@seams/wallet-server 0.23.0 → 0.24.0

package/THIRD_PARTY_NOTICES.md

@@ -5,7 +5,7 @@ distributed Seams Wallet SDK, server runtime, Wasm, strict Workers, and CLI.
 Dependency license expressions come from their package metadata. Packaged
 license and notice wording is reproduced below with normalized whitespace.
 
-Inventory: 451 dependency records (42 npm, 409 Cargo).
+Inventory: 469 dependency records (60 npm, 409 Cargo).
 
 ## Dependency inventory
 
@@ -439,26 +439,44 @@ Inventory: 451 dependency records (42 npm, 409 Cargo).
 | npm | @peculiar/asn1-x509-attr | 2.6.0 | MIT | PeculiarVentures, LLC |
 | npm | @peculiar/asn1-x509 | 2.6.0 | MIT | PeculiarVentures, LLC |
 | npm | @peculiar/x509 | 1.14.3 | MIT | Miroshin Stepan<microshine@mail.ru>; Peculiar Ventures LLC |
+| npm | @protobufjs/aspromise | 1.1.2 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/base64 | 1.1.2 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/codegen | 2.0.5 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/eventemitter | 1.1.1 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/fetch | 1.1.1 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/float | 1.0.2 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/path | 1.1.2 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/pool | 1.1.0 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
+| npm | @protobufjs/utf8 | 1.1.2 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
 | npm | @scure/base | 1.2.6 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @scure/bip32 | 1.7.0 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @scure/bip39 | 1.6.0 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @simplewebauthn/server | 13.2.2 | MIT | Matthew Miller <matthew@millerti.me> |
+| npm | @types/node | 24.2.0 | MIT | Alberto Schiabel; Andrew Makarov; Anna Henningsen; Benjamin Toueg; David Junger; Dmitry Semigradsky; ExE Boss; Ilia Baryshnikov; Junxiao Shi; Linus Unnebäck; Marcin Kopacz; Matteo Collina; Microsoft TypeScript; Mohsen Azimi; Nikita Galkin; NodeJS Contributors; Piotr Błażejewicz; René; Sebastian Silbermann; Trivikram Kamat; Victor Perin; Wilco Bakker; Yagiz Nizipli; wafuwafu13 |
 | npm | abitype | 1.2.3 | MIT | awkweb.eth <t@wevm.dev>; jxom.eth <j@wevm.dev> |
 | npm | asn1js | 3.0.7 | BSD-3-Clause | Ryan Hurst rmh@unmitigatedrisk.com; Yury Strozhevsky yury@strozhevsky.com |
 | npm | base-x | 5.0.1 | MIT | Daniel Cousens |
 | npm | borsh | 1.0.0 | Apache-2.0 | Near Inc |
 | npm | bs58 | 6.0.0 | MIT |  |
 | npm | eventemitter3 | 5.0.1 | MIT | Arnout Kazemier |
+| npm | flatbuffers | 25.9.23 | Apache-2.0 | The FlatBuffers project |
+| npm | guid-typescript | 1.0.9 | ISC | nicolas |
 | npm | idb | 8.0.3 | ISC | Jake Archibald |
 | npm | isows | 1.0.7 | MIT |  |
+| npm | long | 5.3.2 | Apache-2.0 | Daniel Wirtz <dcode@dcode.io> |
+| npm | onnxruntime-common | 1.30.0 | MIT | fs-eire |
+| npm | onnxruntime-web | 1.30.0 | MIT | fs-eire |
 | npm | ox | 0.12.1 | MIT |  |
+| npm | platform | 1.3.6 | MIT | Benjamin Tan <demoneaux@gmail.com>; John-David Dalton <john.david.dalton@gmail.com>; Mathias Bynens <mathias@qiwi.be> |
 | npm | preact | 10.29.8 | MIT |  |
+| npm | protobufjs | 7.6.6 | BSD-3-Clause | Daniel Wirtz <dcode+protobufjs@dcode.io> |
 | npm | pvtsutils | 1.3.6 | MIT | Miroshin Stepan<microshine@mail.ru>; PeculiarVentures |
 | npm | pvutils | 1.1.5 | MIT | Miroshin Stepan microshine@mail.ru; Ryan Hurst rmh@unmitigatedrisk.com; Yury Strozhevsky yury@strozhevsky.com |
 | npm | reflect-metadata | 0.2.2 | Apache-2.0 | Ron Buckton ron.buckton@microsoft.com |
 | npm | tslib | 1.14.1 | 0BSD | Microsoft Corp. |
 | npm | tslib | 2.8.1 | 0BSD | Microsoft Corp. |
 | npm | tsyringe | 4.10.0 | MIT | Steven Hobson-Campbell |
+| npm | undici-types | 7.10.0 | MIT | Daniele Belardi; Ethan Arrowood; Matteo Collina; Matthew Aitken; Robert Nagy; Szymon Marczak; Tomas Della Vedova |
 | npm | viem | 2.46.0 | MIT |  |
 | npm | voice-glow | 0.2.1 | MIT | Jakub Antalik |
 | npm | ws | 8.18.3 | MIT | Einar Otto Stangvik <einaros@gmail.com> (http://2x.io) |
@@ -480,6 +498,9 @@ but do not include a top-level license or notice file in the distributed package
 - cargo:rustls-platform-verifier-android@0.1.1 — MIT OR Apache-2.0
 - cargo:ts-rs-macros@12.0.1 — MIT
 - cargo:ts-rs@12.0.1 — MIT
+- npm:guid-typescript@1.0.9 — ISC
+- npm:onnxruntime-common@1.30.0 — MIT
+- npm:onnxruntime-web@1.30.0 — MIT
 
