@seams/wallet-server 0.23.0 → 0.24.0

package/dist/esm/router/cloudflare.js

@@ -257,6 +257,7 @@ function runtimePolicyScopeKey(scope) {
 }
 function ed25519AdmissionAuthorityScopeKey(scope) {
 	switch (scope.kind) {
+		case "voiceid": return `voiceid:${scope.deviceKeyId}`;
 		case "passkey_rp": return `passkey_rp:${scope.rpId}`;
 		case "email_otp": return `email_otp:${scope.provider}:${scope.providerUserId}`;
 	}
@@ -1536,6 +1537,20 @@ function parseWalletCapabilitySubjectV1(raw, label) {
 //#endregion
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
+function buildVoiceIdWalletAuthAuthority(input) {
+	return {
+		walletId: input.walletId,
+		bindingId: input.walletAuthMethodId,
+		factor: {
+			kind: "voiceid",
+			deviceKeyId: input.deviceKeyId
+		},
+		verifier: { kind: "device_signature" }
+	};
+}
+function isVoiceIdWalletAuthAuthority(authority) {
+	return authority.factor.kind === "voiceid";
+}
 function isPasskeyWalletAuthAuthority(authority) {
 	return authority.factor.kind === "passkey";
 }
@@ -1705,7 +1720,33 @@ function parseEmailOtpWalletAuthAuthorityObject(obj) {
 function parseWalletAuthAuthority(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const obj = raw;
-	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj);
+	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj) || parseVoiceIdWalletAuthAuthority(obj);
+}
+function parseVoiceIdWalletAuthAuthority(raw) {
+	try {
+		const record = requireRecord$1(raw, "device authority");
+		rejectUnknownFields(record, [
+			"walletId",
+			"bindingId",
+			"factor",
+			"verifier"
+		], "device authority");
+		const factor = requireRecord$1(record.factor, "device factor");
+		const verifier = requireRecord$1(record.verifier, "device verifier");
+		rejectUnknownFields(factor, ["kind", "deviceKeyId"], "device factor");
+		rejectUnknownFields(verifier, ["kind"], "device verifier");
+		if (factor.kind !== "voiceid" || verifier.kind !== "device_signature") return null;
+		const walletId = parseWalletId(record.walletId);
+		const method = parseWalletAuthMethodId(record.bindingId);
+		if (!walletId.ok || !method.ok) return null;
+		return buildVoiceIdWalletAuthAuthority({
+			walletId: walletId.value,
+			walletAuthMethodId: method.value,
+			deviceKeyId: parseDigestB64u(factor.deviceKeyId)
+		});
+	} catch {
+		return null;
+	}
 }
 function canonicalWalletAuthorityBindingDigestInput(args) {
 	return `${WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN}${alphabetizeStringify(args.authority)}`;
@@ -5433,6 +5474,7 @@ const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 ];
 const ROUTER_API_LINKED_DEVICE_PASSKEY_SERVICES = ["publishableKeyAuth"];
 const ROUTER_API_WALLET_UNLOCK_SERVICES = ["walletUnlock"];
+const ROUTER_API_VOICEID_ACTIVATION_SERVICES = ["session", "walletAuthMethods"];
 const ROUTER_API_HOSTED_SESSION_EXCHANGE_SERVICES = ["session"];
 const ROUTER_API_EMAIL_OTP_PUBLIC_SERVICES = ["emailOtp"];
 const ROUTER_API_EMAIL_OTP_CHALLENGE_SERVICES = ["emailOtp", "walletAuthMethods"];
@@ -5808,6 +5850,18 @@ function createRouterApiRouteDefinitions(options = {}) {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock verification is intentionally public because the challenge proof is the gate."
+	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_voiceid_activate", "POST", "/wallet/voiceid/activate", "Activate a device-bound VoiceID method under an owner Wallet Session", {
+		plane: "public",
+		proof: "challenge_exchange",
+		rationale: "An active full-owner Wallet Session and the hosted wallet origin authorize activation."
+	}, ROUTER_API_VOICEID_ACTIVATION_SERVICES), publicRoute("wallet_voiceid_challenge", "POST", "/wallet/voiceid/challenge", "Issue a device-bound VoiceID Wallet Session challenge", {
+		plane: "public",
+		proof: "challenge_exchange",
+		rationale: "An active method receives a short-lived challenge bound to the hosted wallet origin."
