85..5b61922 100644
--- a/packages/core/src/payload-uri.ts
+++ b/packages/core/src/payload-uri.ts
@@ -29,7 +29,8 @@ export type PayloadUri = IpfsPayloadUri | HttpsPayloadUri
 
 export interface PayloadIntegrityResult {
   valid: boolean
-  expectedDigestHex: string
+  status: 'valid' | 'tampered' | 'invalid_uri'
+  expectedDigestHex?: string
   actualDigestHex: string
 }
 
@@ -47,10 +48,10 @@ export function payloadBytes(content: string | Uint8Array): Uint8Array {
   if (typeof content === 'string') utf8ByteLength(content)
   const bytes = typeof content === 'string' ? new TextEncoder().encode(content) : content
   if (!(bytes instanceof Uint8Array)) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload must be UTF-8 text or bytes', '$payload')
+    return fail('PAYLOAD_INVALID', 'Payload must be UTF-8 text or bytes', '$payload')
   }
   if (bytes.length > MAX_PAYLOAD_BYTES) {
-    return fail('INVALID_CREDENTIAL_PAYLOAD', 'Payload exceeds 1 MiB', '$payload', {
+    return fail('PAYLOAD_INVALID', 'Payload exceeds 1 MiB', '$payload', {
       size: bytes.length,
     })
   }
@@ -184,7 +185,7 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
       cid.multihash.size !== 32 ||
       cid.toString(base32.encoder) !== cidText
     ) {
-      return fail('INVALID_PAYLOAD_URI', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
+      return fail('PAYLOAD_URI_INVALID', 'Expected a canonical raw SHA-256 CIDv1', '$uri')
     }
     return {
       kind: 'ipfs',
@@ -194,30 +195,30 @@ function parseIpfsUri(uri: string): IpfsPayloadUri | undefined {
     }
   } catch (cause) {
     if (cause instanceof XcsError) throw cause
-    return fail('INVALID_PAYLOAD_URI', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid IPFS CID', '$uri', { cause: String(cause) })
   }
 }
 
 export function parsePayloadUri(uri: string): PayloadUri {
   if (typeof uri !== 'string') {
-    return fail('INVALID_PAYLOAD_URI', 'URI must be a string', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must be a string', '$uri')
   }
   const length = utf8ByteLength(uri)
   if (length < 1 || length > 256) {
-    return fail('INVALID_PAYLOAD_URI', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'URI must contain 1 to 256 UTF-8 bytes', '$uri')
   }
   const ipfs = parseIpfsUri(uri)
   if (ipfs !== undefined) return ipfs
 
   if (!uri.startsWith(HTTPS_PREFIX) || INVALID_RAW_HTTPS_CHARACTER.test(uri)) {
-    return fail('INVALID_PAYLOAD_URI', 'Expected a canonical HTTPS or IPFS URI', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Expected a canonical HTTPS or IPFS URI', '$uri')
   }
   const remainder = uri.slice(HTTPS_PREFIX.length)
   const authorityEnd = remainder.search(/[/?#]/)
   const authority = authorityEnd === -1 ? remainder : remainder.slice(0, authorityEnd)
   if (authority === '' || authority.includes('@')) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS authority cannot be empty or contain userinfo',
       '$uri',
     )
@@ -225,14 +226,14 @@ export function parsePayloadUri(uri: string): PayloadUri {
 
   const normalizedUri = normalizeHttpsAuthority(uri)
   if (normalizedUri === undefined) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS authority', '$uri')
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS authority', '$uri')
   }
   const fetchUrl = buildFetchUrl(normalizedUri)
   let parsed: URL
   try {
     parsed = new URL(normalizedUri)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS URI', '$uri', { cause: String(cause) })
   }
   if (
     fetchUrl === undefined ||
@@ -242,7 +243,7 @@ export function parsePayloadUri(uri: string): PayloadUri {
     !/^#xcs-sha256=[0-9a-f]{64}$/.test(parsed.hash)
   ) {
     return fail(
-      'INVALID_PAYLOAD_URI',
+      'PAYLOAD_URI_INVALID',
       'HTTPS URI must end in #xcs-sha256=<lowercase-sha256>',
       '$uri',
     )
@@ -260,12 +261,12 @@ export function createHttpsPayloadUri(baseUrl: string, content: string | Uint8Ar
   try {
     url = new URL(baseUrl)
   } catch (cause) {
-    return fail('INVALID_PAYLOAD_URI', 'Invalid HTTPS base URL', '$url', {
+    return fail('PAYLOAD_URI_INVALID', 'Invalid HTTPS base URL', '$url', {
       cause: String(cause),
     })
   }
   if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.hash !== '') {
-    return fail('INVALID_PAYLOAD_URI', 'Base URL must be fragment-free HTTPS', '$url')
+    return fail('PAYLOAD_URI_INVALID', 'Base URL must be fragment-free HTTPS', '$url')
   }
   url.hash = `xcs-sha256=${payloadDigest(content)}`
   const uri = url.toString()
@@ -282,11 +283,25 @@ export function verifyPayloadIntegrity(
   content: string | Uint8Array,
   uri: string,
 ): PayloadIntegrityResult {
-  const expectedDigestHex = parsePayloadUri(uri).digestHex
   const actualDigestHex = payloadDigest(content)
+  let expectedDigestHex: string
+  try {
+    expectedDigestHex = parsePayloadUri(uri).digestHex
+  } catch (error) {
+    if (error instanceof XcsError && error.code === 'PAYLOAD_URI_INVALID') {
+      return { valid: false, status: 'invalid_uri', actualDigestHex }
+    }
+    throw error
+  }
+  const valid = expectedDigestHex === actualDigestHex
   return {
-    valid: expectedDigestHex === actualDigestHex,
+    valid,
+    status: valid ? 'valid' : 'tampered',
     expectedDigestHex,
     actualDigestHex,
   }
 }
+
+export const computePayloadSha256Hex = payloadDigest
+export const createIpfsRawPayloadUri = createIpfsPayloadUri
+export const inspectPayloadUri = parsePayloadUri
diff --git a/packages/core/src/ripple-time.ts b/packages/core/src/ripple-time.ts
new file mode 100644
index 0000000..748cf8c
--- /dev/null
+++ b/packages/core/src/ripple-time.ts
@@ -0,0 +1,49 @@
+import { fail } from './errors.js'
+
+export const RIPPLE_EPOCH_UNIX_SECONDS = 946_684_800
+const UINT32_MAX = 0xffff_ffff
+
+export function unixSecondsToRippleTime(unixSeconds: number): number {
+  if (!Number.isSafeInteger(unixSeconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time must be an integer number of seconds', '$time')
+  }
+  const rippleTime = unixSeconds - RIPPLE_EPOCH_UNIX_SECONDS
+  if (rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Unix time is outside the XRPL uint32 time range', '$time')
+  }
+  return rippleTime
+}
+
+export function rippleTimeToUnixSeconds(rippleTime: number): number {
+  if (!Number.isInteger(rippleTime) || rippleTime < 0 || rippleTime > UINT32_MAX) {
+    return fail('RIPPLE_TIME_INVALID', 'Ripple time must be a uint32', '$time')
+  }
+  return rippleTime + RIPPLE_EPOCH_UNIX_SECONDS
+}
+
+export function iso8601ToRippleTime(value: string): number {
+  if (
+    typeof value !== 'string' ||
+    !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.000)?Z$/.test(value)
+  ) {
+    return fail(
+      'RIPPLE_TIME_INVALID',
+      'Expiration must be a UTC ISO-8601 timestamp with whole-second precision',
+      '$time',
+    )
+  }
+  const milliseconds = Date.parse(value)
+  if (!Number.isFinite(milliseconds)) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a real calendar date', '$time')
+  }
+  const normalized = new Date(milliseconds).toISOString()
+  const expected = value.includes('.') ? value : value.replace('Z', '.000Z')
+  if (normalized !== expected) {
+    return fail('RIPPLE_TIME_INVALID', 'Expiration is not a canonical calendar date', '$time')
+  }
+  return unixSecondsToRippleTime(milliseconds / 1000)
+}
+
+export function rippleTimeToIso8601(rippleTime: number): string {
+  return new Date(rippleTimeToUnixSeconds(rippleTime) * 1000).toISOString()
+}
diff --git a/packages/core/src/schema-resolution.ts b/packages/core/src/schema-resolution.ts
index ec36221..ad9f73d 100644
--- a/packages/core/src/schema-resolution.ts
+++ b/packages/core/src/schema-resolution.ts
@@ -42,20 +42,23 @@ function requireReference(
 ): RegisteredSchema {
   const referenced = context.getSchema(uid)
   if (referenced === undefined || referenced.uid !== uid) {
-    return fail('INVALID_SCHEMA_REFERENCE', `${relation} schema was not found`, `$.${relation}`, {
-      uid,
-    })
+    return fail(
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_FOUND' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
+      `${relation} schema was not found`,
+      `$.${relation}`,
+      { uid },
+    )
   }
   if (referenced.networkId !== context.networkId) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NETWORK_MISMATCH' : 'SCHEMA_SUPERSEDES_NOT_FOUND',
       `${relation} schema belongs to another network`,
       `$.${relation}`,
     )
   }
   if (!isEarlier(referenced, context)) {
     return fail(
-      'INVALID_SCHEMA_REFERENCE',
+      relation === 'extends' ? 'SCHEMA_PARENT_NOT_PRIOR' : 'SCHEMA_SUPERSEDES_NOT_PRIOR',
       `${relation} schema must be registered earlier`,
       `$.${relation}`,
     )
@@ -72,12 +75,11 @@ function resolve(
   let lineage: string[] = []
 
   if (schema.extends !== undefined) {
-    if (visiting.size >= MAX_SCHEMA_DEPTH - 1 || visiting.has(schema.extends)) {
-      return fail(
-        'INVALID_SCHEMA_REFERENCE',
-        'Schema inheritance is cyclic or too deep',
-        '$.extends',
-      )
+    if (visiting.has(schema.extends)) {
+      return fail('SCHEMA_INHERITANCE_CYCLE', 'Schema inheritance is cyclic', '$.extends')
+    }
+    if (visiting.size >= MAX_SCHEMA_DEPTH - 1) {
+      return fail('SCHEMA_DEPTH_EXCEEDED', 'Schema inheritance is too deep', '$.extends')
     }
     const parent = requireReference(schema.extends, 'extends', context)
     visiting.add(schema.extends)
@@ -100,7 +102,7 @@ function resolve(
   for (const [name, descriptor] of Object.entries(schema.fields)) {
     if (Object.hasOwn(fields, name)) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_OVERRIDE_FORBIDDEN',
         `Inherited field ${name} cannot be redefined`,
         `$.fields.${name}`,
       )
@@ -109,14 +111,18 @@ function resolve(
   }
 
   if (countSchemaFields(fields) > MAX_SCHEMA_FIELDS) {
-    return fail('INVALID_SCHEMA', `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`, '$.fields')
+    return fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Resolved schema exceeds ${MAX_SCHEMA_FIELDS} fields`,
+      '$.fields',
+    )
   }
 
   if (schema.supersedes !== undefined) {
     const previous = requireReference(schema.supersedes, 'supersedes', context)
     if (previous.publisher !== context.publisher) {
       return fail(
-        'INVALID_SCHEMA_REFERENCE',
+        'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH',
         'Only the original publisher may supersede a schema',
         '$.supersedes',
       )
@@ -137,7 +143,7 @@ export function resolveSchema(
     !isValidClassicAddress(context.publisher) ||
     typeof context.getSchema !== 'function'
   ) {
-    return fail('INVALID_SCHEMA_REFERENCE', 'Invalid schema resolution context', '$context')
+    return fail('SCHEMA_INVALID', 'Invalid schema resolution context', '$context')
   }
   return resolve(parseSchema(input), context, new Set())
 }
diff --git a/packages/core/src/schema-uid.ts b/packages/core/src/schema-uid.ts
index d4b0f59..a7bdcf5 100644
--- a/packages/core/src/schema-uid.ts
+++ b/packages/core/src/schema-uid.ts
@@ -25,17 +25,17 @@ export function computeSchemaUid(input: SchemaUidInput): string {
     !isUint32(input.ledgerIndex) ||
     !isUint32(input.transactionIndex)
   ) {
-    return fail('INVALID_UID_INPUT', 'Network and ledger coordinates must be uint32 values', '$')
+    return fail('UID_INPUT_INVALID', 'Network and ledger coordinates must be uint32 values', '$')
   }
   if (!/^[0-9a-fA-F]{64}$/.test(input.ledgerHash)) {
     return fail(
-      'INVALID_UID_INPUT',
+      'UID_INPUT_INVALID',
       'ledgerHash must be a 32-byte hexadecimal hash',
       '$.ledgerHash',
     )
   }
   if (!isValidClassicAddress(input.publisher)) {
-    return fail('INVALID_UID_INPUT', 'publisher must be an XRPL classic address', '$.publisher')
+    return fail('UID_INPUT_INVALID', 'publisher must be an XRPL classic address', '$.publisher')
   }
 
   const preimage = {
diff --git a/packages/core/src/schema.ts b/packages/core/src/schema.ts
index 215abd0..4302b76 100644
--- a/packages/core/src/schema.ts
+++ b/packages/core/src/schema.ts
@@ -75,17 +75,17 @@ function assertOnlyProperties(
   path: string,
 ): void {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) fail('INVALID_SCHEMA', `Unknown property ${key}`, `${path}.${key}`)
+    if (!allowed.has(key)) fail('SCHEMA_INVALID', `Unknown property ${key}`, `${path}.${key}`)
   }
 }
 
 function parseText(value: unknown, path: string, maxBytes: number): string {
   if (typeof value !== 'string' || CONTROL_CHARACTER.test(value)) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   const length = utf8ByteLength(value)
   if (length < 1 || length > maxBytes) {
-    return fail('INVALID_SCHEMA', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
+    return fail('SCHEMA_INVALID', `Expected 1 to ${maxBytes} UTF-8 bytes`, path)
   }
   return value
 }
@@ -97,10 +97,10 @@ function parseDescriptor(
   count: { value: number },
 ): FieldDescriptor {
   if (!isRecord(input) || typeof input.type !== 'string') {
-    return fail('INVALID_SCHEMA', 'Field descriptor must contain a type', path)
+    return fail('SCHEMA_INVALID', 'Field descriptor must contain a type', path)
   }
   if (input.optional !== undefined && typeof input.optional !== 'boolean') {
-    return fail('INVALID_SCHEMA', 'optional must be a boolean', `${path}.optional`)
+    return fail('SCHEMA_INVALID', 'optional must be a boolean', `${path}.optional`)
   }
   const optional = input.optional === true ? { optional: true as const } : {}
 
