@seams/wallet-server 0.23.0 → 0.24.0

package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts

@@ -1,3 +1,4 @@
+import { type DigestB64u } from './canonicalPrimitives';
 import { type EmailOtpProviderUserId, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 export type EmailOtpProvider = 'google' | 'email';
 export type PasskeyFactorIdentity = {
@@ -6,6 +7,7 @@ export type PasskeyFactorIdentity = {
     rpId?: never;
     provider?: never;
     providerUserId?: never;
+    deviceKeyId?: never;
 };
 export type EmailOtpFactorIdentity = {
     kind: 'email_otp';
@@ -13,8 +15,17 @@ export type EmailOtpFactorIdentity = {
     providerUserId: EmailOtpProviderUserId;
     rpId?: never;
     credentialIdB64u?: never;
+    deviceKeyId?: never;
 };
-export type AuthFactorIdentity = PasskeyFactorIdentity | EmailOtpFactorIdentity;
+export type VoiceIdFactorIdentity = {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type AuthFactorIdentity = PasskeyFactorIdentity | EmailOtpFactorIdentity | VoiceIdFactorIdentity;
 export type PasskeyWalletAuthAuthority = {
     walletId: WalletId;
     factor: PasskeyFactorIdentity;
@@ -43,7 +54,26 @@ export type EmailOtpWalletAuthAuthority = {
     provider?: never;
     providerUserId?: never;
 };
-export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAuthAuthority;
+export type VoiceIdWalletAuthAuthority = {
+    walletId: WalletId;
+    factor: VoiceIdFactorIdentity;
+    verifier: {
+        kind: 'device_signature';
+    };
+    bindingId: WalletAuthMethodId;
+    kind?: never;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAuthAuthority | VoiceIdWalletAuthAuthority;
+export declare function buildVoiceIdWalletAuthAuthority(input: {
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    deviceKeyId: DigestB64u;
+}): VoiceIdWalletAuthAuthority;
+export declare function isVoiceIdWalletAuthAuthority(authority: WalletAuthAuthority): authority is VoiceIdWalletAuthAuthority;
 export declare function isPasskeyWalletAuthAuthority(authority: WalletAuthAuthority): authority is PasskeyWalletAuthAuthority;
 export declare function isEmailOtpWalletAuthAuthority(authority: WalletAuthAuthority): authority is EmailOtpWalletAuthAuthority;
 export declare function walletAuthAuthoritiesMatch(left: WalletAuthAuthority, right: WalletAuthAuthority): boolean;

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,3 +1,4 @@
+import { type VoiceIdDevicePublicKeyB64u } from '../authorization/voiceIdDeviceAssertion';
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 import type { Variant, ReadonlyExclusiveUnion } from './variant';
@@ -77,6 +78,17 @@ export type EmailOtpWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
     readonly credentialPublicKeyB64u?: never;
     readonly counter?: never;
 };
+export type VoiceIdWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'voiceid';
+    readonly deviceKeyId: DigestB64u;
+    readonly devicePublicKeyB64u: VoiceIdDevicePublicKeyB64u;
+    readonly rpId?: never;
+    readonly credentialIdB64u?: never;
+    readonly credentialPublicKeyB64u?: never;
+    readonly counter?: never;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+};
 type WalletAuthMethodCommonV1 = {
     readonly version: 'wallet_auth_method_v2';
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -85,14 +97,16 @@ type WalletAuthMethodCommonV1 = {
     readonly createdAtMs: number;
     readonly updatedAtMs: number;
 };
-export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
+export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (VoiceIdWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
 export type PasskeyWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'passkey'>;
 export type EmailOtpWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type VoiceIdWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'voiceid'>;
 export type PendingWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'pending_local_install'>;
 export type ActiveWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'active'>;
 export type RevokedWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'revoked'>;
 export type ActivePasskeyWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'passkey'>;
 export type ActiveEmailOtpWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type ActiveVoiceIdWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'voiceid'>;
 export declare function sameWalletAuthMethodRecordV2(left: WalletAuthMethodRecordV2, right: WalletAuthMethodRecordV2): boolean;
 export declare function buildWalletAuthMethodRecordV2(input: WalletAuthMethodRecordV2): WalletAuthMethodRecordV2;
 export declare function parseWalletAuthMethodRecordV2(raw: unknown): WalletAuthMethodRecordV2 | null;

