@seams/wallet 0.28.0 → 0.29.0

package/README.md

@@ -1,19 +1,19 @@
 # Seams Wallet SDK
 
-`@seams/wallet` **0.17.0** provides browser wallet lifecycle, NEAR and EVM-family
+`@seams/wallet` **0.29.0** provides browser wallet lifecycle, NEAR and EVM-family
 threshold signing, React components, and hosted wallet runtime assets.
 
 ## Install
 
 ```sh
-pnpm add @seams/wallet@0.17.0
+pnpm add @seams/wallet@0.29.0
 ```
 
 React integrations support React 18 and 19. Import the provider and UI from
 `@seams/wallet/react` and its stylesheet from `@seams/wallet/react/styles`.
 Keep the application package, wallet-origin assets, and
-`@seams/wallet-server@0.17.0` on the matching release. The wallet iframe protocol
-is `16.0.0`. The application and wallet host must use the same protocol version.
+`@seams/wallet-server@0.29.0` on the matching release. The wallet iframe protocol
+is `19.0.0`. The application and wallet host must use the same protocol version.
 
 ## Current API
 
@@ -46,6 +46,31 @@ The SDK selects signers and completes pending activation internally.
 Request email codes only after a user chooses that method. The wallet host owns
 the challenge and its expiry. The application receives the typed challenge handle.
 
+## Application sessions and fresh owner approval
+
+SDK 0.29.0 accepts a handoff from an explicitly trusted application backend.
+Google and app-passkey login can use the same stable application user ID.
+Use `registration.registerOwnerWallet` for NEAR-only passkey onboarding and `near.prepareOwnerTransaction` for fresh approval of each transaction.
+These operations create no reusable signing authority.
+React read connections expose owner-operation handles separately from reusable signers.
+See the [application-session guide](https://wallet.seams.sh/docs/guides/application-auth).
+
+## Bring your own Google authentication
+
+SDK 0.29.0 can reuse an application's Google ID token to open associated wallet settings.
+Configure the environment's Google client ID and let the owner associate their wallet once.
+Then pass the token after the application's existing Google login:
+
+```ts
+const result = await seams.auth.authenticate({ method: 'google', walletId, idToken });
+if (!result.ok) throw new Error(result.code);
+```
+
+Apps that retain the token on their backend use `prepareExternalAuth` and a browser-bound handoff.
+Call `seams.auth.lock()` when the app logs out or switches accounts.
+These sessions grant settings reads. Signing, export, recovery, and security changes retain their owner authentication requirements.
+See the [Google SSO guide](https://wallet.seams.sh/docs/guides/google-sso) for both exchange paths, association, expiry, and revocation.
+
 ## React quick start
 
 The three required values are the wallet origin, Gateway/relayer URL, and

package/dist/.build-inputs.sha256

@@ -1 +1 @@
-ea177740b9a568b4deea722dc18528d4cbfd4098970381660360b3bd1003291b
+810cdbbc2f95b4a48d4b1ce36a3ab524ffd0f3efff7c5a8eeb00d48a8c98c70c

package/dist/esm/SeamsWeb/publicApi/createPublicApi.js

@@ -42,6 +42,7 @@ function createPublicApi(deps) {
 			setAuthMethodEnabled: deps.registration.setAuthMethodEnabled,
 			addEmail: deps.registration.addEmail,
 			removeAuthMethod: deps.registration.removeAuthMethod,
+			registerOwnerWallet: registerOwnerWallet.bind(null, deps.registration),
 			registerWallet: registerWallet.bind(null, deps.registration, deps.configs)
 		},
 		recovery: deps.recovery,
@@ -66,6 +67,7 @@ async function registerWallet(commands, configs, args) {
 			options: args.options ?? {}
 		}) : args.signerSelection;
 		command = {
+			completion: "wallet_session",
 			authMethod: args.authMethod,
 			wallet,
 			signerSelection,
@@ -120,6 +122,15 @@ function createReviewedCapabilities(deps, reservation) {
 		evm: evmFamily.evm
 	};
 }
+async function registerOwnerWallet(commands, args) {
+	return await commands.registerWallet({
+		completion: "owner_operations",
+		authMethod: args.authMethod,
+		wallet: args.wallet ?? { kind: "server_allocated" },
+		signerSelection: args.signerSelection,
+		options: args.options
+	});
+}
 //#endregion
 export { createApplicationPublicApi };
 

