@seams/wallet 0.27.0 → 0.29.0

package/dist/esm/SeamsWeb/walletIframe/shared/exactSessionState.js

@@ -4,8 +4,9 @@ import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../.
 import { thresholdEcdsaChainTargetFromRequest } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
 import { isWalletAuthMethod } from "../../../shared-ts/src/utils/signerDomain.js";
+import { toAccountId } from "../../../core/types/accountIds.js";
+import { parseExternalWalletAuthentication, parseExternalWalletSettings } from "../../../shared-ts/src/auth/externalAuth.js";
 import { NonceCoordinatorDegradationReason, NonceCoordinatorFallback, NonceLeaseState } from "../../../core/signingEngine/nonce/nonceTypes.js";
 import { parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
@@ -29,6 +30,9 @@ function parseWalletIframeExactSessionSnapshot(value) {
 	const state = parseWalletIframeExactSessionState(record.state);
 	if (state.kind !== "wallet_locked" && state.walletId !== walletId) throw new Error("Wallet session snapshot identity differs from its projection");
 	const session = parseWalletSessionFromBoundary(record.session, state.kind === "wallet_locked" ? void 0 : state.walletId);
+	if (state.kind === "external_read") {
+		if (session.authentication.kind !== "external_authenticated" || session.authentication.walletId !== state.walletId || session.authentication.sessionId !== state.externalSessionId || session.authentication.expiresAtMs !== state.expiresAtMs) throw new Error("External read snapshot differs from its authenticated session");
+	} else if (session.authentication.kind === "external_authenticated") throw new Error("External authentication requires an external read state");
 	if (state.kind === "wallet_locked" && (session.authentication.kind !== "signed_out" || session.appIdentity.kind !== "anonymous")) throw new Error("Locked wallet snapshot must publish an anonymous session");
 	return {
 		revision: parseWalletIframeSessionRevision(record.revision),
@@ -41,6 +45,17 @@ function parseWalletIframeExactSessionState(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Wallet iframe exact session state must be an object");
 	switch (Reflect.get(value, "kind")) {
 		case "wallet_locked": return { kind: "wallet_locked" };
+		case "external_read": {
+			const expiresAtMs = Reflect.get(value, "expiresAtMs");
+			if (!isPositiveSafeInteger(expiresAtMs)) throw new Error("External read expiry is invalid");
+			if ("walletSessionId" in value || "authorizationId" in value || "authMethod" in value) throw new Error("External read state cannot contain signing authority");
+			return {
+				kind: "external_read",
+				walletId: requireWalletId(Reflect.get(value, "walletId")),
+				externalSessionId: requireNonEmptyString(Reflect.get(value, "externalSessionId"), "externalSessionId"),
+				expiresAtMs
+			};
+		}
 		case "wallet_authenticated_identity_unresolvable": return {
 			kind: "wallet_authenticated_identity_unresolvable",
 			walletId: requireWalletId(Reflect.get(value, "walletId")),
@@ -89,12 +104,33 @@ function parseWalletIframeExactSessionState(value) {
 function parseWalletSessionFromBoundary(value, expectedWalletId) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Wallet Session must be an object");
 	if (Reflect.get(value, "reusableWalletSession") !== void 0) throw new Error("Wallet Session contains removed reusable-session fields");
-	const parsed = {
-		appIdentity: parseWalletSessionAppIdentity(Reflect.get(value, "appIdentity")),
-		authentication: parseWalletAuthenticationState(Reflect.get(value, "authentication")),
-		capabilityProjection: parseWalletSessionCapabilityProjection(Reflect.get(value, "capabilityProjection")),
+	const appIdentity = parseWalletSessionAppIdentity(Reflect.get(value, "appIdentity"));
+	const authentication = parseWalletAuthenticationState(Reflect.get(value, "authentication"));
+	const capabilityProjection = parseWalletSessionCapabilityProjection(Reflect.get(value, "capabilityProjection"));
+	const common = {
+		appIdentity,
 		nonceDiagnostics: parseNullableNonceDiagnostics(Reflect.get(value, "nonceDiagnostics"))
 	};
+	let parsed;
+	if (authentication.kind === "external_authenticated") {
+		if (appIdentity.kind !== "resolved") throw new Error("External authentication requires a resolved wallet");
+		if (common.nonceDiagnostics !== null) throw new Error("External authentication has no signing runtime");
+		if (capabilityProjection.kind !== "not_requested") throw new Error("External authentication cannot grant signing capabilities");
+		const externalSettings = parseExternalWalletSettings(Reflect.get(value, "externalSettings"));
+		if (externalSettings.authentication.sessionId !== authentication.sessionId || externalSettings.authentication.walletId !== authentication.walletId || externalSettings.authentication.associationId !== authentication.associationId || externalSettings.authentication.environmentId !== authentication.environmentId || externalSettings.authentication.expiresAtMs !== authentication.expiresAtMs) throw new Error("External settings identity mismatch");
+		parsed = {
+			appIdentity,
+			nonceDiagnostics: common.nonceDiagnostics,
+			authentication,
+			capabilityProjection,
+			externalSettings
+		};
+	} else parsed = {
+		appIdentity: common.appIdentity,
+		nonceDiagnostics: common.nonceDiagnostics,
+		authentication,
+		capabilityProjection
+	};
 	const expected = expectedWalletId === void 0 ? null : requireWalletId(expectedWalletId);
 	const canonicalWalletId = walletSessionCanonicalWalletId(parsed);
 	if (expected !== null && canonicalWalletId === null) throw new Error("Wallet iframe Wallet Session omitted the requested wallet identity");
@@ -106,6 +142,7 @@ function parseWalletAuthenticationState(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Wallet Session authentication must be an object");
 	switch (Reflect.get(value, "kind")) {
 		case "signed_out": return { kind: "signed_out" };
+		case "external_authenticated": return parseExternalWalletAuthentication(value);
 		case "authenticated": {
 			const authMethod = Reflect.get(value, "authMethod");
 			if (!isWalletAuthMethod(authMethod)) throw new Error("Wallet Session authentication method is invalid");

