@seams/wallet 0.27.0 → 0.29.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.27.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.29.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.27.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.29.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.27.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.29.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.27.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.29.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/auth/externalAuth.d.ts

@@ -0,0 +1,127 @@
+import { type WalletId } from '../utils/domainIds';
+import { type Ed25519PublicKeyB64u } from '../passkey-custody/primitives';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+export declare const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+export type ExternalAuthProvider = ReadonlyExclusiveUnion<{
+    kind: 'disabled';
+} | {
+    kind: 'google';
+    clientId: string;
+} | {
+    kind: 'application';
+    issuer: string;
+    publicKeyB64u: Ed25519PublicKeyB64u;
+}>;
+export type ExternalAuthConfiguration = ExternalAuthProvider & Readonly<{
+    revision: number;
+}>;
+export type ExternalIdentity = ReadonlyExclusiveUnion<{
+    provider: 'google';
+    issuer: 'https://accounts.google.com';
+    subject: string;
+} | {
+    provider: 'application';
+    issuer: string;
+    subject: string;
+}>;
+export type ExternalIdentityProof = ReadonlyExclusiveUnion<{
+    kind: 'google';
+    idToken: string;
+} | {
+    kind: 'application';
+    assertion: string;
+}>;
+export declare function parseExternalAuthProvider(raw: unknown): ExternalAuthProvider;
+export declare function parseExternalAuthConfiguration(raw: unknown): ExternalAuthConfiguration;
+export declare function serializeExternalIdentity(identity: ExternalIdentity): string;
+export declare function parseStoredExternalIdentity(serialized: string): ExternalIdentity;
+export type ExternalOwnerChallenge = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    identity: ExternalIdentity;
+    challengeB64u: DigestB64u;
+    expiresAtMs: number;
+}> & ReadonlyExclusiveUnion<{
+    kind: 'associate';
+} | {
+    kind: 'unlink';
+    associationId: string;
+}>;
+export declare function parseExternalOwnerChallenge(raw: unknown): ExternalOwnerChallenge;
+type ExternalAuthFailureCode = 'invalid_request' | 'invalid_credential' | 'access_denied' | 'expired' | 'superseded' | 'unavailable' | 'rate_limited' | 'cancelled';
+export type ExternalAuthResult<T> = ReadonlyExclusiveUnion<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: ExternalAuthFailureCode;
+    message: string;
+}>;
+export type ExternalAuthenticateInput = ReadonlyExclusiveUnion<{
+    method: 'google';
+    walletId: string;
+    idToken: string;
+} | {
+    method: 'handoff';
+    walletId: string;
+    attemptId: string;
+    code: string;
+}>;
+export type ExternalAuthPurpose = 'authenticate' | 'associate';
+export type ExternalAuthAttempt<Purpose extends ExternalAuthPurpose = 'authenticate'> = Readonly<{
+    purpose: Purpose;
+    attemptId: string;
+    walletId: WalletId;
+    expiresAtMs: number;
+}>;
+export type ExternalAuthCommand = ReadonlyExclusiveUnion<{
+    action: 'authenticate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'prepare';
+    walletId: string;
+} | {
+    action: 'prepare_association';
+    walletId: string;
+} | {
+    action: 'associate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'unlink';
+    walletId: string;
+    associationId: string;
+}>;
+export declare function parseExternalAuthCommand(raw: unknown): ExternalAuthCommand;
+export type ExternalWalletAuthentication = Readonly<{
+    kind: 'external_authenticated';
+    walletId: WalletId;
+    sessionId: string;
+    associationId: string;
+    environmentId: string;
+    provider: ExternalIdentity['provider'];
+    permission: 'wallet_settings_read';
+    expiresAtMs: number;
+    authMethod?: never;
+}>;
+export type ExternalWalletSettings = Readonly<{
+    authentication: ExternalWalletAuthentication;
+    accounts: readonly Readonly<{
+        family: 'ed25519' | 'ecdsa';
+        address: string;
+        publicKey: string;
+    }>[];
+    methods: readonly Readonly<{
+        id: string;
+        kind: 'passkey' | 'email_otp' | 'voiceid';
+    }>[];
+    devices: readonly Readonly<{
+        id: string;
+    }>[];
+}>;
+export declare function parseExternalWalletAuthentication(value: unknown): ExternalWalletAuthentication;
+export declare function externalAuthFailure(code: ExternalAuthFailureCode): ExternalAuthResult<never>;
+export declare function parseExternalAuthFailure(value: unknown): ExternalAuthResult<never>;
+export declare function parseExternalWalletSettings(value: unknown): ExternalWalletSettings;
+export {};
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/shared-ts/src/authorization/index.d.ts

@@ -1,7 +1,7 @@
 export * from './capabilityKinds';
 export * from './delegatedAuthority';
 export * from './operationFingerprint';
-export * from './walletCustodyOperation';
+export * from './walletOwnerOperation';
 export * from './walletAuthority';
 export * from './walletSessionIssuance';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/authorization/walletOwnerOperation.d.ts