package/dist/esm/SeamsWeb/publicApi/near.js

@@ -2,12 +2,15 @@ import { CAPABILITY_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../shared
 import { toError } from "../../shared-ts/src/utils/errors.js";
 import { nearTransactionFailure } from "../../core/signingEngine/nearTransactionSubmission.js";
 import { requireBrowserCapabilityOperation } from "./capabilitySelection.js";
+import { prepareOwnerNearTransaction, resumeOwnerNearTransaction } from "./ownerNearOperation.js";
 import { accountExists } from "../../core/rpcClients/near/accountExists.js";
 import { delegateRelayerAuthFromConfigs, sendDelegateAction } from "../operations/near/delegateAction.js";
 //#region src/SeamsWeb/publicApi/near.ts
 function createNearSignerCapability(deps) {
 	const signer = new NearSigner(deps);
 	return {
+		prepareOwnerTransaction: prepareOwnerNearTransaction.bind(null, deps.commands.ownerOperation),
+		resumeOwnerTransaction: resumeOwnerNearTransaction.bind(null, deps.commands.ownerOperation),
 		accountExists: accountExists.bind(null, deps.nearClient),
 		signAndSendTransaction: signer.signAndSendTransaction.bind(signer),
 		signTransaction: signer.signTransaction.bind(signer),

package/dist/esm/SeamsWeb/publicApi/ownerNearOperation.js

@@ -0,0 +1,175 @@
+import { secureRandomBase64Url } from "../../shared-ts/src/utils/secureRandomId.js";
+import { SigningSessionIds } from "../../core/signingEngine/session/operationState/types.js";
+import { toAccountId } from "../../core/types/accountIds.js";
+import { toActionArgsWasm } from "../../shared-ts/src/near/actions.js";
+import { parseOwnerNearCommand, parseOwnerNearRecovery } from "../walletIframe/shared/ownerNearOperation.js";
+//#region src/SeamsWeb/publicApi/ownerNearOperation.ts
+function prepareOwnerNearTransaction(execute, input) {
+	const recovery = {
+		operationId: SigningSessionIds.signingOperation(`owner-near:${secureRandomBase64Url(32, "owner NEAR operation IDs")}`),
+		walletId: input.authentication.walletId,
+		nearAccountId: toAccountId(input.nearAccountId)
+	};
+	const command = parseOwnerNearCommand({
+		action: "approve",
+		authentication: input.authentication,
+		recovery,
+		expiresAtMs: Math.min(input.authentication.expiresAtMs, Date.now() + 12e4),
+		transaction: {
+			receiverId: input.transaction.receiverId,
+			actions: input.transaction.actions.map(toActionArgsWasm)
+		}
+	});
+	if (command.action !== "approve") throw new Error("Invalid prepared owner operation.");
+	return new OwnerNearTransaction(execute, command, {
+		kind: "prepared",
+		recovery,
+		expiresAtMs: command.expiresAtMs
+	});
+}
+function resumeOwnerNearTransaction(execute, input) {
+	const recovery = parseOwnerNearRecovery(input.recovery);
+	return new OwnerNearTransaction(execute, parseOwnerNearCommand({
+		action: "recover",
+		authentication: input.authentication,
+		recovery
+	}), {
+		kind: "unknown",
+		recovery
+	});
+}
+var OwnerNearTransaction = class {
+	controller = new AbortController();
+	listeners = /* @__PURE__ */ new Set();
+	inFlight = null;
+	constructor(execute, command, state) {
+		this.execute = execute;
