@seams/wallet-server 0.44.0 → 0.46.0

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,4 +1,4 @@
-import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
@@ -10,8 +10,9 @@ import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/
 import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseVoiceIdOperationAssertion } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
-import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletOperationVoiceIdFactorResult } from "../../../../authorization/factorEvidence.js";
 import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
@@ -657,7 +658,8 @@ function exportPasskeyCredentialId(authorization) {
 			const parsed = webAuthnCredentialIdB64uFromCredential(authorization.webauthnAuthentication);
 			return parsed.ok ? parsed.credentialIdB64u : null;
 		}
-		case "email_otp_factor": return null;
+		case "email_otp_factor":
+		case "voiceid_device": return null;
 		default: return assertNeverExportAdmissionAuthorization(authorization);
 	}
 }
@@ -671,6 +673,10 @@ function exportAuthorizationDigestAuthority(authorization, passkeyCredentialId)
 			kind: "email_otp",
 			providerSubjectId: authorization.providerSubjectId
 		};
+		case "voiceid_device": return {
+			kind: "voiceid",
+			deviceKeyId: authorization.assertion.statement.deviceKeyId
+		};
 		default: return assertNeverExportAdmissionAuthorization(authorization);
 	}
 }
@@ -831,6 +837,14 @@ async function authorizeExportAdmission(args) {
 			expiresAtMs: authorization.expires_at_ms
 		});
 	}
+	if (args.input.authorization.kind === "voiceid_device") return await authorizeVoiceIdExportAdmission({
+		walletId: walletId.value,
+		input: args.input,
+		authorization: args.input.authorization,
+		voiceId: args.voiceId,
+		authorizedOperations: args.authorizedOperations,
+		nowMs
+	});
 	const authority = await args.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedMethod({
 		walletId: String(walletId.value),
 		walletAuthMethodId: args.input.authorization.walletAuthMethodId,
@@ -865,6 +879,77 @@ async function authorizeExportAdmission(args) {
 		factorRelease: checked.factorRelease
 	};
 }
+async function verifyVoiceIdExportProof(args) {
+	const walletAuthMethodId = parseWalletAuthMethodId(args.authorization.walletAuthMethodId);
+	let requestOrigin;
+	let operationChallenge;
+	try {
+		requestOrigin = parseSessionOrigin(args.input.expectedOrigin);
+		operationChallenge = parseDigestB64u(base64UrlEncode(Uint8Array.from(args.input.body.authorization.confirmation_digest)));
+	} catch {
+		return authorizationFailure({
+			status: 403,
+			code: "export_authorization_invalid",
+			message: "Ed25519 Yao export VoiceID scope is invalid"
+		});
+	}
+	if (!walletAuthMethodId.ok) return authorizationFailure({
+		status: 403,
+		code: "invalid_body",
+		message: walletAuthMethodId.error.message
+	});
+	let verified;
+	try {
+		verified = await args.voiceId.verifyVoiceIdOperation({
+			walletId: args.walletId,
+			walletAuthMethodId: walletAuthMethodId.value,
+			assertion: args.authorization.assertion,
+			operationKind: "near.export_key",
+			operationChallenge,
+			requestOrigin,
+			nowMs: args.nowMs
+		});
+	} catch {
+		return authorizationFailure({
+			status: 503,
+			code: "export_voiceid_unavailable",
+			message: "VoiceID export verification is unavailable"
+		});
+	}
+	if (verified.kind === "rejected") return authorizationFailure({
+		status: 403,
+		code: verified.code === "method_unavailable" ? "export_voiceid_method_unavailable" : "export_voiceid_not_verified",
+		message: "Fresh VoiceID export proof was not verified"
+	});
+	return {
+		ok: true,
+		verified
+	};
+}
+async function authorizeVoiceIdExportAdmission(args) {
+	const checked = await verifyVoiceIdExportProof(args);
+	if (!checked.ok) return checked;
+	const verified = checked.verified;
+	const recorded = await recordFreshExportProof({
+		walletId: args.walletId,
+		input: args.input,
+		authority: verified.authority,
+		authorizedOperations: args.authorizedOperations,
+		voiceIdProof: verified.proof,
+		verifiedAtMs: args.nowMs,
+		expiresAtMs: Math.min(args.input.body.authorization.expires_at_ms, verified.proof.statement.expiresAtMs)