+	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_voiceid_verify", "POST", "/wallet/voiceid/verify", "Verify a VoiceID device assertion and issue a Wallet Session", {
+		plane: "public",
+		proof: "signed_payload",
+		rationale: "The registered device signature and single-use server challenge authorize issuance."
 	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_email_otp_challenge", "POST", "/wallet/email-otp/challenge", "Create an operation-bound Email OTP challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
@@ -7530,6 +7584,102 @@ function exactRecord$2(raw, keys, label) {
 	return record;
 }
 //#endregion
+//#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+const MAXIMUM_CHALLENGE_MS = 6e4;
+function parseVoiceIdDevicePublicKeyB64u(value) {
+	if (typeof value !== "string") throw new Error("VoiceID public key is invalid");
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+	return value;
+}
+function exactKeys(value, keys) {
+	if (Object.keys(value).length !== keys.length) return false;
+	for (const key of keys) if (!Object.hasOwn(value, key)) return false;
+	return true;
+}
+function requireOrigin(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be an origin`);
+	let origin;
+	let protocol;
+	try {
+		const parsed = new URL(value);
+		origin = parsed.origin;
+		protocol = parsed.protocol;
+	} catch {
+		throw new Error(`${label} must be an origin`);
+	}
+	if (origin !== value || protocol !== "http:" && protocol !== "https:") throw new Error(`${label} must be a canonical HTTP origin`);
+	return origin;
+}
+function requireWindow(issuedAtMs, expiresAtMs) {
+	if (!Number.isSafeInteger(issuedAtMs) || !Number.isSafeInteger(expiresAtMs) || Number(issuedAtMs) <= 0 || Number(expiresAtMs) <= Number(issuedAtMs) || Number(expiresAtMs) - Number(issuedAtMs) > MAXIMUM_CHALLENGE_MS) throw new Error("VoiceID challenge has an invalid validity window");
+}
+function buildVoiceIdWalletSessionChallenge(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	requireOrigin(fields.audience, "VoiceID audience");
+	return {
+		kind: "voiceid_wallet_session_challenge_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		challengeId: fields.challengeId,
+		nonce: fields.nonce,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdWalletSessionChallenge(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"challengeId",
+		"nonce",
+		"requestOrigin",
+		"audience",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_wallet_session_challenge_v1") throw new Error("Invalid VoiceID Wallet Session challenge");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	const challengeId = parseWalletSessionMintId(raw.challengeId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !challengeId.ok) throw new Error("VoiceID challenge identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID challenge times must be numbers");
+	return buildVoiceIdWalletSessionChallenge({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		challengeId: challengeId.value,
+		nonce: parseDigestB64u(raw.nonce),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		audience: requireOrigin(raw.audience, "VoiceID audience"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdDeviceAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"challenge",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_device_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID device assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_device_assertion_v1",
+		challenge: parseVoiceIdWalletSessionChallenge(raw.challenge),
+		signatureB64u: raw.signatureB64u
+	};
+}
+//#endregion
 //#region ../shared-ts/src/utils/registrationAuthMethodInput.ts
 function inspectRawObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -7660,7 +7810,7 @@ function parseWalletAuthMethodRecordV2(raw) {
 	const version = trimString(record.version);
 	const kind = trimString(record.kind);
 	const status = trimString(record.status);
-	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
+	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp" && kind !== "voiceid") return null;