+		this.command = command;
+		this.state = state;
+	}
+	getState() {
+		return this.state;
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return this.removeListener.bind(this, listener);
+	}
+	removeListener(listener) {
+		this.listeners.delete(listener);
+	}
+	transition(state) {
+		this.state = state;
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+	}
+	approve() {
+		if (this.inFlight) return this.inFlight;
+		if (this.command.action !== "approve" || this.state.kind !== "prepared") throw new Error("This operation cannot request another approval.");
+		if (this.command.expiresAtMs <= Date.now()) {
+			this.transition({
+				kind: "expired",
+				recovery: this.command.recovery
+			});
+			return Promise.resolve({ kind: "expired" });
+		}
+		this.transition({
+			kind: "approval",
+			recovery: this.command.recovery,
+			expiresAtMs: this.command.expiresAtMs
+		});
+		this.inFlight = this.run(this.command);
+		return this.inFlight;
+	}
+	cancel() {
+		if (this.state.kind === "prepared") {
+			this.controller.abort();
+			this.transition({
+				kind: "cancelled",
+				recovery: this.command.recovery
+			});
+		} else if (this.state.kind === "approval") this.controller.abort();
+	}
+	recover() {
+		if (this.inFlight) return this.inFlight;
+		if (this.state.kind !== "unknown") throw new Error("Only an unknown outcome requires recovery.");
+		this.inFlight = this.run({
+			action: "recover",
+			authentication: this.command.authentication,
+			recovery: this.state.recovery
+		});
+		return this.inFlight;
+	}
+	submitted() {
+		this.transition({
+			kind: "submitting",
+			recovery: this.command.recovery
+		});
+	}
+	async run(command) {
+		let outcome;
+		try {
+			outcome = await this.execute(command, {
+				signal: command.action === "recover" ? new AbortController().signal : this.controller.signal,
+				onSubmission: this.submitted.bind(this)
+			});
+		} catch {
+			outcome = {
+				kind: "unknown",
+				recovery: command.recovery
+			};
+		}
+		this.settle(outcome, command.recovery);
+		this.inFlight = null;
+		return outcome;
+	}
+	settle(outcome, recovery) {
+		switch (outcome.kind) {
+			case "completed":
+				this.transition({
+					kind: "completed",
+					recovery,
+					result: outcome.result
+				});
+				return;
+			case "reverted":
+				this.transition({
+					kind: "reverted",
+					recovery,
+					transactionId: outcome.transactionId,
+					error: outcome.error
+				});
+				return;
+			case "cancelled":
+				this.transition({
+					kind: "cancelled",
+					recovery
+				});
+				return;
+			case "expired":
+				this.transition({
+					kind: "expired",
+					recovery
+				});
+				return;
+			case "unknown":
+				this.transition({
+					kind: "unknown",
+					recovery: outcome.recovery
+				});
+				return;
+			case "failed":
+				this.transition({
+					kind: "failed",
+					recovery,
+					error: outcome.error
+				});
+				return;
+			default: throw new Error("Unsupported owner operation outcome.");
+		}
+	}
+};
+//#endregion
+export { prepareOwnerNearTransaction, resumeOwnerNearTransaction };
+
+//# sourceMappingURL=ownerNearOperation.js.map

