@seams/wallet-server 0.23.0 → 0.24.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -9,7 +9,7 @@ import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/ind
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
 import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
-import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
 import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
@@ -31,6 +31,11 @@ import { dispatchWalletRegistrationSetup } from "../../../framework/registration
 import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
 import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
+import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
+import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
+import { D1VoiceIdActivation } from "../wallet/d1VoiceIdActivation.js";
+import { D1VoiceIdSessions } from "../wallet/d1VoiceIdSessions.js";
+import { D1VoiceIdWalletSessionChallenges } from "../wallet/d1VoiceIdWalletSessionChallenges.js";
 import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
 import { ensureSignerWasmRuntime } from "../../../../core/authService/wasm.js";
 import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
@@ -49,8 +54,6 @@ import { CloudflareD1EmailOtpRecoveryService } from "../emailOtp/d1EmailOtpRecov
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
-import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
-import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
@@ -1054,7 +1057,14 @@ function createD1WalletRegistrationRouteService(assembly) {
 	};
 }
 function createD1WalletAuthMethodRouteService(assembly) {
+	const voiceIdActivation = new D1VoiceIdActivation(assembly.options.database, {
+		namespace: assembly.options.namespace,
+		orgId: assembly.options.orgId,
+		projectId: assembly.options.projectId,
+		envId: assembly.options.envId
+	}, assembly.walletAuthMethodStore, assembly.passkeyCustodyEnvelopes);
 	return {
+		activateVoiceId: voiceIdActivation.activate.bind(voiceIdActivation),
 		resolveActiveWalletSessionAuthority: assembly.walletAuthMethods.resolveActiveWalletSessionAuthority.bind(assembly.walletAuthMethods),
 		revokeWalletAuthMethodWithFreshProof: assembly.walletAuthMethods.revokeWalletAuthMethodWithFreshProof.bind(assembly.walletAuthMethods),
 		verifyActivePasskeyAuthority: assembly.walletAuthMethods.verifyActivePasskeyAuthority.bind(assembly.walletAuthMethods),
@@ -1075,8 +1085,6 @@ function createD1WalletAuthMethodRouteService(assembly) {
 		startWalletAddSigner: assembly.walletAddSigners.startWalletAddSigner.bind(assembly.walletAddSigners)
 	};
 }
-const LINKED_DEVICE_WALLET_SESSION_TTL_MS = 900 * 1e3;
-const LINKED_DEVICE_WALLET_SESSION_REMAINING_USES = 100;
 async function resolveEmailOtpAuthorityForUnlock(input) {
 	try {
 		const enrollment = await input.emailOtpRecoveryService.readEmailOtpEnrollment({
@@ -1127,7 +1135,7 @@ async function issueWalletSessionForActiveAuthority(input) {
 			authority: input.resolved.authority,
 			walletAuthMethodId: input.resolved.authMethod.walletAuthMethodId,
 			mintId: mintId.value,
-			remainingUses: deviceLinked ? LINKED_DEVICE_WALLET_SESSION_REMAINING_USES : 3,
+			remainingUses: deviceLinked ? 100 : 3,
 			issuedAtMs,
 			expiresAtMs: issuedAtMs + (deviceLinked ? LINKED_DEVICE_WALLET_SESSION_TTL_MS : DEFAULT_WALLET_SESSION_TTL_MS)
 		});
@@ -1195,7 +1203,16 @@ async function issueWalletSessionForEmailOtpUnlock(input) {
 	});
 }
 function createD1WalletUnlockRouteService(assembly) {
+	const scope = {
+		namespace: assembly.options.namespace,
+		orgId: assembly.options.orgId,
+		projectId: assembly.options.projectId,
+		envId: assembly.options.envId
+	};
+	const voiceIdSessions = new D1VoiceIdSessions(assembly.walletAuthMethodStore, assembly.walletAuthorityStore, assembly.passkeyCustodyEnvelopes, new D1VoiceIdWalletSessionChallenges(assembly.options.database, scope), assembly.authorizationService, assembly.options.orgId);