 ## Packaged license and notice texts
 
@@ -1864,6 +1885,50 @@ Applies to:
     THE SOFTWARE.
 
 
+### 1033ec013241782e
+
+Packaged as: LICENSE
+
+Applies to:
+
+- npm:@protobufjs/aspromise@1.1.2
+- npm:@protobufjs/base64@1.1.2
+- npm:@protobufjs/codegen@2.0.5
+- npm:@protobufjs/eventemitter@1.1.1
+- npm:@protobufjs/fetch@1.1.1
+- npm:@protobufjs/float@1.0.2
+- npm:@protobufjs/path@1.1.2
+- npm:@protobufjs/pool@1.1.0
+- npm:@protobufjs/utf8@1.1.2
+
+    Copyright (c) 2016, Daniel Wirtz  All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are
+    met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of its author, nor the names of its contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+    "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+    A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+    OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+    LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
 ### 123a331b5dbf04c3
 
 Packaged as: LICENSE-MIT
@@ -5056,6 +5121,86 @@ Applies to:
     DEALINGS IN THE SOFTWARE.
 
 
+### 49d6a1c9a623784c
+
+Packaged as: LICENSE
+
+Applies to:
+
+- npm:protobufjs@7.6.6
+
+    This license applies to all parts of protobuf.js except those files
+    either explicitly including or referencing a different license or
+    located in a directory containing a different LICENSE file.
+
+    ---
+
+    Copyright (c) 2016, Daniel Wirtz  All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are
+    met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of its author, nor the names of its contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+    "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+    A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+    OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+    LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+    ---
+
+    Code generated by the command line utilities is owned by the owner
+    of the input file used when generating it. This code is not
+    standalone and requires a support library to be linked with it. This
+    support library is itself covered by the above license.
+
+
+### 4a161ebed4f1ef93
+
+Packaged as: LICENSE
+
+Applies to:
+
+- npm:platform@1.3.6
+
+    Copyright 2014-2020 Benjamin Tan
+    Copyright 2011-2013 John-David Dalton
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    "Software"), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
 ### 4a883ecc3bb1010f
 
 Packaged as: LICENSE-MIT
@@ -10100,6 +10245,37 @@ Applies to:
        END OF TERMS AND CONDITIONS
 
 
+### a6db8096b2707bc0
+
+Packaged as: LICENSE
+
+Applies to:
+
+- npm:undici-types@7.10.0
+
+    MIT License
+
+    Copyright (c) Matteo Collina and Undici contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+
+
 ### a825bd853ab71619
 
 Packaged as: LICENSE-MIT
@@ -11918,7 +12094,7 @@ Applies to:
 
 ### c2cfccb812fe4821
 
-Packaged as: license-mit
+Packaged as: LICENSE, license-mit
 
 Applies to:
 
