@rhinestone/1auth 0.1.1 → 0.4.0

package/dist/index.mjs

@@ -1,5 +1,6 @@
 import {
   buildTransactionReview,
+  createOneAuthProvider,
   createPasskeyProvider,
   encodeWebAuthnSignature,
   getAllSupportedChainsAndTokens,
@@ -18,7 +19,7 @@ import {
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress
-} from "./chunk-U7KZ4XMQ.mjs";
+} from "./chunk-X73ALCGW.mjs";
 
 // src/client.ts
 import { parseUnits, hashTypedData } from "viem";
@@ -26,7 +27,7 @@ var POPUP_WIDTH = 450;
 var POPUP_HEIGHT = 600;
 var DEFAULT_EMBED_WIDTH = "400px";
 var DEFAULT_EMBED_HEIGHT = "500px";
-var MODAL_WIDTH = 360;
+var MODAL_WIDTH = 340;
 var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
 var OneAuthClient = class {
   constructor(config) {
@@ -34,6 +35,12 @@ var OneAuthClient = class {
     const dialogUrl = config.dialogUrl || providerUrl;
     this.config = { ...config, providerUrl, dialogUrl };
     this.theme = this.config.theme || {};
+    if (typeof document !== "undefined") {
+      this.injectPreconnect(providerUrl);
+      if (dialogUrl !== providerUrl) {
+        this.injectPreconnect(dialogUrl);
+      }
+    }
   }
   /**
    * Update the theme configuration at runtime
@@ -95,9 +102,7 @@ var OneAuthClient = class {
         const response = await fetch(
           `${this.config.providerUrl}/api/intent/status/${intentId}`,
           {
-            headers: {
-              "x-client-id": this.config.clientId
-            }
+            headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
           }
         );
         if (response.ok) {
@@ -121,9 +126,11 @@ var OneAuthClient = class {
   async authWithModal(options) {
     const dialogUrl = this.getDialogUrl();
     const params = new URLSearchParams({
-      clientId: this.config.clientId,
       mode: "iframe"
     });
+    if (this.config.clientId) {
+      params.set("clientId", this.config.clientId);
+    }
     if (options?.username) {
       params.set("username", options.username);
     }
@@ -139,6 +146,182 @@ var OneAuthClient = class {
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
     return this.waitForModalAuthResponse(dialog, iframe, cleanup);
   }
+  /**
+   * Open the connect dialog (lightweight connection without passkey auth).
+   *
+   * This method shows a simple connection confirmation dialog that doesn't
+   * require a passkey signature. Users can optionally enable "auto-connect"
+   * to skip this dialog in the future.
+   *
+   * If the user has never connected before, this will return action: "switch"
+   * to indicate that the full auth modal should be opened instead.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.connectWithModal();
+   *
+   * if (result.success) {
+   *   console.log('Connected as:', result.username);
+   * } else if (result.action === 'switch') {
+   *   // User needs to sign in first
+   *   const authResult = await client.authWithModal();
+   * }
+   * ```
+   */
+  async connectWithModal(options) {
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({
+      mode: "iframe"
+    });
+    if (this.config.clientId) {
+      params.set("clientId", this.config.clientId);
+    }
+    const themeParams = this.getThemeParams(options?.theme);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const url = `${dialogUrl}/dialog/connect?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe"
+    });
+    if (!ready) {
+      return {
+        success: false,
+        action: "cancel",
+        error: { code: "USER_CANCELLED", message: "Connection was cancelled" }
+      };
+    }
+    return this.waitForConnectResponse(dialog, iframe, cleanup);
+  }
+  /**
+   * Check if a user has already granted consent for the requested fields.
+   * This is a read-only check — no dialog is shown.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.checkConsent({
+   *   username: "alice",
+   *   fields: ["email"],
+   * });
+   * if (result.hasConsent) {
+   *   console.log(result.data?.email);
+   * }
+   * ```
+   */
+  async checkConsent(options) {
+    const clientId = options.clientId ?? this.config.clientId;
+    if (!clientId) {
+      return {
+        hasConsent: false
+      };
+    }
+    const username = options.username ?? options.accountAddress;
+    if (!username) {
+      return {
+        hasConsent: false
+      };
+    }
+    try {
+      const res = await fetch(`${this.config.providerUrl || "https://passkey.1auth.box"}/api/consent`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...clientId ? { "x-client-id": clientId } : {}
+        },
+        body: JSON.stringify({
+          username,
+          requestedFields: options.fields,
+          clientId
+        })
+      });
+      if (!res.ok) {
+        return { hasConsent: false };
+      }
+      const data = await res.json();
+      return {
+        hasConsent: data.hasConsent ?? false,
+        data: data.data,
+        grantedAt: data.grantedAt
+      };
+    } catch {
+      return { hasConsent: false };
+    }
+  }
+  /**
+   * Request consent from the user to share their data.
+   *
+   * First checks if consent was already granted (returns cached data immediately).
+   * If not, opens the consent dialog where the user can review and approve sharing.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.requestConsent({
+   *   username: "alice",
+   *   fields: ["email", "deviceNames"],
+   * });
+   * if (result.success) {
+   *   console.log(result.data?.email);
+   *   console.log(result.cached); // true if no dialog was shown
+   * }
+   * ```
+   */
+  async requestConsent(options) {
+    const clientId = options.clientId ?? this.config.clientId;
+    if (!clientId) {
+      return {
+        success: false,
+        error: { code: "INVALID_REQUEST", message: "clientId is required (set in config or options)" }
+      };
+    }
+    const username = options.username ?? options.accountAddress;
+    if (!username) {
+      return {
+        success: false,
+        error: { code: "INVALID_REQUEST", message: "username or accountAddress is required" }
+      };
+    }
+    if (!options.fields || options.fields.length === 0) {
+      return {
+        success: false,
+        error: { code: "INVALID_REQUEST", message: "At least one field is required" }
+      };
+    }
+    const existing = await this.checkConsent({ ...options, clientId });
+    if (existing.hasConsent && existing.data) {
+      return {
+        success: true,
+        data: existing.data,
+        grantedAt: existing.grantedAt,
+        cached: true
+      };
+    }
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({
+      mode: "iframe",
+      username,
+      clientId,
+      fields: options.fields.join(",")
+    });
+    const themeParams = this.getThemeParams(options.theme);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const url = `${dialogUrl}/dialog/consent?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe"
+    });
+    if (!ready) {
+      return {
+        success: false,
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+      };
+    }
+    return this.waitForConsentResponse(dialog, iframe, cleanup);
+  }
   /**
    * Authenticate a user with an optional challenge to sign.