 	return {
+		issueVoiceIdChallenge: voiceIdSessions.issueChallenge.bind(voiceIdSessions),
+		verifyAndIssueVoiceId: voiceIdSessions.verifyAndIssue.bind(voiceIdSessions),
 		createEmailOtpUnlockChallenge: assembly.emailOtpRecoveryService.createEmailOtpUnlockChallenge.bind(assembly.emailOtpRecoveryService),
 		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
 		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -217,7 +217,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			};
 			const authority = await this.options.authorityStore.readById(stored.authorityId);
 			const authMethod = await this.options.authMethodStore.readByIdV2({ walletAuthMethodId: stored.authMethodId });
-			if (!authority || !authMethod) return {
+			if (!authority || !authMethod || authMethod.kind === "voiceid") return {
 				kind: "integrity_error",
 				message: "pending authority records are missing"
 			};
@@ -1295,7 +1295,7 @@ function buildPendingAuthMethod(input, authorityId, nowMs) {
 			createdAtMs: draft.createdAtMs,
 			updatedAtMs: nowMs
 		});
-		if (record.status !== "pending_local_install") throw new Error("auth method builder returned a non-pending record");
+		if (record.status !== "pending_local_install" || record.kind !== "passkey") throw new Error("auth method builder returned a non-pending record");
 		return record;
 	}
 	const record = buildWalletAuthMethodRecordV2({
@@ -1310,7 +1310,7 @@ function buildPendingAuthMethod(input, authorityId, nowMs) {
 		createdAtMs: draft.createdAtMs,
 		updatedAtMs: nowMs
 	});
-	if (record.status !== "pending_local_install") throw new Error("auth method builder returned a non-pending record");
+	if (record.status !== "pending_local_install" || record.kind !== "email_otp") throw new Error("auth method builder returned a non-pending record");
 	return record;
 }
 function buildActivationSet(manifest, reservations) {
@@ -1399,7 +1399,7 @@ function buildActiveAuthMethod(pending, activatedAtMs) {
 			updatedAtMs: activatedAtMs,
 			activatedAtMs
 		});
-		if (record.status !== "active") throw new Error("auth method builder returned a non-active record");
+		if (record.status !== "active" || record.kind !== "passkey") throw new Error("auth method builder returned a non-active record");
 		return record;
 	}
 	const record = buildWalletAuthMethodRecordV2({
@@ -1415,7 +1415,7 @@ function buildActiveAuthMethod(pending, activatedAtMs) {
 		updatedAtMs: activatedAtMs,
 		activatedAtMs
 	});
-	if (record.status !== "active") throw new Error("auth method builder returned a non-active record");
+	if (record.status !== "active" || record.kind !== "email_otp") throw new Error("auth method builder returned a non-active record");
 	return record;
 }
 async function buildPasskeyCredentialPromotionStatements(input) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,10 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
 import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";
 import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	prepare;

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js

@@ -43,6 +43,10 @@ function envelopeFactorRef(envelope) {
 			enrollmentId: envelope.factor.enrollmentId,
 			enrollmentSealKeyVersion: envelope.factor.enrollmentSealKeyVersion
 		};
+		case "voiceid": return {
+			kind: "voiceid",
+			deviceKeyId: envelope.factor.deviceKeyId
+		};
 	}
 }
 /**
@@ -62,6 +66,7 @@ function factorKeyPart(factor) {
 			factor.enrollmentId,
 			factor.enrollmentSealKeyVersion
 		];
+		case "voiceid": return ["voiceid", String(factor.deviceKeyId)];
 	}
 }
 function factorRefsMatch(left, right) {
@@ -73,6 +78,7 @@ function factorRefsMatch(left, right) {
 		case "email_otp":
