@seams/wallet-server 0.44.0 → 0.45.0

package/README.md

@@ -4,17 +4,17 @@ This package owns the reusable signer server surface: route adapters,
 WebAuthn verification policy, threshold signing services, signer storage
 adapters, and server wasm bindings.
 
-The package version is `@seams/wallet-server@0.44.0`. Pair it with
-`@seams/wallet@0.44.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
+The package version is `@seams/wallet-server@0.45.0`. Pair it with
+`@seams/wallet@0.45.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
 The wallet iframe protocol is **23.0.0**.
 
 ```sh
-pnpm add @seams/wallet-server@0.44.0
+pnpm add @seams/wallet-server@0.45.0
 ```
 
 ## Google BYO authentication
 
-Version 0.44.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
+Version 0.45.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
 An environment-specific Google client configuration and an owner-approved wallet association are required.
 Apply the packaged signer migrations before enabling the feature.
 External sessions grant settings reads and remain separate from owner and signing credentials.

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.44.0"
+    "version": "0.45.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "cf2212d5f30d0fde0fe50b670947f7e8dbd80bf030f331926b912a7c57b7dfe2",
+      "fingerprint": "be8ce147f8355f6b816a9b258f43f35766a4849bfe3de592510cc7a24aab3fdc",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "7b1fa64f9a3281415967f8c35e0a566f07acf0e0960d59def4e752c561b7c221"
+          "sha256": "c07f1d05db4e35c5f83ea6050c29b8139704dc980cdd29bf68951858043fc9bf"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "3f3a13d3006fb9cb12d0b65155d6606fe76ded40a473ab957e125f1d617fe1e1",
+      "fingerprint": "9fca6888b064b6236f198f3089090a48b6b96dcfcc892a0003e8b189769f287e",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "45128c4e72cb353d397042b5c4a3d4de21f849043703edcd13faa8f813449b00"
+          "sha256": "43f9c411ce83779b05ff77d0fbb31cfffaa23f209124f8432da8a08c442853f4"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "c3ec3bd81745c884753a0ccb49295a5b10babc5ab0411dfd4da3ae03a6f45047",
+      "fingerprint": "2c85d5ed88e0f1c061e6a16b823e7700d5d32033434f6cc8244662e15a1804f1",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "0dbf6fa12a10aa2d722f7aaf35d2736345e57fe13411bac6cb922165228389cc"
+          "sha256": "16be8837dffda937dfdd423f3b7c953b58e5d17783b6997c2f7a2cb1ef5713ea"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "0028ab8619605c142b848e0331ed03625089c4dd542c852f47188779b440c98a",
+      "fingerprint": "95977224fe44f68a6859881f6c13ca75e6deb4d5f60ed1cb6822ce5947ef29fe",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "ef39cd5434a138428ebdb31472a951b26c1588326ea1d4919a00ca35879068af"
+          "sha256": "ce8b46720c2326d1215658429c564f64d462bd32b0987ae4b011392ee6250435"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "585215abff0f2a149de5c2bd000e47945178212759bee3a93e36eb8f45dc3de6",
+      "fingerprint": "4376495623e35c9d5bc8be92d2e3d938e7f0ae0a31263c241b854f07b5ded7f8",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "8a24fdba7f01f7a45de6b8079a01cbf21a21649013d141fd7d4a7e148371f14c"
+          "sha256": "e4aa88373939f5fef93b42d05ebb7072ccb133b591c9572c05a4692d2489747a"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793711641836}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793722189771}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793711793465}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793722326306}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793711933065}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793722456803}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793711405850}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793721977789}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793712096636}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793722608322}

