@seams/wallet 0.22.0 → 0.24.0

package/dist/esm/core/config/configBuilder.js

@@ -1,5 +1,6 @@
 import { normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { normalizeWalletLocale } from "../ui/locale.js";
+import { parseWalletAuthMethodPlugins } from "../authMethods/plugins.js";
 import { copyEcdsaSignerProvisioningDefaults, resolveAppearanceTheme, resolveBoolean, resolveChains, resolveIntegerInRange, resolveThemePalette } from "./configHelpers.js";
 import { normalizeWalletHostVariant } from "../browser/walletIframe/hostVariant.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../shared-ts/src/utils/signingSessionSeal.js";
@@ -156,6 +157,7 @@ function buildConfigsFromDefaults(args) {
 		defaults
 	});
 	return {
+		authMethods: parseWalletAuthMethodPlugins(overrides.authMethods ?? defaults.authMethods),
 		network: {
 			chains,
 			relayer: {

package/dist/esm/core/config/defaultConfigs.js

@@ -11,6 +11,7 @@ const DEFAULT_ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_POLICY = {
 	refillAttemptTimeoutMs: 3e4
 };
 const PASSKEY_MANAGER_DEFAULT_CONFIGS = {
+	authMethods: [],
 	network: {
 		chains: [
 			{