 			if (right.kind !== "email_otp") return false;
 			return left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
+		case "voiceid": return right.kind === "voiceid" && left.deviceKeyId === right.deviceKeyId;
 	}
 	return false;
 }

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdActivation.js

@@ -0,0 +1,139 @@
+import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { isFullOwnerAuthorityV1 } from "./d1WalletAuthMethodService.js";
+//#region src/router/cloudflare/d1/wallet/d1VoiceIdActivation.ts
+function ownerSessionIsCurrent(source, nowMs) {
+	const session = source.authorization.session;
+	const quota = source.authorization.quota;
+	return source.authority.state === "active" && source.authMethod.status === "active" && source.authority.walletId === session.walletId && source.authority.authorityId === session.authorityId && source.authority.authorityDigestB64u === session.authorityDigestB64u && source.authority.revocationEpoch === session.authorityRevocationEpoch && source.authMethod.walletId === session.walletId && source.authMethod.walletAuthorityId === session.authorityId && source.authMethod.walletAuthMethodId === session.walletAuthMethodId && quota.walletSessionId === session.walletSessionId && quota.quotaId === session.quotaId && quota.tenantId === session.tenantId && quota.principalId === session.principalId && quota.remainingUses > 0 && session.createdAtMs <= nowMs && session.expiresAtMs > nowMs && quota.expiresAtMs > nowMs && isFullOwnerAuthorityV1(source.authority);
+}
+/** Aborts the D1 batch if the source Wallet Session lost its live quota or expired. */
+function prepareOwnerSessionGuard(input) {
+	const session = input.source.authorization.session;
+	return input.database.prepare(`
+    INSERT INTO wallet_authority_cas_guard (guard_id)
+    SELECT 1 WHERE NOT EXISTS (
+      SELECT 1 FROM wallet_session_authorizations_v2 AS source_session
+      JOIN authorization_wallet_session_quotas AS quota
+        ON quota.namespace = source_session.namespace
+       AND quota.tenant_id = source_session.tenant_id
+       AND quota.quota_id = source_session.quota_id
+       AND quota.wallet_session_id = source_session.wallet_session_id
+      WHERE source_session.namespace = ? AND source_session.org_id = ?
+        AND source_session.project_id = ? AND source_session.env_id = ?
+        AND source_session.tenant_id = ? AND source_session.authorization_id = ?
+        AND source_session.wallet_id = ? AND source_session.authority_id = ?
+        AND source_session.wallet_auth_method_id = ?
+        AND source_session.authority_digest_b64u = ?
+        AND source_session.authority_revocation_epoch = ?
+        AND source_session.wallet_session_id = ? AND source_session.quota_id = ?
+        AND source_session.retired_at_ms IS NULL
+        AND source_session.issued_at_ms <= ? AND source_session.expires_at_ms > ?
+        AND quota.lifecycle_kind = 'active' AND quota.remaining_uses > 0
+        AND quota.expires_at_ms > ?
+    )
+  `).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(session.tenantId), String(session.authorizationId), String(session.walletId), String(session.authorityId), String(session.walletAuthMethodId), String(session.authorityDigestB64u), session.authorityRevocationEpoch, String(session.walletSessionId), String(session.quotaId), input.nowMs, input.nowMs, input.nowMs);
+}
+function buildActiveVoiceIdMethod(input) {
+	return {
+		version: "wallet_auth_method_v2",
+		walletAuthMethodId: input.walletAuthMethodId,
+		walletId: input.walletId,
+		walletAuthorityId: input.walletAuthorityId,
+		kind: "voiceid",
+		status: "active",
+		deviceKeyId: input.deviceKeyId,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		createdAtMs: input.nowMs,
+		updatedAtMs: input.nowMs,
+		activatedAtMs: input.nowMs
+	};
+}