@@ -111,7 +111,7 @@ function parseDescriptor(
   if (input.type === 'array') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'items']), path)
     if (depth >= MAX_SCHEMA_DEPTH || input.items === undefined) {
-      return fail('INVALID_SCHEMA', 'Array descriptor is missing items or exceeds depth', path)
+      return fail('SCHEMA_INVALID', 'Array descriptor is missing items or exceeds depth', path)
     }
     count.value += 1
     assertFieldLimit(count.value, `${path}.items`)
@@ -124,7 +124,7 @@ function parseDescriptor(
   if (input.type === 'object') {
     assertOnlyProperties(input, new Set(['type', 'optional', 'fields']), path)
     if (depth >= MAX_SCHEMA_DEPTH) {
-      return fail('INVALID_SCHEMA', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
+      return fail('SCHEMA_INVALID', `Schema nesting exceeds ${MAX_SCHEMA_DEPTH}`, path)
     }
     return {
       type: 'object',
@@ -132,12 +132,16 @@ function parseDescriptor(
       ...optional,
     }
   }
-  return fail('INVALID_SCHEMA', `Unsupported field type ${input.type}`, `${path}.type`)
+  return fail('SCHEMA_INVALID', `Unsupported field type ${input.type}`, `${path}.type`)
 }
 
 function assertFieldLimit(count: number, path: string): void {
   if (count > MAX_SCHEMA_FIELDS) {
-    fail('INVALID_SCHEMA', `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`, path)
+    fail(
+      'SCHEMA_FIELD_LIMIT_EXCEEDED',
+      `Schema exceeds ${MAX_SCHEMA_FIELDS} field descriptors`,
+      path,
+    )
   }
 }
 
@@ -148,11 +152,11 @@ function parseFields(
   count: { value: number },
 ): SchemaFields {
   if (!isRecord(input) || Object.keys(input).length === 0) {
-    return fail('INVALID_SCHEMA', 'fields must be a non-empty object', path)
+    return fail('SCHEMA_INVALID', 'fields must be a non-empty object', path)
   }
   const fields = Object.create(null) as SchemaFields
   for (const [name, descriptor] of Object.entries(input)) {
-    if (!FIELD_NAME.test(name)) fail('INVALID_SCHEMA', 'Invalid field name', `${path}.${name}`)
+    if (!FIELD_NAME.test(name)) fail('SCHEMA_INVALID', 'Invalid field name', `${path}.${name}`)
     count.value += 1
     assertFieldLimit(count.value, `${path}.${name}`)
     fields[name] = parseDescriptor(descriptor, `${path}.${name}`, depth, count)
@@ -163,22 +167,22 @@ function parseFields(
 function parseRelation(value: unknown, path: string): string | undefined {
   if (value === undefined) return undefined
   if (typeof value !== 'string' || !SCHEMA_UID.test(value)) {
-    return fail('INVALID_SCHEMA', 'Expected a lowercase 32-byte schema UID', path)
+    return fail('SCHEMA_INVALID', 'Expected a lowercase 32-byte schema UID', path)
   }
   return value
 }
 
 export function parseSchema(input: unknown): SchemaDefinition {
-  if (!isRecord(input)) return fail('INVALID_SCHEMA', 'Schema must be an object', '$')
+  if (!isRecord(input)) return fail('SCHEMA_INVALID', 'Schema must be an object', '$')
   assertOnlyProperties(input, SCHEMA_PROPERTIES, '$')
   if (input.xcsVersion !== '0.1') {
-    return fail('INVALID_SCHEMA', 'Unsupported XCS schema version', '$.xcsVersion')
+    return fail('SCHEMA_INVALID', 'Unsupported XCS schema version', '$.xcsVersion')
   }
 
   const parent = parseRelation(input.extends, '$.extends')
   const predecessor = parseRelation(input.supersedes, '$.supersedes')
   if (parent !== undefined && parent === predecessor) {
-    return fail('INVALID_SCHEMA', 'extends and supersedes must reference different schemas', '$')
+    return fail('SCHEMA_INVALID', 'extends and supersedes must reference different schemas', '$')
   }
 
   return {
@@ -191,6 +195,9 @@ export function parseSchema(input: unknown): SchemaDefinition {
   }
 }
 
+/** Normative XCS v0.1 name retained for existing consumers. */
+export const validateSchema = parseSchema
+
 export function parseSchemaBytes(bytes: Uint8Array): SchemaDefinition {
   return parseSchema(parseCanonicalJson(bytes))
 }
diff --git a/packages/core/test/credential.test.ts b/packages/core/test/credential.test.ts
index 78401c7..6bc05ce 100644
--- a/packages/core/test/credential.test.ts
+++ b/packages/core/test/credential.test.ts
@@ -29,7 +29,7 @@ describe('credential payload', () => {
     expect(parseCredentialPayload(encoded.bytes, context)).toEqual(encoded.payload)
     expect(encoded.json).toBe(new TextDecoder().decode(encoded.bytes))
     expect(() => parseCredentialPayload(`${encoded.json}\n`, context)).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'PAYLOAD_INVALID' }),
     )
   })
 
@@ -59,4 +59,28 @@ describe('credential payload', () => {
       verifyCredentialPayload({ status: 'retrieved', content: encoded.bytes }, uri, context),
     ).toBe('valid')
   })
+
+  it.each([{ courseId: '\ud800', passed: true }, { '\ud800': 'xcs-101' }])(
+    'reports malformed Unicode in payload values or keys as invalid',
+    (claims) => {
+      const content = JSON.stringify({
+        claims,
+        issuer: context.issuer,
+        schema: context.schemaUid,
+        subject: context.subject,
+        xcsVersion: '0.1',
+      })
+      const uri = createIpfsPayloadUri(content)
+
+      expect(verifyCredentialPayload({ status: 'retrieved', content }, uri, context)).toBe(
+        'invalid',
+      )
+    },
+  )
+
+  it('preserves valid Unicode including surrogate pairs', () => {
+    const encoded = encodeCredentialPayload({ courseId: 'Cours réussi 🎓', passed: true }, context)
+
+    expect(parseCredentialPayload(encoded.bytes, context).claims.courseId).toBe('Cours réussi 🎓')
+  })
 })
diff --git a/packages/core/test/json-canonicalize.test.ts b/packages/core/test/json-canonicalize.test.ts
new file mode 100644
index 0000000..893497e
--- /dev/null
+++ b/packages/core/test/json-canonicalize.test.ts
@@ -0,0 +1,50 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+import { canonicalize, parseJsonStrict, XcsError } from '../src/index.js'
+
+interface CanonicalizationVectors {
+  cases: Array<{ name: string; inputJson: string; canonical: string }>
+}
+
+const vectors = JSON.parse(
+  readFileSync(new URL('../../../conformance/v0.1/canonicalization.json', import.meta.url), 'utf8'),
+) as CanonicalizationVectors
+
+describe('strict JSON and RFC 8785 canonicalization', () => {
+  for (const vector of vectors.cases) {
+    it(vector.name, () => {
+      expect(canonicalize(parseJsonStrict(vector.inputJson))).toBe(vector.canonical)
+    })
+  }
+
+  it('rejects duplicate decoded keys', () => {
+    expect(() => parseJsonStrict('{"a":1,"\\u0061":2}')).toThrowError(
+      expect.objectContaining({ code: 'JSON_DUPLICATE_KEY' }),
+    )
+  })
+
+  it('rejects unpaired surrogates in escaped and in-memory input', () => {
+    expect(() => parseJsonStrict('"\\ud800"')).toThrowError(
+      expect.objectContaining({ code: 'JSON_INVALID_UNICODE' }),
+    )
+    expect(() => canonicalize('\udc00')).toThrowError(
+      expect.objectContaining({ code: 'JSON_INVALID_UNICODE' }),
+    )
+  })
+
+  it('rejects non-finite JSON numbers', () => {
+    expect(() => parseJsonStrict('1e400')).toThrowError(
+      expect.objectContaining({ code: 'JSON_NON_IJSON_NUMBER' }),
+    )
+    expect(() => canonicalize(Number.NaN)).toThrowError(
+      expect.objectContaining({ code: 'JSON_NON_IJSON_NUMBER' }),
+    )
+  })
+
+  it('rejects sparse arrays constructed outside JSON', () => {
+    expect(() => canonicalize(new Array(1) as never[])).toThrowError(
+      expect.objectContaining({ code: 'CANONICALIZATION_UNSUPPORTED_VALUE' }),
+    )
+  })
+})
diff --git a/packages/core/test/network-lifecycle.test.ts b/packages/core/test/network-lifecycle.test.ts
index 4fd8050..bc549c9 100644
--- a/packages/core/test/network-lifecycle.test.ts
+++ b/packages/core/test/network-lifecycle.test.ts
@@ -22,7 +22,7 @@ describe('network and native lifecycle', () => {
   it('wraps xrpl.js Ripple-time conversion with strict protocol bounds', () => {
     expect(rippleTimeToIso(0)).toBe('2000-01-01T00:00:00.000Z')
     expect(() => rippleTimeToIso(-1)).toThrow(
-      expect.objectContaining({ code: 'INVALID_RIPPLE_TIME' }),
+      expect.objectContaining({ code: 'RIPPLE_TIME_INVALID' }),
     )
   })
 