package/dist/esm/authorization/factorEvidence.js

@@ -61,6 +61,26 @@ function buildVerifiedWalletOperationEmailOtpFactorResult(fields) {
 		...fields
 	};
 }
+/** Only a verified operation statement yields this factor; its proof supplies the key and digest. */
+function buildVerifiedWalletOperationVoiceIdFactorResult(fields) {
+	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
+	if (fields.expiresAtMs > fields.proof.statement.expiresAtMs) throw new Error("VoiceID factor cannot outlive its operation statement");
+	return {
+		kind: "verified_wallet_operation_voiceid_factor",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityRef: fields.authorityRef,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		factorId: fields.factorId,
+		operation: fields.operation,
+		deviceKeyId: fields.proof.deviceKeyId,
+		assertionDigest: fields.proof.assertionDigest,
+		verifiedAtMs: fields.verifiedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
 function buildVerifiedWalletSessionPasskeyFactorResult(fields) {
 	requireVerificationWindow(fields.verifiedAtMs, fields.expiresAtMs);
 	return {
@@ -242,6 +262,16 @@ async function buildWalletOperationFactorEvidence(evidenceId, factor) {
 				verificationReceiptDigest: factor.verificationReceiptDigest
 			})
 		};
+		case "verified_wallet_operation_voiceid_factor": return {
+			evidenceId,
+			evidenceKind: AUTHORIZATION_EVIDENCE_KINDS.voiceIdDevice,
+			evidenceDigest: await digestCanonicalEvidence({
+				kind: factor.kind,
+				...common,
+				deviceKeyId: factor.deviceKeyId,
+				assertionDigest: factor.assertionDigest
+			})
+		};
 	}
 }
 async function buildOwnerProofFields(input) {
@@ -288,6 +318,7 @@ function ownerProofMethod(factor) {
 		case "verified_wallet_operation_passkey_factor": return "passkey";
 		case "verified_wallet_session_email_otp_factor":
 		case "verified_wallet_operation_email_otp_factor": return "email_otp";
+		case "verified_wallet_operation_voiceid_factor": return "voiceid";
 	}
 }
 function ownerProofAuthSource(factor) {
@@ -307,6 +338,10 @@ function ownerProofAuthSource(factor) {
 				providerSubject: providerSubject.value
 			};
 		}
+		case "verified_wallet_operation_voiceid_factor": return {
+			kind: "voiceid",
+			deviceKeyId: factor.deviceKeyId
+		};
 	}
 }
 function ownerProofReplayIdentity(factor) {
@@ -315,6 +350,7 @@ function ownerProofReplayIdentity(factor) {
 		case "verified_wallet_operation_passkey_factor": return `passkey:${String(factor.factorId)}:${String(factor.assertionDigest)}`;
 		case "verified_wallet_session_email_otp_factor":
 		case "verified_wallet_operation_email_otp_factor": return `email_otp:${String(factor.factorId)}:${String(factor.challengeId)}:${String(factor.verificationReceiptDigest)}`;
+		case "verified_wallet_operation_voiceid_factor": return `voiceid:${String(factor.factorId)}:${String(factor.assertionDigest)}`;
 	}
 }
 function requireOwnerProofFields(fields) {
@@ -347,6 +383,6 @@ function evidenceIdFromEvidence(evidence) {
 	return evidence.evidenceId;
 }
 //#endregion
-export { buildVerifiedOwnerProof, buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationFactorEvidenceSet, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult };
+export { buildVerifiedOwnerProof, buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationFactorEvidenceSet, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletOperationVoiceIdFactorResult, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult };
 
 //# sourceMappingURL=factorEvidence.js.map

package/dist/esm/authorization/voiceIdDeviceProof.js

@@ -1,6 +1,6 @@
 import { base64UrlDecode } from "../shared-ts/src/utils/base64.js";
 import { sha256DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseVoiceIdDeviceAssertion, voiceIdWalletSessionChallengeBytes } from "../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
+import { parseVoiceIdDeviceAssertion, parseVoiceIdOperationAssertion, voiceIdOperationStatementBytes, voiceIdWalletSessionChallengeBytes } from "../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
 //#region src/authorization/voiceIdDeviceProof.ts
 var VerifiedVoiceIdWalletSessionProof = class {
 	proofBrand = true;
@@ -19,14 +19,40 @@ async function verifyVoiceIdWalletSessionAssertion(input) {
 	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < challenge.issuedAtMs - 5e3 || input.nowMs >= challenge.expiresAtMs || challenge.walletId !== input.registered.walletId || challenge.walletAuthMethodId !== input.registered.walletAuthMethodId || challenge.walletAuthorityId !== input.registered.walletAuthorityId || challenge.deviceKeyId !== input.registered.deviceKeyId) throw new Error("VoiceID Wallet Session challenge is unavailable");
 	const assertion = parseVoiceIdDeviceAssertion(input.assertion);
 	if (!sameChallenge(assertion.challenge, challenge)) throw new Error("VoiceID assertion names a different challenge");
-	const publicKeyBytes = base64UrlDecode(input.registered.publicKeyB64u);
-	if (await sha256DigestB64u(publicKeyBytes) !== input.registered.deviceKeyId) throw new Error("VoiceID device key identity is invalid");
-	const publicKey = await crypto.subtle.importKey("raw", publicKeyBytes, "Ed25519", false, ["verify"]);
-	if (!await crypto.subtle.verify("Ed25519", publicKey, base64UrlDecode(assertion.signatureB64u), voiceIdWalletSessionChallengeBytes(challenge))) throw new Error("VoiceID device signature is invalid");
+	await requireRegisteredDeviceSignature(input.registered, assertion.signatureB64u, voiceIdWalletSessionChallengeBytes(challenge));
 	if (!await input.consumeChallenge(challenge, input.nowMs)) throw new Error("VoiceID challenge was already consumed");
 	return new VerifiedVoiceIdWalletSessionProof(challenge, input.registered.deviceKeyId);
 }
+async function requireRegisteredDeviceSignature(registered, signatureB64u, signedBytes) {
+	const publicKeyBytes = base64UrlDecode(registered.publicKeyB64u);
+	if (await sha256DigestB64u(publicKeyBytes) !== registered.deviceKeyId) throw new Error("VoiceID device key identity is invalid");
+	const publicKey = await crypto.subtle.importKey("raw", publicKeyBytes, "Ed25519", false, ["verify"]);
+	if (!await crypto.subtle.verify("Ed25519", publicKey, base64UrlDecode(signatureB64u), signedBytes)) throw new Error("VoiceID device signature is invalid");
+}
+var VerifiedVoiceIdOperationStatementProof = class {
+	proofBrand = true;
+	constructor(statement, deviceKeyId, assertionDigest) {
+		this.statement = statement;
+		this.deviceKeyId = deviceKeyId;
+		this.assertionDigest = assertionDigest;
+		this.proofBrand;
+	}
+};
+/**
+* Only this server boundary turns a signed operation statement into verified
+* proof. The caller supplies the digest the operation expects and owns its
+* single use, as it does for a passkey assertion over the same digest.
+*/
+async function verifyVoiceIdOperationAssertion(input) {
+	const assertion = parseVoiceIdOperationAssertion(input.assertion);
+	const statement = assertion.statement;
+	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < statement.issuedAtMs - 5e3 || input.nowMs >= statement.expiresAtMs || statement.walletId !== input.registered.walletId || statement.walletAuthMethodId !== input.registered.walletAuthMethodId || statement.walletAuthorityId !== input.registered.walletAuthorityId || statement.deviceKeyId !== input.registered.deviceKeyId || statement.operationKind !== input.operationKind || statement.operationChallenge !== input.operationChallenge || statement.requestOrigin !== input.requestOrigin) throw new Error("VoiceID operation statement does not match this operation");
+	const signedBytes = voiceIdOperationStatementBytes(statement);
+	await requireRegisteredDeviceSignature(input.registered, assertion.signatureB64u, signedBytes);
+	const assertionDigest = await sha256DigestB64u(new TextEncoder().encode(`${statement.operationChallenge}|${assertion.signatureB64u}`));
+	return new VerifiedVoiceIdOperationStatementProof(statement, input.registered.deviceKeyId, assertionDigest);
+}
 //#endregion
-export { verifyVoiceIdWalletSessionAssertion };
+export { verifyVoiceIdOperationAssertion, verifyVoiceIdWalletSessionAssertion };
 