package/dist/esm/core/indexedDB/seamsWalletDB/repositories.js

@@ -42,6 +42,7 @@ function exportRootEnvelopeMatchesAuthMethod(authMethod, envelope) {
 	switch (authMethod.kind) {
 		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === authMethod.rpId && envelope.factor.credentialIdB64u === authMethod.credentialIdB64u && envelope.binding.targetFactor.kind === "passkey_prf";
 		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.binding.targetFactor.kind === "email_otp";
+		case "voiceid": return false;
 		default: return assertNever(authMethod);
 	}
 }
@@ -819,6 +820,10 @@ function unavailableWalletAuthMethodPresentation(record) {
 			kind: "email_otp",
 			email: { kind: "unavailable" }
 		};
+		case "voiceid": return {
+			version: "wallet_auth_method_local_presentation_v1",
+			kind: "voiceid"
+		};
 		default: throw new Error("Wallet auth-method presentation kind is invalid");
 	}
 }
@@ -865,6 +870,12 @@ function parseWalletAuthMethodLocalPresentationV1(value, record) {
 				default: return null;
 			}
 		}
+		case "voiceid":
+			if (!hasExactKeys(value, ["version", "kind"])) return null;
+			return {
+				version: "wallet_auth_method_local_presentation_v1",
+				kind: "voiceid"
+			};
 		default: return null;
 	}
 }
@@ -899,6 +910,16 @@ function walletAuthMethodV2StorageRow(projection) {
 			presentation: projection.presentation,
 			record: projection.record
 		};
+		case "voiceid": return {
+			wallet_auth_method_id: projection.record.walletAuthMethodId,
+			wallet_id: projection.record.walletId,
+			wallet_authority_id: projection.record.walletAuthorityId,
+			kind: "voiceid",
+			status: projection.record.status,
+			updated_at: projection.record.updatedAtMs,
+			presentation: projection.presentation,
+			record: projection.record
+		};
 		default: throw new Error("Wallet auth-method projection kind is invalid");
 	}
 }
@@ -926,12 +947,14 @@ function walletAuthMethodLocalPresentation(record, rows, current) {
 	switch (record.kind) {
 		case "passkey": return unavailableWalletAuthMethodPresentation(record);
 		case "email_otp": return verifiedEmailPresentationFromLocalRecords(record, rows) ?? (current?.kind === "email_otp" && current.email.kind === "verified" ? current : unavailableWalletAuthMethodPresentation(record));
+		case "voiceid": return unavailableWalletAuthMethodPresentation(record);
 		default: throw new Error("Wallet auth-method presentation kind is invalid");
 	}
 }
 function walletAuthMethodLocalPresentationsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	if (left.kind === "passkey" && right.kind === "passkey") return true;
+	if (left.kind === "voiceid" && right.kind === "voiceid") return true;
 	if (left.kind !== "email_otp" || right.kind !== "email_otp") return false;
 	if (left.email.kind !== right.email.kind) return false;
 	if (left.email.kind === "unavailable" && right.email.kind === "unavailable") return true;
@@ -956,6 +979,13 @@ function localWalletAuthMethodProjectionV2(record, presentation) {
 				record,
 				presentation
 			};
+		case "voiceid":
+			if (presentation.kind !== "voiceid") throw new Error("VoiceID auth method has non-VoiceID local presentation");
+			return {
+				kind: "voiceid",
+				record,
+				presentation
+			};
 		default: throw new Error("Wallet auth-method projection kind is invalid");
 	}
 }
@@ -1234,6 +1264,7 @@ function walletCustodyEnvelopeFactorsMatch(left, right) {
 	switch (left.kind) {
 		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.kekVersion === right.kekVersion;
 		case "email_otp": return right.kind === "email_otp" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion && left.kekVersion === right.kekVersion;
+		case "voiceid": return right.kind === "voiceid" && left.deviceKeyId === right.deviceKeyId && left.kekVersion === right.kekVersion;
 		default: return assertNever(left);
 	}
 }
@@ -1282,6 +1313,7 @@ function walletAuthMethodRecordsMatch(left, right) {
 	switch (left.kind) {
 		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter && (left.status === "pending_local_install" || left.activatedAtMs === right.activatedAtMs) && (left.status !== "revoked" || left.revokedAtMs === right.revokedAtMs);
 		case "email_otp": return right.kind === "email_otp" && left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId && (left.status === "pending_local_install" || left.activatedAtMs === right.activatedAtMs) && (left.status !== "revoked" || left.revokedAtMs === right.revokedAtMs);
+		case "voiceid": return right.kind === "voiceid" && left.deviceKeyId === right.deviceKeyId && left.devicePublicKeyB64u === right.devicePublicKeyB64u && (left.status === "pending_local_install" || left.activatedAtMs === right.activatedAtMs) && (left.status !== "revoked" || left.revokedAtMs === right.revokedAtMs);
 	}
 	return assertNever(left);
 }
@@ -1290,6 +1322,7 @@ function walletAuthMethodPendingMatchesActive(pending, active) {
 	switch (pending.kind) {
 		case "passkey": return active.kind === "passkey" && pending.rpId === active.rpId && pending.credentialIdB64u === active.credentialIdB64u && pending.credentialPublicKeyB64u === active.credentialPublicKeyB64u && pending.counter === active.counter;
 		case "email_otp": return active.kind === "email_otp" && pending.emailHashHex === active.emailHashHex && pending.registrationAuthorityId === active.registrationAuthorityId;
+		case "voiceid": return active.kind === "voiceid" && pending.deviceKeyId === active.deviceKeyId && pending.devicePublicKeyB64u === active.devicePublicKeyB64u;
 	}
 	return assertNever(pending);
 }
@@ -1355,6 +1388,7 @@ function parseLocalAuthorityInstallationInput(input) {
 		};
 		const authenticator = input.authenticator === null ? null : normalizeAuthenticatorRecord(input.authenticator);
 		let localAuthMethod = null;
+		if (authMethod.kind === "voiceid") throw new Error("Linked-device VoiceID installation requires its own custody flow");
 		if (authMethod.kind === "passkey") {
 			if (input.localAuthMethod !== null) throw new Error("Passkey installation cannot include a local Email OTP auth method");
 			const passkeyCredential = profile.passkeyCredential;
@@ -1840,9 +1874,13 @@ var SeamsWalletRepositories = class {
 		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletSelections, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", this.markWalletSelectionUnlockedInTransaction.bind(this, {
 			walletId,
 			walletAuthMethodId,
-			unlockedAtMs
+			unlockedAtMs,
+			expectedLockGeneration: null
 		}));
 	}
+	async markWalletSelectionUnlockedAtGeneration(input) {
+		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletSelections, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", this.markWalletSelectionUnlockedInTransaction.bind(this, input));
+	}
 	async persistRecoveredWalletAuthority(input) {
 		const authority = requireBoundaryParsed(parseWalletAuthorityV1(input.authority), "authority");
 		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
@@ -2038,6 +2076,7 @@ var SeamsWalletRepositories = class {
 		const selectionRaw = await selectionStore.get(input.walletId);
 		const selection = selectionRaw === void 0 ? null : parseWalletSelectionStorageRow(selectionRaw);
 		if (!selection || selection.wallet_id !== input.walletId) throw new Error("wallet selection is missing or corrupt");
+		if (input.expectedLockGeneration !== null && selection.record.lockGeneration !== input.expectedLockGeneration) throw new Error("Wallet lock state changed during unlock.");
 		if (selection.record.walletAuthMethodId !== input.walletAuthMethodId) await this.assertSelectionMoveBetweenAuthorityMembers({
 			walletId: input.walletId,
 			fromWalletAuthMethodId: selection.record.walletAuthMethodId,
@@ -4287,6 +4326,6 @@ var SeamsWalletRepositories = class {
 	}
 };
 //#endregion
-export { SeamsWalletRepositories };
+export { SeamsWalletRepositories, parseWalletAuthMethodV2StorageRow, parseWalletAuthorityStorageRow, parseWalletSelectionStorageRow };
 