 	try {
 		const common = parseWalletAuthMethodRecordV2Common(record);
 		if (kind === "passkey") {
@@ -7678,6 +7828,16 @@ function parseWalletAuthMethodRecordV2(raw) {
 				counter: parseNonNegativeInteger(record.counter)
 			});
 		}
+		if (kind === "voiceid") {
+			if (!("deviceKeyId" in record) || !("devicePublicKeyB64u" in record)) return null;
+			exactWalletAuthMethodV2Fields(record, "voiceid", status);
+			return buildParsedVoiceIdWalletAuthMethodRecordV2({
+				common,
+				lifecycle: parseWalletAuthMethodLifecycle(record),
+				deviceKeyId: parseDigestB64u(record.deviceKeyId),
+				devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(record.devicePublicKeyB64u)
+			});
+		}
 		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
 		exactWalletAuthMethodV2Fields(record, "email_otp", status);
 		const emailHashHex = trimString(record.emailHashHex);
@@ -7736,7 +7896,8 @@ function exactWalletAuthMethodV2Fields(raw, kind, status) {
 		"updatedAtMs"
 	];
 	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-	else fields.push("emailHashHex", "registrationAuthorityId");
+	else if (kind === "email_otp") fields.push("emailHashHex", "registrationAuthorityId");
+	else fields.push("deviceKeyId", "devicePublicKeyB64u");
 	if (status === "active") fields.push("activatedAtMs");
 	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
 	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
@@ -7837,6 +7998,49 @@ function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
 		};
 	}
 }
+function buildParsedVoiceIdWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
 function parseWalletAuthMethodIdRequired$1(raw) {
 	const parsed = parseWalletAuthMethodId(raw);
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -8433,7 +8637,7 @@ function parseCommittedAuthorityPackagesV1(raw) {
 	const authority = parseWalletAuthorityV1(record.authority);
 	if (!authority.ok || authority.value.state !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
 	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-	if (!authMethod || authMethod.status !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
+	if (!authMethod || authMethod.status !== "pending_local_install" || authMethod.kind === "voiceid") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
 	if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) throw new Error("CommittedAuthorityPackagesV1 authority and auth method identities differ");
 	const signerPackages = parseCommittedSignerPackageSetV1(record.signerPackages);
 	assertSignerPackagesMatchAuthority(signerPackages, authority.value.signerActivations);
@@ -10717,6 +10921,7 @@ function isActiveOwnerLane(lane) {
 	if (lane.lifecycle.state !== "active") return false;
 	switch (lane.laneKind) {
 		case "owner_passkey":
+		case "owner_voiceid":
 		case "owner_email_otp":
 		case "recovery":
 		case "break_glass": return true;
@@ -11738,6 +11943,13 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+const VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
+function isActiveMethodBoundWalletSeedEnvelope(envelope) {
+	return envelope.ownership.kind === "method_bound" && envelope.binding.kind === "wallet_custody_seed_v1" && envelope.lifecycle.state === "active";
+}
+function isVoiceIdSeedEnvelope(envelope) {
+	return isActiveMethodBoundWalletSeedEnvelope(envelope) && envelope.factor.kind === "voiceid";
+}
 const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
@@ -11774,6 +11986,13 @@ function buildEmailOtpEnvelopeFactor(args) {
 		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
 	};
 }
+function buildVoiceIdEnvelopeFactor(args) {
+	return {
+		kind: "voiceid",
+		deviceKeyId: args.deviceKeyId,
+		kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+	};
+}
 function buildActiveEnvelopeLifecycle(args) {
 	return {
 		state: "active",
@@ -11860,7 +12079,16 @@ const EMAIL_OTP_FACTOR_FIELDS = [
 	"enrollmentSealKeyVersion",
 	"kekVersion"
 ];
-const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+const VOICEID_FACTOR_FIELDS = [
