@seams/wallet-server 0.23.0 → 0.25.0

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -891,6 +891,11 @@ async function recordFreshExportProof(args) {
 	let challengeId = null;
 	let assertionDigest = null;
 	switch (args.authority.factor.kind) {
+		case "voiceid": return authorizationFailure({
+			status: 403,
+			code: "export_authorization_invalid",
+			message: "Use a passkey or Email OTP to export keys."
+		});
 		case "passkey":
 			factorId = parseAuthFactorId(`passkey:${args.authority.factor.credentialIdB64u}`);
 			try {

package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js

@@ -21,6 +21,7 @@ function sameWalletCustodyRecoveryReplacementEnvelopeV1(left, right) {
 	switch (left.factor.kind) {
 		case "passkey": return right.factor.kind === "passkey" && left.factor.rpId === right.factor.rpId && left.factor.credentialIdB64u === right.factor.credentialIdB64u && left.factor.kekVersion === right.factor.kekVersion;
 		case "email_otp": return right.factor.kind === "email_otp" && left.factor.enrollmentId === right.factor.enrollmentId && left.factor.enrollmentSealKeyVersion === right.factor.enrollmentSealKeyVersion && left.factor.kekVersion === right.factor.kekVersion;
+		case "voiceid": return right.factor.kind === "voiceid" && left.factor.deviceKeyId === right.factor.deviceKeyId && left.factor.kekVersion === right.factor.kekVersion;
 		default: return assertNeverWalletRecoveryFinalizationBranch(left.factor, "custody envelope factor");
 	}
 }

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js

@@ -75,6 +75,7 @@ function runtimePolicyScopeKey(scope) {
 }
 function ed25519AdmissionAuthorityScopeKey(scope) {
 	switch (scope.kind) {
+		case "voiceid": return `voiceid:${scope.deviceKeyId}`;
 		case "passkey_rp": return `passkey_rp:${scope.rpId}`;
 		case "email_otp": return `email_otp:${scope.provider}:${scope.providerUserId}`;
 	}

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -199,6 +199,7 @@ function isActiveOwnerLane(lane) {
 	if (lane.lifecycle.state !== "active") return false;
 	switch (lane.laneKind) {
 		case "owner_passkey":
+		case "owner_voiceid":
 		case "owner_email_otp":
 		case "recovery":
 		case "break_glass": return true;

package/dist/esm/router/domains/voiceId/voiceIdActivation.js

@@ -0,0 +1,12 @@
+import { isVoiceIdSeedEnvelope, parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+//#region src/router/domains/voiceId/voiceIdActivation.ts
+/** Accepts only a method-bound owner seed envelope for the new VoiceID method. */
+function parseVoiceIdActivationEnvelope(raw) {
+	const envelope = parsePasskeyCustodyEnvelopeRecord(raw);
+	if (!isVoiceIdSeedEnvelope(envelope) || Number(envelope.envelopeRevision) !== 1) throw new Error("VoiceID activation requires an active, method-bound wallet seed envelope");
+	return envelope;
+}
+//#endregion
+export { parseVoiceIdActivationEnvelope };
+
+//# sourceMappingURL=voiceIdActivation.js.map

package/dist/esm/router/framework/routeDefinitions.js

@@ -45,6 +45,7 @@ const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 ];
 const ROUTER_API_LINKED_DEVICE_PASSKEY_SERVICES = ["publishableKeyAuth"];
 const ROUTER_API_WALLET_UNLOCK_SERVICES = ["walletUnlock"];
+const ROUTER_API_VOICEID_ACTIVATION_SERVICES = ["session", "walletAuthMethods"];
 const ROUTER_API_HOSTED_SESSION_EXCHANGE_SERVICES = ["session"];
 const ROUTER_API_EMAIL_OTP_PUBLIC_SERVICES = ["emailOtp"];
 const ROUTER_API_EMAIL_OTP_CHALLENGE_SERVICES = ["emailOtp", "walletAuthMethods"];
@@ -420,6 +421,18 @@ function createRouterApiRouteDefinitions(options = {}) {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock verification is intentionally public because the challenge proof is the gate."
+	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_voiceid_activate", "POST", "/wallet/voiceid/activate", "Activate a device-bound VoiceID method under an owner Wallet Session", {
+		plane: "public",
+		proof: "challenge_exchange",
+		rationale: "An active full-owner Wallet Session and the hosted wallet origin authorize activation."
+	}, ROUTER_API_VOICEID_ACTIVATION_SERVICES), publicRoute("wallet_voiceid_challenge", "POST", "/wallet/voiceid/challenge", "Issue a device-bound VoiceID Wallet Session challenge", {
+		plane: "public",
+		proof: "challenge_exchange",
+		rationale: "An active method receives a short-lived challenge bound to the hosted wallet origin."
+	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_voiceid_verify", "POST", "/wallet/voiceid/verify", "Verify a VoiceID device assertion and issue a Wallet Session", {
+		plane: "public",
+		proof: "signed_payload",
+		rationale: "The registered device signature and single-use server challenge authorize issuance."
 	}, ROUTER_API_WALLET_UNLOCK_SERVICES), publicRoute("wallet_email_otp_challenge", "POST", "/wallet/email-otp/challenge", "Create an operation-bound Email OTP challenge", {
 		plane: "public",
 		proof: "challenge_exchange",

