@seams/wallet 0.22.0 → 0.24.0

package/dist/{esm/sdk/walletSessionAuthorizationStore-DYRMCkiT.js → public/sdk/walletSessionAuthorizationStore-zkxcMdSp.js}

@@ -1 +1 @@
-import{D as e,O as t,T as n,h as r}from"./domainIds-C3fUa33Q.js";import{i,t as a}from"./activeWalletSession-BtEHhe99.js";import{d as o,h as s,m as c}from"./capabilityKinds-CqHVzVsJ.js";import{r as l}from"./canonicalPrimitives-D_1HyEuJ.js";import{a as u,i as d,n as f}from"./presignatures-DGLNs29C.js";import{t as p}from"./walletOwnershipGeneration-CQzaodhB.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let n=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let i=n.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=r(n.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(r){let i=_(r,`kind`),a=i===`active_wallet_session_v1`?g(r,y):i===`retired_wallet_session_v1`?g(r,b):null;if(!a)return null;let s=t(a.get(`walletId`)),u=e(a.get(`authorityId`)),d=n(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};
+import{E as e,O as t,g as n,k as r}from"./domainIds-t1lp25yU.js";import{i,t as a}from"./activeWalletSession-H9JBdHyQ.js";import{d as o,h as s,m as c}from"./capabilityKinds-BzrNeEyO.js";import{r as l}from"./canonicalPrimitives-B6YMrI3W.js";import{a as u,i as d,n as f}from"./presignatures-B9GrGx0L.js";import{t as p}from"./walletOwnershipGeneration-DI9ogcXF.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let r=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!r)return null;let i=r.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=n(r.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(n){let i=_(n,`kind`),a=i===`active_wallet_session_v1`?g(n,y):i===`retired_wallet_session_v1`?g(n,b):null;if(!a)return null;let s=r(a.get(`walletId`)),u=t(a.get(`authorityId`)),d=e(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};

package/dist/public/sdk/warmSessionHydration-DqZyfi1h.js

@@ -0,0 +1 @@
+import{t as e}from"./prfCache-8Wm3etlV.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/public/sdk/{webauthnP256-unqBoZCk.js → webauthnP256-BvTL8nq4.js}

@@ -1 +1 @@
-import{r as e,t}from"./base64-BmKR3UqU.js";import{n}from"./evmCryptoWasm-S2gL5ht4.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};
+import{r as e,t}from"./base64-BmKR3UqU.js";import{n}from"./evmCryptoWasm-DacbCVNM.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};

package/dist/public/sdk/workers/device-linking-key.worker.js

@@ -2064,6 +2064,17 @@ function exactRecord4(raw, keys, label) {
   return record;
 }
 
+// ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+function parseVoiceIdDevicePublicKeyB64u(value) {
+  if (typeof value !== "string")
+    throw new Error("VoiceID public key is invalid");
+  const bytes = base64UrlDecode(value);
+  if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) {
+    throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+  }
+  return value;
+}
+
 // ../shared-ts/src/utils/registrationAuthMethodInput.ts
 function inspectRawObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -2081,7 +2092,7 @@ function parseWalletAuthMethodRecordV2(raw) {
   const version = trimString(record.version);
   const kind = trimString(record.kind);
   const status = trimString(record.status);
-  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") {
+  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp" && kind !== "voiceid") {
     return null;
   }
   try {
@@ -2105,6 +2116,17 @@ function parseWalletAuthMethodRecordV2(raw) {
         counter: parseNonNegativeInteger(record.counter)
       });
     }
+    if (kind === "voiceid") {
+      if (!("deviceKeyId" in record) || !("devicePublicKeyB64u" in record))
+        return null;
+      exactWalletAuthMethodV2Fields(record, "voiceid", status);
+      return buildParsedVoiceIdWalletAuthMethodRecordV2({
+        common,
+        lifecycle: parseWalletAuthMethodLifecycle(record),
+        deviceKeyId: parseDigestB64u(record.deviceKeyId),
+        devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(record.devicePublicKeyB64u)
+      });
+    }
     if (!("emailHashHex" in record) || !("registrationAuthorityId" in record))
       return null;
     exactWalletAuthMethodV2Fields(record, "email_otp", status);
@@ -2181,8 +2203,10 @@ function exactWalletAuthMethodV2Fields(raw, kind, status) {
   ];
   if (kind === "passkey") {
     fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-  } else {
+  } else if (kind === "email_otp") {
     fields.push("emailHashHex", "registrationAuthorityId");
+  } else {
+    fields.push("deviceKeyId", "devicePublicKeyB64u");
   }
   if (status === "active")
     fields.push("activatedAtMs");
@@ -2298,6 +2322,52 @@ function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
       };
   }
 }
+function buildParsedVoiceIdWalletAuthMethodRecordV2(input) {
+  switch (input.lifecycle.status) {
+    case "pending_local_install":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "pending_local_install",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u
+      };
+    case "active":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "active",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs
+      };
+    case "revoked":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "revoked",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs,
+        revokedAtMs: input.lifecycle.revokedAtMs
+      };
+  }
+}
 function parseWalletAuthMethodIdRequired(raw) {
   const parsed = parseWalletAuthMethodId(raw);
   if (!parsed.ok)
@@ -2768,7 +2838,7 @@ function parseCommittedAuthorityPackagesV1(raw) {
     throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
   }
   const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-  if (!authMethod || authMethod.status !== "pending_local_install") {
+  if (!authMethod || authMethod.status !== "pending_local_install" || authMethod.kind === "voiceid") {
     throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
   }
   if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) {
@@ -5082,6 +5152,7 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 var WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 var PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 var EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+var VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
 var ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -5122,6 +5193,13 @@ function buildEmailOtpEnvelopeFactor(args) {
     kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
   };
 }
+function buildVoiceIdEnvelopeFactor(args) {
+  return {
+    kind: "voiceid",
+    deviceKeyId: args.deviceKeyId,
+    kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+  };
+}
 function buildActiveEnvelopeLifecycle(args) {
   return { state: "active", activatedAtMs: args.activatedAtMs };
 }
@@ -5200,7 +5278,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 function requireNonEmptyString(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -5236,8 +5315,17 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
         enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
       });
     }
+    case "voiceid": {
+      rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+      if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) {
+        throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+      }
+      return buildVoiceIdEnvelopeFactor({
+        deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`)
+      });
+    }
     default:
-      throw new Error(`${label}.kind must be passkey or email_otp`);
+      throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
   }
 }
 var ENVELOPE_RECORD_FIELDS = [