 //# sourceMappingURL=repositories.js.map

package/dist/esm/core/indexedDB/unifiedIndexedDBManager.js

@@ -265,6 +265,9 @@ var UnifiedIndexedDBManager = class {
 	async markWalletSelectionUnlocked(input) {
 		await this.seamsWalletRepositories.markWalletSelectionUnlocked(input);
 	}
+	async markWalletSelectionUnlockedAtGeneration(input) {
+		await this.seamsWalletRepositories.markWalletSelectionUnlockedAtGeneration(input);
+	}
 	async persistRecoveredWalletAuthority(input) {
 		await this.seamsWalletRepositories.persistRecoveredWalletAuthority(input);
 	}

package/dist/esm/core/rpcClients/relayer/routerAbNormalSigning.js

@@ -5,8 +5,8 @@ import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
 import { buildRelayerJsonPostRequestInit, buildWalletSessionAuthorizationHeaders, fetchWithWalletHomeDiscovery, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { WalletSessionQuotaAdmissionError } from "../../signingEngine/session/operationState/authorizationAdmission.js";
 import { WalletSessionStatusReadScope, parseExactWalletSessionStatusResponse } from "./walletSessionAuthorizationStatus.js";
+import { WalletSessionQuotaAdmissionError } from "../../signingEngine/session/operationState/authorizationAdmission.js";
 import { walletSessionFailureErrorFromPayload } from "../../signingEngine/session/lifecycle/walletSessionFailure.js";
 import { parseEcdsaPrepareSessionResponse } from "./ecdsaPrepareSession.js";
 //#region src/core/rpcClients/relayer/routerAbNormalSigning.ts

package/dist/esm/core/rpcClients/relayer/walletSessionAuthorizationStatus.js

@@ -341,6 +341,6 @@ function createRelayerExactWalletSessionStatusPort(options) {
 	return new RelayerExactWalletSessionStatusPort(options);
 }
 //#endregion
-export { WalletSessionStatusReadScope, parseExactWalletSessionStatusResponse };
+export { WalletSessionStatusReadScope, createRelayerExactWalletSessionStatusPort, parseExactWalletSessionStatusResponse };
 
 //# sourceMappingURL=walletSessionAuthorizationStatus.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/authPlanning.js

@@ -99,6 +99,7 @@ async function resolveEvmFamilyTransactionStepUp(args) {
 	};
 	async function resolveDirectSigningAuthPlan() {
 		if (args.ecdsaAuthorization === "operation_step_up") {
+			if (args.capability.authority.factor.kind === "voiceid") throw new Error("Unlock this wallet with VoiceID again before signing.");
 			if (isPasskeyWalletAuthAuthority(args.capability.authority)) return { signingAuthPlan: {
 				kind: SigningAuthPlanKind.PasskeyReauth,
 				method: "passkey"
@@ -113,7 +114,7 @@ async function resolveEvmFamilyTransactionStepUp(args) {
 					emailOtpAuthBridge
 				};
 			}
-			args.capability.authority;
+			throw new Error("The EVM authentication method cannot authorize this step-up.");
 		}
 		if (!(Array.isArray(args.accountAuth.linkedAuthMethods) ? args.accountAuth.linkedAuthMethods : []).includes(args.accountAuth.primaryAuthMethod)) throw new Error(`[SigningEngine] primary auth method is not linked: ${String(args.accountAuth.primaryAuthMethod || "")}`);
 		if (args.accountAuth.primaryAuthMethod === SIGNER_AUTH_METHODS.passkey) return { signingAuthPlan: {