+	"kind",
+	"deviceKeyId",
+	"kekVersion"
+];
+const ALL_FACTOR_FIELDS = Array.from(new Set([
+	...PASSKEY_FACTOR_FIELDS,
+	...EMAIL_OTP_FACTOR_FIELDS,
+	...VOICEID_FACTOR_FIELDS
+]));
 function requireNonEmptyString(value, label) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
 	return value;
@@ -11887,7 +12115,11 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
 				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
 				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
 			});
-		default: throw new Error(`${label}.kind must be passkey or email_otp`);
+		case "voiceid":
+			rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+			if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+			return buildVoiceIdEnvelopeFactor({ deviceKeyId: parseDigestField$3(record.deviceKeyId, `${label}.deviceKeyId`) });
+		default: throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
 	}
 }
 const ENVELOPE_RECORD_FIELDS = [
@@ -12419,16 +12651,14 @@ function normalizeAddAuthMethodIntentCaller(raw) {
 	if (!source) return null;
 	const walletAuthorityId = parseWalletAuthorityId("walletAuthorityId" in source ? source.walletAuthorityId : void 0);
 	const walletAuthMethodId = parseWalletAuthMethodId("walletAuthMethodId" in source ? source.walletAuthMethodId : void 0);
-	const walletSessionId = trimString("walletSessionId" in source ? source.walletSessionId : void 0);
 	const authorityDigestB64u = trimString("authorityDigestB64u" in source ? source.authorityDigestB64u : void 0);
 	const revocationEpoch = "revocationEpoch" in source ? source.revocationEpoch : void 0;
-	if (!walletAuthorityId.ok || !walletAuthMethodId.ok || !walletSessionId || !authorityDigestB64u || typeof revocationEpoch !== "number" || !Number.isSafeInteger(revocationEpoch) || revocationEpoch < 0) return null;
+	if (!walletAuthorityId.ok || !walletAuthMethodId.ok || !authorityDigestB64u || typeof revocationEpoch !== "number" || !Number.isSafeInteger(revocationEpoch) || revocationEpoch < 0) return null;
 	return {
 		caller: "same_device_addition",
 		source: {
 			walletAuthorityId: walletAuthorityId.value,
 			walletAuthMethodId: walletAuthMethodId.value,
-			walletSessionId,
 			authorityDigestB64u,
 			revocationEpoch
 		}
@@ -14817,6 +15047,290 @@ async function handleWalletRegistration(ctx) {
 	return toFetchRouteResponse(response);
 }
 //#endregion
+//#region src/router/domains/voiceId/voiceIdActivation.ts
+/** Accepts only a method-bound owner seed envelope for the new VoiceID method. */
+function parseVoiceIdActivationEnvelope(raw) {
+	const envelope = parsePasskeyCustodyEnvelopeRecord(raw);
+	if (!isVoiceIdSeedEnvelope(envelope) || Number(envelope.envelopeRevision) !== 1) throw new Error("VoiceID activation requires an active, method-bound wallet seed envelope");
+	return envelope;
+}
+//#endregion
+//#region src/router/transport/fetch/routes/walletVoiceIdActivation.ts
+const ACTIVATION_FIELDS = [
+	"targetWalletAuthMethodId",
+	"devicePublicKeyB64u",
+	"custodyEnvelope"
+];
+function hostedWalletOriginAllowed(request, allowedOrigins) {
+	const rawOrigin = request.headers.get("origin");
+	let requestOrigin;
+	try {
+		requestOrigin = parseSessionOrigin(rawOrigin);
+	} catch {
+		return false;
+	}
+	for (const allowed of allowedOrigins) try {
+		if (parseSessionOrigin(allowed) === requestOrigin) return true;
+	} catch {
+		continue;
+	}
+	return false;
+}
+function parseActivationBody(raw) {
+	const body = requireRecord$1(raw, "VoiceID activation");
+	rejectUnknownFields(body, ACTIVATION_FIELDS, "VoiceID activation");
+	const target = parseWalletAuthMethodId(body.targetWalletAuthMethodId);
+	if (!target.ok) throw new Error(target.error.message);
+	return {
+		targetWalletAuthMethodId: target.value,
+		devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(body.devicePublicKeyB64u),
+		envelope: parseVoiceIdActivationEnvelope(body.custodyEnvelope)
+	};
+}
+function rejectionStatus(code) {
+	switch (code) {
+		case "invalid_source": return 403;
+		case "invalid_target": return 400;