+async function readCommittedActivation(input) {
+	const storedMethod = await input.authMethods.readByIdV2({ walletAuthMethodId: input.command.targetWalletAuthMethodId });
+	const session = input.command.source.authorization.session;
+	if (!storedMethod || storedMethod.kind !== "voiceid" || storedMethod.status !== "active" || storedMethod.walletId !== session.walletId || storedMethod.walletAuthorityId !== session.authorityId || storedMethod.deviceKeyId !== input.deviceKeyId || storedMethod.devicePublicKeyB64u !== input.command.devicePublicKeyB64u) return null;
+	const storedEnvelope = await input.envelopes.lookupEnvelopeForWalletAuthMethod({
+		walletId: session.walletId,
+		walletAuthMethodId: input.command.targetWalletAuthMethodId,
+		factor: {
+			kind: "voiceid",
+			deviceKeyId: input.deviceKeyId
+		}
+	});
+	if (storedEnvelope.kind !== "active" || alphabetizeStringify(storedEnvelope.envelope) !== alphabetizeStringify(input.expectedEnvelope)) return null;
+	return storedMethod;
+}
+var D1VoiceIdActivation = class {
+	constructor(database, scope, authMethods, envelopes) {
+		this.database = database;
+		this.scope = scope;
+		this.authMethods = authMethods;
+		this.envelopes = envelopes;
+	}
+	async activate(input) {
+		if (!Number.isSafeInteger(input.nowMs) || !ownerSessionIsCurrent(input.source, input.nowMs)) return {
+			kind: "rejected",
+			code: "invalid_source"
+		};
+		const session = input.source.authorization.session;
+		const deviceKeyId = await sha256DigestB64u(base64UrlDecode(input.devicePublicKeyB64u));
+		const ciphertextDigest = await sha256DigestB64u(base64UrlDecode(input.envelope.sealedCustodySecretB64u));
+		if (!String(input.targetWalletAuthMethodId).startsWith("wallet-auth-method:") || input.targetWalletAuthMethodId === input.source.authMethod.walletAuthMethodId || input.envelope.walletId !== session.walletId || input.envelope.ownership.walletAuthMethodId !== input.targetWalletAuthMethodId || input.envelope.factor.deviceKeyId !== deviceKeyId || input.envelope.createdAtMs > input.nowMs || input.envelope.lifecycle.activatedAtMs > input.nowMs || ciphertextDigest !== input.envelope.ciphertextDigestB64u) return {
+			kind: "rejected",
+			code: "invalid_target"
+		};
+		const authMethod = buildActiveVoiceIdMethod({
+			walletAuthMethodId: input.targetWalletAuthMethodId,
+			walletId: session.walletId,
+			walletAuthorityId: session.authorityId,
+			deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			nowMs: input.nowMs
+		});
+		if ((await this.envelopes.linkWalletCustodyFactorAtomically({
+			envelope: input.envelope,
+			additionalStatements: [
+				prepareOwnerSessionGuard({
+					database: this.database,
+					scope: this.scope,
+					source: input.source,
+					nowMs: input.nowMs
+				}),
+				...this.authMethods.prepareActiveV2SourceGuardStatements({
+					walletId: session.walletId,
+					walletAuthMethodId: input.source.authMethod.walletAuthMethodId,
+					walletAuthorityId: session.authorityId,
+					authorityDigestB64u: session.authorityDigestB64u,
+					authorityRevocationEpoch: session.authorityRevocationEpoch
+				}),
+				...this.authMethods.prepareV2InsertStatements(authMethod)
+			]
+		})).kind !== "stored") {
+			const committed = await readCommittedActivation({
+				authMethods: this.authMethods,
+				envelopes: this.envelopes,
+				command: input,
+				deviceKeyId,
+				expectedEnvelope: input.envelope
+			});
+			if (committed) return {
+				kind: "activated",
+				authMethod: committed
+			};
+			return {
+				kind: "rejected",
+				code: "conflict"
+			};
+		}
+		return {
+			kind: "activated",
+			authMethod
+		};
+	}
+};
+//#endregion
+export { D1VoiceIdActivation };
+
+//# sourceMappingURL=d1VoiceIdActivation.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdSessions.js

@@ -0,0 +1,138 @@
