@seams/wallet 0.26.0 → 0.28.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.26.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.28.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.26.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.28.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.26.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.28.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.26.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.28.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/auth/externalAuth.d.ts

@@ -0,0 +1,84 @@
+import { type WalletId } from '../utils/domainIds';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export declare const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+export type ExternalAuthConfiguration = ReadonlyExclusiveUnion<{
+    kind: 'disabled';
+    revision: number;
+} | {
+    kind: 'google';
+    revision: number;
+    clientId: string;
+}>;
+export declare function parseExternalAuthConfiguration(raw: unknown): ExternalAuthConfiguration;
+type ExternalAuthFailureCode = 'invalid_request' | 'invalid_credential' | 'access_denied' | 'expired' | 'superseded' | 'unavailable' | 'rate_limited';
+export type ExternalAuthResult<T> = ReadonlyExclusiveUnion<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: ExternalAuthFailureCode;
+    message: string;
+}>;
+export type ExternalAuthenticateInput = ReadonlyExclusiveUnion<{
+    method: 'google';
+    walletId: string;
+    idToken: string;
+} | {
+    method: 'handoff';
+    walletId: string;
+    attemptId: string;
+    code: string;
+}>;
+export type ExternalAuthAttempt = Readonly<{
+    attemptId: string;
+    walletId: WalletId;
+    expiresAtMs: number;
+}>;
+export type ExternalAuthCommand = ReadonlyExclusiveUnion<{
+    action: 'authenticate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'prepare';
+    walletId: string;
+} | {
+    action: 'associate';
+    walletId: string;
+    idToken: string;
+} | {
+    action: 'unlink';
+    walletId: string;
+    associationId: string;
+}>;
+export declare function parseExternalAuthCommand(raw: unknown): ExternalAuthCommand;
+export type ExternalWalletAuthentication = Readonly<{
+    kind: 'external_authenticated';
+    walletId: WalletId;
+    sessionId: string;
+    associationId: string;
+    environmentId: string;
+    provider: 'google';
+    permission: 'wallet_settings_read';
+    expiresAtMs: number;
+    authMethod?: never;
+}>;
+export type ExternalWalletSettings = Readonly<{
+    authentication: ExternalWalletAuthentication;
+    accounts: readonly Readonly<{
+        family: 'ed25519' | 'ecdsa';
+        address: string;
+        publicKey: string;
+    }>[];
+    methods: readonly Readonly<{
+        id: string;
+        kind: 'passkey' | 'email_otp' | 'voiceid';
+    }>[];
+    devices: readonly Readonly<{
+        id: string;
+    }>[];
+}>;
+export declare function parseExternalWalletAuthentication(value: unknown): ExternalWalletAuthentication;
+export declare function externalAuthFailure(code: ExternalAuthFailureCode): ExternalAuthResult<never>;
+export declare function parseExternalAuthFailure(value: unknown): ExternalAuthResult<never>;
+export declare function parseExternalWalletSettings(value: unknown): ExternalWalletSettings;
+export {};
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/walletHostOwnerAuthority.d.ts

@@ -1,7 +1,7 @@
 import type { DeviceLinkOwnerConfirmation } from '../../walletIframe/host/deviceLinkApproval';
 import type { HttpTransport } from '../../../core/platform/http';
 import type { UnlockedEd25519ExportRootLinkingCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
-import { type WalletSessionAuthorizationRepository } from '../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
+import { type WalletSessionOperationCredentialV1, type WalletSessionAuthorizationRepository } from '../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
 import type { ResolveSelectedWalletAuthorityResultV1 } from '../../../core/indexedDB/seamsWalletDB/repositories';
 import type { WalletAuthenticationState } from '../../../core/types/seams';
 import type { DeviceLinkingOwnerAuthorizationPortV1 } from './deviceLinkingPorts';
@@ -24,6 +24,7 @@ export type WalletHostManagementRequestV1 = {
     }>;
 };
 export type WalletHostOwnerAuthoritiesV1 = {
+    readonly readOwnerCredential: (walletId: WalletId) => Promise<WalletSessionOperationCredentialV1>;
     readonly ownerAuthorization: DeviceLinkingOwnerAuthorizationPortV1;
     readonly ownerRequest: LinkSessionOwnerAuthenticatedRequestPortV1;
     readonly managementRequest: WalletHostManagementRequestV1;

package/dist/types/wallet/src/SeamsWeb/publicApi/auth.d.ts

@@ -1,6 +1,6 @@
 import type { AuthCapability } from '../signingSurface/types';
 export type WalletAuthCommands = Omit<AuthCapability, 'onSessionChange'>;
-export type WalletSessionCommands = Pick<AuthCapability, 'unlock' | 'unlockWithAuthMethod' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
+export type WalletSessionCommands = Pick<AuthCapability, 'authenticate' | 'prepareExternalAuth' | 'associateExternalAuth' | 'removeExternalAuth' | 'unlock' | 'unlockWithAuthMethod' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
 export type EmailOtpAuthCommands = Pick<AuthCapability, 'requestEmailCode' | 'unlockWithEmailCode' | 'startGoogleSignIn'>;
 export declare function unlockWithEmailCode(args: Parameters<AuthCapability['unlockWithEmailCode']>[0]): ReturnType<AuthCapability['unlockWithEmailCode']>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/publicApi/types.d.ts

@@ -1,6 +1,7 @@
 import type { AuthMethodAvailability } from '../../core/authMethods/availabilityTypes';
 import type { VoiceIdConfirmationOptions } from '../../core/authMethods/plugins';
 import type { SdkLifecycleEventListener } from '../../core/types/sdkSentEvents';
+import type { ExternalAuthenticateInput, ExternalAuthAttempt, ExternalAuthResult, ExternalWalletAuthentication } from '../../../../shared-ts/src/auth/externalAuth';
 import type { HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuSessionId, HostedAuthMenuExternalAuthRequest, HostedAuthMenuExternalAuthResolutionInput } from '../walletIframe/shared/messages';
 import type { NearAccountRef, TempoChainTarget, ThresholdEcdsaChainTarget, WalletSessionRef } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
 import type { EcdsaChainSelector, EvmChainSelector, TempoChainSelector } from './chainTargets';
@@ -492,6 +493,16 @@ export type RequestEmailCodeInput = ExclusiveUnion<{
     onEvent?: GoogleEmailOtpWalletAuthStartInput['onEvent'];
 };
 export interface AuthCapability {
+    authenticate(input: ExternalAuthenticateInput): Promise<ExternalAuthResult<ExternalWalletAuthentication>>;
+    prepareExternalAuth(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt>>;
+    associateExternalAuth(input: {
+        walletId: string;
+        idToken: string;
+    }): Promise<ExternalAuthResult<null>>;
+    removeExternalAuth(input: {
+        walletId: string;
+        associationId: string;
+    }): Promise<ExternalAuthResult<null>>;
     unlockWithAuthMethod(args: {
         walletId: WalletId | string;
         walletAuthMethodId: string;

package/dist/types/wallet/src/SeamsWeb/walletIframe/client/router.d.ts

@@ -244,6 +244,10 @@ export declare class WalletIframeRouter {
     removeAuthMethod(payload: Parameters<RegistrationCapability['removeAuthMethod']>[0]): Promise<RevokeAuthMethodResult>;
     unlock(payload: LoginUnlockRequest): Promise<LoginAndCreateSessionResult>;
     unlockWithAuthMethod(payload: Parameters<AuthCapability['unlockWithAuthMethod']>[0]): ReturnType<AuthCapability['unlockWithAuthMethod']>;
+    authenticate(input: Parameters<AuthCapability['authenticate']>[0]): ReturnType<AuthCapability['authenticate']>;
+    prepareExternalAuth(walletId: string): ReturnType<AuthCapability['prepareExternalAuth']>;
+    removeExternalAuth(input: Parameters<AuthCapability['removeExternalAuth']>[0]): ReturnType<AuthCapability['removeExternalAuth']>;
+    associateExternalAuth(input: Parameters<AuthCapability['associateExternalAuth']>[0]): ReturnType<AuthCapability['associateExternalAuth']>;
     getWalletSession(walletId?: string): Promise<WalletSession>;
     private finishWalletSessionRead;
     private readWalletSession;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/WalletHostRuntime.d.ts

@@ -21,9 +21,11 @@ type SeamsWebContextWithDeviceLinkingResumeV1 = SeamsWebContext & {
 };
 /** Owns wallet-origin execution and durable signing state. */
 export declare class WalletHostRuntime {
+    readonly parentOrigin: string;
     private readonly signingEngine;
     private readonly nearClient;
     readonly configs: WalletHostConfig;
+    readonly readExternalSession: WalletHostSessionCommands['readExternalSession'];
     private appearance;
     theme: ThemeMode;
     private readonly prefillRestoredSession;
@@ -31,7 +33,7 @@ export declare class WalletHostRuntime {
     readonly devices: DevicesCapability;
     readonly keys: KeyExportDomainMethods;
     readonly preferences: Omit<PreferencesCapability, 'setConfirmationConfig' | 'setConfirmationBehavior' | 'onCurrentWalletChange'> & Pick<UserPreferencesManager, 'setConfirmationConfig' | 'setConfirmationBehavior' | 'onCurrentWalletChange'>;
-    readonly auth: WalletAuthCommands & Pick<WalletHostSessionCommands, 'unlockWithAuthMethod'>;
+    readonly auth: WalletAuthCommands & Pick<WalletHostSessionCommands, 'unlockWithAuthMethod' | 'authenticate'>;
     readonly placement: WalletPlacementCapability;
     readonly registration: RegistrationCapability;
     readonly near: NearSignerCapability;
@@ -39,7 +41,7 @@ export declare class WalletHostRuntime {
     readonly evm: EvmSignerCapability;
     private readonly deviceLinkingDispose;
     private readonly resumePendingAcknowledgementsV1;
-    constructor(configs: WalletHostConfig, nearClient?: NearClient);
+    constructor(configs: WalletHostConfig, parentOrigin: string, nearClient?: NearClient);
     /** @internal One wallet-host restore owns all configured-chain prefills. */
     prefillRestoredWalletSession(state: WalletIframeExactSessionState): Promise<void>;
     private lockAfterWalletMove;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/createSessionCommands.d.ts

@@ -2,6 +2,7 @@ import { type PendingRegistrationRecoverySigningSurface } from '../../operations
 import { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 import type { ThresholdEcdsaChainTarget, WalletSessionRef } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
+import type { WalletSession } from '../../../core/types/seams';
 import type { AuthMethodCaptureMount } from '../../../core/authMethods/hostPlugin';
 import type { WalletAuthenticationSurface, WalletIframeSurfaceMeasurementSurface } from '../../signingSurface/ports';
 import type { WalletAuthWebContext, WalletIframeWarmupSurface } from '../../signingSurface/types';
@@ -9,10 +10,12 @@ import type { WalletSessionCommands } from '../../publicApi/auth';
 type WalletHostAuthContext = WalletAuthWebContext & {
     signingEngine: Pick<WalletIframeWarmupSurface, 'warmCriticalResources'> & PendingRegistrationRecoverySigningSurface & WalletIframeSurfaceMeasurementSurface & Pick<WalletAuthenticationSurface, 'installAuthMethodSession'>;
 };
-export type WalletHostSessionCommands = Omit<WalletSessionCommands, 'unlockWithAuthMethod'> & {
+export type WalletHostSessionCommands = Omit<WalletSessionCommands, 'unlockWithAuthMethod' | 'authenticate'> & {
+    authenticate(input: Parameters<WalletSessionCommands['authenticate']>[0], assertActive?: () => void): ReturnType<WalletSessionCommands['authenticate']>;
+    readExternalSession(walletId?: string): Promise<WalletSession | null>;
     unlockWithAuthMethod(args: Parameters<WalletSessionCommands['unlockWithAuthMethod']>[0], assertActive?: () => void, mountCapture?: AuthMethodCaptureMount): ReturnType<WalletSessionCommands['unlockWithAuthMethod']>;
 };
-export declare function createWalletHostSessionCommands(getContext: () => WalletHostAuthContext): WalletHostSessionCommands;
+export declare function createWalletHostSessionCommands(getContext: () => WalletHostAuthContext, readOwnerCredential: import('../../operations/devices/walletHostOwnerAuthority').WalletHostOwnerAuthoritiesV1['readOwnerCredential'], parentOrigin: string): WalletHostSessionCommands;
 export declare function prefillWalletHostPresignatures(getContext: () => WalletHostAuthContext, args: {
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/externalAuth.d.ts

@@ -0,0 +1,29 @@
+import type { SeamsConfigsReadonly, WalletSession } from '../../../core/types/seams';
+import { type ExternalAuthenticateInput, type ExternalAuthAttempt, type ExternalAuthResult, type ExternalWalletAuthentication } from '../../../../../shared-ts/src/auth/externalAuth';
+import type { WalletHostOwnerAuthoritiesV1 } from '../../operations/devices/walletHostOwnerAuthority';
+export declare class HostedExternalAuth {
+    private readonly configs;
+    private readonly lockOwner;
+    private readonly readOwnerCredential;
+    private readonly parentOrigin;
+    private state;
+    private generation;
+    constructor(configs: SeamsConfigsReadonly, lockOwner: () => Promise<void>, readOwnerCredential: WalletHostOwnerAuthoritiesV1['readOwnerCredential'], parentOrigin: string);
+    private storageKey;
+    private restore;
+    private request;
+    lock(): Promise<void>;
+    releaseForOwner(): Promise<void>;
+    prepare(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt>>;
+    authenticate(input: ExternalAuthenticateInput, assertActive?: () => void): Promise<ExternalAuthResult<ExternalWalletAuthentication>>;
+    associate(input: {
+        walletId: string;
+        idToken: string;
+    }): Promise<ExternalAuthResult<null>>;
+    getSession(walletId?: string): Promise<WalletSession | null>;
+    remove(input: {
+        walletId: string;
+        associationId: string;
+    }): Promise<ExternalAuthResult<null>>;
+}
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/requestRouter.d.ts

@@ -4,7 +4,7 @@ type WalletHostRequest<T extends ParentToChildType> = ParentToChildEnvelope & {
 };
 type BootWalletRequestType = 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_CANCEL' | 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED';
 type NearWalletRequestType = 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413';
-type AuthWalletRequestType = 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS';
+type AuthWalletRequestType = 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_EXTERNAL_AUTH' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS';
 type EcdsaWalletRequestType = 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE';
 type EmailOtpWalletRequestType = 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE';
 type RecoveryWalletRequestType = 'PM_SYNC_ACCOUNT_FLOW';

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/sessionObserver.d.ts

@@ -15,6 +15,7 @@ export declare class WalletHostSessionObserver {
     private refresh;
     private invalidationRevision;
     private activeOperations;
+    private externalExpiryTimer;
     private readonly pendingObservations;
     private readonly unsubscribeAuthority;
     private readonly unsubscribeSelection;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ui/auth-menu/mountAuthMenuSurface.d.ts

@@ -7,6 +7,7 @@ export type AuthMenuSurfaceHandle = {
 type MountAuthMenuSurfaceInput = {
     readonly parent: HTMLElement;
     readonly viewModel: AuthMenuViewModel;
+    readonly initialHeightCssPx?: number;
     readonly onIntent: (intent: AuthMenuIntent) => void;
 };
 export declare function mountAuthMenuSurface(input: MountAuthMenuSurfaceInput): AuthMenuSurfaceHandle;

package/dist/types/wallet/src/SeamsWeb/walletIframe/shared/messages.d.ts

@@ -88,6 +88,7 @@ export type HostedAuthMenuOpenRequest = {
     kind: 'hosted_auth_menu_open_v1';
     authMenuSessionId: HostedAuthMenuSessionId;
     initialMode: HostedAuthMenuMode;
+    initialHeightCssPx?: number;
     loginTarget: HostedAuthMenuLoginTarget;
     registrationAccountInput: HostedAuthMenuRegistrationAccountInput;
     showRegistrationInput: boolean;
@@ -173,6 +174,7 @@ export declare function parseHostedAuthMenuOpenRequest(value: unknown): HostedAu
 export declare function buildHostedAuthMenuOpenRequest(args: {
     authMenuSessionId: HostedAuthMenuSessionId;
     initialMode?: HostedAuthMenuMode;
+    initialHeightCssPx?: number;
     loginTarget?: HostedAuthMenuLoginTarget;
     registrationAccountInput?: HostedAuthMenuRegistrationAccountInput;
     showRegistrationInput?: boolean;
@@ -190,10 +192,10 @@ export declare function buildHostedAuthMenuCancelPayload(args: {
     reason: HostedAuthMenuCancelReason;
 }): HostedAuthMenuCancelPayload;
 export declare function parseHostedAuthMenuOutcome(value: unknown): HostedAuthMenuOutcome | null;
-export declare const WALLET_PROTOCOL_VERSION: '17.0.0';
+export declare const WALLET_PROTOCOL_VERSION: '18.0.0';
 export declare const WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH: 'WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH';
 export type WalletProtocolVersion = typeof WALLET_PROTOCOL_VERSION;
-export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
+export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_EXTERNAL_AUTH' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
 interface RpcEnvelope<T extends string = string, P = unknown> {
     type: T;
     requestId?: string;
@@ -620,7 +622,7 @@ export type ParentToChildEnvelope = RpcEnvelope<'PM_ACTIVATE_TRANSACTION_REVIEW'
     signedTransaction: string;
 }> | RpcEnvelope<'PING'> | RpcEnvelope<'PM_PREPARE_WALLET_RUNTIME'> | RpcEnvelope<'PM_SET_CONFIG', PMSetConfigPayload> | RpcEnvelope<'PM_CANCEL', PMCancelPayload> | RpcEnvelope<'PM_OPEN_AUTH_MENU', PMOpenAuthMenuPayload> | RpcEnvelope<'PM_CANCEL_AUTH_MENU', PMCancelAuthMenuPayload> | RpcEnvelope<'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH', PMResolveAuthMenuExternalAuthPayload> | RpcEnvelope<'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION', PMRedeemHostedWalletSeamsSessionPayload> | RpcEnvelope<'PM_REGISTER_WALLET', PMRegisterWalletPayload> | RpcEnvelope<'PM_ADD_WALLET_SIGNER', PMAddWalletSignerPayload> | RpcEnvelope<'PM_ADD_PASSKEY', PMAddPasskeyPayload> | RpcEnvelope<'PM_ACTIVATE_AUTH_METHOD', PMActivateAuthMethodPayload> | RpcEnvelope<'PM_GET_AUTH_METHOD_AVAILABILITY', PMActivateAuthMethodPayload> | RpcEnvelope<'PM_SET_AUTH_METHOD_ENABLED', PMActivateAuthMethodPayload & {
     enabled: boolean;
-}> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_UNLOCK_AUTH_METHOD', {
+}> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_EXTERNAL_AUTH', import('../../../../../shared-ts/src/auth/externalAuth').ExternalAuthCommand> | RpcEnvelope<'PM_UNLOCK_AUTH_METHOD', {
     walletId: string;
     walletAuthMethodId: string;
     method: WalletAuthMethodPlugin['kind'];

package/dist/types/wallet/src/core/authMethods/hostPlugin.d.ts

@@ -52,6 +52,7 @@ export interface AuthMethodReviewApproval {
         confirm?: string;
     }>;
     readonly surface: HTMLElement;
+    prepare(signal: AbortSignal): Promise<void>;
     approve(signal: AbortSignal): Promise<AuthMethodApprovalResult>;
     consume(): void;
 }

package/dist/types/wallet/src/core/authMethods/plugins.d.ts

@@ -1,5 +1,7 @@
+export type VoiceIdTranscriptionModel = 'aurora' | 'citrinet';
 export type VoiceIdAuthMethodPlugin = Readonly<{
     kind: 'voiceid';
+    transcriptionModel?: VoiceIdTranscriptionModel;
 }>;
 export type VoiceIdConfirmationOptions = Readonly<{
     /** App wording used only to select an action-only challenge. Maximum 256 characters. */

package/dist/types/wallet/src/core/rpcClients/near/NearClient.d.ts

@@ -6,10 +6,23 @@ import type { NonceLeaseRef } from '../../signingEngine/nonce/NonceCoordinator';
 export { encodeSignedTransactionBase64 } from '../../../../../shared-ts/src/near/nearClient';
 export type { AccessKeyList } from '@near-js/types';
 export declare class SignedTransaction extends SharedSignedTransaction<WasmTransaction, WasmSignature, NonceLeaseRef> {
+    readonly transactionHash: string;
+    constructor(input: {
+        transaction: WasmTransaction;
+        signature: WasmSignature;
+        borsh_bytes: number[];
+        transactionHash: string;
+        nonceLease?: NonceLeaseRef;
+        serverDispatch?: {
+            transactionHash: string;
+            rpcResult: unknown;
+        };
+    });
     static fromPlain(input: {
         transaction: unknown;
         signature: unknown;
         borsh_bytes: number[];
+        transactionHash: string;
         nonceLease?: NonceLeaseRef;
         serverDispatch?: {
             transactionHash: string;

package/dist/types/wallet/src/core/signingEngine/nearTransactionSubmission.d.ts

@@ -0,0 +1,24 @@
+import type { ActionResult } from '../types/seams';
+import type { ActionHooksOptions } from '../types/sdkSentEvents';
+type NearTransactionFailure = Extract<ActionResult, {
+    success: false;
+}>;
+export declare class NearTransactionRequest {
+    private readonly transaction;
+    private state;
+    constructor(transaction: {
+        readonly kind: 'sign_and_send';
+    } | {
+        readonly kind: 'send';
+        readonly transactionId: string;
+    });
+    readonly dispatched: () => void;
+    failed(error: unknown): NearTransactionFailure;
+}
+export declare function parseNearTransactionResult(raw: unknown): ActionResult;
+export declare function nearTransactionFailure(error: unknown, fallback: 'not_submitted' | 'submission_unknown'): NearTransactionFailure;
+export declare function unresolvedNearTransaction(transactionId: string, error: unknown): NearTransactionFailure;
+/** Application hooks cannot replace a settled transaction outcome with their own error. */
+export declare function notifyNearTransactionResult(options: Pick<ActionHooksOptions, 'onError' | 'afterCall'> | undefined, result: ActionResult): Promise<void>;
+export {};
+//# sourceMappingURL=nearTransactionSubmission.d.ts.map

package/dist/types/wallet/src/core/signingEngine/uiConfirm/transactionReviewAdmission.d.ts

@@ -27,6 +27,8 @@ export declare class TransactionReviewAdmission {
     beforeCredential: () => void;
     afterCredential(): void;
     beforeSigning: () => void;
+    prepareAuthMethod(): Promise<void>;
+    get requiresAuthMethodApproval(): boolean;
     approveAuthMethod(): Promise<AuthMethodApprovalResult>;
     get authMethodApprovalSurface(): HTMLElement | null;
     get authMethodApprovalMessages(): Readonly<{

package/dist/types/wallet/src/core/types/linkDevice.d.ts

@@ -1,4 +1,3 @@
-import type { ActionResult } from './seams';
 import type { AfterCall, EventCallback, LinkDeviceFlowEvent } from './sdkSentEvents';
 import type { ConfirmationConfig } from './signer-worker';
 import type { LinkedDeviceTargetFactorV1, LinkedDeviceEmailOtpBaseFactorChoiceV1, LinkSessionStateV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking';
@@ -21,14 +20,14 @@ export type LinkDeviceResult = {
     readonly enrollmentId: LinkedDeviceEnrollmentId;
     readonly deviceId: LinkedDeviceId;
     readonly error?: never;
-} | (Extract<ActionResult, {
-    success: false;
-}> & {
+} | {
+    readonly success: false;
+    readonly error: string;
     readonly kind?: never;
     readonly walletId?: never;
     readonly enrollmentId?: never;
     readonly deviceId?: never;
-});
+};
 export declare class DeviceLinkingError extends Error {
     readonly code: DeviceLinkingErrorCode;
     readonly phase: 'generation' | 'authorization' | 'registration';

package/dist/types/wallet/src/core/types/seams.d.ts

@@ -346,12 +346,20 @@ export type WalletSessionCapabilityProjection = ReadonlyExclusiveUnion<{
         ...WalletSessionCapabilityReadiness[]
     ];
 }>;
-export interface WalletSession {
-    readonly appIdentity: WalletSessionAppIdentity;
-    readonly authentication: WalletAuthenticationState;
-    readonly capabilityProjection: WalletSessionCapabilityProjection;
-    readonly nonceDiagnostics: NonceCoordinatorDiagnostics | null;
-}
+export type WalletSession = ReadonlyExclusiveUnion<{
+    authentication: WalletAuthenticationState;
+    appIdentity: WalletSessionAppIdentity;
+    capabilityProjection: WalletSessionCapabilityProjection;
+    nonceDiagnostics: NonceCoordinatorDiagnostics | null;
+} | {
+    authentication: import('../../../../shared-ts/src/auth/externalAuth').ExternalWalletAuthentication;
+    appIdentity: Variant<WalletSessionAppIdentity, 'kind', 'resolved'>;
+    capabilityProjection: {
+        readonly kind: 'not_requested';
+    };
+    externalSettings: import('../../../../shared-ts/src/auth/externalAuth').ExternalWalletSettings;
+    nonceDiagnostics: null;
+}>;
 export type ThemeMode = 'light' | 'dark';
 type ThemeId = string;
 export type ThemePaletteName = 'default';
@@ -552,12 +560,24 @@ export type ThresholdWarmLoginAndCreateSessionResult = Extract<LoginAndCreateSes
 };
 export type ActionResult = ExclusiveUnion<{
     success: true;
-    transactionId?: string;
-    result?: FinalExecutionOutcome;
+    transactionId: string;
+    result: FinalExecutionOutcome;
+} | {
+    success: false;
+    /** This attempt did not submit a transaction. A new review is safe. */
+    kind: 'not_submitted';
+    error: string;
+} | {
+    success: false;
+    /** Signing or submission may have completed. Never automatically resend. */
+    kind: 'submission_unknown';
+    error: string;
 } | {
     success: false;
+    /** Reconcile this hash before starting another transaction. */
+    kind: 'unresolved';
+    transactionId: string;
     error: string;
-    errorDetails?: unknown;
 }>;
 export interface SignTransactionResult {
     signedTransaction: SignedTransaction;