@seams/wallet 0.22.0 → 0.24.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.22.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.24.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.22.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.24.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.22.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.24.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.22.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.24.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/authorization/voiceIdDeviceAssertion.d.ts

@@ -0,0 +1,32 @@
+import { type WalletSessionMintId } from './capabilityKinds';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../utils/domainIds';
+declare const voiceIdDevicePublicKeyBrand: unique symbol;
+export type VoiceIdDevicePublicKeyB64u = string & {
+    readonly [voiceIdDevicePublicKeyBrand]: true;
+};
+export declare function parseVoiceIdDevicePublicKeyB64u(value: unknown): VoiceIdDevicePublicKeyB64u;
+export type VoiceIdWalletSessionChallenge = Readonly<{
+    kind: 'voiceid_wallet_session_challenge_v1';
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    walletAuthorityId: WalletAuthorityId;
+    deviceKeyId: DigestB64u;
+    challengeId: WalletSessionMintId;
+    nonce: DigestB64u;
+    requestOrigin: string;
+    audience: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+}>;
+export type VoiceIdDeviceAssertion = Readonly<{
+    kind: 'voiceid_device_assertion_v1';
+    challenge: VoiceIdWalletSessionChallenge;
+    signatureB64u: string;
+}>;
+export declare function buildVoiceIdWalletSessionChallenge(fields: Omit<VoiceIdWalletSessionChallenge, 'kind'>): VoiceIdWalletSessionChallenge;
+export declare function parseVoiceIdWalletSessionChallenge(raw: unknown): VoiceIdWalletSessionChallenge;
+export declare function parseVoiceIdDeviceAssertion(raw: unknown): VoiceIdDeviceAssertion;
+export declare function voiceIdWalletSessionChallengeBytes(challenge: VoiceIdWalletSessionChallenge): Uint8Array<ArrayBuffer>;
+export {};
+//# sourceMappingURL=voiceIdDeviceAssertion.d.ts.map

package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts

@@ -41,7 +41,9 @@ export type CommittedSignerPackageSetV1 = ReadonlyExclusiveUnion<{
 export type CommittedAuthorityPackagesV1 = {
     readonly kind: 'committed_authority_packages_v1';
     readonly authority: PendingWalletAuthorityV1;
-    readonly authMethod: PendingWalletAuthMethodRecordV2;
+    readonly authMethod: Exclude<PendingWalletAuthMethodRecordV2, {
+        readonly kind: 'voiceid';
+    }>;
     readonly signerPackages: CommittedSignerPackageSetV1;
     readonly ed25519ExportRootPackage: LinkedDeviceEd25519ExportRootPackageV1 | null;
     readonly packageSetDigestB64u: DigestB64u;

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -432,6 +432,14 @@ export type LinkedOwnerCredentialMetadataV1 = {
     readonly email?: never;
     readonly device?: never;
     readonly credentialIdB64u?: never;
+    readonly deviceKeyId?: never;
+} | {
+    readonly kind: 'voiceid';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly deviceKeyId: DigestB64u;
+    readonly email?: never;
+    readonly device?: never;
+    readonly credentialIdB64u?: never;
 };
 /** Public wallet-scoped projection for linked-device management. */
 export type LinkedDeviceSummaryV1 = {

package/dist/types/shared-ts/src/device-linking/wireFields.d.ts

@@ -7,15 +7,15 @@ export declare const enrollmentId: WireParser<import("../signing-lanes").LinkedD
 export declare const linkedDeviceId: WireParser<import("../signing-lanes").LinkedDeviceId>;
 export declare const authorizationDeviceId: WireParser<import("../authorization").DeviceId>;
 export declare const walletKeyId: WireParser<import("../signing-lanes").WalletKeyId>;
-export declare const walletSessionId: WireParser<import("../../../wallet/src/core/types").WalletSessionId>;
+export declare const walletSessionId: WireParser<import("../../../wallet/src/voiceid-host").WalletSessionId>;
 export declare const walletSessionAuthorizationId: WireParser<import("../authorization").WalletSessionAuthorizationId>;
-export declare const walletAuthMethodId: WireParser<import("../utils").WalletAuthMethodId>;
-export declare const walletAuthorityId: WireParser<import("../utils").WalletAuthorityId>;
+export declare const walletAuthMethodId: WireParser<import("../../../wallet/src/voiceid-host").WalletAuthMethodId>;
+export declare const walletAuthorityId: WireParser<import("../../../wallet/src/voiceid-host").WalletAuthorityId>;
 export declare const credentialId: WireParser<import("../utils").WebAuthnCredentialIdB64u>;
 export declare const rpId: WireParser<import("../../../wallet/src/advanced").WebAuthnRpId>;
 export declare const quotaId: WireParser<import("../authorization").MpcWalletSigningQuotaId>;
 export declare const materialActivation: WireParser<MpcMaterialActivationRef>;
-export declare const digest: WireParser<import("../utils").DigestB64u>;
+export declare const digest: WireParser<import("../../../wallet/src/voiceid-host").DigestB64u>;
 export declare const nullableToken: WireParser<string | null>;
 export declare function keyLabeled<T>(parse: WireParser<T>): WireParser<T>;
 export declare function parseUnixTime(raw: unknown, label: string): number;