+import { parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { verifyVoiceIdWalletSessionAssertion } from "../../../../authorization/voiceIdDeviceProof.js";
+import { isVoiceIdSeedEnvelope } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { isFullOwnerAuthorityV1 } from "./d1WalletAuthMethodService.js";
+//#region src/router/cloudflare/d1/wallet/d1VoiceIdSessions.ts
+var D1VoiceIdSessions = class {
+	tenantId;
+	constructor(authMethods, authorities, envelopes, challenges, authorization, orgId) {
+		this.authMethods = authMethods;
+		this.authorities = authorities;
+		this.envelopes = envelopes;
+		this.challenges = challenges;
+		this.authorization = authorization;
+		const tenantId = parseTenantId(orgId);
+		if (!tenantId.ok) throw new Error(tenantId.error.message);
+		this.tenantId = tenantId.value;
+	}
+	async resolveActiveMethod(walletId, walletAuthMethodId) {
+		const method = await this.authMethods.readByIdV2({ walletAuthMethodId });
+		if (!method || method.kind !== "voiceid" || method.status !== "active" || method.walletId !== walletId) return null;
+		const authority = await this.authorities.readById(method.walletAuthorityId);
+		if (!authority || authority.state !== "active" || authority.walletId !== walletId || authority.authorityId !== method.walletAuthorityId || !isFullOwnerAuthorityV1(authority)) return null;
+		const custody = await this.envelopes.lookupEnvelopeForWalletAuthMethod({
+			walletId,
+			walletAuthMethodId,
+			factor: {
+				kind: "voiceid",
+				deviceKeyId: method.deviceKeyId
+			}
+		});
+		if (custody.kind !== "active" || !isVoiceIdSeedEnvelope(custody.envelope)) return null;
+		return {
+			authMethod: method,
+			authority,
+			registered: {
+				walletId,
+				walletAuthMethodId,
+				walletAuthorityId: method.walletAuthorityId,
+				deviceKeyId: method.deviceKeyId,
+				publicKeyB64u: method.devicePublicKeyB64u,
+				status: "active"
+			},
+			custodyEnvelope: custody.envelope
+		};
+	}
+	async issueChallenge(input) {
+		const active = await this.resolveActiveMethod(input.walletId, input.walletAuthMethodId);
+		if (!active) return {
+			kind: "rejected",
+			code: "method_unavailable"
+		};
+		return {
+			kind: "issued",
+			challenge: await this.challenges.issue({
+				registered: active.registered,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				nowMs: input.nowMs
+			})
+		};
+	}
+	async verifyAndIssue(input) {
+		const supplied = input.assertion.challenge;
+		const expected = await this.challenges.read({
+			challengeId: supplied.challengeId,
+			requestOrigin: input.requestOrigin,
+			audience: input.requestOrigin,
+			nowMs: input.nowMs
+		});
+		if (!expected) return {
+			kind: "rejected",
+			code: "challenge_unavailable"
+		};
+		const active = await this.resolveActiveMethod(expected.walletId, expected.walletAuthMethodId);
+		if (!active) return {
+			kind: "rejected",
+			code: "method_unavailable"
+		};
+		let verified;
+		try {
+			verified = await verifyVoiceIdWalletSessionAssertion({
+				registered: active.registered,
+				expectedChallenge: expected,
+				assertion: input.assertion,
+				nowMs: input.nowMs,
+				consumeChallenge: this.challenges.consume.bind(this.challenges)
+			});
+		} catch {
+			return {
+				kind: "rejected",
+				code: "invalid_assertion"
+			};
+		}
+		const principalId = parsePrincipalId(String(active.authority.walletId));
+		if (!principalId.ok) return {
+			kind: "rejected",
+			code: "issuance_unavailable"
+		};
+		const deviceLinked = active.authority.provenance.kind === "device_link";
+		let issued;
+		try {
+			issued = await this.authorization.issueDirectWalletSessionAuthorizationV2({
+				tenantId: this.tenantId,
+				principalId: principalId.value,
+				walletId: active.authority.walletId,
+				authority: active.authority,