package/dist/esm/SeamsWeb/walletIframe/client/nearCommands.js

@@ -4,6 +4,7 @@ import { nearTransactionFailure, notifyNearTransactionResult } from "../../../co
 function createApplicationNearCommands(walletIframe, beforeSigning, transactionDispatch) {
 	const commands = new ApplicationNearCommands(walletIframe, beforeSigning, transactionDispatch);
 	return {
+		ownerOperation: commands.ownerOperation.bind(commands),
 		signAndSendTransaction: commands.signAndSendTransaction.bind(commands),
 		signTransaction: commands.signTransaction.bind(commands),
 		sendTransaction: commands.sendTransaction.bind(commands),
@@ -17,6 +18,9 @@ var ApplicationNearCommands = class {
 		this.beforeSigning = beforeSigning;
 		this.transactionDispatch = transactionDispatch;
 	}
+	async ownerOperation(...args) {
+		return await (await this.walletIframe.requireRouter()).ownerNearOperation(...args);
+	}
 	async signAndSendTransaction(args) {
 		const walletIframe = this.walletIframe;
 		const nearAccountId = args.nearAccount.accountId;

package/dist/esm/SeamsWeb/walletIframe/client/ownerNearOperation.js

@@ -0,0 +1,67 @@
+import { parseOwnerNearOutcome, parseOwnerNearSubmissionProgress } from "../shared/ownerNearOperation.js";
+//#region src/SeamsWeb/walletIframe/client/ownerNearOperation.ts
+async function executeOwnerNearRequest(ports, ...args) {
+	const [command, execution] = args;
+	return await new OwnerNearRequest(ports, command, execution).run();
+}
+var OwnerNearRequest = class {
+	requestId;
+	state = "preparing";
+	constructor(ports, command, execution) {
+		this.ports = ports;
+		this.command = command;
+		this.execution = execution;
+		this.requestId = ports.allocateRequestId();
+	}
+	current() {
+		return !this.execution.signal.aborted;
+	}
+	dispatched() {
+		this.state = "dispatched";
+	}
+	progress(payload) {
+		if (parseOwnerNearSubmissionProgress(payload)?.operationId === this.command.recovery.operationId) {
+			this.state = "submitting";
+			this.execution.onSubmission();
+		}
+	}
+	cancel() {
+		this.ports.cancelRequest(this.requestId).catch(ignoreCancellationFailure);
+	}
+	async run() {
+		if (!this.current()) return { kind: "cancelled" };
+		const cancel = this.cancel.bind(this);
+		this.execution.signal.addEventListener("abort", cancel, { once: true });
+		try {
+			return parseOwnerNearOutcome((await this.ports.post({
+				type: "PM_OWNER_NEAR_TRANSACTION",
+				payload: this.command,
+				options: { onProgress: this.progress.bind(this) }
+			}, {
+				requestId: this.requestId,
+				timeout: "interactive",
+				shouldContinue: this.current.bind(this),
+				onDispatched: this.dispatched.bind(this)
+			})).result);
+		} catch (error) {
+			if (this.state !== "submitting" && isOwnerRequestCancellation(error)) return { kind: "cancelled" };
+			if (this.state === "preparing" && !this.current()) return { kind: "cancelled" };
+			return {
+				kind: "unknown",
+				recovery: this.command.recovery
+			};
+		} finally {
+			this.execution.signal.removeEventListener("abort", cancel);
+		}
+	}
+};
+function ignoreCancellationFailure() {}
+function isOwnerRequestCancellation(error) {
+	if (!error || typeof error !== "object") return false;
+	const code = Reflect.get(error, "code");
+	return code === "cancelled" || code === "wallet_operation_step_up_cancelled";
+}
+//#endregion
+export { executeOwnerNearRequest };
+
+//# sourceMappingURL=ownerNearOperation.js.map

package/dist/esm/SeamsWeb/walletIframe/client/progress/on-events-progress-bus.js

@@ -86,23 +86,7 @@ var OnEventsProgressBus = class {
 			});
 			return true;
 		}
-		this.log("dispatch-miss", isWalletFlowEvent(payload) ? {
-			requestId,
-			flow: payload.flow,
-			phase: payload.phase,
-			status: payload.status
-		} : isDeviceLinkTargetFactorActivationProgressV1(payload) ? {
-			requestId,
-			event: payload.event,
-			activationKind: payload.activation.kind
-		} : isDeviceLinkEmailOtpBaseFactorSelectionProgressV1(payload) ? {
-			requestId,
-			event: payload.event,
-			choiceCount: payload.choices.length
-		} : {
-			requestId,
-			span: payload.span
-		});
+		this.log("dispatch-miss", progressDebugFields(requestId, payload));
 		return false;
 	}
 	findSticky(requestId) {
@@ -129,6 +113,32 @@ var OnEventsProgressBus = class {
 		} catch {}
 	}
 };
+function progressDebugFields(requestId, payload) {
+	if (isWalletFlowEvent(payload)) return {
+		requestId,
+		flow: payload.flow,
+		phase: payload.phase,
+		status: payload.status
+	};
+	if (isDeviceLinkTargetFactorActivationProgressV1(payload)) return {
+		requestId,
+		event: payload.event,
+		activationKind: payload.activation.kind
+	};
+	if (isDeviceLinkEmailOtpBaseFactorSelectionProgressV1(payload)) return {
+		requestId,
+		event: payload.event,
+		choiceCount: payload.choices.length
+	};
+	if (payload.event === "owner_near_submitting") return {
+		requestId,
+		event: payload.event
+	};
+	return {
+		requestId,
+		span: payload.span
+	};
+}
 //#endregion
 export { OnEventsProgressBus };
 