diff --git a/packages/core/test/network-uid.test.ts b/packages/core/test/network-uid.test.ts
new file mode 100644
index 0000000..b41f639
--- /dev/null
+++ b/packages/core/test/network-uid.test.ts
@@ -0,0 +1,86 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+import {
+  computeSchemaUid,
+  encodeUtf8Hex,
+  decodeUtf8Hex,
+  validateNetworkProfile,
+  XcsError,
+  type SchemaUidInput,
+} from '../src/index.js'
+
+interface UidVectors {
+  cases: Array<{ name: string; input: SchemaUidInput; uid: string }>
+}
+
+const vectors = JSON.parse(
+  readFileSync(new URL('../../../conformance/v0.1/schema-uid.json', import.meta.url), 'utf8'),
+) as UidVectors
+
+describe('network profile', () => {
+  it('validates and normalizes hexadecimal identifiers', () => {
+    const profile = validateNetworkProfile({
+      profileId: 'xrpl-testnet-xcs-v0.1',
+      xcsVersion: '0.1',
+      networkId: 1,
+      requiredAmendment: 'ab'.repeat(32),
+      registryAddress: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+      registrationAmountDrops: '1',
+      activationLedgerIndex: 1,
+      activationLedgerHash: 'CD'.repeat(32),
+    })
+    expect(profile.requiredAmendment).toBe('AB'.repeat(32))
+    expect(profile.activationLedgerHash).toBe('cd'.repeat(32))
+  })
+
+  it('rejects a malformed registry account', () => {
+    expect(() =>
+      validateNetworkProfile({
+        profileId: 'test',
+        xcsVersion: '0.1',
+        networkId: 1,
+        requiredAmendment: 'ab'.repeat(32),
+        registryAddress: 'rNotChecksummed',
+        registrationAmountDrops: '1',
+        activationLedgerIndex: 1,
+        activationLedgerHash: 'cd'.repeat(32),
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'NETWORK_PROFILE_INVALID' }))
+  })
+
+  it('rejects ledger zero because activation starts at a real validated ledger', () => {
+    expect(() =>
+      validateNetworkProfile({
+        profileId: 'test',
+        xcsVersion: '0.1',
+        networkId: 1,
+        requiredAmendment: 'ab'.repeat(32),
+        registryAddress: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+        registrationAmountDrops: '1',
+        activationLedgerIndex: 0,
+        activationLedgerHash: 'cd'.repeat(32),
+      }),
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'NETWORK_PROFILE_INVALID',
+        message: 'activationLedgerIndex must be a positive uint32',
+      }),
+    )
+  })
+})
+
+describe('schema UID', () => {
+  for (const vector of vectors.cases) {
+    it(vector.name, () => {
+      expect(computeSchemaUid(vector.input)).toBe(vector.uid)
+    })
+  }
+
+  it('encodes memo strings as uppercase UTF-8 hex', () => {
+    expect(encodeUtf8Hex('xcs:schema_register')).toBe(
+      '7863733A736368656D615F7265676973746572'.toUpperCase(),
+    )
+    expect(decodeUtf8Hex(encodeUtf8Hex('é'))).toBe('é')
+  })
+})
diff --git a/packages/core/test/payload-time.test.ts b/packages/core/test/payload-time.test.ts
new file mode 100644
index 0000000..7a635e1
--- /dev/null
+++ b/packages/core/test/payload-time.test.ts
@@ -0,0 +1,109 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+import {
+  canonicalize,
+  computePayloadSha256Hex,
+  createHttpsPayloadUri,
+  createIpfsRawPayloadUri,
+  inspectPayloadUri,
+  iso8601ToRippleTime,
+  parseCredentialPayload,
+  rippleTimeToIso8601,
+  verifyPayloadIntegrity,
+  XcsError,
+} from '../src/index.js'
+
+interface PayloadVectors {
+  cases: Array<{
+    name: string
+    contentUtf8: string
+    sha256: string
+    uri: string
+  }>
+}
+
+const vectors = JSON.parse(
+  readFileSync(
+    new URL('../../../conformance/v0.1/payload-integrity.json', import.meta.url),
+    'utf8',
+  ),
+) as PayloadVectors
+
+describe('payload integrity', () => {
+  for (const vector of vectors.cases) {
+    it(vector.name, () => {
+      expect(computePayloadSha256Hex(vector.contentUtf8)).toBe(vector.sha256)
+      expect(verifyPayloadIntegrity(vector.contentUtf8, vector.uri)).toMatchObject({
+        status: 'valid',
+        expectedDigestHex: vector.sha256,
+        actualDigestHex: vector.sha256,
+      })
+    })
+  }
+
+  it('creates canonical HTTPS and raw CIDv1 URIs', () => {
+    expect(createHttpsPayloadUri('https://issuer.example/credentials/1.json', 'hello')).toBe(
+      vectors.cases[1]?.uri,
+    )
+    expect(createIpfsRawPayloadUri('hello')).toBe(vectors.cases[0]?.uri)
+    expect(inspectPayloadUri(vectors.cases[0]?.uri ?? '').kind).toBe('ipfs')
+  })
+
+  it('distinguishes tampering from an invalid URI', () => {
+    expect(verifyPayloadIntegrity('HELLO', vectors.cases[0]?.uri ?? '').status).toBe('tampered')
+    expect(verifyPayloadIntegrity('hello', 'http://issuer.example/file').status).toBe('invalid_uri')
+  })
+
+  it('strictly validates the payload envelope and claims', () => {
+    const issuer = 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh'
+    const subject = 'rG1QQv2nh2gr7RCZ1P8YYcBUKCCN633jCn'
+    const schemaUid = 'ab'.repeat(32)
+    const content = canonicalize({
+      xcsVersion: '0.1',
+      issuer,
+      subject,
+      schema: schemaUid,
+      claims: { programId: 'course-1' },
+    })
+    expect(
+      parseCredentialPayload(content, {
+        issuer,
+        subject,
+        schemaUid,
+        schema: { programId: { type: 'string' } },
+      }).claims,
+    ).toEqual({ programId: 'course-1' })
+    const pretty = JSON.stringify(JSON.parse(content), null, 2)
+    expect(() =>
+      parseCredentialPayload(pretty, {
+        issuer,
+        subject,
+        schemaUid,
+        schema: { programId: { type: 'string' } },
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'PAYLOAD_INVALID' }))
+    expect(() =>
+      parseCredentialPayload(content.replace(issuer, subject), {
+        issuer,
+        subject,
+        schemaUid,
+        schema: { programId: { type: 'string' } },
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'PAYLOAD_INVALID' }))
+  })
+})
+
+describe('Ripple epoch conversions', () => {
+  it('maps the Ripple epoch and round-trips an expiration', () => {
+    expect(iso8601ToRippleTime('2000-01-01T00:00:00Z')).toBe(0)
+    const expiration = iso8601ToRippleTime('2030-05-06T07:08:09Z')
+    expect(rippleTimeToIso8601(expiration)).toBe('2030-05-06T07:08:09.000Z')
+  })
+
+  it('rejects Unix seconds accidentally passed as Ripple time and subsecond timestamps', () => {
+    expect(() => iso8601ToRippleTime('2030-05-06T07:08:09.123Z')).toThrowError(
+      expect.objectContaining({ code: 'RIPPLE_TIME_INVALID' }),
+    )
+  })
+})
diff --git a/packages/core/test/schema-claims.test.ts b/packages/core/test/schema-claims.test.ts
new file mode 100644
index 0000000..5397ecd
--- /dev/null
+++ b/packages/core/test/schema-claims.test.ts
@@ -0,0 +1,320 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+import {
+  resolveSchema,
+  validateClaims,
+  validateSchema,
+  XcsError,
+  type RegisteredSchema,
+  type SchemaDefinition,
+} from '../src/index.js'
+
+interface ClaimsVectors {
+  schema: SchemaDefinition
+  cases: Array<{
+    name: string
+    valid: boolean
+    errorCode?: string
+    claims: unknown
+  }>
+}
+
+const vectors = JSON.parse(
+  readFileSync(new URL('../../../conformance/v0.1/claims.json', import.meta.url), 'utf8'),
+) as ClaimsVectors
+
+describe('schema validation and resolution', () => {
+  const rootUid = '11'.repeat(32)
+  const root: RegisteredSchema = {
+    uid: rootUid,
+    publisher: 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+    networkId: 1,
+    ledgerIndex: 10,
+    transactionIndex: 1,
+    definition: validateSchema({
+      xcsVersion: '0.1',
+      name: 'Base',
+      description: 'Base schema',
+      fields: { programId: { type: 'string', optional: false } },
+    }),
+  }
+
+  it('normalizes optional=false and resolves one prior parent', () => {
+    expect(root.definition.fields.programId).toEqual({ type: 'string' })
+    const child = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Child',
+      description: 'Child schema',
+      extends: rootUid,
+      fields: { completedAt: { type: 'string' } },
+    })
+    const resolved = resolveSchema(child, {
+      networkId: 1,
+      publisher: root.publisher,
+      ledgerIndex: 11,
+      transactionIndex: 0,
+      getSchema: (uid) => (uid === rootUid ? root : undefined),
+    })
+    expect(resolved.lineage).toEqual([rootUid])
+    expect(Object.keys(resolved.fields)).toEqual(['programId', 'completedAt'])
+  })
+
+  it('preserves __proto__ as an own required field through inheritance', () => {
+    const child = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Prototype-safe child',
+      description: 'Reserved JavaScript names remain ordinary XCS fields',
+      extends: rootUid,
+      fields: JSON.parse('{"__proto__":{"type":"string"}}'),
+    })
+    const resolved = resolveSchema(child, {
+      networkId: 1,
+      publisher: root.publisher,
+      ledgerIndex: 11,
+      transactionIndex: 0,
+      getSchema: (uid) => (uid === rootUid ? root : undefined),
+    })
+
+    expect(Object.getPrototypeOf(resolved.fields)).toBeNull()
+    expect(Object.hasOwn(resolved.fields, '__proto__')).toBe(true)
+    expect(Object.keys(resolved.fields)).toEqual(['programId', '__proto__'])
+    expect(() => validateClaims({ programId: 'course-1' }, resolved)).toThrowError(
+      expect.objectContaining({ code: 'CLAIMS_INVALID', path: '$.claims.__proto__' }),
+    )
+
+    const claims = validateClaims(
+      JSON.parse('{"programId":"course-1","__proto__":"ordinary-value"}'),
+      resolved,
+    )
+    expect(Object.getPrototypeOf(claims)).toBeNull()
+    expect(Object.hasOwn(claims, '__proto__')).toBe(true)
+    expect(claims.__proto__).toBe('ordinary-value')
+  })
+
+  it('rejects control characters in human-readable metadata', () => {
+    expect(() =>
+      validateSchema({
+        xcsVersion: '0.1',
+        name: 'Unsafe\u0000name',
+        description: 'Description',
+        fields: { value: { type: 'string' } },
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_INVALID' }))
+    expect(() =>
+      validateSchema({
+        xcsVersion: '0.1',
+        name: 'Name',
+        description: 'Unsafe\u0085description',
+        fields: { value: { type: 'string' } },
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_INVALID' }))
+  })
+
+  it('forbids inherited field overrides', () => {
+    const child = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Child',
+      description: 'Child schema',
+      extends: rootUid,
+      fields: { programId: { type: 'bool' } },
+    })
+    expect(() =>
+      resolveSchema(child, {
+        networkId: 1,
+        publisher: root.publisher,
+        ledgerIndex: 11,
+        transactionIndex: 0,
+        getSchema: () => root,
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_OVERRIDE_FORBIDDEN' }))
+  })
+
+  it('requires supersedes to target an earlier schema by the same publisher', () => {
+    const replacement = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Replacement',
+      description: 'Replacement schema',
+      supersedes: rootUid,
+      fields: { replacement: { type: 'bool' } },
+    })
+    expect(() =>
+      resolveSchema(replacement, {
+        networkId: 1,
+        publisher: 'rG1QQv2nh2gr7RCZ1P8YYcBUKCCN633jCn',
+        ledgerIndex: 11,
+        transactionIndex: 0,
+        getSchema: () => root,
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_SUPERSEDES_PUBLISHER_MISMATCH' }))
+  })
+
+  it('enforces the 256-field and 16-level limits', () => {
+    const tooManyFields = Object.fromEntries(
+      Array.from({ length: 257 }, (_, index) => [`field_${index}`, { type: 'string' }]),
+    )
+    expect(() =>
+      validateSchema({
+        xcsVersion: '0.1',
+        name: 'Too many fields',
+        description: 'Limit test',
+        fields: tooManyFields,
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_FIELD_LIMIT_EXCEEDED' }))
+
+    const catalog = new Map<string, RegisteredSchema>()
+    for (let index = 0; index < 16; index += 1) {
+      const uid = index.toString(16).padStart(64, '0')
+      catalog.set(uid, {
+        uid,
+        publisher: root.publisher,
+        networkId: 1,
+        ledgerIndex: index + 1,
+        transactionIndex: 0,
+        definition: validateSchema({
+          xcsVersion: '0.1',
+          name: `Level ${index}`,
+          description: 'Inheritance limit test',
+          ...(index > 0 ? { extends: (index - 1).toString(16).padStart(64, '0') } : {}),
+          fields: { [`level_${index}`]: { type: 'string' } },
+        }),
+      })
+    }
+    const depthSixteen = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Allowed level',
+      description: 'Inheritance limit test',
+      extends: (14).toString(16).padStart(64, '0'),
+      fields: { allowed_level: { type: 'string' } },
+    })
+    expect(
+      resolveSchema(depthSixteen, {
+        networkId: 1,
+        publisher: root.publisher,
+        ledgerIndex: 16,
+        transactionIndex: 0,
+        getSchema: (uid) => catalog.get(uid),
+      }).lineage,
+    ).toHaveLength(15)
+
+    const depthSeventeen = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Level 16',
+      description: 'Inheritance limit test',
+      extends: (15).toString(16).padStart(64, '0'),
+      fields: { level_16: { type: 'string' } },
+    })
+    expect(() =>
+      resolveSchema(depthSeventeen, {
+        networkId: 1,
+        publisher: root.publisher,
+        ledgerIndex: 17,
+        transactionIndex: 0,
+        getSchema: (uid) => catalog.get(uid),
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_DEPTH_EXCEEDED' }))
+  })
+
+  it('counts array item descriptors in local and inherited field limits', () => {
+    const arrayFields = (prefix: string, count: number) =>
+      Object.fromEntries(
+        Array.from({ length: count }, (_, index) => [
+          `${prefix}_${index}`,
+          { type: 'array', items: { type: 'string' } },
+        ]),
+      )
+
+    expect(() =>
+      validateSchema({
+        xcsVersion: '0.1',
+        name: 'At the descriptor limit',
+        description: 'Every array and its item are separate descriptors',
+        fields: arrayFields('field', 128),
+      }),
+    ).not.toThrow()
+    expect(() =>
+      validateSchema({
+        xcsVersion: '0.1',
+        name: 'Over the descriptor limit',
+        description: 'Array item descriptors must count toward the limit',
+        fields: arrayFields('field', 129),
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_FIELD_LIMIT_EXCEEDED' }))
+
+    const nestedFields = (prefix: string) =>
+      Object.fromEntries(
+        Array.from({ length: 127 }, (_, index) => [`${prefix}_${index}`, { type: 'string' }]),
+      )
+    const parentUid = '22'.repeat(32)
+    const parent: RegisteredSchema = {
+      uid: parentUid,
+      publisher: root.publisher,
+      networkId: 1,
+      ledgerIndex: 20,
+      transactionIndex: 0,
+      definition: validateSchema({
+        xcsVersion: '0.1',
+        name: 'Array parent',
+        description: 'Parent with an object descriptor nested in an array',
+        fields: {
+          parentItems: {
+            type: 'array',
+            items: { type: 'object', fields: nestedFields('parent') },
+          },
+        },
+      }),
+    }
+    const child = validateSchema({
+      xcsVersion: '0.1',
+      name: 'Array child',
+      description: 'Child that pushes the resolved descriptor count over the limit',
+      extends: parentUid,
+      fields: {
+        childItems: {
+          type: 'array',
+          items: { type: 'object', fields: nestedFields('child') },
+        },
+      },
+    })
+
+    expect(() =>
+      resolveSchema(child, {
+        networkId: 1,
+        publisher: root.publisher,
+        ledgerIndex: 21,
+        transactionIndex: 0,
+        getSchema: (uid) => (uid === parentUid ? parent : undefined),
+      }),
+    ).toThrowError(expect.objectContaining({ code: 'SCHEMA_FIELD_LIMIT_EXCEEDED' }))
+  })
+})
+
+describe('claim validation conformance', () => {
+  const schema = validateSchema(vectors.schema)
+  for (const vector of vectors.cases) {
+    it(vector.name, () => {
+      if (vector.valid) {
+        expect(validateClaims(vector.claims, schema.fields)).toEqual(vector.claims)
+      } else {
+        expect(() => validateClaims(vector.claims, schema.fields)).toThrowError(
+          expect.objectContaining({ code: vector.errorCode }),
+        )
+      }
+    })
+  }
+
+  it('rejects null and signed/unsigned overflow', () => {
+    expect(() => validateClaims({ text: null }, { text: { type: 'string' } })).toThrowError(
+      expect.objectContaining({ code: 'CLAIMS_INVALID' }),
+    )
+    expect(() =>
+      validateClaims({ n: (1n << 256n).toString() }, { n: { type: 'uint' } }),
+    ).toThrowError(expect.objectContaining({ code: 'CLAIMS_INVALID' }))
+  })
+
+  it('accepts a raw schema whose claim is literally named "fields"', () => {
+    expect(validateClaims({ fields: 'value' }, { fields: { type: 'string' } })).toEqual({
+      fields: 'value',
+    })
+  })
+})
diff --git a/packages/core/test/schema.test.ts b/packages/core/test/schema.test.ts
index c30e204..7507498 100644
--- a/packages/core/test/schema.test.ts
+++ b/packages/core/test/schema.test.ts
@@ -44,7 +44,7 @@ describe('schema', () => {
     )
     expect(parseSchemaBytes(canonical).name).toBe('Schema')
     expect(() => parseSchemaBytes(new TextEncoder().encode('{ "xcsVersion": "0.1" }'))).toThrow(
-      expect.objectContaining({ code: 'NON_CANONICAL_JSON' }),
+      expect.objectContaining({ code: 'JSON_INVALID' }),
     )
     expect(() =>
       parseSchemaBytes(
@@ -52,7 +52,7 @@ describe('schema', () => {
           '{"description":"First","description":"Second","fields":{"value":{"type":"string"}},"name":"Schema","xcsVersion":"0.1"}',
         ),
       ),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_JSON' }))
+    ).toThrow(expect.objectContaining({ code: 'JSON_DUPLICATE_KEY' }))
   })
 