    *
@@ -174,9 +357,11 @@ var OneAuthClient = class {
   async authenticate(options) {
     const dialogUrl = this.getDialogUrl();
     const params = new URLSearchParams({
-      clientId: this.config.clientId,
       mode: "iframe"
     });
+    if (this.config.clientId) {
+      params.set("clientId", this.config.clientId);
+    }
     if (options?.challenge) {
       params.set("challenge", options.challenge);
     }
@@ -190,28 +375,30 @@ var OneAuthClient = class {
     return this.waitForAuthenticateResponse(dialog, iframe, cleanup);
   }
   /**
-   * Show signing in a modal overlay (Porto-style iframe dialog)
+   * Show signing in a modal overlay (iframe dialog)
    */
   async signWithModal(options) {
     const dialogUrl = this.getDialogUrl();
     const themeParams = this.getThemeParams(options?.theme);
     const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogOrigin = this.getDialogOrigin();
-    await new Promise((resolve) => {
-      iframe.onload = () => {
-        iframe.contentWindow?.postMessage({
-          type: "PASSKEY_INIT",
-          mode: "iframe",
-          challenge: options.challenge,
-          username: options.username,
-          description: options.description,
-          transaction: options.transaction,
-          metadata: options.metadata
-        }, dialogOrigin);
-        resolve();
-      };
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe",
+      challenge: options.challenge,
+      username: options.username,
+      description: options.description,
+      transaction: options.transaction,
+      metadata: options.metadata
     });
+    if (!ready) {
+      return {
+        success: false,
+        error: {
+          code: "USER_REJECTED",
+          message: "User closed the dialog"
+        }
+      };
+    }
     return this.waitForSigningResponse(dialog, iframe, cleanup);
   }
   /**
@@ -262,7 +449,8 @@ var OneAuthClient = class {
         }
       };
     }
-    if (!username && !signedIntent?.accountAddress) {
+    const accountAddress = signedIntent?.accountAddress || options.accountAddress;
+    if (!username && !accountAddress) {
       return {
         success: false,
         intentId: "",
@@ -284,158 +472,264 @@ var OneAuthClient = class {
         }
       };
     }
+    const serializedTokenRequests = options.tokenRequests?.map((r) => ({
+      token: r.token,
+      amount: r.amount.toString()
+    }));
     let prepareResponse;
-    try {
-      const requestBody = signedIntent || {
-        username: options.username,
-        targetChain: options.targetChain,
-        calls: options.calls,
-        tokenRequests: options.tokenRequests,
-        sourceAssets: options.sourceAssets,
-        clientId: this.config.clientId
+    const requestBody = signedIntent || {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      tokenRequests: serializedTokenRequests,
+      sourceAssets: options.sourceAssets,
+      sourceChainId: options.sourceChainId,
+      ...this.config.clientId && { clientId: this.config.clientId }
+    };
+    const dialogUrl = this.getDialogUrl();
+    const themeParams = this.getThemeParams();
+    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    const [prepareResult, dialogResult] = await Promise.all([
+      this.prepareIntent(requestBody),
+      this.waitForDialogReadyDeferred(dialog, iframe, cleanup)
+    ]);
+    if (!dialogResult.ready) {
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
       };
-      const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(requestBody)
-      });
-      if (!response.ok) {
-        const errorData = await response.json().catch(() => ({}));
-        const errorMessage = errorData.error || "Failed to prepare intent";
-        if (errorMessage.includes("User not found")) {
-          localStorage.removeItem("1auth-user");
-        }
-        return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: {
-            code: errorMessage.includes("User not found") ? "USER_NOT_FOUND" : "PREPARE_FAILED",
-            message: errorMessage
-          }
-        };
-      }
-      prepareResponse = await response.json();
-    } catch (error) {
+    }
+    if (!prepareResult.success) {
+      this.sendPrepareError(iframe, prepareResult.error.message);
+      await this.waitForDialogClose(dialog, cleanup);
       return {
         success: false,
         intentId: "",
         status: "failed",
-        error: {
-          code: "NETWORK_ERROR",
-          message: error instanceof Error ? error.message : "Network error"
-        }
+        error: prepareResult.error
       };
     }
-    const dialogUrl = this.getDialogUrl();
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    prepareResponse = prepareResult.data;
     const dialogOrigin = this.getDialogOrigin();
-    await new Promise((resolve) => {
-      const handleReady = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_READY") {
-          window.removeEventListener("message", handleReady);
-          iframe.contentWindow?.postMessage({
-            type: "PASSKEY_INIT",
-            mode: "iframe",
-            calls,
-            chainId: targetChain,
-            transaction: prepareResponse.transaction,
-            challenge: prepareResponse.challenge,
-            username,
-            accountAddress: prepareResponse.accountAddress,
-            intentId: prepareResponse.intentId
-          }, dialogOrigin);
-          resolve();
+    const initPayload = {
+      mode: "iframe",
+      calls,
+      chainId: targetChain,
+      transaction: prepareResponse.transaction,
+      challenge: prepareResponse.challenge,
+      username,
+      accountAddress: prepareResponse.accountAddress,
+      originMessages: prepareResponse.originMessages,
+      tokenRequests: serializedTokenRequests,
+      expiresAt: prepareResponse.expiresAt,
+      userId: prepareResponse.userId,
+      intentOp: prepareResponse.intentOp,
+      digestResult: prepareResponse.digestResult,
+      tier: prepareResult.tier
+    };
+    dialogResult.sendInit(initPayload);
+    const handleReReady = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...initPayload },
+          dialogOrigin
+        );
+      }
+    };
+    window.addEventListener("message", handleReReady);
+    const signingResult = await this.waitForSigningWithRefresh(
+      dialog,
+      iframe,
+      cleanup,
+      dialogOrigin,
+      // Refresh callback - called when dialog requests a quote refresh
+      async () => {
+        console.log("[SDK] Dialog requested quote refresh, re-preparing intent");
+        try {
+          const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(requestBody),
+            credentials: "include"
+          });
+          if (!refreshResponse.ok) {
+            console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
+            return null;
+          }
+          const refreshedData = await refreshResponse.json();
+          prepareResponse = refreshedData;
+          return {
+            intentOp: refreshedData.intentOp,
+            expiresAt: refreshedData.expiresAt,
+            challenge: refreshedData.challenge,
+            originMessages: refreshedData.originMessages,
+            transaction: refreshedData.transaction,
+            digestResult: refreshedData.digestResult
+          };
+        } catch (error) {
+          console.error("[SDK] Quote refresh error:", error);
+          return null;
         }
-      };
-      window.addEventListener("message", handleReady);
-    });
-    const signingResult = await this.waitForSigningResponse(dialog, iframe, cleanup);
+      }
+    );
+    window.removeEventListener("message", handleReReady);
     if (!signingResult.success) {
       return {
         success: false,
-        intentId: prepareResponse.intentId,
+        intentId: "",
+        // No intentId yet - signing was cancelled before execute
         status: "failed",
         error: signingResult.error
       };
     }
+    const dialogExecutedIntent = "intentId" in signingResult && signingResult.intentId;
     let executeResponse;
-    try {
-      const response = await fetch(`${this.config.providerUrl}/api/intent/execute`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          intentId: prepareResponse.intentId,
-          signature: signingResult.signature,