@@ -0,0 +1,10 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+export type WalletOwnerAdminOperation = 'external_identity_associate' | 'external_identity_unlink' | 'credentials_list' | 'credential_label' | 'recovery_rotate' | 'recovery_read' | 'recovery_status' | 'recovery_backup_acknowledge';
+/** Public challenge digest for a single wallet-administration factor proof. */
+export declare function computeWalletOwnerAdminChallengeDigest(input: {
+    readonly walletId: string;
+    readonly operation: WalletOwnerAdminOperation;
+    readonly payload: Record<string, unknown>;
+    readonly requestOrigin: string;
+}): Promise<DigestB64u>;
+//# sourceMappingURL=walletOwnerOperation.d.ts.map

package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts

@@ -72,6 +72,10 @@ export type RegistrationEstablishedSessionV2 = {
     readonly tokens: RegistrationEstablishedSessionProjectionTokensV2;
 };
 export type RegistrationEstablishedSessionResultV2 = {
+    readonly kind: 'owner_operations';
+    readonly walletId: WalletId;
+    readonly session?: never;
+} | {
     readonly kind: 'issued';
     readonly session: RegistrationEstablishedSessionV2;
 } | {

package/dist/types/shared-ts/src/utils/registrationIntent.d.ts

@@ -18,7 +18,9 @@ export type RuntimePolicyScopeLike = {
     envId: string;
     signingRootVersion?: string;
 };
+export type RegistrationCompletion = 'wallet_session' | 'owner_operations';
 export type RegistrationIntentV1 = {
+    completion: RegistrationCompletion;
     version: 'registration_intent_v1';
     walletId: WalletId;
     authMethod: RegistrationAuthMethodInput;

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "4";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "5";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/walletHostOwnerAuthority.d.ts

@@ -1,7 +1,7 @@
 import type { DeviceLinkOwnerConfirmation } from '../../walletIframe/host/deviceLinkApproval';
 import type { HttpTransport } from '../../../core/platform/http';
 import type { UnlockedEd25519ExportRootLinkingCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
-import { type WalletSessionAuthorizationRepository } from '../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
+import { type WalletSessionOperationCredentialV1, type WalletSessionAuthorizationRepository } from '../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
 import type { ResolveSelectedWalletAuthorityResultV1 } from '../../../core/indexedDB/seamsWalletDB/repositories';
 import type { WalletAuthenticationState } from '../../../core/types/seams';
 import type { DeviceLinkingOwnerAuthorizationPortV1 } from './deviceLinkingPorts';
@@ -24,6 +24,7 @@ export type WalletHostManagementRequestV1 = {
     }>;
 };
 export type WalletHostOwnerAuthoritiesV1 = {
+    readonly readOwnerCredential: (walletId: WalletId) => Promise<WalletSessionOperationCredentialV1>;
     readonly ownerAuthorization: DeviceLinkingOwnerAuthorizationPortV1;
     readonly ownerRequest: LinkSessionOwnerAuthenticatedRequestPortV1;
     readonly managementRequest: WalletHostManagementRequestV1;

package/dist/types/wallet/src/SeamsWeb/operations/registration/pendingRegistrationRecovery.d.ts

@@ -40,6 +40,7 @@ type PendingRegistrationRecoveryResult = {
     readonly error: Error;
 };
 export declare function registrationProjectionFromPending(pending: PendingEd25519RegistrationCommit, finalized: FinalizedNearProvisioningResponse): Promise<StoreWalletRegistrationPublicationInputV1>;
+export declare function publicationInputFromPending(pending: PendingEd25519RegistrationCommit, finalized: FinalizedNearProvisioningResponse, registration: StoreWalletRegistrationPublicationInputV1): PublishPendingWalletRegistrationCommitInputV1;
 /** Converts persisted joined material into the current continuation input. */
 export declare function restorePendingNearRegistrationMaterial(args: {
     readonly relayerUrl: string;

package/dist/types/wallet/src/SeamsWeb/operations/registration/registration.d.ts

@@ -16,6 +16,7 @@ import { type EmailOtpProvider } from '../../../../../shared-ts/src/utils/wallet
 import { RegistrationPasskeyAuthority } from './registrationEd25519Yao';
 export { REGISTRATION_TIMING_LABEL, emitRegistrationTimingSpan, parseYaoServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, } from './registrationTiming';
 type RegisterWalletOperationInput = {
+    completion: import('../../../../../shared-ts/src/utils/registrationIntent').RegistrationCompletion;
     context: RegistrationWebContext;
     authMethod: RegistrationAuthMethodInput;
     wallet: RegisterWalletInput;

package/dist/types/wallet/src/SeamsWeb/operations/registration/registrationPasskeyMaterial.d.ts