   it('resolves prior parents and rejects field overrides', () => {
@@ -88,7 +88,7 @@ describe('schema', () => {
     expect(Object.keys(resolveSchema(child, context).fields)).toEqual(['courseId', 'score'])
     expect(() =>
       resolveSchema(parseSchema({ ...child, fields: { courseId: { type: 'bool' } } }), context),
-    ).toThrow(expect.objectContaining({ code: 'INVALID_SCHEMA_REFERENCE' }))
+    ).toThrow(expect.objectContaining({ code: 'SCHEMA_OVERRIDE_FORBIDDEN' }))
   })
 
   it('derives the published schema UID with noble SHA-256', () => {
diff --git a/packages/sdk/README.md b/packages/sdk/README.md
index 282fa3f..817e8be 100644
--- a/packages/sdk/README.md
+++ b/packages/sdk/README.md
@@ -27,12 +27,28 @@ only a signed blob and transaction hash. Hosts integrating a wallet that refresh
 non-signature field remains bound to the reviewed transaction, and submission uses the signed expiry
 value.
 
+After signing, the SDK checks the current ledger before invoking `onValidatedSignature`. An
+already-expired fresh signature is rejected without persisting recovery material or relaying it;
+the journal records a failed preparation so the host can offer a fresh review. It checks again
+after `beforeSubmit`, immediately before relay. If expiry occurs after recovery material was
+exposed to host hooks, the operation remains signed and recoverable. These first-submission
+guards do not establish historical absence for `submitSignedTransaction` retries.
+
 The optional operation journal records hashes and lifecycle stages, never signed blobs, payloads,
 seeds, or private keys. Browser and service hosts can persist a validated signed blob through
 `onValidatedSignature` before the first relay attempt. Volatile checks belong in `beforeSubmit`; if
 that hook rejects, the SDK keeps the journal stage `signed` so the host's persisted artifact remains
 recoverable instead of being mislabeled as a terminal signing failure.
 
+`getTransactionStatus` returns `not_found`, not `expired`, when the node cannot find a hash.
+An open ledger beyond `LastLedgerSequence` does not prove that the transaction failed: it may
+still validate in the preceding ledger or be missing from this node's history. Polling keeps
+reconciling until a validated result or the timeout; a timeout remains `pending`. The current
+journal does not store the submission-window start needed to prove final absence, so it does
+not automatically release an unresolved operation's business lock. `LastLedgerSequence` still
+prevents XRPL from validating the signed blob in a later ledger. See
+[XRPL reliable submission](https://xrpl.org/docs/concepts/transactions/reliable-transaction-submission).
+
 ## Network safety
 
 `connectAndValidateNetwork` checks the connected network ID, required amendment, and profile
diff --git a/packages/sdk/src/submission.ts b/packages/sdk/src/submission.ts
index 0019d2f..8fe9963 100644
--- a/packages/sdk/src/submission.ts
+++ b/packages/sdk/src/submission.ts
@@ -64,6 +64,14 @@ export interface ValidatedSignature {
   readonly lastLedgerSequence: number
 }
 
+export interface ValidatedSignedTransaction {
+  /** The exact unsigned fields recovered from the signed blob. */
+  readonly transaction: Readonly<SubmittableTransaction>
+  readonly txBlob: string
+  readonly txHash: string
+  readonly lastLedgerSequence: number
+}
+
 export interface ReliableSubmissionOptions {
   readonly journal: OperationJournal
   readonly operationId?: string | undefined
@@ -106,6 +114,43 @@ const HASH_PATTERN = /^[0-9a-fA-F]{64}$/u
 const BLOB_PATTERN = /^(?:[0-9a-fA-F]{2})+$/u
 const XRPL_JS_5_MAX_URI_HEX_CHARACTERS = 256
 
+/**
+ * Decode and cryptographically verify a single-signed XRPL transaction blob.
+ * This is the server-safe counterpart to the browser submission validation.
+ */
+export function decodeSignedTransactionBlob(txBlob: string): ValidatedSignedTransaction {
+  if (!BLOB_PATTERN.test(txBlob)) {
+    throw new XcsSdkError(
+      'XCS_SDK_INVALID_SIGNED_BLOB',
+      'Signed transaction input must be non-empty hexadecimal data.',
+    )
+  }
+
+  let decoded: Record<string, unknown>
+  let txHash: string
+  try {
+    decoded = decode(txBlob)
+    txHash = hashes.hashSignedTx(txBlob).toUpperCase()
+  } catch {
+    throw new XcsSdkError('XCS_SDK_INVALID_SIGNED_BLOB', 'Cannot decode signed transaction.')
+  }
+  assertValidSingleSignature(decoded, txBlob)
+  const lastLedgerSequence = asPositiveInteger(decoded.LastLedgerSequence)
+  if (lastLedgerSequence === undefined) {
+    throw new XcsSdkError(
+      'XCS_SDK_INVALID_SIGNED_BLOB',
+      'Signed transaction must contain a positive LastLedgerSequence.',
+    )
+  }
+
+  return {
+    transaction: withoutSignatureFields(decoded) as unknown as SubmittableTransaction,
+    txBlob,
+    txHash,
+    lastLedgerSequence,
+  }
+}
+
 export async function autofillXcsTransaction<T extends SubmittableTransaction>(
   client: Client,
   transaction: T,
@@ -212,6 +257,9 @@ export async function signPreparedAndSubmit<T extends SubmittableTransaction>(
       allowLastLedgerSequenceRefresh: options.allowSignerLastLedgerSequenceRefresh,
     })
     signedLastLedgerSequence = signedTransaction.LastLedgerSequence as number
+    // A wallet approval can outlive the reviewed ledger window. Reject before
+    // exposing recovery material to host hooks, so a fresh operation can retry.
+    await assertTransactionNotExpired(client, signedLastLedgerSequence)
     await options.onValidatedSignature?.({
       operationId,
       transaction: signedTransaction,
@@ -232,6 +280,13 @@ export async function signPreparedAndSubmit<T extends SubmittableTransaction>(
   return submitSignedTransaction(client, signed.txBlob, {
     ...options,
     operationId,
+    beforeSubmit: async (signature) => {
+      await options.beforeSubmit?.(signature)
+      // Recheck after asynchronous persistence/business guards, at the last
+      // boundary before this first relay. Recovery of old blobs stays separate:
+      // passing LastLedgerSequence does not prove absence from ledger history.
+      await assertTransactionNotExpired(client, signature.lastLedgerSequence)
+    },
   })
 }
 
@@ -246,31 +301,10 @@ export async function submitSignedTransaction(
       'Connect and validate the XRPL client before submitting a transaction.',
     )
   }
-  if (!BLOB_PATTERN.test(txBlob)) {
-    throw new XcsSdkError(
-      'XCS_SDK_INVALID_SIGNED_BLOB',
-      'Signed transaction input must be non-empty hexadecimal data.',
-    )
-  }
-
   const operationId = options.operationId ?? crypto.randomUUID()
-  let decoded: Record<string, unknown>
-  let txHash: string
-  try {
-    decoded = decode(txBlob)
-    txHash = hashes.hashSignedTx(txBlob).toUpperCase()
-  } catch {
-    throw new XcsSdkError('XCS_SDK_INVALID_SIGNED_BLOB', 'Cannot decode signed transaction.')
-  }
-  assertValidSingleSignature(decoded, txBlob)
-
-  const lastLedgerSequence = asPositiveInteger(decoded.LastLedgerSequence)
-  if (lastLedgerSequence === undefined) {
-    throw new XcsSdkError(
-      'XCS_SDK_INVALID_SIGNED_BLOB',
-      'Reliable submission requires a signed transaction with LastLedgerSequence.',
-    )
-  }
+  const validated = decodeSignedTransactionBlob(txBlob)
+  const decoded = validated.transaction as unknown as Record<string, unknown>
+  const { txHash, lastLedgerSequence } = validated
 
   // Persist the recovery identifiers before the first network side effect.
   await append(options.journal, {
@@ -392,17 +426,10 @@ export async function getTransactionStatus(
     }
   }
 
-  if (lastLedgerSequence !== undefined) {
-    const currentLedger = await getCurrentLedgerIndex(client)
-    if (currentLedger > lastLedgerSequence) {
-      return {
-        status: 'expired',
-        txHash: txHash.toUpperCase(),
-        lastLedgerSequence,
-      }
-    }
-  }
-
+  // A missing hash is not proof of expiry: the open ledger can be ahead of
+  // validation, and the server may lack historical ledgers. This API has no
+  // persisted submission-window start with which to prove complete absence.
+  // Keep the operation reconcilable instead of recording a terminal failure.
   return { status: 'not_found', txHash: txHash.toUpperCase(), lastLedgerSequence }
 }
 
diff --git a/packages/sdk/test/submission.test.ts b/packages/sdk/test/submission.test.ts
index 7f3878f..3450c3c 100644
--- a/packages/sdk/test/submission.test.ts
+++ b/packages/sdk/test/submission.test.ts
@@ -199,6 +199,69 @@ describe('reliable submission', () => {
     expect(submit).not.toHaveBeenCalled()
   })
 
+  it('rejects a signature returned after expiry before persisting it or entering the relay path', async () => {
+    const blob = signedBlob()
+    const transaction = decode(blob) as unknown as SubmittableTransaction
+    const journal = new MemoryOperationJournal()
+    const submit = vi.fn()
+    const onValidatedSignature = vi.fn()
+    const beforeSubmit = vi.fn()
+    const request = vi.fn(async () => ({ result: { ledger_current_index: 51 } }))
+    await expect(
+      signPreparedAndSubmit(
+        mockClient({ submit, request }),
+        transaction,
+        { sign: async () => ({ txBlob: blob, hash: hashes.hashSignedTx(blob) }) },
+        { journal, onValidatedSignature, beforeSubmit },
+      ),
+    ).rejects.toMatchObject({ code: 'XCS_SDK_TRANSACTION_EXPIRED' })
+    expect(onValidatedSignature).not.toHaveBeenCalled()
+    expect(beforeSubmit).not.toHaveBeenCalled()
+    expect(submit).not.toHaveBeenCalled()
+    expect(journal.entries.map((entry) => entry.stage)).toEqual(['prepared', 'failed'])
+    expect(journal.entries.every((entry) => entry.txHash === undefined)).toBe(true)
+  })
+
+  it('rechecks expiry after the final asynchronous host guard without relaying the blob', async () => {
+    const blob = signedBlob()
+    const journal = new MemoryOperationJournal()
+    let currentLedger = 49
+    const submit = vi.fn()
+    const onValidatedSignature = vi.fn()
+    await expect(
+      signPreparedAndSubmit(
+        mockClient({
+          submit,
+          request: vi.fn(async () => ({ result: { ledger_current_index: currentLedger } })),
+        }),
+        decode(blob) as unknown as SubmittableTransaction,
+        { sign: async () => ({ txBlob: blob, hash: hashes.hashSignedTx(blob) }) },
+        {
+          journal,
+          onValidatedSignature,
+          beforeSubmit: async () => {
+            currentLedger = 51
+          },
+        },
+      ),
+    ).rejects.toMatchObject({ code: 'XCS_SDK_TRANSACTION_EXPIRED' })
+    expect(onValidatedSignature).toHaveBeenCalledOnce()
+    expect(submit).not.toHaveBeenCalled()
+    // Once recovery material has escaped to a host hook, do not infer global absence.
+    expect(journal.entries.at(-1)?.stage).toBe('signed')
+  })
+
+  it('keeps a previously relayed cached transaction pending after its ledger window', async () => {
+    const request = vi.fn(async ({ command }: { command: string }) => ({
+      result: command === 'tx' ? { validated: false } : { ledger_current_index: 100 },
+    }))
+    await expect(
+      getTransactionStatus(mockClient({ request }), 'AB'.repeat(32), 50),
+    ).resolves.toMatchObject({ status: 'pending' })
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(request).toHaveBeenCalledWith(expect.objectContaining({ command: 'tx' }))
+  })
+
   it('runs the validated-signature hook after exact comparison and before submit', async () => {
     const calls: string[] = []
     const blob = signedBlob()
@@ -312,18 +375,47 @@ describe('reliable submission', () => {
     expect(request).not.toHaveBeenCalled()
   })
 