-          passkey: signingResult.passkey
-          // Include passkey info for signature encoding
-        })
-      });
-      if (!response.ok) {
-        const errorData = await response.json().catch(() => ({}));
+    if (dialogExecutedIntent) {
+      executeResponse = {
+        success: true,
+        intentId: signingResult.intentId,
+        status: "pending"
+      };
+    } else {
+      try {
+        const response = await fetch(`${this.config.providerUrl}/api/intent/execute`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            // Data from prepare response (no intentId yet - created on execute)
+            intentOp: prepareResponse.intentOp,
+            userId: prepareResponse.userId,
+            targetChain: prepareResponse.targetChain,
+            calls: prepareResponse.calls,
+            expiresAt: prepareResponse.expiresAt,
+            digestResult: prepareResponse.digestResult,
+            // Signature from dialog
+            signature: signingResult.signature,
+            passkey: signingResult.passkey
+            // Include passkey info for signature encoding
+          })
+        });
+        if (!response.ok) {
+          const errorData = await response.json().catch(() => ({}));
+          this.sendTransactionStatus(iframe, "failed");
+          await this.waitForDialogClose(dialog, cleanup);
+          return {
+            success: false,
+            intentId: "",
+            // No intentId - execute failed before creation
+            status: "failed",
+            error: {
+              code: "EXECUTE_FAILED",
+              message: errorData.error || "Failed to execute intent"
+            }
+          };
+        }
+        executeResponse = await response.json();
+      } catch (error) {
         this.sendTransactionStatus(iframe, "failed");
         await this.waitForDialogClose(dialog, cleanup);
         return {
           success: false,
-          intentId: prepareResponse.intentId,
+          intentId: "",
+          // No intentId - network error before creation
           status: "failed",
           error: {
-            code: "EXECUTE_FAILED",
-            message: errorData.error || "Failed to execute intent"
+            code: "NETWORK_ERROR",
+            message: error instanceof Error ? error.message : "Network error"
           }
         };
       }
-      executeResponse = await response.json();
-    } catch (error) {
-      this.sendTransactionStatus(iframe, "failed");
-      await this.waitForDialogClose(dialog, cleanup);
-      return {
-        success: false,
-        intentId: prepareResponse.intentId,
-        status: "failed",
-        error: {
-          code: "NETWORK_ERROR",
-          message: error instanceof Error ? error.message : "Network error"
-        }
-      };
     }
-    const closeOn = options.closeOn || "preconfirmed";
-    const acceptPreconfirmations = closeOn !== "completed";
     let finalStatus = executeResponse.status;
     let finalTxHash = executeResponse.transactionHash;
     if (finalStatus === "pending") {
-      this.sendTransactionStatus(iframe, "processing");
-      try {
-        const waitResponse = await fetch(
-          `${this.config.providerUrl}/api/intent/wait/${prepareResponse.intentId}?preconfirm=${acceptPreconfirmations}`,
-          {
-            headers: {
-              "x-client-id": this.config.clientId
+      this.sendTransactionStatus(iframe, "pending");
+      let userClosedEarly = false;
+      const dialogOrigin2 = this.getDialogOrigin();
+      const earlyCloseHandler = (event) => {
+        if (event.origin !== dialogOrigin2) return;
+        if (event.data?.type === "PASSKEY_CLOSE") {
+          userClosedEarly = true;
+          cleanup();
+        }
+      };
+      window.addEventListener("message", earlyCloseHandler);
+      const maxAttempts = 120;
+      const pollIntervalMs = 1500;
+      let lastStatus = "pending";
+      for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        if (userClosedEarly) break;
+        try {
+          const statusResponse = await fetch(
+            `${this.config.providerUrl}/api/intent/status/${executeResponse.intentId}`,
+            {
+              method: "GET",
+              headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+            }
+          );
+          if (statusResponse.ok) {
+            const statusResult = await statusResponse.json();
+            finalStatus = statusResult.status;
+            finalTxHash = statusResult.transactionHash;
+            if (finalStatus !== lastStatus) {
+              this.sendTransactionStatus(iframe, finalStatus, finalTxHash);
+              lastStatus = finalStatus;
+            }
+            const closeOn2 = options.closeOn || "preconfirmed";
+            const successStatuses2 = {
+              claimed: ["claimed", "preconfirmed", "filled", "completed"],
+              preconfirmed: ["preconfirmed", "filled", "completed"],
+              filled: ["filled", "completed"],
+              completed: ["completed"]
+            };
+            const isTerminal = finalStatus === "failed" || finalStatus === "expired";
+            const isSuccess = successStatuses2[closeOn2]?.includes(finalStatus) ?? false;
+            if (isTerminal || isSuccess) {
+              break;
             }
           }
-        );
-        if (waitResponse.ok) {
-          const waitResult = await waitResponse.json();
-          finalStatus = waitResult.status === "preconfirmed" || waitResult.status === "completed" ? "completed" : waitResult.status;
-          finalTxHash = waitResult.transactionHash;
-        } else {
-          console.error("Wait endpoint failed:", await waitResponse.text());
+        } catch (pollError) {
+          console.error("Failed to poll intent status:", pollError);
         }
-      } catch (waitError) {
-        console.error("Failed to wait for intent:", waitError);
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+      }
+      window.removeEventListener("message", earlyCloseHandler);
+      if (userClosedEarly) {
+        cleanup();
+        return {
+          success: false,
+          intentId: executeResponse.intentId,
+          status: finalStatus,
+          transactionHash: finalTxHash,
+          operationId: executeResponse.operationId,
+          error: {
+            code: "USER_CANCELLED",
+            message: "User closed the dialog"
+          }
+        };
       }
     }
-    const displayStatus = finalStatus === "completed" ? "confirmed" : finalStatus;
+    const closeOn = options.closeOn || "preconfirmed";
+    const successStatuses = {
+      claimed: ["claimed", "preconfirmed", "filled", "completed"],
+      preconfirmed: ["preconfirmed", "filled", "completed"],
+      filled: ["filled", "completed"],
+      completed: ["completed"]
+    };
+    const isSuccessStatus = successStatuses[closeOn]?.includes(finalStatus) ?? false;
+    const displayStatus = isSuccessStatus ? "confirmed" : finalStatus;
+    const closePromise = this.waitForDialogClose(dialog, cleanup);
     this.sendTransactionStatus(iframe, displayStatus, finalTxHash);
-    await this.waitForDialogClose(dialog, cleanup);
+    await closePromise;
     if (options.waitForHash && !finalTxHash) {
-      const hash = await this.waitForTransactionHash(prepareResponse.intentId, {
+      const hash = await this.waitForTransactionHash(executeResponse.intentId, {
         timeoutMs: options.hashTimeoutMs,
         intervalMs: options.hashIntervalMs
       });
@@ -446,7 +740,7 @@ var OneAuthClient = class {
         finalStatus = "failed";
         return {
           success: false,
-          intentId: prepareResponse.intentId,
+          intentId: executeResponse.intentId,
           status: finalStatus,
           transactionHash: finalTxHash,
           operationId: executeResponse.operationId,
@@ -458,14 +752,223 @@ var OneAuthClient = class {
       }
     }
     return {
-      success: finalStatus === "completed",
-      intentId: prepareResponse.intentId,
+      success: isSuccessStatus,
+      intentId: executeResponse.intentId,
       status: finalStatus,
       transactionHash: finalTxHash,
       operationId: executeResponse.operationId,
       error: executeResponse.error
     };
   }
+  /**
+   * Send a batch of intents for multi-chain execution with a single passkey tap.