+				walletAuthMethodId: active.authMethod.walletAuthMethodId,
+				mintId: verified.challenge.challengeId,
+				remainingUses: deviceLinked ? 100 : 3,
+				issuedAtMs: input.nowMs,
+				expiresAtMs: input.nowMs + (deviceLinked ? LINKED_DEVICE_WALLET_SESSION_TTL_MS : DEFAULT_WALLET_SESSION_TTL_MS)
+			});
+		} catch {
+			return {
+				kind: "rejected",
+				code: "issuance_unavailable"
+			};
+		}
+		if (issued.kind !== "issued") return {
+			kind: "rejected",
+			code: "issuance_unavailable"
+		};
+		return {
+			kind: "issued",
+			authorization: {
+				session: issued.session,
+				quota: issued.quota
+			},
+			operationCredential: issued.operationCredential,
+			custodyEnvelope: active.custodyEnvelope
+		};
+	}
+};
+//#endregion
+export { D1VoiceIdSessions };
+
+//# sourceMappingURL=d1VoiceIdSessions.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.js

@@ -0,0 +1,88 @@
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildVoiceIdWalletSessionChallenge, parseVoiceIdWalletSessionChallenge } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.ts
+const CHALLENGE_LIFETIME_MS = 6e4;
+const EXPIRY_CLEANUP_LIMIT = 64;
+var D1VoiceIdWalletSessionChallenges = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async issue(input) {
+		requireTime(input.nowMs);
+		const expiresAtMs = input.nowMs + CHALLENGE_LIFETIME_MS;
+		requireTime(expiresAtMs);
+		const challengeId = parseWalletSessionMintId(`voiceid:${secureRandomBase64Url(32, "VoiceID Wallet Session challenge")}`);
+		if (!challengeId.ok) throw new Error(challengeId.error.message);
+		const challenge = buildVoiceIdWalletSessionChallenge({
+			walletId: input.registered.walletId,
+			walletAuthMethodId: input.registered.walletAuthMethodId,
+			walletAuthorityId: input.registered.walletAuthorityId,
+			deviceKeyId: input.registered.deviceKeyId,
+			challengeId: challengeId.value,
+			nonce: parseDigestB64u(secureRandomBase64Url(32, "VoiceID Wallet Session nonce")),
+			requestOrigin: input.requestOrigin,
+			audience: input.audience,
+			issuedAtMs: input.nowMs,
+			expiresAtMs
+		});
+		await this.pruneExpired(input.nowMs);
+		if (d1ChangedRows(await this.database.prepare(`INSERT INTO voiceid_wallet_session_challenges (
+          namespace, org_id, project_id, env_id, challenge_id, wallet_id,
+          wallet_auth_method_id, challenge_json, issued_at_ms, expires_at_ms
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...this.scopeValues(), String(challenge.challengeId), String(challenge.walletId), String(challenge.walletAuthMethodId), alphabetizeStringify(challenge), challenge.issuedAtMs, challenge.expiresAtMs).run()) !== 1) throw new Error("VoiceID challenge was not stored");
+		return challenge;
+	}
+	async read(input) {
+		requireTime(input.nowMs);
+		const row = await this.database.prepare(`SELECT challenge_json FROM voiceid_wallet_session_challenges
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND challenge_id = ? AND consumed_at_ms IS NULL
+            AND issued_at_ms <= ? AND expires_at_ms > ?
+          LIMIT 1`).bind(...this.scopeValues(), String(input.challengeId), input.nowMs, input.nowMs).first();
+		if (!row) return null;
+		const challenge = parseVoiceIdWalletSessionChallenge(parseD1JsonColumn(row.challenge_json));
+		if (challenge.challengeId !== input.challengeId) throw new Error("Stored VoiceID challenge identity changed");
+		if (challenge.requestOrigin !== input.requestOrigin || challenge.audience !== input.audience) return null;
+		return challenge;
+	}
+	async consume(challenge, nowMs) {
+		requireTime(nowMs);
+		const parsed = parseVoiceIdWalletSessionChallenge(challenge);
+		if (nowMs < parsed.issuedAtMs || nowMs >= parsed.expiresAtMs) return false;
+		return d1ChangedRows(await this.database.prepare(`UPDATE voiceid_wallet_session_challenges SET consumed_at_ms = ?