package/dist/esm/SeamsWeb/walletIframe/shared/messages.js

@@ -470,7 +470,7 @@ function parseHostedAuthMenuOutcome(value) {
 		default: return null;
 	}
 }
-const WALLET_PROTOCOL_VERSION = "17.0.0";
+const WALLET_PROTOCOL_VERSION = "19.0.0";
 const WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH = "WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH";
 const HOSTED_WALLET_REDEMPTION_PAYLOAD_FIELDS = [
 	"home",

package/dist/esm/SeamsWeb/walletIframe/shared/ownerNearOperation.js

@@ -0,0 +1,152 @@
+import { requireCanonicalString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
+import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseNearTransactionResult } from "../../../core/signingEngine/nearTransactionSubmission.js";
+import { SigningSessionIds } from "../../../core/signingEngine/session/operationState/types.js";
+import { toAccountId } from "../../../core/types/accountIds.js";
+import { ActionType } from "../../../shared-ts/src/near/actions.js";
+import { parseExternalWalletAuthentication } from "../../../shared-ts/src/auth/externalAuth.js";
+import { parseThresholdEd25519NearTransaction } from "../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
+//#region src/SeamsWeb/walletIframe/shared/ownerNearOperation.ts
+function parseOwnerNearRecovery(raw) {
+	const value = requireRecord(raw, "owner operation recovery");
+	const operationId = requireCanonicalString(value.operationId, "operationId");
+	if (!/^owner-near:[A-Za-z0-9_-]{32,64}$/.test(operationId)) throw new Error("Invalid owner operation ID.");
+	const walletId = parseWalletId(value.walletId);
+	if (!walletId.ok) throw new Error("Invalid owner operation wallet.");
+	return {
+		operationId: SigningSessionIds.signingOperation(operationId),
+		walletId: walletId.value,
+		nearAccountId: toAccountId(requireCanonicalString(value.nearAccountId, "nearAccountId"))
+	};
+}
+function parseOwnerNearCommand(raw) {
+	const value = requireRecord(raw, "owner operation command");
+	const authentication = parseExternalWalletAuthentication(value.authentication);
+	const recovery = parseOwnerNearRecovery(value.recovery);
+	if (recovery.walletId !== String(authentication.walletId)) throw new Error("Owner operation wallet mismatch.");
+	switch (value.action) {
+		case "recover": return {
+			action: "recover",
+			authentication,
+			recovery
+		};
+		case "approve": {
+			const rawTransaction = requireRecord(value.transaction, "transaction");
+			const transaction = parseThresholdEd25519NearTransaction({
+				nearAccountId: recovery.nearAccountId,
+				receiverId: rawTransaction.receiverId,
+				actions: rawTransaction.actions
+			}, "transaction");
+			if (transaction.nearAccountId !== String(recovery.nearAccountId)) throw new Error("Owner operation account mismatch.");
+			const expiresAtMs = value.expiresAtMs;
+			if (typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) throw new Error("Invalid owner operation expiry.");
+			return {
+				action: "approve",
+				authentication,
+				recovery,
+				expiresAtMs,
+				transaction: {
+					receiverId: transaction.receiverId,
+					actions: transaction.actions.map(ownerNearAction)
+				}
+			};
+		}
+		default: throw new Error("Invalid owner operation action.");
+	}
+}
+function parseOwnerNearOutcome(raw) {
+	const value = requireRecord(raw, "owner operation outcome");
+	switch (value.kind) {
+		case "completed": {
+			const result = parseNearTransactionResult(value.result);
+			if (!result.success) throw new Error("A completed owner operation requires a successful transaction.");
+			return {
+				kind: "completed",
+				result
+			};
+		}
+		case "reverted": return {
+			kind: "reverted",
+			transactionId: requireCanonicalString(value.transactionId, "transactionId"),
+			error: requireCanonicalString(value.error, "error")
+		};
+		case "cancelled": return { kind: "cancelled" };
+		case "expired": return { kind: "expired" };
+		case "failed": return {
+			kind: "failed",
+			error: requireCanonicalString(value.error, "error")
+		};
+		case "unknown": return {
+			kind: "unknown",
+			recovery: parseOwnerNearRecovery(value.recovery)
+		};
+		default: throw new Error("Invalid owner operation outcome.");
+	}
+}
+function ownerNearAction(action) {
+	switch (action.action_type) {
+		case "CreateAccount": return { action_type: ActionType.CreateAccount };
+		case "DeployContract": return {
+			action_type: ActionType.DeployContract,
+			code: [...action.code]
+		};
+		case "FunctionCall": return {
+			action_type: ActionType.FunctionCall,
+			method_name: action.method_name,
+			args: action.args,
+			gas: action.gas,
+			deposit: action.deposit
+		};
+		case "Transfer": return {
+			action_type: ActionType.Transfer,
+			deposit: action.deposit
+		};
+		case "Stake": return {
+			action_type: ActionType.Stake,
+			stake: action.stake,
+			public_key: action.public_key
+		};
+		case "AddKey": return {
+			action_type: ActionType.AddKey,
+			public_key: action.public_key,
+			access_key: action.access_key
+		};
+		case "DeleteKey": return {
+			action_type: ActionType.DeleteKey,
+			public_key: action.public_key
+		};
+		case "DeleteAccount": return {
+			action_type: ActionType.DeleteAccount,
+			beneficiary_id: action.beneficiary_id
+		};
+		case "DeployGlobalContract": return {
+			action_type: ActionType.DeployGlobalContract,
+			code: [...action.code],
+			deploy_mode: action.deploy_mode
+		};
+		case "UseGlobalContract":
+			if (action.account_id !== void 0) return {
+				action_type: ActionType.UseGlobalContract,
+				account_id: action.account_id
+			};
+			return {
+				action_type: ActionType.UseGlobalContract,
+				code_hash: action.code_hash
+			};
+		case "SignedDelegate": throw new Error("Use the delegate API for delegated actions.");
+		default: throw new Error("Unsupported owner transaction action.");
+	}
+}
+function parseOwnerNearSubmissionProgress(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw) || Reflect.get(raw, "event") !== "owner_near_submitting") return null;
+	const operationId = Reflect.get(raw, "operationId");
+	if (typeof operationId !== "string" || !/^owner-near:[A-Za-z0-9_-]{32,64}$/.test(operationId)) return null;
+	return {
+		event: "owner_near_submitting",
+		operationId: SigningSessionIds.signingOperation(operationId)
+	};
+}
+//#endregion
+export { parseOwnerNearCommand, parseOwnerNearOutcome, parseOwnerNearRecovery, parseOwnerNearSubmissionProgress };
+
+//# sourceMappingURL=ownerNearOperation.js.map

package/dist/esm/core/accountData/near/accountProjection.js

@@ -1,6 +1,6 @@
 import { normalizeTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import { toAccountId } from "../../types/accountIds.js";
 import { SIGNER_AUTH_METHODS, SIGNER_KINDS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { toAccountId } from "../../types/accountIds.js";
 import { normalizeIndexedDbAccountAddress } from "../../indexedDB/normalization.js";
 import { getLastSelectedProfileAccountByChain, resolveProfileAccountProjection } from "../../indexedDB/profileAccountProjection.js";
 import { getNearChainCandidates } from "./accountRefs.js";