+	});
+	if (!recorded.ok) return recorded;
+	return {
+		ok: true,
+		admission: recorded.admission,
+		walletId: recorded.walletId,
+		custodyRelease: {
+			kind: "voiceid_custody_envelope",
+			envelope: verified.custodyEnvelope
+		}
+	};
+}
 async function recordFreshExportProof(args) {
 	const authorizationIdentitySuffix = base64UrlEncode(Uint8Array.from(args.input.body.authorization.authorization_digest));
 	const principalId = parsePrincipalId(`ed25519-export:${args.walletId}`);
@@ -891,11 +976,9 @@ async function recordFreshExportProof(args) {
 	let challengeId = null;
 	let assertionDigest = null;
 	switch (args.authority.factor.kind) {
-		case "voiceid": return authorizationFailure({
-			status: 403,
-			code: "export_authorization_invalid",
-			message: "Use a passkey or Email OTP to export keys."
-		});
+		case "voiceid":
+			factorId = parseAuthFactorId(`voiceid:${args.authority.factor.deviceKeyId}`);
+			break;
 		case "passkey":
 			factorId = parseAuthFactorId(`passkey:${args.authority.factor.credentialIdB64u}`);
 			try {
@@ -911,14 +994,15 @@ async function recordFreshExportProof(args) {
 				case "email_otp_factor":
 					rawChallengeId = args.input.authorization.challengeId;
 					break;
-				case "passkey": break;
+				case "passkey":
+				case "voiceid_device": break;
 				default: assertNeverExportAdmissionAuthorization(args.input.authorization);
 			}
 			challengeId = parseEmailOtpChallengeId(rawChallengeId);
 			break;
 		}
 	}
-	if (!principalId.ok || !capabilityId.ok || !operationId.ok || !evidenceId.ok || !evidenceSetId.ok || !authorizedOperationId.ok || !auditEventId.ok || !factorId.ok || challengeId !== null && !challengeId.ok || args.authority.factor.kind === "passkey" && assertionDigest === null) return authorizationFailure({
+	if (!principalId.ok || !capabilityId.ok || !operationId.ok || !evidenceId.ok || !evidenceSetId.ok || !authorizedOperationId.ok || !auditEventId.ok || !factorId.ok || challengeId !== null && !challengeId.ok || args.authority.factor.kind === "passkey" && assertionDigest === null || args.authority.factor.kind === "voiceid" && !args.voiceIdProof) return authorizationFailure({
 		status: 403,
 		code: "export_authorization_invalid",
 		message: "Ed25519 Yao export owner proof identifiers are invalid"
@@ -974,6 +1058,21 @@ async function recordFreshExportProof(args) {
 				expiresAtMs: args.expiresAtMs
 			});
 			break;
+		case "voiceid":
+			factor = buildVerifiedWalletOperationVoiceIdFactorResult({
+				tenantId: args.authorizedOperations.tenantId,
+				principalId: principalId.value,
+				walletId: args.walletId,
+				requestOrigin,
+				audience: requestOrigin,
+				factorId: factorId.value,
+				authorityRef,
+				operation,
+				proof: requireVoiceIdProof(args.voiceIdProof),
+				verifiedAtMs: args.verifiedAtMs,
+				expiresAtMs: args.expiresAtMs
+			});
+			break;
 	}
 	const evidence = await args.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation,
@@ -1003,6 +1102,10 @@ async function recordFreshExportProof(args) {
 		})
 	};
 }
+function requireVoiceIdProof(proof) {
+	if (!proof) throw new Error("VoiceID export proof is required");
+	return proof;
+}
 var ExportOperationAdmission = class {
 	constructor(authorizedOperations, operation) {
 		this.authorizedOperations = authorizedOperations;
@@ -1053,9 +1156,10 @@ function exportOwnerProofRejected(code) {
 	});
 }
 var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
-	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation, admitEstablishedHome) {
+	constructor(webAuthn, emailOtp, voiceId, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation, admitEstablishedHome) {
 		this.webAuthn = webAuthn;
 		this.emailOtp = emailOtp;
+		this.voiceId = voiceId;
 		this.walletAuthMethods = walletAuthMethods;
 		this.authorizedOperations = authorizedOperations;
 		this.resolveEd25519MaterialActivation = resolveEd25519MaterialActivation;
@@ -1071,6 +1175,7 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 			input,
 			webAuthn: this.webAuthn,
 			emailOtp: this.emailOtp,
+			voiceId: this.voiceId,