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -1,6 +1,7 @@
 import { type WalletAuthMethodId, type WalletId, type WebAuthnRpId } from './domainIds';
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
 import { type NearEd25519SigningKeyId } from './registrationIds';
+import { type DigestB64u } from './canonicalPrimitives';
 export type { WebAuthnRpId };
 export type RpId = WebAuthnRpId;
 export type WalletIdentity = {
@@ -15,6 +16,7 @@ export type WalletAuthMethodBinding = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly scope: PasskeyAuthScope;
     readonly credentialIdB64u: string;
+    readonly deviceKeyId?: never;
 } | {
     readonly kind: 'email_otp';
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -22,6 +24,17 @@ export type WalletAuthMethodBinding = {
     readonly emailHashHex: string;
     readonly registrationAuthorityId: string;
     readonly rpId?: never;
+    readonly deviceKeyId?: never;
+} | {
+    readonly kind: 'voiceid';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly wallet: WalletIdentity;
+    readonly deviceKeyId: DigestB64u;
+    readonly scope?: never;
+    readonly credentialIdB64u?: never;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+    readonly rpId?: never;
 };
 export type CurrentWalletAuthMethod = {
     readonly kind: 'none';
@@ -74,6 +87,13 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
     emailHashHex: string;
     registrationAuthorityId: string;
 }): WalletAuthMethodBinding;
+export declare function buildVoiceIdWalletAuthMethodBinding(args: {
+    walletAuthMethodId: WalletAuthMethodId;
+    wallet: WalletIdentity;
+    deviceKeyId: DigestB64u;
+}): Extract<WalletAuthMethodBinding, {
+    kind: 'voiceid';
+}>;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';