package/dist/esm/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,20 +1,12 @@
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
-import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
 import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";
 import { resolveEvmFamilyTransactionWalletAuth } from "./accountAuth.js";
 import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { emailOtpEcdsaSigningSessionAuthLane } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
 //#region src/core/signingEngine/flows/signEvmFamily/ecdsaSelection.ts
-function ecdsaLaneCandidateAuthMethod(candidate) {
-	switch (laneCandidateAuthMethod(candidate)) {
-		case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
-		case SIGNER_AUTH_METHODS.passkey: return SIGNER_AUTH_METHODS.passkey;
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported ECDSA lane auth method");
-}
 function walletAuthWithSelectedPrimary(accountAuth, authMethod) {
 	return {
 		...accountAuth,
@@ -49,7 +41,7 @@ function resolvedEvmFamilyEcdsaSigningLaneFromCandidate(candidate) {
 }
 function laneCandidateDiagnosticsBase(candidate) {
 	return {
-		authMethod: ecdsaLaneCandidateAuthMethod(candidate),
+		authMethod: candidate.auth.kind,
 		chain: candidate.chain,
 		chainTarget: candidate.chainTarget,
 		state: candidate.state,
@@ -109,6 +101,26 @@ async function commitPasskeyEcdsaLaneForSelection(args) {
 		authorization: args.lane.authorization
 	};
 }
+async function commitVoiceIdEcdsaLaneForSelection(args) {
+	const candidate = args.candidate;
+	const authority = (await args.deps.resolveCanonicalEcdsaSigningCapability({
+		walletId: candidate.walletId,
+		chainTarget: candidate.chainTarget,
+		materialActivation: candidate.materialActivation
+	})).authority;
+	if (candidate.auth.kind !== "voiceid" || !isVoiceIdWalletAuthAuthority(authority) || authority.bindingId !== candidate.auth.walletAuthMethodId || authority.factor.deviceKeyId !== candidate.auth.deviceKeyId) throw new Error("VoiceID ECDSA capability authority changed.");
+	assertEcdsaCommittedLaneAuthorityMatchesWallet({
+		authority,
+		lane: args.lane,
+		candidate,
+		context: "VoiceID"
+	});
+	return {
+		lane: args.lane,
+		authority,
+		authorization: args.lane.authorization
+	};
+}
 async function resolveEmailOtpAuthorityForSelection(args) {
 	const exactLane = exactEcdsaSigningLaneIdentityFromSelectedLane(args.lane);
 	const laneAuthority = await args.deps.resolveDurableEmailOtpEcdsaSigningSessionAuthority({
@@ -186,7 +198,7 @@ function commitEmailOtpEcdsaLaneForSelection(args) {
 async function resolveEvmFamilyEcdsaSigningSelection(args) {
 	const lane = resolvedEvmFamilyEcdsaSigningLaneFromCandidate(args.laneCandidate);
 	const emailOtpAuthorityLane = lane;
-	const candidateAuthMethod = ecdsaLaneCandidateAuthMethod(args.laneCandidate);
+	const candidateAuthMethod = args.laneCandidate.auth.kind;
 	const emailOtpAuthority = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp ? await resolveEmailOtpAuthorityForSelection({
 		deps: args.deps,
 		lane: emailOtpAuthorityLane,
@@ -207,7 +219,12 @@ async function resolveEvmFamilyEcdsaSigningSelection(args) {
 		lane,
 		candidate: args.laneCandidate
 	}) : null;
-	const committedLane = committedEmailOtpLane ?? committedPasskeyLane;
+	const committedVoiceIdLane = candidateAuthMethod === "voiceid" ? await commitVoiceIdEcdsaLaneForSelection({
+		deps: args.deps,
+		lane,
+		candidate: args.laneCandidate
+	}) : null;
+	const committedLane = committedEmailOtpLane ?? committedPasskeyLane ?? committedVoiceIdLane;
 	const committedFactor = committedLane?.authority.factor.kind;
 	const selectedAccountAuth = walletAuthWithSelectedPrimary(await resolveEvmFamilyTransactionWalletAuth({
 		senderSignatureAlgorithm: args.senderSignatureAlgorithm,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -350,6 +350,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		throw error;
 	}
 	const { signingAuthPlan, emailOtpSigning, flowArgs } = preparedFlow;
+	reviewAdmissionForBinding(deps.touchConfirm.getContext().surfaceMeasurementBinding)?.assertAuthMethodPolicy(signingAuthPlan.method);
 	let freshAuthRetryHandledFinalization = false;
 	const retryWithFreshWalletSessionAuth = async (error) => {
 		return await retryEvmFamilyWithFreshWalletSessionAuthWhenRequired({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -4,10 +4,10 @@ import { activeWalletSessionV1RecordsEqual, walletSessionPreservesCapabilities }
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
+import { WalletSessionStatusReadScope } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
 import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
-import { WalletSessionStatusReadScope } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
 import { authorizeEvmFamilyEcdsaOperationStepUp, prepareEvmFamilyEcdsaOperationStepUp } from "./thresholdAdmission.js";
@@ -29,6 +29,7 @@ function buildActiveWalletAuthorityConfirmationAuthPlan(runtime) {
 }
 function signerAuthMethodForWalletAuthority(authority) {
 	switch (authority.factor.kind) {
+		case "voiceid": return "voiceid";
 		case "passkey": return "passkey";
 		case "email_otp": return "email_otp";
 		default:

package/dist/esm/core/signingEngine/flows/signNear/requireNearStepUpAuth.js

@@ -60,6 +60,7 @@ async function requireNearStepUpAuth(args) {
 }
 function signingAuthPlanForNearMaterialRequirement(auth) {
 	switch (auth.kind) {
+		case "voiceid": throw new Error("Unlock with VoiceID again before signing.");
 		case "passkey": return {
 			kind: "passkeyReauth",
 			method: "passkey"

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -9,9 +9,9 @@ import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
 import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";
+import { WalletSessionStatusReadScope } from "../../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { emitEd25519SigningTiming } from "../../../session/operationState/trace.js";
 import { buildCapabilityOperationEnvelope, parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { WalletSessionStatusReadScope } from "../../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbNormalSigningV2, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint } from "../../../../rpcClients/relayer/routerAbNormalSigning.js";
 import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionOperationFingerprint } from "../../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, decodeThresholdEd25519SignedNearTxBorshWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm } from "../../../chains/near/nearSignerWasm.js";

package/dist/esm/core/signingEngine/flows/signNear/shared/signingSessionAuthMode.js

@@ -26,6 +26,11 @@ function buildPlanningLane(args) {
 		thresholdSessionId: args.selectedLane.thresholdSessionId
 	};
 	switch (args.selectedLane.auth.kind) {
+		case "voiceid": return buildNearTransactionSigningLane({
+			...common,
+			auth: args.selectedLane.auth,
+			storageSource: "login"
+		});
 		case "passkey": return buildNearTransactionSigningLane({
 			...common,
 			auth: args.selectedLane.auth,