package/dist/esm/core/authMethods/plugins.js

@@ -5,12 +5,18 @@ function parseWalletAuthMethodPlugins(value) {
 	const plugins = [];
 	const seen = /* @__PURE__ */ new Set();
 	for (const candidate of value) {
-		if (!isPlainObject(candidate) || Object.keys(candidate).length !== 1 || candidate.kind !== "voiceid" || seen.has(candidate.kind)) throw new Error("Unsupported or duplicate wallet auth method plugin.");
+		if (!isPlainObject(candidate) || Object.keys(candidate).some(unknownVoiceIdOption) || candidate.kind !== "voiceid" || candidate.transcriptionModel !== void 0 && candidate.transcriptionModel !== "aurora" && candidate.transcriptionModel !== "citrinet" || seen.has(candidate.kind)) throw new Error("Unsupported or duplicate wallet auth method plugin.");
 		seen.add(candidate.kind);
-		plugins.push({ kind: "voiceid" });
+		plugins.push({
+			kind: "voiceid",
+			transcriptionModel: candidate.transcriptionModel ?? "citrinet"
+		});
 	}
 	return plugins;
 }
+function unknownVoiceIdOption(key) {
+	return key !== "kind" && key !== "transcriptionModel";
+}
 //#endregion
 export { parseWalletAuthMethodPlugins };
 

package/dist/esm/core/indexedDB/seamsWalletDB/repositories.js

@@ -11,8 +11,8 @@ import { parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/wall
 import { encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isEcdsaExtensionOfEd25519WalletAuthority, parseWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import "../../../shared-ts/src/device-linking/index.js";
-import { toAccountId } from "../../types/accountIds.js";
 import { SIGNER_KINDS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { toAccountId } from "../../types/accountIds.js";
 import { parseNearProvisioningState } from "../../types/sdkSentEvents.js";
 import { parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
@@ -3719,7 +3719,7 @@ var SeamsWalletRepositories = class {
 			registration: input.registration
 		});
 		const walletSession = input.walletSessionPublication.walletSession;
-		if (walletSession.walletId !== pending.walletId || walletSession.authorityId !== foundingAuthority.authority.authorityId || walletSession.authMethodId !== pending.walletAuthMethodId || walletSession.authorityDigestB64u !== foundingAuthority.authority.authorityDigestB64u || walletSession.authorityRevocationEpoch !== foundingAuthority.authority.revocationEpoch) throw new Error("registration Wallet Session identity does not match the pending wallet");
+		if (walletSession !== void 0 && (walletSession.walletId !== pending.walletId || walletSession.authorityId !== foundingAuthority.authority.authorityId || walletSession.authMethodId !== pending.walletAuthMethodId || walletSession.authorityDigestB64u !== foundingAuthority.authority.authorityDigestB64u || walletSession.authorityRevocationEpoch !== foundingAuthority.authority.revocationEpoch)) throw new Error("registration Wallet Session identity does not match the pending wallet");
 		return this.manager.runTransaction(WALLET_REGISTRATION_PUBLICATION_STORES, "readwrite", this.publishPendingWalletRegistrationCommitInTransaction.bind(this, {
 			request: input.request,
 			pending,
@@ -3771,7 +3771,8 @@ var SeamsWalletRepositories = class {
 				active: input.walletSessionPublication.walletSession,
 				operationCredential: input.walletSessionPublication.operationCredential
 			});
-		} else {
+		} else if (input.walletSessionPublication.kind === "owner_operations") sessionPublication = "locked_identity";
+		else {
 			const existingSession = await readExactActiveWalletSessionForScopeInTransaction({
 				ctx,
 				walletId: input.pending.walletId,

package/dist/esm/core/rpcClients/relayer/walletRegistration.js

@@ -80,7 +80,7 @@ async function postJson(args) {
 	const response = await fetch(`${normalizeRelayerBaseUrl(args.relayerUrl, { trim: false })}${args.path}`, buildRelayerJsonPostRequestInit({
 		headers: {
 			...args.headers,
-			[WALLET_MANAGEMENT_PROTOCOL_HEADER]: "4"
+			[WALLET_MANAGEMENT_PROTOCOL_HEADER]: "5"
 		},
 		body: args.body,
 		bodyJson: requestBody

package/dist/esm/core/signingEngine/flows/registration/accountLifecycle.js

@@ -1,9 +1,9 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { SIGNER_AUTH_METHODS, SIGNER_KINDS, SIGNER_SOURCES } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { compactImplicitNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../types/accountIds.js";
-import { SIGNER_AUTH_METHODS, SIGNER_KINDS, SIGNER_SOURCES } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { NEAR_ED25519_YAO_KEY_VERSION_V1 } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";