package/dist/types/wallet-server/src/authorization/voiceIdDeviceProof.d.ts

@@ -0,0 +1,29 @@
+import { type VoiceIdDevicePublicKeyB64u, type VoiceIdWalletSessionChallenge } from '../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../shared-ts/src/utils/domainIds';
+export type RegisteredVoiceIdDeviceKey = Readonly<{
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    walletAuthorityId: WalletAuthorityId;
+    deviceKeyId: DigestB64u;
+    publicKeyB64u: VoiceIdDevicePublicKeyB64u;
+    status: 'active';
+}>;
+declare class VerifiedVoiceIdWalletSessionProof {
+    readonly challenge: VoiceIdWalletSessionChallenge;
+    readonly deviceKeyId: DigestB64u;
+    private readonly proofBrand;
+    constructor(challenge: VoiceIdWalletSessionChallenge, deviceKeyId: DigestB64u);
+}
+export type VerifiedVoiceIdSessionProof = VerifiedVoiceIdWalletSessionProof;
+export type ConsumeVoiceIdChallenge = (challenge: VoiceIdWalletSessionChallenge, nowMs: number) => Promise<boolean>;
+/** Only this server boundary turns a signed device result into verified proof. */
+export declare function verifyVoiceIdWalletSessionAssertion(input: {
+    registered: RegisteredVoiceIdDeviceKey;
+    expectedChallenge: VoiceIdWalletSessionChallenge;
+    assertion: unknown;
+    nowMs: number;
+    consumeChallenge: ConsumeVoiceIdChallenge;
+}): Promise<VerifiedVoiceIdSessionProof>;
+export {};
+//# sourceMappingURL=voiceIdDeviceProof.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -1,6 +1,6 @@
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import { type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type ActiveWalletAuthMethodRecordV2, type ActiveVoiceIdWalletAuthMethodRecordV2, type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
 export type WalletAuthMethodRecord = SharedWalletAuthMethodRecord;
@@ -27,6 +27,11 @@ export type WalletAuthMethodV2Store = {
     readByIdV2(input: {
         readonly walletAuthMethodId: WalletAuthMethodId;
     }): Promise<WalletAuthMethodRecordV2 | null>;
+    getActiveVoiceIdV2(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly walletAuthorityId: WalletAuthorityId;
+    }): Promise<ActiveVoiceIdWalletAuthMethodRecordV2 | null>;
     getPasskeyV2(input: {
         readonly rpId: string;
         readonly credentialIdB64u: string;
@@ -70,7 +75,7 @@ export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CR
  * statements; keeping the SQL here lets focused D1 tests provision the V2
  * table without copying migration text into a test.
  */
-export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
+export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      provider TEXT,\n      provider_user_id TEXT,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp', 'voiceid')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n        OR\n        (kind = 'voiceid'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) = 43\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND provider IS NULL\n          AND provider_user_id IS NULL\n          AND length(auth_identifier_key) = 43\n          AND COALESCE(auth_identifier_key = json_extract(record_json, '$.deviceKeyId'), 0))\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n        OR\n        (kind = 'voiceid'\n          AND COALESCE(json_extract(record_json, '$.deviceKeyId') = auth_identifier_key, 0)\n          AND COALESCE(json_extract(record_json, '$.devicePublicKeyB64u') = credential_public_key_b64u, 0))\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_voiceid_key_uidx\n      ON wallet_auth_methods (\n        namespace, org_id, project_id, env_id, auth_identifier_key\n      )\n      WHERE kind = 'voiceid'\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
 export declare function ensureWalletAuthMethodStoreD1Schema(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
 export declare function walletAuthMethodId(record: WalletAuthMethodRecord): WalletAuthMethodId;
 export declare function normalizeWalletAuthMethod(raw: unknown): WalletAuthMethodRecord | null;
@@ -178,6 +183,12 @@ export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, W
     readByIdV2(input: {
         readonly walletAuthMethodId: WalletAuthMethodId;
     }): Promise<WalletAuthMethodRecordV2 | null>;
+    /** Checks the method record. Session issuance must also check its parent authority. */
+    getActiveVoiceIdV2(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly walletAuthorityId: WalletAuthorityId;
+    }): Promise<ActiveVoiceIdWalletAuthMethodRecordV2 | null>;
     getPasskeyV2(input: {
         rpId: string;
         credentialIdB64u: string;

package/dist/types/wallet-server/src/core/registrationContracts.d.ts

@@ -276,6 +276,14 @@ export type WalletRevokeAuthMethodResponse = {
         kind: typeof WALLET_AUTH_METHODS.emailOtp;
     };
     rpId?: never;
+} | {
+    ok: true;
+    walletId: WalletId;
+    authMethod: {
+        kind: 'voiceid';
+        status: 'revoked';
+    };
+    rpId?: never;
 } | {
     ok: false;
     code: string;

package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts

@@ -1,4 +1,5 @@
 import { type OwnerWalletExecutionLaneProjectionV1 } from '../../../../shared-ts/src/signing-lanes';
+import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { MpcMaterialActivationRef, ProviderSubject, WalletAuthMethodId, WalletId } from '../../../../shared-ts/src/utils/domainIds';
 import { type WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
@@ -21,6 +22,9 @@ export interface WalletExecutionLaneProjectionSource {
     }): Promise<readonly WalletSignerRecord[]>;
 }
 export type WalletExecutionLaneAuthSource = {
+    readonly kind: 'voiceid';
+    readonly deviceKeyId: DigestB64u;
+} | {
     readonly kind: 'passkey';
     readonly credentialIdB64u: string;
 } | {