package/dist/esm/core/signingEngine/flows/signNear/signNear.js

@@ -61,22 +61,25 @@ async function invalidateAuthoritativeNearWalletSessionExpiry(args) {
 	})).kind === "unavailable") throw new Error("[SigningEngine][near] expired Wallet Session cleanup failed");
 }
 async function signNear(deps, request) {
-	if (request.kind === "transactionWithActions") {
-		const context = deps.getSignerWorkerContext();
-		const admission = reviewAdmissionForBinding(context.touchConfirm?.getContext().surfaceMeasurementBinding);
-		if (admission) {
-			admission.assertPending();
-			deps = {
-				...deps,
-				getSignerWorkerContext: reviewedNearContext.bind(null, context, admission.beforeSigning)
-			};
-		}
-		return await signTransaction(deps, request.args);
-	}
+	const context = deps.getSignerWorkerContext();
+	const admission = request.kind === "transactionWithActions" ? reviewAdmissionForBinding(context.touchConfirm?.getContext().surfaceMeasurementBinding) ?? null : null;
+	if (admission) admission.assertPending();
+	deps = {
+		...deps,
+		prepareNearEd25519YaoMaterialBoundary: prepareReviewBoundNearMaterial.bind(null, deps.prepareNearEd25519YaoMaterialBoundary.bind(deps), admission),
+		getSignerWorkerContext: admission ? reviewedNearContext.bind(null, context, admission.beforeSigning) : deps.getSignerWorkerContext
+	};
+	if (request.kind === "transactionWithActions") return await signTransaction(deps, request.args);
 	if (request.kind === "delegateAction") return await signDelegateAction(deps, request.args);
 	if (request.kind === "nep413") return await signMessage(deps, request.args);
 	throw new Error(`[SigningEngine] unsupported near signing intent: ${String(request.kind || "")}`);
 }
+function prepareReviewBoundNearMaterial(prepare, admission, input) {
+	const method = signingLaneAuthMethod(input.materialIdentity ? input.materialIdentity.auth : input.auth);
+	if (method === "voiceid" && !admission) throw new Error("VoiceID requires a reviewed NEAR transfer.");
+	admission?.assertAuthMethodPolicy(method);
+	return prepare(input);
+}
 function createNearTransactionSigningOperationId() {
 	const randomId = secureRandomBase64Url(32, "NEAR transaction signing operation IDs");
 	return SigningSessionIds.signingOperation(`near-transaction-sign:${randomId}`);
@@ -934,6 +937,7 @@ async function signTransactionWithActionsAttempt(deps, args, attempt) {
 				lane: preparedSigningSession.transactionLane,
 				expiresAtMs: preparationAuthorization.authorization.status.expiresAtMs
 			});
+			if (transactionLane.auth.kind === "voiceid") throw new Error("Unlock with VoiceID again to renew the NEAR Wallet Session.");
 			const isEmailOtpSession = transactionLane.auth.kind === "email_otp";
 			const ownerStepUpReason = ownerDecision?.kind === "step_up_required" ? ownerDecision.reason : void 0;
 			const reason = admissionDecision ? admissionDecision.reason === "stale_projection" ? "wallet_signing_budget_stale_projection" : "wallet_signing_budget_exhausted" : ownerStepUpReason === "wallet_session_missing" ? "threshold_session_missing" : "threshold_session_expired";

package/dist/esm/core/signingEngine/session/availability/availableSigningLanes.js

@@ -10,7 +10,7 @@ function ecdsaAuthorizationPolicyMatchesLane(lane) {
 	return lane.remainingUses === authorization.runtime.remainingUses && lane.expiresAtMs === authorization.runtime.expiresAtMs;
 }
 function availableEcdsaSigningLaneAuthMethod(lane) {
-	return signingLaneAuthMethod(lane.auth);
+	return lane.auth.kind;
 }
 function isConcreteAvailableSigningLane(lane) {
 	if (lane.state === "missing") return false;
@@ -20,9 +20,8 @@ function isConcreteAvailableSigningLane(lane) {
 		if (!thresholdSessionId) return false;
 		if (lane.authorizationState === "authorization_required") return lane.state === "deferred";
 		if (!lane.authorization.operationCredential.walletSessionId || !lane.authorization.session.quotaId || lane.authorization.status.remainingUses <= 0 || lane.authorization.status.expiresAtMs <= Date.now()) return false;
-		return lane.auth.kind === "email_otp" || lane.auth.kind === "passkey";
+		return true;
 	}
-	if (lane.auth.kind !== "email_otp" && lane.auth.kind !== "passkey") return false;
 	if (lane.source === "active_wallet_authority") {
 		if (lane.state !== "deferred" || lane.authorizationState !== "authorization_required" || lane.runtime.kind !== "active_wallet_authority_ecdsa_runtime_v1" || String(lane.runtime.walletId) !== String(lane.key.walletId) || !mpcMaterialActivationRefsEqual(lane.runtime.materialActivation, lane.materialActivation) || lane.runtime.publicFacts !== lane.publicFacts) return false;
 	}