-  it('reports expiration only after the last ledger sequence passes', async () => {
-    const notFound = Object.assign(new Error('txnNotFound'), { data: { error: 'txnNotFound' } })
+  it('does not infer final failure from an open ledger or incomplete history', async () => {
+    const notFound = Object.assign(new Error('txnNotFound'), {
+      data: { error: 'txnNotFound', searched_all: false },
+    })
     const client = mockClient({
-      request: vi
-        .fn()
-        .mockRejectedValueOnce(notFound)
-        .mockResolvedValueOnce({ result: { ledger_current_index: 51 } }),
+      request: vi.fn(async (request: { command: string }) => {
+        if (request.command === 'tx') throw notFound
+        return { result: { ledger_current_index: 51 } }
+      }),
     })
 
     await expect(getTransactionStatus(client, 'AB'.repeat(32), 50)).resolves.toMatchObject({
-      status: 'expired',
+      status: 'not_found',
+    })
+  })
+
+  it('keeps polling after txnNotFound so a later validated result is not lost', async () => {
+    const journal = new MemoryOperationJournal()
+    let lookups = 0
+    const client = mockClient({
+      request: vi.fn(async ({ command }: { command: string }) => {
+        if (command !== 'tx') return { result: { ledger_current_index: 51 } }
+        if (lookups++ === 0) {
+          throw Object.assign(new Error('txnNotFound'), { data: { error: 'txnNotFound' } })
+        }
+        return {
+          result: {
+            validated: true,
+            ledger_index: 50,
+            meta: { TransactionResult: 'tesSUCCESS' },
+          },
+        }
+      }),
+    })
+    const result = await submitSignedTransaction(client, signedBlob(), {
+      journal,
+      pollIntervalMs: 1,
+      timeoutMs: 100,
     })
+    expect(result).toMatchObject({ status: 'validated', ledgerIndex: 50 })
+    expect(journal.entries.map((entry) => entry.stage)).not.toContain('expired')
   })
 