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts

@@ -1,3 +1,4 @@
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type PasskeyDeviceEnvelopeIndexRecord, type PasskeyCustodyEnvelopeRecord, type WalletCustodyEnvelopeOwnership } from '../../../../../../shared-ts/src/passkey-custody';
 import { type WalletCredentialActivityRecordV1 } from '../../../../../../shared-ts/src/passkey-custody/credentialActivity';
 import type { PasskeyEnvelopeId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId, WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -45,6 +46,9 @@ export type WalletCustodyFactorRef = {
     readonly kind: 'email_otp';
     readonly enrollmentId: string;
     readonly enrollmentSealKeyVersion: string;
+} | {
+    readonly kind: 'voiceid';
+    readonly deviceKeyId: DigestB64u;
 };
 export type PasskeyCustodyEnvelopeLocator = {
     readonly walletId: WalletId;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1VoiceIdActivation.d.ts

@@ -0,0 +1,14 @@
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/d1PasskeyCustodyEnvelopeStore';
+import type { VoiceIdActivationCommand, VoiceIdActivationResult } from '../../../domains/voiceId/voiceIdActivation';
+export declare class D1VoiceIdActivation {
+    private readonly database;
+    private readonly scope;
+    private readonly authMethods;
+    private readonly envelopes;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope, authMethods: D1WalletAuthMethodStore, envelopes: CloudflareD1PasskeyCustodyEnvelopeStore);
+    activate(input: VoiceIdActivationCommand): Promise<VoiceIdActivationResult>;
+}
+//# sourceMappingURL=d1VoiceIdActivation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1VoiceIdSessions.d.ts

@@ -0,0 +1,19 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/d1PasskeyCustodyEnvelopeStore';
+import type { D1WalletAuthorityStore } from './d1WalletAuthorityStore';
+import type { VoiceIdChallengeRequest, VoiceIdChallengeResult, VoiceIdVerifyRequest, VoiceIdVerifyResult } from '../../../domains/voiceId/voiceIdSessions';
+import { D1VoiceIdWalletSessionChallenges } from './d1VoiceIdWalletSessionChallenges';
+export declare class D1VoiceIdSessions {
+    private readonly authMethods;
+    private readonly authorities;
+    private readonly envelopes;
+    private readonly challenges;
+    private readonly authorization;
+    private readonly tenantId;
+    constructor(authMethods: D1WalletAuthMethodStore, authorities: D1WalletAuthorityStore, envelopes: CloudflareD1PasskeyCustodyEnvelopeStore, challenges: D1VoiceIdWalletSessionChallenges, authorization: Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2'>, orgId: string);
+    private resolveActiveMethod;
+    issueChallenge(input: VoiceIdChallengeRequest): Promise<VoiceIdChallengeResult>;
+    verifyAndIssue(input: VoiceIdVerifyRequest): Promise<VoiceIdVerifyResult>;
+}
+//# sourceMappingURL=d1VoiceIdSessions.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.d.ts

@@ -0,0 +1,26 @@
+import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type VoiceIdWalletSessionChallenge } from '../../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { RegisteredVoiceIdDeviceKey } from '../../../../authorization/voiceIdDeviceProof';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+export declare class D1VoiceIdWalletSessionChallenges {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    issue(input: {
+        readonly registered: RegisteredVoiceIdDeviceKey;
+        readonly requestOrigin: string;
+        readonly audience: string;
+        readonly nowMs: number;
+    }): Promise<VoiceIdWalletSessionChallenge>;
+    read(input: {
+        readonly challengeId: WalletSessionMintId;
+        readonly requestOrigin: string;
+        readonly audience: string;
+        readonly nowMs: number;
+    }): Promise<VoiceIdWalletSessionChallenge | null>;
+    consume(challenge: VoiceIdWalletSessionChallenge, nowMs: number): Promise<boolean>;
+    private pruneExpired;
+    private scopeValues;
+}
+//# sourceMappingURL=d1VoiceIdWalletSessionChallenges.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -92,6 +92,7 @@ type WalletAuthMethodAuthorityResult = {
 type Sha256Bytes = (input: Uint8Array) => Promise<Uint8Array>;
 type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
 type WalletAuthMethodStoreProvider = () => D1WalletAuthMethodStore;
+export declare function isFullOwnerAuthorityV1(authority: ActiveWalletAuthorityV1): boolean;
 export declare class CloudflareD1WalletAuthMethodService {
     private readonly emailOtpChallengeVerifier;
     private readonly emailOtpEnrollmentChallengeIssuer;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationOwner.d.ts