+		case "conflict": return 409;
+		default: {
+			const unexpected = code;
+			throw new Error(`Unsupported VoiceID activation rejection: ${unexpected}`);
+		}
+	}
+}
+async function handleWalletVoiceIdActivation(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/activate") return null;
+	return await handleVoiceIdActivationRequest(ctx.request, {
+		tenantId: ctx.service.authorizationSessions.tenantId,
+		readWalletSessionAuthorizationV2ByOperationCredential: ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential,
+		activateVoiceId: ctx.service.walletAuthMethods.activateVoiceId,
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleVoiceIdActivationRequest(request, deps) {
+	if (!hostedWalletOriginAllowed(request, deps.hostedWalletOrigins)) return json$3({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	const credential = extractBearerCredential(request.headers);
+	if (!credential) return json$3({
+		ok: false,
+		code: "unauthorized"
+	}, { status: 401 });
+	let token;
+	try {
+		token = parsePrimaryWalletSessionOperationCredentialToken(credential);
+	} catch {
+		return json$3({
+			ok: false,
+			code: "unauthorized"
+		}, { status: 401 });
+	}
+	const nowMs = Date.now();
+	let source;
+	try {
+		source = await deps.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: deps.tenantId,
+			token,
+			nowMs
+		});
+	} catch {
+		return json$3({
+			ok: false,
+			code: "wallet_session_unavailable"
+		}, { status: 503 });
+	}
+	if (!source || source.retiredAtMs !== null || source.authMethod.status !== "active" || source.authMethod.kind !== "passkey" && source.authMethod.kind !== "email_otp") return json$3({
+		ok: false,
+		code: "unauthorized"
+	}, { status: 401 });
+	let parsedBody;
+	try {
+		parsedBody = parseActivationBody(await readJson(request));
+	} catch (error) {
+		return json$3({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID activation body is invalid"
+		}, { status: 400 });
+	}
+	let result;
+	try {
+		result = await deps.activateVoiceId({
+			source: {
+				authorization: source.authorization,
+				authority: source.authority,
+				authMethod: source.authMethod
+			},
+			targetWalletAuthMethodId: parsedBody.targetWalletAuthMethodId,
+			devicePublicKeyB64u: parsedBody.devicePublicKeyB64u,
+			envelope: parsedBody.envelope,
+			nowMs
+		});
+	} catch {
+		return json$3({
+			ok: false,
+			code: "activation_unavailable"
+		}, { status: 503 });
+	}
+	if (result.kind === "rejected") return json$3({
+		ok: false,
+		code: result.code
+	}, { status: rejectionStatus(result.code) });
+	return json$3({
+		ok: true,
+		authMethod: result.authMethod
+	}, { status: 200 });
+}
+//#endregion
+//#region src/router/transport/fetch/routes/walletVoiceIdNear.ts
+async function prepareVoiceIdNearInstallation(ctx, verified) {
+	const session = verified.authorization.session;
+	const activation = session.capabilitySubjects.find(isNearSignSubject);
+	if (!activation || activation.kind !== "sign") return { kind: "unavailable" };
+	const resolved = await ctx.service.walletRegistration.resolveEd25519MaterialActivation({
+		walletId: session.walletId,
+		materialActivation: routerAbMpcMaterialActivationRefToWire(activation.materialActivation)
+	});
+	if (!resolved.ok) throw new Error(resolved.message);
+	const product = ctx.opts.routerAbEd25519YaoProduct;
+	if (!product) throw new Error("NEAR signing is not configured");
+	const capability = await product.resolveActiveCapability({
+		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+		walletId: session.walletId,
+		nearEd25519SigningKeyId: resolved.exportIdentity.application_binding.near_ed25519_signing_key_id,
+		signerSlot: resolved.signerSlot,
+		signingWorkerId: resolved.signingWorkerId,
+		participantIds: resolved.participantIds
+	});
+	if (!capability.ok) throw new Error(capability.message);
+	if (!sameRouterAbMpcMaterialActivationRef(capability.capability.materialActivation, resolved.materialActivation)) throw new Error("NEAR capability does not belong to this Wallet Session");
+	return {