@@ -0,0 +1,24 @@
+import type { StoreWalletRegistrationPublicationInputV1 } from '../../../core/indexedDB/seamsWalletDB/repositories';
+import { type Ed25519YaoLocalMaterialIdentity } from '../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial';
+import { type LoadedWalletCustodyEd25519MaterialV1 } from '../../../core/signingEngine/walletCustody/ed25519SeedMaterial';
+import { type WalletCustodyCacheEnvelopeV1 } from '../../../core/signingEngine/walletCustody/openCustodyCache';
+import type { JoinedWalletCustodyNearEd25519KeySetV1 } from '../../signingSurface/ports';
+import type { registrationEd25519MaterialFacts } from './registrationEd25519Yao';
+type PasskeyRegistrationMaterial = {
+    metadata: JoinedWalletCustodyNearEd25519KeySetV1['metadata'];
+    material: LoadedWalletCustodyEd25519MaterialV1;
+    materialFacts: ReturnType<typeof registrationEd25519MaterialFacts>;
+    envelope: WalletCustodyCacheEnvelopeV1;
+    ownedFactorSecret: Uint8Array;
+};
+export declare function openPasskeyRegistrationEd25519Material(args: PasskeyRegistrationMaterial): Promise<import("../../../core/signingEngine/threshold/ed25519/yaoClient").RouterAbEd25519YaoSealableActiveClientV1>;
+export declare function passkeyRegistrationLocalMaterialIdentity(materialFacts: ReturnType<typeof registrationEd25519MaterialFacts>, rpId: string, credentialIdB64u: string): Ed25519YaoLocalMaterialIdentity;
+/** Include sealed owner material in the registration transaction. No live client escapes this function. */
+export declare function prepareOwnerRegistrationPublication(args: PasskeyRegistrationMaterial & {
+    registration: StoreWalletRegistrationPublicationInputV1;
+    rpId: string;
+    credentialIdB64u: string;
+    passkeyPrfFirstB64u: string;
+}): Promise<StoreWalletRegistrationPublicationInputV1>;
+export {};
+//# sourceMappingURL=registrationPasskeyMaterial.d.ts.map

package/dist/types/wallet/src/SeamsWeb/publicApi/auth.d.ts

@@ -1,6 +1,6 @@
 import type { AuthCapability } from '../signingSurface/types';
 export type WalletAuthCommands = Omit<AuthCapability, 'onSessionChange'>;
-export type WalletSessionCommands = Pick<AuthCapability, 'unlock' | 'unlockWithAuthMethod' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
+export type WalletSessionCommands = Pick<AuthCapability, 'authenticate' | 'prepareExternalAuth' | 'prepareExternalAssociation' | 'associateExternalAuth' | 'removeExternalAuth' | 'unlock' | 'unlockWithAuthMethod' | 'lock' | 'getSession' | 'getRecentUnlocks' | 'hasPasskey'>;
 export type EmailOtpAuthCommands = Pick<AuthCapability, 'requestEmailCode' | 'unlockWithEmailCode' | 'startGoogleSignIn'>;
 export declare function unlockWithEmailCode(args: Parameters<AuthCapability['unlockWithEmailCode']>[0]): ReturnType<AuthCapability['unlockWithEmailCode']>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/publicApi/createPublicApi.d.ts

@@ -11,6 +11,7 @@ import type { RegisterWalletInput } from '../../../../shared-ts/src/utils/regist
 import type { RegistrationSignerSetSelection } from '../../../../shared-ts/src/utils/registrationSignerPlan';
 /** A registration request after public defaults are resolved. */
 export type WalletRegistrationCommand = Omit<Parameters<RegistrationCapability['registerWallet']>[0], 'wallet' | 'signerSelection'> & {
+    readonly completion: import('../../../../shared-ts/src/utils/registrationIntent').RegistrationCompletion;
     readonly wallet: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;
 };

package/dist/types/wallet/src/SeamsWeb/publicApi/nearCommands.d.ts

@@ -10,6 +10,8 @@ type ResolvedNearInput<T extends {
     options: NonNullable<T['options']>;
 };
 export type NearCommands = {
+    ownerOperation: import('./ownerNearOperation').ExecuteOwnerNearOperation;
+} & {
     [K in NearSigningOperation]: (args: ResolvedNearInput<Parameters<NearSignerCapability[K]>[0]>) => ReturnType<NearSignerCapability[K]>;
 };
 export type CreateNearCommands = (dispatch: TransactionDispatch) => NearCommands;

