@seams/wallet-server 0.43.0 → 0.45.0

package/dist/esm/router/cloudflare.js

@@ -967,7 +967,8 @@ const EVM_ECDSA_MPC_OPERATION_KINDS = {
 const AUTHORIZATION_EVIDENCE_KINDS = {
 	seamsSession: "seams_session",
 	passkeyAssertion: "passkey_assertion",
-	emailOtp: "email_otp"
+	emailOtp: "email_otp",
+	voiceIdDevice: "voiceid_device"
 };
 const AUTHORIZATION_GRANT_KINDS = { walletSession: "wallet_session_authorization" };
 const CAPABILITY_KIND_VALUES = Object.values(CAPABILITY_KINDS);
@@ -1561,6 +1562,19 @@ function isPasskeyWalletAuthAuthority(authority) {
 function isEmailOtpWalletAuthAuthority(authority) {
 	return authority.factor.kind === "email_otp";
 }
+function walletAuthAuthoritiesMatch(left, right) {
+	if (left.walletId !== right.walletId || left.bindingId !== right.bindingId) return false;
+	if (isPasskeyWalletAuthAuthority(left)) {
+		if (!isPasskeyWalletAuthAuthority(right)) return false;
+		return left.factor.credentialIdB64u === right.factor.credentialIdB64u && left.verifier.rpId === right.verifier.rpId;
+	}
+	if (isEmailOtpWalletAuthAuthority(left)) {
+		if (!isEmailOtpWalletAuthAuthority(right)) return false;
+		return left.factor.provider === right.factor.provider && left.factor.providerUserId === right.factor.providerUserId && left.verifier.emailHashHex === right.verifier.emailHashHex;
+	}
+	if (isVoiceIdWalletAuthAuthority(left)) return isVoiceIdWalletAuthAuthority(right) && left.factor.deviceKeyId === right.factor.deviceKeyId;
+	return false;
+}
 function parseWalletAuthAuthorityRef(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
@@ -1766,6 +1780,166 @@ async function walletAuthAuthorityRef(args) {
 		walletAuthMethodId: args.authority.bindingId
 	};
 }
+//#endregion
+//#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+const MAXIMUM_CHALLENGE_MS = 6e4;
+function parseVoiceIdDevicePublicKeyB64u(value) {
+	if (typeof value !== "string") throw new Error("VoiceID public key is invalid");
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+	return value;
+}
+function exactKeys(value, keys) {
+	if (Object.keys(value).length !== keys.length) return false;
+	for (const key of keys) if (!Object.hasOwn(value, key)) return false;
+	return true;
+}
+function requireOrigin(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be an origin`);
+	let origin;
+	let protocol;
+	try {
+		const parsed = new URL(value);
+		origin = parsed.origin;
+		protocol = parsed.protocol;
+	} catch {
+		throw new Error(`${label} must be an origin`);
+	}
+	if (origin !== value || protocol !== "http:" && protocol !== "https:") throw new Error(`${label} must be a canonical HTTP origin`);
+	return origin;
+}
+function requireWindow(issuedAtMs, expiresAtMs) {
+	if (!Number.isSafeInteger(issuedAtMs) || !Number.isSafeInteger(expiresAtMs) || Number(issuedAtMs) <= 0 || Number(expiresAtMs) <= Number(issuedAtMs) || Number(expiresAtMs) - Number(issuedAtMs) > MAXIMUM_CHALLENGE_MS) throw new Error("VoiceID challenge has an invalid validity window");
+}
+function buildVoiceIdWalletSessionChallenge(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	requireOrigin(fields.audience, "VoiceID audience");
+	return {
+		kind: "voiceid_wallet_session_challenge_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		challengeId: fields.challengeId,
+		nonce: fields.nonce,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdWalletSessionChallenge(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"challengeId",
+		"nonce",
+		"requestOrigin",
+		"audience",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_wallet_session_challenge_v1") throw new Error("Invalid VoiceID Wallet Session challenge");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	const challengeId = parseWalletSessionMintId(raw.challengeId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !challengeId.ok) throw new Error("VoiceID challenge identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID challenge times must be numbers");
+	return buildVoiceIdWalletSessionChallenge({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		challengeId: challengeId.value,
+		nonce: parseDigestB64u(raw.nonce),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		audience: requireOrigin(raw.audience, "VoiceID audience"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdDeviceAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"challenge",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_device_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID device assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_device_assertion_v1",
+		challenge: parseVoiceIdWalletSessionChallenge(raw.challenge),
+		signatureB64u: raw.signatureB64u
+	};
+}