@@ -60,6 +60,31 @@ export declare function readWalletRelocationOwner(database: D1DatabaseLike, scop
         readonly status: 'active';
         readonly activatedAtMs: number;
         readonly revokedAtMs?: undefined;
+    }) | ({
+        readonly version: 'wallet_auth_method_v2';
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+        readonly createdAtMs: number;
+        readonly updatedAtMs: number;
+    } & {
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly createdAtMs: number;
+    } & {
+        readonly kind: 'voiceid';
+        readonly deviceKeyId: DigestB64u;
+        readonly devicePublicKeyB64u: import("../../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion").VoiceIdDevicePublicKeyB64u;
+        readonly rpId?: never;
+        readonly credentialIdB64u?: never;
+        readonly credentialPublicKeyB64u?: never;
+        readonly counter?: never;
+        readonly emailHashHex?: never;
+        readonly registrationAuthorityId?: never;
+    } & {
+        readonly status: 'active';
+        readonly activatedAtMs: number;
+        readonly revokedAtMs?: undefined;
     });
     authority: {
         readonly kind: 'wallet_authority_v1';

package/dist/types/wallet-server/src/router/domains/voiceId/voiceIdActivation.d.ts

@@ -0,0 +1,29 @@
+import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
+import type { VoiceIdDevicePublicKeyB64u } from '../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveVoiceIdWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type VoiceIdSeedEnvelope } from '../../../../../shared-ts/src/passkey-custody/custodyEnvelope';
+import type { IssuedWalletSessionAuthorizationV2 } from '../../../authorization/domain';
+export type VoiceIdActivationEnvelope = VoiceIdSeedEnvelope;
+export type VoiceIdActivationOwnerSession = Readonly<{
+    authorization: IssuedWalletSessionAuthorizationV2;
+    authority: ActiveWalletAuthorityV1;
+    authMethod: ActivePasskeyWalletAuthMethodRecordV2 | ActiveEmailOtpWalletAuthMethodRecordV2;
+}>;
+export type VoiceIdActivationCommand = Readonly<{
+    source: VoiceIdActivationOwnerSession;
+    targetWalletAuthMethodId: WalletAuthMethodId;
+    devicePublicKeyB64u: VoiceIdDevicePublicKeyB64u;
+    envelope: VoiceIdActivationEnvelope;
+    nowMs: number;
+}>;
+export type VoiceIdActivationResult = {
+    readonly kind: 'activated';
+    readonly authMethod: ActiveVoiceIdWalletAuthMethodRecordV2;
+} | {
+    readonly kind: 'rejected';
+    readonly code: 'invalid_source' | 'invalid_target' | 'conflict';
+};
+/** Accepts only a method-bound owner seed envelope for the new VoiceID method. */
+export declare function parseVoiceIdActivationEnvelope(raw: unknown): VoiceIdActivationEnvelope;
+//# sourceMappingURL=voiceIdActivation.d.ts.map