   it('rejects an expired prepared transaction before any submit side effect', async () => {
diff --git a/verifier-go/README.md b/verifier-go/README.md
new file mode 100644
index 0000000..7767fc0
--- /dev/null
+++ b/verifier-go/README.md
@@ -0,0 +1,33 @@
+# Independent Go verifier
+
+This module is an offline, standard-library-only implementation of the XCS v0.1
+deterministic rules. It does not import or execute the TypeScript implementation.
+
+Run its shared conformance suite:
+
+```sh
+GOCACHE=/tmp/xcs-go-cache go test ./...
+```
+
+Build the CLI:
+
+```sh
+go build -o xcs-verify ./cmd/xcs-verify
+```
+
+Commands:
+
+```text
+xcs-verify uid UID_INPUT.json
+xcs-verify schema SCHEMA.json
+xcs-verify claims SCHEMA.json CLAIMS.json
+xcs-verify payload SCHEMA.json PAYLOAD.json URI ISSUER SUBJECT SCHEMA_UID
+```
+
+Every command writes one JSON result. Protocol errors are written to stderr with
+a stable `code`, `path`, and `message`, then the process exits non-zero.
+
+The `claims` and `payload` commands require a locally complete schema. If the
+input schema contains `extends`, they fail closed with `SCHEMA_PARENT_NOT_FOUND`;
+the offline CLI has no ledger-backed parent catalog from which to resolve
+inherited fields.
diff --git a/verifier-go/cmd/xcs-verify/main.go b/verifier-go/cmd/xcs-verify/main.go
new file mode 100644
index 0000000..57f920a
--- /dev/null
+++ b/verifier-go/cmd/xcs-verify/main.go
@@ -0,0 +1,121 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/XRPL-Commons/XCS/verifier-go/xcs"
+)
+
+func read(path string) []byte {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		fatal(err)
+	}
+	return data
+}
+
+func write(value any) {
+	encoder := json.NewEncoder(os.Stdout)
+	encoder.SetEscapeHTML(false)
+	if err := encoder.Encode(value); err != nil {
+		fatal(err)
+	}
+}
+
+func fatal(err error) {
+	var protocolError *xcs.Error
+	if errors.As(err, &protocolError) {
+		_ = json.NewEncoder(os.Stderr).Encode(protocolError)
+	} else {
+		_ = json.NewEncoder(os.Stderr).Encode(map[string]string{
+			"code": "INTERNAL", "message": err.Error(),
+		})
+	}
+	os.Exit(1)
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, `Offline XCS v0.1 verifier
+
+Usage:
+  xcs-verify uid UID_INPUT.json
+  xcs-verify schema SCHEMA.json
+  xcs-verify claims SCHEMA.json CLAIMS.json
+  xcs-verify payload SCHEMA.json PAYLOAD.json URI ISSUER SUBJECT SCHEMA_UID`)
+	os.Exit(2)
+}
+
+func main() {
+	if len(os.Args) < 3 {
+		usage()
+	}
+	switch os.Args[1] {
+	case "uid":
+		if len(os.Args) != 3 {
+			usage()
+		}
+		input, err := xcs.ParseSchemaUIDInput(read(os.Args[2]))
+		if err != nil {
+			fatal(err)
+		}
+		uid, preimage, err := xcs.ComputeSchemaUID(input)
+		if err != nil {
+			fatal(err)
+		}
+		write(map[string]any{"valid": true, "uid": uid, "canonicalPreimage": string(preimage)})
+	case "schema":
+		if len(os.Args) != 3 {
+			usage()
+		}
+		if _, err := xcs.ParseSchema(read(os.Args[2])); err != nil {
+			fatal(err)
+		}
+		write(map[string]any{"valid": true})
+	case "claims":
+		if len(os.Args) != 4 {
+			usage()
+		}
+		schema, err := xcs.ParseSchema(read(os.Args[2]))
+		if err != nil {
+			fatal(err)
+		}
+		value, err := xcs.ParseJSON(read(os.Args[3]))
+		if err != nil {
+			fatal(err)
+		}
+		claims, ok := value.(map[string]any)
+		if !ok {
+			fatal(fmt.Errorf("claims must be a JSON object"))
+		}
+		if err := xcs.ValidateClaimsAgainstSchema(claims, schema); err != nil {
+			fatal(err)
+		}
+		write(map[string]any{"valid": true})
+	case "payload":
+		if len(os.Args) != 8 {
+			usage()
+		}
+		schema, err := xcs.ParseSchema(read(os.Args[2]))
+		if err != nil {
+			fatal(err)
+		}
+		payloadBytes := read(os.Args[3])
+		integrity, expected, actual, err := xcs.VerifyPayloadIntegrity(payloadBytes, os.Args[4])
+		if err != nil {
+			fatal(err)
+		}
+		if _, err := xcs.ParseCredentialPayload(payloadBytes, xcs.PayloadContext{
+			Issuer: os.Args[5], Subject: os.Args[6], SchemaUID: os.Args[7], Schema: schema,
+		}); err != nil {
+			fatal(err)
+		}
+		write(map[string]any{
+			"valid": integrity, "expectedDigestHex": expected, "actualDigestHex": actual,
+		})
+	default:
+		usage()
+	}
+}
diff --git a/verifier-go/go.mod b/verifier-go/go.mod
new file mode 100644
index 0000000..aae1df8
--- /dev/null
+++ b/verifier-go/go.mod
@@ -0,0 +1,3 @@
+module github.com/XRPL-Commons/XCS/verifier-go
+
+go 1.26
diff --git a/verifier-go/xcs/address.go b/verifier-go/xcs/address.go
new file mode 100644
index 0000000..9a97d10
--- /dev/null
+++ b/verifier-go/xcs/address.go
@@ -0,0 +1,56 @@
+package xcs
+
+import (
+	"crypto/sha256"
+	"slices"
+)
+
+const xrpBase58Alphabet = "rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz"
+
+func decodeBase58(value string) ([]byte, bool) {
+	decoded := []byte{0}
+	for _, character := range value {
+		digit := -1
+		for index, candidate := range xrpBase58Alphabet {
+			if candidate == character {
+				digit = index
+				break
+			}
+		}
+		if digit < 0 {
+			return nil, false
+		}
+		carry := digit
+		for index := len(decoded) - 1; index >= 0; index-- {
+			carry += int(decoded[index]) * 58
+			decoded[index] = byte(carry & 0xff)
+			carry >>= 8
+		}
+		for carry > 0 {
+			decoded = append([]byte{byte(carry & 0xff)}, decoded...)
+			carry >>= 8
+		}
+	}
+
+	zeroes := 0
+	for zeroes < len(value) && value[zeroes] == xrpBase58Alphabet[0] {
+		zeroes++
+	}
+	if len(decoded) == 1 && decoded[0] == 0 {
+		decoded = decoded[:0]
+	}
+	return append(make([]byte, zeroes), decoded...), true
+}
+
+func IsClassicAddress(value string) bool {
+	if len(value) < 25 || len(value) > 35 || value[0] != 'r' {
+		return false
+	}
+	decoded, ok := decodeBase58(value)
+	if !ok || len(decoded) != 25 || decoded[0] != 0 {
+		return false
+	}
+	first := sha256.Sum256(decoded[:21])
+	second := sha256.Sum256(first[:])
+	return slices.Equal(decoded[21:], second[:4])
+}
diff --git a/verifier-go/xcs/canonical.go b/verifier-go/xcs/canonical.go
new file mode 100644
index 0000000..e256a73
--- /dev/null
+++ b/verifier-go/xcs/canonical.go
@@ -0,0 +1,285 @@
+package xcs
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode/utf16"
+	"unicode/utf8"
+)
+
+func ParseJSON(data []byte) (any, error) {
+	if !utf8.Valid(data) {
+		return nil, invalid("JSON_INVALID_UNICODE", "$", "input is not valid UTF-8")
+	}
+	if err := validateUnicodeEscapes(data); err != nil {
+		return nil, err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.UseNumber()
+	value, err := decodeValue(decoder, "$")
+	if err != nil {
+		if _, ok := err.(*Error); ok {
+			return nil, err
+		}
+		return nil, invalid("JSON_INVALID", "$", "%v", err)
+	}
+	if _, err := decoder.Token(); err != io.EOF {
+		return nil, invalid("JSON_INVALID", "$", "unexpected trailing content")
+	}
+	return value, nil
+}
+
+func hexQuad(data []byte) (uint16, bool) {
+	if len(data) < 4 {
+		return 0, false
+	}
+	var value uint16
+	for _, character := range data[:4] {
+		value <<= 4
+		switch {
+		case character >= '0' && character <= '9':
+			value += uint16(character - '0')
+		case character >= 'a' && character <= 'f':
+			value += uint16(character-'a') + 10
+		case character >= 'A' && character <= 'F':
+			value += uint16(character-'A') + 10
+		default:
+			return 0, false
+		}
+	}
+	return value, true
+}
+
+func validateUnicodeEscapes(data []byte) error {
+	inString := false
+	for index := 0; index < len(data); index++ {
+		switch data[index] {
+		case '"':
+			inString = !inString
+		case '\\':
+			if !inString || index+1 >= len(data) {
+				continue
+			}
+			index++
+			if data[index] != 'u' {
+				continue
+			}
+			first, ok := hexQuad(data[index+1:])
+			if !ok {
+				continue // encoding/json reports malformed escapes.
+			}
+			index += 4
+			if first >= 0xd800 && first <= 0xdbff {
+				if index+6 >= len(data) || data[index+1] != '\\' || data[index+2] != 'u' {
+					return invalid("JSON_INVALID_UNICODE", "$", "unpaired high surrogate")
+				}
+				second, valid := hexQuad(data[index+3:])
+				if !valid || second < 0xdc00 || second > 0xdfff {
+					return invalid("JSON_INVALID_UNICODE", "$", "invalid low surrogate")
+				}
+				index += 6
+			} else if first >= 0xdc00 && first <= 0xdfff {
+				return invalid("JSON_INVALID_UNICODE", "$", "unpaired low surrogate")
+			}
+		}
+	}
+	return nil
+}
+
+func decodeValue(decoder *json.Decoder, path string) (any, error) {
+	token, err := decoder.Token()
+	if err != nil {
+		return nil, err
+	}
+	delimiter, composite := token.(json.Delim)
+	if !composite {
+		return token, nil
+	}
+	switch delimiter {
+	case '{':
+		object := make(map[string]any)
+		for decoder.More() {
+			keyToken, err := decoder.Token()
+			if err != nil {
+				return nil, err
+			}
+			key, ok := keyToken.(string)
+			if !ok {
+				return nil, invalid("JSON_INVALID", path, "object key is not a string")
+			}
+			if _, exists := object[key]; exists {
+				return nil, invalid("JSON_DUPLICATE_KEY", path+"."+key, "duplicate object key")
+			}
+			value, err := decodeValue(decoder, path+"."+key)
+			if err != nil {
+				return nil, err
+			}
+			object[key] = value
+		}
+		if _, err := decoder.Token(); err != nil {
+			return nil, err
+		}
+		return object, nil
+	case '[':
+		array := make([]any, 0)
+		for decoder.More() {
+			value, err := decodeValue(decoder, path)
+			if err != nil {
+				return nil, err
+			}
+			array = append(array, value)
+		}
+		if _, err := decoder.Token(); err != nil {
+			return nil, err
+		}
+		return array, nil
+	default:
+		return nil, invalid("JSON_INVALID", path, "unexpected delimiter")
+	}
+}
+
+func appendString(destination *bytes.Buffer, value string) error {
+	if !utf8.ValidString(value) {
+		return invalid("JSON_INVALID_UNICODE", "$", "string is not valid UTF-8")
+	}
+	destination.WriteByte('"')
+	for _, character := range value {
+		switch character {
+		case '"', '\\':
+			destination.WriteByte('\\')
+			destination.WriteRune(character)
+		case '\b':
+			destination.WriteString("\\b")
+		case '\t':
+			destination.WriteString("\\t")
+		case '\n':
+			destination.WriteString("\\n")
+		case '\f':
+			destination.WriteString("\\f")
+		case '\r':
+			destination.WriteString("\\r")
+		default:
+			if character < 0x20 {
+				fmt.Fprintf(destination, "\\u%04x", character)
+			} else {
+				destination.WriteRune(character)
+			}
+		}
+	}
+	destination.WriteByte('"')
+	return nil
+}
+
+func formatECMAScriptNumber(value float64) (string, error) {
+	if math.IsNaN(value) || math.IsInf(value, 0) {
+		return "", invalid("JSON_NON_IJSON_NUMBER", "$", "number is not finite")
+	}
+	if value == 0 {
+		return "0", nil
+	}
+	absolute := math.Abs(value)
+	if absolute >= 1e-6 && absolute < 1e21 {
+		return strconv.FormatFloat(value, 'f', -1, 64), nil
+	}
+	scientific := strconv.FormatFloat(value, 'e', -1, 64)
+	parts := strings.Split(scientific, "e")
+	exponent, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%se%+d", parts[0], exponent), nil
+}
+
+func utf16Less(left, right string) bool {
+	leftUnits := utf16.Encode([]rune(left))
+	rightUnits := utf16.Encode([]rune(right))
+	for index := 0; index < len(leftUnits) && index < len(rightUnits); index++ {
+		if leftUnits[index] != rightUnits[index] {
+			return leftUnits[index] < rightUnits[index]
+		}
+	}
+	return len(leftUnits) < len(rightUnits)
+}
+
+func appendCanonical(destination *bytes.Buffer, value any) error {
+	switch typed := value.(type) {
+	case nil:
+		destination.WriteString("null")
+	case bool:
+		if typed {
+			destination.WriteString("true")
+		} else {
+			destination.WriteString("false")
+		}
+	case string:
+		return appendString(destination, typed)
+	case json.Number:
+		parsed, err := strconv.ParseFloat(string(typed), 64)
+		if err != nil {
+			return invalid("JSON_NON_IJSON_NUMBER", "$", "%v", err)
+		}
+		formatted, err := formatECMAScriptNumber(parsed)
+		if err != nil {
+			return err
+		}
+		destination.WriteString(formatted)
+	case float64:
+		formatted, err := formatECMAScriptNumber(typed)
+		if err != nil {
+			return err
+		}
+		destination.WriteString(formatted)
+	case int:
+		destination.WriteString(strconv.Itoa(typed))
+	case uint32:
+		destination.WriteString(strconv.FormatUint(uint64(typed), 10))
+	case []any:
+		destination.WriteByte('[')
+		for index, element := range typed {
+			if index > 0 {
+				destination.WriteByte(',')
+			}
+			if err := appendCanonical(destination, element); err != nil {
+				return err
+			}
+		}
+		destination.WriteByte(']')
+	case map[string]any:
+		keys := make([]string, 0, len(typed))
+		for key := range typed {
+			keys = append(keys, key)
+		}
+		sort.Slice(keys, func(left, right int) bool { return utf16Less(keys[left], keys[right]) })
+		destination.WriteByte('{')
+		for index, key := range keys {
+			if index > 0 {
+				destination.WriteByte(',')
+			}
+			if err := appendString(destination, key); err != nil {
+				return err
+			}
+			destination.WriteByte(':')
+			if err := appendCanonical(destination, typed[key]); err != nil {
+				return err
+			}
+		}
+		destination.WriteByte('}')
+	default:
+		return invalid("CANONICALIZATION_UNSUPPORTED_VALUE", "$", "unsupported value %T", value)
+	}
+	return nil
+}
+
+func Canonicalize(value any) ([]byte, error) {
+	var result bytes.Buffer
+	if err := appendCanonical(&result, value); err != nil {
+		return nil, err
+	}
+	return result.Bytes(), nil
+}
diff --git a/verifier-go/xcs/claims.go b/verifier-go/xcs/claims.go
new file mode 100644
index 0000000..9d6b32a
--- /dev/null
+++ b/verifier-go/xcs/claims.go
@@ -0,0 +1,125 @@
+package xcs
+
+import (
+	"encoding/base64"
+	"math/big"
+	"regexp"
+	"strconv"
+)
+
+var (
+	unsignedDecimal = regexp.MustCompile(`^(?:0|[1-9][0-9]*)$`)
+	signedDecimal   = regexp.MustCompile(`^(?:0|-?[1-9][0-9]*)$`)
+	uintMaximum     = new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 256), big.NewInt(1))
+	intMaximum      = new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(1))
+	intMinimum      = new(big.Int).Neg(new(big.Int).Lsh(big.NewInt(1), 255))
+)
+
+func validateClaimValue(value any, descriptor FieldDescriptor, path string) error {
+	if value == nil {
+		return invalid("CLAIMS_INVALID", path, "null is not allowed")
+	}
+	switch descriptor.Type {
+	case "string":
+		if _, ok := value.(string); !ok {
+			return invalid("CLAIMS_INVALID", path, "expected string")
+		}
+	case "bool":
+		if _, ok := value.(bool); !ok {
+			return invalid("CLAIMS_INVALID", path, "expected boolean")
+		}
+	case "uint":
+		text, ok := value.(string)
+		if !ok || len(text) > 78 || !unsignedDecimal.MatchString(text) {
+			return invalid("CLAIMS_INVALID", path, "expected canonical unsigned decimal string")
+		}
+		parsed, _ := new(big.Int).SetString(text, 10)
+		if parsed.Cmp(uintMaximum) > 0 {
+			return invalid("CLAIMS_INVALID", path, "uint exceeds 256-bit range")
+		}
+	case "int":
+		text, ok := value.(string)
+		if !ok || len(text) > 79 || !signedDecimal.MatchString(text) {
+			return invalid("CLAIMS_INVALID", path, "expected canonical signed decimal string")
+		}
+		parsed, _ := new(big.Int).SetString(text, 10)
+		if parsed.Cmp(intMinimum) < 0 || parsed.Cmp(intMaximum) > 0 {
+			return invalid("CLAIMS_INVALID", path, "int exceeds signed 256-bit range")
+		}
+	case "bytes":
+		text, ok := value.(string)
+		if !ok {
+			return invalid("CLAIMS_INVALID", path, "expected base64url string")
+		}
+		decoded, err := base64.RawURLEncoding.DecodeString(text)
+		if err != nil || base64.RawURLEncoding.EncodeToString(decoded) != text {
+			return invalid("CLAIMS_INVALID", path, "expected canonical base64url without padding")
+		}
+	case "address":
+		text, ok := value.(string)
+		if !ok || !IsClassicAddress(text) {
+			return invalid("CLAIMS_INVALID", path, "expected XRPL classic address")
+		}
+	case "array":
+		values, ok := value.([]any)