@@ -11934,6 +12110,7 @@ Applies to:
 - cargo:windows_x86_64_gnu@0.52.6
 - cargo:windows_x86_64_gnullvm@0.52.6
 - cargo:windows_x86_64_msvc@0.52.6
+- npm:@types/node@24.2.0
 
         MIT License
 
@@ -12447,7 +12624,7 @@ Applies to:
 
 ### cfc7749b96f63bd3
 
-Packaged as: LICENSE-APACHE, LICENSE-APACHE.md, LICENSE-APACHE.txt
+Packaged as: LICENSE, LICENSE-APACHE, LICENSE-APACHE.md, LICENSE-APACHE.txt
 
 Applies to:
 
@@ -12464,6 +12641,8 @@ Applies to:
 - cargo:zeroize@1.9.0
 - cargo:zeroize_derive@1.4.3
 - cargo:zeroize_derive@1.5.0
+- npm:flatbuffers@25.9.23
+- npm:long@5.3.2
 
 
                                      Apache License
@@ -13589,5 +13768,3 @@ Applies to:
     OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
     IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
     DEALINGS IN THE SOFTWARE.
-
-

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.23.0"
+    "version": "0.24.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "16d69ea116b33d19df58a2ea30d0fe59277bfe07b856986b576e45f983f81515",
+      "fingerprint": "6ddb5e651770db6620ea6c32e819ec2d342ea633f5eec2a4e7edcf055322c60f",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "bdd9dc10a334a0733d8e973a127a49f06a5513f28959874239354ef3727411ed"
+          "sha256": "4263de73def4a3454ccd32cae1edf398be77c0ab96676236bd15b5affb745512"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "4e9035611a026dacf58afd85fc245fdcd1803c4dc66d1dceb568430857992279",
+      "fingerprint": "da7b4be7de2cb4744e9bf926d7cc3d5e9cb0a4da71a574ed03e2cc5a63324abd",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "855ad07fa9c2d03db626e064bc9393fa684f5deda016eda7a1dc1bff2cec4c95"
+          "sha256": "a2098d1915517951bc2bb8739503587b8f62a5282a9b72e9c68fa1c389732e70"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "703f4d5d38c2f7fee97a8718e4cc210fd7717fed03fa0689e2845679798104c8",
+      "fingerprint": "b8c7b108d8246adb0280e0fd465c047d86a5f6328e840963a1dc461918ab5f33",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "6b18f22e35eb238db007c34f0583e0931f7f10760f2aa39254ce1c5cfa5673c9"
+          "sha256": "258f61a014c49c0cfce17b15e188b3ba9d22643da0c1ae1d28092fbea3cce9e1"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "6e63cf05a9d08e8931d281d854eabecd7af6b92bf14cd00db241b3e5b5190222",
+      "fingerprint": "565d10337fbe6468a3ea52d1974283fd469850946930dfc5c4d22279f5b86efd",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "891e92be77c5591a57d9f33dab4cfe0d044f8370e5a14c2c4ba5af8169d81b8d"
+          "sha256": "04a4a9ba73c933fbb3ea406e5445005154afc7c8754f3a1f8c92b0acdacdad73"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "980fbb6afc822438491809374d9aad90120602b9a432137d30e763aee9361f1d",
+      "fingerprint": "8efa3977d3148161d1c5e65f71e10339df1b46ec784215e626bf880296427d6a",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "d233922e8336065c6184d083c1f68dba56e4a6296ab3e3f45553f202b089da1b"
+          "sha256": "5c5188771e96f492b1141971e898979ad545304b429b66e99cddf0f26e65f25a"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -165,8 +165,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0082_wallet_signature_completions.sql",
-      "fingerprint": "a886c91affebf67bf90a993165d65f9d70a8c5b0a0d876c6ab6e914f68f1fcb4",
+      "head": "0084_voiceid_wallet_auth_methods.sql",
+      "fingerprint": "724414d2bc4d41dd761541a0dc465145957275303a1c49610f1fbdc1e60c0316",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -577,6 +577,16 @@
           "path": "migrations/d1-signer/0082_wallet_signature_completions.sql",
           "bytes": 1781,
           "sha256": "0b9372c31b650eee2b2dcb23396de327654cdc1b14fc51b460010ae656e39fc0"
+        },
+        {
+          "path": "migrations/d1-signer/0083_voiceid_wallet_session_challenges.sql",
+          "bytes": 1515,
+          "sha256": "ab2094d360b086944d8cb79bae3086993bdc2784e8e4ba4151d34dd5932cc3ec"
+        },
+        {
+          "path": "migrations/d1-signer/0084_voiceid_wallet_auth_methods.sql",
+          "bytes": 17185,
+          "sha256": "01af96f95131fb6ce8e42301bfdc2bd99ead260c817833b6b03a501f836d34a9"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793011431381}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793078068083}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793011576933}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793078249784}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793011707465}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793078412480}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793011221295}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793077790894}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793011841902}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793078605175}