+function parseVoiceIdOperationKind(value) {
+	if (value === "near.export_key" || value === "evm.export_key") return value;
+	throw new Error("VoiceID operation kind is unsupported");
+}
+function buildVoiceIdOperationStatement(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	return {
+		kind: "voiceid_operation_statement_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		operationKind: parseVoiceIdOperationKind(fields.operationKind),
+		operationChallenge: parseDigestB64u(fields.operationChallenge),
+		requestOrigin: fields.requestOrigin,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdOperationStatement(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"operationKind",
+		"operationChallenge",
+		"requestOrigin",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_operation_statement_v1") throw new Error("Invalid VoiceID operation statement");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok) throw new Error("VoiceID operation identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID operation times must be numbers");
+	return buildVoiceIdOperationStatement({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		operationKind: parseVoiceIdOperationKind(raw.operationKind),
+		operationChallenge: parseDigestB64u(raw.operationChallenge),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdOperationAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"statement",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_operation_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID operation assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_operation_assertion_v1",
+		statement: parseVoiceIdOperationStatement(raw.statement),
+		signatureB64u: raw.signatureB64u
+	};
+}
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
 const ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH = "/router-ab/ecdsa-derivation/healthz";
 const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
@@ -2909,6 +3083,22 @@ function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {
 				otp_code: requireAsciiNonEmptyString(proof.otp_code, "operationStepUpAuthorizationRequest.proof.otp_code")
 			};
 			break;
+		case "voiceid": {
+			requireExactKeys$5(proof, "operationStepUpAuthorizationRequest.proof", [
+				"kind",
+				"authority",
+				"assertion"
+			]);
+			if (!authority || !isVoiceIdWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact VoiceID authority");
+			const assertion = parseVoiceIdOperationAssertion(proof.assertion);
+			if (assertion.statement.walletId !== authority.walletId || assertion.statement.walletAuthMethodId !== authority.bindingId || assertion.statement.deviceKeyId !== authority.factor.deviceKeyId) throw new Error("operationStepUpAuthorizationRequest.proof names another VoiceID method");
+			parsedProof = {
+				kind: "voiceid",
+				authority,
+				assertion
+			};
+			break;
+		}
 		default: throw new Error("operationStepUpAuthorizationRequest.proof.kind is invalid");
 	}
 	return {
@@ -6358,102 +6548,6 @@ function exactRecord$2(raw, keys, label) {
 	return record;
 }
 //#endregion
-//#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
-const MAXIMUM_CHALLENGE_MS = 6e4;
-function parseVoiceIdDevicePublicKeyB64u(value) {
-	if (typeof value !== "string") throw new Error("VoiceID public key is invalid");
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("VoiceID public key must be canonical Ed25519 bytes");
-	return value;
-}
-function exactKeys(value, keys) {
-	if (Object.keys(value).length !== keys.length) return false;
-	for (const key of keys) if (!Object.hasOwn(value, key)) return false;
-	return true;
-}
-function requireOrigin(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be an origin`);
-	let origin;
-	let protocol;
-	try {
-		const parsed = new URL(value);
-		origin = parsed.origin;
-		protocol = parsed.protocol;
-	} catch {
-		throw new Error(`${label} must be an origin`);
-	}
-	if (origin !== value || protocol !== "http:" && protocol !== "https:") throw new Error(`${label} must be a canonical HTTP origin`);
-	return origin;
-}
-function requireWindow(issuedAtMs, expiresAtMs) {
-	if (!Number.isSafeInteger(issuedAtMs) || !Number.isSafeInteger(expiresAtMs) || Number(issuedAtMs) <= 0 || Number(expiresAtMs) <= Number(issuedAtMs) || Number(expiresAtMs) - Number(issuedAtMs) > MAXIMUM_CHALLENGE_MS) throw new Error("VoiceID challenge has an invalid validity window");
-}
-function buildVoiceIdWalletSessionChallenge(fields) {
-	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
-	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
-	requireOrigin(fields.audience, "VoiceID audience");
-	return {
-		kind: "voiceid_wallet_session_challenge_v1",
