@seams/wallet 0.22.0 → 0.24.0

package/dist/types/wallet/src/externalNear/types.d.ts

@@ -0,0 +1,87 @@
+import type { TransactionInput } from '../core/types/actions';
+import type { ValidatedNearMessage } from './message';
+export type ExternalNearWalletId = 'meteor' | 'hot' | 'intear';
+export type ExternalNearNetwork = 'mainnet' | 'testnet';
+export type ExternalNearConfig = Readonly<{
+    network: ExternalNearNetwork;
+    rpcUrl: string;
+    wallets: readonly ExternalNearWalletId[];
+}>;
+export type ExternalNearResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'unavailable' | 'invalid_input' | 'connection_changed' | 'pending_request' | 'submission_unknown';
+    readonly message: string;
+    readonly value?: never;
+};
+declare const connectionBrand: unique symbol;
+export declare function connectedNear(wallet: ExternalNearWalletId, accountId: string, network: ExternalNearNetwork, generation: number): ExternalNearConnection;
+export type ExternalNearConnection = Readonly<{
+    kind: 'connected';
+    [connectionBrand]: true;
+    accountId: string;
+    network: ExternalNearNetwork;
+    wallet: ExternalNearWalletId;
+    generation: number;
+}>;
+export type ExternalNearState = ExternalNearConnection | {
+    readonly kind: 'disconnected';
+    readonly accountId?: never;
+    readonly network?: never;
+    readonly wallet?: never;
+    readonly generation?: never;
+} | {
+    readonly kind: 'connecting';
+    readonly wallet: ExternalNearWalletId;
+    readonly accountId?: never;
+    readonly network?: never;
+    readonly generation?: never;
+};
+export type ExternalNearSnapshot = Readonly<{
+    connection: ExternalNearState;
+    busy: boolean;
+    wallets: readonly ExternalNearWalletId[];
+}>;
+export type ExternalNearSubmission = Readonly<{
+    hash: string;
+    accountId: string;
+    network: ExternalNearNetwork;
+}>;
+export type ExternalNearOutcome = {
+    readonly kind: 'confirmed' | 'failed';
+    readonly submission: ExternalNearSubmission;
+} | {
+    readonly kind: 'unresolved';
+    readonly submission: ExternalNearSubmission;
+};
+export type ExternalNearMessageParams = Readonly<{
+    message: string;
+    recipient: string;
+    nonce: Uint8Array;
+    callbackUrl?: string;
+    state?: string;
+}>;
+export type ExternalNearSignedMessage = Readonly<{
+    accountId: string;
+    publicKey: string;
+    signature: string;
+    state?: string;
+}>;
+export type NearWalletProvider = {
+    connect(network: ExternalNearNetwork): Promise<unknown>;
+    accounts(network: ExternalNearNetwork): Promise<unknown>;
+    send(connection: ExternalNearConnection, transaction: TransactionInput): Promise<unknown>;
+    dispose(): void;
+} & ({
+    readonly messageSigning: 'nep413';
+    signMessage(connection: ExternalNearConnection, message: ValidatedNearMessage): Promise<unknown>;
+} | {
+    readonly messageSigning: 'unsupported';
+    readonly signMessage?: never;
+});
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/wallet/src/externalNear/wallets.d.ts

@@ -0,0 +1,4 @@
+import type { ExternalNearWalletId, NearWalletProvider } from './types';
+export declare function nearWalletName(wallet: ExternalNearWalletId): string;
+export declare function createNearWalletProvider(wallet: ExternalNearWalletId, rpcUrl: string): Promise<NearWalletProvider>;
+//# sourceMappingURL=wallets.d.ts.map

package/dist/types/wallet/src/index.d.ts

@@ -1,6 +1,7 @@
 export { parseWalletMoveId } from './SeamsWeb/publicApi/placement';
 export type { WalletMoveId, WalletMoveRequest, WalletMoveStatus, WalletMoveStatusResult, WalletPlacement, WalletPlacementCapability, WalletPlacementResult, WalletRegion, } from './SeamsWeb/publicApi/placement';
 export { SeamsWeb } from './SeamsWeb';
+export type { WalletAuthMethodPlugin, VoiceIdAuthMethodPlugin } from './core/authMethods/plugins';
 export { normalizeWalletLocale } from './core/ui/locale';
 export type { WalletLocale } from './core/ui/locale';
 export type { AuthMenuCapability, ClientConnectionState, ConfigCapability, ConnectionCapability, EventsCapability, } from './SeamsWeb';

package/dist/types/wallet/src/plugins/plugin-utils.d.ts

@@ -1,3 +1,3 @@
 import { type WalletHostVariant } from '../core/browser/walletIframe/hostVariant';
-export declare function buildWalletServiceHtml(sdkBasePath?: string, assetVersion?: string, walletHostVariant?: WalletHostVariant, approvedRelayerOrigins?: readonly string[]): string;
+export declare function buildWalletServiceHtml(sdkBasePath?: string, assetVersion?: string, walletHostVariant?: WalletHostVariant): string;
 //# sourceMappingURL=plugin-utils.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/AddEvmAccount.d.ts

@@ -0,0 +1,29 @@
+import React from 'react';
+import { type ThresholdEcdsaChainTarget } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
+type Targets = readonly [ThresholdEcdsaChainTarget, ...ThresholdEcdsaChainTarget[]];
+type ActionState = {
+    readonly kind: 'idle';
+} | {
+    readonly kind: 'adding';
+    readonly walletId: string;
+} | {
+    readonly kind: 'added';
+    readonly walletId: string;
+    readonly evmAddress: string;
+    readonly nearAccountId: string | null;
+} | {
+    readonly kind: 'failed';
+    readonly walletId: string;
+    readonly message: string;
+};
+/** The menu owns setup across navigation between its screens. */
+export declare function useEvmAccountSetup(): {
+    state: ActionState;
+    add: (walletId: string, targets: Targets) => Promise<void>;
+};
+export declare function AddEvmAccount({ walletId, setup, }: {
+    readonly walletId: string;
+    readonly setup: ReturnType<typeof useEvmAccountSetup>;
+}): React.JSX.Element | null;
+export {};
+//# sourceMappingURL=AddEvmAccount.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/AuthenticationMethodRow.d.ts

@@ -1,14 +1,19 @@
 import React from 'react';
 type AuthenticationMethodRowProps = {
-    kind: 'passkey' | 'email_otp';
+    kind: 'passkey' | 'email_otp' | 'voiceid';
     title: string;
-    description: string;
+    /** Plain copy is localized; an element carries its own live region or tone. */
+    description: string | React.ReactElement;
+    chip?: string;
     /** Replaces the method's default icon, as for a linked device. */
     icon?: React.ReactNode;
+    /** The row's one trailing control, such as Remove or a switch. */
     action?: React.ReactNode;
+    /** Full-width actions or a confirmation under a divider. */
+    footer?: React.ReactNode;
     onSelect?: () => void;
     children?: React.ReactNode;
 };
-export declare function AuthenticationMethodRow({ kind, title, description, icon, action, onSelect, children, }: AuthenticationMethodRowProps): React.JSX.Element;
+export declare function AuthenticationMethodRow({ kind, title, description, chip, icon, action, footer, onSelect, children, }: AuthenticationMethodRowProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=AuthenticationMethodRow.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/AuthenticationMethodsView.d.ts

@@ -1,8 +1,7 @@
 import React from 'react';
 /** Shared presentation; callers own enrollment data and authenticated actions. */
-export declare function AuthenticationMethodsView({ walletLabel, status, children, }: {
+export declare function AuthenticationMethodsView({ walletLabel, children, }: {
     walletLabel: string;
-    status: string;
     children: React.ReactNode;
 }): React.JSX.Element;
 //# sourceMappingURL=AuthenticationMethodsView.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/VoiceIdAvailabilityControl.d.ts

@@ -0,0 +1,19 @@
+import React from 'react';
+/** The VoiceID row in Authentication methods: the switch, its state, and the voice actions. */
+export declare function VoiceIdMethodRow({ walletId, disabled, onChanged, title, chip, remove, confirmation, children, }: {
+    walletId: string;
+    disabled: boolean;
+    onChanged: () => Promise<void>;
+    title: string;
+    chip?: string;
+    remove: React.ReactNode;
+    confirmation: React.ReactNode;
+    children?: React.ReactNode;
+}): React.JSX.Element;
+/** The VoiceID card under "Add a method", before this wallet has a VoiceID method. */
+export declare function VoiceIdSetupRow({ walletId, disabled, onChanged, }: {
+    walletId: string;
+    disabled: boolean;
+    onChanged: () => Promise<void>;
+}): React.JSX.Element;
+//# sourceMappingURL=VoiceIdAvailabilityControl.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/icons/ChevronRightIcon.d.ts

@@ -0,0 +1,2 @@
+export declare const ChevronRightIcon: import("react").FC<import("./strokeIcon").IconProps>;
+//# sourceMappingURL=ChevronRightIcon.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/icons/WalletIcon.d.ts

@@ -0,0 +1,2 @@
+export declare const WalletIcon: import("react").FC<import("./strokeIcon").IconProps>;
+//# sourceMappingURL=WalletIcon.d.ts.map

package/dist/types/wallet/src/react/externalNear.d.ts

@@ -0,0 +1,26 @@
+import { Component } from 'react';
+import { type ExternalNearController, type ExternalNearSnapshot, type ExternalNearWalletId } from '../externalNear';
+export declare function useExternalNear(controller: ExternalNearController): ExternalNearSnapshot;
+export declare class ExternalNearWalletPicker extends Component<{
+    controller: ExternalNearController;
+}, {
+    snapshot: ExternalNearSnapshot;
+    message: string;
+}> {
+    state: {
+        snapshot: Readonly<{
+            connection: import("../externalNear").ExternalNearState;
+            busy: boolean;
+            wallets: readonly ExternalNearWalletId[];
+        }>;
+        message: string;
+    };
+    private unsubscribe;
+    componentDidMount(): void;
+    componentWillUnmount(): void;
+    private updateSnapshot;
+    private connect;
+    private disconnect;
+    render(): import("react/jsx-runtime").JSX.Element;
+}
+//# sourceMappingURL=externalNear.d.ts.map

package/dist/types/wallet/src/react/index.d.ts

@@ -28,6 +28,7 @@ export * from '../externalEvm';
 export { ExternalEvmWalletPicker, useExternalEvm } from './externalEvm';
 export { SeamsWebProvider } from './context/SeamsWebProvider';
 export { SeamsWeb } from '../SeamsWeb';
+export type { WalletAuthMethodPlugin, VoiceIdAuthMethodPlugin } from '../core/authMethods/plugins';
 export { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromChainFamily, thresholdEcdsaChainTargetFromConfig, thresholdEcdsaChainTargetFromConfiguredRequest, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId, walletIdFromWalletProfile, walletSessionRefFromSession, } from '../boundary/walletRefs';
 export type { EcdsaCommandSubject, EvmEip155ChainTarget, NearAccountRef, NearCommandSubject, TempoChainTarget, ThresholdEcdsaChainTarget, WalletId, WalletSessionRef, } from '../boundary/walletRefs';
 export { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../core/config/defaultConfigs';
@@ -62,10 +63,6 @@ export { QRCodeScanner } from './components/QRCodeScanner';
 export type { QRCodeScannerProps } from './components/QRCodeScanner';
 export { ShowQRCode } from './components/ShowQRCode';
 export type { ShowQRCodeProps } from './components/ShowQRCode';
-export { VoiceAssistantCard } from './components/VoiceAssistantCard';
-export type { VoiceAssistantCardProps, VoiceAssistantInput, VoiceAssistantState, } from './components/VoiceAssistantCard';
-export { VoiceBeam } from 'voice-glow';
-export type { VoiceBeamLevel, VoiceBeamProps } from 'voice-glow';
 export { HostedSeamsAuthMenu, SeamsAuthMenuMock } from './components/HostedSeamsAuthMenu/public';
 export type { HostedAuthMenuCopy, HostedAuthMenuCopyInput, HostedAuthMenuExternalAuthBroker, HostedAuthMenuExternalAuthEvidence, HostedAuthMenuExternalAuthRequest, HostedAuthMenuExternalProvider, HostedAuthMenuMode, HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuRegistrationAccountInput, HostedAuthMenuSessionId, HostedSeamsAuthMenuProps, } from './components/HostedSeamsAuthMenu/public';
 export { default as TouchIcon } from './components/AccountMenuButton/icons/TouchIcon';

package/dist/types/wallet/src/voiceid-host.d.ts

@@ -0,0 +1,52 @@
+export declare const VOICE_ID_HOST_API_VERSION = 1;
+export type { MpcMaterialActivationRef } from '../../shared-ts/src/utils/domainIds';
+export type { WalletCapabilitySubjectV1 } from '../../shared-ts/src/device-linking/contracts';
+export { type RegistrationCapability, type RegistrationWebContext, } from './SeamsWeb/signingSurface/types';
+export { authMenuSuccessCopy } from './SeamsWeb/walletIframe/host/auth-menu/domain';
+export { type WalletIframeSurfaceMeasurementReporter, createWalletIframeSurfaceMeasurementReporter, } from './SeamsWeb/walletIframe/host/surface-measurement-reporter';
+export { backIcon } from './SeamsWeb/walletIframe/host/ui/auth-menu/icons';
+export { walletForHostRequest } from './SeamsWeb/walletIframe/host/walletMutationGuard';
+export { type ConfiguredWalletHost, walletHostExecutionFingerprint, } from './SeamsWeb/walletIframe/shared/configuration';
+export { type ParentToChildEnvelope } from './SeamsWeb/walletIframe/shared/messages';
+export { TransactionReviewError, type TransactionReviewWire, parseTransactionReviewWire, } from './SeamsWeb/walletIframe/shared/transactionReview';
+export { availabilityKey, parseStoredAuthMethodAvailability, readAuthMethodEnabled, } from './core/authMethods/availability';
+export { type AuthMethodApprovalResult, type AuthMethodCaptureMount, type AuthMethodCaptureSettlement, type AuthMethodNearInstallation, type AuthMethodSessionInstaller, type AuthMethodUnlockSuccess, type WalletAuthMethodHostPlugin, } from './core/authMethods/hostPlugin';
+export { type VoiceIdAuthMethodPlugin } from './core/authMethods/plugins';
+export { createCspStylesheetManager, getDefaultCspNonce, } from './core/browser/walletIframe/csp-stylesheet';
+export { resolveNearNetwork } from './core/config/chains';
+export { IndexedDBManager } from './core/indexedDB';
+export { SEAMS_WALLET_STORES } from './core/indexedDB/schemaNames';
+export { parseWalletAuthMethodV2StorageRow, parseWalletAuthorityStorageRow, parseWalletSelectionStorageRow, } from './core/indexedDB/seamsWalletDB/repositories';
+export { walletSessionAuthorizations } from './core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
+export { buildRelayerJsonPostRequestInit, buildWalletSessionAuthorizationHeaders, fetchWithWalletHomeDiscovery, normalizeRelayerBaseUrl, } from './core/rpcClients/relayer/relayerHttp';
+export { createRelayerExactWalletSessionStatusPort } from './core/rpcClients/relayer/walletSessionAuthorizationStatus';
+export { buildWebauthnP256SignatureWasm, decodeCoseP256PublicKeyWasm, } from './core/signingEngine/chains/evm/evmCryptoWasm';
+export { parseEd25519YaoRecoveryCapabilityV1 } from './core/signingEngine/session/passkey/ed25519YaoRecoveryCapability';
+export { SeamsWordmark } from './core/signingEngine/uiConfirm/ui/preact/SeamsWordmark';
+export { type UiConfirmSurfaceMeasurementBinding } from './core/signingEngine/uiConfirm/uiConfirm.types';
+export { type WalletCustodyCeremonyTransportPort } from './core/signingEngine/walletCustody/ceremonyStepRunner';
+export { parseResealedEnvelopeResult } from './core/signingEngine/walletCustody/resealedEnvelopeResult';
+export { readUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1, } from './core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability';
+export { type WorkerOperationContext } from './core/signingEngine/workerManager/executeWorkerOperation';
+export { WorkerDeferred } from './core/signingEngine/workerManager/workerDeferred';
+export { type UnlockedWalletEd25519ExportRootCapabilityV1 } from './core/signingEngine/workerManager/workerTypes';
+export { type WalletSessionId } from '../../shared-ts/src/authorization/capabilityKinds';
+export { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1, } from '../../shared-ts/src/authorization/delegatedAuthority';
+export { type VoiceIdDeviceAssertion, type VoiceIdDevicePublicKeyB64u, type VoiceIdWalletSessionChallenge, parseVoiceIdDeviceAssertion, parseVoiceIdDevicePublicKeyB64u, parseVoiceIdWalletSessionChallenge, voiceIdWalletSessionChallengeBytes, } from '../../shared-ts/src/authorization/voiceIdDeviceAssertion';
+export { type OwnerDeviceSummaryV1, parseLinkedDeviceListResultV1 } from '../../shared-ts/src/device-linking';
+export { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1, } from '../../shared-ts/src/device-linking/activeWalletSession';
+export { type ActiveWalletSessionV1, type WalletSessionOperationCredentialV1, } from '../../shared-ts/src/device-linking/contracts';
+export { ActionType } from '../../shared-ts/src/near/actions';
+export { type VoiceIdSeedEnvelope, buildMethodBoundEnvelopeOwnership, buildPasskeyCustodyEnvelopeRecord, buildVoiceIdEnvelopeFactor, buildWalletCustodySeedBinding, custodyEnvelopeBindingJsonV1, isVoiceIdSeedEnvelope, parseEnvelopeRevision, parsePasskeyCustodyEnvelopeRecord, } from '../../shared-ts/src/passkey-custody';
+export { base64UrlDecode, base64UrlEncode } from '../../shared-ts/src/utils/base64';
+export { type DigestB64u, parseDigestB64u, sha256DigestB64u, } from '../../shared-ts/src/utils/canonicalPrimitives';
+export { alphabetizeStringify } from '../../shared-ts/src/utils/digests';
+export { type PasskeyEnvelopeId, type WalletAuthMethodId, type WalletAuthorityId, type WalletId, allocateWalletAuthMethodId, mpcMaterialActivationRefsEqual, parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, } from '../../shared-ts/src/utils/domainIds';
+export { toError } from '../../shared-ts/src/utils/errors';
+export { rejectUnknownFields } from '../../shared-ts/src/utils/exactRecord';
+export { joinNormalizedUrl } from '../../shared-ts/src/utils/normalize';
+export { secureRandomId } from '../../shared-ts/src/utils/secureRandomId';
+export { isFiniteNumber, isPlainObject, requireRecord } from '../../shared-ts/src/utils/validation';
+export { type Variant } from '../../shared-ts/src/utils/variant';
+export { type ActiveVoiceIdWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2, parseWalletAuthMethodRecordV2, } from '../../shared-ts/src/utils/walletAuthMethodRecord';
+//# sourceMappingURL=voiceid-host.d.ts.map

package/dist/workers/device-linking-key.worker.js

@@ -2064,6 +2064,17 @@ function exactRecord4(raw, keys, label) {
   return record;
 }
 
+// ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+function parseVoiceIdDevicePublicKeyB64u(value) {
+  if (typeof value !== "string")
+    throw new Error("VoiceID public key is invalid");
+  const bytes = base64UrlDecode(value);
+  if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) {
+    throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+  }
+  return value;
+}
+
 // ../shared-ts/src/utils/registrationAuthMethodInput.ts
 function inspectRawObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -2081,7 +2092,7 @@ function parseWalletAuthMethodRecordV2(raw) {
   const version = trimString(record.version);
   const kind = trimString(record.kind);
   const status = trimString(record.status);
-  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") {
+  if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp" && kind !== "voiceid") {
     return null;
   }
   try {
@@ -2105,6 +2116,17 @@ function parseWalletAuthMethodRecordV2(raw) {
         counter: parseNonNegativeInteger(record.counter)
       });
     }
+    if (kind === "voiceid") {
+      if (!("deviceKeyId" in record) || !("devicePublicKeyB64u" in record))
+        return null;
+      exactWalletAuthMethodV2Fields(record, "voiceid", status);
+      return buildParsedVoiceIdWalletAuthMethodRecordV2({
+        common,
+        lifecycle: parseWalletAuthMethodLifecycle(record),
+        deviceKeyId: parseDigestB64u(record.deviceKeyId),
+        devicePublicKeyB64u: parseVoiceIdDevicePublicKeyB64u(record.devicePublicKeyB64u)
+      });
+    }
     if (!("emailHashHex" in record) || !("registrationAuthorityId" in record))
       return null;
     exactWalletAuthMethodV2Fields(record, "email_otp", status);
@@ -2181,8 +2203,10 @@ function exactWalletAuthMethodV2Fields(raw, kind, status) {
   ];
   if (kind === "passkey") {
     fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-  } else {
+  } else if (kind === "email_otp") {
     fields.push("emailHashHex", "registrationAuthorityId");
+  } else {
+    fields.push("deviceKeyId", "devicePublicKeyB64u");
   }
   if (status === "active")
     fields.push("activatedAtMs");
@@ -2298,6 +2322,52 @@ function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
       };
   }
 }
+function buildParsedVoiceIdWalletAuthMethodRecordV2(input) {
+  switch (input.lifecycle.status) {
+    case "pending_local_install":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "pending_local_install",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u
+      };
+    case "active":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "active",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs
+      };
+    case "revoked":
+      return {
+        version: "wallet_auth_method_v2",
+        walletAuthMethodId: input.common.walletAuthMethodId,
+        walletId: input.common.walletId,
+        walletAuthorityId: input.common.walletAuthorityId,
+        kind: "voiceid",
+        status: "revoked",
+        createdAtMs: input.common.createdAtMs,
+        updatedAtMs: input.common.updatedAtMs,
+        deviceKeyId: input.deviceKeyId,
+        devicePublicKeyB64u: input.devicePublicKeyB64u,
+        activatedAtMs: input.lifecycle.activatedAtMs,
+        revokedAtMs: input.lifecycle.revokedAtMs
+      };
+  }
+}
 function parseWalletAuthMethodIdRequired(raw) {
   const parsed = parseWalletAuthMethodId(raw);
   if (!parsed.ok)
@@ -2768,7 +2838,7 @@ function parseCommittedAuthorityPackagesV1(raw) {
     throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
   }
   const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-  if (!authMethod || authMethod.status !== "pending_local_install") {
+  if (!authMethod || authMethod.status !== "pending_local_install" || authMethod.kind === "voiceid") {
     throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
   }
   if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) {
@@ -5082,6 +5152,7 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 var WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 var PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 var EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+var VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
 var ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -5122,6 +5193,13 @@ function buildEmailOtpEnvelopeFactor(args) {
     kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
   };
 }
+function buildVoiceIdEnvelopeFactor(args) {
+  return {
+    kind: "voiceid",
+    deviceKeyId: args.deviceKeyId,
+    kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+  };
+}
 function buildActiveEnvelopeLifecycle(args) {
   return { state: "active", activatedAtMs: args.activatedAtMs };
 }
@@ -5200,7 +5278,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 function requireNonEmptyString(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -5236,8 +5315,17 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
         enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
       });
     }
+    case "voiceid": {
+      rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+      if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) {
+        throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+      }
+      return buildVoiceIdEnvelopeFactor({
+        deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`)
+      });
+    }
     default:
-      throw new Error(`${label}.kind must be passkey or email_otp`);
+      throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
   }
 }
 var ENVELOPE_RECORD_FIELDS = [

package/dist/workers/ecdsa-derivation-client.worker.js

@@ -1273,28 +1273,6 @@ function parseLinkDeviceSessionId(raw) {
   return parseDomainId(raw, "linkDeviceSessionId");
 }
 
-// ../shared-ts/src/utils/walletAuthAuthority.ts
-function parseWalletAuthAuthorityRef(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
-    return null;
-  const record = raw;
-  const fields = Object.keys(record);
-  if (fields.length !== 4 || !fields.every((field) => ["kind", "walletId", "authorityDigest", "walletAuthMethodId"].includes(field)) || record.kind !== "wallet_auth_authority_ref") {
-    return null;
-  }
-  const walletId = parseWalletId(record.walletId);
-  const authorityDigest = parseWalletAuthorityBindingDigest(record.authorityDigest);
-  const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-  if (!walletId.ok || !authorityDigest.ok || !walletAuthMethodId.ok)
-    return null;
-  return {
-    kind: "wallet_auth_authority_ref",
-    walletId: walletId.value,
-    authorityDigest: authorityDigest.value,
-    walletAuthMethodId: walletAuthMethodId.value
-  };
-}
-
 // ../shared-ts/src/utils/normalize.ts
 function normalizeOptionalString(value) {
   return typeof value === "string" ? value : "";
@@ -1329,6 +1307,69 @@ function requireArray(value, label) {
   return value;
 }
 
+// ../shared-ts/src/utils/exactRecord.ts
+var SECRET_BEARING_FIELD_SUBSTRINGS = [
+  "prf",
+  "kek",
+  "seed",
+  "scalar",
+  "secretkey",
+  "privatekey",
+  "plaintext",
+  "recoverycode",
+  "clientroot",
+  "holdershare"
+];
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+  const allowedSet = new Set(allowed);
+  const knownSet = new Set(knownOnOtherBranches);
+  for (const field of Object.keys(record)) {
+    if (allowedSet.has(field))
+      continue;
+    if (knownSet.has(field)) {
+      throw new Error(`${label}.${field} is not part of ${label}`);
+    }
+    const normalized = field.toLowerCase().replace(/_/g, "");
+    const namesAPublicKey = normalized.includes("publickey");
+    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
+      throw new Error(`${label}.${field} must never carry plaintext custody material`);
+    }
+    throw new Error(`${label}.${field} is not part of ${label}`);
+  }
+}
+function exactRecord(raw, fields, label) {
+  const record = requireRecord(raw, label);
+  rejectUnknownFields(record, fields, label);
+  for (const field of fields) {
+    if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === undefined) {
+      throw new Error(`${label}.${field} is required`);
+    }
+  }
+  return record;
+}
+
+// ../shared-ts/src/utils/walletAuthAuthority.ts
+function parseWalletAuthAuthorityRef(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return null;
+  const record = raw;
+  const fields = Object.keys(record);
+  if (fields.length !== 4 || !fields.every((field) => ["kind", "walletId", "authorityDigest", "walletAuthMethodId"].includes(field)) || record.kind !== "wallet_auth_authority_ref") {
+    return null;
+  }
+  const walletId = parseWalletId(record.walletId);
+  const authorityDigest = parseWalletAuthorityBindingDigest(record.authorityDigest);
+  const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+  if (!walletId.ok || !authorityDigest.ok || !walletAuthMethodId.ok)
+    return null;
+  return {
+    kind: "wallet_auth_authority_ref",
+    walletId: walletId.value,
+    authorityDigest: authorityDigest.value,
+    walletAuthMethodId: walletAuthMethodId.value
+  };
+}
+
 // ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
 function requireExactFields(record, expectedFields, label) {
   const actualFields = Object.keys(record).sort();
@@ -1850,47 +1891,6 @@ var SERVER_ALLOCATED_WALLET_NOUNS = [
 var SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
 var SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
 
-// ../shared-ts/src/utils/exactRecord.ts
-var SECRET_BEARING_FIELD_SUBSTRINGS = [
-  "prf",
-  "kek",
-  "seed",
-  "scalar",
-  "secretkey",
-  "privatekey",
-  "plaintext",
-  "recoverycode",
-  "clientroot",
-  "holdershare"
-];
-function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
-  const allowedSet = new Set(allowed);
-  const knownSet = new Set(knownOnOtherBranches);
-  for (const field of Object.keys(record)) {
-    if (allowedSet.has(field))
-      continue;
-    if (knownSet.has(field)) {
-      throw new Error(`${label}.${field} is not part of ${label}`);
-    }
-    const normalized = field.toLowerCase().replace(/_/g, "");
-    const namesAPublicKey = normalized.includes("publickey");
-    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
-      throw new Error(`${label}.${field} must never carry plaintext custody material`);
-    }
-    throw new Error(`${label}.${field} is not part of ${label}`);
-  }
-}
-function exactRecord(raw, fields, label) {
-  const record = requireRecord(raw, label);
-  rejectUnknownFields(record, fields, label);
-  for (const field of fields) {
-    if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === undefined) {
-      throw new Error(`${label}.${field} is required`);
-    }
-  }
-  return record;
-}
-
 // ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 var LANE_SCOPE_FIELDS = ["kind", "walletKeyId", "laneId", "laneShareEpoch"];
 var ALLOWED_FIELDS_BY_KIND = {
@@ -1928,7 +1928,8 @@ var EMAIL_OTP_FACTOR_FIELDS = [
   "enrollmentSealKeyVersion",
   "kekVersion"
 ];
-var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+var VOICEID_FACTOR_FIELDS = ["kind", "deviceKeyId", "kekVersion"];
+var ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS, ...VOICEID_FACTOR_FIELDS]));
 // ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
 function parseWalletCustodyGeneratedString(value, label) {
   if (typeof value !== "string") {
@@ -5262,7 +5263,8 @@ var EMAIL_OTP_CHANNEL = "email_otp";
 // ../shared-ts/src/utils/signerDomain.ts
 var WALLET_AUTH_METHODS = {
   passkey: "passkey",
-  emailOtp: EMAIL_OTP_CHANNEL
+  emailOtp: EMAIL_OTP_CHANNEL,
+  voiceId: "voiceid"
 };
 var WALLET_AUTH_METHOD_VALUES = Object.values(WALLET_AUTH_METHODS);