package/dist/public/sdk/workers/ecdsa-derivation-client.worker.js

@@ -1273,28 +1273,6 @@ function parseLinkDeviceSessionId(raw) {
   return parseDomainId(raw, "linkDeviceSessionId");
 }
 
-// ../shared-ts/src/utils/walletAuthAuthority.ts
-function parseWalletAuthAuthorityRef(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
-    return null;
-  const record = raw;
-  const fields = Object.keys(record);
-  if (fields.length !== 4 || !fields.every((field) => ["kind", "walletId", "authorityDigest", "walletAuthMethodId"].includes(field)) || record.kind !== "wallet_auth_authority_ref") {
-    return null;
-  }
-  const walletId = parseWalletId(record.walletId);
-  const authorityDigest = parseWalletAuthorityBindingDigest(record.authorityDigest);
-  const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-  if (!walletId.ok || !authorityDigest.ok || !walletAuthMethodId.ok)
-    return null;
-  return {
-    kind: "wallet_auth_authority_ref",
-    walletId: walletId.value,
-    authorityDigest: authorityDigest.value,
-    walletAuthMethodId: walletAuthMethodId.value
-  };
-}
-
 // ../shared-ts/src/utils/normalize.ts
 function normalizeOptionalString(value) {
   return typeof value === "string" ? value : "";
@@ -1329,6 +1307,69 @@ function requireArray(value, label) {
   return value;
 }
 
+// ../shared-ts/src/utils/exactRecord.ts
+var SECRET_BEARING_FIELD_SUBSTRINGS = [
+  "prf",
+  "kek",
+  "seed",
+  "scalar",
+  "secretkey",
+  "privatekey",
+  "plaintext",
+  "recoverycode",
+  "clientroot",
+  "holdershare"
+];
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+  const allowedSet = new Set(allowed);
+  const knownSet = new Set(knownOnOtherBranches);
+  for (const field of Object.keys(record)) {
+    if (allowedSet.has(field))
+      continue;
+    if (knownSet.has(field)) {
+      throw new Error(`${label}.${field} is not part of ${label}`);
+    }
+    const normalized = field.toLowerCase().replace(/_/g, "");
+    const namesAPublicKey = normalized.includes("publickey");
+    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
+      throw new Error(`${label}.${field} must never carry plaintext custody material`);
+    }
+    throw new Error(`${label}.${field} is not part of ${label}`);
+  }
+}
+function exactRecord(raw, fields, label) {
+  const record = requireRecord(raw, label);
+  rejectUnknownFields(record, fields, label);
+  for (const field of fields) {
+    if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === undefined) {
+      throw new Error(`${label}.${field} is required`);
+    }
+  }
+  return record;
+}
+
+// ../shared-ts/src/utils/walletAuthAuthority.ts
+function parseWalletAuthAuthorityRef(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return null;
+  const record = raw;
+  const fields = Object.keys(record);
+  if (fields.length !== 4 || !fields.every((field) => ["kind", "walletId", "authorityDigest", "walletAuthMethodId"].includes(field)) || record.kind !== "wallet_auth_authority_ref") {
+    return null;
+  }
+  const walletId = parseWalletId(record.walletId);
+  const authorityDigest = parseWalletAuthorityBindingDigest(record.authorityDigest);
+  const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+  if (!walletId.ok || !authorityDigest.ok || !walletAuthMethodId.ok)
+    return null;
+  return {
+    kind: "wallet_auth_authority_ref",
+    walletId: walletId.value,
+    authorityDigest: authorityDigest.value,
+    walletAuthMethodId: walletAuthMethodId.value
+  };
+}
+
 // ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
 function requireExactFields(record, expectedFields, label) {
   const actualFields = Object.keys(record).sort();
@@ -1850,47 +1891,6 @@ var SERVER_ALLOCATED_WALLET_NOUNS = [
 var SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
 var SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
 