package/dist/esm/authorization/voiceIdDeviceProof.js

@@ -0,0 +1,32 @@
+import { base64UrlDecode } from "../shared-ts/src/utils/base64.js";
+import { sha256DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseVoiceIdDeviceAssertion, voiceIdWalletSessionChallengeBytes } from "../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
+//#region src/authorization/voiceIdDeviceProof.ts
+var VerifiedVoiceIdWalletSessionProof = class {
+	proofBrand = true;
+	constructor(challenge, deviceKeyId) {
+		this.challenge = challenge;
+		this.deviceKeyId = deviceKeyId;
+		this.proofBrand;
+	}
+};
+function sameChallenge(left, right) {
+	return left.kind === right.kind && left.walletId === right.walletId && left.walletAuthMethodId === right.walletAuthMethodId && left.walletAuthorityId === right.walletAuthorityId && left.deviceKeyId === right.deviceKeyId && left.challengeId === right.challengeId && left.nonce === right.nonce && left.requestOrigin === right.requestOrigin && left.audience === right.audience && left.issuedAtMs === right.issuedAtMs && left.expiresAtMs === right.expiresAtMs;
+}
+/** Only this server boundary turns a signed device result into verified proof. */
+async function verifyVoiceIdWalletSessionAssertion(input) {
+	const challenge = input.expectedChallenge;
+	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < challenge.issuedAtMs - 5e3 || input.nowMs >= challenge.expiresAtMs || challenge.walletId !== input.registered.walletId || challenge.walletAuthMethodId !== input.registered.walletAuthMethodId || challenge.walletAuthorityId !== input.registered.walletAuthorityId || challenge.deviceKeyId !== input.registered.deviceKeyId) throw new Error("VoiceID Wallet Session challenge is unavailable");
+	const assertion = parseVoiceIdDeviceAssertion(input.assertion);
+	if (!sameChallenge(assertion.challenge, challenge)) throw new Error("VoiceID assertion names a different challenge");
+	const publicKeyBytes = base64UrlDecode(input.registered.publicKeyB64u);
+	if (await sha256DigestB64u(publicKeyBytes) !== input.registered.deviceKeyId) throw new Error("VoiceID device key identity is invalid");
+	const publicKey = await crypto.subtle.importKey("raw", publicKeyBytes, "Ed25519", false, ["verify"]);
+	if (!await crypto.subtle.verify("Ed25519", publicKey, base64UrlDecode(assertion.signatureB64u), voiceIdWalletSessionChallengeBytes(challenge))) throw new Error("VoiceID device signature is invalid");
+	if (!await input.consumeChallenge(challenge, input.nowMs)) throw new Error("VoiceID challenge was already consumed");
+	return new VerifiedVoiceIdWalletSessionProof(challenge, input.registered.deviceKeyId);
+}
+//#endregion
+export { verifyVoiceIdWalletSessionAssertion };
+
+//# sourceMappingURL=voiceIdDeviceProof.js.map