+   *
+   * This method prepares multiple intents, shows a paginated review,
+   * and signs all intents with a single passkey tap via a shared merkle tree.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.sendBatchIntent({
+   *   username: 'alice',
+   *   intents: [
+   *     {
+   *       targetChain: 8453, // Base
+   *       calls: [{ to: '0x...', data: '0x...', label: 'Swap on Base' }],
+   *     },
+   *     {
+   *       targetChain: 42161, // Arbitrum
+   *       calls: [{ to: '0x...', data: '0x...', label: 'Mint on Arbitrum' }],
+   *     },
+   *   ],
+   * });
+   *
+   * if (result.success) {
+   *   console.log(`${result.successCount} intents submitted`);
+   * }
+   * ```
+   */
+  async sendBatchIntent(options) {
+    if (!options.username && !options.accountAddress) {
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0
+      };
+    }
+    if (!options.intents?.length) {
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0
+      };
+    }
+    const serializedIntents = options.intents.map((intent) => ({
+      targetChain: intent.targetChain,
+      calls: intent.calls,
+      tokenRequests: intent.tokenRequests?.map((r) => ({
+        token: r.token,
+        amount: r.amount.toString()
+      })),
+      sourceAssets: intent.sourceAssets,
+      sourceChainId: intent.sourceChainId,
+      moduleInstall: intent.moduleInstall
+    }));
+    const requestBody = {
+      ...options.username && { username: options.username },
+      ...options.accountAddress && { accountAddress: options.accountAddress },
+      intents: serializedIntents,
+      ...this.config.clientId && { clientId: this.config.clientId }
+    };
+    const dialogUrl = this.getDialogUrl();
+    const themeParams = this.getThemeParams();
+    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    const [prepareResult, dialogResult] = await Promise.all([
+      this.prepareBatchIntent(requestBody),
+      this.waitForDialogReadyDeferred(dialog, iframe, cleanup)
+    ]);
+    if (!dialogResult.ready) {
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0
+      };
+    }
+    if (!prepareResult.success) {
+      const failedIntents = prepareResult.failedIntents;
+      const failureResults = failedIntents?.map((f) => ({
+        index: f.index,
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: { message: f.error, code: "PREPARE_FAILED" }
+      })) ?? [];
+      this.sendPrepareError(iframe, prepareResult.error);
+      await this.waitForDialogClose(dialog, cleanup);
+      return {
+        success: false,
+        results: failureResults,
+        successCount: 0,
+        failureCount: failureResults.length,
+        error: prepareResult.error
+      };
+    }
+    let prepareResponse = prepareResult.data;
+    const dialogOrigin = this.getDialogOrigin();
+    const batchInitPayload = {
+      mode: "iframe",
+      batchMode: true,
+      batchIntents: prepareResponse.intents,
+      batchFailedIntents: prepareResponse.failedIntents,
+      challenge: prepareResponse.challenge,
+      username: options.username,
+      accountAddress: prepareResponse.accountAddress,
+      userId: prepareResponse.userId,
+      expiresAt: prepareResponse.expiresAt,
+      tier: prepareResult.tier
+    };
+    dialogResult.sendInit(batchInitPayload);
+    const handleBatchReReady = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...batchInitPayload },
+          dialogOrigin
+        );
+      }
+    };
+    window.addEventListener("message", handleBatchReReady);
+    const batchResult = await new Promise((resolve) => {
+      const handleMessage = async (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const message = event.data;
+        if (message?.type === "PASSKEY_REFRESH_QUOTE") {
+          console.log("[SDK] Batch dialog requested quote refresh, re-preparing all intents");
+          try {
+            const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify(requestBody)
+            });
+            if (refreshResponse.ok) {
+              const refreshed = await refreshResponse.json();
+              prepareResponse = refreshed;
+              iframe.contentWindow?.postMessage({
+                type: "PASSKEY_REFRESH_COMPLETE",
+                batchIntents: refreshed.intents,
+                challenge: refreshed.challenge,
+                expiresAt: refreshed.expiresAt
+              }, dialogOrigin);
+            } else {
+              iframe.contentWindow?.postMessage({
+                type: "PASSKEY_REFRESH_ERROR",
+                error: "Failed to refresh batch quotes"
+              }, dialogOrigin);
+            }
+          } catch {
+            iframe.contentWindow?.postMessage({
+              type: "PASSKEY_REFRESH_ERROR",
+              error: "Failed to refresh batch quotes"
+            }, dialogOrigin);
+          }
+          return;
+        }
+        if (message?.type === "PASSKEY_SIGNING_RESULT") {
+          window.removeEventListener("message", handleMessage);
+          if (message.success && message.data?.batchResults) {
+            const rawResults = message.data.batchResults;
+            const results = rawResults.map((r) => ({
+              index: r.index,
+              success: r.success ?? r.status !== "FAILED",
+              intentId: r.intentId || r.operationId || "",
+              status: r.status === "FAILED" ? "failed" : "pending",
+              error: r.error ? { code: "EXECUTE_FAILED", message: r.error } : void 0
+            }));
+            const prepareFailures = (prepareResponse.failedIntents ?? []).map((f) => ({
+              index: f.index,
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: { code: "PREPARE_FAILED", message: f.error }
+            }));
+            const allResults = [...results, ...prepareFailures].sort((a, b) => a.index - b.index);
+            const successCount = allResults.filter((r) => r.success).length;
+            await this.waitForDialogClose(dialog, cleanup);
+            resolve({
+              success: successCount === allResults.length,
+              results: allResults,
+              successCount,
+              failureCount: allResults.length - successCount
+            });
+          } else {
+            cleanup();
+            resolve({
+              success: false,
+              results: [],
+              successCount: 0,
+              failureCount: 0
+            });
+          }
+        }
+        if (message?.type === "PASSKEY_CLOSE") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            results: [],
+            successCount: 0,
+            failureCount: 0
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
+    });
+    window.removeEventListener("message", handleBatchReReady);
+    return batchResult;
+  }
   /**
    * Send transaction status to the dialog iframe
    */
@@ -542,7 +1045,77 @@ var OneAuthClient = class {
         const payload = message?.data;
         if (message?.type === "PASSKEY_SIGNING_RESULT") {
           window.removeEventListener("message", handleMessage);
-          if (message.success && payload?.signature) {
+          if (message.success && payload?.intentId) {
+            resolve({
+              success: true,
+              intentId: payload.intentId
+            });
+          } else if (message.success && payload?.signature) {
+            resolve({
+              success: true,
+              signature: payload.signature,
+              passkey: payload.passkey,
+              signedHash: payload.signedHash
+            });
+          } else {
+            resolve({
+              success: false,
+              error: message.error || {
+                code: "SIGNING_FAILED",
+                message: "Signing failed"
+              }
+            });
+          }
+        } else if (message?.type === "PASSKEY_CLOSE") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: {
+              code: "USER_REJECTED",
+              message: "User closed the dialog"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
+    });
+  }
+  /**
+   * Wait for signing result with auto-refresh support
+   * This method handles both signing results and quote refresh requests from the dialog
+   */
+  waitForSigningWithRefresh(dialog, iframe, cleanup, dialogOrigin, onRefresh) {
+    console.log("[SDK] waitForSigningWithRefresh, expecting origin:", dialogOrigin);
+    return new Promise((resolve) => {
+      const handleMessage = async (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const message = event.data;
+        if (message?.type === "PASSKEY_REFRESH_QUOTE") {
+          console.log("[SDK] Received quote refresh request from dialog");
+          const refreshedData = await onRefresh();
+          if (refreshedData) {
+            iframe.contentWindow?.postMessage({
+              type: "PASSKEY_REFRESH_COMPLETE",
+              ...refreshedData
+            }, dialogOrigin);
+          } else {
+            iframe.contentWindow?.postMessage({
+              type: "PASSKEY_REFRESH_ERROR",
+              error: "Failed to refresh quote"
+            }, dialogOrigin);
+          }
+          return;
+        }
+        const payload = message?.data;
+        if (message?.type === "PASSKEY_SIGNING_RESULT") {
+          window.removeEventListener("message", handleMessage);
+          if (message.success && payload?.intentId) {
+            resolve({
+              success: true,
+              intentId: payload.intentId
+            });
+          } else if (message.success && payload?.signature) {
             resolve({
               success: true,
               signature: payload.signature,
@@ -574,28 +1147,165 @@ var OneAuthClient = class {
     });
   }
   /**
-   * Wait for the dialog to be closed
+   * Wait for the dialog to be closed
+   */
+  waitForDialogClose(dialog, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_CLOSE") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve();
+        }
+      };
+      const handleClose = () => {
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+        cleanup();
+        resolve();
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
+  /**
+   * Inject a preconnect link tag to pre-warm DNS + TLS for a given URL.