-// ../shared-ts/src/utils/exactRecord.ts
-var SECRET_BEARING_FIELD_SUBSTRINGS = [
-  "prf",
-  "kek",
-  "seed",
-  "scalar",
-  "secretkey",
-  "privatekey",
-  "plaintext",
-  "recoverycode",
-  "clientroot",
-  "holdershare"
-];
-function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
-  const allowedSet = new Set(allowed);
-  const knownSet = new Set(knownOnOtherBranches);
-  for (const field of Object.keys(record)) {
-    if (allowedSet.has(field))
-      continue;
-    if (knownSet.has(field)) {
-      throw new Error(`${label}.${field} is not part of ${label}`);
-    }
-    const normalized = field.toLowerCase().replace(/_/g, "");
-    const namesAPublicKey = normalized.includes("publickey");
-    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
-      throw new Error(`${label}.${field} must never carry plaintext custody material`);
-    }
-    throw new Error(`${label}.${field} is not part of ${label}`);
-  }
-}
-function exactRecord(raw, fields, label) {
-  const record = requireRecord(raw, label);
-  rejectUnknownFields(record, fields, label);
-  for (const field of fields) {
-    if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === undefined) {
-      throw new Error(`${label}.${field} is required`);
-    }
-  }
-  return record;
-}
-
 // ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 var LANE_SCOPE_FIELDS = ["kind", "walletKeyId", "laneId", "laneShareEpoch"];
 var ALLOWED_FIELDS_BY_KIND = {
@@ -1928,7 +1928,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 // ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
 function parseWalletCustodyGeneratedString(value, label) {
   if (typeof value !== "string") {
@@ -5262,7 +5263,8 @@ var EMAIL_OTP_CHANNEL = "email_otp";
 // ../shared-ts/src/utils/signerDomain.ts
 var WALLET_AUTH_METHODS = {
   passkey: "passkey",
-  emailOtp: EMAIL_OTP_CHANNEL
+  emailOtp: EMAIL_OTP_CHANNEL,
+  voiceId: "voiceid"
 };
 var WALLET_AUTH_METHOD_VALUES = Object.values(WALLET_AUTH_METHODS);
 

package/dist/public/sdk/workers/email-otp.worker.js

@@ -919,6 +919,7 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 var WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 var PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 var EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+var VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
 var ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -979,6 +980,13 @@ function buildEmailOtpEnvelopeFactor(args) {
     kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
   };
 }
+function buildVoiceIdEnvelopeFactor(args) {
+  return {
+    kind: "voiceid",
+    deviceKeyId: args.deviceKeyId,
+    kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+  };
+}
 function buildActiveEnvelopeLifecycle(args) {
   return { state: "active", activatedAtMs: args.activatedAtMs };
 }
@@ -1057,7 +1065,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 function requireNonEmptyString(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -1093,8 +1102,17 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
         enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
       });
     }
+    case "voiceid": {
+      rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+      if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) {
+        throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+      }
+      return buildVoiceIdEnvelopeFactor({
+        deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`)
+      });
+    }
     default:
-      throw new Error(`${label}.kind must be passkey or email_otp`);
+      throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
   }
 }
 var ENVELOPE_RECORD_FIELDS = [
@@ -5220,6 +5238,17 @@ function requireRouterAbEcdsaDerivationNormalSigningStateV1(value) {
   return parsed;
 }
 
+// ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+function parseVoiceIdDevicePublicKeyB64u(value) {
+  if (typeof value !== "string")
+    throw new Error("VoiceID public key is invalid");
+  const bytes = base64UrlDecode(value);
+  if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) {
+    throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+  }
+  return value;
+}
+
 // ../shared-ts/src/utils/registrationAuthMethodInput.ts
 function inspectRawObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -5237,7 +5266,7 @@ function parseWalletAuthMethodRecordV2(raw) {
   const version = trimString(record.version);
   const kind = trimString(record.kind);
   const status = trimString(record.status);
-  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") {
+  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp" && kind !== "voiceid") {
     return null;
   }
   try {
@@ -5261,6 +5290,17 @@ function parseWalletAuthMethodRecordV2(raw) {
         counter: parseNonNegativeInteger(record.counter)
       });
     }
+    if (kind === "voiceid") {
+      if (!("deviceKeyId" in record) || !("devicePublicKeyB64u" in record))
+        return null;
+      exactWalletAuthMethodV2Fields(record, "voiceid", status);
+      return buildParsedVoiceIdWalletAuthMethodRecordV2({
+        common,
+        lifecycle: parseWalletAuthMethodLifecycle(record),
+        deviceKeyId: parseDigestB64u(record.deviceKeyId),
+        devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(record.devicePublicKeyB64u)
+      });
+    }
     if (!("emailHashHex" in record) || !("registrationAuthorityId" in record))
       return null;
     exactWalletAuthMethodV2Fields(record, "email_otp", status);
@@ -5337,8 +5377,10 @@ function exactWalletAuthMethodV2Fields(raw, kind, status) {
   ];
   if (kind === "passkey") {
     fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-  } else {
+  } else if (kind === "email_otp") {
     fields.push("emailHashHex", "registrationAuthorityId");
+  } else {
+    fields.push("deviceKeyId", "devicePublicKeyB64u");
   }
   if (status === "active")
     fields.push("activatedAtMs");
@@ -5454,6 +5496,52 @@ function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
       };
   }
 }
+function buildParsedVoiceIdWalletAuthMethodRecordV2(input) {
+  switch (input.lifecycle.status) {
+    case "pending_local_install":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "pending_local_install",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u
+      };
+    case "active":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "active",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs
+      };
+    case "revoked":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "revoked",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs,
+        revokedAtMs: input.lifecycle.revokedAtMs
+      };
+  }
+}
 function parseWalletAuthMethodIdRequired(raw) {
   const parsed = parseWalletAuthMethodId(raw);
   if (!parsed.ok)
@@ -6317,6 +6405,7 @@ function normalizeThresholdEd25519ParticipantIds(input) {
 
 // ../shared-ts/src/threshold/sessionPolicy.ts
 var DEFAULT_WALLET_SESSION_TTL_MS = 24 * 60 * 60000;
+var LINKED_DEVICE_WALLET_SESSION_TTL_MS = 15 * 60 * 1000;
 var MAX_WALLET_SESSION_TTL_MS = 30 * 24 * 60 * 60000;
 
 // src/core/signingEngine/threshold/sessionPolicy.ts

package/dist/public/sdk/workers/passkey-mpc-export.worker.js

@@ -3373,6 +3373,7 @@ function yaoRoutingHeaders(routing) {
 
 // ../shared-ts/src/threshold/sessionPolicy.ts
 var DEFAULT_WALLET_SESSION_TTL_MS = 24 * 60 * 60000;
+var LINKED_DEVICE_WALLET_SESSION_TTL_MS = 15 * 60 * 1000;
 var MAX_WALLET_SESSION_TTL_MS = 30 * 24 * 60 * 60000;
 
 // ../shared-ts/src/threshold/signingRootScope.ts
@@ -4034,6 +4035,7 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 var WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 var PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 var EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+var VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
 var ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -4094,6 +4096,13 @@ function buildEmailOtpEnvelopeFactor(args) {
     kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
   };
 }
+function buildVoiceIdEnvelopeFactor(args) {
+  return {
+    kind: "voiceid",
+    deviceKeyId: args.deviceKeyId,
+    kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+  };
+}
 function buildActiveEnvelopeLifecycle(args) {
   return { state: "active", activatedAtMs: args.activatedAtMs };
 }
@@ -4172,7 +4181,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 function requireNonEmptyString(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -4208,8 +4218,17 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
         enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
       });
     }
+    case "voiceid": {
+      rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+      if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) {
+        throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+      }
+      return buildVoiceIdEnvelopeFactor({
+        deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`)
+      });
+    }
     default:
-      throw new Error(`${label}.kind must be passkey or email_otp`);
+      throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
   }
 }
 var ENVELOPE_RECORD_FIELDS = [