package/dist/esm/SeamsWeb/walletIframe/client/router.js

@@ -25,6 +25,7 @@ import { resolveRuntimeAppearance } from "../shared/facadeBoundary.js";
 import { TransactionReviewError, assertTransactionReviewValid, parseTransactionReviewState, reviewedConfirmationConfig, sameTransactionReviewIdentity, transactionReviewCancellationCode } from "../shared/transactionReview.js";
 import { needsExplicitActivation } from "../../../utils/deviceDetection.js";
 import { hostedAuthMenuAnchorMetrics, markHostedAuthMenuAnchorReady, publishHostedAuthMenuAnchorHeight } from "./authMenuAnchor.js";
+import { executeOwnerNearRequest } from "./ownerNearOperation.js";
 import { parseAuthMethodAvailability } from "../../../core/authMethods/availabilityTypes.js";
 import { TransactionReviewReservation } from "./transactionReviewReservation.js";
 import { OnEventsProgressBus } from "./progress/on-events-progress-bus.js";
@@ -44,6 +45,8 @@ function requestSurfaceKindForMessage(type, payload) {
 		case "PM_ADD_PASSKEY":
 		case "PM_ROTATE_WALLET_RECOVERY_CODES": return "registration";
 		case "PM_ACTIVATE_AUTH_METHOD": return "auth_method_activation";
+		case "PM_EXTERNAL_OWNER_AUTH":
+		case "PM_OWNER_NEAR_TRANSACTION": return "owner_approval";
 		case "PM_ADD_EMAIL_OTP": return "email_otp_enrollment";
 		case "PM_GET_WALLET_RECOVERY_CODE_STATUS":
 		case "PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP": return "recovery_codes";
@@ -94,6 +97,7 @@ function requestSurfacePresentationFor(kind, payload, fallbackUiMode) {
 		case "registration": return modalWalletIframeSurfacePresentation("Confirm passkey registration");
 		case "email_otp_enrollment": return confirmationUiModeForRequest("PM_ADD_EMAIL_OTP", payload, fallbackUiMode) === "drawer" ? drawerWalletIframeSurfacePresentation("Enter email code") : modalWalletIframeSurfacePresentation("Enter email code");
 		case "auth_method_activation": return modalWalletIframeSurfacePresentation("Activate authentication method");
+		case "owner_approval": return modalWalletIframeSurfacePresentation("Approve wallet operation");
 		case "transaction": return effectiveTransactionSurfaceUiMode(payload, fallbackUiMode) === "drawer" ? drawerWalletIframeSurfacePresentation("Confirm transaction") : modalWalletIframeSurfacePresentation("Confirm transaction");
 		case "key_export_near":
 		case "key_export_threshold": return confirmationUiModeForRequest("PM_EXPORT_KEYPAIR_UI", payload, fallbackUiMode) === "drawer" ? drawerWalletIframeSurfacePresentation("Confirm key export") : modalWalletIframeSurfacePresentation("Confirm key export");
@@ -201,6 +205,7 @@ function walletIframeSessionStatesEqual(left, right) {
 	if (left === null || left.kind !== right.kind) return false;
 	switch (left.kind) {
 		case "wallet_locked": return right.kind === "wallet_locked";
+		case "external_read": return right.kind === "external_read" && left.walletId === right.walletId && left.externalSessionId === right.externalSessionId && left.expiresAtMs === right.expiresAtMs;
 		case "active_session":
 		case "expired_session": return (right.kind === "active_session" || right.kind === "expired_session") && exactSessionIdentitiesMatch(left, right) && left.authMethod === right.authMethod && left.expiresAtMs === right.expiresAtMs;
 		case "wallet_authenticated_identity_unresolvable": return right.kind === left.kind && left.walletId === right.walletId && left.reason === right.reason;
@@ -213,6 +218,7 @@ function walletIframeSessionStatesEqual(left, right) {
 }
 function walletIframeLoginStatusFromExactSession(state) {