+   */
+  injectPreconnect(url) {
+    try {
+      const origin = new URL(url).origin;
+      if (document.querySelector(`link[rel="preconnect"][href="${origin}"]`)) return;
+      const link = document.createElement("link");
+      link.rel = "preconnect";
+      link.href = origin;
+      link.crossOrigin = "anonymous";
+      document.head.appendChild(link);
+    } catch {
+    }
+  }
+  /**
+   * Wait for the dialog iframe to signal ready without sending init data.
+   * Returns a sendInit function the caller uses once prepare data is available.
+   */
+  waitForDialogReadyDeferred(dialog, iframe, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let settled = false;
+      const teardown = () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(readyTimeout);
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_READY") {
+          teardown();
+          resolve({
+            ready: true,
+            sendInit: (initMessage) => {
+              iframe.contentWindow?.postMessage(
+                { type: "PASSKEY_INIT", ...initMessage },
+                dialogOrigin
+              );
+            }
+          });
+        } else if (event.data?.type === "PASSKEY_CLOSE") {
+          teardown();
+          cleanup();
+          resolve({ ready: false });
+        }
+      };
+      const handleClose = () => {
+        teardown();
+        resolve({ ready: false });
+      };
+      const readyTimeout = setTimeout(() => {
+        teardown();
+        cleanup();
+        resolve({ ready: false });
+      }, 1e4);
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
+  /**
+   * Prepare an intent by calling the orchestrator for a quote.
+   * Returns the prepare response and the origin tier from the response header.
+   */
+  async prepareIntent(requestBody) {
+    try {
+      const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(requestBody)
+      });
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        const errorMessage = errorData.error || "Failed to prepare intent";
+        if (errorMessage.includes("User not found")) {
+          localStorage.removeItem("1auth-user");
+        }
+        return {
+          success: false,
+          error: {
+            code: errorMessage.includes("User not found") ? "USER_NOT_FOUND" : "PREPARE_FAILED",
+            message: errorMessage
+          }
+        };
+      }
+      const tier = response.headers.get("X-Origin-Tier");
+      return { success: true, data: await response.json(), tier };
+    } catch (error) {
+      return {
+        success: false,
+        error: {
+          code: "NETWORK_ERROR",
+          message: error instanceof Error ? error.message : "Network error"
+        }
+      };
+    }
+  }
+  /**
+   * Prepare a batch intent by calling the orchestrator for quotes on all intents.
+   */
+  async prepareBatchIntent(requestBody) {
+    try {
+      const response = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(requestBody)
+      });
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        const errorMessage = errorData.error || "Failed to prepare batch intent";
+        if (errorMessage.includes("User not found")) {
+          localStorage.removeItem("1auth-user");
+        }
+        return {
+          success: false,
+          error: errorMessage,
+          failedIntents: errorData.failedIntents
+        };
+      }
+      const tier = response.headers.get("X-Origin-Tier");
+      return { success: true, data: await response.json(), tier };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
+  /**
+   * Send a prepare error message to the dialog iframe.
    */
-  waitForDialogClose(dialog, cleanup) {
+  sendPrepareError(iframe, error) {
     const dialogOrigin = this.getDialogOrigin();
-    return new Promise((resolve) => {
-      const handleMessage = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          resolve();
-        }
-      };
-      const handleClose = () => {
-        window.removeEventListener("message", handleMessage);
-        dialog.removeEventListener("close", handleClose);
-        cleanup();
-        resolve();
-      };
-      window.addEventListener("message", handleMessage);
-      dialog.addEventListener("close", handleClose);
-    });
+    iframe.contentWindow?.postMessage(
+      { type: "PASSKEY_PREPARE_ERROR", error },
+      dialogOrigin
+    );
   }
   /**
    * Poll for intent status
@@ -608,9 +1318,7 @@ var OneAuthClient = class {
       const response = await fetch(
         `${this.config.providerUrl}/api/intent/status/${intentId}`,
         {
-          headers: {
-            "x-client-id": this.config.clientId
-          }
+          headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
         }
       );
       if (!response.ok) {
@@ -645,6 +1353,43 @@ var OneAuthClient = class {
       };
     }
   }
+  /**
+   * Get the history of intents for the authenticated user.
+   *
+   * Requires an active session (user must be logged in).