package/dist/esm/core/ThresholdService/validation.js

@@ -1,9 +1,11 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/ThresholdService/validation.ts
 function decodeFixedB64u(value, expectedLength) {
 	try {
@@ -41,6 +43,15 @@ function parseThresholdEd25519AuthorityScope(raw) {
 	if (!isPlainObject(raw)) return null;
 	const kind = normalizeOptionalString(raw.kind);
 	switch (kind) {
+		case "voiceid": try {
+			rejectUnknownFields(raw, ["kind", "deviceKeyId"], "device authority scope");
+			return {
+				kind: "voiceid",
+				deviceKeyId: parseDigestB64u(raw.deviceKeyId)
+			};
+		} catch {
+			return null;
+		}
 		case "passkey_rp": {
 			const rpId = parseWebAuthnRpId(raw.rpId);
 			if (!rpId.ok || normalizeOptionalString(raw.proofKind) || normalizeOptionalString(raw.email) || normalizeOptionalString(raw.provider) || normalizeOptionalString(raw.providerUserId) || normalizeOptionalString(raw.challengeId) || normalizeOptionalString(raw.googleEmailOtpRegistrationAttemptId) || normalizeOptionalString(raw.googleEmailOtpRegistrationOfferId) || normalizeOptionalString(raw.googleEmailOtpRegistrationCandidateId)) return null;
@@ -73,11 +84,16 @@ function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority) {
 		provider: authority.factor.provider,
 		providerUserId: authority.factor.providerUserId
 	};
+	if (isVoiceIdWalletAuthAuthority(authority)) return {
+		kind: "voiceid",
+		deviceKeyId: authority.factor.deviceKeyId
+	};
 	throw new Error("[threshold-ed25519] unsupported wallet auth authority");
 }
 function thresholdEd25519AuthorityScopesMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
+		case "voiceid": return right.kind === "voiceid" && left.deviceKeyId === right.deviceKeyId;
 		case "passkey_rp": return right.kind === "passkey_rp" && left.rpId === right.rpId;
 		case "email_otp": return right.kind === "email_otp" && left.provider === right.provider && left.providerUserId === right.providerUserId;
 	}

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -143,6 +143,8 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
       updated_at_ms INTEGER NOT NULL,
       activated_at_ms INTEGER,
       revoked_at_ms INTEGER,
+      provider TEXT,
+      provider_user_id TEXT,
       PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),
       FOREIGN KEY (
         namespace,
@@ -159,7 +161,7 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
       ),
       CHECK (length(wallet_id) > 0),
       CHECK (length(wallet_authority_id) > 0),
-      CHECK (kind IN ('passkey', 'email_otp')),
+      CHECK (kind IN ('passkey', 'email_otp', 'voiceid')),
       CHECK (status IN ('pending_local_install', 'active', 'revoked')),
       CHECK (length(wallet_auth_method_id) > 0),
       CHECK (length(auth_identifier_key) > 0),
@@ -193,6 +195,18 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
           AND registration_authority_id IS NOT NULL
           AND length(registration_authority_id) > 0
           AND auth_identifier_key = email_hash_hex)
+        OR
+        (kind = 'voiceid'
+          AND rp_id = ''
+          AND credential_id_b64u IS NULL
+          AND credential_public_key_b64u IS NOT NULL
+          AND length(credential_public_key_b64u) = 43
+          AND email_hash_hex IS NULL
+          AND registration_authority_id IS NULL
+          AND provider IS NULL
+          AND provider_user_id IS NULL
+          AND length(auth_identifier_key) = 43
+          AND COALESCE(auth_identifier_key = json_extract(record_json, '$.deviceKeyId'), 0))
       ),
       CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),
       CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),
@@ -212,6 +226,10 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
         (kind = 'email_otp'
           AND json_extract(record_json, '$.emailHashHex') = email_hash_hex
           AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)
+        OR
+        (kind = 'voiceid'
+          AND COALESCE(json_extract(record_json, '$.deviceKeyId') = auth_identifier_key, 0)
+          AND COALESCE(json_extract(record_json, '$.devicePublicKeyB64u') = credential_public_key_b64u, 0))
       )
     )
   `,
@@ -226,6 +244,13 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
         wallet_authority_id,
         status
       )
+  `,
+	`
+    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_voiceid_key_uidx
+      ON wallet_auth_methods (
+        namespace, org_id, project_id, env_id, auth_identifier_key
+      )
+      WHERE kind = 'voiceid'
   `,
 	`
     CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx
@@ -322,6 +347,16 @@ function bindWalletAuthMethodIdentityV2(record) {
 			activatedAtMs: record.status === "pending_local_install" ? null : record.activatedAtMs,
 			revokedAtMs: record.status === "revoked" ? record.revokedAtMs : null
 		};
+		case "voiceid": return {
+			rpId: "",
+			authIdentifierKey: record.deviceKeyId,
+			credentialIdB64u: null,
+			credentialPublicKeyB64u: record.devicePublicKeyB64u,
+			emailHashHex: null,
+			registrationAuthorityId: null,
+			activatedAtMs: record.status === "pending_local_install" ? null : record.activatedAtMs,
+			revokedAtMs: record.status === "revoked" ? record.revokedAtMs : null
+		};
 	}
 }
 function walletAuthMethodV2IdentityColumns(record) {
@@ -646,6 +681,12 @@ var D1WalletAuthMethodStore = class {
 		await this.v2Schema.ensure();
 		return normalizeWalletAuthMethodV2(await readD1WalletAuthMethodJsonById(this.table.database, this.table.scope, String(input.walletAuthMethodId)));
 	}
+	/** Checks the method record. Session issuance must also check its parent authority. */
+	async getActiveVoiceIdV2(input) {
+		const record = await this.readByIdV2({ walletAuthMethodId: input.walletAuthMethodId });
+		if (!record || record.kind !== "voiceid" || record.status !== "active" || record.walletId !== input.walletId || record.walletAuthorityId !== input.walletAuthorityId) return null;
+		return record;
+	}
 	async getPasskeyV2(input) {
 		await this.v2Schema.ensure();
 		const rpId = normalizeOptionalTrimmedString(input.rpId);