 	switch (state.kind) {
+		case "external_read":
 		case "active_session":
 		case "expired_session":
 		case "wallet_authenticated_identity_unresolvable":
@@ -1155,6 +1161,7 @@ var WalletIframeRouter = class {
 				break;
 			case "email_otp_enrollment":
 			case "auth_method_activation":
+			case "owner_approval":
 				result = this.transitionWalletIframeSurface({
 					kind: "transaction_modal_request_started",
 					connectionId,
@@ -1605,7 +1612,7 @@ var WalletIframeRouter = class {
 	acceptSessionSnapshot(snapshot) {
 		if (snapshot.revision <= this.sessionObservationRevision) return false;
 		const walletId = this.lastPreferencesChangedPayload?.walletId;
-		if (walletId !== void 0 && walletId !== snapshot.walletId) return false;
+		if (snapshot.state.kind !== "external_read" && walletId !== void 0 && walletId !== snapshot.walletId) return false;
 		const changed = !walletIframeSessionStatesEqual(this.exactSessionState, snapshot.state);
 		this.sessionObservationRevision = snapshot.revision;
 		this.updateReviewSession(snapshot.state);
@@ -1768,6 +1775,7 @@ var WalletIframeRouter = class {
 		return (await this.post({
 			type: "PM_REGISTER_WALLET",
 			payload: {
+				completion: payload.completion,
 				authMethod: transport.authMethod,
 				wallet: payload.wallet,
 				signerSelection: registrationSignerSetRequestSelection(payload.signerSelection),
@@ -1923,23 +1931,31 @@ var WalletIframeRouter = class {
 	}
 	async removeExternalAuth(input) {
 		return (await this.post({
-			type: "PM_EXTERNAL_AUTH",
+			type: "PM_EXTERNAL_OWNER_AUTH",
 			payload: {
 				action: "unlink",
 				walletId: input.walletId,
 				associationId: input.associationId
 			}
+		}, { timeout: "interactive" })).result;
+	}
+	async prepareExternalAssociation(walletId) {
+		return (await this.post({
+			type: "PM_EXTERNAL_AUTH",
+			payload: {
+				action: "prepare_association",
+				walletId
+			}
 		})).result;
 	}
 	async associateExternalAuth(input) {
 		return (await this.post({
-			type: "PM_EXTERNAL_AUTH",
+			type: "PM_EXTERNAL_OWNER_AUTH",
 			payload: {
 				action: "associate",
-				walletId: input.walletId,
-				idToken: input.idToken
+				input
 			}
-		})).result;
+		}, { timeout: "interactive" })).result;
 	}
 	async getWalletSession(walletId) {
 		const expectedWalletId = walletId === void 0 ? void 0 : parseRequestedWalletId(walletId);
@@ -2501,6 +2517,13 @@ var WalletIframeRouter = class {
 			} catch {}
 		};
 	}
+	async ownerNearOperation(...args) {
+		return await executeOwnerNearRequest({
+			post: this.post.bind(this),
+			cancelRequest: this.cancelRequest.bind(this),
+			allocateRequestId: this.allocateRequestId.bind(this)
+		}, ...args);
+	}
 	async signAndSendTransaction(payload, transactionDispatch = { kind: "ordinary" }) {
 		const request = new NearTransactionRequest({ kind: "sign_and_send" });
 		try {
@@ -2885,7 +2908,7 @@ var WalletIframeRouter = class {
 		const deadlineAtMs = timeoutPolicy.kind === "deadline" ? timeoutPolicy.deadlineAtMs : null;
 		const surfaceKind = requestSurfaceKindForMessage(envelope.type, full.payload);
 		let transactionSurfaceLease = null;
-		if (!reservation && (surfaceKind === "transaction" || surfaceKind === "email_otp_enrollment" || surfaceKind === "auth_method_activation")) {
+		if (!reservation && (surfaceKind === "transaction" || surfaceKind === "email_otp_enrollment" || surfaceKind === "auth_method_activation" || surfaceKind === "owner_approval")) {
 			const queueDeadline = timeoutPolicy.kind === "deadline" ? {
 				kind: "deadline",
 				atMs: timeoutPolicy.deadlineAtMs