 			walletAuthMethods: this.walletAuthMethods,
 			authorizedOperations: this.authorizedOperations
 		});
@@ -1095,7 +1200,8 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 			authorizationIdentity: activeIdentity.authorizationIdentity,
 			ownershipGeneration: home.ownershipGeneration,
 			admission: checked.admission,
-			...checked.factorRelease ? { factorRelease: checked.factorRelease } : {}
+			...checked.factorRelease ? { factorRelease: checked.factorRelease } : {},
+			...checked.custodyRelease ? { custodyRelease: checked.custodyRelease } : {}
 		};
 	}
 	authorizeExecution(input) {
@@ -1112,6 +1218,29 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 			authorizationIdentity
 		} : checked;
 	}
+	async releaseVoiceIdCustodyForAuthorizedExport(input) {
+		const walletId = parseWalletId(input.body.application_binding.wallet_id);
+		if (input.authorization.kind !== "voiceid_device" || !walletId.ok) return authorizationFailure({
+			status: 403,
+			code: "export_authorization_method_mismatch",
+			message: "Only a VoiceID export releases a VoiceID custody envelope"
+		});
+		const checked = await verifyVoiceIdExportProof({
+			walletId: walletId.value,
+			input,
+			authorization: input.authorization,
+			voiceId: this.voiceId,
+			nowMs: Date.now()
+		});
+		if (!checked.ok) return checked;
+		return {
+			ok: true,
+			custodyRelease: {
+				kind: "voiceid_custody_envelope",
+				envelope: checked.verified.custodyEnvelope
+			}
+		};
+	}
 	async resolveAuthorizationIdentity(body) {
 		return await resolveActiveExportAuthorizationIdentity({
 			body,
@@ -1127,7 +1256,7 @@ const ROUTES = Object.freeze([defineRoute({
 	auth: {
 		plane: "public",
 		proof: "challenge_exchange",
-		rationale: "Exact-seed export requires fresh passkey assertion or Email OTP factor possession."
+		rationale: "Exact-seed export requires a fresh passkey assertion, Email OTP factor possession or VoiceID device proof."
 	},
 	metering: { kind: "none" },
 	requiredServices: [],
@@ -1213,6 +1342,42 @@ function parseEmailOtpExportAdmissionAuthorization(authorization) {
 		}
 	};
 }
+function parseVoiceIdExportAdmissionAuthorization(authorization) {
+	const unexpectedField = firstUnexpectedField(authorization, [
+		"kind",
+		"walletAuthMethodId",
+		"assertion"
+	]);
+	if (unexpectedField) return {
+		ok: false,
+		message: `VoiceID export authorization has unknown field: ${unexpectedField}`
+	};
+	let assertion;
+	try {
+		assertion = parseVoiceIdOperationAssertion(authorization.assertion);
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : "VoiceID export assertion is invalid"
+		};
+	}
+	if (typeof authorization.walletAuthMethodId !== "string" || authorization.walletAuthMethodId !== assertion.statement.walletAuthMethodId) return {
+		ok: false,
+		message: "walletAuthMethodId must name the signing VoiceID method"
+	};
+	if (assertion.statement.operationKind !== "near.export_key") return {
+		ok: false,
+		message: "VoiceID export assertion names another operation"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "voiceid_device",
+			walletAuthMethodId: authorization.walletAuthMethodId,
+			assertion
+		}
+	};
+}
 function parseExportAdmissionAuthorization(value) {
 	if (!isPlainObject(value)) return {
 		ok: false,
@@ -1221,6 +1386,7 @@ function parseExportAdmissionAuthorization(value) {
 	switch (value.kind) {
 		case "passkey": return parsePasskeyExportAdmissionAuthorization(value);
 		case "email_otp_factor": return parseEmailOtpExportAdmissionAuthorization(value);
+		case "voiceid_device": return parseVoiceIdExportAdmissionAuthorization(value);
 		default: return {
 			ok: false,
 			message: "export admission authorization kind is invalid"
@@ -1311,7 +1477,8 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json({
 				protocol: result.value,
-				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
+				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {},
+				...authorized.custodyRelease ? { voiceIdCustodyEnvelope: authorized.custodyRelease.envelope } : {}
 			}, { status: result.status }) : json({
 				ok: false,
 				code: result.code,

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js

@@ -165,7 +165,8 @@ async function handleAdmissionRequest(context, raw) {
 	const result = await runAdmission(context, parsed.protocol, admission.authorizationIdentity);
 	if (result.ok) return json({
 		protocol: result.value,
-		...admission.factorRelease ? { factorRelease: admission.factorRelease } : {}
+		...admission.factorRelease ? { factorRelease: admission.factorRelease } : {},
+		...admission.custodyRelease ? { voiceIdCustodyEnvelope: admission.custodyRelease.envelope } : {}
 	}, { status: result.status });
 	return exportResponse(result);
 }
@@ -204,10 +205,22 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 		const resolved = await context.input.authorization.resolveAuthorizationIdentity(parsed.protocol);
 		if (!resolved.ok) return resolved;
 		if (!sameAuthorizationIdentity(resolved.authorizationIdentity, existingAuthority.authorizationIdentity)) return authorizationFailure(409, "export_authorization_conflict", "Export authorization owner changed for an existing request");
+		let custodyRelease = null;
+		if (parsed.authorization.kind === "voiceid_device") {
+			const released = await context.input.authorization.releaseVoiceIdCustodyForAuthorizedExport({
+				request: context.input.request,
+				body: parsed.protocol,
+				authorization: parsed.authorization,
+				expectedOrigin
+			});
+			if (!released.ok) return released;
+			custodyRelease = released.custodyRelease;
+		}
 		verified = {
 			identity: existingAuthority.authorizationIdentity,
 			ownershipGeneration: existingAuthority.ownershipGeneration,
-			admission: null
+			admission: null,
+			...custodyRelease ? { custodyRelease } : {}
 		};
 	} else {
 		let authorized;
@@ -226,7 +239,8 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 			identity: authorized.authorizationIdentity,
 			ownershipGeneration: authorized.ownershipGeneration,
 			admission: authorized.admission,
-			...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
+			...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {},
+			...authorized.custodyRelease ? { custodyRelease: authorized.custodyRelease } : {}
 		};
 	}
 	const authorizationFingerprint = await authorizationFingerprintForIdentity(parsed, verified.identity);
@@ -236,7 +250,8 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 			identity: verified.identity,
 			ownershipGeneration: verified.ownershipGeneration,
 			admission: verified.admission,
-			...decision.value.factorRelease ? { factorRelease: decision.value.factorRelease } : {}
+			...decision.value.factorRelease ? { factorRelease: decision.value.factorRelease } : {},
+			...verified.custodyRelease ? { custodyRelease: verified.custodyRelease } : {}
 		}) : decision.value;
 		if (!verified.admission) return authorizationFailure(503, "export_authorization_uncertain", "Export authorization changed while it was being replayed");
 		const prepared = await verified.admission.prepare();
@@ -264,7 +279,8 @@ function authorizedRun(verified) {
 	return {
 		ok: true,
 		authorizationIdentity: verified.identity,
-		...verified.factorRelease ? { factorRelease: verified.factorRelease } : {}
+		...verified.factorRelease ? { factorRelease: verified.factorRelease } : {},
+		...verified.custodyRelease ? { custodyRelease: verified.custodyRelease } : {}
 	};
 }
 async function persistAuthorizationUncertain(context, request) {

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -266,6 +266,10 @@ function walletExecutionLaneAuthSourceFromAuthority(authority) {
 		kind: "passkey",
 		credentialIdB64u: authority.factor.credentialIdB64u
 	};
+	if (authority.factor.kind === "voiceid") return {
+		kind: "voiceid",
+		deviceKeyId: authority.factor.deviceKeyId
+	};
 	const providerSubject = parseProviderSubject(authority.factor.providerUserId);
 	return providerSubject.ok ? {
 		kind: "oidc_provider",