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -10,6 +10,8 @@ import { coerceRouterLogger } from "../../framework/logger.js";
 import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
 import { handleWalletRegistration } from "./routes/walletRegistration.js";
+import { handleWalletVoiceIdActivation } from "./routes/walletVoiceIdActivation.js";
+import { handleWalletVoiceIdChallenge, handleWalletVoiceIdVerify } from "./routes/walletVoiceIdSessions.js";
 import { handlePasskeyCustody, handleWalletCustodyCredentialLabel, handleWalletCustodyCredentialsList, handleWalletCustodyEmailOtpChallenge, handleWalletCustodyEnvelopeOwnershipUpgrade, handleWalletRecoveryBackupAcknowledge, handleWalletRecoveryEmailOtpRelease, handleWalletRecoveryEmailOtpVerify, handleWalletRecoveryFinalize, handleWalletRecoveryGoogleEmailOtpFinalize, handleWalletRecoveryGoogleVerify, handleWalletRecoveryPrepare, handleWalletRecoveryRead, handleWalletRecoveryRotate, handleWalletRecoveryStatus } from "./routes/passkeyCustody.js";
 import { handleThresholdEcdsa } from "./routes/thresholdEcdsa.js";
 import { handleExactWalletSessionStatus, handleHostedWalletSessionExchangeIssue, handleHostedWalletSessionExchangeRedeem, handleWalletEmailOtpChallenge, handleWalletEmailOtpDevCleanupGoogleRegistration, handleWalletEmailOtpDevOutbox, handleWalletEmailOtpFactorRelease, handleWalletEmailOtpRegistrationSeal, handleWalletUnlockChallenge, handleWalletUnlockVerify } from "./routes/sessions.js";
@@ -234,6 +236,9 @@ function createFetchRouter(service, opts, runtime) {
 		handleHostedWalletSessionExchangeRedeem,
 		handleWalletUnlockChallenge,
 		handleWalletUnlockVerify,
+		handleWalletVoiceIdActivation,
+		handleWalletVoiceIdChallenge,
+		handleWalletVoiceIdVerify,
 		handleWalletEmailOtpChallenge,
 		handleWalletEmailOtpFactorRelease,
 		handleWalletEmailOtpDevCleanupGoogleRegistration,

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,7 +1,7 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
 import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, buildVoiceIdWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
@@ -203,6 +203,17 @@ function walletAuthAuthorityFromExactV2MethodV1(input) {
 	} catch {
 		return null;
 	}
+	if (input.authMethod.kind === "voiceid") return {
+		authority: buildVoiceIdWalletAuthAuthority({
+			walletId: input.walletId,
+			walletAuthMethodId: input.authMethod.walletAuthMethodId,
+			deviceKeyId: input.authMethod.deviceKeyId
+		}),
+		authSource: {
+			kind: "voiceid",
+			deviceKeyId: input.authMethod.deviceKeyId
+		}
+	};
 	const providerSubject = parseProviderSubject(input.principalId);
 	if (!providerSubject.ok) return null;
 	try {