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND challenge_id = ? AND wallet_id = ? AND wallet_auth_method_id = ?
+            AND challenge_json = ? AND consumed_at_ms IS NULL
+            AND issued_at_ms <= ? AND expires_at_ms > ?`).bind(nowMs, ...this.scopeValues(), String(parsed.challengeId), String(parsed.walletId), String(parsed.walletAuthMethodId), alphabetizeStringify(parsed), nowMs, nowMs).run()) === 1;
+	}
+	async pruneExpired(nowMs) {
+		await this.database.prepare(`WITH expired AS (
+          SELECT rowid FROM voiceid_wallet_session_challenges
+            WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+              AND expires_at_ms <= ?
+            ORDER BY expires_at_ms ASC, challenge_id ASC
+            LIMIT ?
+        ) DELETE FROM voiceid_wallet_session_challenges
+          WHERE rowid IN (SELECT rowid FROM expired)`).bind(...this.scopeValues(), nowMs, EXPIRY_CLEANUP_LIMIT).run();
+	}
+	scopeValues() {
+		return [
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId
+		];
+	}
+};
+function requireTime(value) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error("VoiceID challenge time is invalid");
+}
+//#endregion
+export { D1VoiceIdWalletSessionChallenges };
+
+//# sourceMappingURL=d1VoiceIdWalletSessionChallenges.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -22,9 +22,9 @@ import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingL
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
-import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
-import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
 import { computeWalletAuthMethodRevocationProofDigestV1 } from "./d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
 /** Long enough for a device to retry across a reload, short of ceremony scale. */
@@ -141,6 +141,14 @@ function walletAuthMethodRevokedResponse(walletId, record) {
 				status: "revoked"
 			}
 		};
+		case "voiceid": return {
+			ok: true,
+			walletId,
+			authMethod: {
+				kind: "voiceid",
+				status: "revoked"
+			}
+		};
 		default: return unreachableRevokedMethodKind(record);
 	}
 }
@@ -506,7 +514,7 @@ var CloudflareD1WalletAuthMethodService = class {
 				walletId,
 				auth: storedAuth.auth
 			});
-			if (!sourceMethod) return {
+			if (!sourceMethod || sourceMethod.kind === "voiceid") return {
 				ok: false,
 				code: "unauthorized",
 				message: "Add-auth-method source is not an active V2 wallet auth method"
@@ -2114,6 +2122,6 @@ var CloudflareD1WalletAuthMethodService = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletAuthMethodService };
+export { CloudflareD1WalletAuthMethodService, isFullOwnerAuthorityV1 };
 
 //# sourceMappingURL=d1WalletAuthMethodService.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -724,6 +724,20 @@ function buildRevokedAuthMethod(method, revokedAtMs) {
 		activatedAtMs: method.activatedAtMs,
 		revokedAtMs
 	};
+	if (method.kind === "voiceid") return {
+		version: "wallet_auth_method_v2",
+		walletAuthMethodId: method.walletAuthMethodId,
+		walletId: method.walletId,
+		walletAuthorityId: method.walletAuthorityId,
+		kind: "voiceid",
+		status: "revoked",
+		deviceKeyId: method.deviceKeyId,
+		devicePublicKeyB64u: method.devicePublicKeyB64u,
+		createdAtMs: method.createdAtMs,
+		updatedAtMs: revokedAtMs,
+		activatedAtMs: method.activatedAtMs,
+		revokedAtMs
+	};
 	return {
 		version: "wallet_auth_method_v2",
 		walletAuthMethodId: method.walletAuthMethodId,

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -243,6 +243,7 @@ function buildWebAuthnRecoveryContinuityEnvelopeAnchor(envelope) {
 			updatedAtMs: envelope.updatedAtMs,
 			bindingKind: "wallet_custody_seed_v1"
 		};
+		case "voiceid": throw new Error("WebAuthn recovery continuity does not accept a VoiceID envelope");
 	}
 }
 function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {