@seams/wallet-server 0.44.0 → 0.46.0

package/dist/types/shared-ts/src/authorization/voiceIdDeviceAssertion.d.ts

@@ -28,5 +28,35 @@ export declare function buildVoiceIdWalletSessionChallenge(fields: Omit<VoiceIdW
 export declare function parseVoiceIdWalletSessionChallenge(raw: unknown): VoiceIdWalletSessionChallenge;
 export declare function parseVoiceIdDeviceAssertion(raw: unknown): VoiceIdDeviceAssertion;
 export declare function voiceIdWalletSessionChallengeBytes(challenge: VoiceIdWalletSessionChallenge): Uint8Array<ArrayBuffer>;
+/** The operations a fresh voice check can authorize; signing uses a Wallet Session. */
+export type VoiceIdOperationKind = 'near.export_key' | 'evm.export_key';
+/**
+ * What the enrolled device key signs after a local voice match for one
+ * operation. `operationChallenge` is the digest that a passkey signs for the
+ * same operation, and the server accepts that operation only once. It is a
+ * different statement from a Wallet Session challenge, under its own domain,
+ * so neither proof can stand in for the other.
+ */
+export type VoiceIdOperationStatement = Readonly<{
+    kind: 'voiceid_operation_statement_v1';
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    walletAuthorityId: WalletAuthorityId;
+    deviceKeyId: DigestB64u;
+    operationKind: VoiceIdOperationKind;
+    operationChallenge: DigestB64u;
+    requestOrigin: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+}>;
+export type VoiceIdOperationAssertion = Readonly<{
+    kind: 'voiceid_operation_assertion_v1';
+    statement: VoiceIdOperationStatement;
+    signatureB64u: string;
+}>;
+export declare function buildVoiceIdOperationStatement(fields: Omit<VoiceIdOperationStatement, 'kind'>): VoiceIdOperationStatement;
+export declare function parseVoiceIdOperationStatement(raw: unknown): VoiceIdOperationStatement;
+export declare function parseVoiceIdOperationAssertion(raw: unknown): VoiceIdOperationAssertion;
+export declare function voiceIdOperationStatementBytes(statement: VoiceIdOperationStatement): Uint8Array<ArrayBuffer>;
 export {};
 //# sourceMappingURL=voiceIdDeviceAssertion.d.ts.map

package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts

@@ -5,7 +5,8 @@ import { type EcdsaServerGeneration } from './ecdsaCapabilityActivation';
 import { type RouterAbMpcMaterialActivationRefWire, type RouterAbNormalSigningAuthorizationWire } from './routerAbNormalSigningIdentity';
 import { type EvmEcdsaMpcOperationKind, type MpcWalletSigningQuotaId, type WalletSessionMintId, type EcdsaAuthorizationSessionId, type WalletSessionAuthorizationId, type WalletSessionId } from '../authorization/capabilityKinds';
 import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../device-linking/contracts';
-import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority } from './walletAuthAuthority';
+import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type VoiceIdWalletAuthAuthority } from './walletAuthAuthority';
+import { type VoiceIdOperationAssertion } from '../authorization/voiceIdDeviceAssertion';
 /**
  * The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
  * pool fill only when the requested ceremony deadline is within this limit.
@@ -486,12 +487,21 @@ type RouterAbEcdsaOperationStepUpProofV1Wire = {
     readonly webauthn_authentication: RouterAbEcdsaOperationStepUpWebAuthnCredentialV1Wire;
     readonly challenge_id?: never;
     readonly otp_code?: never;
+    readonly assertion?: never;
 } | {
     readonly kind: 'email_otp';
     readonly authority: EmailOtpWalletAuthAuthority;
     readonly challenge_id: string;
     readonly otp_code: string;
     readonly webauthn_authentication?: never;
+    readonly assertion?: never;
+} | {
+    readonly kind: 'voiceid';
+    readonly authority: VoiceIdWalletAuthAuthority;
+    readonly assertion: VoiceIdOperationAssertion;
+    readonly webauthn_authentication?: never;
+    readonly challenge_id?: never;
+    readonly otp_code?: never;
 };
 export type RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire = {
     readonly kind: 'router_ab_ecdsa_operation_step_up_v1';

package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts

@@ -7,6 +7,9 @@ type RouterAbEd25519YaoExportAuthorityBindingV1 = ReadonlyExclusiveUnion<{
 } | {
     readonly kind: 'email_otp';
     readonly providerSubjectId: string;
+} | {
+    readonly kind: 'voiceid';
+    readonly deviceKeyId: string;
 }>;
 export declare function requireVisibleIdentifier(value: unknown, label: string): string;
 export declare function requireBytes(value: unknown, label: string, minimumLength: number, maximumLength: number): number[];

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -36,6 +36,9 @@ export type VerifiedOwnerProofCommon = {
     readonly authSource: {
         readonly kind: 'passkey';
         readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    } | {
+        readonly kind: 'voiceid';
+        readonly deviceKeyId: DigestB64u;
     } | {
         readonly kind: 'oidc_provider';
         readonly providerId: 'google_oidc' | 'oidc';

package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts

@@ -4,6 +4,7 @@ import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitive
 import { type EmailOtpChallengeId, type WalletId, type WebAuthnCredentialIdB64u } from '../../../shared-ts/src/utils/domainIds';
 import { type WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
 import type { OwnerOperationBinding, SessionOrigin, VerifiedOwnerProofFields, VerifiedAuthorizationEvidence, VerifiedOwnerProofId, VerifiedOwnerProofMethod } from './domain';
+import type { VerifiedVoiceIdOperationProof } from './voiceIdDeviceProof';
 type VerifiedWalletOperationEvidenceSetFields = {
     readonly tenantId: TenantId;
     readonly principalId: PrincipalId;
@@ -66,7 +67,12 @@ type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactor
     readonly challengeId: EmailOtpChallengeId;
     readonly verificationReceiptDigest: DigestB64u;
 };
-export type VerifiedWalletOperationFactorResult = VerifiedWalletOperationPasskeyFactorResult | VerifiedWalletOperationEmailOtpFactorResult;
+type VerifiedWalletOperationVoiceIdFactorResult = VerifiedWalletOperationFactorBinding & {
+    readonly kind: 'verified_wallet_operation_voiceid_factor';
+    readonly deviceKeyId: DigestB64u;
+    readonly assertionDigest: DigestB64u;
+};
+export type VerifiedWalletOperationFactorResult = VerifiedWalletOperationPasskeyFactorResult | VerifiedWalletOperationEmailOtpFactorResult | VerifiedWalletOperationVoiceIdFactorResult;
 type VerifiedWalletSessionFactorBinding = {
     readonly tenantId: TenantId;
     readonly principalId: PrincipalId;
@@ -106,6 +112,10 @@ export type VerifiedOwnerProofInput = {
 };
 export declare function buildVerifiedWalletOperationPasskeyFactorResult(fields: Omit<VerifiedWalletOperationPasskeyFactorResult, 'kind'>): VerifiedWalletOperationPasskeyFactorResult;
 export declare function buildVerifiedWalletOperationEmailOtpFactorResult(fields: Omit<VerifiedWalletOperationEmailOtpFactorResult, 'kind'>): VerifiedWalletOperationEmailOtpFactorResult;
+/** Only a verified operation statement yields this factor; its proof supplies the key and digest. */
+export declare function buildVerifiedWalletOperationVoiceIdFactorResult(fields: Omit<VerifiedWalletOperationVoiceIdFactorResult, 'kind' | 'deviceKeyId' | 'assertionDigest'> & {
+    readonly proof: VerifiedVoiceIdOperationProof;
+}): VerifiedWalletOperationVoiceIdFactorResult;
 export declare function buildVerifiedWalletSessionPasskeyFactorResult(fields: Omit<VerifiedWalletSessionPasskeyFactorResult, 'kind'>): VerifiedWalletSessionPasskeyFactorResult;
 export declare function buildVerifiedWalletSessionEmailOtpFactorResult(fields: Omit<VerifiedWalletSessionEmailOtpFactorResult, 'kind'>): VerifiedWalletSessionEmailOtpFactorResult;
 /** Nominal server-only owner proofs; private constructors block browser forgery. */

package/dist/types/wallet-server/src/authorization/voiceIdDeviceProof.d.ts

@@ -1,4 +1,4 @@
-import { type VoiceIdDevicePublicKeyB64u, type VoiceIdWalletSessionChallenge } from '../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import { type VoiceIdDevicePublicKeyB64u, type VoiceIdOperationKind, type VoiceIdOperationStatement, type VoiceIdWalletSessionChallenge } from '../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
 import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 export type RegisteredVoiceIdDeviceKey = Readonly<{
@@ -25,5 +25,31 @@ export declare function verifyVoiceIdWalletSessionAssertion(input: {
     nowMs: number;
     consumeChallenge: ConsumeVoiceIdChallenge;
 }): Promise<VerifiedVoiceIdSessionProof>;
+declare class VerifiedVoiceIdOperationStatementProof {
+    readonly statement: VoiceIdOperationStatement;
+    readonly deviceKeyId: DigestB64u;
+    readonly assertionDigest: DigestB64u;
+    private readonly proofBrand;
+    constructor(statement: VoiceIdOperationStatement, deviceKeyId: DigestB64u, assertionDigest: DigestB64u);
+}
+/**
+ * A voice check for one operation. It is not a Wallet Session proof, and no
+ * conversion exists between the two: a session assertion signs a different
+ * statement under a different domain.
+ */
+export type VerifiedVoiceIdOperationProof = VerifiedVoiceIdOperationStatementProof;
+/**
+ * Only this server boundary turns a signed operation statement into verified
+ * proof. The caller supplies the digest the operation expects and owns its
+ * single use, as it does for a passkey assertion over the same digest.
+ */
+export declare function verifyVoiceIdOperationAssertion(input: {
+    registered: RegisteredVoiceIdDeviceKey;
+    assertion: unknown;
+    operationKind: VoiceIdOperationKind;
+    operationChallenge: DigestB64u;
+    requestOrigin: string;
+    nowMs: number;
+}): Promise<VerifiedVoiceIdOperationProof>;
 export {};
 //# sourceMappingURL=voiceIdDeviceProof.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1VoiceIdSessions.d.ts

@@ -2,7 +2,7 @@ import type { AuthorizationService } from '../../../../authorization/service';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/d1PasskeyCustodyEnvelopeStore';
 import type { D1WalletAuthorityStore } from './d1WalletAuthorityStore';
-import type { VoiceIdChallengeRequest, VoiceIdChallengeResult, VoiceIdVerifyRequest, VoiceIdVerifyResult } from '../../../domains/voiceId/voiceIdSessions';
+import type { VoiceIdChallengeRequest, VoiceIdChallengeResult, VoiceIdOperationVerifyRequest, VoiceIdOperationVerifyResult, VoiceIdVerifyRequest, VoiceIdVerifyResult } from '../../../domains/voiceId/voiceIdSessions';
 import { D1VoiceIdWalletSessionChallenges } from './d1VoiceIdWalletSessionChallenges';
 export declare class D1VoiceIdSessions {
     private readonly authMethods;
@@ -15,5 +15,7 @@ export declare class D1VoiceIdSessions {
     private resolveActiveMethod;
     issueChallenge(input: VoiceIdChallengeRequest): Promise<VoiceIdChallengeResult>;
     verifyAndIssue(input: VoiceIdVerifyRequest): Promise<VoiceIdVerifyResult>;
+    /** Verifies a voice check for one operation; the operation's own claim makes it single use. */
+    verifyOperation(input: VoiceIdOperationVerifyRequest): Promise<VoiceIdOperationVerifyResult>;
 }
 //# sourceMappingURL=d1VoiceIdSessions.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -2,8 +2,10 @@ import type { WalletExecutionAuthority } from '../../walletRegistration/walletRe
 import { type RouterAbEd25519YaoExportAdmissionReceiptV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1, type RouterAbEd25519YaoExportResultV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
 import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type VoiceIdOperationAssertion } from '../../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { VoiceIdSeedEnvelope } from '../../../../../../shared-ts/src/passkey-custody/custodyEnvelope';
 import type { WebAuthnAuthenticationCredential } from '../../../../core/types';
-import type { RouterApiAuthorizedOperationService, RouterApiEmailOtpRouteService, RouterApiWalletAuthMethodService, RouterApiWalletRegistrationService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
+import type { RouterApiAuthorizedOperationService, RouterApiEmailOtpRouteService, RouterApiWalletAuthMethodService, RouterApiWalletRegistrationService, RouterApiWalletUnlockService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { RouterAbEd25519YaoActiveCapabilityResolverV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoExportExecuteAdmissionContextV1 } from '../routerAbEd25519YaoGatewayEnvelope';
@@ -102,8 +104,10 @@ export type RouterAbEd25519YaoExportAdmissionAuthorization = {
     readonly kind: 'passkey';
     readonly webauthnAuthentication: WebAuthnAuthenticationCredential;
     readonly providerSubjectId?: never;
+    readonly walletAuthMethodId?: never;
     readonly challengeId?: never;
     readonly otpCode?: never;
+    readonly assertion?: never;
 } | {
     readonly kind: 'email_otp_factor';
     readonly providerSubjectId: string;
@@ -111,6 +115,23 @@ export type RouterAbEd25519YaoExportAdmissionAuthorization = {
     readonly challengeId: string;
     readonly otpCode: string;
     readonly webauthnAuthentication?: never;
+    readonly assertion?: never;
+} | {
+    readonly kind: 'voiceid_device';
+    readonly walletAuthMethodId: string;
+    readonly assertion: VoiceIdOperationAssertion;
+    readonly webauthnAuthentication?: never;
+    readonly providerSubjectId?: never;
+    readonly challengeId?: never;
+    readonly otpCode?: never;
+};
+/**
+ * The VoiceID seed envelope the admission returns after a voice check. The
+ * browser opens it with the factor secret from the same check.
+ */
+export type RouterAbEd25519YaoExportVoiceIdCustodyReleaseV1 = {
+    readonly kind: 'voiceid_custody_envelope';
+    readonly envelope: VoiceIdSeedEnvelope;
 };
 export type RouterAbEd25519YaoExportAdmissionAuthorizationInputV1 = {
     readonly request: Request;
@@ -172,6 +193,11 @@ export type RouterAbEd25519YaoExportAdmissionAuthorizationResultV1 = {
     readonly admission: RouterAbEd25519YaoExportOperationAdmissionV1;
     readonly ownershipGeneration: number;
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
+    readonly custodyRelease?: RouterAbEd25519YaoExportVoiceIdCustodyReleaseV1;
+} | RouterAbEd25519YaoExportAuthorizationFailure;
+export type RouterAbEd25519YaoExportVoiceIdCustodyReleaseResultV1 = {
+    readonly ok: true;
+    readonly custodyRelease: RouterAbEd25519YaoExportVoiceIdCustodyReleaseV1;
 } | RouterAbEd25519YaoExportAuthorizationFailure;
 export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
     readonly ok: true;
@@ -182,6 +208,12 @@ export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
 export interface RouterAbEd25519YaoExportAuthorizationAdapter {
     authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1> | RouterAbEd25519YaoExportAdmissionAuthorizationResultV1;
     authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
+    /**
+     * The VoiceID seed envelope for an exact retry of an export already
+     * authorized with VoiceID. The retry's statement is verified again; its
+     * export is not authorized again.
+     */
+    releaseVoiceIdCustodyForAuthorizedExport(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportVoiceIdCustodyReleaseResultV1>;
     /** The identity an already-authorized export's admission resolves to now. */
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
 }
@@ -263,13 +295,15 @@ export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAb
 export declare class RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter implements RouterAbEd25519YaoExportAuthorizationAdapter {
     private readonly webAuthn;
     private readonly emailOtp;
+    private readonly voiceId;
     private readonly walletAuthMethods;
     private readonly authorizedOperations;
     private readonly resolveEd25519MaterialActivation;
     private readonly admitEstablishedHome;
-    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'], admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome']);
+    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, voiceId: Pick<RouterApiWalletUnlockService, 'verifyVoiceIdOperation'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'], admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome']);
     authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1>;
     authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
+    releaseVoiceIdCustodyForAuthorizedExport(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportVoiceIdCustodyReleaseResultV1>;
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult>;
 }
 export type RouterAbEd25519YaoExportAdmissionEnvelopeParseResultV1 = {

package/dist/types/wallet-server/src/router/domains/voiceId/voiceIdSessions.d.ts

@@ -1,4 +1,7 @@
-import type { VoiceIdDeviceAssertion, VoiceIdWalletSessionChallenge } from '../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { VoiceIdDeviceAssertion, VoiceIdOperationKind, VoiceIdWalletSessionChallenge } from '../../../../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+import type { DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { VoiceIdWalletAuthAuthority } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { VerifiedVoiceIdOperationProof } from '../../../authorization/voiceIdDeviceProof';
 import type { WalletAuthMethodId, WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { VoiceIdSeedEnvelope } from '../../../../../shared-ts/src/passkey-custody/custodyEnvelope';
 import type { DirectV2IssueResult, IssuedWalletSessionAuthorizationV2 } from '../../../authorization/domain';
@@ -32,4 +35,23 @@ export type VoiceIdVerifyResult = {
     readonly kind: 'rejected';
     readonly code: 'challenge_unavailable' | 'method_unavailable' | 'invalid_assertion' | 'issuance_unavailable';
 };
+/** A fresh voice check for one operation, verified against the active VoiceID method. */
+export type VoiceIdOperationVerifyRequest = Readonly<{
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    assertion: unknown;
+    operationKind: VoiceIdOperationKind;
+    operationChallenge: DigestB64u;
+    requestOrigin: SessionOrigin;
+    nowMs: number;
+}>;
+export type VoiceIdOperationVerifyResult = {
+    readonly kind: 'verified';
+    readonly proof: VerifiedVoiceIdOperationProof;
+    readonly authority: VoiceIdWalletAuthAuthority;
+    readonly custodyEnvelope: VoiceIdSeedEnvelope;
+} | {
+    readonly kind: 'rejected';
+    readonly code: 'method_unavailable' | 'invalid_assertion';
+};
 //# sourceMappingURL=voiceIdSessions.d.ts.map

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1208,6 +1208,7 @@ export interface RouterApiWalletRegistrationRouteService extends RouterApiWallet
 export interface RouterApiWalletUnlockService {
     issueVoiceIdChallenge(input: import('../domains/voiceId/voiceIdSessions').VoiceIdChallengeRequest): Promise<import('../domains/voiceId/voiceIdSessions').VoiceIdChallengeResult>;
     verifyAndIssueVoiceId(input: import('../domains/voiceId/voiceIdSessions').VoiceIdVerifyRequest): Promise<import('../domains/voiceId/voiceIdSessions').VoiceIdVerifyResult>;
+    verifyVoiceIdOperation(input: import('../domains/voiceId/voiceIdSessions').VoiceIdOperationVerifyRequest): Promise<import('../domains/voiceId/voiceIdSessions').VoiceIdOperationVerifyResult>;
     createEmailOtpUnlockChallenge(input: RouterApiMethodTypes['createEmailOtpUnlockChallenge']['input']): Promise<RouterApiMethodTypes['createEmailOtpUnlockChallenge']['result']>;
     createWebAuthnLoginOptions(input: RouterApiMethodTypes['createWebAuthnLoginOptions']['input']): Promise<RouterApiMethodTypes['createWebAuthnLoginOptions']['result']>;
     markEmailOtpStrongAuthSatisfied(input: RouterApiMethodTypes['markEmailOtpStrongAuthSatisfied']['input']): Promise<RouterApiMethodTypes['markEmailOtpStrongAuthSatisfied']['result']>;

package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts

@@ -5,7 +5,7 @@ import type { RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire } from '../
 import { type VerifiedWalletOperationFactorResult } from '../../../../authorization/factorEvidence';
 import type { SessionOrigin } from '../../../../authorization/domain';
 import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
-import type { RouterApiEmailOtpRouteService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
+import type { RouterApiEmailOtpRouteService, RouterApiWalletUnlockService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
 type StepUpUnseal = {
     readonly kind: 'not_requested';
 } | {
@@ -32,6 +32,7 @@ export declare function verifyEcdsaOperationStepUpFactor(input: {
     readonly expiresAtMs: number;
     readonly webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>;
     readonly emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge' | 'consumeEmailOtpGrant'>;
+    readonly voiceId: Pick<RouterApiWalletUnlockService, 'verifyVoiceIdOperation'>;
 }): Promise<VerifiedStepUpFactorResult>;
 export {};
 //# sourceMappingURL=ecdsaOperationStepUpFactor.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.44.0",
+  "version": "0.46.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",