@seams/wallet-server 0.23.0 → 0.25.0

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -136,7 +136,21 @@ function buildOwnerEmailOtpSigningLaneRecord(args) {
 		lifecycle: args.lifecycle
 	};
 }
+function buildOwnerVoiceIdSigningLaneRecord(args) {
+	return {
+		kind: "signing_lane_reference_v1",
+		walletId: args.walletId,
+		walletKeyId: args.walletKeyId,
+		laneId: args.laneId,
+		laneKind: "owner_voiceid",
+		laneShareEpoch: args.laneShareEpoch,
+		participantBindingDigestB64u: args.participantBindingDigestB64u,
+		walletAuthMethodId: args.walletAuthMethodId,
+		ownerParticipantContinuity: args.ownerParticipantContinuity,
+		lifecycle: args.lifecycle
+	};
+}
 //#endregion
-export { buildActiveSigningLaneLifecycle, buildActiveWalletKeyLifecycle, buildEd25519WalletKeyRecord, buildEvmFamilyWalletKeyRecord, buildOwnerEmailOtpSigningLaneRecord, buildOwnerPasskeySigningLaneRecord, parseWalletKeyVersion };
+export { buildActiveSigningLaneLifecycle, buildActiveWalletKeyLifecycle, buildEd25519WalletKeyRecord, buildEvmFamilyWalletKeyRecord, buildOwnerEmailOtpSigningLaneRecord, buildOwnerPasskeySigningLaneRecord, buildOwnerVoiceIdSigningLaneRecord, parseWalletKeyVersion };
 
 //# sourceMappingURL=recordParsers.js.map

package/dist/esm/shared-ts/src/threshold/sessionPolicy.js

@@ -1,9 +1,10 @@
 //#region ../shared-ts/src/threshold/sessionPolicy.ts
 const DEFAULT_WALLET_SESSION_TTL_MS = 1440 * 6e4;
 const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
+const LINKED_DEVICE_WALLET_SESSION_TTL_MS = 900 * 1e3;
 const MAX_WALLET_SESSION_TTL_MS = 720 * 60 * 6e4;
 const MAX_WALLET_SESSION_REMAINING_USES = 1e6;
 //#endregion
-export { DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS };
+export { DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS };
 
 //# sourceMappingURL=sessionPolicy.js.map

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -35,16 +35,14 @@ function normalizeAddAuthMethodIntentCaller(raw) {
 	if (!source) return null;
 	const walletAuthorityId = parseWalletAuthorityId("walletAuthorityId" in source ? source.walletAuthorityId : void 0);
 	const walletAuthMethodId = parseWalletAuthMethodId("walletAuthMethodId" in source ? source.walletAuthMethodId : void 0);
-	const walletSessionId = trimString("walletSessionId" in source ? source.walletSessionId : void 0);
 	const authorityDigestB64u = trimString("authorityDigestB64u" in source ? source.authorityDigestB64u : void 0);
 	const revocationEpoch = "revocationEpoch" in source ? source.revocationEpoch : void 0;
-	if (!walletAuthorityId.ok || !walletAuthMethodId.ok || !walletSessionId || !authorityDigestB64u || typeof revocationEpoch !== "number" || !Number.isSafeInteger(revocationEpoch) || revocationEpoch < 0) return null;
+	if (!walletAuthorityId.ok || !walletAuthMethodId.ok || !authorityDigestB64u || typeof revocationEpoch !== "number" || !Number.isSafeInteger(revocationEpoch) || revocationEpoch < 0) return null;
 	return {
 		caller: "same_device_addition",
 		source: {
 			walletAuthorityId: walletAuthorityId.value,
 			walletAuthMethodId: walletAuthMethodId.value,
-			walletSessionId,
 			authorityDigestB64u,
 			revocationEpoch
 		}

