@seams/wallet 0.23.0 → 0.24.0

package/dist/{public/sdk/walletSessionAuthorizationStore-DYRMCkiT.js → esm/sdk/walletSessionAuthorizationStore-zkxcMdSp.js}

@@ -1 +1 @@
-import{D as e,O as t,T as n,h as r}from"./domainIds-C3fUa33Q.js";import{i,t as a}from"./activeWalletSession-BtEHhe99.js";import{d as o,h as s,m as c}from"./capabilityKinds-CqHVzVsJ.js";import{r as l}from"./canonicalPrimitives-D_1HyEuJ.js";import{a as u,i as d,n as f}from"./presignatures-DGLNs29C.js";import{t as p}from"./walletOwnershipGeneration-CQzaodhB.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let n=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let i=n.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=r(n.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(r){let i=_(r,`kind`),a=i===`active_wallet_session_v1`?g(r,y):i===`retired_wallet_session_v1`?g(r,b):null;if(!a)return null;let s=t(a.get(`walletId`)),u=e(a.get(`authorityId`)),d=n(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};
+import{E as e,O as t,g as n,k as r}from"./domainIds-t1lp25yU.js";import{i,t as a}from"./activeWalletSession-H9JBdHyQ.js";import{d as o,h as s,m as c}from"./capabilityKinds-BzrNeEyO.js";import{r as l}from"./canonicalPrimitives-B6YMrI3W.js";import{a as u,i as d,n as f}from"./presignatures-B9GrGx0L.js";import{t as p}from"./walletOwnershipGeneration-DI9ogcXF.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let r=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!r)return null;let i=r.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=n(r.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(n){let i=_(n,`kind`),a=i===`active_wallet_session_v1`?g(n,y):i===`retired_wallet_session_v1`?g(n,b):null;if(!a)return null;let s=r(a.get(`walletId`)),u=t(a.get(`authorityId`)),d=e(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};

package/dist/esm/sdk/warmSessionHydration-DqZyfi1h.js

@@ -0,0 +1 @@
+import{t as e}from"./prfCache-8Wm3etlV.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/esm/sdk/{webauthnP256-unqBoZCk.js → webauthnP256-BvTL8nq4.js}

@@ -1 +1 @@
-import{r as e,t}from"./base64-BmKR3UqU.js";import{n}from"./evmCryptoWasm-S2gL5ht4.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};
+import{r as e,t}from"./base64-BmKR3UqU.js";import{n}from"./evmCryptoWasm-DacbCVNM.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -71,6 +71,9 @@ function parseWalletSessionId(value) {
 function parseMpcWalletSigningQuotaId(value) {
 	return parseAuthorizationId(value, "mpcWalletSigningQuotaId");
 }
+function parseWalletSessionMintId(value) {
+	return parseAuthorizationId(value, "walletSessionMintId");
+}
 function parseAuthorizationId(value, fieldName) {
 	if (typeof value !== "string") return {
 		ok: false,
@@ -100,6 +103,6 @@ function parseAuthorizationId(value, fieldName) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId };
+export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
 
 //# sourceMappingURL=capabilityKinds.js.map

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -1,4 +1,5 @@
-Object.freeze([
+//#region ../shared-ts/src/authorization/delegatedAuthority.ts
+const FULL_OWNER_PERMISSIONS = Object.freeze([
 	"export_keys",
 	"link_devices",
 	"revoke_devices",
@@ -61,11 +62,19 @@ function parseDelegatedWalletAuthorityV1(raw) {
 		value: buildDelegatedWalletAuthorityV1({ permissions: permissions.value })
 	};
 }
+function buildFullOwnerPermissionsV1() {
+	return buildPresetPermissionSet(FULL_OWNER_PERMISSIONS);
+}
 function sameDelegatedWalletAuthorityV1(left, right) {
 	if (left.kind !== right.kind || left.permissions.length !== right.permissions.length) return false;
 	for (let index = 0; index < left.permissions.length; index += 1) if (left.permissions[index] !== right.permissions[index]) return false;
 	return true;
 }
+function buildPresetPermissionSet(permissions) {
+	const parsed = parseDelegatedWalletPermissionSetV1(permissions);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
 function compareDelegatedWalletPermissions(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -98,6 +107,6 @@ function invalidAuthorityResult(message) {
 	};
 }
 //#endregion
-export { buildDelegatedWalletAuthorityV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
+export { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
 
 //# sourceMappingURL=delegatedAuthority.js.map

package/dist/esm/shared-ts/src/authorization/voiceIdDeviceAssertion.js

@@ -0,0 +1,110 @@
+import { isPlainObject } from "../utils/validation.js";
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
+import { parseWalletSessionMintId } from "./capabilityKinds.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+//#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
+const CHALLENGE_DOMAIN = "seams:wallet-session:voiceid-device:v1";
+const MAXIMUM_CHALLENGE_MS = 6e4;
+function parseVoiceIdDevicePublicKeyB64u(value) {
+	if (typeof value !== "string") throw new Error("VoiceID public key is invalid");
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("VoiceID public key must be canonical Ed25519 bytes");
+	return value;
+}
+function exactKeys(value, keys) {
+	if (Object.keys(value).length !== keys.length) return false;
+	for (const key of keys) if (!Object.hasOwn(value, key)) return false;
+	return true;
+}
+function requireOrigin(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be an origin`);
+	let origin;
+	let protocol;
+	try {
+		const parsed = new URL(value);
+		origin = parsed.origin;
+		protocol = parsed.protocol;
+	} catch {
+		throw new Error(`${label} must be an origin`);
+	}
+	if (origin !== value || protocol !== "http:" && protocol !== "https:") throw new Error(`${label} must be a canonical HTTP origin`);
+	return origin;
+}
+function requireWindow(issuedAtMs, expiresAtMs) {
+	if (!Number.isSafeInteger(issuedAtMs) || !Number.isSafeInteger(expiresAtMs) || Number(issuedAtMs) <= 0 || Number(expiresAtMs) <= Number(issuedAtMs) || Number(expiresAtMs) - Number(issuedAtMs) > MAXIMUM_CHALLENGE_MS) throw new Error("VoiceID challenge has an invalid validity window");
+}
+function buildVoiceIdWalletSessionChallenge(fields) {
+	requireWindow(fields.issuedAtMs, fields.expiresAtMs);
+	requireOrigin(fields.requestOrigin, "VoiceID requestOrigin");
+	requireOrigin(fields.audience, "VoiceID audience");
+	return {
+		kind: "voiceid_wallet_session_challenge_v1",
+		walletId: fields.walletId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		walletAuthorityId: fields.walletAuthorityId,
+		deviceKeyId: fields.deviceKeyId,
+		challengeId: fields.challengeId,
+		nonce: fields.nonce,
+		requestOrigin: fields.requestOrigin,
+		audience: fields.audience,
+		issuedAtMs: fields.issuedAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseVoiceIdWalletSessionChallenge(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"walletId",
+		"walletAuthMethodId",
+		"walletAuthorityId",
+		"deviceKeyId",
+		"challengeId",
+		"nonce",
+		"requestOrigin",
+		"audience",
+		"issuedAtMs",
+		"expiresAtMs"
+	]) || raw.kind !== "voiceid_wallet_session_challenge_v1") throw new Error("Invalid VoiceID Wallet Session challenge");
+	const walletId = parseWalletId(raw.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(raw.walletAuthMethodId);
+	const walletAuthorityId = parseWalletAuthorityId(raw.walletAuthorityId);
+	const challengeId = parseWalletSessionMintId(raw.challengeId);
+	if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !challengeId.ok) throw new Error("VoiceID challenge identity is invalid");
+	if (typeof raw.issuedAtMs !== "number" || typeof raw.expiresAtMs !== "number") throw new Error("VoiceID challenge times must be numbers");
+	return buildVoiceIdWalletSessionChallenge({
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		walletAuthorityId: walletAuthorityId.value,
+		deviceKeyId: parseDigestB64u(raw.deviceKeyId),
+		challengeId: challengeId.value,
+		nonce: parseDigestB64u(raw.nonce),
+		requestOrigin: requireOrigin(raw.requestOrigin, "VoiceID requestOrigin"),
+		audience: requireOrigin(raw.audience, "VoiceID audience"),
+		issuedAtMs: raw.issuedAtMs,
+		expiresAtMs: raw.expiresAtMs
+	});
+}
+function parseVoiceIdDeviceAssertion(raw) {
+	if (!isPlainObject(raw) || !exactKeys(raw, [
+		"kind",
+		"challenge",
+		"signatureB64u"
+	]) || raw.kind !== "voiceid_device_assertion_v1" || typeof raw.signatureB64u !== "string") throw new Error("Invalid VoiceID device assertion");
+	const signature = base64UrlDecode(raw.signatureB64u);
+	if (signature.length !== 64 || base64UrlEncode(signature) !== raw.signatureB64u) throw new Error("VoiceID signature must be canonical Ed25519 bytes");
+	return {
+		kind: "voiceid_device_assertion_v1",
+		challenge: parseVoiceIdWalletSessionChallenge(raw.challenge),
+		signatureB64u: raw.signatureB64u
+	};
+}
+function voiceIdWalletSessionChallengeBytes(challenge) {
+	const payload = alphabetizeStringify(challenge);
+	return new TextEncoder().encode(`${CHALLENGE_DOMAIN}|${payload}`);
+}
+//#endregion
+export { parseVoiceIdDeviceAssertion, parseVoiceIdDevicePublicKeyB64u, parseVoiceIdWalletSessionChallenge, voiceIdWalletSessionChallengeBytes };
+
+//# sourceMappingURL=voiceIdDeviceAssertion.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -1,6 +1,7 @@
 import { wireLiteral, wireObject } from "../utils/wireSchema.js";
 import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, walletAuthMethodId, walletAuthorityId, walletId } from "./wireFields.js";
 import "./activeWalletSession.js";
+import "../utils/walletAuthMethodRecord.js";
 import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
 import "./walletSessionCredentialDelivery.js";
 //#region ../shared-ts/src/device-linking/authorityActivation.ts

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -1,3 +1,4 @@
 import "../utils/routerAbEd25519Yao.js";
 import "./sourceContribution.js";
+import "../utils/walletAuthMethodRecord.js";
 import "../authorization/walletAuthority.js";

package/dist/esm/shared-ts/src/device-linking/deviceManagement.js

@@ -25,15 +25,23 @@ function parseWebAuthnDeviceInfo(raw, label) {
 	return device;
 }
 function linkedOwnerCredentialMetadataV1() {
-	return wireUnion("kind", [wireObject({
-		kind: wireLiteral("passkey"),
-		walletAuthMethodId,
-		credentialIdB64u: credentialId,
-		device: parseWebAuthnDeviceInfo
-	}), wireObject({
-		kind: wireLiteral("email_otp"),
-		walletAuthMethodId
-	})]);
+	return wireUnion("kind", [
+		wireObject({
+			kind: wireLiteral("passkey"),
+			walletAuthMethodId,
+			credentialIdB64u: credentialId,
+			device: parseWebAuthnDeviceInfo
+		}),
+		wireObject({
+			kind: wireLiteral("email_otp"),
+			walletAuthMethodId
+		}),
+		wireObject({
+			kind: wireLiteral("voiceid"),
+			walletAuthMethodId,
+			deviceKeyId: digest
+		})
+	]);
 }
 function parseLinkedOwnerCredentialMetadata(raw, label) {
 	return linkedOwnerCredentialMetadataV1()(raw, label);

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -7,6 +7,13 @@ import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
 const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
 const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+const VOICEID_DEVICE_FACTOR_KEK_VERSION_V1 = "voiceid_device_factor_kek_hkdf_sha256_v1";
+function isActiveMethodBoundWalletSeedEnvelope(envelope) {
+	return envelope.ownership.kind === "method_bound" && envelope.binding.kind === "wallet_custody_seed_v1" && envelope.lifecycle.state === "active";
+}
+function isVoiceIdSeedEnvelope(envelope) {
+	return isActiveMethodBoundWalletSeedEnvelope(envelope) && envelope.factor.kind === "voiceid";
+}
 const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
 function parseWalletCustodyEnvelopeOwnership(raw, label) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
@@ -27,6 +34,38 @@ function parseWalletCustodyEnvelopeOwnership(raw, label) {
 		default: throw new Error(`${label}.kind must be unbound or method_bound`);
 	}
 }
+/**
+* The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
+*
+* Every caller that hands a binding to wasm must build it here. The Rust struct
+* uses `deny_unknown_fields` and now requires `ownership`, so a hand-rolled
+* object that omits it fails to deserialise — and that failure surfaces as an
+* unopenable envelope, not a type error.
+*/
+function custodyEnvelopeBindingJsonV1(envelope) {
+	return JSON.stringify({
+		walletId: envelope.walletId,
+		envelopeId: envelope.envelopeId,
+		factor: envelope.factor,
+		envelopeRevision: envelope.envelopeRevision,
+		binding: envelope.binding,
+		ownership: custodyEnvelopeOwnershipWireV1(envelope.ownership)
+	});
+}
+/** Serde's shape for the ownership enum: a bare string, or a one-key object. */
+function custodyEnvelopeOwnershipWireV1(ownership) {
+	switch (ownership.kind) {
+		case "unbound": return "unbound";
+		case "method_bound": return { methodBound: { walletAuthMethodId: String(ownership.walletAuthMethodId) } };
+		default: throw new Error(`Unhandled custody envelope ownership: ${String(ownership)}`);
+	}
+}
+function buildMethodBoundEnvelopeOwnership(walletAuthMethodId) {
+	return {
+		kind: "method_bound",
+		walletAuthMethodId
+	};
+}
 function buildPasskeyEnvelopeFactor(args) {
 	return {
 		kind: "passkey",
@@ -43,6 +82,13 @@ function buildEmailOtpEnvelopeFactor(args) {
 		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
 	};
 }
+function buildVoiceIdEnvelopeFactor(args) {
+	return {
+		kind: "voiceid",
+		deviceKeyId: args.deviceKeyId,
+		kekVersion: VOICEID_DEVICE_FACTOR_KEK_VERSION_V1
+	};
+}
 function buildActiveEnvelopeLifecycle(args) {
 	return {
 		state: "active",
@@ -129,7 +175,16 @@ const EMAIL_OTP_FACTOR_FIELDS = [
 	"enrollmentSealKeyVersion",
 	"kekVersion"
 ];
-const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+const VOICEID_FACTOR_FIELDS = [
+	"kind",
+	"deviceKeyId",
+	"kekVersion"
+];
+const ALL_FACTOR_FIELDS = Array.from(new Set([
+	...PASSKEY_FACTOR_FIELDS,
+	...EMAIL_OTP_FACTOR_FIELDS,
+	...VOICEID_FACTOR_FIELDS
+]));
 function requireNonEmptyString(value, label) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
 	return value;
@@ -156,7 +211,11 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
 				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
 				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
 			});
-		default: throw new Error(`${label}.kind must be passkey or email_otp`);
+		case "voiceid":
+			rejectUnknownFields(record, VOICEID_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+			if (record.kekVersion !== VOICEID_DEVICE_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${VOICEID_DEVICE_FACTOR_KEK_VERSION_V1}`);
+			return buildVoiceIdEnvelopeFactor({ deviceKeyId: parseDigestField(record.deviceKeyId, `${label}.deviceKeyId`) });
+		default: throw new Error(`${label}.kind must be passkey, email_otp, or voiceid`);
 	}
 }
 const ENVELOPE_RECORD_FIELDS = [
@@ -217,6 +276,6 @@ function sameWalletCustodyEnvelopeOwnership(left, right) {
 	return right.kind === "method_bound" && String(left.walletAuthMethodId) === String(right.walletAuthMethodId);
 }
 //#endregion
-export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, sameWalletCustodyEnvelopeOwnership };
+export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildMethodBoundEnvelopeOwnership, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, buildVoiceIdEnvelopeFactor, custodyEnvelopeBindingJsonV1, custodyEnvelopeOwnershipWireV1, isActiveMethodBoundWalletSeedEnvelope, isVoiceIdSeedEnvelope, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, sameWalletCustodyEnvelopeOwnership };
 
 //# sourceMappingURL=custodyEnvelope.js.map

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -172,6 +172,6 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 	}
 }
 //#endregion
-export { buildEd25519YaoClientRootBinding, parsePasskeyCustodySecretBinding };
+export { buildEd25519YaoClientRootBinding, buildWalletCustodySeedBinding, parsePasskeyCustodySecretBinding };
 
 //# sourceMappingURL=custodySecretBinding.js.map

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -1,5 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { sha256BytesUtf8 } from "./digests.js";
+import { sha256Bytes, sha256BytesUtf8 } from "./digests.js";
 //#region ../shared-ts/src/utils/canonicalPrimitives.ts
 function parseCorrelationId(value) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error("correlation id must be a non-empty canonical string");
@@ -26,10 +26,13 @@ function isoTimestampFromUnixMs(value) {
 	if (!Number.isSafeInteger(value) || Number(value) <= 0) throw new Error("timestamp milliseconds must be a positive safe integer");
 	return parseIsoTimestamp(new Date(Number(value)).toISOString());
 }
+async function sha256DigestB64u(bytes) {
+	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+}
 async function sha256Utf8DigestB64u(text) {
 	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
 }
 //#endregion
-export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256Utf8DigestB64u };
+export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -112,6 +112,19 @@ function parseWebAuthnCredentialIdB64u(raw) {
 function parsePasskeyEnvelopeId(raw) {
 	return parseDomainId(raw, "passkeyEnvelopeId");
 }
+/**
+* Mints a wallet auth-method id.
+*
+* Registration allocates this identity on the server. Device-bound VoiceID
+* activation allocates it in the Wallet before sealing its custody envelope.
+* Both paths use this builder because the identity is authenticated data in
+* the custody envelope's AAD.
+*/
+function allocateWalletAuthMethodId(randomSuffix) {
+	const parsed = parseWalletAuthMethodId(`wallet-auth-method:${randomSuffix}`);
+	if (!parsed.ok) throw new Error(`Generated wallet auth-method ID is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
 function parseWalletAuthMethodId(raw) {
 	return parseDomainId(raw, "walletAuthMethodId");
 }
@@ -253,6 +266,6 @@ function parseLinkDeviceSessionId(raw) {
 	return parseDomainId(raw, "linkDeviceSessionId");
 }
 //#endregion
-export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseEcdsaActiveStateId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcKeyBindingRef, parseMpcLifecycleBindingRef, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcMaterialOwnerRef, parseMpcSigningWorkerRef, parsePasskeyEnvelopeId, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
+export { allocateWalletAuthMethodId, buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseEcdsaActiveStateId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcKeyBindingRef, parseMpcLifecycleBindingRef, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcMaterialOwnerRef, parseMpcSigningWorkerRef, parsePasskeyEnvelopeId, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
 
 //# sourceMappingURL=domainIds.js.map

package/dist/esm/shared-ts/src/utils/signerDomain.js

@@ -7,11 +7,13 @@ const SIGNER_KINDS = {
 };
 const SIGNER_AUTH_METHODS = {
 	passkey: "passkey",
-	emailOtp: EMAIL_OTP_CHANNEL
+	emailOtp: EMAIL_OTP_CHANNEL,
+	voiceId: "voiceid"
 };
 const WALLET_AUTH_METHODS = {
 	passkey: "passkey",
-	emailOtp: EMAIL_OTP_CHANNEL
+	emailOtp: EMAIL_OTP_CHANNEL,
+	voiceId: "voiceid"
 };
 const SENSITIVE_OPERATION_POLICIES = {
 	inheritSessionPolicy: "inherit_session_policy",

package/dist/esm/shared-ts/src/utils/validation.js

@@ -26,6 +26,9 @@ function isPlainObject(x) {
 function isString(x) {
 	return typeof x === "string";
 }
+function isFiniteNumber(x) {
+	return typeof x === "number" && Number.isFinite(x);
+}
 function isFunction(x) {
 	return typeof x === "function";
 }
@@ -71,6 +74,6 @@ function extractBorshBytesFromPlainSignedTx(x) {
 	return Array.from(asU8 || new Uint8Array());
 }
 //#endregion
-export { asRecord, coerceNonEmptyString, extractBorshBytesFromPlainSignedTx, isArray, isBoolean, isFunction, isObject, isPlainObject, isPlainSignedTransactionLike, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireTrimmedString, stripFunctionsShallow };
+export { asRecord, coerceNonEmptyString, extractBorshBytesFromPlainSignedTx, isArray, isBoolean, isFiniteNumber, isFunction, isObject, isPlainObject, isPlainSignedTransactionLike, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireTrimmedString, stripFunctionsShallow };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,8 +1,25 @@
+import { requireRecord } from "./validation.js";
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import { parseDigestB64u } from "./canonicalPrimitives.js";
+import { rejectUnknownFields } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
+function buildVoiceIdWalletAuthAuthority(input) {
+	return {
+		walletId: input.walletId,
+		bindingId: input.walletAuthMethodId,
+		factor: {
+			kind: "voiceid",
+			deviceKeyId: input.deviceKeyId
+		},
+		verifier: { kind: "device_signature" }
+	};
+}
+function isVoiceIdWalletAuthAuthority(authority) {
+	return authority.factor.kind === "voiceid";
+}
 function isPasskeyWalletAuthAuthority(authority) {
 	return authority.factor.kind === "passkey";
 }
@@ -19,6 +36,7 @@ function walletAuthAuthoritiesMatch(left, right) {
 		if (!isEmailOtpWalletAuthAuthority(right)) return false;
 		return left.factor.provider === right.factor.provider && left.factor.providerUserId === right.factor.providerUserId && left.verifier.emailHashHex === right.verifier.emailHashHex;
 	}
+	if (isVoiceIdWalletAuthAuthority(left)) return isVoiceIdWalletAuthAuthority(right) && left.factor.deviceKeyId === right.factor.deviceKeyId;
 	return false;
 }
 function parseWalletAuthAuthorityRef(raw) {
@@ -166,7 +184,33 @@ function parseEmailOtpWalletAuthAuthorityObject(obj) {
 function parseWalletAuthAuthority(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const obj = raw;
-	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj);
+	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj) || parseVoiceIdWalletAuthAuthority(obj);
+}
+function parseVoiceIdWalletAuthAuthority(raw) {
+	try {
+		const record = requireRecord(raw, "device authority");
+		rejectUnknownFields(record, [
+			"walletId",
+			"bindingId",
+			"factor",
+			"verifier"
+		], "device authority");
+		const factor = requireRecord(record.factor, "device factor");
+		const verifier = requireRecord(record.verifier, "device verifier");
+		rejectUnknownFields(factor, ["kind", "deviceKeyId"], "device factor");
+		rejectUnknownFields(verifier, ["kind"], "device verifier");
+		if (factor.kind !== "voiceid" || verifier.kind !== "device_signature") return null;
+		const walletId = parseWalletId(record.walletId);
+		const method = parseWalletAuthMethodId(record.bindingId);
+		if (!walletId.ok || !method.ok) return null;
+		return buildVoiceIdWalletAuthAuthority({
+			walletId: walletId.value,
+			walletAuthMethodId: method.value,
+			deviceKeyId: parseDigestB64u(factor.deviceKeyId)
+		});
+	} catch {
+		return null;
+	}
 }
 function parseEmailOtpWalletAuthAuthority(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
@@ -191,6 +235,6 @@ async function walletAuthAuthorityRef(args) {
 	};
 }
 //#endregion
-export { buildEmailOtpWalletAuthAuthority, canonicalWalletAuthorityBindingDigestInput, isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parsePasskeyWalletAuthAuthority, parseWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthoritiesMatch, walletAuthAuthorityRef, walletAuthorityBindingDigest };
+export { buildEmailOtpWalletAuthAuthority, buildVoiceIdWalletAuthAuthority, canonicalWalletAuthorityBindingDigestInput, isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parsePasskeyWalletAuthAuthority, parseWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthoritiesMatch, walletAuthAuthorityRef, walletAuthorityBindingDigest };
 
 //# sourceMappingURL=walletAuthAuthority.js.map