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -116,6 +116,7 @@ function serializeProjection(value) {
 	const lane = value.lane;
 	switch (lane.laneKind) {
 		case "owner_passkey":
+		case "owner_voiceid":
 		case "owner_email_otp": return {
 			kind: value.kind,
 			walletKey: serializeWalletKey(value.walletKey),

package/dist/esm/router/transport/fetch/routes/walletVoiceIdActivation.js

@@ -0,0 +1,139 @@
+import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../../../shared-ts/src/utils/exactRecord.js";
+import { parseVoiceIdDevicePublicKeyB64u } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
+import { parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../../authorization/domain.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
+import { parseVoiceIdActivationEnvelope } from "../../../domains/voiceId/voiceIdActivation.js";
+//#region src/router/transport/fetch/routes/walletVoiceIdActivation.ts
+const ACTIVATION_FIELDS = [
+	"targetWalletAuthMethodId",
+	"devicePublicKeyB64u",
+	"custodyEnvelope"
+];
+function hostedWalletOriginAllowed(request, allowedOrigins) {
+	const rawOrigin = request.headers.get("origin");
+	let requestOrigin;
+	try {
+		requestOrigin = parseSessionOrigin(rawOrigin);
+	} catch {
+		return false;
+	}
+	for (const allowed of allowedOrigins) try {
+		if (parseSessionOrigin(allowed) === requestOrigin) return true;
+	} catch {
+		continue;
+	}
+	return false;
+}
+function parseActivationBody(raw) {
+	const body = requireRecord(raw, "VoiceID activation");
+	rejectUnknownFields(body, ACTIVATION_FIELDS, "VoiceID activation");
+	const target = parseWalletAuthMethodId(body.targetWalletAuthMethodId);
+	if (!target.ok) throw new Error(target.error.message);
+	return {
+		targetWalletAuthMethodId: target.value,
+		devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(body.devicePublicKeyB64u),
+		envelope: parseVoiceIdActivationEnvelope(body.custodyEnvelope)
+	};
+}
+function rejectionStatus(code) {
+	switch (code) {
+		case "invalid_source": return 403;
+		case "invalid_target": return 400;
+		case "conflict": return 409;
+		default: {
+			const unexpected = code;
+			throw new Error(`Unsupported VoiceID activation rejection: ${unexpected}`);
+		}
+	}
+}
+async function handleWalletVoiceIdActivation(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/activate") return null;
+	return await handleVoiceIdActivationRequest(ctx.request, {
+		tenantId: ctx.service.authorizationSessions.tenantId,
+		readWalletSessionAuthorizationV2ByOperationCredential: ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential,
+		activateVoiceId: ctx.service.walletAuthMethods.activateVoiceId,
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleVoiceIdActivationRequest(request, deps) {
+	if (!hostedWalletOriginAllowed(request, deps.hostedWalletOrigins)) return json({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	const credential = extractBearerCredential(request.headers);
+	if (!credential) return json({
+		ok: false,
+		code: "unauthorized"
+	}, { status: 401 });
+	let token;
+	try {
+		token = parsePrimaryWalletSessionOperationCredentialToken(credential);
+	} catch {
+		return json({
+			ok: false,
+			code: "unauthorized"
+		}, { status: 401 });
+	}
+	const nowMs = Date.now();
+	let source;
+	try {
+		source = await deps.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: deps.tenantId,
+			token,
+			nowMs
+		});
+	} catch {
+		return json({
+			ok: false,
+			code: "wallet_session_unavailable"
+		}, { status: 503 });
+	}
+	if (!source || source.retiredAtMs !== null || source.authMethod.status !== "active" || source.authMethod.kind !== "passkey" && source.authMethod.kind !== "email_otp") return json({
+		ok: false,
+		code: "unauthorized"
+	}, { status: 401 });
+	let parsedBody;
+	try {
+		parsedBody = parseActivationBody(await readJson(request));
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID activation body is invalid"
+		}, { status: 400 });
+	}
+	let result;
+	try {
+		result = await deps.activateVoiceId({
+			source: {
+				authorization: source.authorization,
+				authority: source.authority,
+				authMethod: source.authMethod
+			},
+			targetWalletAuthMethodId: parsedBody.targetWalletAuthMethodId,
+			devicePublicKeyB64u: parsedBody.devicePublicKeyB64u,
+			envelope: parsedBody.envelope,
+			nowMs
+		});
+	} catch {
+		return json({
+			ok: false,
+			code: "activation_unavailable"
+		}, { status: 503 });
+	}
+	if (result.kind === "rejected") return json({
+		ok: false,
+		code: result.code
+	}, { status: rejectionStatus(result.code) });
+	return json({
+		ok: true,
+		authMethod: result.authMethod
+	}, { status: 200 });
+}
+//#endregion
+export { handleVoiceIdActivationRequest, handleWalletVoiceIdActivation, hostedWalletOriginAllowed };
+
+//# sourceMappingURL=walletVoiceIdActivation.js.map