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,8 +1,25 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
+import { requireRecord } from "./validation.js";
+import { rejectUnknownFields } from "./exactRecord.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import { parseDigestB64u } from "./canonicalPrimitives.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
+function buildVoiceIdWalletAuthAuthority(input) {
+	return {
+		walletId: input.walletId,
+		bindingId: input.walletAuthMethodId,
+		factor: {
+			kind: "voiceid",
+			deviceKeyId: input.deviceKeyId
+		},
+		verifier: { kind: "device_signature" }
+	};
+}
+function isVoiceIdWalletAuthAuthority(authority) {
+	return authority.factor.kind === "voiceid";
+}
 function isPasskeyWalletAuthAuthority(authority) {
 	return authority.factor.kind === "passkey";
 }
@@ -19,6 +36,7 @@ function walletAuthAuthoritiesMatch(left, right) {
 		if (!isEmailOtpWalletAuthAuthority(right)) return false;
 		return left.factor.provider === right.factor.provider && left.factor.providerUserId === right.factor.providerUserId && left.verifier.emailHashHex === right.verifier.emailHashHex;
 	}
+	if (isVoiceIdWalletAuthAuthority(left)) return isVoiceIdWalletAuthAuthority(right) && left.factor.deviceKeyId === right.factor.deviceKeyId;
 	return false;
 }
 function parseWalletAuthAuthorityRef(raw) {
@@ -184,7 +202,33 @@ function parseEmailOtpWalletAuthAuthorityObject(obj) {
 function parseWalletAuthAuthority(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const obj = raw;
-	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj);
+	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj) || parseVoiceIdWalletAuthAuthority(obj);
+}
+function parseVoiceIdWalletAuthAuthority(raw) {
+	try {
+		const record = requireRecord(raw, "device authority");
+		rejectUnknownFields(record, [
+			"walletId",
+			"bindingId",
+			"factor",
+			"verifier"
+		], "device authority");
+		const factor = requireRecord(record.factor, "device factor");
+		const verifier = requireRecord(record.verifier, "device verifier");
+		rejectUnknownFields(factor, ["kind", "deviceKeyId"], "device factor");
+		rejectUnknownFields(verifier, ["kind"], "device verifier");
+		if (factor.kind !== "voiceid" || verifier.kind !== "device_signature") return null;
+		const walletId = parseWalletId(record.walletId);
+		const method = parseWalletAuthMethodId(record.bindingId);
+		if (!walletId.ok || !method.ok) return null;
+		return buildVoiceIdWalletAuthAuthority({
+			walletId: walletId.value,
+			walletAuthMethodId: method.value,
+			deviceKeyId: parseDigestB64u(factor.deviceKeyId)
+		});
+	} catch {
+		return null;
+	}
 }
 function canonicalWalletAuthorityBindingDigestInput(args) {
 	return `${WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN}${alphabetizeStringify(args.authority)}`;
@@ -201,6 +245,6 @@ async function walletAuthAuthorityRef(args) {
 	};
 }
 //#endregion
-export { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthoritiesMatch, walletAuthAuthorityRef };
+export { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, buildVoiceIdWalletAuthAuthority, isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority, parseWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthoritiesMatch, walletAuthAuthorityRef };
 