package/dist/esm/core/signingEngine/flows/shared/signingConfirmation.js

@@ -1,8 +1,8 @@
 import { isUserCancellationError } from "../../../../shared-ts/src/utils/errors.js";
 import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningKeyRefIntentKind, SigningSessionPlanKind } from "../../session/operationState/types.js";
+import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { SigningOperationCancellationPhase, SigningOperationCommandKind, applySigningOperationInteractionEvent, cancelSigningOperation, planSigningOperationAttempt, runSigningOperationCommand } from "./signingStateMachine.js";
 import { confirmSigningOperation } from "../../stepUpConfirmation/confirmOperation.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -1,8 +1,8 @@
 import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { signingLaneAuthBindingKey } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent } from "../../session/operationState/types.js";
+import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane, requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
 import { reviewAdmissionForBinding } from "../../uiConfirm/transactionReviewAdmission.js";
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -1,8 +1,8 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
+import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
 import { bytesToHex } from "../../chains/evm/bytes.js";
 import { isActiveWalletAuthoritySigningAuthPlan, isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -5,15 +5,15 @@ import { WorkerResponseType } from "../../../../types/signer-worker.js";
 import { resolveNearNetwork } from "../../../../config/chains.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../../config/defaultConfigs.js";
 import { activeWalletSessionV1RecordsEqual } from "../../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
-import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";
+import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionOperationFingerprint } from "../../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { WalletSessionStatusReadScope } from "../../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { emitEd25519SigningTiming } from "../../../session/operationState/trace.js";
 import { buildCapabilityOperationEnvelope, parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbNormalSigningV2, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint } from "../../../../rpcClients/relayer/routerAbNormalSigning.js";
-import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionOperationFingerprint } from "../../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, decodeThresholdEd25519SignedNearTxBorshWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm } from "../../../chains/near/nearSignerWasm.js";
 import { requireRouterAbNormalSigningPrepareMatchesRequest, requireRouterAbNormalSigningResponseMatchesRequest } from "../../../../rpcClients/relayer/routerAbNormalSigningValidation.js";
 import { requireRouterAbEd25519NormalSigningReadyState } from "../../../session/warmCapabilities/routerAbWalletSessionCredential.js";

package/dist/esm/core/signingEngine/flows/signNear/signDelegate.js

@@ -2,17 +2,17 @@ import { WorkerResponseType } from "../../../types/signer-worker.js";
 import { resolveNearNetwork, resolvePrimaryNearRpcUrl } from "../../../config/chains.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../config/defaultConfigs.js";
+import { SigningOperationIntent, SigningSessionIds } from "../../session/operationState/types.js";
 import { ensureEd25519Prefix } from "../../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../types/accountIds.js";
+import { parseThresholdEd25519NearAction, thresholdEd25519DelegateActionOperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
-import { SigningOperationIntent, SigningSessionIds } from "../../session/operationState/types.js";
 import { computeUiIntentDigestFromTxs, orderActionForDigest } from "../../../../utils/intentDigest.js";
 import { isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";
 import { emitEd25519SigningTiming } from "../../session/operationState/trace.js";
 import { SigningOperationCommandKind, runSigningOperationCommand } from "../shared/signingStateMachine.js";
 import { resolveNearSigningMaterials } from "./shared/signingMaterials.js";
 import { buildNearDelegateSigningPayloads } from "../../chains/near/payloads.js";
-import { parseThresholdEd25519NearAction, thresholdEd25519DelegateActionOperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { computeThresholdEd25519DelegateSigningDigestWasm } from "../../chains/near/nearSignerWasm.js";
 import { finalizeThresholdEd25519DelegateSignatureResult } from "./shared/ed25519YaoNormalSigning.js";
 import { toPublicKeyString } from "../../workerManager/validation.js";

package/dist/esm/core/signingEngine/flows/signNear/signNear.js

@@ -1,11 +1,10 @@
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toAccountId } from "../../../types/accountIds.js";
 import { SENSITIVE_OPERATION_POLICIES, SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { signingLaneAuthBindingKey, signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent, SigningSessionIds, SigningSessionPlanKind } from "../../session/operationState/types.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
 import { exactEd25519SigningLaneIdentityFromSelectedLane, exactSigningLaneIdentityKey, nearEd25519SignerBindingFromBoundaryFields } from "../../session/identity/exactSigningLaneIdentity.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
@@ -80,10 +79,6 @@ function prepareReviewBoundNearMaterial(prepare, admission, input) {
 	admission?.assertAuthMethodPolicy(method);
 	return prepare(input);
 }
-function createNearTransactionSigningOperationId() {
-	const randomId = secureRandomBase64Url(32, "NEAR transaction signing operation IDs");
-	return SigningSessionIds.signingOperation(`near-transaction-sign:${randomId}`);
-}
 function summarizeNearEd25519Lane(lane) {
 	if (lane.state === "missing") return {
 		state: lane.state,
@@ -759,7 +754,7 @@ async function signTransaction(deps, args) {
 		confirmationConfigOverride: args.confirmationConfigOverride
 	});
 	try {
-		const operationId = createNearTransactionSigningOperationId();
+		const operationId = SigningSessionIds.signingOperation(deps.createSigningSessionId("near-transaction-sign"));
 		emitEd25519SigningTiming(String(operationId), "preparation_modal", modalStartedAt);
 		return await signTransactionWithActionsAttempt(deps, args, { signingOperationState: createSigningOperationStateRef({ operationId }) });
 	} finally {

package/dist/esm/core/signingEngine/flows/signNear/signNep413.js

@@ -4,11 +4,11 @@ import { resolveNearNetwork } from "../../../config/chains.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../config/defaultConfigs.js";
 import { SigningOperationIntent, SigningSessionIds } from "../../session/operationState/types.js";
+import { thresholdEd25519Nep413OperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { computeUiIntentDigestFromNep413 } from "../../../../utils/intentDigest.js";
 import { emitEd25519SigningTiming } from "../../session/operationState/trace.js";
 import { SigningOperationCommandKind, runSigningOperationCommand } from "../shared/signingStateMachine.js";
 import { resolveNearSigningMaterials } from "./shared/signingMaterials.js";
-import { thresholdEd25519Nep413OperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { computeThresholdEd25519Nep413SigningDigestWasm } from "../../chains/near/nearSignerWasm.js";
 import { authorizeNearSignatureOnlyOperation, confirmNearSignatureOnlyOperation, prepareNearSignatureOnlyStepUp, resolveNearSignatureOnlySigningMaterial, resolveNearSignatureOnlySigningPlans, runNearSignatureOnlySignCommand, signNearSignatureOnlyOperation, startNearSignatureOnlyPrepare } from "./shared/signatureOnlySigning.js";
 //#region src/core/signingEngine/flows/signNear/signNep413.ts

package/dist/esm/core/signingEngine/flows/signNear/signTransactions.js

@@ -2,9 +2,10 @@ import { resolveNearNetwork, resolvePrimaryNearRpcUrl } from "../../../config/ch
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../config/defaultConfigs.js";
 import { SignedTransaction } from "../../../rpcClients/near/NearClient.js";
+import { SigningOperationIntent, SigningSessionIds, SigningSessionPlanKind } from "../../session/operationState/types.js";
 import { toAccountId } from "../../../types/accountIds.js";
+import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionPlanningOperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
-import { SigningOperationIntent, SigningSessionIds, SigningSessionPlanKind } from "../../session/operationState/types.js";
 import { nearEd25519SignerBindingFromBoundaryFields } from "../../session/identity/exactSigningLaneIdentity.js";
 import { computeUiIntentDigestFromTxs, orderActionForDigest } from "../../../../utils/intentDigest.js";
 import { isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";
@@ -15,7 +16,6 @@ import { buildSigningConfirmationAuthParams } from "../../stepUpConfirmation/con
 import { confirmationConfigForSigningAuthPlan, resolveSigningConfirmationAuthMethod, runTransactionSigningConfirmationCommand } from "../shared/signingConfirmation.js";
 import { resolveNearSigningMaterials } from "./shared/signingMaterials.js";
 import { buildNearTransactionSigningPayload } from "../../chains/near/payloads.js";
-import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionPlanningOperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { requireNearStepUpAuth, signingAuthPlanForNearMaterialRequirement } from "./requireNearStepUpAuth.js";
 import { emitNearSigningConfirmationProgress } from "./shared/confirmationProgress.js";
 import { buildNearEd25519StepUpAuthorization } from "./stepUpAuthorization.js";
@@ -415,12 +415,11 @@ async function runNearAuthorizationRequiredTransactionSigning(payload) {
 		});
 		await markNearNonceLeasesSigned(ctx, confirmation.readiness.nonceLeases);
 		return signed;
-	} catch (error) {
+	} finally {
 		disposeOwnedNearOperationStepUpMaterial({
 			resolved: resolvedOperationStepUpMaterial,
 			owned: operationStepUpMaterial.kind === "passkey_sealed" || operationStepUpMaterial.kind === "email_otp_sealed"
 		});
-		throw error;
 	}
 }
 async function runAuthorizedNearTransactionWithActionsSigning({ ctx, commandSubject, nearAccount, transaction, rpcCall, onEvent, confirmationConfigOverride, title, body, signerSlot, signingOperationState, signingSessionCoordinator: sessionCoordinator, transactionOperation, ed25519SigningBoundary, passkeyEd25519OperationStepUp, emailOtpEd25519StepUp, yaoSigningPreparation, yaoMaterialExecutor }) {

package/dist/esm/core/signingEngine/session/identity/exactSigningLaneIdentity.js

@@ -2,8 +2,8 @@ import { parseMpcMaterialActivationRef, parseWalletAuthMethodId } from "../../..
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { isImplicitNearAccountId, parseNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { SigningSessionIds } from "../operationState/types.js";
+import { isImplicitNearAccountId, parseNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { buildImplicitNearAccountBinding, buildNamedNearAccountBinding, buildNearEd25519SignerBinding, buildWalletIdentity, nearEd25519SignerBindingFromRaw } from "../../../../shared-ts/src/utils/walletCapabilityBindings.js";
 import { buildBaseEvmFamilyEcdsaKeyIdentity, toEvmFamilyEcdsaKeyHandle, toRpId } from "./evmFamilyEcdsaIdentity.js";
 //#region src/core/signingEngine/session/identity/exactSigningLaneIdentity.ts

package/dist/esm/core/ui/messages.js

@@ -305,6 +305,11 @@ const walletMessages = [
 	["Dark mode", "ダークモード"],
 	["Unable to lock your wallet. Try again.", "ウォレットをロックできません。もう一度お試しください。"],
 	["Unlocked on this device", "このデバイスでロック解除済み"],
+	["Connected with Google", "Google で接続中"],
+	["Wallet access", "ウォレットへのアクセス"],
+	["Connected to your wallet", "ウォレットに接続しています"],
+	["Method {value0}", "認証方法 {value0}"],
+	["Confirm with a wallet authentication method to make security changes.", "セキュリティ設定を変更するには、ウォレットの認証方法で本人確認してください。"],
 	["All settings", "すべての設定"],
 	["Locking…", "ロック中…"],
 	["Lock wallet", "ウォレットをロック"],

package/dist/esm/index.js

@@ -4,6 +4,8 @@ import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv } from "./core/con
 import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromChainFamily, thresholdEcdsaChainTargetFromConfig, thresholdEcdsaChainTargetFromConfiguredRequest, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId, walletIdFromWalletProfile, walletSessionRefFromSession } from "./core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { BrowserCapabilityUnavailableError } from "./SeamsWeb/publicApi/capabilitySelection.js";
 import { toAccountId } from "./core/types/accountIds.js";
+import { ActionType } from "./shared-ts/src/near/actions.js";
+import { parseOwnerNearRecovery } from "./SeamsWeb/walletIframe/shared/ownerNearOperation.js";
 import { AccountSyncEventPhase, KeyExportEventPhase, LinkDeviceEventPhase, RegistrationEventPhase, SigningEventPhase, UnlockEventPhase, WALLET_FLOW_EVENT_MESSAGES, WALLET_FLOW_EVENT_STEPS, WALLET_FLOW_EVENT_VERSION, createAccountSyncFlowEvent, createKeyExportFlowEvent, createLinkDeviceFlowEvent, createRegistrationFlowEvent, createSigningFlowEvent, createUnlockFlowEvent, createWalletFlowEvent, isWalletFlowEvent } from "./core/types/sdkSentEvents.js";
 import { buildHostedAuthMenuOpenRequest, hostedAuthMenuExternalAuthRequestIdFromBoundary, hostedAuthMenuSessionIdFromBoundary } from "./SeamsWeb/walletIframe/shared/messages.js";
 import { SeamsWeb } from "./SeamsWeb/SeamsWeb.js";
@@ -11,8 +13,7 @@ import { ExternalEvmController } from "./externalEvm/controller.js";
 import { DEVICE_LINKING_CONFIG, SIGNER_WORKER_MANAGER_CONFIG } from "./config.js";
 import { defineSeamsConfig, seamsTestnetConfig } from "./core/config/defineConfig.js";
 import { DEFAULT_WAIT_STATUS } from "./core/types/rpc.js";
-import { ActionType } from "./shared-ts/src/near/actions.js";
 import { AmountError, parseEther, parseNear, parseUnits, yoctoNear } from "./core/types/amounts.js";
 import { addKey, createAccount, deleteAccount, deleteKey, deployContract, functionCall, stake, transfer } from "./core/types/actionBuilders.js";
 import { logWalletEvents } from "./core/types/eventLogging.js";
-export { AccountSyncEventPhase, ActionType, AmountError, BrowserCapabilityUnavailableError, DEFAULT_WAIT_STATUS, DEVICE_LINKING_CONFIG, ExternalEvmController, KeyExportEventPhase, LinkDeviceEventPhase, PASSKEY_MANAGER_DEFAULT_CONFIGS, RegistrationEventPhase, SIGNER_WORKER_MANAGER_CONFIG, SeamsWeb, SigningEventPhase, UnlockEventPhase, WALLET_FLOW_EVENT_MESSAGES, WALLET_FLOW_EVENT_STEPS, WALLET_FLOW_EVENT_VERSION, addKey, buildConfigsFromEnv, buildHostedAuthMenuOpenRequest, configuredThresholdEcdsaChainTargets, createAccount, createAccountSyncFlowEvent, createKeyExportFlowEvent, createLinkDeviceFlowEvent, createRegistrationFlowEvent, createSigningFlowEvent, createUnlockFlowEvent, createWalletFlowEvent, defineSeamsConfig, deleteAccount, deleteKey, deployContract, functionCall, hostedAuthMenuExternalAuthRequestIdFromBoundary, hostedAuthMenuSessionIdFromBoundary, isWalletFlowEvent, logWalletEvents, nearAccountRefFromAccountId, normalizeWalletLocale, parseEther, parseNear, parseUnits, parseWalletMoveId, seamsTestnetConfig, stake, thresholdEcdsaChainTargetFromChainFamily, thresholdEcdsaChainTargetFromConfig, thresholdEcdsaChainTargetFromConfiguredRequest, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toAccountId, toWalletId, transfer, walletIdFromWalletProfile, walletSessionRefFromSession, yoctoNear };
+export { AccountSyncEventPhase, ActionType, AmountError, BrowserCapabilityUnavailableError, DEFAULT_WAIT_STATUS, DEVICE_LINKING_CONFIG, ExternalEvmController, KeyExportEventPhase, LinkDeviceEventPhase, PASSKEY_MANAGER_DEFAULT_CONFIGS, RegistrationEventPhase, SIGNER_WORKER_MANAGER_CONFIG, SeamsWeb, SigningEventPhase, UnlockEventPhase, WALLET_FLOW_EVENT_MESSAGES, WALLET_FLOW_EVENT_STEPS, WALLET_FLOW_EVENT_VERSION, addKey, buildConfigsFromEnv, buildHostedAuthMenuOpenRequest, configuredThresholdEcdsaChainTargets, createAccount, createAccountSyncFlowEvent, createKeyExportFlowEvent, createLinkDeviceFlowEvent, createRegistrationFlowEvent, createSigningFlowEvent, createUnlockFlowEvent, createWalletFlowEvent, defineSeamsConfig, deleteAccount, deleteKey, deployContract, functionCall, hostedAuthMenuExternalAuthRequestIdFromBoundary, hostedAuthMenuSessionIdFromBoundary, isWalletFlowEvent, logWalletEvents, nearAccountRefFromAccountId, normalizeWalletLocale, parseEther, parseNear, parseOwnerNearRecovery, parseUnits, parseWalletMoveId, seamsTestnetConfig, stake, thresholdEcdsaChainTargetFromChainFamily, thresholdEcdsaChainTargetFromConfig, thresholdEcdsaChainTargetFromConfiguredRequest, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toAccountId, toWalletId, transfer, walletIdFromWalletProfile, walletSessionRefFromSession, yoctoNear };

package/dist/esm/react/boundWallet.js

@@ -2,6 +2,16 @@ import { nearAccountRefFromAccountId, walletSessionRefFromSession } from "../cor
 import { createReviewedBoundCalls } from "./transactionReview/boundCalls.js";
 //#region src/react/boundWallet.ts
 function createBoundWallet(seams, loginState, host, owner) {
+	if (loginState.access === "external") return {
+		access: "external",
+		walletId: loginState.walletId,
+		authentication: loginState.externalSettings.authentication,
+		near: loginState.nearAccountId ? {
+			accountId: loginState.nearAccountId,
+			prepareOwnerTransaction: prepareReadableOwnerTransaction.bind(null, seams, loginState.externalSettings.authentication, loginState.nearAccountId),
+			resumeOwnerTransaction: resumeReadableOwnerTransaction.bind(null, seams, loginState.externalSettings.authentication)
+		} : null
+	};
 	const { walletId, nearAccountId } = loginState;
 	const walletSession = walletSessionRefFromSession({ walletId });
 	const nearAccount = nearAccountId ? nearAccountRefFromAccountId(nearAccountId) : null;
@@ -14,6 +24,7 @@ function createBoundWallet(seams, loginState, host, owner) {
 		owner
 	});
 	return {
+		access: "wallet",
 		walletId,
 		walletSession,
 		near: nearAccount && nearAccountId ? {
@@ -50,6 +61,19 @@ function exportKey(seams, walletSession, nearAccount, input) {
 		walletSession
 	});
 }
+function prepareReadableOwnerTransaction(seams, authentication, nearAccountId, input) {
+	return seams.near.prepareOwnerTransaction({
+		authentication,
+		nearAccountId,
+		transaction: input.transaction
+	});
+}
+function resumeReadableOwnerTransaction(seams, authentication, input) {
+	return seams.near.resumeOwnerTransaction({
+		authentication,
+		recovery: input.recovery
+	});
+}
 //#endregion
 export { createBoundWallet };