package/dist/esm/router/transport/fetch/routes/walletVoiceIdNear.js

@@ -0,0 +1,36 @@
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+//#region src/router/transport/fetch/routes/walletVoiceIdNear.ts
+async function prepareVoiceIdNearInstallation(ctx, verified) {
+	const session = verified.authorization.session;
+	const activation = session.capabilitySubjects.find(isNearSignSubject);
+	if (!activation || activation.kind !== "sign") return { kind: "unavailable" };
+	const resolved = await ctx.service.walletRegistration.resolveEd25519MaterialActivation({
+		walletId: session.walletId,
+		materialActivation: routerAbMpcMaterialActivationRefToWire(activation.materialActivation)
+	});
+	if (!resolved.ok) throw new Error(resolved.message);
+	const product = ctx.opts.routerAbEd25519YaoProduct;
+	if (!product) throw new Error("NEAR signing is not configured");
+	const capability = await product.resolveActiveCapability({
+		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+		walletId: session.walletId,
+		nearEd25519SigningKeyId: resolved.exportIdentity.application_binding.near_ed25519_signing_key_id,
+		signerSlot: resolved.signerSlot,
+		signingWorkerId: resolved.signingWorkerId,
+		participantIds: resolved.participantIds
+	});
+	if (!capability.ok) throw new Error(capability.message);
+	if (!sameRouterAbMpcMaterialActivationRef(capability.capability.materialActivation, resolved.materialActivation)) throw new Error("NEAR capability does not belong to this Wallet Session");
+	return {
+		kind: "ready",
+		capability: capability.capability,
+		remainingUses: verified.authorization.quota.remainingUses
+	};
+}
+function isNearSignSubject(subject) {
+	return subject.kind === "sign" && subject.keyFamily === "ed25519";
+}
+//#endregion
+export { prepareVoiceIdNearInstallation };
+
+//# sourceMappingURL=walletVoiceIdNear.js.map

package/dist/esm/router/transport/fetch/routes/walletVoiceIdSessions.js

@@ -0,0 +1,127 @@
+import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../../../shared-ts/src/utils/exactRecord.js";
+import { parseVoiceIdDeviceAssertion } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
+import { parseSessionOrigin, projectActiveWalletSession } from "../../../../authorization/domain.js";
+import { json, readJson } from "../../../framework/http.js";
+import { hostedWalletOriginAllowed } from "./walletVoiceIdActivation.js";
+import { prepareVoiceIdNearInstallation } from "./walletVoiceIdNear.js";
+//#region src/router/transport/fetch/routes/walletVoiceIdSessions.ts
+function hostedOrigin(request, allowedOrigins) {
+	if (!hostedWalletOriginAllowed(request, allowedOrigins)) return null;
+	return parseSessionOrigin(request.headers.get("origin"));
+}
+function parseChallengeBody(raw) {
+	const body = requireRecord(raw, "VoiceID challenge");
+	rejectUnknownFields(body, ["walletId", "walletAuthMethodId"], "VoiceID challenge");
+	const walletId = parseWalletId(body.walletId);
+	if (!walletId.ok) throw new Error(walletId.error.message);
+	const walletAuthMethodId = parseWalletAuthMethodId(body.walletAuthMethodId);
+	if (!walletAuthMethodId.ok) throw new Error(walletAuthMethodId.error.message);
+	return {
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value
+	};
+}
+async function handleWalletVoiceIdChallenge(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/challenge") return null;
+	return await handleVoiceIdChallengeRequest(ctx.request, {
+		issueVoiceIdChallenge: ctx.service.walletUnlock.issueVoiceIdChallenge,
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleWalletVoiceIdVerify(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/voiceid/verify") return null;
+	return await handleVoiceIdVerifyRequest(ctx.request, {
+		verifyAndIssueVoiceId: ctx.service.walletUnlock.verifyAndIssueVoiceId,
+		prepareNear: prepareVoiceIdNearInstallation.bind(null, ctx),
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? []
+	});
+}
+async function handleVoiceIdChallengeRequest(request, deps) {
+	const requestOrigin = hostedOrigin(request, deps.hostedWalletOrigins);
+	if (!requestOrigin) return json({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	let body;
+	try {
+		body = parseChallengeBody(await readJson(request));
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID challenge body is invalid"
+		}, { status: 400 });
+	}
+	try {
+		const result = await deps.issueVoiceIdChallenge({
+			walletId: body.walletId,
+			walletAuthMethodId: body.walletAuthMethodId,
+			requestOrigin,
+			nowMs: Date.now()
+		});
+		if (result.kind === "rejected") return json({
+			ok: false,
+			code: result.code
+		}, { status: 403 });
+		return json({
+			ok: true,
+			challenge: result.challenge
+		}, { status: 200 });
+	} catch {
+		return json({
+			ok: false,
+			code: "challenge_unavailable"
+		}, { status: 503 });
+	}
+}
+async function handleVoiceIdVerifyRequest(request, deps) {
+	const requestOrigin = hostedOrigin(request, deps.hostedWalletOrigins);
+	if (!requestOrigin) return json({
+		ok: false,
+		code: "origin_mismatch"
+	}, { status: 403 });
+	let assertion;
+	try {
+		const body = requireRecord(await readJson(request), "VoiceID verification");
+		rejectUnknownFields(body, ["assertion"], "VoiceID verification");
+		assertion = parseVoiceIdDeviceAssertion(body.assertion);
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "VoiceID assertion is invalid"
+		}, { status: 400 });
+	}
+	try {
+		const result = await deps.verifyAndIssueVoiceId({
+			assertion,
+			requestOrigin,
+			nowMs: Date.now()
+		});
+		if (result.kind === "rejected") {
+			const status = result.code === "issuance_unavailable" ? 503 : 403;
+			return json({
+				ok: false,
+				code: result.code
+			}, { status });
+		}
+		return json({
+			ok: true,
+			walletSession: projectActiveWalletSession(result.authorization),
+			operationCredential: result.operationCredential,
+			custodyEnvelope: result.custodyEnvelope,
+			near: await deps.prepareNear(result)
+		}, { status: 200 });
+	} catch {
+		return json({
+			ok: false,
+			code: "verification_unavailable"
+		}, { status: 503 });
+	}
+}
+//#endregion
+export { handleVoiceIdChallengeRequest, handleVoiceIdVerifyRequest, handleWalletVoiceIdChallenge, handleWalletVoiceIdVerify };
+
+//# sourceMappingURL=walletVoiceIdSessions.js.map