 //# sourceMappingURL=walletAuthAuthority.js.map

package/dist/esm/shared-ts/src/utils/walletAuthMethodRecord.js

@@ -1,6 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { alphabetizeStringify } from "./digests.js";
-import { sha256Utf8DigestB64u } from "./canonicalPrimitives.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "./canonicalPrimitives.js";
+import { parseVoiceIdDevicePublicKeyB64u } from "../authorization/voiceIdDeviceAssertion.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
 //#region ../shared-ts/src/utils/walletAuthMethodRecord.ts
 async function computeWalletAuthMethodRevokeOperationFingerprintV1(input) {
@@ -22,6 +23,10 @@ function sameWalletAuthMethodRecordV2(left, right) {
 			if (right.kind !== "email_otp") return false;
 			if (left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId) break;
 			return false;
+		case "voiceid":
+			if (right.kind !== "voiceid") return false;
+			if (left.deviceKeyId === right.deviceKeyId && left.devicePublicKeyB64u === right.devicePublicKeyB64u) break;
+			return false;
 		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method kind");
 	}
 	switch (left.status) {
@@ -83,6 +88,47 @@ function buildWalletAuthMethodRecordV2(input) {
 			revokedAtMs: input.revokedAtMs
 		};
 	}
+	if (input.kind === "voiceid") switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "voiceid",
+			status: "pending_local_install",
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "voiceid",
+			status: "active",
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "voiceid",
+			status: "revoked",
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
 	switch (input.status) {
 		case "pending_local_install": return {
 			version: "wallet_auth_method_v2",
@@ -131,7 +177,7 @@ function parseWalletAuthMethodRecordV2(raw) {
 	const version = trimString(record.version);
 	const kind = trimString(record.kind);
 	const status = trimString(record.status);
-	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
+	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp" && kind !== "voiceid") return null;
 	try {
 		const common = parseWalletAuthMethodRecordV2Common(record);
 		if (kind === "passkey") {
@@ -149,6 +195,16 @@ function parseWalletAuthMethodRecordV2(raw) {
 				counter: parseNonNegativeInteger(record.counter)
 			});
 		}
+		if (kind === "voiceid") {
+			if (!("deviceKeyId" in record) || !("devicePublicKeyB64u" in record)) return null;
+			exactWalletAuthMethodV2Fields(record, "voiceid", status);
+			return buildParsedVoiceIdWalletAuthMethodRecordV2({
+				common,
+				lifecycle: parseWalletAuthMethodLifecycle(record),
+				deviceKeyId: parseDigestB64u(record.deviceKeyId),
+				devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(record.devicePublicKeyB64u)
+			});
+		}
 		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
 		exactWalletAuthMethodV2Fields(record, "email_otp", status);
 		const emailHashHex = trimString(record.emailHashHex);
@@ -180,10 +236,19 @@ function validateWalletAuthMethodRecordV2(value) {
 	if (!value.walletAuthMethodId || !value.walletId || !value.walletAuthorityId) throw new Error("wallet auth method record identities are required");
 	if (!Number.isSafeInteger(value.createdAtMs) || value.createdAtMs < 0) throw new Error("wallet auth method createdAtMs must be a non-negative safe integer");
 	if (!Number.isSafeInteger(value.updatedAtMs) || value.updatedAtMs < value.createdAtMs) throw new Error("wallet auth method updatedAtMs must follow createdAtMs");
-	if (value.kind === "passkey") {
-		if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
-		if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
-	} else if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
+	switch (value.kind) {
+		case "passkey":
+			if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
+			if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
+			break;
+		case "email_otp":
+			if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
+			break;
+		case "voiceid":
+			parseDigestB64u(value.deviceKeyId);
+			parseVoiceIdDevicePublicKeyB64u(value.devicePublicKeyB64u);
+			break;
+	}
 	switch (value.status) {
 		case "pending_local_install": return;
 		case "active":
@@ -228,7 +293,8 @@ function exactWalletAuthMethodV2Fields(raw, kind, status) {
 		"updatedAtMs"
 	];
 	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-	else fields.push("emailHashHex", "registrationAuthorityId");
+	else if (kind === "email_otp") fields.push("emailHashHex", "registrationAuthorityId");
+	else fields.push("deviceKeyId", "devicePublicKeyB64u");
 	if (status === "active") fields.push("activatedAtMs");
 	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
 	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
@@ -329,6 +395,49 @@ function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
 		};
 	}
 }
+function buildParsedVoiceIdWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "voiceid",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			deviceKeyId: input.deviceKeyId,
+			devicePublicKeyB64u: input.devicePublicKeyB64u,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
 function parseWalletAuthMethodIdRequired(raw) {
 	const parsed = parseWalletAuthMethodId(raw);
 	if (!parsed.ok) throw new Error(parsed.error.message);

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -1,5 +1,6 @@
 import "../authorization/capabilityKinds.js";
 import { requireTrimmedString } from "../utils/validation.js";
+import "../utils/walletAuthMethodRecord.js";
 import "../authorization/walletAuthority.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts
 function buildWalletRecoveryCommittedProjectionV1(input) {