+		kind: "ready",
+		capability: capability.capability,
+		remainingUses: verified.authorization.quota.remainingUses
+	};
+}
+function isNearSignSubject(subject) {
+	return subject.kind === "sign" && subject.keyFamily === "ed25519";
+}
+//#endregion
+//#region src/router/transport/fetch/routes/walletVoiceIdSessions.ts
+function hostedOrigin(request, allowedOrigins) {
+	if (!hostedWalletOriginAllowed(request, allowedOrigins)) return null;
+	return parseSessionOrigin(request.headers.get("origin"));
+}
+function parseChallengeBody(raw) {
+	const body = requireRecord$1(raw, "VoiceID challenge");
+	rejectUnknownFields(body, ["walletId", "walletAuthMethodId"], "VoiceID challenge");
+	const walletId = parseWalletId(body.walletId);
+	if (!walletId.ok) throw new Error(walletId.error.message);
+	const walletAuthMethodId = parseWalletAuthMethodId(body.walletAuthMethodId);
+	if (!walletAuthMethodId.ok) throw new Error(walletAuthMethodId.error.message);
+	return {
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value
+	};
+}
+async function handleWalletVoiceIdChallenge(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/challenge") return null;
+	return await handleVoiceIdChallengeRequest(ctx.request, {
+		issueVoiceIdChallenge: ctx.service.walletUnlock.issueVoiceIdChallenge,
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleWalletVoiceIdVerify(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/verify") return null;
+	return await handleVoiceIdVerifyRequest(ctx.request, {
+		verifyAndIssueVoiceId: ctx.service.walletUnlock.verifyAndIssueVoiceId,
+		prepareNear: prepareVoiceIdNearInstallation.bind(null, ctx),
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleVoiceIdChallengeRequest(request, deps) {
+	const requestOrigin = hostedOrigin(request, deps.hostedWalletOrigins);
+	if (!requestOrigin) return json$3({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	let body;
+	try {
+		body = parseChallengeBody(await readJson(request));
+	} catch (error) {
+		return json$3({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID challenge body is invalid"
+		}, { status: 400 });
+	}
+	try {
+		const result = await deps.issueVoiceIdChallenge({
+			walletId: body.walletId,
+			walletAuthMethodId: body.walletAuthMethodId,
+			requestOrigin,
+			nowMs: Date.now()
+		});
+		if (result.kind === "rejected") return json$3({
+			ok: false,
+			code: result.code
+		}, { status: 403 });
+		return json$3({
+			ok: true,
+			challenge: result.challenge
+		}, { status: 200 });
+	} catch {
+		return json$3({
+			ok: false,
+			code: "challenge_unavailable"
+		}, { status: 503 });
+	}
+}
+async function handleVoiceIdVerifyRequest(request, deps) {
+	const requestOrigin = hostedOrigin(request, deps.hostedWalletOrigins);
+	if (!requestOrigin) return json$3({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	let assertion;
+	try {
+		const body = requireRecord$1(await readJson(request), "VoiceID verification");
+		rejectUnknownFields(body, ["assertion"], "VoiceID verification");
+		assertion = parseVoiceIdDeviceAssertion(body.assertion);
+	} catch (error) {
+		return json$3({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID assertion is invalid"
+		}, { status: 400 });
+	}
+	try {
+		const result = await deps.verifyAndIssueVoiceId({
+			assertion,
+			requestOrigin,
+			nowMs: Date.now()
+		});
+		if (result.kind === "rejected") {
+			const status = result.code === "issuance_unavailable" ? 503 : 403;
+			return json$3({
+				ok: false,
+				code: result.code
+			}, { status });
+		}
+		return json$3({
+			ok: true,
+			walletSession: projectActiveWalletSession(result.authorization),
+			operationCredential: result.operationCredential,
+			custodyEnvelope: result.custodyEnvelope,
+			near: await deps.prepareNear(result)
+		}, { status: 200 });
+	} catch {
+		return json$3({
+			ok: false,
+			code: "verification_unavailable"
+		}, { status: 503 });
+	}
+}
+//#endregion
 //#region ../shared-ts/src/utils/errors.ts
 /**
 * Best-effort error message extractor without relying on `any`.