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -4,7 +4,8 @@ import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletOperationVoiceIdFactorResult } from "../../../../authorization/factorEvidence.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { json } from "../../../framework/http.js";
@@ -152,6 +153,55 @@ async function verifyEcdsaOperationStepUpFactor(input) {
 				} : { kind: "not_requested" }
 			};
 		}
+		case "voiceid": {
+			if (input.operation.operation.operationKind !== "evm.export_key" || input.authSource.kind !== "voiceid" || proof.authority.factor.deviceKeyId !== input.authSource.deviceKeyId) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "scope_mismatch",
+					message: "VoiceID authority changed"
+				}, { status: 403 })
+			};
+			const verified = await input.voiceId.verifyVoiceIdOperation({
+				walletId: input.walletId,
+				walletAuthMethodId: proof.authority.bindingId,
+				assertion: proof.assertion,
+				operationKind: "evm.export_key",
+				operationChallenge: parseDigestB64u(input.expectedChallenge),
+				requestOrigin: input.requestOrigin,
+				nowMs: Date.now()
+			});
+			if (verified.kind === "rejected" || !walletAuthAuthoritiesMatch(verified.authority, proof.authority)) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "not_verified",
+					message: "VoiceID operation proof was not verified"
+				}, { status: 401 })
+			};
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.proof.statement.expiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`voiceid:${proof.authority.factor.deviceKeyId}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationVoiceIdFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					proof: verified.proof,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
 		default: throw new Error("Unsupported ECDSA operation step-up proof");
 	}
 }

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -31,6 +31,7 @@ async function verifyActiveEcdsaOperationStepUpAuthority(walletAuthMethods, proo
 	switch (proof.kind) {
 		case "passkey": return await walletAuthMethods.verifyActivePasskeyAuthority(proof.authority);
 		case "email_otp": return await walletAuthMethods.verifyActiveEmailOtpAuthority(proof.authority);
+		case "voiceid": return { ok: true };
 		default: throw new Error("Unsupported ECDSA operation step-up proof");
 	}
 }
@@ -569,7 +570,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		expectedChallenge,
 		expiresAtMs,
 		webAuthn: input.ctx.service.webAuthn,
-		emailOtp: input.ctx.service.emailOtp
+		emailOtp: input.ctx.service.emailOtp,
+		voiceId: input.ctx.service.walletUnlock
 	});
 	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -22,7 +22,8 @@ const EVM_ECDSA_MPC_OPERATION_KINDS = {
 const AUTHORIZATION_EVIDENCE_KINDS = {
 	seamsSession: "seams_session",
 	passkeyAssertion: "passkey_assertion",
-	emailOtp: "email_otp"
+	emailOtp: "email_otp",
+	voiceIdDevice: "voiceid_device"
 };
 const AUTHORIZATION_GRANT_KINDS = { walletSession: "wallet_session_authorization" };
 const CAPABILITY_KIND_VALUES = Object.values(CAPABILITY_KINDS);

package/dist/esm/shared-ts/src/authorization/voiceIdDeviceAssertion.js

@@ -104,7 +104,76 @@ function voiceIdWalletSessionChallengeBytes(challenge) {
 	const payload = alphabetizeStringify(challenge);
 	return new TextEncoder().encode(`${CHALLENGE_DOMAIN}|${payload}`);
 }
+const OPERATION_DOMAIN = "seams:wallet-operation:voiceid-device:v1";
+function parseVoiceIdOperationKind(value) {
+	if (value === "near.export_key" || value === "evm.export_key") return value;
+	throw new Error("VoiceID operation kind is unsupported");
+}
+function buildVoiceIdOperationStatement(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	return {
+		kind: "voiceid_operation_statement_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		operationKind: parseVoiceIdOperationKind(fields.operationKind),
+		operationChallenge: parseDigestB64u(fields.operationChallenge),
+		requestOrigin: fields.requestOrigin,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdOperationStatement(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"operationKind",
+		"operationChallenge",
+		"requestOrigin",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_operation_statement_v1") throw new Error("Invalid VoiceID operation statement");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok) throw new Error("VoiceID operation identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID operation times must be numbers");
+	return buildVoiceIdOperationStatement({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		operationKind: parseVoiceIdOperationKind(raw.operationKind),
+		operationChallenge: parseDigestB64u(raw.operationChallenge),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdOperationAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"statement",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_operation_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID operation assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_operation_assertion_v1",
+		statement: parseVoiceIdOperationStatement(raw.statement),
+		signatureB64u: raw.signatureB64u
+	};
+}
+function voiceIdOperationStatementBytes(statement) {
+	const payload = alphabetizeStringify(statement);
+	return new TextEncoder().encode(`${OPERATION_DOMAIN}|${payload}`);
+}
 //#endregion
-export { buildVoiceIdWalletSessionChallenge, parseVoiceIdDeviceAssertion, parseVoiceIdDevicePublicKeyB64u, parseVoiceIdWalletSessionChallenge, voiceIdWalletSessionChallengeBytes };
+export { buildVoiceIdWalletSessionChallenge, parseVoiceIdDeviceAssertion, parseVoiceIdDevicePublicKeyB64u, parseVoiceIdOperationAssertion, parseVoiceIdWalletSessionChallenge, voiceIdOperationStatementBytes, voiceIdWalletSessionChallengeBytes };
 