package/dist/types/wallet-server/src/router/domains/voiceId/voiceIdSessions.d.ts

@@ -0,0 +1,35 @@
+import type { VoiceIdDeviceAssertion, VoiceIdWalletSessionChallenge } from '../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { WalletAuthMethodId, WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { VoiceIdSeedEnvelope } from '../../../../../shared-ts/src/passkey-custody/custodyEnvelope';
+import type { DirectV2IssueResult, IssuedWalletSessionAuthorizationV2 } from '../../../authorization/domain';
+import type { SessionOrigin } from '../../../authorization/domain';
+export type VoiceIdChallengeRequest = Readonly<{
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    requestOrigin: SessionOrigin;
+    nowMs: number;
+}>;
+export type VoiceIdChallengeResult = {
+    readonly kind: 'issued';
+    readonly challenge: VoiceIdWalletSessionChallenge;
+} | {
+    readonly kind: 'rejected';
+    readonly code: 'method_unavailable';
+};
+export type VoiceIdVerifyRequest = Readonly<{
+    assertion: VoiceIdDeviceAssertion;
+    requestOrigin: SessionOrigin;
+    nowMs: number;
+}>;
+export type VoiceIdVerifyResult = {
+    readonly kind: 'issued';
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly operationCredential: Extract<DirectV2IssueResult, {
+        readonly kind: 'issued';
+    }>['operationCredential'];
+    readonly custodyEnvelope: VoiceIdSeedEnvelope;
+} | {
+    readonly kind: 'rejected';
+    readonly code: 'challenge_unavailable' | 'method_unavailable' | 'invalid_assertion' | 'issuance_unavailable';
+};
+//# sourceMappingURL=voiceIdSessions.d.ts.map

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1075,6 +1075,7 @@ interface RouterApiWalletAuthVerificationService {
     verifyWebAuthnAuthenticationLite(input: RouterApiMethodTypes['verifyWebAuthnAuthenticationLite']['input']): Promise<RouterApiMethodTypes['verifyWebAuthnAuthenticationLite']['result']>;
 }
 export interface RouterApiWalletAuthMethodService {
+    activateVoiceId(input: import('../domains/voiceId/voiceIdActivation').VoiceIdActivationCommand): Promise<import('../domains/voiceId/voiceIdActivation').VoiceIdActivationResult>;
     resolveActiveWalletSessionAuthority(input: {
         readonly walletId: WalletId;
         readonly authorityRef: WalletAuthAuthorityRef;
@@ -1204,6 +1205,8 @@ export interface RouterApiWalletRegistrationRouteService extends RouterApiWallet
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
 }
 export interface RouterApiWalletUnlockService {
+    issueVoiceIdChallenge(input: import('../domains/voiceId/voiceIdSessions').VoiceIdChallengeRequest): Promise<import('../domains/voiceId/voiceIdSessions').VoiceIdChallengeResult>;
+    verifyAndIssueVoiceId(input: import('../domains/voiceId/voiceIdSessions').VoiceIdVerifyRequest): Promise<import('../domains/voiceId/voiceIdSessions').VoiceIdVerifyResult>;
     createEmailOtpUnlockChallenge(input: RouterApiMethodTypes['createEmailOtpUnlockChallenge']['input']): Promise<RouterApiMethodTypes['createEmailOtpUnlockChallenge']['result']>;
     createWebAuthnLoginOptions(input: RouterApiMethodTypes['createWebAuthnLoginOptions']['input']): Promise<RouterApiMethodTypes['createWebAuthnLoginOptions']['result']>;
     markEmailOtpStrongAuthSatisfied(input: RouterApiMethodTypes['markEmailOtpStrongAuthSatisfied']['input']): Promise<RouterApiMethodTypes['markEmailOtpStrongAuthSatisfied']['result']>;

package/dist/types/wallet-server/src/router/transport/fetch/routes/walletVoiceIdActivation.d.ts

@@ -0,0 +1,12 @@
+import type { RouterApiAuthorizationSessionService, RouterApiWalletAuthMethodService } from '../../../framework/authServicePort';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function hostedWalletOriginAllowed(request: Request, allowedOrigins: readonly (string | undefined)[]): boolean;
+export type VoiceIdActivationRouteDependencies = Readonly<{
+    tenantId: RouterApiAuthorizationSessionService['tenantId'];
+    readWalletSessionAuthorizationV2ByOperationCredential: RouterApiAuthorizationSessionService['readWalletSessionAuthorizationV2ByOperationCredential'];
+    activateVoiceId: RouterApiWalletAuthMethodService['activateVoiceId'];
+    hostedWalletOrigins: readonly (string | undefined)[];
+}>;
+export declare function handleWalletVoiceIdActivation(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleVoiceIdActivationRequest(request: Request, deps: VoiceIdActivationRouteDependencies): Promise<Response>;
+//# sourceMappingURL=walletVoiceIdActivation.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/walletVoiceIdNear.d.ts