package/dist/esm/shared-ts/src/authorization/voiceIdDeviceAssertion.js

@@ -0,0 +1,110 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
+import { parseWalletSessionMintId } from "./capabilityKinds.js";
+import { isPlainObject } from "../utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+//#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+const CHALLENGE_DOMAIN = "seams:wallet-session:voiceid-device:v1";
+const MAXIMUM_CHALLENGE_MS = 6e4;
+function parseVoiceIdDevicePublicKeyB64u(value) {
+	if (typeof value !== "string") throw new Error("VoiceID public key is invalid");
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+	return value;
+}
+function exactKeys(value, keys) {
+	if (Object.keys(value).length !== keys.length) return false;
+	for (const key of keys) if (!Object.hasOwn(value, key)) return false;
+	return true;
+}
+function requireOrigin(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be an origin`);
+	let origin;
+	let protocol;
+	try {
+		const parsed = new URL(value);
+		origin = parsed.origin;
+		protocol = parsed.protocol;
+	} catch {
+		throw new Error(`${label} must be an origin`);
+	}
+	if (origin !== value || protocol !== "http:" && protocol !== "https:") throw new Error(`${label} must be a canonical HTTP origin`);
+	return origin;
+}
+function requireWindow(issuedAtMs, expiresAtMs) {
+	if (!Number.isSafeInteger(issuedAtMs) || !Number.isSafeInteger(expiresAtMs) || Number(issuedAtMs) <= 0 || Number(expiresAtMs) <= Number(issuedAtMs) || Number(expiresAtMs) - Number(issuedAtMs) > MAXIMUM_CHALLENGE_MS) throw new Error("VoiceID challenge has an invalid validity window");
+}
+function buildVoiceIdWalletSessionChallenge(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	requireOrigin(fields.audience, "VoiceID audience");
+	return {
+		kind: "voiceid_wallet_session_challenge_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		challengeId: fields.challengeId,
+		nonce: fields.nonce,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdWalletSessionChallenge(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"challengeId",
+		"nonce",
+		"requestOrigin",
+		"audience",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_wallet_session_challenge_v1") throw new Error("Invalid VoiceID Wallet Session challenge");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	const challengeId = parseWalletSessionMintId(raw.challengeId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !challengeId.ok) throw new Error("VoiceID challenge identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID challenge times must be numbers");
+	return buildVoiceIdWalletSessionChallenge({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		challengeId: challengeId.value,
+		nonce: parseDigestB64u(raw.nonce),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		audience: requireOrigin(raw.audience, "VoiceID audience"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdDeviceAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"challenge",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_device_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID device assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_device_assertion_v1",
+		challenge: parseVoiceIdWalletSessionChallenge(raw.challenge),
+		signatureB64u: raw.signatureB64u
+	};
+}
+function voiceIdWalletSessionChallengeBytes(challenge) {
+	const payload = alphabetizeStringify(challenge);
+	return new TextEncoder().encode(`${CHALLENGE_DOMAIN}|${payload}`);
+}
+//#endregion
+export { buildVoiceIdWalletSessionChallenge, parseVoiceIdDeviceAssertion, parseVoiceIdDevicePublicKeyB64u, parseVoiceIdWalletSessionChallenge, voiceIdWalletSessionChallengeBytes };
+
+//# sourceMappingURL=voiceIdDeviceAssertion.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -1,6 +1,7 @@
 import { wireLiteral, wireObject } from "../utils/wireSchema.js";
 import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import "./activeWalletSession.js";
+import "../utils/walletAuthMethodRecord.js";
 import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
 import "./walletSessionCredentialDelivery.js";
 //#region ../shared-ts/src/device-linking/authorityActivation.ts