+		if !ok || descriptor.Items == nil {
+			return invalid("CLAIMS_INVALID", path, "expected array")
+		}
+		for index, element := range values {
+			if err := validateClaimValue(element, *descriptor.Items, path+"["+strconv.Itoa(index)+"]"); err != nil {
+				return err
+			}
+		}
+	case "object":
+		object, ok := value.(map[string]any)
+		if !ok {
+			return invalid("CLAIMS_INVALID", path, "expected object")
+		}
+		return validateClaimObject(object, descriptor.Fields, path)
+	default:
+		return invalid("CLAIMS_INVALID", path, "unsupported descriptor")
+	}
+	return nil
+}
+
+func validateClaimObject(claims map[string]any, fields map[string]FieldDescriptor, path string) error {
+	for name := range claims {
+		if _, ok := fields[name]; !ok {
+			return invalid("CLAIMS_INVALID", path+"."+name, "unknown claim")
+		}
+	}
+	for name, descriptor := range fields {
+		value, exists := claims[name]
+		if !exists {
+			if descriptor.Optional {
+				continue
+			}
+			return invalid("CLAIMS_INVALID", path+"."+name, "missing required claim")
+		}
+		if err := validateClaimValue(value, descriptor, path+"."+name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func ValidateClaims(claims map[string]any, fields map[string]FieldDescriptor) error {
+	return validateClaimObject(claims, fields, "$.claims")
+}
+
+// ValidateClaimsAgainstSchema validates claims only when the supplied schema is
+// locally complete. Inherited schemas require parent resolution, which this
+// offline verifier cannot infer from a child definition alone.
+func ValidateClaimsAgainstSchema(claims map[string]any, schema SchemaDefinition) error {
+	if err := ValidateSchema(schema); err != nil {
+		return err
+	}
+	if schema.Extends != "" {
+		return invalid(
+			"SCHEMA_PARENT_NOT_FOUND",
+			"$.extends",
+			"cannot validate claims against an unresolved inherited schema",
+		)
+	}
+	return ValidateClaims(claims, schema.Fields)
+}
diff --git a/verifier-go/xcs/conformance_test.go b/verifier-go/xcs/conformance_test.go
new file mode 100644
index 0000000..a4cd147
--- /dev/null
+++ b/verifier-go/xcs/conformance_test.go
@@ -0,0 +1,311 @@
+package xcs
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func vectorFile(t *testing.T, name string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join("..", "..", "conformance", "v0.1", name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func TestCanonicalizationVectors(t *testing.T) {
+	var vectors struct {
+		Cases []struct {
+			Name      string `json:"name"`
+			InputJSON string `json:"inputJson"`
+			Canonical string `json:"canonical"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(vectorFile(t, "canonicalization.json"), &vectors); err != nil {
+		t.Fatal(err)
+	}
+	for _, vector := range vectors.Cases {
+		t.Run(vector.Name, func(t *testing.T) {
+			parsed, err := ParseJSON([]byte(vector.InputJSON))
+			if err != nil {
+				t.Fatal(err)
+			}
+			canonical, err := Canonicalize(parsed)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(canonical) != vector.Canonical {
+				t.Fatalf("canonical mismatch\nwant %s\ngot  %s", vector.Canonical, canonical)
+			}
+		})
+	}
+}
+
+func TestStrictJSONRejectsDuplicateKeys(t *testing.T) {
+	_, err := ParseJSON([]byte(`{"a":1,"a":2}`))
+	var xcsError *Error
+	if !errors.As(err, &xcsError) || xcsError.Code != "JSON_DUPLICATE_KEY" {
+		t.Fatalf("expected JSON_DUPLICATE_KEY, got %v", err)
+	}
+}
+
+func TestStrictJSONRejectsUnpairedSurrogates(t *testing.T) {
+	_, err := ParseJSON([]byte(`"\ud800"`))
+	var xcsError *Error
+	if !errors.As(err, &xcsError) || xcsError.Code != "JSON_INVALID_UNICODE" {
+		t.Fatalf("expected JSON_INVALID_UNICODE, got %v", err)
+	}
+}
+
+func TestSchemaUIDVectors(t *testing.T) {
+	var vectors struct {
+		Cases []struct {
+			Name              string         `json:"name"`
+			Input             SchemaUIDInput `json:"input"`
+			CanonicalPreimage string         `json:"canonicalPreimage"`
+			UID               string         `json:"uid"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(vectorFile(t, "schema-uid.json"), &vectors); err != nil {
+		t.Fatal(err)
+	}
+	for _, vector := range vectors.Cases {
+		t.Run(vector.Name, func(t *testing.T) {
+			uid, canonical, err := ComputeSchemaUID(vector.Input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if uid != vector.UID {
+				t.Fatalf("UID mismatch: want %s, got %s", vector.UID, uid)
+			}
+			if string(canonical) != vector.CanonicalPreimage {
+				t.Fatalf("preimage mismatch\nwant %s\ngot  %s", vector.CanonicalPreimage, canonical)
+			}
+		})
+	}
+}
+
+func TestSchemaUIDInputRequiresPresentNumericFields(t *testing.T) {
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "Course", Description: "Course completion",
+		Fields: map[string]FieldDescriptor{"programId": {Type: "string"}},
+	}
+	for _, field := range []string{"networkId", "ledgerIndex", "transactionIndex"} {
+		for _, variant := range []string{"missing", "null"} {
+			t.Run(field+"_"+variant, func(t *testing.T) {
+				input := map[string]any{
+					"networkId":        0,
+					"ledgerHash":       "abababababababababababababababababababababababababababababababab",
+					"ledgerIndex":      0,
+					"transactionIndex": 0,
+					"publisher":        "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh",
+					"schema":           schemaMap(schema),
+				}
+				if variant == "missing" {
+					delete(input, field)
+				} else {
+					input[field] = nil
+				}
+				encoded, err := json.Marshal(input)
+				if err != nil {
+					t.Fatal(err)
+				}
+				_, err = ParseSchemaUIDInput(encoded)
+				var xcsError *Error
+				if !errors.As(err, &xcsError) || xcsError.Code != "UID_INPUT_INVALID" {
+					t.Fatalf("expected UID_INPUT_INVALID, got %v", err)
+				}
+			})
+		}
+	}
+}
+
+func TestClaimVectors(t *testing.T) {
+	var vectors struct {
+		Schema SchemaDefinition `json:"schema"`
+		Cases  []struct {
+			Name      string          `json:"name"`
+			Valid     bool            `json:"valid"`
+			ErrorCode string          `json:"errorCode"`
+			Claims    json.RawMessage `json:"claims"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(vectorFile(t, "claims.json"), &vectors); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateSchema(vectors.Schema); err != nil {
+		t.Fatal(err)
+	}
+	for _, vector := range vectors.Cases {
+		t.Run(vector.Name, func(t *testing.T) {
+			parsed, err := ParseJSON(vector.Claims)
+			if err != nil {
+				t.Fatal(err)
+			}
+			claims := parsed.(map[string]any)
+			err = ValidateClaims(claims, vectors.Schema.Fields)
+			if vector.Valid && err != nil {
+				t.Fatalf("expected valid claims: %v", err)
+			}
+			if !vector.Valid {
+				var xcsError *Error
+				if !errors.As(err, &xcsError) || xcsError.Code != vector.ErrorCode {
+					t.Fatalf("expected %s, got %v", vector.ErrorCode, err)
+				}
+			}
+		})
+	}
+}
+
+func TestSchemaRejectsControlCharacters(t *testing.T) {
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "unsafe\x00name", Description: "description",
+		Fields: map[string]FieldDescriptor{"value": {Type: "string"}},
+	}
+	if err := ValidateSchema(schema); err == nil {
+		t.Fatal("expected control-character rejection")
+	}
+}
+
+func TestParsedSchemaRejectsNullCompositePropertiesOnScalar(t *testing.T) {
+	_, err := ParseSchema([]byte(`{"xcsVersion":"0.1","name":"Name","description":"Description","fields":{"value":{"type":"string","items":null}}}`))
+	if err == nil {
+		t.Fatal("expected scalar items property rejection")
+	}
+}
+
+func TestParsedSchemaRejectsNullOptionalAndRelations(t *testing.T) {
+	cases := map[string]string{
+		"optional":      `{"xcsVersion":"0.1","name":"Name","description":"Description","fields":{"value":{"type":"string","optional":null}}}`,
+		"extends":       `{"xcsVersion":"0.1","name":"Name","description":"Description","extends":null,"fields":{"value":{"type":"string"}}}`,
+		"empty extends": `{"xcsVersion":"0.1","name":"Name","description":"Description","extends":"","fields":{"value":{"type":"string"}}}`,
+		"supersedes":    `{"xcsVersion":"0.1","name":"Name","description":"Description","supersedes":null,"fields":{"value":{"type":"string"}}}`,
+	}
+	for name, input := range cases {
+		t.Run(name, func(t *testing.T) {
+			_, err := ParseSchema([]byte(input))
+			var xcsError *Error
+			if !errors.As(err, &xcsError) || xcsError.Code != "SCHEMA_INVALID" {
+				t.Fatalf("expected SCHEMA_INVALID, got %v", err)
+			}
+		})
+	}
+}
+
+func TestSchemaCountsArrayItemDescriptors(t *testing.T) {
+	fields := make(map[string]FieldDescriptor, 128)
+	for index := 0; index < 128; index++ {
+		items := FieldDescriptor{Type: "string"}
+		fields[fmt.Sprintf("field_%d", index)] = FieldDescriptor{Type: "array", Items: &items}
+	}
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "At the descriptor limit", Description: "Array item descriptors count",
+		Fields: fields,
+	}
+	if err := ValidateSchema(schema); err != nil {
+		t.Fatalf("expected exactly 256 descriptors to be valid: %v", err)
+	}
+
+	items := FieldDescriptor{Type: "string"}
+	schema.Fields["field_128"] = FieldDescriptor{Type: "array", Items: &items}
+	err := ValidateSchema(schema)
+	var xcsError *Error
+	if !errors.As(err, &xcsError) || xcsError.Code != "SCHEMA_FIELD_LIMIT_EXCEEDED" {
+		t.Fatalf("expected SCHEMA_FIELD_LIMIT_EXCEEDED, got %v", err)
+	}
+}
+
+func TestPayloadIntegrityVectors(t *testing.T) {
+	var vectors struct {
+		Cases []struct {
+			Name        string `json:"name"`
+			ContentUTF8 string `json:"contentUtf8"`
+			SHA256      string `json:"sha256"`
+			URI         string `json:"uri"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(vectorFile(t, "payload-integrity.json"), &vectors); err != nil {
+		t.Fatal(err)
+	}
+	for _, vector := range vectors.Cases {
+		t.Run(vector.Name, func(t *testing.T) {
+			valid, expected, actual, err := VerifyPayloadIntegrity([]byte(vector.ContentUTF8), vector.URI)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !valid || expected != vector.SHA256 || actual != vector.SHA256 {
+				t.Fatalf("integrity mismatch: valid=%v expected=%s actual=%s", valid, expected, actual)
+			}
+		})
+	}
+}
+
+func TestCanonicalPayloadValidation(t *testing.T) {
+	issuer := "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh"
+	subject := "rG1QQv2nh2gr7RCZ1P8YYcBUKCCN633jCn"
+	schemaUID := "abababababababababababababababababababababababababababababababab"
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "Course", Description: "Course completion",
+		Fields: map[string]FieldDescriptor{"programId": {Type: "string"}},
+	}
+	value := map[string]any{
+		"xcsVersion": "0.1", "issuer": issuer, "subject": subject, "schema": schemaUID,
+		"claims": map[string]any{"programId": "course-1"},
+	}
+	canonical, err := Canonicalize(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	context := PayloadContext{Issuer: issuer, Subject: subject, SchemaUID: schemaUID, Schema: schema}
+	if _, err := ParseCredentialPayload(canonical, context); err != nil {
+		t.Fatal(err)
+	}
+	pretty, _ := json.MarshalIndent(value, "", "  ")
+	if _, err := ParseCredentialPayload(pretty, context); err == nil {
+		t.Fatal("expected non-canonical payload rejection")
+	}
+}
+
+func TestPayloadValidationRejectsUnresolvedInheritedSchema(t *testing.T) {
+	issuer := "rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh"
+	subject := "rG1QQv2nh2gr7RCZ1P8YYcBUKCCN633jCn"
+	schemaUID := "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "Child", Description: "Unresolved inherited schema",
+		Extends: "abababababababababababababababababababababababababababababababab",
+		Fields:  map[string]FieldDescriptor{"child": {Type: "string"}},
+	}
+	value := map[string]any{
+		"xcsVersion": "0.1", "issuer": issuer, "subject": subject, "schema": schemaUID,
+		"claims": map[string]any{"child": "present"},
+	}
+	canonical, err := Canonicalize(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = ParseCredentialPayload(canonical, PayloadContext{
+		Issuer: issuer, Subject: subject, SchemaUID: schemaUID, Schema: schema,
+	})
+	var xcsError *Error
+	if !errors.As(err, &xcsError) || xcsError.Code != "SCHEMA_PARENT_NOT_FOUND" {
+		t.Fatalf("expected unresolved inheritance rejection, got %v", err)
+	}
+}
+
+func TestClaimValidationRejectsUnresolvedInheritedSchema(t *testing.T) {
+	schema := SchemaDefinition{
+		XCSVersion: "0.1", Name: "Child", Description: "Unresolved inherited schema",
+		Extends: "abababababababababababababababababababababababababababababababab",
+		Fields:  map[string]FieldDescriptor{"child": {Type: "string"}},
+	}
+	err := ValidateClaimsAgainstSchema(map[string]any{"child": "present"}, schema)
+	var xcsError *Error
+	if !errors.As(err, &xcsError) || xcsError.Code != "SCHEMA_PARENT_NOT_FOUND" {
+		t.Fatalf("expected unresolved inheritance rejection, got %v", err)
+	}
+}
diff --git a/verifier-go/xcs/errors.go b/verifier-go/xcs/errors.go
new file mode 100644
index 0000000..7c87ac9
--- /dev/null
+++ b/verifier-go/xcs/errors.go
@@ -0,0 +1,20 @@
+package xcs
+
+import "fmt"
+
+type Error struct {
+	Code string `json:"code"`
+	Path string `json:"path,omitempty"`
+	Msg  string `json:"message"`
+}
+
+func (e *Error) Error() string {
+	if e.Path == "" {
+		return fmt.Sprintf("%s: %s", e.Code, e.Msg)
+	}
+	return fmt.Sprintf("%s at %s: %s", e.Code, e.Path, e.Msg)
+}
+
+func invalid(code, path, format string, args ...any) error {
+	return &Error{Code: code, Path: path, Msg: fmt.Sprintf(format, args...)}
+}
diff --git a/verifier-go/xcs/payload.go b/verifier-go/xcs/payload.go
new file mode 100644
index 0000000..093c6d7
--- /dev/null
+++ b/verifier-go/xcs/payload.go
@@ -0,0 +1,163 @@
+package xcs
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+const maxPayloadBytes = 1024 * 1024
+
+var (
+	ipfsPattern        = regexp.MustCompile(`^ipfs://(b[a-z2-7]+)$`)
+	httpsDigestPattern = regexp.MustCompile(`^xcs-sha256=([0-9a-f]{64})$`)
+)
+
+const base32Alphabet = "abcdefghijklmnopqrstuvwxyz234567"
+
+func decodeBase32Lower(value string) ([]byte, bool) {
+	bits := 0
+	accumulator := 0
+	decoded := make([]byte, 0, len(value)*5/8)
+	for _, character := range value {
+		digit := strings.IndexRune(base32Alphabet, character)
+		if digit < 0 {
+			return nil, false
+		}
+		accumulator = accumulator<<5 | digit
+		bits += 5
+		if bits >= 8 {
+			bits -= 8
+			decoded = append(decoded, byte(accumulator>>bits&0xff))
+			accumulator &= 1<<bits - 1
+		}
+	}
+	return decoded, bits == 0 || accumulator == 0
+}
+
+type CredentialPayload struct {
+	XCSVersion string         `json:"xcsVersion"`
+	Issuer     string         `json:"issuer"`
+	Subject    string         `json:"subject"`
+	Schema     string         `json:"schema"`
+	Claims     map[string]any `json:"claims"`
+}
+
+type PayloadContext struct {
+	Issuer    string
+	Subject   string
+	SchemaUID string
+	Schema    SchemaDefinition
+}
+
+type PayloadURI struct {
+	Kind      string `json:"kind"`
+	URI       string `json:"uri"`
+	FetchURL  string `json:"fetchUrl,omitempty"`
+	CID       string `json:"cid,omitempty"`
+	DigestHex string `json:"digestHex"`
+}
+
+func ParseCredentialPayload(data []byte, context PayloadContext) (CredentialPayload, error) {
+	if len(data) > maxPayloadBytes {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$payload", "payload exceeds 1 MiB")
+	}
+	value, err := ParseJSON(data)
+	if err != nil {
+		return CredentialPayload{}, err
+	}
+	object, ok := value.(map[string]any)
+	if !ok {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$", "payload must be an object")
+	}
+	allowed := map[string]bool{
+		"xcsVersion": true, "issuer": true, "subject": true, "schema": true, "claims": true,
+	}
+	for key := range object {
+		if !allowed[key] {
+			return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$."+key, "unknown payload property")
+		}
+	}