 //# sourceMappingURL=voiceIdDeviceProof.js.map

package/dist/esm/hosted-wallet-gateway.js

@@ -834,7 +834,7 @@ function createStagingExportRequestScopedDependencies(env, service, tenantRootCu
 	return {
 		store: createStagingYaoPartitionedStateStore(env),
 		backend: createStagingEd25519YaoBackend(env, createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveActiveTenantRoot)),
-		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration), authority.admitEstablishedHome.bind(authority)),
+		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletUnlock, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration), authority.admitEstablishedHome.bind(authority)),
 		capabilities: createStagingYaoRequestScopedRuntime(env, registrationTenantRootResolver)
 	};
 }

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1238,6 +1238,7 @@ function createD1WalletUnlockRouteService(assembly) {
 	return {
 		issueVoiceIdChallenge: voiceIdSessions.issueChallenge.bind(voiceIdSessions),
 		verifyAndIssueVoiceId: voiceIdSessions.verifyAndIssue.bind(voiceIdSessions),
+		verifyVoiceIdOperation: voiceIdSessions.verifyOperation.bind(voiceIdSessions),
 		createEmailOtpUnlockChallenge: assembly.emailOtpRecoveryService.createEmailOtpUnlockChallenge.bind(assembly.emailOtpRecoveryService),
 		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
 		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdSessions.js

@@ -1,6 +1,7 @@
 import { parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildVoiceIdWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isBillingCreditFailure } from "../../../../authorization/sessionRouting.js";
-import { verifyVoiceIdWalletSessionAssertion } from "../../../../authorization/voiceIdDeviceProof.js";
+import { verifyVoiceIdOperationAssertion, verifyVoiceIdWalletSessionAssertion } from "../../../../authorization/voiceIdDeviceProof.js";
 import { isVoiceIdSeedEnvelope } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { isFullOwnerAuthorityV1 } from "./d1WalletAuthMethodService.js";
@@ -133,6 +134,38 @@ var D1VoiceIdSessions = class {
 			custodyEnvelope: active.custodyEnvelope
 		};
 	}
+	/** Verifies a voice check for one operation; the operation's own claim makes it single use. */
+	async verifyOperation(input) {
+		const active = await this.resolveActiveMethod(input.walletId, input.walletAuthMethodId);
+		if (!active) return {
+			kind: "rejected",
+			code: "method_unavailable"
+		};
+		try {
+			return {
+				kind: "verified",
+				proof: await verifyVoiceIdOperationAssertion({
+					registered: active.registered,
+					assertion: input.assertion,
+					operationKind: input.operationKind,
+					operationChallenge: input.operationChallenge,
+					requestOrigin: input.requestOrigin,
+					nowMs: input.nowMs
+				}),
+				authority: buildVoiceIdWalletAuthAuthority({
+					walletId: input.walletId,
+					walletAuthMethodId: input.walletAuthMethodId,
+					deviceKeyId: active.authMethod.deviceKeyId
+				}),
+				custodyEnvelope: active.custodyEnvelope
+			};
+		} catch {
+			return {
+				kind: "rejected",
+				code: "invalid_assertion"
+			};
+		}
+	}
 };
 //#endregion
 export { D1VoiceIdSessions };