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -16,7 +16,7 @@ function parseCommittedAuthorityPackagesV1(raw) {
 	const authority = parseWalletAuthorityV1(record.authority);
 	if (!authority.ok || authority.value.state !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
 	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-	if (!authMethod || authMethod.status !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
+	if (!authMethod || authMethod.status !== "pending_local_install" || authMethod.kind === "voiceid") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
 	if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) throw new Error("CommittedAuthorityPackagesV1 authority and auth method identities differ");
 	const signerPackages = parseCommittedSignerPackageSetV1(record.signerPackages);
 	assertSignerPackagesMatchAuthority(signerPackages, authority.value.signerActivations);

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -7,6 +7,13 @@ import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+const VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
+function isActiveMethodBoundWalletSeedEnvelope(envelope) {
+	return envelope.ownership.kind === "method_bound" && envelope.binding.kind === "wallet_custody_seed_v1" && envelope.lifecycle.state === "active";
+}
+function isVoiceIdSeedEnvelope(envelope) {
+	return isActiveMethodBoundWalletSeedEnvelope(envelope) && envelope.factor.kind === "voiceid";
+}
 const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
@@ -67,6 +74,13 @@ function buildEmailOtpEnvelopeFactor(args) {
 		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
 	};
 }
+function buildVoiceIdEnvelopeFactor(args) {
+	return {
+		kind: "voiceid",
+		deviceKeyId: args.deviceKeyId,
+		kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+	};
+}
 function buildActiveEnvelopeLifecycle(args) {
 	return {
 		state: "active",
@@ -153,7 +167,16 @@ const EMAIL_OTP_FACTOR_FIELDS = [
 	"enrollmentSealKeyVersion",
 	"kekVersion"
 ];
-const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+const VOICEID_FACTOR_FIELDS = [
+	"kind",
+	"deviceKeyId",
+	"kekVersion"
+];
+const ALL_FACTOR_FIELDS = Array.from(new Set([
+	...PASSKEY_FACTOR_FIELDS,
+	...EMAIL_OTP_FACTOR_FIELDS,
+	...VOICEID_FACTOR_FIELDS
+]));
 function requireNonEmptyString(value, label) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
 	return value;
@@ -180,7 +203,11 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
 				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
 				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
 			});
-		default: throw new Error(`${label}.kind must be passkey or email_otp`);
+		case "voiceid":
+			rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+			if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+			return buildVoiceIdEnvelopeFactor({ deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`) });
+		default: throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
 	}
 }
 const ENVELOPE_RECORD_FIELDS = [
@@ -269,6 +296,6 @@ function admitWalletCustodyEnvelopeOwnershipReplacementV1(input) {
 	}
 }
 //#endregion
-export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, admitWalletCustodyEnvelopeOwnershipReplacementV1, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
+export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, admitWalletCustodyEnvelopeOwnershipReplacementV1, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, buildVoiceIdEnvelopeFactor, isActiveMethodBoundWalletSeedEnvelope, isVoiceIdSeedEnvelope, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
 
 //# sourceMappingURL=custodyEnvelope.js.map

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -172,6 +172,6 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 	}
 }
 //#endregion
-export { buildEd25519YaoClientRootBinding, parsePasskeyCustodySecretBinding };
+export { buildEd25519YaoClientRootBinding, buildWalletCustodySeedBinding, parsePasskeyCustodySecretBinding };
 
 //# sourceMappingURL=custodySecretBinding.js.map