+   *
+   * @example
+   * ```typescript
+   * // Get recent intents
+   * const history = await client.getIntentHistory({ limit: 10 });
+   *
+   * // Filter by status
+   * const pending = await client.getIntentHistory({ status: 'pending' });
+   *
+   * // Filter by date range
+   * const lastWeek = await client.getIntentHistory({
+   *   from: new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString(),
+   * });
+   * ```
+   */
+  async getIntentHistory(options) {
+    const queryParams = new URLSearchParams();
+    if (options?.limit) queryParams.set("limit", String(options.limit));
+    if (options?.offset) queryParams.set("offset", String(options.offset));
+    if (options?.status) queryParams.set("status", options.status);
+    if (options?.from) queryParams.set("from", options.from);
+    if (options?.to) queryParams.set("to", options.to);
+    const url = `${this.config.providerUrl}/api/intent/history${queryParams.toString() ? `?${queryParams}` : ""}`;
+    const response = await fetch(url, {
+      headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {},
+      credentials: "include"
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || "Failed to get intent history");
+    }
+    return response.json();
+  }
   /**
    * Send a swap intent through the Rhinestone orchestrator
    *
@@ -707,17 +1452,21 @@ var OneAuthClient = class {
         };
       }
     };
-    const fromTokenResult = resolveToken(options.fromToken, "fromToken");
-    if (!fromTokenResult.address) {
-      return {
-        success: false,
-        intentId: "",
-        status: "failed",
-        error: {
-          code: "INVALID_TOKEN",
-          message: fromTokenResult.error || `Unknown fromToken: ${options.fromToken}`
-        }
-      };
+    let fromTokenAddress;
+    if (options.fromToken) {
+      const fromTokenResult = resolveToken(options.fromToken, "fromToken");
+      if (!fromTokenResult.address) {
+        return {
+          success: false,
+          intentId: "",
+          status: "failed",
+          error: {
+            code: "INVALID_TOKEN",
+            message: fromTokenResult.error || `Unknown fromToken: ${options.fromToken}`
+          }
+        };
+      }
+      fromTokenAddress = fromTokenResult.address;
     }
     const toTokenResult = resolveToken(options.toToken, "toToken");
     if (!toTokenResult.address) {
@@ -731,18 +1480,17 @@ var OneAuthClient = class {
         }
       };
     }
-    const fromTokenAddress = fromTokenResult.address;
     const toTokenAddress = toTokenResult.address;
     console.log("[SDK sendSwap] Token resolution:", {
-      fromToken: options.fromToken,
-      fromTokenAddress,
+      fromToken: options.fromToken ?? "Any",
+      fromTokenAddress: fromTokenAddress ?? "orchestrator picks",
       toToken: options.toToken,
       toTokenAddress,
       targetChain: options.targetChain
     });
     const formatTokenLabel = (token, fallback) => {
       if (!token.startsWith("0x")) {
-        return token.toUpperCase();
+        return token;
       }
       try {
         return getTokenSymbol(token, options.targetChain);
@@ -750,15 +1498,11 @@ var OneAuthClient = class {
         return fallback;
       }
     };
-    const fromSymbol = formatTokenLabel(
-      options.fromToken,
-      `${options.fromToken.slice(0, 6)}...${options.fromToken.slice(-4)}`
-    );
     const toSymbol = formatTokenLabel(
       options.toToken,
       `${options.toToken.slice(0, 6)}...${options.toToken.slice(-4)}`
     );
-    const isFromNativeEth = fromTokenAddress === "0x0000000000000000000000000000000000000000";
+    const isFromNativeEth = fromTokenAddress ? fromTokenAddress === "0x0000000000000000000000000000000000000000" : false;
     const isToNativeEth = toTokenAddress === "0x0000000000000000000000000000000000000000";
     const KNOWN_DECIMALS = {
       ETH: 18,
@@ -768,31 +1512,33 @@ var OneAuthClient = class {
       USDT0: 6
     };
     const getDecimals = (symbol, chainId) => {
-      const upperSymbol = symbol.toUpperCase();
       try {
-        const decimals = getTokenDecimals(upperSymbol, chainId);
-        console.log(`[SDK] getTokenDecimals(${upperSymbol}, ${chainId}) = ${decimals}`);
+        const match = getSupportedTokens(chainId).find(
+          (t) => t.symbol.toUpperCase() === symbol.toUpperCase()
+        );
+        if (match) {
+          console.log(`[SDK] getTokenDecimals(${match.symbol}, ${chainId}) = ${match.decimals}`);
+          return match.decimals;
+        }
+        const decimals = getTokenDecimals(symbol, chainId);
+        console.log(`[SDK] getTokenDecimals(${symbol}, ${chainId}) = ${decimals}`);
         return decimals;
       } catch (e) {
-        console.warn(`[SDK] getTokenDecimals failed for ${upperSymbol}, using fallback`, e);
+        const upperSymbol = symbol.toUpperCase();
+        console.warn(`[SDK] getTokenDecimals failed for ${symbol}, using fallback`, e);
         return KNOWN_DECIMALS[upperSymbol] ?? 18;
       }
     };
-    const fromDecimals = getDecimals(options.fromToken, options.targetChain);
     const toDecimals = getDecimals(options.toToken, options.targetChain);
-    const isBridge = options.fromToken.toUpperCase() === options.toToken.toUpperCase();
-    let tokenRequests;
-    if (!isToNativeEth) {
-      tokenRequests = [{
-        token: toTokenAddress,
-        amount: parseUnits(options.amount, toDecimals).toString()
-      }];
-    }
+    const isBridge = options.fromToken ? options.fromToken.toUpperCase() === options.toToken.toUpperCase() : false;
+    const tokenRequests = [{
+      token: toTokenAddress,
+      amount: parseUnits(options.amount, toDecimals)
+    }];
     console.log("[SDK sendSwap] Building intent:", {
       isBridge,
       isFromNativeEth,
       isToNativeEth,
-      fromDecimals,
       toDecimals,
       tokenRequests
     });
@@ -803,15 +1549,20 @@ var OneAuthClient = class {
         {
           // Minimal call - just signals to orchestrator we want the tokenRequests delivered
           to: toTokenAddress,
-          value: "0"
+          value: "0",
+          // SDK provides labels so dialog shows "Buy ETH" not "Send ETH / To: 0x000..."
+          label: `Buy ${toSymbol}`,
+          sublabel: `${options.amount} ${toSymbol}`
         }
       ],
       // Request specific output tokens - this is what actually matters for swaps
       tokenRequests,
       // Constrain orchestrator to use only the fromToken as input
       // This ensures the swap uses the correct source token
-      // Pass the symbol (not address) so orchestrator can resolve per-chain
-      sourceAssets: options.sourceAssets || [options.fromToken.toUpperCase()],
+      // Use canonical symbol casing from registry (e.g. "MockUSD" not "MOCKUSD")
+      sourceAssets: options.sourceAssets || (options.fromToken ? [options.fromToken] : void 0),
+      // Pass source chain ID so orchestrator knows which chain to look for tokens on
+      sourceChainId: options.sourceChainId,
       closeOn: options.closeOn || "preconfirmed",
       waitForHash: options.waitForHash,
       hashTimeoutMs: options.hashTimeoutMs,
@@ -820,7 +1571,7 @@ var OneAuthClient = class {
     return {
       ...result,
       quote: result.success ? {
-        fromToken: fromTokenAddress,
+        fromToken: fromTokenAddress ?? options.fromToken,
         toToken: toTokenAddress,
         amountIn: options.amount,
         amountOut: "",
@@ -862,26 +1613,24 @@ var OneAuthClient = class {
     const themeParams = this.getThemeParams(options?.theme);
     const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogOrigin = this.getDialogOrigin();
-    await new Promise((resolve) => {
-      const handleReady = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_READY") {
-          window.removeEventListener("message", handleReady);
-          iframe.contentWindow?.postMessage({
-            type: "PASSKEY_INIT",
-            mode: "iframe",
-            message: options.message,
-            challenge: options.challenge || options.message,
-            username: options.username,
-            description: options.description,
-            metadata: options.metadata
-          }, dialogOrigin);
-          resolve();
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe",
+      message: options.message,
+      challenge: options.challenge || options.message,
+      username: options.username,
+      accountAddress: options.accountAddress,
+      description: options.description,
+      metadata: options.metadata
+    });
+    if (!ready) {
+      return {
+        success: false,
+        error: {
+          code: "USER_REJECTED",
+          message: "User closed the dialog"
         }
       };
-      window.addEventListener("message", handleReady);