package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts

@@ -6,9 +6,11 @@ import type { ExclusiveUnion } from '../utils/variant';
 export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: 'wallet_custody_envelope_v2';
 declare const PASSKEY_PRF_KEK_VERSION_V1: 'passkey_prf_kek_hkdf_sha256_v1';
 declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: 'email_otp_factor_kek_hkdf_sha256_v1';
+declare const VOICEID_DEVICE_FACTOR_KEK_VERSION_V1: 'voiceid_device_factor_kek_hkdf_sha256_v1';
 type WalletCustodyEnvelopeVersion = typeof WALLET_CUSTODY_ENVELOPE_VERSION_V2;
 type PasskeyPrfKekVersion = typeof PASSKEY_PRF_KEK_VERSION_V1;
 type EmailOtpFactorKekVersion = typeof EMAIL_OTP_FACTOR_KEK_VERSION_V1;
+type VoiceIdFactorKekVersion = typeof VOICEID_DEVICE_FACTOR_KEK_VERSION_V1;
 /**
  * Which enrolled factor sealed this envelope.
  *
@@ -45,6 +47,10 @@ export type WalletCustodyEnvelopeFactor = ExclusiveUnion<{
     enrollmentId: string;
     enrollmentSealKeyVersion: string;
     kekVersion: EmailOtpFactorKekVersion;
+} | {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    kekVersion: VoiceIdFactorKekVersion;
 }>;
 export type PasskeyCustodyEnvelopeLifecycle = ExclusiveUnion<{
     state: 'active';
@@ -86,6 +92,24 @@ export type PasskeyCustodyEnvelopeRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
+export type ActiveMethodBoundWalletSeedEnvelope = PasskeyCustodyEnvelopeRecord & {
+    readonly ownership: Extract<WalletCustodyEnvelopeOwnership, {
+        readonly kind: 'method_bound';
+    }>;
+    readonly binding: Extract<PasskeyCustodySecretBinding, {
+        readonly kind: 'wallet_custody_seed_v1';
+    }>;
+    readonly lifecycle: Extract<PasskeyCustodyEnvelopeLifecycle, {
+        readonly state: 'active';
+    }>;
+};
+export type VoiceIdSeedEnvelope = ActiveMethodBoundWalletSeedEnvelope & {
+    readonly factor: Extract<WalletCustodyEnvelopeFactor, {
+        readonly kind: 'voiceid';
+    }>;
+};
+export declare function isActiveMethodBoundWalletSeedEnvelope(envelope: PasskeyCustodyEnvelopeRecord): envelope is ActiveMethodBoundWalletSeedEnvelope;
+export declare function isVoiceIdSeedEnvelope(envelope: PasskeyCustodyEnvelopeRecord): envelope is VoiceIdSeedEnvelope;
 /**
  * The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
  *
@@ -119,6 +143,11 @@ export declare function buildEmailOtpEnvelopeFactor(args: {
 }): Extract<WalletCustodyEnvelopeFactor, {
     readonly kind: 'email_otp';
 }>;
+export declare function buildVoiceIdEnvelopeFactor(args: {
+    deviceKeyId: DigestB64u;
+}): Extract<WalletCustodyEnvelopeFactor, {
+    readonly kind: 'voiceid';
+}>;
 export declare function buildActiveEnvelopeLifecycle(args: {
     activatedAtMs: number;
 }): PasskeyCustodyEnvelopeLifecycle;

package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts

@@ -103,6 +103,7 @@ type PasskeyCustodySecretBindingOfKind<TKind extends PasskeyCustodySecretKind> =
 }>;
 /** True when this binding covers owner custody rather than one lane's share. */
 export declare function isWalletCustodySeedBinding(binding: PasskeyCustodySecretBinding): binding is PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
+export declare function buildWalletCustodySeedBinding(): PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
 export declare function buildEd25519YaoClientRootBinding(args: {
     linkSessionId: LinkDeviceSessionId;
     walletKeyId: WalletKeyId;

package/dist/types/shared-ts/src/signing-lanes/execution.d.ts

@@ -7,7 +7,7 @@ export type OwnerWalletExecutionLaneProjectionV1 = {
     readonly kind: 'active_owner_wallet_execution_lane_projection_v1';
     readonly walletKey: WalletKeyRecord;
     readonly lane: Extract<SigningLaneRecord, {
-        readonly laneKind: 'owner_passkey' | 'owner_email_otp';
+        readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid';
     }>;
     readonly materialActivation: MpcMaterialActivationRef;
     readonly verifiedActivationReceiptDigestB64u: DigestB64u;
@@ -24,7 +24,7 @@ type PreparedWalletExecutionBase = {
 };
 export type PreparedOwnerWalletExecution = PreparedWalletExecutionBase & {
     readonly kind: 'prepared_owner_wallet_execution';
-    readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'recovery' | 'break_glass';
+    readonly laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid' | 'recovery' | 'break_glass';
     readonly lane: ActiveSigningLaneReference & {
         readonly laneKind: PreparedOwnerWalletExecution['laneKind'];
     };

package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts

@@ -2,7 +2,7 @@ import type { WalletId } from '../utils/domainIds';
 import { type EvmFamilySigningKeySlotId } from './evmFamilySigningKeySlotId';
 import { type LaneHolderParticipantRecordV1, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantRecordV1 } from './participants';
 import { type LaneShareEpoch, type LinkedDeviceId, type SigningLaneId, type WalletKeyId } from './ids';
-import type { AgentCustodyBindingId, AgentIdentityKeyId, BreakGlassSigningLaneRecord, DelegatedExecutionSigningLaneRecord, DelegatedSpendAuthorizationId, Ed25519WalletKeyRecord, EvmFamilyWalletKeyRecord, LinkedDeviceSigningLaneRecord, OwnerEmailOtpSigningLaneRecord, OwnerPasskeySigningLaneRecord, RecoverySigningLaneRecord, SigningLaneLifecycle, SigningLaneRecord, WalletKeyLifecycle, WalletKeyRecord, WalletKeyVersion } from './records';
+import type { AgentCustodyBindingId, AgentIdentityKeyId, BreakGlassSigningLaneRecord, DelegatedExecutionSigningLaneRecord, DelegatedSpendAuthorizationId, Ed25519WalletKeyRecord, EvmFamilyWalletKeyRecord, LinkedDeviceSigningLaneRecord, OwnerEmailOtpSigningLaneRecord, OwnerPasskeySigningLaneRecord, OwnerVoiceIdSigningLaneRecord, RecoverySigningLaneRecord, SigningLaneLifecycle, SigningLaneRecord, WalletKeyLifecycle, WalletKeyRecord, WalletKeyVersion } from './records';
 import { type OwnerLaneParticipantContinuityV1 } from './ownerContinuity';
 type ActiveSigningLaneLifecycle = Extract<SigningLaneLifecycle, {
     readonly state: 'active';
@@ -64,6 +64,7 @@ export declare function buildActiveSigningLaneLifecycle(args: {
 }): ActiveSigningLaneLifecycle;
 export declare function buildOwnerPasskeySigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerPasskeySigningLaneRecord;
 export declare function buildOwnerEmailOtpSigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerEmailOtpSigningLaneRecord;
+export declare function buildOwnerVoiceIdSigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerVoiceIdSigningLaneRecord;
 export declare function buildLinkedDeviceSigningLaneRecord(args: RotatableSigningLaneRecordBuilderArgs & {
     readonly linkedDeviceId: LinkedDeviceId;
 }): LinkedDeviceSigningLaneRecord;

package/dist/types/shared-ts/src/signing-lanes/records.d.ts

@@ -46,7 +46,7 @@ export type EvmFamilyWalletKeyRecord = {
     readonly registeredPublicKeyB64u?: never;
 };
 export type WalletKeyRecord = Ed25519WalletKeyRecord | EvmFamilyWalletKeyRecord;
-export type SigningLaneKind = 'owner_passkey' | 'owner_email_otp' | 'linked_device' | 'delegated_execution' | 'recovery' | 'break_glass';
+export type SigningLaneKind = 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid' | 'linked_device' | 'delegated_execution' | 'recovery' | 'break_glass';
 export type SigningLaneReference = {
     readonly kind: 'signing_lane_reference_v1';
     readonly walletId: WalletId;
@@ -119,6 +119,14 @@ export type OwnerEmailOtpSigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
     readonly custodyBindingId?: never;
     readonly authorizationBindingDigestB64u?: never;
 };
+export type OwnerVoiceIdSigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
+    readonly laneKind: 'owner_voiceid';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
 export type LinkedDeviceSigningLaneRecord = RotatableSigningLaneRecordBase & {
     readonly laneKind: 'linked_device';
     readonly linkedDeviceId: LinkedDeviceId;
@@ -154,6 +162,6 @@ export type BreakGlassSigningLaneRecord = PrivilegedOwnerSigningLaneRecordBase &
     readonly custodyBindingId?: never;
     readonly authorizationBindingDigestB64u?: never;
 };
-export type SigningLaneRecord = OwnerPasskeySigningLaneRecord | OwnerEmailOtpSigningLaneRecord | LinkedDeviceSigningLaneRecord | DelegatedExecutionSigningLaneRecord | RecoverySigningLaneRecord | BreakGlassSigningLaneRecord;
+export type SigningLaneRecord = OwnerPasskeySigningLaneRecord | OwnerEmailOtpSigningLaneRecord | OwnerVoiceIdSigningLaneRecord | LinkedDeviceSigningLaneRecord | DelegatedExecutionSigningLaneRecord | RecoverySigningLaneRecord | BreakGlassSigningLaneRecord;
 export {};
 //# sourceMappingURL=records.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts

@@ -13,7 +13,7 @@ type ActiveLaneProtocolSourceBaseV1 = {
 /** Existing owner signer rows expose continuity, without linked-lane HPKE identities. */
 type OwnerLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
     sourceKind: 'owner_registration';
-    laneKind: 'owner_passkey' | 'owner_email_otp';
+    laneKind: 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid';
     ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
     holderParticipantId?: never;
     signingWorkerParticipantId?: never;
@@ -22,7 +22,7 @@ type OwnerLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
 /** Independently provisioned lanes carry their durable holder/worker identities. */
 type ProvisionedLaneProtocolSourceV1 = ActiveLaneProtocolSourceBaseV1 & {
     sourceKind: 'provisioned_lane';
-    laneKind: Exclude<SigningLaneKind, 'owner_passkey' | 'owner_email_otp'>;
+    laneKind: Exclude<SigningLaneKind, 'owner_passkey' | 'owner_email_otp' | 'owner_voiceid'>;
     holderParticipantId: LaneHolderParticipantId;
     signingWorkerParticipantId: SigningWorkerParticipantId;
     signingWorkerRecipientKeyId: SigningWorkerRecipientKeyId;

package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts

@@ -1,9 +1,18 @@
 import type { WebAuthnRpId } from '../utils/domainIds';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
 export declare const DEFAULT_WALLET_SESSION_TTL_MS: number;
 export declare const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
+export declare const LINKED_DEVICE_WALLET_SESSION_TTL_MS: number;
+export declare const LINKED_DEVICE_WALLET_SESSION_REMAINING_USES = 100;
 export declare const MAX_WALLET_SESSION_TTL_MS: number;
 export declare const MAX_WALLET_SESSION_REMAINING_USES = 1000000;
 export type Ed25519AuthorityScope = {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    rpId?: never;
+    provider?: never;
+    providerUserId?: never;
+} | {
     kind: 'passkey_rp';
     rpId: WebAuthnRpId;
     proofKind?: never;

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -12,7 +12,7 @@
  * `already_configured` at admission — before any target verification or local
  * write — rather than travelling through the operation as a rejected case.
  */
-import type { ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -24,7 +24,7 @@ import type { WalletAuthMethod } from './signerDomain';
  * addition — which family a branch fills in — and the assertion below keeps it
  * from drifting from the canonical record's own discriminant.
  */
-export type WalletAuthMethodFamilyV1 = WalletAuthMethod;
+export type WalletAuthMethodFamilyV1 = Exclude<WalletAuthMethod, 'voiceid'>;
 /**
  * The two exhaustive branches. The name reads source-to-target, which is the
  * order every stage of the operation uses: resolve the source, then verify the
@@ -54,7 +54,7 @@ type AddWalletAuthMethodAdmissionV1 = {
  * which is why the operation needs no same-family rejection of its own.
  */
 export declare function admitAddWalletAuthMethod(input: {
-    readonly sourceMethod: ActiveWalletAuthMethodRecordV2;
+    readonly sourceMethod: ActivePasskeyWalletAuthMethodRecordV2 | ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly targetFamily: WalletAuthMethodFamilyV1;
     readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -88,11 +88,10 @@ export declare function parsePasskeyEnvelopeId(raw: unknown): DomainIdParseResul
 /**
  * Mints a wallet auth-method id.
  *
- * Server-side only, and there is exactly one of these because an auth method's
- * identity is now authenticated data: it goes into the custody envelope's AAD,
- * so an id minted to a second shape would seal envelopes the parsers reject.
- * A client never chooses one — registration and every addition receive theirs
- * from the intent that allocated it.
+ * Registration allocates this identity on the server. Device-bound VoiceID
+ * activation allocates it in the Wallet before sealing its custody envelope.
+ * Both paths use this builder because the identity is authenticated data in
+ * the custody envelope's AAD.
  */
 export declare function allocateWalletAuthMethodId(randomSuffix: string): WalletAuthMethodId;
 export declare function parseWalletAuthMethodId(raw: unknown): DomainIdParseResult<WalletAuthMethodId>;

package/dist/types/shared-ts/src/utils/registrationIntent.d.ts

@@ -63,7 +63,6 @@ export type AddSignerIntentV1 = {
 export type AddAuthMethodIntentSourceV1 = {
     readonly walletAuthorityId: WalletAuthorityId;
     readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletSessionId: string;
     readonly authorityDigestB64u: string;
     readonly revocationEpoch: number;
 };

package/dist/types/shared-ts/src/utils/signerDomain.d.ts

@@ -6,12 +6,15 @@ export type SignerKind = (typeof SIGNER_KINDS)[keyof typeof SIGNER_KINDS];
 export declare const SIGNER_AUTH_METHODS: {
     readonly passkey: 'passkey';
     readonly emailOtp: "email_otp";
+    readonly voiceId: 'voiceid';
 };
 /** Authentication methods that can authorize a signer capability. */
 export type SignerAuthMethod = (typeof SIGNER_AUTH_METHODS)[keyof typeof SIGNER_AUTH_METHODS];
+export declare function requirePersistedSignerAuthMethod(method: SignerAuthMethod): Exclude<SignerAuthMethod, 'voiceid'>;
 export declare const WALLET_AUTH_METHODS: {
     readonly passkey: 'passkey';
     readonly emailOtp: "email_otp";
+    readonly voiceId: 'voiceid';
 };
 /** Authentication methods that can be enrolled on a wallet. */
 export type WalletAuthMethod = (typeof WALLET_AUTH_METHODS)[keyof typeof WALLET_AUTH_METHODS];

package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts

@@ -1,3 +1,4 @@
+import { type DigestB64u } from './canonicalPrimitives';
 import { type EmailOtpProviderUserId, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 export type EmailOtpProvider = 'google' | 'email';
 export type PasskeyFactorIdentity = {
@@ -6,6 +7,7 @@ export type PasskeyFactorIdentity = {
     rpId?: never;
     provider?: never;
     providerUserId?: never;
+    deviceKeyId?: never;
 };
 export type EmailOtpFactorIdentity = {
     kind: 'email_otp';
@@ -13,8 +15,17 @@ export type EmailOtpFactorIdentity = {
     providerUserId: EmailOtpProviderUserId;
     rpId?: never;
     credentialIdB64u?: never;
+    deviceKeyId?: never;
 };
-export type AuthFactorIdentity = PasskeyFactorIdentity | EmailOtpFactorIdentity;
+export type VoiceIdFactorIdentity = {
+    kind: 'voiceid';
+    deviceKeyId: DigestB64u;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type AuthFactorIdentity = PasskeyFactorIdentity | EmailOtpFactorIdentity | VoiceIdFactorIdentity;
 export type PasskeyWalletAuthAuthority = {
     walletId: WalletId;
     factor: PasskeyFactorIdentity;
@@ -43,7 +54,26 @@ export type EmailOtpWalletAuthAuthority = {
     provider?: never;
     providerUserId?: never;
 };
-export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAuthAuthority;
+export type VoiceIdWalletAuthAuthority = {
+    walletId: WalletId;
+    factor: VoiceIdFactorIdentity;
+    verifier: {
+        kind: 'device_signature';
+    };
+    bindingId: WalletAuthMethodId;
+    kind?: never;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAuthAuthority | VoiceIdWalletAuthAuthority;
+export declare function buildVoiceIdWalletAuthAuthority(input: {
+    walletId: WalletId;
+    walletAuthMethodId: WalletAuthMethodId;
+    deviceKeyId: DigestB64u;
+}): VoiceIdWalletAuthAuthority;
+export declare function isVoiceIdWalletAuthAuthority(authority: WalletAuthAuthority): authority is VoiceIdWalletAuthAuthority;
 export declare function isPasskeyWalletAuthAuthority(authority: WalletAuthAuthority): authority is PasskeyWalletAuthAuthority;
 export declare function isEmailOtpWalletAuthAuthority(authority: WalletAuthAuthority): authority is EmailOtpWalletAuthAuthority;
 export declare function walletAuthAuthoritiesMatch(left: WalletAuthAuthority, right: WalletAuthAuthority): boolean;

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,3 +1,4 @@
+import { type VoiceIdDevicePublicKeyB64u } from '../authorization/voiceIdDeviceAssertion';
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 import type { Variant, ReadonlyExclusiveUnion } from './variant';
@@ -77,6 +78,17 @@ export type EmailOtpWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
     readonly credentialPublicKeyB64u?: never;
     readonly counter?: never;
 };
+export type VoiceIdWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'voiceid';
+    readonly deviceKeyId: DigestB64u;
+    readonly devicePublicKeyB64u: VoiceIdDevicePublicKeyB64u;
+    readonly rpId?: never;
+    readonly credentialIdB64u?: never;
+    readonly credentialPublicKeyB64u?: never;
+    readonly counter?: never;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+};
 type WalletAuthMethodCommonV1 = {
     readonly version: 'wallet_auth_method_v2';
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -85,14 +97,16 @@ type WalletAuthMethodCommonV1 = {
     readonly createdAtMs: number;
     readonly updatedAtMs: number;
 };
-export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
+export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (VoiceIdWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
 export type PasskeyWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'passkey'>;
 export type EmailOtpWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type VoiceIdWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'voiceid'>;
 export type PendingWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'pending_local_install'>;
 export type ActiveWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'active'>;
 export type RevokedWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'revoked'>;
 export type ActivePasskeyWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'passkey'>;
 export type ActiveEmailOtpWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type ActiveVoiceIdWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'voiceid'>;
 export declare function sameWalletAuthMethodRecordV2(left: WalletAuthMethodRecordV2, right: WalletAuthMethodRecordV2): boolean;
 export declare function buildWalletAuthMethodRecordV2(input: WalletAuthMethodRecordV2): WalletAuthMethodRecordV2;
 export declare function parseWalletAuthMethodRecordV2(raw: unknown): WalletAuthMethodRecordV2 | null;

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -1,6 +1,7 @@
 import { type WalletAuthMethodId, type WalletId, type WebAuthnRpId } from './domainIds';
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
 import { type NearEd25519SigningKeyId } from './registrationIds';
+import { type DigestB64u } from './canonicalPrimitives';
 export type { WebAuthnRpId };
 export type RpId = WebAuthnRpId;
 export type WalletIdentity = {
@@ -15,6 +16,7 @@ export type WalletAuthMethodBinding = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly scope: PasskeyAuthScope;
     readonly credentialIdB64u: string;
+    readonly deviceKeyId?: never;
 } | {
     readonly kind: 'email_otp';
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -22,6 +24,17 @@ export type WalletAuthMethodBinding = {
     readonly emailHashHex: string;
     readonly registrationAuthorityId: string;
     readonly rpId?: never;
+    readonly deviceKeyId?: never;
+} | {
+    readonly kind: 'voiceid';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly wallet: WalletIdentity;
+    readonly deviceKeyId: DigestB64u;
+    readonly scope?: never;
+    readonly credentialIdB64u?: never;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+    readonly rpId?: never;
 };
 export type CurrentWalletAuthMethod = {
     readonly kind: 'none';
@@ -74,6 +87,13 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
     emailHashHex: string;
     registrationAuthorityId: string;
 }): WalletAuthMethodBinding;
+export declare function buildVoiceIdWalletAuthMethodBinding(args: {
+    walletAuthMethodId: WalletAuthMethodId;
+    wallet: WalletIdentity;
+    deviceKeyId: DigestB64u;
+}): Extract<WalletAuthMethodBinding, {
+    kind: 'voiceid';
+}>;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.d.ts

@@ -13,12 +13,12 @@
  * revalidates against.
  */
 import type { AddAuthMethodIntentSourceV1 } from '../../../../../shared-ts/src/utils/registrationIntent';
-import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 type AddAuthMethodSourceClaimResultV1 = {
     readonly kind: 'resolved';
     readonly source: AddAuthMethodIntentSourceV1;
-    readonly sourceAuthMethod: ActiveWalletAuthMethodRecordV2;
+    readonly sourceAuthMethod: ActivePasskeyWalletAuthMethodRecordV2 | ActiveEmailOtpWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'unavailable';
     readonly reason: string;

package/dist/types/wallet/src/SeamsWeb/publicApi/auth.d.ts

@@ -1,6 +1,6 @@
 import type { AuthCapability } from '../signingSurface/types';
 export type WalletAuthCommands = Omit<AuthCapability, 'onSessionChange'>;
-export type WalletSessionCommands = Pick<AuthCapability, 'unlock' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
+export type WalletSessionCommands = Pick<AuthCapability, 'unlock' | 'unlockWithAuthMethod' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
 export type EmailOtpAuthCommands = Pick<AuthCapability, 'requestEmailCode' | 'unlockWithEmailCode' | 'startGoogleSignIn'>;
 export declare function unlockWithEmailCode(args: Parameters<AuthCapability['unlockWithEmailCode']>[0]): ReturnType<AuthCapability['unlockWithEmailCode']>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/publicApi/createPublicApi.d.ts

@@ -14,7 +14,7 @@ export type WalletRegistrationCommand = Omit<Parameters<RegistrationCapability['
     readonly wallet: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;
 };
-export type WalletRegistrationCommands = Pick<RegistrationCapability, 'getNearAccountState' | 'addSigner' | 'addPasskey' | 'removeAuthMethod' | 'addEmail'> & {
+export type WalletRegistrationCommands = Pick<RegistrationCapability, 'getAuthMethodAvailability' | 'setAuthMethodEnabled' | 'getNearAccountState' | 'addSigner' | 'addPasskey' | 'activateAuthMethod' | 'removeAuthMethod' | 'addEmail'> & {
     registerWallet(args: WalletRegistrationCommand): ReturnType<RegistrationCapability['registerWallet']>;
 };
 export type RegistrationCapabilityDomainMethods = WalletRegistrationCommands & {

package/dist/types/wallet/src/SeamsWeb/publicApi/types.d.ts

@@ -1,3 +1,4 @@
+import type { AuthMethodAvailability } from '../../core/authMethods/availabilityTypes';
 import type { SdkLifecycleEventListener } from '../../core/types/sdkSentEvents';
 import type { HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuSessionId, HostedAuthMenuExternalAuthRequest, HostedAuthMenuExternalAuthResolutionInput } from '../walletIframe/shared/messages';
 import type { NearAccountRef, TempoChainTarget, ThresholdEcdsaChainTarget, WalletSessionRef } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
@@ -35,6 +36,8 @@ import type { LinkDeviceResult, ScanAndLinkDeviceOptionsDevice1, StartDevice2Lin
 import type { LinkedDeviceListResultV1, LinkedDeviceRevokeResultV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking';
 import type { WalletEmailOtpChannel } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAuthMethodPlugin } from '../../core/authMethods/plugins';
+import type { AuthMethodActivationResult } from '../../core/authMethods/hostPlugin';
 import type { AddSignerSelection, RegistrationSignerSetSelection } from '../../../../shared-ts/src/utils/registrationSignerPlan';
 import type { RegistrationAuthMethodInput, RegisterWalletInput } from '../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { ExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
@@ -486,6 +489,11 @@ export type RequestEmailCodeInput = ExclusiveUnion<{
     onEvent?: GoogleEmailOtpWalletAuthStartInput['onEvent'];
 };
 export interface AuthCapability {
+    unlockWithAuthMethod(args: {
+        walletId: WalletId | string;
+        walletAuthMethodId: string;
+        method: WalletAuthMethodPlugin['kind'];
+    }): Promise<LoginAndCreateSessionResult>;
     onSessionChange(listener: (session: WalletSession) => void): () => void;
     unlock(walletId: string, options?: LoginHooksOptions): Promise<LoginAndCreateSessionResult>;
     lock(): Promise<void>;
@@ -500,6 +508,20 @@ export interface AuthCapability {
     startGoogleSignIn(args: GoogleEmailOtpWalletAuthStartInput): Promise<GoogleEmailOtpWalletAuthResult<GoogleEmailOtpWalletAuthFlow>>;
 }
 export interface RegistrationCapability {
+    getAuthMethodAvailability(args: {
+        walletId: WalletId | string;
+        method: WalletAuthMethodPlugin['kind'];
+    }): Promise<AuthMethodAvailability>;
+    setAuthMethodEnabled(args: {
+        walletId: WalletId | string;
+        method: WalletAuthMethodPlugin['kind'];
+        enabled: boolean;
+    }): Promise<AuthMethodAvailability>;
+    /** Activate an enabled host plugin after an owner unlock. */
+    activateAuthMethod(args: {
+        walletId: WalletId | string;
+        method: WalletAuthMethodPlugin['kind'];
+    }): Promise<AuthMethodActivationResult>;
     getNearAccountState(args: {
         walletId: WalletId | string;
     }): Promise<NearProvisioningState | null>;

package/dist/types/wallet/src/SeamsWeb/signingSurface/BrowserSigningSurface.d.ts

@@ -4,6 +4,7 @@ import type { NonceCoordinator } from '../../core/signingEngine/nonce/NonceCoord
 import { type AccountId } from '../../core/types/accountIds';
 import type { SdkLifecycleEvent, SdkLifecycleEventListener, SigningFlowEvent } from '../../core/types/sdkSentEvents';
 import type { AppearanceConfig, SigningSessionStatus, SeamsConfigsReadonly, WalletAuthenticationState } from '../../core/types/seams';
+import type { AuthMethodSessionInstaller, AuthMethodUnlockSuccess } from '../../core/authMethods/hostPlugin';
 import type { WebAuthnAuthenticationCredential } from '../../core/types';
 import type { UserPreferencesManager } from '../../core/signingEngine/session/userPreferences';
 import type { NearEd25519YaoOperationMaterial } from '../../core/signingEngine/interfaces/near';
@@ -113,9 +114,11 @@ export declare class BrowserSigningSurface {
     private readonly signingSessionLifecycleSubscription;
     private readonly nearProvisioningUnsubscribe;
     private walletAuthenticationState;
+    private readonly voiceIdNearSessions;
     private volatileWarmSigningMaterialCleanupInFlight;
     readonly seamsWebConfigs: SeamsConfigsReadonly;
     private readNearEd25519SigningCandidate;
+    private prepareVoiceIdNearSigning;
     private readExactNearEd25519WalletSessionAuthorization;
     private resolveActiveNearEd25519WalletSessionAuthorization;
     private readonly listPreprocessingCapabilities;
@@ -367,6 +370,7 @@ export declare class BrowserSigningSurface {
     storeWalletEmailOtpEcdsaSignerRecords(input: Parameters<typeof registrationAccount.storeWalletEmailOtpEcdsaSignerRecords>[1]): ReturnType<typeof registrationAccount.storeWalletEmailOtpEcdsaSignerRecords>;
     finalizeWalletEcdsaRegistration(input: Parameters<typeof registrationAccount.finalizeWalletEcdsaRegistration>[1]): ReturnType<typeof registrationAccount.finalizeWalletEcdsaRegistration>;
     activateVerifiedNearEd25519YaoMaterial(material: NearEd25519YaoOperationMaterial): Promise<Ed25519YaoActiveClientIdentityV1>;
+    installAuthMethodSession(expectedLockGeneration: number, unlocked: Parameters<AuthMethodSessionInstaller>[0]): Promise<AuthMethodUnlockSuccess>;
     withExactEd25519MaterialOwner<T>(args: {
         materialActivation: MpcMaterialActivationRef;
         nearAccountId: AccountId;

package/dist/types/wallet/src/SeamsWeb/signingSurface/ports.d.ts

@@ -1,4 +1,5 @@
 import type { WalletSessionHome } from '../../../../shared-ts/src/device-linking/contracts';
+import type { AuthMethodSessionInstaller, AuthMethodUnlockSuccess } from '../../core/authMethods/hostPlugin';
 import type { WalletSessionStatusReadScope } from '../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { NonceCoordinator } from '../../core/signingEngine/nonce/NonceCoordinator';
 import type { EmailOtpAuthorityUnlockEd25519Request } from '../../core/signingEngine/session/emailOtp/walletUnlock';
@@ -413,6 +414,7 @@ export interface SigningSessionSurface {
     }, statusReads: WalletSessionStatusReadScope): Promise<AvailableSigningLanes>;
 }
 export interface WalletAuthenticationSurface {
+    installAuthMethodSession(expectedLockGeneration: number, unlocked: Parameters<AuthMethodSessionInstaller>[0]): Promise<AuthMethodUnlockSuccess>;
     readWalletAuthenticationState(): WalletAuthenticationState;
     setWalletAuthenticated(state: Extract<WalletAuthenticationState, {
         kind: 'authenticated';