@@ -0,0 +1,14 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import type { VoiceIdVerifyResult } from '../../../domains/voiceId/voiceIdSessions';
+import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+export type VoiceIdNearInstallation = {
+    readonly kind: 'unavailable';
+} | {
+    readonly kind: 'ready';
+    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+    readonly remainingUses: number;
+};
+export declare function prepareVoiceIdNearInstallation(ctx: FetchRouterApiContext, verified: Extract<VoiceIdVerifyResult, {
+    kind: 'issued';
+}>): Promise<VoiceIdNearInstallation>;
+//# sourceMappingURL=walletVoiceIdNear.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/walletVoiceIdSessions.d.ts

@@ -0,0 +1,19 @@
+import type { RouterApiWalletUnlockService } from '../../../framework/authServicePort';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import { type VoiceIdNearInstallation } from './walletVoiceIdNear';
+import type { VoiceIdVerifyResult } from '../../../domains/voiceId/voiceIdSessions';
+type HostedVoiceIdRoute = Readonly<{
+    hostedWalletOrigins: readonly (string | undefined)[];
+}>;
+export type VoiceIdChallengeRouteDependencies = HostedVoiceIdRoute & Pick<RouterApiWalletUnlockService, 'issueVoiceIdChallenge'>;
+export type VoiceIdVerifyRouteDependencies = HostedVoiceIdRoute & Pick<RouterApiWalletUnlockService, 'verifyAndIssueVoiceId'> & {
+    prepareNear(verified: Extract<VoiceIdVerifyResult, {
+        kind: 'issued';
+    }>): Promise<VoiceIdNearInstallation>;
+};
+export declare function handleWalletVoiceIdChallenge(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletVoiceIdVerify(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleVoiceIdChallengeRequest(request: Request, deps: VoiceIdChallengeRouteDependencies): Promise<Response>;
+export declare function handleVoiceIdVerifyRequest(request: Request, deps: VoiceIdVerifyRouteDependencies): Promise<Response>;
+export {};
+//# sourceMappingURL=walletVoiceIdSessions.d.ts.map

package/migrations/d1-signer/0083_voiceid_wallet_session_challenges.sql

@@ -0,0 +1,29 @@
+CREATE TABLE voiceid_wallet_session_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  wallet_auth_method_id TEXT NOT NULL,
+  challenge_json TEXT NOT NULL CHECK(json_valid(challenge_json)),
+  issued_at_ms INTEGER NOT NULL CHECK(issued_at_ms > 0 AND issued_at_ms <= 9007199254740991),
+  expires_at_ms INTEGER NOT NULL,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY(namespace, org_id, project_id, env_id, challenge_id),
+  CHECK(length(challenge_id) > 0 AND length(wallet_id) > 0 AND length(wallet_auth_method_id) > 0),
+  CHECK(expires_at_ms > issued_at_ms AND expires_at_ms - issued_at_ms <= 60000),
+  CHECK(consumed_at_ms IS NULL OR
+    (consumed_at_ms >= issued_at_ms AND consumed_at_ms < expires_at_ms)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.kind') = 'voiceid_wallet_session_challenge_v1', 0)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.challengeId') = challenge_id, 0)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.walletId') = wallet_id, 0)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.walletAuthMethodId') = wallet_auth_method_id, 0)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.issuedAtMs') = issued_at_ms, 0)),
+  CHECK(COALESCE(json_extract(challenge_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+
+CREATE INDEX voiceid_wallet_session_challenges_expiry
+  ON voiceid_wallet_session_challenges(
+    namespace, org_id, project_id, env_id, expires_at_ms
+  );