package/dist/esm/SeamsWeb/walletIframe/client/sessionCommands.js

@@ -5,6 +5,7 @@ function createApplicationSessionCommands(walletIframe) {
 	return {
 		authenticate: authenticate.bind(null, walletIframe),
 		prepareExternalAuth: prepareExternalAuth.bind(null, walletIframe),
+		prepareExternalAssociation: prepareExternalAssociation.bind(null, walletIframe),
 		associateExternalAuth: associateExternalAuth.bind(null, walletIframe),
 		removeExternalAuth: removeExternalAuth.bind(null, walletIframe),
 		unlock: unlock.bind(null, walletIframe),
@@ -24,6 +25,9 @@ async function prepareExternalAuth(walletIframe, walletId) {
 async function associateExternalAuth(walletIframe, input) {
 	return (await walletIframe.requireRouter()).associateExternalAuth(input);
 }
+async function prepareExternalAssociation(walletIframe, walletId) {
+	return (await walletIframe.requireRouter()).prepareExternalAssociation(walletId);
+}
 async function removeExternalAuth(walletIframe, input) {
 	return (await walletIframe.requireRouter()).removeExternalAuth(input);
 }

package/dist/esm/SeamsWeb/walletIframe/host/walletMutationGuard.js

@@ -29,6 +29,11 @@ function walletForHostRequest(request, currentWalletId) {
 			return walletId === null ? null : requiredWallet(walletId);
 		}
 		case "PM_SCAN_AND_LINK_DEVICE": return currentWalletId === null ? null : requiredWallet(currentWalletId);
+		case "PM_OWNER_NEAR_TRANSACTION": return request.payload.action === "approve" ? requiredWallet(request.payload.authentication.walletId) : null;
+		case "PM_EXTERNAL_OWNER_AUTH": {
+			const command = request.payload;
+			return requiredWallet(command.action === "associate" ? command.input.walletId : command.walletId);
+		}
 		case "PM_SET_TRANSACTION_VIEW":
 		case "PM_TRANSACTION_BROADCAST_STARTED":
 		case "PING":

package/dist/esm/SeamsWeb/walletIframe/shared/exactSessionState.js

@@ -4,8 +4,8 @@ import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../.
 import { thresholdEcdsaChainTargetFromRequest } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
 import { isWalletAuthMethod } from "../../../shared-ts/src/utils/signerDomain.js";
+import { toAccountId } from "../../../core/types/accountIds.js";
 import { parseExternalWalletAuthentication, parseExternalWalletSettings } from "../../../shared-ts/src/auth/externalAuth.js";
 import { NonceCoordinatorDegradationReason, NonceCoordinatorFallback, NonceLeaseState } from "../../../core/signingEngine/nonce/nonceTypes.js";
 import { parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
@@ -30,6 +30,9 @@ function parseWalletIframeExactSessionSnapshot(value) {
 	const state = parseWalletIframeExactSessionState(record.state);
 	if (state.kind !== "wallet_locked" && state.walletId !== walletId) throw new Error("Wallet session snapshot identity differs from its projection");
 	const session = parseWalletSessionFromBoundary(record.session, state.kind === "wallet_locked" ? void 0 : state.walletId);
+	if (state.kind === "external_read") {
+		if (session.authentication.kind !== "external_authenticated" || session.authentication.walletId !== state.walletId || session.authentication.sessionId !== state.externalSessionId || session.authentication.expiresAtMs !== state.expiresAtMs) throw new Error("External read snapshot differs from its authenticated session");
+	} else if (session.authentication.kind === "external_authenticated") throw new Error("External authentication requires an external read state");
 	if (state.kind === "wallet_locked" && (session.authentication.kind !== "signed_out" || session.appIdentity.kind !== "anonymous")) throw new Error("Locked wallet snapshot must publish an anonymous session");
 	return {
 		revision: parseWalletIframeSessionRevision(record.revision),
@@ -42,6 +45,17 @@ function parseWalletIframeExactSessionState(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Wallet iframe exact session state must be an object");
 	switch (Reflect.get(value, "kind")) {
 		case "wallet_locked": return { kind: "wallet_locked" };
+		case "external_read": {
+			const expiresAtMs = Reflect.get(value, "expiresAtMs");
+			if (!isPositiveSafeInteger(expiresAtMs)) throw new Error("External read expiry is invalid");
+			if ("walletSessionId" in value || "authorizationId" in value || "authMethod" in value) throw new Error("External read state cannot contain signing authority");
+			return {
+				kind: "external_read",
+				walletId: requireWalletId(Reflect.get(value, "walletId")),
+				externalSessionId: requireNonEmptyString(Reflect.get(value, "externalSessionId"), "externalSessionId"),
+				expiresAtMs
+			};
+		}
 		case "wallet_authenticated_identity_unresolvable": return {
 			kind: "wallet_authenticated_identity_unresolvable",
 			walletId: requireWalletId(Reflect.get(value, "walletId")),

package/dist/esm/SeamsWeb/walletIframe/shared/messages.js

@@ -470,7 +470,7 @@ function parseHostedAuthMenuOutcome(value) {
 		default: return null;
 	}
 }
-const WALLET_PROTOCOL_VERSION = "18.0.0";
+const WALLET_PROTOCOL_VERSION = "19.0.0";
 const WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH = "WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH";
 const HOSTED_WALLET_REDEMPTION_PAYLOAD_FIELDS = [
 	"home",