package/dist/types/wallet/src/SeamsWeb/publicApi/ownerNearOperation.d.ts

@@ -0,0 +1,58 @@
+import { type TransactionInput } from '../../core/types/actions';
+import type { ActionResult } from '../../core/types/seams';
+import type { ExternalWalletAuthentication } from '../../../../shared-ts/src/auth/externalAuth';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
+import { type OwnerNearCommand, type OwnerNearOutcome, type OwnerNearRecovery } from '../walletIframe/shared/ownerNearOperation';
+export type { OwnerNearOutcome, OwnerNearRecovery, } from '../walletIframe/shared/ownerNearOperation';
+export type OwnerNearOperationState = Readonly<{
+    recovery: OwnerNearRecovery;
+}> & ReadonlyExclusiveUnion<{
+    kind: 'prepared';
+    expiresAtMs: number;
+} | {
+    kind: 'approval';
+    expiresAtMs: number;
+} | {
+    kind: 'submitting';
+} | {
+    kind: 'unknown';
+} | {
+    kind: 'completed';
+    result: Extract<ActionResult, {
+        success: true;
+    }>;
+} | {
+    kind: 'reverted';
+    transactionId: string;
+    error: string;
+} | {
+    kind: 'cancelled';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'failed';
+    error: string;
+}>;
+export interface OwnerNearOperation {
+    getState(): OwnerNearOperationState;
+    subscribe(listener: () => void): () => void;
+    approve(): Promise<OwnerNearOutcome>;
+    cancel(): void;
+    recover(): Promise<OwnerNearOutcome>;
+}
+export type PrepareOwnerNearTransaction = {
+    readonly authentication: ExternalWalletAuthentication;
+    readonly nearAccountId: string;
+    readonly transaction: TransactionInput;
+};
+export type ResumeOwnerNearTransaction = {
+    readonly authentication: ExternalWalletAuthentication;
+    readonly recovery: OwnerNearRecovery;
+};
+export type ExecuteOwnerNearOperation = (command: OwnerNearCommand, execution: {
+    readonly signal: AbortSignal;
+    readonly onSubmission: () => void;
+}) => Promise<OwnerNearOutcome>;
+export declare function prepareOwnerNearTransaction(execute: ExecuteOwnerNearOperation, input: PrepareOwnerNearTransaction): OwnerNearOperation;
+export declare function resumeOwnerNearTransaction(execute: ExecuteOwnerNearOperation, input: ResumeOwnerNearTransaction): OwnerNearOperation;
+//# sourceMappingURL=ownerNearOperation.d.ts.map

package/dist/types/wallet/src/SeamsWeb/publicApi/types.d.ts

@@ -1,6 +1,7 @@
 import type { AuthMethodAvailability } from '../../core/authMethods/availabilityTypes';
 import type { VoiceIdConfirmationOptions } from '../../core/authMethods/plugins';
 import type { SdkLifecycleEventListener } from '../../core/types/sdkSentEvents';
+import type { ExternalAuthenticateInput, ExternalAuthAttempt, ExternalAuthResult, ExternalWalletAuthentication } from '../../../../shared-ts/src/auth/externalAuth';
 import type { HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuSessionId, HostedAuthMenuExternalAuthRequest, HostedAuthMenuExternalAuthResolutionInput } from '../walletIframe/shared/messages';
 import type { NearAccountRef, TempoChainTarget, ThresholdEcdsaChainTarget, WalletSessionRef } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
 import type { EcdsaChainSelector, EvmChainSelector, TempoChainSelector } from './chainTargets';
@@ -24,7 +25,7 @@ import type { AddEmailOtpHooksOptions, AddEmailOtpResult } from '../operations/a
 import type { RevokeAuthMethodResult } from '../operations/authMethods/revokeAuthMethod';
 import type { WalletRecoveryBackupAcknowledgementResult, WalletRecoveryCodeStatusResult, WalletCustodyEmailOtpChallengeResult } from '../../core/rpcClients/relayer/walletRecoveryRotate';
 import type { WalletRecoveryRotationAuthorization } from '../operations/recovery/walletRecoveryRotation';
-import type { WalletCustodyAdminOperation } from '../../../../shared-ts/src/authorization/walletCustodyOperation';
+import type { WalletOwnerAdminOperation } from '../../../../shared-ts/src/authorization/walletOwnerOperation';
 import type { WalletRecoveryRotationOutcome } from '../../core/signingEngine/walletCustody/walletRecoveryRotation';
 import type { EvmAddress, EvmBytes, EvmSigningRequest } from '../../core/signingEngine/chains/evm/evmSigning.types';
 import type { TempoSigningRequest } from '../../core/signingEngine/chains/tempo/tempoSigning.types';
@@ -492,6 +493,14 @@ export type RequestEmailCodeInput = ExclusiveUnion<{
     onEvent?: GoogleEmailOtpWalletAuthStartInput['onEvent'];
 };
 export interface AuthCapability {
+    authenticate(input: ExternalAuthenticateInput): Promise<ExternalAuthResult<ExternalWalletAuthentication>>;
+    prepareExternalAuth(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt>>;
+    prepareExternalAssociation(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt<'associate'>>>;
+    associateExternalAuth(input: ExternalAuthenticateInput): Promise<ExternalAuthResult<null>>;
+    removeExternalAuth(input: {
+        walletId: string;
+        associationId: string;
+    }): Promise<ExternalAuthResult<null>>;
     unlockWithAuthMethod(args: {
         walletId: WalletId | string;
         walletAuthMethodId: string;
@@ -577,6 +586,14 @@ export interface RegistrationCapability {
         walletId: WalletId | string;
         walletAuthMethodId: string;
     }): Promise<RevokeAuthMethodResult>;
+    registerOwnerWallet(args: {
+        authMethod: Extract<RegistrationAuthMethodInput, {
+            kind: 'passkey';
+        }>;
+        wallet?: RegisterWalletInput;
+        signerSelection: RegistrationSignerSetSelection;
+        options?: RegistrationHooksOptions;
+    }): Promise<RegistrationResult>;
     registerWallet(args: {
         authMethod: RegistrationAuthMethodInput;
         /** Omit to let the server assign a new wallet ID. */
@@ -600,6 +617,8 @@ type NearSubjectInput = {
     nearAccount?: NearAccountRef | string;
 };
 export interface NearSignerCapability {
+    prepareOwnerTransaction(input: import('./ownerNearOperation').PrepareOwnerNearTransaction): import('./ownerNearOperation').OwnerNearOperation;
+    resumeOwnerTransaction(input: import('./ownerNearOperation').ResumeOwnerNearTransaction): import('./ownerNearOperation').OwnerNearOperation;
     /** Returns false only for an absent account; unavailable RPC reads reject. */
     accountExists(accountId: string): Promise<boolean>;
     signAndSendTransaction(args: NearSubjectInput & {
@@ -704,7 +723,7 @@ export interface RecoveryCapability {
     requestWalletCustodyEmailOtpChallenge(args: {
         walletId: string;
         providerSubjectId: string;
-        operation: WalletCustodyAdminOperation;
+        operation: WalletOwnerAdminOperation;
         payload: Record<string, unknown>;
         requestOrigin?: string;
     }): Promise<WalletCustodyEmailOtpChallengeResult>;

package/dist/types/wallet/src/SeamsWeb/signingSurface/BrowserSigningSurface.d.ts

@@ -1,71 +1,70 @@
-import type { WalletSessionHome } from '../../../../shared-ts/src/device-linking/contracts';
+import type { OwnerNearCommand } from '../walletIframe/shared/ownerNearOperation';
+import { type StoreNearThresholdKeyMaterialInput } from '../../core/accountData/near/keyMaterial';
+import type { AuthMethodSessionInstaller, AuthMethodUnlockSuccess } from '../../core/authMethods/hostPlugin';
+import { type ImportWalletCustodyEcdsaContinuityInput } from '../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity';
 import type { NearClient } from '../../core/rpcClients/near/NearClient';
+import type { WalletRecoveryRegistrationOptions } from '../../core/rpcClients/relayer/walletRecoveryPrepare';
+import type { WalletAddAuthMethodRegistrationOptions } from '../../core/rpcClients/relayer/walletRegistration';
+import { WalletSessionStatusReadScope } from '../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
+import type { WorkerResourceWarmupAccountContext, WorkerResourceWarmupDiagnostics } from '../../core/signingEngine/assembly/warmup';
+import type { EvmSignedResult } from '../../core/signingEngine/chains/evm/evmAdapter';
+import type { EvmSigningRequest } from '../../core/signingEngine/chains/evm/evmSigning.types';
+import type { TempoSignedResult } from '../../core/signingEngine/chains/tempo/tempoAdapter';
+import type { TempoSigningRequest } from '../../core/signingEngine/chains/tempo/tempoSigning.types';
+import type { SigningEngineExportKeypairWithUIInput, SigningEngineResolveExactKeyExportLaneInput, SigningEngineResolveExactKeyExportLaneResult } from '../../core/signingEngine/flows/recovery/public';
+import * as registrationAccount from '../../core/signingEngine/flows/registration/accountLifecycle';
+import { finalizeWalletRegistrationEcdsaSessions as finalizeWalletRegistrationEcdsaSessionsOperation } from '../../core/signingEngine/flows/registration/services/ecdsaRegistrationSessions';
+import { type LoginWithEmailOtpEcdsaCapabilityInternalArgs, type LoginWithEmailOtpEcdsaCapabilityInternalResult, type PrepareEmailOtpRegistrationEnrollmentMaterialInternalArgs, type PrepareEmailOtpRegistrationEnrollmentMaterialInternalResult } from '../../core/signingEngine/flows/signEvmFamily/emailOtpPublic';
+import { type ReconcileTempoNonceLaneArgs, type ReportTempoBroadcastAcceptedArgs, type ReportTempoBroadcastRejectedArgs, type ReportTempoDroppedOrReplacedArgs, type ReportTempoFinalizedArgs, type TempoNonceLaneStatus } from '../../core/signingEngine/flows/signEvmFamily/signEvmFamily';
+import { type NearSignIntentRequest, type NearSignIntentResult } from '../../core/signingEngine/flows/signNear/signNear';
+import { type ThresholdEcdsaChainTarget, type WalletId, type WalletSessionRef } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
+import type { NearEd25519YaoOperationMaterial } from '../../core/signingEngine/interfaces/near';
 import type { NonceCoordinator } from '../../core/signingEngine/nonce/NonceCoordinator';
-import { type AccountId } from '../../core/types/accountIds';
-import type { SdkLifecycleEvent, SdkLifecycleEventListener, SigningFlowEvent } from '../../core/types/sdkSentEvents';
-import type { AppearanceConfig, SigningSessionStatus, SeamsConfigsReadonly, WalletAuthenticationState } from '../../core/types/seams';
-import type { AuthMethodSessionInstaller, AuthMethodUnlockSuccess } from '../../core/authMethods/hostPlugin';
-import type { WebAuthnAuthenticationCredential } from '../../core/types';
+import { type EmailOtpAuthorityUnlockEd25519Request } from '../../core/signingEngine/session/emailOtp/walletUnlock';
+import type { OwnerLaneScope } from '../../core/signingEngine/session/identity/signingLaneAuthBinding';
+import type { EcdsaRoleLocalPersistedMaterialRef } from '../../core/signingEngine/session/keyMaterialBrands';
+import type { EcdsaBootstrapRequest } from '../../core/signingEngine/session/passkey/ecdsaBootstrap';
+import type { ConnectEd25519SessionArgs } from '../../core/signingEngine/session/passkey/public';
+import type { ExactWalletSessionAuthorization } from '../../core/signingEngine/session/persistence/walletSessionAuthorizationProjection';
+import type { AvailableSigningLanes, DiscoverPersistedSessionsForWalletInput, DiscoverPersistedSessionsForWalletResult, ReadAvailableSigningLanesInput } from '../../core/signingEngine/session/public';
 import type { UserPreferencesManager } from '../../core/signingEngine/session/userPreferences';
-import type { NearEd25519YaoOperationMaterial } from '../../core/signingEngine/interfaces/near';
+import { type RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
+import * as warmCapabilitiesPublic from '../../core/signingEngine/session/warmCapabilities/public';
+import type { ProvisionWarmEd25519CapabilityResult } from '../../core/signingEngine/session/warmCapabilities/types';
+import type { RegistrationWebAuthnPromptOwner, ReservedRegistrationWebAuthnPrompt, WebAuthnPromptCancellation } from '../../core/signingEngine/stepUpConfirmation/passkeyPrompt/webauthnPromptCoordinator';
+import type { ThresholdEcdsaSessionBootstrapResult } from '../../core/signingEngine/threshold/ecdsa/activation';
 import type { Ed25519YaoActiveClientIdentityV1 } from '../../core/signingEngine/threshold/ed25519/yaoActiveClientRegistry';
+import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../core/signingEngine/threshold/ed25519/yaoClient';
 import { type Ed25519YaoPublicCapabilityLaneReferenceV1, type Ed25519YaoPublicCapabilityReferenceV1 } from '../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences';
-import type { ThresholdEcdsaSessionBootstrapResult } from '../../core/signingEngine/threshold/ecdsa/activation';
+import type { PasskeyMpcSessionPort, UiConfirmSurfaceMeasurementBinding } from '../../core/signingEngine/uiConfirm/uiConfirm.types';
+import type { LoginWithEmailOtpWalletCustodyEd25519Args } from '../../core/signingEngine/walletCustody/ed25519Login';
+import { type WalletCustodyEd25519Projection } from '../../core/signingEngine/walletCustody/ed25519Projection';
+import { type LoadedWalletCustodyEd25519MaterialV1, type WalletCustodyEd25519MaterialBindingV1, type WalletCustodySealedEd25519MaterialV1 } from '../../core/signingEngine/walletCustody/ed25519SeedMaterial';
+import type { WalletCustodyCacheEnvelopeV1 } from '../../core/signingEngine/walletCustody/openCustodyCache';
 import { establishEvmFamilyCustodyV1, joinEvmFamilyCustodyV1 } from '../../core/signingEngine/walletCustody/registrationCeremony';
+import { type WalletRecoveryReplacementCredential } from '../../core/signingEngine/walletCustody/walletRecoveryCredential';
 import { type WalletSessionEd25519RecoveryBasisV1 } from '../../core/signingEngine/walletCustody/walletRecoveryEd25519';
 import { recoverWalletCustodyManifestV1 } from '../../core/signingEngine/walletCustody/walletRecoveryManifest';
-import { type LoadedWalletCustodyEd25519MaterialV1, type WalletCustodyEd25519MaterialBindingV1, type WalletCustodySealedEd25519MaterialV1 } from '../../core/signingEngine/walletCustody/ed25519SeedMaterial';
-import type { EstablishWalletCustodyNearEd25519KeySetArgs, EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyEvmFamilyKeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1, EmailOtpOwnerConfirmationPurpose } from './ports';
-import { type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
-import type { RouterAbTraceContextV1 } from '../../../../shared-ts/src/utils/routerAbTraceContext';
-import type { SignerWorkerKind, SignerWorkerOperationRequest, SignerWorkerOperationResult, SignerWorkerOperationType, EmailOtpYaoPrewarmRequest, EmailOtpYaoPrewarmOutcome } from '../../core/signingEngine/workerManager/workerTypes';
-import type { WorkerOperationContext } from '../../core/signingEngine/workerManager/executeWorkerOperation';
-import { type ImportWalletCustodyEcdsaContinuityInput } from '../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity';
-import type { EcdsaRoleLocalPersistedMaterialRef } from '../../core/signingEngine/session/keyMaterialBrands';
-import type { PasskeyMpcSessionPort, UiConfirmSurfaceMeasurementBinding } from '../../core/signingEngine/uiConfirm/uiConfirm.types';
 import type { WebAuthnAllowCredential } from '../../core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u';
-import type { EvmSigningRequest } from '../../core/signingEngine/chains/evm/evmSigning.types';
-import type { EvmSignedResult } from '../../core/signingEngine/chains/evm/evmAdapter';
-import type { TempoSigningRequest } from '../../core/signingEngine/chains/tempo/tempoSigning.types';
-import type { TempoSignedResult } from '../../core/signingEngine/chains/tempo/tempoAdapter';
-import type { EcdsaBootstrapRequest } from '../../core/signingEngine/session/passkey/ecdsaBootstrap';
-import { type ThresholdEcdsaChainTarget, type WalletId, type WalletSessionRef } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
-import { type RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
-import { type NearSignIntentRequest, type NearSignIntentResult } from '../../core/signingEngine/flows/signNear/signNear';
-import { type StoreNearThresholdKeyMaterialInput } from '../../core/accountData/near/keyMaterial';
-import type { WalletAuthMethodId } from '../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
-import { type MpcMaterialActivationRef } from '../../../../shared-ts/src/utils/domainIds';
-import { WalletSessionStatusReadScope } from '../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
-import { type ReconcileTempoNonceLaneArgs, type ReportTempoBroadcastAcceptedArgs, type ReportTempoBroadcastRejectedArgs, type ReportTempoDroppedOrReplacedArgs, type ReportTempoFinalizedArgs, type TempoNonceLaneStatus } from '../../core/signingEngine/flows/signEvmFamily/signEvmFamily';
-import type { SigningEngineResolveExactKeyExportLaneInput, SigningEngineResolveExactKeyExportLaneResult, SigningEngineExportKeypairWithUIInput } from '../../core/signingEngine/flows/recovery/public';
+import type { WorkerOperationContext } from '../../core/signingEngine/workerManager/executeWorkerOperation';
 import type { RegistrationCredentialConfirmationPayload } from '../../core/signingEngine/workerManager/validation';
+import type { EmailOtpEd25519YaoRecoveryBootstrapV1, EmailOtpYaoPrewarmOutcome, EmailOtpYaoPrewarmRequest, SignerWorkerKind, SignerWorkerOperationRequest, SignerWorkerOperationResult, SignerWorkerOperationType, UnlockedWalletEd25519ExportRootCapabilityDestroyScopeV1 } from '../../core/signingEngine/workerManager/workerTypes';
+import type { WebAuthnAuthenticationCredential } from '../../core/types';
+import { type AccountId } from '../../core/types/accountIds';
+import type { SdkLifecycleEvent, SdkLifecycleEventListener, SigningFlowEvent } from '../../core/types/sdkSentEvents';
+import type { AppearanceConfig, SeamsConfigsReadonly, SigningSessionStatus, WalletAuthenticationState } from '../../core/types/seams';
 import type { ConfirmationConfig } from '../../core/types/signer-worker';
-import * as registrationAccount from '../../core/signingEngine/flows/registration/accountLifecycle';
-import { type LoginWithEmailOtpEcdsaCapabilityInternalArgs, type LoginWithEmailOtpEcdsaCapabilityInternalResult, type PrepareEmailOtpRegistrationEnrollmentMaterialInternalArgs, type PrepareEmailOtpRegistrationEnrollmentMaterialInternalResult } from '../../core/signingEngine/flows/signEvmFamily/emailOtpPublic';
-import type { ExactWalletSessionAuthorization } from '../../core/signingEngine/session/persistence/walletSessionAuthorizationProjection';
-import type { ProvisionWarmEd25519CapabilityResult } from '../../core/signingEngine/session/warmCapabilities/types';
-import type { LoginWithEmailOtpWalletCustodyEd25519Args } from '../../core/signingEngine/walletCustody/ed25519Login';
-import { type EmailOtpAuthorityUnlockEd25519Request } from '../../core/signingEngine/session/emailOtp/walletUnlock';
-import type { WalletCustodyCacheEnvelopeV1 } from '../../core/signingEngine/walletCustody/openCustodyCache';
-import { type WalletCustodyEd25519Projection } from '../../core/signingEngine/walletCustody/ed25519Projection';
-import type { NearEd25519SignerBinding } from '../../../../shared-ts/src/utils/walletCapabilityBindings';
-import type { OwnerLaneScope } from '../../core/signingEngine/session/identity/signingLaneAuthBinding';
-import type { EmailOtpEd25519YaoRecoveryBootstrapV1 } from '../../core/signingEngine/workerManager/workerTypes';
-import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../core/signingEngine/threshold/ed25519/yaoClient';
-import type { DiscoverPersistedSessionsForWalletInput, DiscoverPersistedSessionsForWalletResult, ReadAvailableSigningLanesInput, AvailableSigningLanes } from '../../core/signingEngine/session/public';
-import * as warmCapabilitiesPublic from '../../core/signingEngine/session/warmCapabilities/public';
-import type { ConnectEd25519SessionArgs } from '../../core/signingEngine/session/passkey/public';
+import type { WebAuthnRegistrationCredential } from '../../core/types/webauthn';
+import type { WalletSessionHome } from '../../../../shared-ts/src/device-linking/contracts';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../../shared-ts/src/passkey-custody';
-import type { UnlockedWalletEd25519ExportRootCapabilityDestroyScopeV1 } from '../../core/signingEngine/workerManager/workerTypes';
+import type { WalletAuthMethodId } from '../../../../shared-ts/src/utils/domainIds';
+import { type MpcMaterialActivationRef } from '../../../../shared-ts/src/utils/domainIds';
+import { type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { RouterAbTraceContextV1 } from '../../../../shared-ts/src/utils/routerAbTraceContext';
+import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { NearEd25519SignerBinding } from '../../../../shared-ts/src/utils/walletCapabilityBindings';
 import type { BrowserSigningSurfaceConstructorDeps } from '../assembly/browserSigningSurfacePorts';
-import { finalizeWalletRegistrationEcdsaSessions as finalizeWalletRegistrationEcdsaSessionsOperation } from '../../core/signingEngine/flows/registration/services/ecdsaRegistrationSessions';
-import type { WorkerResourceWarmupAccountContext, WorkerResourceWarmupDiagnostics } from '../../core/signingEngine/assembly/warmup';
-import type { WebAuthnRegistrationCredential } from '../../core/types/webauthn';
-import type { WalletRecoveryRegistrationOptions } from '../../core/rpcClients/relayer/walletRecoveryPrepare';
-import type { WalletAddAuthMethodRegistrationOptions } from '../../core/rpcClients/relayer/walletRegistration';
-import { type WalletRecoveryReplacementCredential } from '../../core/signingEngine/walletCustody/walletRecoveryCredential';
-import type { RegistrationWebAuthnPromptOwner, ReservedRegistrationWebAuthnPrompt, WebAuthnPromptCancellation } from '../../core/signingEngine/stepUpConfirmation/passkeyPrompt/webauthnPromptCoordinator';
+import type { EmailOtpOwnerConfirmationPurpose, EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, EstablishWalletCustodyNearEd25519KeySetArgs, JoinedWalletCustodyEvmFamilyKeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1 } from './ports';
 type EmailOtpEd25519CustodyCapabilityActivationArgs = {
     readonly commitQueue: 'acquire' | 'already_acquired';
     readonly walletSession: WalletSessionRef;
@@ -295,6 +294,9 @@ export declare class BrowserSigningSurface {
     setWalletIframeSurfaceMeasurementBinding(binding: UiConfirmSurfaceMeasurementBinding): void;
     getWalletIframeSurfaceMeasurementBinding(): UiConfirmSurfaceMeasurementBinding;
     getUserPreferences(): UserPreferencesManager;
+    signNearOwnerTransaction(command: Extract<OwnerNearCommand, {
+        action: 'approve';
+    }>, assertCurrent: () => void, onEvent: (event: SigningFlowEvent) => void): Promise<import("../../core/types").SignTransactionResult>;
     signNear<TRequest extends NearSignIntentRequest>(request: TRequest): Promise<NearSignIntentResult<TRequest>>;
     private terminateWalletStateAfterSigningFailure;
     private ensureNearEd25519YaoCapabilityForSigning;
@@ -313,7 +315,6 @@ export declare class BrowserSigningSurface {
     private authorizeAndRehydrateEmailOtpEd25519OperationMaterial;
     private resolveExactNearEd25519YaoSigningHydration;
     private prepareExactPasskeyEd25519YaoOperationStepUpForSigning;
-    private rehydratePreparedPasskeyEd25519YaoOperationStepUp;
     private resolveExactPasskeyEd25519YaoExportContext;
     private resolveLinkedPasskeyEd25519YaoExportContext;
     private readExactEmailOtpEd25519ExportAuthorization;

package/dist/types/wallet/src/SeamsWeb/signingSurface/nearOwnerOperation.d.ts

@@ -0,0 +1,16 @@
+import type { SigningOperationId } from '../../core/signingEngine/session/operationState/types';
+import type { WalletId } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
+import type { NearSigningApiDeps } from '../../core/signingEngine/interfaces/operationDeps';
+import type { Ed25519YaoPublicCapabilityReferenceStorePort } from '../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences';
+import type { AccountId } from '../../core/types/accountIds';
+type OwnerOperationInput = {
+    readonly operationId: SigningOperationId;
+    readonly walletId: WalletId;
+    readonly nearAccountId: AccountId;
+    readonly relayerUrl: string;
+    readonly assertCurrent: () => void;
+};
+/** This projection contains durable material and fresh owner proof. It has no reusable authority. */
+export declare function createNearOwnerOperationDeps(base: NearSigningApiDeps, lanes: Pick<Ed25519YaoPublicCapabilityReferenceStorePort, 'listLanes'>, input: OwnerOperationInput): Promise<NearSigningApiDeps>;
+export {};
+//# sourceMappingURL=nearOwnerOperation.d.ts.map