package/dist/types/shared-ts/src/authorization/voiceIdDeviceAssertion.d.ts

@@ -0,0 +1,32 @@
+import { type WalletSessionMintId } from './capabilityKinds';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../utils/domainIds';
+declare const voiceIdDevicePublicKeyBrand: unique symbol;
+export type VoiceIdDevicePublicKeyB64u = string & {
+    readonly [voiceIdDevicePublicKeyBrand]: true;
+};
+export declare function parseVoiceIdDevicePublicKeyB64u(value: unknown): VoiceIdDevicePublicKeyB64u;
+export type VoiceIdWalletSessionChallenge = Readonly<{
+    kind: 'voiceid_wallet_session_challenge_v1';
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    walletAuthorityId: WalletAuthorityId;
+    deviceKeyId: DigestB64u;
+    challengeId: WalletSessionMintId;
+    nonce: DigestB64u;
+    requestOrigin: string;
+    audience: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+}>;
+export type VoiceIdDeviceAssertion = Readonly<{
+    kind: 'voiceid_device_assertion_v1';
+    challenge: VoiceIdWalletSessionChallenge;
+    signatureB64u: string;
+}>;
+export declare function buildVoiceIdWalletSessionChallenge(fields: Omit<VoiceIdWalletSessionChallenge, 'kind'>): VoiceIdWalletSessionChallenge;
+export declare function parseVoiceIdWalletSessionChallenge(raw: unknown): VoiceIdWalletSessionChallenge;
+export declare function parseVoiceIdDeviceAssertion(raw: unknown): VoiceIdDeviceAssertion;
+export declare function voiceIdWalletSessionChallengeBytes(challenge: VoiceIdWalletSessionChallenge): Uint8Array<ArrayBuffer>;
+export {};
+//# sourceMappingURL=voiceIdDeviceAssertion.d.ts.map

package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts

@@ -41,7 +41,9 @@ export type CommittedSignerPackageSetV1 = ReadonlyExclusiveUnion<{
 export type CommittedAuthorityPackagesV1 = {
     readonly kind: 'committed_authority_packages_v1';
     readonly authority: PendingWalletAuthorityV1;
-    readonly authMethod: PendingWalletAuthMethodRecordV2;
+    readonly authMethod: Exclude<PendingWalletAuthMethodRecordV2, {
+        readonly kind: 'voiceid';
+    }>;
     readonly signerPackages: CommittedSignerPackageSetV1;
     readonly ed25519ExportRootPackage: LinkedDeviceEd25519ExportRootPackageV1 | null;
     readonly packageSetDigestB64u: DigestB64u;

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -432,6 +432,14 @@ export type LinkedOwnerCredentialMetadataV1 = {
     readonly email?: never;
     readonly device?: never;
     readonly credentialIdB64u?: never;
+    readonly deviceKeyId?: never;
+} | {
+    readonly kind: 'voiceid';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly deviceKeyId: DigestB64u;
+    readonly email?: never;
+    readonly device?: never;
+    readonly credentialIdB64u?: never;
 };
 /** Public wallet-scoped projection for linked-device management. */
 export type LinkedDeviceSummaryV1 = {

package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts

@@ -6,9 +6,11 @@ import type { ExclusiveUnion } from '../utils/variant';
 export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: 'wallet_custody_envelope_v2';
 declare const PASSKEY_PRF_KEK_VERSION_V1: 'passkey_prf_kek_hkdf_sha256_v1';
 declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: 'email_otp_factor_kek_hkdf_sha256_v1';
+declare const VOICEID_DEVICE_FACTOR_KEK_VERSION_V1: 'voiceid_device_factor_kek_hkdf_sha256_v1';
 type WalletCustodyEnvelopeVersion = typeof WALLET_CUSTODY_ENVELOPE_VERSION_V2;
 type PasskeyPrfKekVersion = typeof PASSKEY_PRF_KEK_VERSION_V1;
 type EmailOtpFactorKekVersion = typeof EMAIL_OTP_FACTOR_KEK_VERSION_V1;
+type VoiceIdFactorKekVersion = typeof VOICEID_DEVICE_FACTOR_KEK_VERSION_V1;
 /**
  * Which enrolled factor sealed this envelope.
  *
@@ -45,6 +47,10 @@ export type WalletCustodyEnvelopeFactor = ExclusiveUnion<{
     enrollmentId: string;
     enrollmentSealKeyVersion: string;
     kekVersion: EmailOtpFactorKekVersion;
+} | {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    kekVersion: VoiceIdFactorKekVersion;
 }>;
 export type PasskeyCustodyEnvelopeLifecycle = ExclusiveUnion<{
     state: 'active';
@@ -86,6 +92,24 @@ export type PasskeyCustodyEnvelopeRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
+export type ActiveMethodBoundWalletSeedEnvelope = PasskeyCustodyEnvelopeRecord & {
+    readonly ownership: Extract<WalletCustodyEnvelopeOwnership, {
+        readonly kind: 'method_bound';
+    }>;
+    readonly binding: Extract<PasskeyCustodySecretBinding, {
+        readonly kind: 'wallet_custody_seed_v1';
+    }>;
+    readonly lifecycle: Extract<PasskeyCustodyEnvelopeLifecycle, {
+        readonly state: 'active';
+    }>;
+};
+export type VoiceIdSeedEnvelope = ActiveMethodBoundWalletSeedEnvelope & {
+    readonly factor: Extract<WalletCustodyEnvelopeFactor, {
+        readonly kind: 'voiceid';
+    }>;
+};
+export declare function isActiveMethodBoundWalletSeedEnvelope(envelope: PasskeyCustodyEnvelopeRecord): envelope is ActiveMethodBoundWalletSeedEnvelope;
+export declare function isVoiceIdSeedEnvelope(envelope: PasskeyCustodyEnvelopeRecord): envelope is VoiceIdSeedEnvelope;
 /**
  * The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
  *
@@ -119,6 +143,11 @@ export declare function buildEmailOtpEnvelopeFactor(args: {
 }): Extract<WalletCustodyEnvelopeFactor, {
     readonly kind: 'email_otp';
 }>;
+export declare function buildVoiceIdEnvelopeFactor(args: {
+    deviceKeyId: DigestB64u;
+}): Extract<WalletCustodyEnvelopeFactor, {
+    readonly kind: 'voiceid';
+}>;
 export declare function buildActiveEnvelopeLifecycle(args: {
     activatedAtMs: number;
 }): PasskeyCustodyEnvelopeLifecycle;