-		walletId: fields.walletId,
-		walletAuthMethodId: fields.walletAuthMethodId,
-		walletAuthorityId: fields.walletAuthorityId,
-		deviceKeyId: fields.deviceKeyId,
-		challengeId: fields.challengeId,
-		nonce: fields.nonce,
-		requestOrigin: fields.requestOrigin,
-		audience: fields.audience,
-		issuedAtMs: fields.issuedAtMs,
-		expiresAtMs: fields.expiresAtMs
-	};
-}
-function parseVoiceIdWalletSessionChallenge(raw) {
-	if (!isPlainObject(raw) || !exactKeys(raw, [
-		"kind",
-		"walletId",
-		"walletAuthMethodId",
-		"walletAuthorityId",
-		"deviceKeyId",
-		"challengeId",
-		"nonce",
-		"requestOrigin",
-		"audience",
-		"issuedAtMs",
-		"expiresAtMs"
-	]) || raw.kind !== "voiceid_wallet_session_challenge_v1") throw new Error("Invalid VoiceID Wallet Session challenge");
-	const walletId = parseWalletId(raw.walletId);
-	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
-	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
-	const challengeId = parseWalletSessionMintId(raw.challengeId);
-	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !challengeId.ok) throw new Error("VoiceID challenge identity is invalid");
-	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID challenge times must be numbers");
-	return buildVoiceIdWalletSessionChallenge({
-		walletId: walletId.value,
-		walletAuthMethodId: walletAuthMethodId.value,
-		walletAuthorityId: walletAuthorityId.value,
-		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
-		challengeId: challengeId.value,
-		nonce: parseDigestB64u(raw.nonce),
-		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
-		audience: requireOrigin(raw.audience, "VoiceID audience"),
-		issuedAtMs: raw.issuedAtMs,
-		expiresAtMs: raw.expiresAtMs
-	});
-}
-function parseVoiceIdDeviceAssertion(raw) {
-	if (!isPlainObject(raw) || !exactKeys(raw, [
-		"kind",
-		"challenge",
-		"signatureB64u"
-	]) || raw.kind !== "voiceid_device_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID device assertion");
-	const signature = base64UrlDecode(raw.signatureB64u);
-	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
-	return {
-		kind: "voiceid_device_assertion_v1",
-		challenge: parseVoiceIdWalletSessionChallenge(raw.challenge),
-		signatureB64u: raw.signatureB64u
-	};
-}
-//#endregion
 //#region ../shared-ts/src/utils/registrationAuthMethodInput.ts
 function inspectRawObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -9003,6 +9097,26 @@ function buildVerifiedWalletOperationEmailOtpFactorResult(fields) {
 		...fields
 	};
 }
+/** Only a verified operation statement yields this factor; its proof supplies the key and digest. */
+function buildVerifiedWalletOperationVoiceIdFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	if (fields.expiresAtMs > fields.proof.statement.expiresAtMs) throw new Error("VoiceID factor cannot outlive its operation statement");
+	return {
+		kind: "verified_wallet_operation_voiceid_factor",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityRef: fields.authorityRef,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		factorId: fields.factorId,
+		operation: fields.operation,
+		deviceKeyId: fields.proof.deviceKeyId,
+		assertionDigest: fields.proof.assertionDigest,
+		verifiedAtMs: fields.verifiedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
 function buildVerifiedWalletSessionPasskeyFactorResult(fields) {
 	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
 	return {
@@ -9109,6 +9223,16 @@ async function buildWalletOperationFactorEvidence(evidenceId, factor) {
 				verificationReceiptDigest: factor.verificationReceiptDigest
 			})
 		};
+		case "verified_wallet_operation_voiceid_factor": return {
+			evidenceId,
+			evidenceKind: AUTHORIZATION_EVIDENCE_KINDS.voiceIdDevice,
+			evidenceDigest: await digestCanonicalEvidence({
+				kind: factor.kind,
+				...common,
+				deviceKeyId: factor.deviceKeyId,
+				assertionDigest: factor.assertionDigest
+			})
+		};
 	}
 }
 function requireVerificationWindow(verifiedAtMs, expiresAtMs) {
@@ -19459,6 +19583,10 @@ function walletExecutionLaneAuthSourceFromAuthority(authority) {
 		kind: "passkey",
 		credentialIdB64u: authority.factor.credentialIdB64u
 	};
+	if (authority.factor.kind === "voiceid") return {
+		kind: "voiceid",
+		deviceKeyId: authority.factor.deviceKeyId
+	};
 	const providerSubject = parseProviderSubject(authority.factor.providerUserId);
 	return providerSubject.ok ? {
 		kind: "oidc_provider",
@@ -21051,6 +21179,55 @@ async function verifyEcdsaOperationStepUpFactor(input) {
 				} : { kind: "not_requested" }
 			};
 		}
+		case "voiceid": {
+			if (input.operation.operation.operationKind !== "evm.export_key" || input.authSource.kind !== "voiceid" || proof.authority.factor.deviceKeyId !== input.authSource.deviceKeyId) return {
+				ok: false,
+				response: json$3({
+					ok: false,
+					code: "scope_mismatch",
+					message: "VoiceID authority changed"
+				}, { status: 403 })
+			};
+			const verified = await input.voiceId.verifyVoiceIdOperation({
+				walletId: input.walletId,
+				walletAuthMethodId: proof.authority.bindingId,
+				assertion: proof.assertion,
+				operationKind: "evm.export_key",
+				operationChallenge: parseDigestB64u(input.expectedChallenge),
+				requestOrigin: input.requestOrigin,
+				nowMs: Date.now()
+			});
+			if (verified.kind === "rejected" || !walletAuthAuthoritiesMatch(verified.authority, proof.authority)) return {
+				ok: false,
+				response: json$3({
+					ok: false,
+					code: "not_verified",
+					message: "VoiceID operation proof was not verified"
+				}, { status: 401 })
+			};
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.proof.statement.expiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`voiceid:${proof.authority.factor.deviceKeyId}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationVoiceIdFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					proof: verified.proof,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
 		default: throw new Error("Unsupported ECDSA operation step-up proof");
 	}
 }
@@ -21326,6 +21503,7 @@ async function verifyActiveEcdsaOperationStepUpAuthority(walletAuthMethods, proo
 	switch (proof.kind) {
 		case "passkey": return await walletAuthMethods.verifyActivePasskeyAuthority(proof.authority);
 		case "email_otp": return await walletAuthMethods.verifyActiveEmailOtpAuthority(proof.authority);
+		case "voiceid": return { ok: true };
 		default: throw new Error("Unsupported ECDSA operation step-up proof");
 	}
 }
@@ -21864,7 +22042,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		expectedChallenge,
 		expiresAtMs,
 		webAuthn: input.ctx.service.webAuthn,
-		emailOtp: input.ctx.service.emailOtp
+		emailOtp: input.ctx.service.emailOtp,
+		voiceId: input.ctx.service.walletUnlock
 	});
 	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
@@ -39753,7 +39932,7 @@ const ROUTES = Object.freeze([defineRoute({
 	auth: {
 		plane: "public",
 		proof: "challenge_exchange",
-		rationale: "Exact-seed export requires fresh passkey assertion or Email OTP factor possession."
+		rationale: "Exact-seed export requires a fresh passkey assertion, Email OTP factor possession or VoiceID device proof."
 	},
 	metering: { kind: "none" },
 	requiredServices: [],
@@ -39839,6 +40018,42 @@ function parseEmailOtpExportAdmissionAuthorization(authorization) {
 		}
 	};
 }
+function parseVoiceIdExportAdmissionAuthorization(authorization) {
+	const unexpectedField = firstUnexpectedField(authorization, [
+		"kind",
+		"walletAuthMethodId",
+		"assertion"
+	]);
+	if (unexpectedField) return {
+		ok: false,
+		message: `VoiceID export authorization has unknown field: ${unexpectedField}`
+	};
+	let assertion;
+	try {
+		assertion = parseVoiceIdOperationAssertion(authorization.assertion);
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : "VoiceID export assertion is invalid"
+		};
+	}
+	if (typeof authorization.walletAuthMethodId !== "string" || authorization.walletAuthMethodId !== assertion.statement.walletAuthMethodId) return {
+		ok: false,
+		message: "walletAuthMethodId must name the signing VoiceID method"
+	};
+	if (assertion.statement.operationKind !== "near.export_key") return {
+		ok: false,
+		message: "VoiceID export assertion names another operation"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "voiceid_device",
+			walletAuthMethodId: authorization.walletAuthMethodId,
+			assertion
+		}
+	};
+}
 function parseExportAdmissionAuthorization(value) {
 	if (!isPlainObject(value)) return {
 		ok: false,
@@ -39847,6 +40062,7 @@ function parseExportAdmissionAuthorization(value) {
 	switch (value.kind) {
 		case "passkey": return parsePasskeyExportAdmissionAuthorization(value);
 		case "email_otp_factor": return parseEmailOtpExportAdmissionAuthorization(value);
+		case "voiceid_device": return parseVoiceIdExportAdmissionAuthorization(value);
 		default: return {
 			ok: false,
 			message: "export admission authorization kind is invalid"
@@ -39937,7 +40153,8 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json$3({
 				protocol: result.value,
-				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
+				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {},
+				...authorized.custodyRelease ? { voiceIdCustodyEnvelope: authorized.custodyRelease.envelope } : {}
 			}, { status: result.status }) : json$3({
 				ok: false,
 				code: result.code,