-    });
+    }
     const signingResult = await this.waitForSigningResponse(dialog, iframe, cleanup);
     cleanup();
     if (signingResult.success) {
@@ -950,31 +1699,29 @@ var OneAuthClient = class {
     const themeParams = this.getThemeParams(options?.theme);
     const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogOrigin = this.getDialogOrigin();
-    await new Promise((resolve) => {
-      const handleReady = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_READY") {
-          window.removeEventListener("message", handleReady);
-          iframe.contentWindow?.postMessage({
-            type: "PASSKEY_INIT",
-            mode: "iframe",
-            signingMode: "typedData",
-            typedData: {
-              domain: options.domain,
-              types: options.types,
-              primaryType: options.primaryType,
-              message: options.message
-            },
-            challenge: signedHash,
-            username: options.username,
-            description: options.description
-          }, dialogOrigin);
-          resolve();
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe",
+      signingMode: "typedData",
+      typedData: {
+        domain: options.domain,
+        types: options.types,
+        primaryType: options.primaryType,
+        message: options.message
+      },
+      challenge: signedHash,
+      username: options.username,
+      accountAddress: options.accountAddress,
+      description: options.description
+    });
+    if (!ready) {
+      return {
+        success: false,
+        error: {
+          code: "USER_REJECTED",
+          message: "User closed the dialog"
         }
       };
-      window.addEventListener("message", handleReady);
-    });
+    }
     const signingResult = await this.waitForSigningResponse(dialog, iframe, cleanup);
     cleanup();
     if (signingResult.success) {
@@ -1037,7 +1784,7 @@ var OneAuthClient = class {
     iframe.style.borderRadius = "12px";
     iframe.style.boxShadow = "0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1)";
     iframe.id = `passkey-embed-${requestId}`;
-    iframe.allow = "publickey-credentials-get *; publickey-credentials-create *";
+    iframe.allow = "publickey-credentials-get *; publickey-credentials-create *; identity-credentials-get";
     iframe.onload = () => {
       options.onReady?.();
     };
@@ -1128,9 +1875,7 @@ var OneAuthClient = class {
     const response = await fetch(
       `${this.config.providerUrl}/api/users/${encodeURIComponent(username)}/passkeys`,
       {
-        headers: {
-          "x-client-id": this.config.clientId
-        }
+        headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
       }
     );
     if (!response.ok) {
@@ -1149,7 +1894,7 @@ var OneAuthClient = class {
           "Content-Type": "application/json"
         },
         body: JSON.stringify({
-          clientId: this.config.clientId,
+          ...this.config.clientId && { clientId: this.config.clientId },
           username: options.username,
           challenge: options.challenge,
           description: options.description,
@@ -1175,6 +1920,50 @@ var OneAuthClient = class {
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
   }
+  /**
+   * Wait for the dialog iframe to signal ready, then send init data.
+   * Also handles early close (X button, escape, backdrop) during the ready phase.
+   * Returns true if dialog is ready, false if it was closed before becoming ready.
+   */
+  waitForDialogReady(dialog, iframe, cleanup, initMessage) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let settled = false;
+      const teardown = () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(readyTimeout);
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_READY") {
+          teardown();
+          iframe.contentWindow?.postMessage({
+            type: "PASSKEY_INIT",
+            ...initMessage
+          }, dialogOrigin);
+          resolve(true);
+        } else if (event.data?.type === "PASSKEY_CLOSE") {
+          teardown();
+          cleanup();
+          resolve(false);
+        }
+      };
+      const handleClose = () => {
+        teardown();
+        resolve(false);
+      };
+      const readyTimeout = setTimeout(() => {
+        teardown();
+        cleanup();
+        resolve(false);
+      }, 1e4);
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
   /**
    * Create a modal dialog with an iframe inside.
    */
@@ -1211,7 +2000,9 @@ var OneAuthClient = class {
         border-radius: 14px;
         border: none;
         box-shadow: 0 8px 32px rgba(0, 0, 0, 0.12), 0 2px 8px rgba(0, 0, 0, 0.08);
-        transition: width 0.2s ease-out, height 0.15s ease-out;
+        transition: height 0.15s ease-out;
+        max-height: calc(100vh - 100px);
+        max-height: calc(100dvh - 100px);
       }
 
       @media (min-width: 769px) {
@@ -1273,14 +2064,10 @@ var OneAuthClient = class {
     const iframe = document.createElement("iframe");
     iframe.setAttribute(
       "allow",
-      "publickey-credentials-get *; publickey-credentials-create *; clipboard-write"
+      "publickey-credentials-get *; publickey-credentials-create *; clipboard-write; identity-credentials-get"
     );
     iframe.setAttribute("aria-label", "Passkey Authentication");
     iframe.setAttribute("tabindex", "0");
-    iframe.setAttribute(
-      "sandbox",
-      "allow-forms allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox"
-    );
     iframe.setAttribute("src", url);
     iframe.setAttribute("title", "Passkey");
     iframe.style.border = "none";
@@ -1290,10 +2077,8 @@ var OneAuthClient = class {
     const handleMessage = (event) => {
       if (event.origin !== hostUrl.origin) return;
       if (event.data?.type === "PASSKEY_RESIZE") {
-        iframe.style.height = `${event.data.height}px`;
-        if (event.data.width) {
-          iframe.style.width = `${event.data.width}px`;
-        }
+        const maxHeight = window.innerHeight - 100;
+        iframe.style.height = `${Math.min(event.data.height, maxHeight)}px`;
       } else if (event.data?.type === "PASSKEY_DISCONNECT") {
         localStorage.removeItem("1auth-user");
       }
@@ -1311,7 +2096,10 @@ var OneAuthClient = class {
       }
     });
     dialog.showModal();
+    let cleanedUp = false;
     const cleanup = () => {
+      if (cleanedUp) return;
+      cleanedUp = true;
       window.removeEventListener("message", handleMessage);
       document.removeEventListener("keydown", handleEscape);
       dialog.close();
@@ -1319,12 +2107,24 @@ var OneAuthClient = class {
     };
     return { dialog, iframe, cleanup };
   }
-  waitForModalAuthResponse(_dialog, _iframe, cleanup) {
+  waitForModalAuthResponse(_dialog, iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
+      let dialogReady = false;
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         const data = event.data;
+        if (data?.type === "PASSKEY_READY") {
+          dialogReady = true;
+          iframe.contentWindow?.postMessage({
+            type: "PASSKEY_INIT",
+            mode: "iframe"
+          }, dialogOrigin);
+          return;
+        }
+        if (!dialogReady && data?.type === "PASSKEY_CLOSE") {
+          return;
+        }
         if (data?.type === "PASSKEY_LOGIN_RESULT") {
           window.removeEventListener("message", handleMessage);
           cleanup();
@@ -1332,6 +2132,7 @@ var OneAuthClient = class {
             resolve({
               success: true,
               username: data.data?.username,
+              address: data.data?.address,
               user: data.data?.user
             });
           } else {
@@ -1346,7 +2147,8 @@ var OneAuthClient = class {
           if (data.success) {
             resolve({
               success: true,
-              username: data.data?.username
+              username: data.data?.username,
+              address: data.data?.address
             });
           } else {
             resolve({
@@ -1354,6 +2156,11 @@ var OneAuthClient = class {
               error: data.error
             });
           }
+        } else if (data?.type === "PASSKEY_RETRY_POPUP") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          const popupUrl = data.data?.url?.replace("mode=iframe", "mode=popup") || `${this.getDialogUrl()}/dialog/auth?mode=popup${this.config.clientId ? `&clientId=${this.config.clientId}` : ""}`;
+          this.waitForPopupAuthResponse(popupUrl).then(resolve);
         } else if (data?.type === "PASSKEY_CLOSE") {
           window.removeEventListener("message", handleMessage);
           cleanup();
@@ -1369,6 +2176,79 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
   }
+  /**
+   * Open a popup for auth and wait for the result.