package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts

@@ -103,6 +103,7 @@ type PasskeyCustodySecretBindingOfKind<TKind extends PasskeyCustodySecretKind> =
 }>;
 /** True when this binding covers owner custody rather than one lane's share. */
 export declare function isWalletCustodySeedBinding(binding: PasskeyCustodySecretBinding): binding is PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
+export declare function buildWalletCustodySeedBinding(): PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
 export declare function buildEd25519YaoClientRootBinding(args: {
     linkSessionId: LinkDeviceSessionId;
     walletKeyId: WalletKeyId;

package/dist/types/shared-ts/src/signing-lanes/execution.d.ts

@@ -7,7 +7,7 @@ export type OwnerWalletExecutionLaneProjectionV1 = {
     readonly kind: 'active_owner_wallet_execution_lane_projection_v1';
     readonly walletKey: WalletKeyRecord;
     readonly lane: Extract<SigningLaneRecord, {
-        readonly laneKind: 'owner_passkey' | 'owner_email_otp';
+        readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid';
     }>;
     readonly materialActivation: MpcMaterialActivationRef;
     readonly verifiedActivationReceiptDigestB64u: DigestB64u;
@@ -24,7 +24,7 @@ type PreparedWalletExecutionBase = {
 };
 export type PreparedOwnerWalletExecution = PreparedWalletExecutionBase & {
     readonly kind: 'prepared_owner_wallet_execution';
-    readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'recovery' | 'break_glass';
+    readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid' | 'recovery' | 'break_glass';
     readonly lane: ActiveSigningLaneReference & {
         readonly laneKind: PreparedOwnerWalletExecution['laneKind'];
     };

package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts

@@ -2,7 +2,7 @@ import type { WalletId } from '../utils/domainIds';
 import { type EvmFamilySigningKeySlotId } from './evmFamilySigningKeySlotId';
 import { type LaneHolderParticipantRecordV1, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantRecordV1 } from './participants';
 import { type LaneShareEpoch, type LinkedDeviceId, type SigningLaneId, type WalletKeyId } from './ids';
-import type { AgentCustodyBindingId, AgentIdentityKeyId, BreakGlassSigningLaneRecord, DelegatedExecutionSigningLaneRecord, DelegatedSpendAuthorizationId, Ed25519WalletKeyRecord, EvmFamilyWalletKeyRecord, LinkedDeviceSigningLaneRecord, OwnerEmailOtpSigningLaneRecord, OwnerPasskeySigningLaneRecord, RecoverySigningLaneRecord, SigningLaneLifecycle, SigningLaneRecord, WalletKeyLifecycle, WalletKeyRecord, WalletKeyVersion } from './records';
+import type { AgentCustodyBindingId, AgentIdentityKeyId, BreakGlassSigningLaneRecord, DelegatedExecutionSigningLaneRecord, DelegatedSpendAuthorizationId, Ed25519WalletKeyRecord, EvmFamilyWalletKeyRecord, LinkedDeviceSigningLaneRecord, OwnerEmailOtpSigningLaneRecord, OwnerPasskeySigningLaneRecord, OwnerVoiceIdSigningLaneRecord, RecoverySigningLaneRecord, SigningLaneLifecycle, SigningLaneRecord, WalletKeyLifecycle, WalletKeyRecord, WalletKeyVersion } from './records';
 import { type OwnerLaneParticipantContinuityV1 } from './ownerContinuity';
 type ActiveSigningLaneLifecycle = Extract<SigningLaneLifecycle, {
     readonly state: 'active';
@@ -64,6 +64,7 @@ export declare function buildActiveSigningLaneLifecycle(args: {
 }): ActiveSigningLaneLifecycle;
 export declare function buildOwnerPasskeySigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerPasskeySigningLaneRecord;
 export declare function buildOwnerEmailOtpSigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerEmailOtpSigningLaneRecord;
+export declare function buildOwnerVoiceIdSigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerVoiceIdSigningLaneRecord;
 export declare function buildLinkedDeviceSigningLaneRecord(args: RotatableSigningLaneRecordBuilderArgs & {
     readonly linkedDeviceId: LinkedDeviceId;
 }): LinkedDeviceSigningLaneRecord;

package/dist/types/shared-ts/src/signing-lanes/records.d.ts

@@ -46,7 +46,7 @@ export type EvmFamilyWalletKeyRecord = {
     readonly registeredPublicKeyB64u?: never;
 };
 export type WalletKeyRecord = Ed25519WalletKeyRecord | EvmFamilyWalletKeyRecord;
-export type SigningLaneKind = 'owner_passkey' | 'owner_email_otp' | 'linked_device' | 'delegated_execution' | 'recovery' | 'break_glass';
+export type SigningLaneKind = 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid' | 'linked_device' | 'delegated_execution' | 'recovery' | 'break_glass';
 export type SigningLaneReference = {
     readonly kind: 'signing_lane_reference_v1';
     readonly walletId: WalletId;
@@ -119,6 +119,14 @@ export type OwnerEmailOtpSigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
     readonly custodyBindingId?: never;
     readonly authorizationBindingDigestB64u?: never;
 };
+export type OwnerVoiceIdSigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
+    readonly laneKind: 'owner_voiceid';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
 export type LinkedDeviceSigningLaneRecord = RotatableSigningLaneRecordBase & {
     readonly laneKind: 'linked_device';
     readonly linkedDeviceId: LinkedDeviceId;
@@ -154,6 +162,6 @@ export type BreakGlassSigningLaneRecord = PrivilegedOwnerSigningLaneRecordBase &
     readonly custodyBindingId?: never;
     readonly authorizationBindingDigestB64u?: never;
 };
-export type SigningLaneRecord = OwnerPasskeySigningLaneRecord | OwnerEmailOtpSigningLaneRecord | LinkedDeviceSigningLaneRecord | DelegatedExecutionSigningLaneRecord | RecoverySigningLaneRecord | BreakGlassSigningLaneRecord;
+export type SigningLaneRecord = OwnerPasskeySigningLaneRecord | OwnerEmailOtpSigningLaneRecord | OwnerVoiceIdSigningLaneRecord | LinkedDeviceSigningLaneRecord | DelegatedExecutionSigningLaneRecord | RecoverySigningLaneRecord | BreakGlassSigningLaneRecord;
 export {};
 //# sourceMappingURL=records.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts

@@ -13,7 +13,7 @@ type ActiveLaneProtocolSourceBaseV1 = {
 /** Existing owner signer rows expose continuity, without linked-lane HPKE identities. */
 type OwnerLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
     sourceKind: 'owner_registration';
-    laneKind: 'owner_passkey' | 'owner_email_otp';
+    laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid';
     ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
     holderParticipantId?: never;
     signingWorkerParticipantId?: never;
@@ -22,7 +22,7 @@ type OwnerLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
 /** Independently provisioned lanes carry their durable holder/worker identities. */
 type ProvisionedLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
     sourceKind: 'provisioned_lane';
-    laneKind: Exclude<SigningLaneKind, 'owner_passkey' | 'owner_email_otp'>;
+    laneKind: Exclude<SigningLaneKind, 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid'>;
     holderParticipantId: LaneHolderParticipantId;
     signingWorkerParticipantId: SigningWorkerParticipantId;
     signingWorkerRecipientKeyId: SigningWorkerRecipientKeyId;