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -185,6 +185,11 @@ async function credentialMetadataV1(credentials, walletId, authMethod) {
 		kind: "email_otp",
 		walletAuthMethodId: authMethod.walletAuthMethodId
 	};
+	if (authMethod.kind === "voiceid") return {
+		kind: "voiceid",
+		walletAuthMethodId: authMethod.walletAuthMethodId,
+		deviceKeyId: authMethod.deviceKeyId
+	};
 	const device = await credentials.readPasskeyDeviceInfoV1({
 		walletId,
 		credentialIdB64u: authMethod.credentialIdB64u

package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js

@@ -6,12 +6,12 @@ import { parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1Co
 import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildVoiceIdWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbServerIdentityV1 } from "../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseNearEd25519SigningKeyId } from "../../shared-ts/src/utils/registrationIds.js";
 import { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, parseWalletSignerId } from "../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import "../../shared-ts/src/signing-lanes/index.js";
-import { buildActiveSigningLaneLifecycle, buildActiveWalletKeyLifecycle, buildEd25519WalletKeyRecord, buildEvmFamilyWalletKeyRecord, buildOwnerEmailOtpSigningLaneRecord, buildOwnerPasskeySigningLaneRecord, parseWalletKeyVersion } from "../../shared-ts/src/signing-lanes/recordParsers.js";
+import { buildActiveSigningLaneLifecycle, buildActiveWalletKeyLifecycle, buildEd25519WalletKeyRecord, buildEvmFamilyWalletKeyRecord, buildOwnerEmailOtpSigningLaneRecord, buildOwnerPasskeySigningLaneRecord, buildOwnerVoiceIdSigningLaneRecord, parseWalletKeyVersion } from "../../shared-ts/src/signing-lanes/recordParsers.js";
 //#region src/core/signingLanes/WalletExecutionLaneProjection.ts
 const SOURCE_IDENTITY_DOMAIN = "seams/wallet-execution-lane/source-identity/v1";
 const ED25519_RECEIPT_DOMAIN = "seams/wallet-execution-lane/ed25519-receipt/v1";
@@ -191,6 +191,7 @@ async function buildOwnerLane(input) {
 	switch (input.authMethod.kind) {
 		case "passkey": return buildOwnerPasskeySigningLaneRecord(base);
 		case "email_otp": return buildOwnerEmailOtpSigningLaneRecord(base);
+		case "voiceid": return buildOwnerVoiceIdSigningLaneRecord(base);
 	}
 }
 async function ownerContinuity(input) {
@@ -270,6 +271,14 @@ function walletAuthorityForAuthMethod(authMethod, authSource) {
 			bindingId: authMethod.walletAuthMethodId
 		};
 	}
+	if (authMethod.kind === "voiceid") {
+		if (authSource.kind !== "voiceid" || authSource.deviceKeyId !== authMethod.deviceKeyId) return null;
+		return buildVoiceIdWalletAuthAuthority({
+			walletId: authMethod.walletId,
+			walletAuthMethodId: authMethod.walletAuthMethodId,
+			deviceKeyId: authMethod.deviceKeyId
+		});
+	}
 	if (authSource.kind !== "oidc_provider") return null;
 	const providerUserId = parseEmailOtpProviderUserId(authSource.providerSubject);
 	if (!providerUserId.ok) return null;