+	version, versionOK := object["xcsVersion"].(string)
+	issuer, issuerOK := object["issuer"].(string)
+	subject, subjectOK := object["subject"].(string)
+	schemaUID, schemaOK := object["schema"].(string)
+	claims, claimsOK := object["claims"].(map[string]any)
+	if !versionOK || version != "0.1" {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$.xcsVersion", "must be 0.1")
+	}
+	if !issuerOK || !IsClassicAddress(issuer) || issuer != context.Issuer {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$.issuer", "does not match credential issuer")
+	}
+	if !subjectOK || !IsClassicAddress(subject) || subject != context.Subject {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$.subject", "does not match credential subject")
+	}
+	if !schemaOK || !uidPattern.MatchString(schemaUID) || schemaUID != context.SchemaUID {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$.schema", "does not match CredentialType")
+	}
+	if !claimsOK {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$.claims", "must be an object")
+	}
+	if err := ValidateClaimsAgainstSchema(claims, context.Schema); err != nil {
+		return CredentialPayload{}, err
+	}
+	canonical, err := Canonicalize(object)
+	if err != nil {
+		return CredentialPayload{}, err
+	}
+	if !bytes.Equal(canonical, data) {
+		return CredentialPayload{}, invalid("PAYLOAD_INVALID", "$payload", "payload is not RFC 8785 canonical JSON")
+	}
+	return CredentialPayload{
+		XCSVersion: version,
+		Issuer:     issuer,
+		Subject:    subject,
+		Schema:     schemaUID,
+		Claims:     claims,
+	}, nil
+}
+
+func InspectPayloadURI(rawURI string) (PayloadURI, error) {
+	if len([]byte(rawURI)) < 1 || len([]byte(rawURI)) > 256 {
+		return PayloadURI{}, invalid("PAYLOAD_URI_INVALID", "$uri", "must contain 1 to 256 UTF-8 bytes")
+	}
+	if match := ipfsPattern.FindStringSubmatch(rawURI); match != nil {
+		cid := match[1]
+		decoded, ok := decodeBase32Lower(cid[1:])
+		if !ok || len(cid) != 59 || len(decoded) != 36 || decoded[0] != 1 || decoded[1] != 0x55 || decoded[2] != 0x12 || decoded[3] != 0x20 {
+			return PayloadURI{}, invalid("PAYLOAD_URI_INVALID", "$uri", "IPFS URI is not a raw sha2-256 CIDv1")
+		}
+		return PayloadURI{
+			Kind: "ipfs", URI: rawURI, CID: cid, DigestHex: hex.EncodeToString(decoded[4:]),
+		}, nil
+	}
+	parsed, err := url.Parse(rawURI)
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil {
+		return PayloadURI{}, invalid("PAYLOAD_URI_INVALID", "$uri", "must be HTTPS without user information")
+	}
+	digestMatch := httpsDigestPattern.FindStringSubmatch(parsed.Fragment)
+	if digestMatch == nil {
+		return PayloadURI{}, invalid("PAYLOAD_URI_INVALID", "$uri", "missing lowercase xcs-sha256 fragment")
+	}
+	digest := digestMatch[1]
+	parsed.Fragment = ""
+	return PayloadURI{
+		Kind: "https", URI: rawURI, FetchURL: parsed.String(), DigestHex: digest,
+	}, nil
+}
+
+func VerifyPayloadIntegrity(data []byte, rawURI string) (bool, string, string, error) {
+	if len(data) > maxPayloadBytes {
+		return false, "", "", invalid("PAYLOAD_INVALID", "$payload", "payload exceeds 1 MiB")
+	}
+	digest := sha256.Sum256(data)
+	actual := hex.EncodeToString(digest[:])
+	parsed, err := InspectPayloadURI(rawURI)
+	if err != nil {
+		return false, "", actual, err
+	}
+	return parsed.DigestHex == actual, parsed.DigestHex, actual, nil
+}
diff --git a/verifier-go/xcs/schema.go b/verifier-go/xcs/schema.go
new file mode 100644
index 0000000..50b14dc
--- /dev/null
+++ b/verifier-go/xcs/schema.go
@@ -0,0 +1,276 @@
+package xcs
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+)
+
+const (
+	maxSchemaDepth  = 16
+	maxSchemaFields = 256
+)
+
+var (
+	fieldNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]{0,63}$`)
+	uidPattern       = regexp.MustCompile(`^[0-9a-f]{64}$`)
+)
+
+func containsControl(value string) bool {
+	for _, character := range value {
+		if character <= 0x1f || (character >= 0x7f && character <= 0x9f) {
+			return true
+		}
+	}
+	return false
+}
+
+type FieldDescriptor struct {
+	Type      string                     `json:"type"`
+	Optional  bool                       `json:"optional,omitempty"`
+	Items     *FieldDescriptor           `json:"items,omitempty"`
+	Fields    map[string]FieldDescriptor `json:"fields,omitempty"`
+	itemsSet  bool
+	fieldsSet bool
+}
+
+func (descriptor *FieldDescriptor) UnmarshalJSON(data []byte) error {
+	var properties map[string]json.RawMessage
+	if err := json.Unmarshal(data, &properties); err != nil {
+		return err
+	}
+	for key := range properties {
+		switch key {
+		case "type", "optional", "items", "fields":
+		default:
+			return invalid("SCHEMA_INVALID", "$", "unknown field descriptor property %q", key)
+		}
+	}
+	if err := json.Unmarshal(properties["type"], &descriptor.Type); err != nil {
+		return err
+	}
+	if raw, exists := properties["optional"]; exists {
+		var optional any
+		if err := json.Unmarshal(raw, &optional); err != nil {
+			return err
+		}
+		value, ok := optional.(bool)
+		if !ok {
+			return invalid("SCHEMA_INVALID", "$", "optional must be a boolean")
+		}
+		descriptor.Optional = value
+	}
+	if raw, exists := properties["items"]; exists {
+		descriptor.itemsSet = true
+		if string(raw) != "null" {
+			var items FieldDescriptor
+			if err := json.Unmarshal(raw, &items); err != nil {
+				return err
+			}
+			descriptor.Items = &items
+		}
+	}
+	if raw, exists := properties["fields"]; exists {
+		descriptor.fieldsSet = true
+		if err := json.Unmarshal(raw, &descriptor.Fields); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type SchemaDefinition struct {
+	XCSVersion  string                     `json:"xcsVersion"`
+	Name        string                     `json:"name"`
+	Description string                     `json:"description"`
+	Extends     string                     `json:"extends,omitempty"`
+	Supersedes  string                     `json:"supersedes,omitempty"`
+	Fields      map[string]FieldDescriptor `json:"fields"`
+}
+
+func decodeKnownJSON(data []byte, destination any) error {
+	if _, err := ParseJSON(data); err != nil {
+		return err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	decoder.UseNumber()
+	if err := decoder.Decode(destination); err != nil {
+		var protocolError *Error
+		if errors.As(err, &protocolError) {
+			return protocolError
+		}
+		return invalid("JSON_INVALID", "$", "%v", err)
+	}
+	if err := decoder.Decode(new(any)); err != io.EOF {
+		return invalid("JSON_INVALID", "$", "unexpected trailing content")
+	}
+	return nil
+}
+
+func ParseSchema(data []byte) (SchemaDefinition, error) {
+	parsed, err := ParseJSON(data)
+	if err != nil {
+		return SchemaDefinition{}, err
+	}
+	if object, ok := parsed.(map[string]any); ok {
+		for _, relation := range []string{"extends", "supersedes"} {
+			if value, exists := object[relation]; exists {
+				relationUID, valid := value.(string)
+				if !valid || !uidPattern.MatchString(relationUID) {
+					return SchemaDefinition{}, invalid("SCHEMA_INVALID", "$."+relation, "must be a lowercase schema UID")
+				}
+			}
+		}
+	}
+	var schema SchemaDefinition
+	if err := decodeKnownJSON(data, &schema); err != nil {
+		return SchemaDefinition{}, err
+	}
+	if err := ValidateSchema(schema); err != nil {
+		return SchemaDefinition{}, err
+	}
+	return schema, nil
+}
+
+func incrementFieldCount(count *int, path string) error {
+	(*count)++
+	if *count > maxSchemaFields {
+		return invalid("SCHEMA_FIELD_LIMIT_EXCEEDED", path, "more than %d fields", maxSchemaFields)
+	}
+	return nil
+}
+
+func validateFields(fields map[string]FieldDescriptor, path string, depth int, count *int) error {
+	if len(fields) == 0 {
+		return invalid("SCHEMA_INVALID", path, "fields must not be empty")
+	}
+	if depth > maxSchemaDepth {
+		return invalid("SCHEMA_DEPTH_EXCEEDED", path, "field nesting exceeds %d", maxSchemaDepth)
+	}
+	for name, descriptor := range fields {
+		if !fieldNamePattern.MatchString(name) {
+			return invalid("SCHEMA_INVALID", path+"."+name, "invalid field name")
+		}
+		if err := incrementFieldCount(count, path+"."+name); err != nil {
+			return err
+		}
+		fieldPath := path + "." + name
+		switch descriptor.Type {
+		case "string", "bool", "uint", "int", "bytes", "address":
+			if descriptor.Items != nil || descriptor.Fields != nil || descriptor.itemsSet || descriptor.fieldsSet {
+				return invalid("SCHEMA_INVALID", fieldPath, "scalar descriptor has composite properties")
+			}
+		case "array":
+			if descriptor.Items == nil || descriptor.Fields != nil || descriptor.fieldsSet {
+				return invalid("SCHEMA_INVALID", fieldPath, "array requires items only")
+			}
+			if err := validateDescriptor(*descriptor.Items, fieldPath+".items", depth+1, count); err != nil {
+				return err
+			}
+		case "object":
+			if descriptor.Items != nil || descriptor.itemsSet {
+				return invalid("SCHEMA_INVALID", fieldPath, "object cannot define items")
+			}
+			if err := validateFields(descriptor.Fields, fieldPath+".fields", depth+1, count); err != nil {
+				return err
+			}
+		default:
+			return invalid("SCHEMA_INVALID", fieldPath+".type", "unsupported field type %q", descriptor.Type)
+		}
+	}
+	return nil
+}
+
+func validateDescriptor(descriptor FieldDescriptor, path string, depth int, count *int) error {
+	if depth > maxSchemaDepth {
+		return invalid("SCHEMA_DEPTH_EXCEEDED", path, "field nesting exceeds %d", maxSchemaDepth)
+	}
+	if err := incrementFieldCount(count, path); err != nil {
+		return err
+	}
+	switch descriptor.Type {
+	case "string", "bool", "uint", "int", "bytes", "address":
+		if descriptor.Items != nil || descriptor.Fields != nil || descriptor.itemsSet || descriptor.fieldsSet {
+			return invalid("SCHEMA_INVALID", path, "scalar descriptor has composite properties")
+		}
+	case "array":
+		if descriptor.Items == nil || descriptor.Fields != nil || descriptor.fieldsSet {
+			return invalid("SCHEMA_INVALID", path, "array requires items only")
+		}
+		return validateDescriptor(*descriptor.Items, path+".items", depth+1, count)
+	case "object":
+		if descriptor.Items != nil || descriptor.itemsSet {
+			return invalid("SCHEMA_INVALID", path, "object cannot define items")
+		}
+		return validateFields(descriptor.Fields, path+".fields", depth+1, count)
+	default:
+		return invalid("SCHEMA_INVALID", path+".type", "unsupported field type %q", descriptor.Type)
+	}
+	return nil
+}
+
+func ValidateSchema(schema SchemaDefinition) error {
+	if schema.XCSVersion != "0.1" {
+		return invalid("SCHEMA_INVALID", "$.xcsVersion", "must be 0.1")
+	}
+	if !utf8.ValidString(schema.Name) || len([]byte(schema.Name)) < 1 || len([]byte(schema.Name)) > 64 || containsControl(schema.Name) {
+		return invalid("SCHEMA_INVALID", "$.name", "must contain 1 to 64 UTF-8 bytes")
+	}
+	if !utf8.ValidString(schema.Description) || len([]byte(schema.Description)) < 1 || len([]byte(schema.Description)) > 256 || containsControl(schema.Description) {
+		return invalid("SCHEMA_INVALID", "$.description", "must contain 1 to 256 UTF-8 bytes")
+	}
+	if schema.Extends != "" && !uidPattern.MatchString(schema.Extends) {
+		return invalid("SCHEMA_INVALID", "$.extends", "must be a lowercase schema UID")
+	}
+	if schema.Supersedes != "" && !uidPattern.MatchString(schema.Supersedes) {
+		return invalid("SCHEMA_INVALID", "$.supersedes", "must be a lowercase schema UID")
+	}
+	if schema.Extends != "" && strings.EqualFold(schema.Extends, schema.Supersedes) {
+		return invalid("SCHEMA_INVALID", "$", "extends and supersedes cannot be identical")
+	}
+	count := 0
+	return validateFields(schema.Fields, "$.fields", 1, &count)
+}
+
+func descriptorMap(descriptor FieldDescriptor) map[string]any {
+	result := map[string]any{"type": descriptor.Type}
+	if descriptor.Optional {
+		result["optional"] = true
+	}
+	if descriptor.Items != nil {
+		result["items"] = descriptorMap(*descriptor.Items)
+	}
+	if descriptor.Type == "object" {
+		result["fields"] = fieldsMap(descriptor.Fields)
+	}
+	return result
+}
+
+func fieldsMap(fields map[string]FieldDescriptor) map[string]any {
+	result := make(map[string]any, len(fields))
+	for name, descriptor := range fields {
+		result[name] = descriptorMap(descriptor)
+	}
+	return result
+}
+
+func schemaMap(schema SchemaDefinition) map[string]any {
+	result := map[string]any{
+		"xcsVersion":  schema.XCSVersion,
+		"name":        schema.Name,
+		"description": schema.Description,
+		"fields":      fieldsMap(schema.Fields),
+	}
+	if schema.Extends != "" {
+		result["extends"] = schema.Extends
+	}
+	if schema.Supersedes != "" {
+		result["supersedes"] = schema.Supersedes
+	}
+	return result
+}
diff --git a/verifier-go/xcs/uid.go b/verifier-go/xcs/uid.go
new file mode 100644
index 0000000..d35c00b
--- /dev/null
+++ b/verifier-go/xcs/uid.go
@@ -0,0 +1,94 @@
+package xcs
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+var hashPattern = regexp.MustCompile(`^[0-9a-fA-F]{64}$`)
+
+type SchemaUIDInput struct {
+	NetworkID        uint32           `json:"networkId"`
+	LedgerHash       string           `json:"ledgerHash"`
+	LedgerIndex      uint32           `json:"ledgerIndex"`
+	TransactionIndex uint32           `json:"transactionIndex"`
+	Publisher        string           `json:"publisher"`
+	Schema           SchemaDefinition `json:"schema"`
+}
+
+func ParseSchemaUIDInput(data []byte) (SchemaUIDInput, error) {
+	parsed, err := ParseJSON(data)
+	if err != nil {
+		return SchemaUIDInput{}, err
+	}
+	object, ok := parsed.(map[string]any)
+	if !ok {
+		return SchemaUIDInput{}, invalid("UID_INPUT_INVALID", "$", "must be an object")
+	}
+	for _, field := range []string{"networkId", "ledgerIndex", "transactionIndex"} {
+		value, exists := object[field]
+		number, valid := value.(json.Number)
+		if !exists || !valid {
+			return SchemaUIDInput{}, invalid("UID_INPUT_INVALID", "$."+field, "must be a present uint32")
+		}
+		if _, err := strconv.ParseUint(number.String(), 10, 32); err != nil {
+			return SchemaUIDInput{}, invalid("UID_INPUT_INVALID", "$."+field, "must be a uint32")
+		}
+	}
+
+	var raw struct {
+		NetworkID        uint32          `json:"networkId"`
+		LedgerHash       string          `json:"ledgerHash"`
+		LedgerIndex      uint32          `json:"ledgerIndex"`
+		TransactionIndex uint32          `json:"transactionIndex"`
+		Publisher        string          `json:"publisher"`
+		Schema           json.RawMessage `json:"schema"`
+	}
+	if err := decodeKnownJSON(data, &raw); err != nil {
+		return SchemaUIDInput{}, err
+	}
+	schema, err := ParseSchema(raw.Schema)
+	if err != nil {
+		return SchemaUIDInput{}, err
+	}
+	return SchemaUIDInput{
+		NetworkID:        raw.NetworkID,
+		LedgerHash:       raw.LedgerHash,
+		LedgerIndex:      raw.LedgerIndex,
+		TransactionIndex: raw.TransactionIndex,
+		Publisher:        raw.Publisher,
+		Schema:           schema,
+	}, nil
+}
+
+func ComputeSchemaUID(input SchemaUIDInput) (string, []byte, error) {
+	if !hashPattern.MatchString(input.LedgerHash) {
+		return "", nil, invalid("UID_INPUT_INVALID", "$.ledgerHash", "must be a 32-byte hex hash")
+	}
+	if !IsClassicAddress(input.Publisher) {
+		return "", nil, invalid("UID_INPUT_INVALID", "$.publisher", "must be an XRPL classic address")
+	}
+	if err := ValidateSchema(input.Schema); err != nil {
+		return "", nil, err
+	}
+	preimage := map[string]any{
+		"purpose":          "xcs.schema.uid",
+		"version":          "0.1",
+		"networkId":        input.NetworkID,
+		"ledgerHash":       strings.ToLower(input.LedgerHash),
+		"ledgerIndex":      input.LedgerIndex,
+		"transactionIndex": input.TransactionIndex,
+		"publisher":        input.Publisher,
+		"schema":           schemaMap(input.Schema),
+	}
+	canonical, err := Canonicalize(preimage)
+	if err != nil {
+		return "", nil, err
+	}
+	digest := sha256.Sum256(canonical)
+	return hex.EncodeToString(digest[:]), canonical, nil
+}