package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts

@@ -1,9 +1,18 @@
 import type { WebAuthnRpId } from '../utils/domainIds';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
 export declare const DEFAULT_WALLET_SESSION_TTL_MS: number;
 export declare const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
+export declare const LINKED_DEVICE_WALLET_SESSION_TTL_MS: number;
+export declare const LINKED_DEVICE_WALLET_SESSION_REMAINING_USES = 100;
 export declare const MAX_WALLET_SESSION_TTL_MS: number;
 export declare const MAX_WALLET_SESSION_REMAINING_USES = 1000000;
 export type Ed25519AuthorityScope = {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    rpId?: never;
+    provider?: never;
+    providerUserId?: never;
+} | {
     kind: 'passkey_rp';
     rpId: WebAuthnRpId;
     proofKind?: never;

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -12,7 +12,7 @@
  * `already_configured` at admission — before any target verification or local
  * write — rather than travelling through the operation as a rejected case.
  */
-import type { ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -24,7 +24,7 @@ import type { WalletAuthMethod } from './signerDomain';
  * addition — which family a branch fills in — and the assertion below keeps it
  * from drifting from the canonical record's own discriminant.
  */
-export type WalletAuthMethodFamilyV1 = WalletAuthMethod;
+export type WalletAuthMethodFamilyV1 = Exclude<WalletAuthMethod, 'voiceid'>;
 /**
  * The two exhaustive branches. The name reads source-to-target, which is the
  * order every stage of the operation uses: resolve the source, then verify the
@@ -54,7 +54,7 @@ type AddWalletAuthMethodAdmissionV1 = {
  * which is why the operation needs no same-family rejection of its own.
  */
 export declare function admitAddWalletAuthMethod(input: {
-    readonly sourceMethod: ActiveWalletAuthMethodRecordV2;
+    readonly sourceMethod: ActivePasskeyWalletAuthMethodRecordV2 | ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly targetFamily: WalletAuthMethodFamilyV1;
     readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -88,11 +88,10 @@ export declare function parsePasskeyEnvelopeId(raw: unknown): DomainIdParseResul
 /**
  * Mints a wallet auth-method id.
  *
- * Server-side only, and there is exactly one of these because an auth method's
- * identity is now authenticated data: it goes into the custody envelope's AAD,
- * so an id minted to a second shape would seal envelopes the parsers reject.
- * A client never chooses one — registration and every addition receive theirs
- * from the intent that allocated it.
+ * Registration allocates this identity on the server. Device-bound VoiceID
+ * activation allocates it in the Wallet before sealing its custody envelope.
+ * Both paths use this builder because the identity is authenticated data in
+ * the custody envelope's AAD.
  */
 export declare function allocateWalletAuthMethodId(randomSuffix: string): WalletAuthMethodId;
 export declare function parseWalletAuthMethodId(raw: unknown): DomainIdParseResult<WalletAuthMethodId>;

package/dist/types/shared-ts/src/utils/registrationIntent.d.ts

@@ -63,7 +63,6 @@ export type AddSignerIntentV1 = {
 export type AddAuthMethodIntentSourceV1 = {
     readonly walletAuthorityId: WalletAuthorityId;
     readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletSessionId: string;
     readonly authorityDigestB64u: string;
     readonly revocationEpoch: number;
 };

package/dist/types/shared-ts/src/utils/signerDomain.d.ts

@@ -6,12 +6,15 @@ export type SignerKind = (typeof SIGNER_KINDS)[keyof typeof SIGNER_KINDS];
 export declare const SIGNER_AUTH_METHODS: {
     readonly passkey: 'passkey';
     readonly emailOtp: "email_otp";
+    readonly voiceId: 'voiceid';
 };
 /** Authentication methods that can authorize a signer capability. */
 export type SignerAuthMethod = (typeof SIGNER_AUTH_METHODS)[keyof typeof SIGNER_AUTH_METHODS];
+export declare function requirePersistedSignerAuthMethod(method: SignerAuthMethod): Exclude<SignerAuthMethod, 'voiceid'>;
 export declare const WALLET_AUTH_METHODS: {
     readonly passkey: 'passkey';
     readonly emailOtp: "email_otp";
+    readonly voiceId: 'voiceid';
 };
 /** Authentication methods that can be enrolled on a wallet. */
 export type WalletAuthMethod = (typeof WALLET_AUTH_METHODS)[keyof typeof WALLET_AUTH_METHODS];