+   * Used when iframe mode fails (e.g., due to password manager interference).
+   */
+  waitForPopupAuthResponse(url) {
+    const dialogOrigin = this.getDialogOrigin();
+    const popup = this.openPopup(url);
+    return new Promise((resolve) => {
+      const pollTimer = setInterval(() => {
+        if (popup?.closed) {
+          clearInterval(pollTimer);
+          window.removeEventListener("message", handleMessage);
+          resolve({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "Authentication was cancelled"
+            }
+          });
+        }
+      }, 500);
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const data = event.data;
+        if (data?.type === "PASSKEY_LOGIN_RESULT") {
+          clearInterval(pollTimer);
+          window.removeEventListener("message", handleMessage);
+          popup?.close();
+          if (data.success) {
+            resolve({
+              success: true,
+              username: data.data?.username,
+              address: data.data?.address,
+              user: data.data?.user
+            });
+          } else {
+            resolve({
+              success: false,
+              error: data.error
+            });
+          }
+        } else if (data?.type === "PASSKEY_REGISTER_RESULT") {
+          clearInterval(pollTimer);
+          window.removeEventListener("message", handleMessage);
+          popup?.close();
+          if (data.success) {
+            resolve({
+              success: true,
+              username: data.data?.username,
+              address: data.data?.address
+            });
+          } else {
+            resolve({
+              success: false,
+              error: data.error
+            });
+          }
+        } else if (data?.type === "PASSKEY_CLOSE") {
+          clearInterval(pollTimer);
+          window.removeEventListener("message", handleMessage);
+          popup?.close();
+          resolve({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "Authentication was cancelled"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
+    });
+  }
   waitForAuthenticateResponse(_dialog, _iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
@@ -1408,6 +2288,84 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
   }
+  waitForConnectResponse(_dialog, _iframe, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const data = event.data;
+        if (data?.type === "PASSKEY_CONNECT_RESULT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          if (data.success) {
+            resolve({
+              success: true,
+              username: data.data?.username,
+              address: data.data?.address,
+              autoConnected: data.data?.autoConnected
+            });
+          } else {
+            resolve({
+              success: false,
+              action: data.data?.action,
+              error: data.error
+            });
+          }
+        } else if (data?.type === "PASSKEY_CLOSE") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            action: "cancel",
+            error: {
+              code: "USER_CANCELLED",
+              message: "Connection was cancelled"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
+    });
+  }
+  waitForConsentResponse(_dialog, _iframe, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const data = event.data;
+        if (data?.type === "PASSKEY_CONSENT_RESULT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          if (data.success) {
+            resolve({
+              success: true,
+              data: data.data,
+              grantedAt: data.data?.grantedAt
+            });
+          } else {
+            resolve({
+              success: false,
+              error: data.error ?? {
+                code: "USER_REJECTED",
+                message: "User denied the consent request"
+              }
+            });
+          }
+        } else if (data?.type === "PASSKEY_CLOSE") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "User closed the dialog"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
+    });
+  }
   waitForModalSigningResponse(requestId, _dialog, _iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
@@ -1496,9 +2454,7 @@ var OneAuthClient = class {
     const response = await fetch(
       `${this.config.providerUrl}/api/sign/request/${requestId}`,
       {
-        headers: {
-          "x-client-id": this.config.clientId
-        }
+        headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
       }
     );
     if (!response.ok) {
@@ -1640,6 +2596,9 @@ function createPasskeyWalletClient(config) {
     if (!result.success) {
       throw new Error(result.error?.message || "Signing failed");
     }
+    if (!result.signature) {
+      throw new Error("No signature received");
+    }
     return encodeWebAuthnSignature(result.signature);
   };
   const signTransactionImpl = async (transaction) => {
@@ -1660,6 +2619,9 @@ function createPasskeyWalletClient(config) {
     if (!result.success) {
       throw new Error(result.error?.message || "Signing failed");
     }
+    if (!result.signature) {
+      throw new Error("No signature received");
+    }
     return encodeWebAuthnSignature(result.signature);
   };
   const signTypedDataImpl = async (typedData) => {
@@ -1681,6 +2643,9 @@ function createPasskeyWalletClient(config) {
     if (!result.success) {
       throw new Error(result.error?.message || "Signing failed");
     }
+    if (!result.signature) {
+      throw new Error("No signature received");
+    }
     return encodeWebAuthnSignature(result.signature);
   };
   const buildIntentPayload = async (calls, targetChainOverride) => {
@@ -1749,11 +2714,12 @@ function createPasskeyWalletClient(config) {
      * Send multiple calls as a single batched transaction
      */
     async sendCalls(params) {
-      const { calls, chainId: targetChain } = params;
+      const { calls, chainId: targetChain, tokenRequests } = params;
       const closeOn = config.waitForHash ?? true ? "completed" : "preconfirmed";
       const intentPayload = await buildIntentPayload(calls, targetChain);
       const result = await provider.sendIntent({
         ...intentPayload,
+        tokenRequests,
         closeOn,
         waitForHash: config.waitForHash ?? true,
         hashTimeoutMs: config.hashTimeoutMs,
@@ -2197,9 +3163,10 @@ function BatchQueueWidget({ onSignAll }) {
 
 // src/verify.ts
 import { keccak256, toBytes } from "viem";
-var PASSKEY_MESSAGE_PREFIX = "Passkey Signed Message:\n";
+var ETHEREUM_MESSAGE_PREFIX = "Ethereum Signed Message:\n";
+var PASSKEY_MESSAGE_PREFIX = ETHEREUM_MESSAGE_PREFIX;
 function hashMessage2(message) {
-  const prefixed = PASSKEY_MESSAGE_PREFIX + message.length.toString() + message;
+  const prefixed = ETHEREUM_MESSAGE_PREFIX + message.length.toString() + message;
   return keccak256(toBytes(prefixed));
 }
 function verifyMessageHash(message, signedHash) {
@@ -2210,9 +3177,11 @@ function verifyMessageHash(message, signedHash) {
 export {
   BatchQueueProvider,
   BatchQueueWidget,
+  ETHEREUM_MESSAGE_PREFIX,
   OneAuthClient,
   PASSKEY_MESSAGE_PREFIX,
   OneAuthClient as PasskeyProviderClient,
+  createOneAuthProvider,
   createPasskeyAccount,
   createPasskeyProvider,
   createPasskeyWalletClient,