package/dist/esm/core/signingEngine/session/identity/exactSigningLaneIdentity.js

@@ -1,5 +1,6 @@
-import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseMpcMaterialActivationRef, parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { isImplicitNearAccountId, parseNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { SigningSessionIds } from "../operationState/types.js";
@@ -24,6 +25,15 @@ function rejectPresent(record, fields, branch) {
 function parseSigningLaneAuthBinding(value) {
 	const auth = requireRecord(value, "exact lane auth");
 	switch (auth.kind) {
+		case "voiceid": {
+			const method = parseWalletAuthMethodId(auth.walletAuthMethodId);
+			if (!method.ok) throw new Error("VoiceID lane method ID is invalid");
+			return {
+				kind: "voiceid",
+				walletAuthMethodId: method.value,
+				deviceKeyId: parseDigestB64u(auth.deviceKeyId)
+			};
+		}
 		case "passkey": return {
 			kind: "passkey",
 			rpId: toRpId(auth.rpId),
@@ -141,6 +151,11 @@ function canonicalKeyIdentity(key) {
 }
 function canonicalAuthBinding(auth) {
 	switch (auth.kind) {
+		case "voiceid": return {
+			kind: "voiceid",
+			walletAuthMethodId: auth.walletAuthMethodId,
+			deviceKeyId: auth.deviceKeyId
+		};
 		case "passkey": return {
 			kind: "passkey",
 			rpId: String(auth.rpId),

package/dist/esm/core/signingEngine/session/identity/signingLaneAuthBinding.js

@@ -4,6 +4,7 @@ function signingLaneAuthMethod(auth) {
 	switch (auth.kind) {
 		case SIGNER_AUTH_METHODS.passkey: return SIGNER_AUTH_METHODS.passkey;
 		case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
+		case "voiceid": return "voiceid";
 	}
 	throw new Error("[SigningSession] unsupported signing lane auth binding");
 }
@@ -14,6 +15,11 @@ function requireSigningLaneAuthKeyPart(value, label) {
 }
 function signingLaneAuthBindingKey(auth) {
 	switch (auth.kind) {
+		case "voiceid": return [
+			"voiceid",
+			auth.walletAuthMethodId,
+			auth.deviceKeyId
+		].join(":");
 		case SIGNER_AUTH_METHODS.passkey: return [
 			SIGNER_AUTH_METHODS.passkey,
 			requireSigningLaneAuthKeyPart(String(auth.rpId), "passkey rpId"),

package/dist/esm/core/signingEngine/session/material/ecdsaSigningCapability.js

@@ -19,6 +19,7 @@ function capabilityAuthorityMatchesRuntime(args) {
 	const capabilityAuthority = args.capability.authority;
 	const runtimeBinding = args.runtime.authBinding;
 	switch (runtimeBinding.kind) {
+		case "voiceid": return walletAuthAuthoritiesMatch(capabilityAuthority, runtimeBinding.voiceIdAuthority);
 		case "email_otp": return isEmailOtpWalletAuthAuthority(capabilityAuthority) && walletAuthAuthoritiesMatch(capabilityAuthority, runtimeBinding.emailOtpAuthority);
 		case "passkey": return isPasskeyWalletAuthAuthority(capabilityAuthority) && capabilityAuthority.verifier.rpId === runtimeBinding.rpId && capabilityAuthority.factor.credentialIdB64u === runtimeBinding.credentialIdB64u;
 		default: return runtimeBinding;
@@ -26,6 +27,7 @@ function capabilityAuthorityMatchesRuntime(args) {
 }
 function selectedAuthMethodMatchesRuntime(args) {
 	switch (args.runtime.authBinding.kind) {
+		case "voiceid": return args.selectedAuthMethod.kind === "voiceid" && args.selectedAuthMethod.walletAuthMethodId === args.runtime.authBinding.voiceIdAuthority.bindingId && args.selectedAuthMethod.deviceKeyId === args.runtime.authBinding.voiceIdAuthority.factor.deviceKeyId;
 		case "email_otp": return args.selectedAuthMethod.kind === "email_otp" && args.selectedAuthMethod.emailHashHex === args.runtime.authBinding.emailHashHex;
 		case "passkey": return args.selectedAuthMethod.kind === "passkey" && String(args.selectedAuthMethod.rpId) === String(args.runtime.authBinding.rpId) && args.selectedAuthMethod.credentialIdB64u === args.runtime.authBinding.credentialIdB64u;
 		default: return args.runtime.authBinding;
@@ -72,6 +74,7 @@ function exactAuthorizationMatchesCapability(args) {
 function exactEcdsaAuthBindingsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
+		case "voiceid": return right.kind === "voiceid" && walletAuthAuthoritiesMatch(left.voiceIdAuthority, right.voiceIdAuthority);
 		case "email_otp": return right.kind === "email_otp" && left.providerSubjectId === right.providerSubjectId && left.emailHashHex === right.emailHashHex && walletAuthAuthoritiesMatch(left.emailOtpAuthority, right.emailOtpAuthority);
 		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
 		default: return left;

package/dist/esm/core/signingEngine/session/operationState/lanes.js

@@ -38,7 +38,7 @@ function buildEd25519EmailOtpSigningLane(input) {
 		...input.retention ? { retention: input.retention } : {}
 	});
 }
-function buildEcdsaPasskeySigningLane(input) {
+function buildEcdsaStoredSigningLane(input) {
 	return buildSigningLane({
 		...selectedEcdsaLane({
 			key: input.key,
@@ -75,6 +75,23 @@ function buildEcdsaEmailOtpSigningLane(input) {
 	});
 }
 function buildNearTransactionSigningLane(input) {
+	if (input.auth.kind === "voiceid") return buildSigningLane({
+		...selectedEd25519Lane({
+			walletId: input.walletId,
+			nearAccountId: input.nearAccountId,
+			nearEd25519SigningKeyId: input.nearEd25519SigningKeyId,
+			signerSlot: input.signerSlot,
+			auth: input.auth,
+			walletSessionId: input.walletSessionId,
+			quotaId: input.quotaId,
+			thresholdSessionId: input.thresholdSessionId
+		}),
+		keyKind: "threshold_ed25519",
+		chainFamily: "near",
+		storageSource: "login",
+		sessionOrigin: "login",
+		retention: "session"
+	});
 	if (isEd25519EmailOtpTransactionSigningLaneInput(input)) return buildEd25519EmailOtpSigningLane(input);
 	if (isEd25519PasskeyTransactionSigningLaneInput(input)) return buildEd25519PasskeySigningLane(input);
 	throw new Error("[SigningSession] unsupported NEAR lane auth");
@@ -89,7 +106,7 @@ function buildEvmTransactionSigningLane(input) {
 }
 function buildEcdsaTransactionSigningLane(input) {
 	if (isEcdsaEmailOtpTransactionSigningLaneInput(input)) return buildEcdsaEmailOtpSigningLane(input);
-	if (isEcdsaPasskeyTransactionSigningLaneInput(input)) return buildEcdsaPasskeySigningLane(input);
+	if (isEcdsaStoredTransactionSigningLaneInput(input)) return buildEcdsaStoredSigningLane(input);
 	throw new Error("[SigningSession] unsupported ECDSA lane auth");
 }
 function isEd25519PasskeyTransactionSigningLaneInput(input) {
@@ -98,8 +115,8 @@ function isEd25519PasskeyTransactionSigningLaneInput(input) {
 function isEd25519EmailOtpTransactionSigningLaneInput(input) {
 	return input.auth.kind === "email_otp";
 }
-function isEcdsaPasskeyTransactionSigningLaneInput(input) {
-	return input.auth.kind === "passkey";
+function isEcdsaStoredTransactionSigningLaneInput(input) {
+	return input.auth.kind === "passkey" || input.auth.kind === "voiceid";
 }
 function isEcdsaEmailOtpTransactionSigningLaneInput(input) {
 	return input.auth.kind === "email_otp";