 //# sourceMappingURL=voiceIdDeviceAssertion.js.map

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -9,7 +9,8 @@ import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
+import { parseVoiceIdOperationAssertion } from "../authorization/voiceIdDeviceAssertion.js";
 //#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
 /**
 * The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
@@ -1463,6 +1464,22 @@ function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {
 				otp_code: requireAsciiNonEmptyString(proof.otp_code, "operationStepUpAuthorizationRequest.proof.otp_code")
 			};
 			break;
+		case "voiceid": {
+			requireExactKeys(proof, "operationStepUpAuthorizationRequest.proof", [
+				"kind",
+				"authority",
+				"assertion"
+			]);
+			if (!authority || !isVoiceIdWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact VoiceID authority");
+			const assertion = parseVoiceIdOperationAssertion(proof.assertion);
+			if (assertion.statement.walletId !== authority.walletId || assertion.statement.walletAuthMethodId !== authority.bindingId || assertion.statement.deviceKeyId !== authority.factor.deviceKeyId) throw new Error("operationStepUpAuthorizationRequest.proof names another VoiceID method");
+			parsedProof = {
+				kind: "voiceid",
+				authority,
+				assertion
+			};
+			break;
+		}
 		default: throw new Error("operationStepUpAuthorizationRequest.proof.kind is invalid");
 	}
 	return {

package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js

@@ -139,6 +139,13 @@ async function deriveRouterAbEd25519YaoExportConfirmationDigestV1(input) {
 	]);
 	return Array.from(await sha256(encoded));
 }
+function exportAuthoritySubject(authority) {
+	switch (authority.kind) {
+		case "passkey": return requireVisibleIdentifier(authority.credentialIdB64u, "credentialIdB64u");
+		case "email_otp": return requireVisibleIdentifier(authority.providerSubjectId, "providerSubjectId");
+		case "voiceid": return requireVisibleIdentifier(authority.deviceKeyId, "deviceKeyId");
+	}
+}
 async function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input) {
 	const confirmationDigest = requireBytes32(input.confirmationDigest, "export confirmation digest", true);
 	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
@@ -150,7 +157,7 @@ async function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input) {
 		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
 		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs)),
 		labeledField("authorityKind", UTF8.encode(input.authority.kind)),
-		labeledField("authoritySubject", UTF8.encode(input.authority.kind === "passkey" ? requireVisibleIdentifier(input.authority.credentialIdB64u, "credentialIdB64u") : requireVisibleIdentifier(input.authority.providerSubjectId, "providerSubjectId")))
+		labeledField("authoritySubject", UTF8.encode(exportAuthoritySubject(input.authority)))
 	]);
 	return Array.from(await sha256(encoded));
 }

package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts

@@ -48,9 +48,10 @@ export declare const AUTHORIZATION_EVIDENCE_KINDS: {
     readonly seamsSession: 'seams_session';
     readonly passkeyAssertion: 'passkey_assertion';
     readonly emailOtp: 'email_otp';
+    readonly voiceIdDevice: 'voiceid_device';
 };
 type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
-type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
+type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp | typeof AUTHORIZATION_EVIDENCE_KINDS.voiceIdDevice;
 export type AuthorizationEvidenceKind = SessionAuthorizationEvidenceKind | InteractiveAuthorizationEvidenceKind;
 export type AuthorizationEvidenceRequirement = {
     readonly mode: 'all' | 'any';