@@ -19888,6 +20402,14 @@ function walletAuthorityForAuthMethod(authMethod, authSource) {
 			bindingId: authMethod.walletAuthMethodId
 		};
 	}
+	if (authMethod.kind === "voiceid") {
+		if (authSource.kind !== "voiceid" || authSource.deviceKeyId !== authMethod.deviceKeyId) return null;
+		return buildVoiceIdWalletAuthAuthority({
+			walletId: authMethod.walletId,
+			walletAuthMethodId: authMethod.walletAuthMethodId,
+			deviceKeyId: authMethod.deviceKeyId
+		});
+	}
 	if (authSource.kind !== "oidc_provider") return null;
 	const providerUserId = parseEmailOtpProviderUserId(authSource.providerSubject);
 	if (!providerUserId.ok) return null;
@@ -25679,6 +26201,7 @@ function serializeProjection(value) {
 	const lane = value.lane;
 	switch (lane.laneKind) {
 		case "owner_passkey":
+		case "owner_voiceid":
 		case "owner_email_otp": return {
 			kind: value.kind,
 			walletKey: serializeWalletKey(value.walletKey),
@@ -27890,6 +28413,10 @@ function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority) {
 		provider: authority.factor.provider,
 		providerUserId: authority.factor.providerUserId
 	};
+	if (isVoiceIdWalletAuthAuthority(authority)) return {
+		kind: "voiceid",
+		deviceKeyId: authority.factor.deviceKeyId
+	};
 	throw new Error("[threshold-ed25519] unsupported wallet auth authority");
 }
 async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
@@ -28064,6 +28591,17 @@ function walletAuthAuthorityFromExactV2MethodV1(input) {
 	} catch {
 		return null;
 	}
+	if (input.authMethod.kind === "voiceid") return {
+		authority: buildVoiceIdWalletAuthAuthority({
+			walletId: input.walletId,
+			walletAuthMethodId: input.authMethod.walletAuthMethodId,
+			deviceKeyId: input.authMethod.deviceKeyId
+		}),
+		authSource: {
+			kind: "voiceid",
+			deviceKeyId: input.authMethod.deviceKeyId
+		}
+	};
 	const providerSubject = parseProviderSubject(input.principalId);
 	if (!providerSubject.ok) return null;
 	try {
@@ -28482,6 +29020,9 @@ function createFetchRouter(service, opts, runtime) {
 		handleHostedWalletSessionExchangeRedeem,
 		handleWalletUnlockChallenge,
 		handleWalletUnlockVerify,
+		handleWalletVoiceIdActivation,
+		handleWalletVoiceIdChallenge,
+		handleWalletVoiceIdVerify,
 		handleWalletEmailOtpChallenge,
 		handleWalletEmailOtpFactorRelease,
 		handleWalletEmailOtpDevCleanupGoogleRegistration,
@@ -32819,6 +33360,8 @@ Object.freeze([
       updated_at_ms INTEGER NOT NULL,
       activated_at_ms INTEGER,
       revoked_at_ms INTEGER,
+      provider TEXT,
+      provider_user_id TEXT,
       PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),
       FOREIGN KEY (
         namespace,
@@ -32835,7 +33378,7 @@ Object.freeze([
       ),
       CHECK (length(wallet_id) > 0),
       CHECK (length(wallet_authority_id) > 0),
-      CHECK (kind IN ('passkey', 'email_otp')),
+      CHECK (kind IN ('passkey', 'email_otp', 'voiceid')),
       CHECK (status IN ('pending_local_install', 'active', 'revoked')),
       CHECK (length(wallet_auth_method_id) > 0),
       CHECK (length(auth_identifier_key) > 0),
@@ -32869,6 +33412,18 @@ Object.freeze([
           AND registration_authority_id IS NOT NULL
           AND length(registration_authority_id) > 0
           AND auth_identifier_key = email_hash_hex)
+        OR
+        (kind = 'voiceid'
+          AND rp_id = ''
+          AND credential_id_b64u IS NULL
+          AND credential_public_key_b64u IS NOT NULL
+          AND length(credential_public_key_b64u) = 43
+          AND email_hash_hex IS NULL
+          AND registration_authority_id IS NULL
+          AND provider IS NULL
+          AND provider_user_id IS NULL
+          AND length(auth_identifier_key) = 43
+          AND COALESCE(auth_identifier_key = json_extract(record_json, '$.deviceKeyId'), 0))
       ),
       CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),
       CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),
@@ -32888,6 +33443,10 @@ Object.freeze([
         (kind = 'email_otp'
           AND json_extract(record_json, '$.emailHashHex') = email_hash_hex
           AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)
+        OR
+        (kind = 'voiceid'
+          AND COALESCE(json_extract(record_json, '$.deviceKeyId') = auth_identifier_key, 0)
+          AND COALESCE(json_extract(record_json, '$.devicePublicKeyB64u') = credential_public_key_b64u, 0))
       )
     )
   `,
@@ -32902,6 +33461,13 @@ Object.freeze([
         wallet_authority_id,
         status
       )
+  `,
+	`
+    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_voiceid_key_uidx
+      ON wallet_auth_methods (
+        namespace, org_id, project_id, env_id, auth_identifier_key
+      )
+      WHERE kind = 'voiceid'
   `,
 	`
     CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx