@seams/wallet 0.27.0 → 0.29.0

package/dist/types/wallet/src/SeamsWeb/signingSurface/nearPasskeyOperationMaterial.d.ts

@@ -0,0 +1,72 @@
+import type { ResolveSelectedWalletAuthorityResultV1 } from '../../core/indexedDB/seamsWalletDB/repositories';
+import { type WalletId } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
+import type { NearEd25519YaoOperationMaterial, NearEd25519YaoOperationMaterialFacts } from '../../core/signingEngine/interfaces/near';
+import type { NearEd25519MaterialIdentity, NearSigningApiDeps } from '../../core/signingEngine/interfaces/operationDeps';
+import { preparePasskeyEd25519YaoLocalMaterialRehydrationV1, type Ed25519YaoLocalMaterialIdentity, type PasskeyEd25519YaoPublicLocatorObservationV1 } from '../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial';
+import type { WebAuthnAuthenticationCredential } from '../../core/types';
+import { type MpcMaterialActivationRef } from '../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { NearEd25519SignerBinding } from '../../../../shared-ts/src/utils/walletCapabilityBindings';
+export declare function resolveBrowserExactPasskeyWalletAuthAuthorityRef(args: {
+    readonly walletId: WalletId;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+}): Promise<WalletAuthAuthorityRef | null>;
+export type PasskeyEd25519MaterialAccess = {
+    readonly kind: 'wallet_session';
+} | {
+    readonly kind: 'owner_operation';
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
+    readonly authority: import('../../../../shared-ts/src/authorization/walletAuthority').ActiveWalletAuthorityV1;
+    readonly assertCurrent: () => void;
+};
+export declare function preparePasskeyEd25519OperationMaterial(args: {
+    walletId: WalletId;
+    identity: NearEd25519MaterialIdentity;
+    relayerUrl: string;
+    access: PasskeyEd25519MaterialAccess;
+}): Promise<{
+    prepared: {
+        kind: 'prepared';
+        plan: Extract<import("../../core/signingEngine/session/material/mpcCapabilityHydration").MpcCapabilityHydrationPlan, {
+            kind: 'rehydrate_material_activation';
+        }>;
+    };
+    localIdentity: Ed25519YaoLocalMaterialIdentity;
+    authority: WalletAuthAuthorityRef;
+    publicLocator: Omit<{
+        readonly kind: 'available';
+        readonly walletId: string;
+        readonly nearAccountId: string;
+        readonly signerSlot: number;
+        readonly materialActivation: MpcMaterialActivationRef;
+        readonly authority: WalletAuthAuthorityRef;
+    }, "authority">;
+    facts: NearEd25519YaoOperationMaterialFacts;
+    participantIds: readonly [number, number];
+}>;
+export declare function assertPasskeyEd25519MaterialAccess(access: PasskeyEd25519MaterialAccess, selected: Extract<ResolveSelectedWalletAuthorityResultV1, {
+    kind: 'resolved';
+}>): void;
+export declare function prepareExactPasskeyEd25519YaoLocalMaterialRehydration(input: Parameters<typeof preparePasskeyEd25519YaoLocalMaterialRehydrationV1>[0]): Promise<Awaited<ReturnType<typeof preparePasskeyEd25519YaoLocalMaterialRehydrationV1>>>;
+export type PrepareNearEd25519YaoMaterialBoundaryInput = Parameters<NearSigningApiDeps['prepareNearEd25519YaoMaterialBoundary']>[0];
+export declare function nearEd25519MaterialIdentityFromBoundaryInput(input: PrepareNearEd25519YaoMaterialBoundaryInput): NearEd25519MaterialIdentity;
+export declare function nearEd25519SignerFromBoundaryInput(input: PrepareNearEd25519YaoMaterialBoundaryInput): NearEd25519SignerBinding;
+export declare function validateExactNearEd25519YaoOperationMaterial(args: {
+    material: NearEd25519YaoOperationMaterial;
+    input: PrepareNearEd25519YaoMaterialBoundaryInput;
+    expectedActivation: MpcMaterialActivationRef;
+}): NearEd25519YaoOperationMaterial;
+export declare function rehydratePreparedPasskeyEd25519YaoOperationStepUp(prepared: {
+    input: PrepareNearEd25519YaoMaterialBoundaryInput;
+    access: PasskeyEd25519MaterialAccess;
+    identity: Ed25519YaoLocalMaterialIdentity;
+    facts: NearEd25519YaoOperationMaterialFacts;
+    authority: WalletAuthAuthorityRef;
+    rpId: string;
+    credentialIdB64u: string;
+    publicLocator: PasskeyEd25519YaoPublicLocatorObservationV1;
+    materialActivation: MpcMaterialActivationRef;
+}, credential: WebAuthnAuthenticationCredential): Promise<NearEd25519YaoOperationMaterial>;
+//# sourceMappingURL=nearPasskeyOperationMaterial.d.ts.map

package/dist/types/wallet/src/SeamsWeb/signingSurface/types.d.ts

@@ -6,6 +6,9 @@ import type { WorkerOperationContext } from '../../core/signingEngine/workerMana
 export type { AccountSyncSigningSurface, AccountSyncWebContext, WalletAuthWebContext, DeviceLinkingSigningSurface, DeviceLinkingWebContext, EcdsaLoginSessionSurface, EcdsaRegistrationSurface, Ed25519YaoCapabilityActivationSurface, EcdsaSessionBootstrapSurface, EcdsaSessionControlSurface, Ed25519SessionConnectionSurface, EmailOtpRegistrationEnrollmentSurface, EmailOtpSigningSessionSurface, WalletRecoverySigningSurface, WalletRecoveryWebContext, EvmFamilySigningSurface, LocalLoginStateSurface, LockSigningSurface, LoginUnlockSigningSurface, LoginWarmSigningSurface, LoginWebContext, NearSigningSurface, NearSigningWebContext, NonceCoordinatorSurface, PasskeyLoginAssertionSurface, RecentUnlocksSigningSurface, RecentUnlocksWebContext, RegistrationAccountSurface, RegistrationResourceWarmupSurface, RegistrationSigningSurface, RegistrationWebContext, RpIdSurface, RuntimeStartupSurface, SeamsWebBaseContext, SigningEngineLifecycleEventSurface, SignerWorkerContextSurface, SigningSessionSurface, TempoNonceLifecycleSurface, TempoSigningSurface, UnlockedEd25519ExportRootCapabilitySurface, UserAccountLookupSurface, UserProfileStoreSurface, WalletIframeWarmupSurface, WalletAuthenticationSurface, WalletSessionReadSurface, WalletSessionWebContext, WarmSessionStatusSurface, WebAuthnRegistrationConfirmationSurface, } from './ports';
 export type * from '../publicApi/types';
 export interface SeamsWebSigningSurface extends RpIdSurface, NonceCoordinatorSurface, WalletIframeWarmupSurface, WalletIframeSurfaceMeasurementSurface, WalletAuthenticationSurface, WalletLockGenerationSurface, RuntimeStartupSurface, SigningEngineLifecycleEventSurface, WorkerOperationContext, SigningSessionSurface, Ed25519SessionConnectionSurface, EcdsaSessionBootstrapSurface, EmailOtpSigningSessionSurface, EmailOtpRegistrationEnrollmentSurface, EcdsaLoginSessionSurface, EcdsaSessionControlSurface, SignerWorkerContextSurface, WarmSessionStatusSurface, NearSigningSurface, EvmFamilySigningSurface, TempoNonceLifecycleSurface, UserProfileStoreSurface, RegistrationResourceWarmupSurface, RegistrationAccountSurface, EcdsaRegistrationSurface, Ed25519YaoCapabilityActivationSurface, UnlockedEd25519ExportRootCapabilitySurface, WalletCustodyCeremonySurface, Ed25519MaterialOwnerQueueSurface, Pick<AccountSyncSigningSurface, 'storeNearThresholdKeyMaterial'>, WebAuthnRegistrationConfirmationSurface, EmailOtpOwnerConfirmationSurface, PasskeyLoginAssertionSurface, KeyExportSigningSurface {
+    signNearOwnerTransaction(command: Extract<import('../walletIframe/shared/ownerNearOperation').OwnerNearCommand, {
+        action: 'approve';
+    }>, assertCurrent: () => void, onEvent: (event: import('../../core/types/sdkSentEvents').SigningFlowEvent) => void): Promise<import('../../core/types/seams').SignTransactionResult>;
     readonly seamsWebConfigs: SeamsConfigsReadonly;
     dispose(): void;
     setAppearance(appearance: AppearanceConfig): void;

package/dist/types/wallet/src/SeamsWeb/walletIframe/client/ownerNearOperation.d.ts

@@ -0,0 +1,25 @@
+import type { ExecuteOwnerNearOperation } from '../../publicApi/ownerNearOperation';
+import type { WalletIframeRequestId } from '../../../core/types/walletIframeIdentity';
+import type { ProgressPayload } from '../shared/messages';
+import { type OwnerNearCommand } from '../shared/ownerNearOperation';
+type OwnerNearRequestPorts = {
+    allocateRequestId(): WalletIframeRequestId;
+    cancelRequest(requestId: string): Promise<void>;
+    post(request: {
+        type: 'PM_OWNER_NEAR_TRANSACTION';
+        payload: OwnerNearCommand;
+        options: {
+            onProgress: (payload: ProgressPayload) => void;
+        };
+    }, options: {
+        requestId: WalletIframeRequestId;
+        timeout: 'interactive';
+        shouldContinue: () => boolean;
+        onDispatched: () => void;
+    }): Promise<{
+        result?: unknown;
+    }>;
+};
+export declare function executeOwnerNearRequest(ports: OwnerNearRequestPorts, ...args: Parameters<ExecuteOwnerNearOperation>): ReturnType<ExecuteOwnerNearOperation>;
+export {};
+//# sourceMappingURL=ownerNearOperation.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/client/router.d.ts

@@ -1,3 +1,4 @@
+import type { ExecuteOwnerNearOperation } from '../../publicApi/ownerNearOperation';
 import type { VoiceIdConfirmationOptions } from '../../../core/authMethods/plugins';
 import type { WalletRegistrationCommand } from '../../publicApi/createPublicApi';
 import type { AuthCapability } from '../../publicApi/types';
@@ -244,6 +245,11 @@ export declare class WalletIframeRouter {
     removeAuthMethod(payload: Parameters<RegistrationCapability['removeAuthMethod']>[0]): Promise<RevokeAuthMethodResult>;
     unlock(payload: LoginUnlockRequest): Promise<LoginAndCreateSessionResult>;
     unlockWithAuthMethod(payload: Parameters<AuthCapability['unlockWithAuthMethod']>[0]): ReturnType<AuthCapability['unlockWithAuthMethod']>;
+    authenticate(input: Parameters<AuthCapability['authenticate']>[0]): ReturnType<AuthCapability['authenticate']>;
+    prepareExternalAuth(walletId: string): ReturnType<AuthCapability['prepareExternalAuth']>;
+    removeExternalAuth(input: Parameters<AuthCapability['removeExternalAuth']>[0]): ReturnType<AuthCapability['removeExternalAuth']>;
+    prepareExternalAssociation(walletId: string): ReturnType<AuthCapability['prepareExternalAssociation']>;
+    associateExternalAuth(input: Parameters<AuthCapability['associateExternalAuth']>[0]): ReturnType<AuthCapability['associateExternalAuth']>;
     getWalletSession(walletId?: string): Promise<WalletSession>;
     private finishWalletSessionRead;
     private readWalletSession;
@@ -255,7 +261,7 @@ export declare class WalletIframeRouter {
     requestWalletCustodyEmailOtpChallenge(payload: {
         walletId: string;
         providerSubjectId: string;
-        operation: import('../../../../../shared-ts/src/authorization/walletCustodyOperation').WalletCustodyAdminOperation;
+        operation: import('../../../../../shared-ts/src/authorization/walletOwnerOperation').WalletOwnerAdminOperation;
         payload: Record<string, unknown>;
         requestOrigin?: string;
     }): Promise<WalletCustodyEmailOtpChallengeResult>;
@@ -372,6 +378,7 @@ export declare class WalletIframeRouter {
     private submitLinkedDeviceTargetEmailOtpV1;
     cancelDeviceLinking(): Promise<void>;
     private wrapOnEvent;
+    ownerNearOperation(...args: Parameters<ExecuteOwnerNearOperation>): ReturnType<ExecuteOwnerNearOperation>;
     signAndSendTransaction(payload: {
         walletId: string;
         nearAccountId: string;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/WalletHostRuntime.d.ts

@@ -1,3 +1,4 @@
+import type { OwnerNearCommand, OwnerNearOutcome } from '../shared/ownerNearOperation';
 import type { WalletPlacementCapability } from '../../publicApi/placement';
 import { type KeyExportDomainMethods } from '../../publicApi/keyExport';
 import type { WalletAuthCommands } from '../../publicApi/auth';
@@ -21,9 +22,12 @@ type SeamsWebContextWithDeviceLinkingResumeV1 = SeamsWebContext & {
 };
 /** Owns wallet-origin execution and durable signing state. */
 export declare class WalletHostRuntime {
+    readonly parentOrigin: string;
     private readonly signingEngine;
     private readonly nearClient;
     readonly configs: WalletHostConfig;
+    readonly readExternalSession: WalletHostSessionCommands['readExternalSession'];
+    private readonly captureExternalOwnerOperation;
     private appearance;
     theme: ThemeMode;
     private readonly prefillRestoredSession;
@@ -31,20 +35,22 @@ export declare class WalletHostRuntime {
     readonly devices: DevicesCapability;
     readonly keys: KeyExportDomainMethods;
     readonly preferences: Omit<PreferencesCapability, 'setConfirmationConfig' | 'setConfirmationBehavior' | 'onCurrentWalletChange'> & Pick<UserPreferencesManager, 'setConfirmationConfig' | 'setConfirmationBehavior' | 'onCurrentWalletChange'>;
-    readonly auth: WalletAuthCommands & Pick<WalletHostSessionCommands, 'unlockWithAuthMethod'>;
+    readonly auth: WalletAuthCommands & Pick<WalletHostSessionCommands, 'unlockWithAuthMethod' | 'authenticate' | 'associateExternalAuth' | 'removeExternalAuth'>;
     readonly placement: WalletPlacementCapability;
     readonly registration: RegistrationCapability;
+    readonly registerWalletCommand: import('../../publicApi/createPublicApi').WalletRegistrationCommands['registerWallet'];
     readonly near: NearSignerCapability;
     readonly tempo: TempoSignerCapability;
     readonly evm: EvmSignerCapability;
     private readonly deviceLinkingDispose;
     private readonly resumePendingAcknowledgementsV1;
-    constructor(configs: WalletHostConfig, nearClient?: NearClient);
+    constructor(configs: WalletHostConfig, parentOrigin: string, nearClient?: NearClient);
     /** @internal One wallet-host restore owns all configured-chain prefills. */
     prefillRestoredWalletSession(state: WalletIframeExactSessionState): Promise<void>;
     private lockAfterWalletMove;
     /** Subscribe to typed lifecycle events emitted by the wallet boundary. */
     onSdkLifecycleEvent(listener: SdkLifecycleEventListener): () => void;
+    runOwnerNearOperation(command: OwnerNearCommand, assertActive: () => void, onEvent: (event: import('../../../core/types/sdkSentEvents').SigningFlowEvent) => void, onSubmission: () => void): Promise<OwnerNearOutcome>;
     getContext(): SeamsWebContextWithDeviceLinkingResumeV1;
     private resumePendingAcknowledgementsAfterExactUnlockV1;
     private resumePendingRegistrationOnStartup;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/createNearCommands.d.ts

@@ -1,4 +1,5 @@
+import type { WalletHostRuntime } from './WalletHostRuntime';
 import type { NearCommands } from '../../publicApi/nearCommands';
 import type { NearSigningWebContext } from '../../signingSurface/types';
-export declare function createWalletHostNearCommands(getContext: () => NearSigningWebContext): NearCommands;
+export declare function createWalletHostNearCommands(getContext: () => NearSigningWebContext, runOwnerOperation: WalletHostRuntime['runOwnerNearOperation']): NearCommands;
 //# sourceMappingURL=createNearCommands.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/createSessionCommands.d.ts

@@ -1,7 +1,9 @@
+import { HostedExternalAuth } from './externalAuth';
 import { type PendingRegistrationRecoverySigningSurface } from '../../operations/registration/pendingRegistrationRecovery';
 import { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 import type { ThresholdEcdsaChainTarget, WalletSessionRef } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
+import type { WalletSession } from '../../../core/types/seams';
 import type { AuthMethodCaptureMount } from '../../../core/authMethods/hostPlugin';
 import type { WalletAuthenticationSurface, WalletIframeSurfaceMeasurementSurface } from '../../signingSurface/ports';
 import type { WalletAuthWebContext, WalletIframeWarmupSurface } from '../../signingSurface/types';
@@ -9,10 +11,15 @@ import type { WalletSessionCommands } from '../../publicApi/auth';
 type WalletHostAuthContext = WalletAuthWebContext & {
     signingEngine: Pick<WalletIframeWarmupSurface, 'warmCriticalResources'> & PendingRegistrationRecoverySigningSurface & WalletIframeSurfaceMeasurementSurface & Pick<WalletAuthenticationSurface, 'installAuthMethodSession'>;
 };
-export type WalletHostSessionCommands = Omit<WalletSessionCommands, 'unlockWithAuthMethod'> & {
+export type WalletHostSessionCommands = Omit<WalletSessionCommands, 'unlockWithAuthMethod' | 'authenticate' | 'associateExternalAuth' | 'removeExternalAuth'> & {
+    authenticate(input: Parameters<WalletSessionCommands['authenticate']>[0], assertActive?: () => void): ReturnType<WalletSessionCommands['authenticate']>;
+    associateExternalAuth(input: Parameters<WalletSessionCommands['associateExternalAuth']>[0], assertActive?: () => void): ReturnType<WalletSessionCommands['associateExternalAuth']>;
+    removeExternalAuth(input: Parameters<WalletSessionCommands['removeExternalAuth']>[0], assertActive?: () => void): ReturnType<WalletSessionCommands['removeExternalAuth']>;
+    readExternalSession(walletId?: string): Promise<WalletSession | null>;
+    captureExternalOwnerOperation: HostedExternalAuth['captureOwnerOperation'];
     unlockWithAuthMethod(args: Parameters<WalletSessionCommands['unlockWithAuthMethod']>[0], assertActive?: () => void, mountCapture?: AuthMethodCaptureMount): ReturnType<WalletSessionCommands['unlockWithAuthMethod']>;
 };
-export declare function createWalletHostSessionCommands(getContext: () => WalletHostAuthContext): WalletHostSessionCommands;
+export declare function createWalletHostSessionCommands(getContext: () => WalletHostAuthContext, parentOrigin: string): WalletHostSessionCommands;
 export declare function prefillWalletHostPresignatures(getContext: () => WalletHostAuthContext, args: {
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/externalAuth.d.ts

@@ -0,0 +1,31 @@
+import type { SeamsConfigsReadonly, WalletSession } from '../../../core/types/seams';
+import { type ExternalAuthenticateInput, type ExternalAuthAttempt, type ExternalAuthResult, type ExternalWalletAuthentication } from '../../../../../shared-ts/src/auth/externalAuth';
+import { type ExternalOwnerApproval } from './externalOwnerApproval';
+export declare class HostedExternalAuth {
+    private readonly configs;
+    private readonly lockOwner;
+    private readonly approveOwner;
+    private readonly parentOrigin;
+    private state;
+    private generation;
+    constructor(configs: SeamsConfigsReadonly, lockOwner: () => Promise<void>, approveOwner: ExternalOwnerApproval, parentOrigin: string);
+    private storageKey;
+    private restore;
+    private request;
+    lock(): Promise<void>;
+    releaseForOwner(): Promise<void>;
+    prepare(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt>>;
+    authenticate(input: ExternalAuthenticateInput, assertActive?: () => void): Promise<ExternalAuthResult<ExternalWalletAuthentication>>;
+    prepareAssociation(walletId: string): Promise<ExternalAuthResult<ExternalAuthAttempt<'associate'>>>;
+    associate(input: ExternalAuthenticateInput, assertActive?: () => void): Promise<ExternalAuthResult<null>>;
+    private assertOwnerOperation;
+    private completeOwnerOperation;
+    captureOwnerOperation(authentication: ExternalWalletAuthentication): Promise<() => void>;
+    private assertOwnerOperationCurrent;
+    getSession(walletId?: string): Promise<WalletSession | null>;
+    remove(input: {
+        walletId: string;
+        associationId: string;
+    }, assertActive?: () => void): Promise<ExternalAuthResult<null>>;
+}
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/externalOwnerApproval.d.ts

@@ -0,0 +1,24 @@
+import type { SeamsConfigsReadonly } from '../../../core/types/seams';
+import type { UiConfirmSurfaceMeasurementBinding } from '../../../core/signingEngine/uiConfirm/uiConfirm.types';
+import type { WalletCustodyFactorProof } from '../../../core/rpcClients/relayer/walletRecoveryRotate';
+import type { ExternalOwnerChallenge } from '../../../../../shared-ts/src/auth/externalAuth';
+type OwnerApprovalContext = {
+    readonly configs: Pick<SeamsConfigsReadonly, 'ui'>;
+    readonly signingEngine: {
+        getRpId(): string;
+        getWalletIframeSurfaceMeasurementBinding(): UiConfirmSurfaceMeasurementBinding;
+    };
+};
+export type ExternalOwnerApprovalRequest = Readonly<{
+    challenge: ExternalOwnerChallenge;
+    signal: AbortSignal;
+    assertCurrent: () => void;
+}>;
+export type ExternalOwnerApproval = (input: ExternalOwnerApprovalRequest) => Promise<WalletCustodyFactorProof>;
+export declare class ExternalOwnerApprovalError extends Error {
+    readonly code: 'cancelled' | 'expired';
+    constructor(code: 'cancelled' | 'expired');
+}
+export declare function approveExternalOwnerOperation(getContext: () => OwnerApprovalContext, input: ExternalOwnerApprovalRequest): Promise<WalletCustodyFactorProof>;
+export {};
+//# sourceMappingURL=externalOwnerApproval.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ownerNearOperation.d.ts

@@ -0,0 +1,12 @@
+import { type SigningFlowEvent } from '../../../core/types/sdkSentEvents';
+import type { SeamsWebContext } from '../../signingSurface/types';
+import { type OwnerNearCommand, type OwnerNearOutcome } from '../shared/ownerNearOperation';
+import type { HostedExternalAuth } from './externalAuth';
+type OwnerNearPorts = {
+    readonly getContext: () => SeamsWebContext;
+    readonly captureConnection: HostedExternalAuth['captureOwnerOperation'];
+    readonly parentOrigin: string;
+};
+export declare function runOwnerNearOperation(ports: OwnerNearPorts, command: OwnerNearCommand, assertActive: () => void, onEvent: (event: SigningFlowEvent) => void, onSubmission: () => void): Promise<OwnerNearOutcome>;
+export {};
+//# sourceMappingURL=ownerNearOperation.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/requestRouter.d.ts

@@ -3,8 +3,8 @@ type WalletHostRequest<T extends ParentToChildType> = ParentToChildEnvelope & {
     type: T;
 };
 type BootWalletRequestType = 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_CANCEL' | 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED';
-type NearWalletRequestType = 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413';
-type AuthWalletRequestType = 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS';
+type NearWalletRequestType = 'PM_OWNER_NEAR_TRANSACTION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413';
+type AuthWalletRequestType = 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_EXTERNAL_AUTH' | 'PM_EXTERNAL_OWNER_AUTH' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS';
 type EcdsaWalletRequestType = 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE';
 type EmailOtpWalletRequestType = 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE';
 type RecoveryWalletRequestType = 'PM_SYNC_ACCOUNT_FLOW';

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/sessionObserver.d.ts

@@ -15,6 +15,7 @@ export declare class WalletHostSessionObserver {
     private refresh;
     private invalidationRevision;
     private activeOperations;
+    private externalExpiryTimer;
     private readonly pendingObservations;
     private readonly unsubscribeAuthority;
     private readonly unsubscribeSelection;

package/dist/types/wallet/src/SeamsWeb/walletIframe/shared/exactSessionState.d.ts

@@ -25,6 +25,14 @@ export type WalletIframeExactSessionIdentityInput = {
 type WalletIframeSessionUnavailableReason = 'exhausted' | 'absent' | 'not_found' | 'unavailable' | 'upgrade_required' | 'superseded' | 'invalid';
 export type WalletIframeExactSessionState = {
     readonly kind: 'wallet_locked';
+} | {
+    readonly kind: 'external_read';
+    readonly walletId: WalletId;
+    readonly externalSessionId: string;
+    readonly expiresAtMs: number;
+    readonly walletSessionId?: never;
+    readonly authorizationId?: never;
+    readonly authMethod?: never;
 } | {
     readonly kind: 'wallet_authenticated_identity_unresolvable';
     readonly walletId: WalletId;

package/dist/types/wallet/src/SeamsWeb/walletIframe/shared/messages.d.ts

@@ -1,3 +1,4 @@
+import type { OwnerNearCommand } from './ownerNearOperation';
 import type { WalletSessionHome } from '../../../../../shared-ts/src/device-linking/contracts';
 import type { SigningEngineResolveExactKeyExportLaneInput as ResolveExactKeyExportLaneInput } from '../../../core/signingEngine/flows/recovery/public';
 import type { TransactionReviewWire, TransactionReviewStateMessage } from './transactionReview';
@@ -16,7 +17,7 @@ import type { TempoSignedResult } from '../../../core/signingEngine/chains/tempo
 import type { KeyExportUiOptions } from '../../../core/signingEngine/flows/recovery/keyExportFlow';
 import type { EvmEip155ChainTarget, NearAccountRef, TempoChainTarget, ThresholdEcdsaChainTarget, WalletSessionRef } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import type { EmailOtpAuthPolicy } from '../../../core/types/seams';
-import type { WalletCustodyAdminOperation } from '../../../../../shared-ts/src/authorization/walletCustodyOperation';
+import type { WalletOwnerAdminOperation } from '../../../../../shared-ts/src/authorization/walletOwnerOperation';
 import type { MpcMaterialActivationRef } from '../../../../../shared-ts/src/utils/domainIds';
 import type { RegistrationTimingSpanV1, SdkLifecycleEvent, WalletFlowEvent } from '../../../core/types/sdkSentEvents';
 import type { GoogleEmailOtpWalletAuthDelivery, GoogleEmailOtpWalletAuthEcdsaTargets, GoogleEmailOtpWalletAuthFailure, GoogleEmailOtpWalletAuthPromptCopy, GoogleEmailOtpWalletAuthRegistrationCompleted, GoogleEmailOtpWalletAuthResolvedMode, GoogleEmailOtpWalletAuthRequestedMode, GoogleEmailOtpWalletAuthSubmitSuccess, RequestEmailCodeInput, WalletRecoveryRotationAuthorization } from '../../publicApi/types';
@@ -192,10 +193,10 @@ export declare function buildHostedAuthMenuCancelPayload(args: {
     reason: HostedAuthMenuCancelReason;
 }): HostedAuthMenuCancelPayload;
 export declare function parseHostedAuthMenuOutcome(value: unknown): HostedAuthMenuOutcome | null;
-export declare const WALLET_PROTOCOL_VERSION: '17.0.0';
+export declare const WALLET_PROTOCOL_VERSION: '19.0.0';
 export declare const WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH: 'WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH';
 export type WalletProtocolVersion = typeof WALLET_PROTOCOL_VERSION;
-export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
+export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ACTIVATE_AUTH_METHOD' | 'PM_GET_AUTH_METHOD_AVAILABILITY' | 'PM_SET_AUTH_METHOD_ENABLED' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_UNLOCK_AUTH_METHOD' | 'PM_EXTERNAL_AUTH' | 'PM_EXTERNAL_OWNER_AUTH' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_OWNER_NEAR_TRANSACTION' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
 interface RpcEnvelope<T extends string = string, P = unknown> {
     type: T;
     requestId?: string;
@@ -264,6 +265,7 @@ type PMGoogleSsoRegistrationAuthMethod = Omit<Extract<EmailOtpRegistrationAuthMe
 };
 export type PMRegistrationAuthMethodInput = PasskeyRegistrationAuthMethodInput | PMEmailOtpChallengeRegistrationAuthMethod | PMGoogleSsoRegistrationAuthMethod;
 interface PMRegisterWalletPayload {
+    completion: import('../../../../../shared-ts/src/utils/registrationIntent').RegistrationCompletion;
     authMethod: PMRegistrationAuthMethodInput;
     wallet: RegisterWalletInput;
     signerSelection: RegistrationSignerSetSelection;
@@ -528,7 +530,7 @@ interface PMWalletRecoverySessionPayload {
 interface PMRequestWalletCustodyEmailOtpChallengePayload {
     walletId: string;
     providerSubjectId: string;
-    operation: WalletCustodyAdminOperation;
+    operation: WalletOwnerAdminOperation;
     payload: Record<string, unknown>;
     requestOrigin?: string;
 }
@@ -594,7 +596,7 @@ export declare function parseDeviceLinkTargetFactorActionPayloadV1(value: unknow
     readonly activationId: string;
     readonly action: DeviceLinkTargetFactorActionV1;
 } | null;
-export type ProgressPayload = WalletFlowEvent | RegistrationTimingSpanV1 | DeviceLinkTargetFactorActivationProgressV1 | DeviceLinkEmailOtpBaseFactorSelectionProgressV1;
+export type ProgressPayload = import('./ownerNearOperation').OwnerNearSubmissionProgress | WalletFlowEvent | RegistrationTimingSpanV1 | DeviceLinkTargetFactorActivationProgressV1 | DeviceLinkEmailOtpBaseFactorSelectionProgressV1;
 export declare function isDeviceLinkTargetFactorActivationProgressV1(value: ProgressPayload): value is DeviceLinkTargetFactorActivationProgressV1;
 export declare function isRegistrationTimingSpanV1(value: unknown): value is RegistrationTimingSpanV1;
 export interface PMResultPayload {
@@ -622,7 +624,13 @@ export type ParentToChildEnvelope = RpcEnvelope<'PM_ACTIVATE_TRANSACTION_REVIEW'
     signedTransaction: string;
 }> | RpcEnvelope<'PING'> | RpcEnvelope<'PM_PREPARE_WALLET_RUNTIME'> | RpcEnvelope<'PM_SET_CONFIG', PMSetConfigPayload> | RpcEnvelope<'PM_CANCEL', PMCancelPayload> | RpcEnvelope<'PM_OPEN_AUTH_MENU', PMOpenAuthMenuPayload> | RpcEnvelope<'PM_CANCEL_AUTH_MENU', PMCancelAuthMenuPayload> | RpcEnvelope<'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH', PMResolveAuthMenuExternalAuthPayload> | RpcEnvelope<'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION', PMRedeemHostedWalletSeamsSessionPayload> | RpcEnvelope<'PM_REGISTER_WALLET', PMRegisterWalletPayload> | RpcEnvelope<'PM_ADD_WALLET_SIGNER', PMAddWalletSignerPayload> | RpcEnvelope<'PM_ADD_PASSKEY', PMAddPasskeyPayload> | RpcEnvelope<'PM_ACTIVATE_AUTH_METHOD', PMActivateAuthMethodPayload> | RpcEnvelope<'PM_GET_AUTH_METHOD_AVAILABILITY', PMActivateAuthMethodPayload> | RpcEnvelope<'PM_SET_AUTH_METHOD_ENABLED', PMActivateAuthMethodPayload & {
     enabled: boolean;
-}> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_UNLOCK_AUTH_METHOD', {
+}> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_EXTERNAL_AUTH', import('../../../../../shared-ts/src/auth/externalAuth').ExternalAuthCommand> | (RpcEnvelope<'PM_EXTERNAL_OWNER_AUTH', Extract<import('../../../../../shared-ts/src/auth/externalAuth').ExternalAuthCommand, {
+    action: 'associate' | 'unlink';
+}>> & {
+    payload: Extract<import('../../../../../shared-ts/src/auth/externalAuth').ExternalAuthCommand, {
+        action: 'associate' | 'unlink';
+    }>;
+}) | RpcEnvelope<'PM_UNLOCK_AUTH_METHOD', {
     walletId: string;
     walletAuthMethodId: string;
     method: WalletAuthMethodPlugin['kind'];
@@ -638,7 +646,9 @@ export type ParentToChildEnvelope = RpcEnvelope<'PM_ACTIVATE_TRANSACTION_REVIEW'
     readonly moveId: string;
 }> | RpcEnvelope<'PM_GET_WALLET_PLACEMENT', {
     readonly walletId: string;
-}> | RpcEnvelope<'PM_GET_WALLET_SESSION', PMGetWalletSessionPayload> | RpcEnvelope<'PM_GET_EXACT_WALLET_SESSION_STATE', PMGetExactWalletSessionStatePayload> | RpcEnvelope<'PM_GET_NEAR_PROVISIONING_STATE', PMGetNearProvisioningStatePayload> | RpcEnvelope<'PM_REQUEST_EMAIL_OTP_CHALLENGE', PMEmailOtpChallengePayload> | RpcEnvelope<'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH', PMGoogleEmailOtpWalletAuthStartPayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT', PMGoogleEmailOtpWalletAuthSubmitPayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GET_WALLET_RECOVERY_CODE_STATUS', PMWalletRecoveryOwnerPayload> | RpcEnvelope<'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP', PMWalletRecoveryOwnerPayload> | RpcEnvelope<'PM_ROTATE_WALLET_RECOVERY_CODES', PMRotateWalletRecoveryCodesPayload> | RpcEnvelope<'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE', PMRequestWalletCustodyEmailOtpChallengePayload> | RpcEnvelope<'PM_SIGN_TX_WITH_ACTIONS', PMSignTxPayload> | ReviewedTransactionEnvelope<RpcEnvelope<'PM_SIGN_AND_SEND_TX', PMSignAndSendTxPayload>> | RpcEnvelope<'PM_SEND_TRANSACTION', PMSendTxPayload> | RpcEnvelope<'PM_SIGN_DELEGATE_ACTION', PMSignDelegateActionPayload> | RpcEnvelope<'PM_SIGN_NEP413', PMSignNep413Payload> | ReviewedTransactionEnvelope<RpcEnvelope<'PM_SIGN_TEMPO', PMSignTempoPayload>> | RpcEnvelope<'PM_REPORT_TEMPO_BROADCAST_ACCEPTED', PMReportTempoBroadcastAcceptedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_BROADCAST_REJECTED', PMReportTempoBroadcastRejectedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_FINALIZED', PMReportTempoFinalizedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_DROPPED_OR_REPLACED', PMReportTempoDroppedOrReplacedPayload> | RpcEnvelope<'PM_RECONCILE_TEMPO_NONCE_LANE', PMReconcileTempoNonceLanePayload> | RpcEnvelope<'PM_RESOLVE_EXACT_KEY_EXPORT_LANE', PMResolveExactKeyExportLanePayload> | RpcEnvelope<'PM_EXPORT_KEYPAIR_UI', PMExportKeypairUiPayload> | RpcEnvelope<'PM_GET_RECENT_UNLOCKS'> | RpcEnvelope<'PM_SET_CONFIRM_BEHAVIOR', PMSetConfirmBehaviorPayload> | RpcEnvelope<'PM_SET_CONFIRMATION_CONFIG', PMSetConfirmationConfigPayload> | RpcEnvelope<'PM_GET_CONFIRMATION_CONFIG'> | RpcEnvelope<'PM_HAS_PASSKEY', PMHasPasskeyPayload> | RpcEnvelope<'PM_LIST_LINKED_DEVICES', PMListLinkedDevicesPayload> | RpcEnvelope<'PM_REVOKE_LINKED_DEVICE', PMRevokeLinkedDevicePayload> | RpcEnvelope<'PM_SCAN_AND_LINK_DEVICE', {
+}> | RpcEnvelope<'PM_GET_WALLET_SESSION', PMGetWalletSessionPayload> | RpcEnvelope<'PM_GET_EXACT_WALLET_SESSION_STATE', PMGetExactWalletSessionStatePayload> | RpcEnvelope<'PM_GET_NEAR_PROVISIONING_STATE', PMGetNearProvisioningStatePayload> | RpcEnvelope<'PM_REQUEST_EMAIL_OTP_CHALLENGE', PMEmailOtpChallengePayload> | RpcEnvelope<'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH', PMGoogleEmailOtpWalletAuthStartPayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT', PMGoogleEmailOtpWalletAuthSubmitPayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL', PMGoogleEmailOtpWalletAuthHandlePayload> | RpcEnvelope<'PM_GET_WALLET_RECOVERY_CODE_STATUS', PMWalletRecoveryOwnerPayload> | RpcEnvelope<'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP', PMWalletRecoveryOwnerPayload> | RpcEnvelope<'PM_ROTATE_WALLET_RECOVERY_CODES', PMRotateWalletRecoveryCodesPayload> | RpcEnvelope<'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE', PMRequestWalletCustodyEmailOtpChallengePayload> | (RpcEnvelope<'PM_OWNER_NEAR_TRANSACTION', OwnerNearCommand> & {
+    payload: OwnerNearCommand;
+}) | RpcEnvelope<'PM_SIGN_TX_WITH_ACTIONS', PMSignTxPayload> | ReviewedTransactionEnvelope<RpcEnvelope<'PM_SIGN_AND_SEND_TX', PMSignAndSendTxPayload>> | RpcEnvelope<'PM_SEND_TRANSACTION', PMSendTxPayload> | RpcEnvelope<'PM_SIGN_DELEGATE_ACTION', PMSignDelegateActionPayload> | RpcEnvelope<'PM_SIGN_NEP413', PMSignNep413Payload> | ReviewedTransactionEnvelope<RpcEnvelope<'PM_SIGN_TEMPO', PMSignTempoPayload>> | RpcEnvelope<'PM_REPORT_TEMPO_BROADCAST_ACCEPTED', PMReportTempoBroadcastAcceptedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_BROADCAST_REJECTED', PMReportTempoBroadcastRejectedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_FINALIZED', PMReportTempoFinalizedPayload> | RpcEnvelope<'PM_REPORT_TEMPO_DROPPED_OR_REPLACED', PMReportTempoDroppedOrReplacedPayload> | RpcEnvelope<'PM_RECONCILE_TEMPO_NONCE_LANE', PMReconcileTempoNonceLanePayload> | RpcEnvelope<'PM_RESOLVE_EXACT_KEY_EXPORT_LANE', PMResolveExactKeyExportLanePayload> | RpcEnvelope<'PM_EXPORT_KEYPAIR_UI', PMExportKeypairUiPayload> | RpcEnvelope<'PM_GET_RECENT_UNLOCKS'> | RpcEnvelope<'PM_SET_CONFIRM_BEHAVIOR', PMSetConfirmBehaviorPayload> | RpcEnvelope<'PM_SET_CONFIRMATION_CONFIG', PMSetConfirmationConfigPayload> | RpcEnvelope<'PM_GET_CONFIRMATION_CONFIG'> | RpcEnvelope<'PM_HAS_PASSKEY', PMHasPasskeyPayload> | RpcEnvelope<'PM_LIST_LINKED_DEVICES', PMListLinkedDevicesPayload> | RpcEnvelope<'PM_REVOKE_LINKED_DEVICE', PMRevokeLinkedDevicePayload> | RpcEnvelope<'PM_SCAN_AND_LINK_DEVICE', {
     qrData: QrLinkedDeviceSessionPayloadV5;
     options?: {
         confirmationConfig?: Partial<ConfirmationConfig>;

package/dist/types/wallet/src/SeamsWeb/walletIframe/shared/ownerNearOperation.d.ts

@@ -0,0 +1,51 @@
+import { type SigningOperationId } from '../../../core/signingEngine/session/operationState/types';
+import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type AccountId } from '../../../core/types/accountIds';
+import { type TransactionInputWasm } from '../../../core/types/actions';
+import type { ActionResult } from '../../../core/types/seams';
+import { type ExternalWalletAuthentication } from '../../../../../shared-ts/src/auth/externalAuth';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
+export type OwnerNearRecovery = Readonly<{
+    operationId: SigningOperationId;
+    walletId: WalletId;
+    nearAccountId: AccountId;
+}>;
+export type OwnerNearCommand = Readonly<{
+    authentication: ExternalWalletAuthentication;
+    recovery: OwnerNearRecovery;
+}> & ReadonlyExclusiveUnion<{
+    action: 'approve';
+    transaction: TransactionInputWasm;
+    expiresAtMs: number;
+} | {
+    action: 'recover';
+}>;
+export type OwnerNearOutcome = ReadonlyExclusiveUnion<{
+    kind: 'completed';
+    result: Extract<ActionResult, {
+        success: true;
+    }>;
+} | {
+    kind: 'reverted';
+    transactionId: string;
+    error: string;
+} | {
+    kind: 'cancelled';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'unknown';
+    recovery: OwnerNearRecovery;
+} | {
+    kind: 'failed';
+    error: string;
+}>;
+export declare function parseOwnerNearRecovery(raw: unknown): OwnerNearRecovery;
+export declare function parseOwnerNearCommand(raw: unknown): OwnerNearCommand;
+export declare function parseOwnerNearOutcome(raw: unknown): OwnerNearOutcome;
+export type OwnerNearSubmissionProgress = Readonly<{
+    event: 'owner_near_submitting';
+    operationId: SigningOperationId;
+}>;
+export declare function parseOwnerNearSubmissionProgress(raw: unknown): OwnerNearSubmissionProgress | null;
+//# sourceMappingURL=ownerNearOperation.d.ts.map

package/dist/types/wallet/src/core/authMethods/plugins.d.ts

@@ -1,5 +1,7 @@
+export type VoiceIdTranscriptionModel = 'aurora' | 'citrinet';
 export type VoiceIdAuthMethodPlugin = Readonly<{
     kind: 'voiceid';
+    transcriptionModel?: VoiceIdTranscriptionModel;
 }>;
 export type VoiceIdConfirmationOptions = Readonly<{
     /** App wording used only to select an action-only challenge. Maximum 256 characters. */

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/registrationSetup.d.ts

@@ -24,6 +24,7 @@ export declare class RegistrationSetupRepository {
     private readonly manager;
     constructor(manager: SeamsWalletDBManager);
     begin(scopeDigest: string, request: {
+        readonly completion: import('../../../../../shared-ts/src/utils/registrationIntent').RegistrationCompletion;
         readonly wallet: RegisterWalletInput;
         readonly authMethod: RegistrationAuthMethodInput;
         readonly signerSelection: RegistrationSignerSetSelection;

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/repositories.d.ts

@@ -177,6 +177,10 @@ export type StoreWalletRegistrationPublicationInputV1 = Omit<StoreWalletRegistra
     };
 };
 type WalletRegistrationSessionPublicationV1 = {
+    readonly kind: 'owner_operations';
+    readonly walletSession?: never;
+    readonly operationCredential?: never;
+} | {
     readonly kind: 'issued';
     readonly walletSession: ActiveWalletSessionV1;
     readonly operationCredential: WalletSessionOperationCredentialV1;

package/dist/types/wallet/src/core/rpcClients/near/NearClient.d.ts

@@ -39,4 +39,8 @@ export declare class MinimalNearClient extends NearJsonRpcClient<SignedTransacti
     protected errorFromHttpStatus(response: Response): Error;
     protected sendWithRetry<T>(send: () => Promise<T>): Promise<T>;
 }
+/** An owner operation records its hash before one broadcast and then recovers by status. */
+export declare class OwnerOperationNearClient extends MinimalNearClient {
+    protected sendWithRetry<T>(send: () => Promise<T>): Promise<T>;
+}
 //# sourceMappingURL=NearClient.d.ts.map

package/dist/types/wallet/src/core/rpcClients/relayer/walletRecoveryRotate.d.ts

@@ -1,5 +1,5 @@
 import { type WalletRecoverySetRotationWireV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet';
-import type { WalletCustodyAdminOperation } from '../../../../../shared-ts/src/authorization/walletCustodyOperation';
+import type { WalletOwnerAdminOperation } from '../../../../../shared-ts/src/authorization/walletOwnerOperation';
 import type { WebAuthnAuthenticationCredential } from '../../types/webauthn';
 export type WalletCustodyFactorProof = {
     readonly kind: 'passkey';
@@ -32,7 +32,7 @@ export declare function requestWalletCustodyEmailOtpChallenge(args: {
     readonly relayUrl: string;
     readonly walletId: string;
     readonly providerSubjectId: string;
-    readonly operation: WalletCustodyAdminOperation;
+    readonly operation: WalletOwnerAdminOperation;
     readonly payload: Record<string, unknown>;
     readonly requestOrigin?: string;
     readonly fetchImpl?: typeof fetch;

package/dist/types/wallet/src/core/rpcClients/relayer/walletRegistration.d.ts

@@ -502,6 +502,7 @@ export type WalletEcdsaKeyFactsInventoryResponse = {
 export declare function setupWalletRegistration(args: {
     relayerUrl: string;
     request: {
+        completion?: RegistrationIntentV1['completion'];
         wallet?: RegisterWalletInput;
         signerSelection: CreateRegistrationIntentRequest['signerSelection'];
         authMethod: CreateRegistrationIntentRequest['authMethod'];

package/dist/types/wallet/src/core/signingEngine/session/passkey/ed25519YaoLocalMaterial.d.ts

@@ -1,3 +1,4 @@
+import type { KeyMaterialRecord } from '../../../indexedDB/keyMaterial.types';
 import { type AccountKeyMaterialDeps } from '../../../indexedDB/accountKeyMaterial';
 import type { NearEd25519YaoOperationMaterial, NearResolvedEd25519SigningSessionState } from '../../interfaces/near';
 import { type ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
@@ -5,6 +6,7 @@ import { type RouterAbEd25519NormalSigningState } from '../../threshold/ed25519/
 import { type RouterAbEd25519YaoActiveClientV1, type RouterAbEd25519YaoSealableActiveClientV1 } from '../../threshold/ed25519/yaoClient';
 import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type NearEd25519YaoPublicLocatorObservationV1 } from '../material/nearEd25519YaoMaterialActivation';
+import type { RouterAbEd25519YaoRecoveryActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { buildRestorableMpcMaterialRefInternal } from '../material/restorableMpcMaterialRef.internal';
 import type { MpcCapabilityHydrationPlan } from '../material/mpcCapabilityHydration';
@@ -62,6 +64,11 @@ type PersistPasskeyEd25519YaoSignerMaterialInputV1 = {
     stableServerScope: PasskeyEd25519YaoStableServerScopeV1;
     passkeyPrfFirstB64u: string;
 };
+type PasskeyEd25519YaoLocalMaterialTargetV1 = {
+    profileId: string;
+    chainIdKey: string;
+    accountAddress: string;
+};
 type HydratePasskeyEd25519YaoLocalMaterialResultV1 = {
     kind: 'live';
     plan: Extract<MpcCapabilityHydrationPlan, {
@@ -107,6 +114,20 @@ export type PasskeyEd25519YaoPublicLocatorObservationV1 = Omit<Extract<NearEd255
     kind: 'available';
 }>;
 export declare function ed25519YaoLocalMaterialIdentityFromWalletSession(walletSessionState: NearResolvedEd25519SigningSessionState, rpId: string, credentialIdB64u: string): Ed25519YaoLocalMaterialIdentity;
+export declare function buildPasskeyEd25519YaoLocalMaterialRecordV1(input: {
+    target: PasskeyEd25519YaoLocalMaterialTargetV1;
+    activeClient: RouterAbEd25519YaoSealableActiveClientV1;
+    identity: Ed25519YaoLocalMaterialIdentity;
+    stableServerScope: PasskeyEd25519YaoStableServerScopeV1;
+    ownedPasskeyPrfFirst: Uint8Array;
+    lifecycle: {
+        kind: 'registration_or_rehydration';
+        promotionReceipt?: never;
+    } | {
+        kind: 'recovery_promotion';
+        promotionReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;
+    };
+}): KeyMaterialRecord;
 export declare function persistPasskeyEd25519YaoSignerMaterialV1(input: PersistPasskeyEd25519YaoSignerMaterialInputV1): Promise<void>;
 export declare function readPasskeyEd25519YaoLocalMaterialLocatorV1(input: ReadPasskeyEd25519YaoLocalMaterialLocatorInputV1): Promise<ReadPasskeyEd25519YaoLocalMaterialLocatorResultV1>;
 export declare function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input: {