Typed passkey proofs checked inside mutation transactions, ports and normalized paths, overrides on GrantCreate, payload digests, key file checks, retention (D57), scripts in QuickJS inside Wasmtime (D58), RSA on aws-lc-rs, OAuth2 token URL checks. 85 credential tests plus durable and harness tests pass.