@rhinestone/1auth 0.6.4 → 0.6.7

package/dist/{client-hZxAAhcl.d.mts → client-BrMrhetG.d.mts}

@@ -283,55 +283,19 @@ interface IntentTokenRequest {
     /** Amount in base units (use parseUnits for decimals) */
     amount: bigint;
 }
-/**
- * A signed intent request from a backend.
- * This provides XSS protection by ensuring calls were constructed server-side.
- */
-interface DeveloperSignedIntent {
-    /** Developer ID (clientId). Mapped to merchantId for the API. */
-    developerId?: string;
-    /** Wire field used by the API (same value as developerId) */
-    merchantId?: string;
-    /** Target chain ID */
-    targetChain: number;
-    /** Calls to execute (signed by developer) */
-    calls: IntentCall[];
-    /** Username of the signer */
-    username?: string;
-    /** Alternative to username: account address */
-    accountAddress?: string;
-    /** Unique nonce for replay protection */
-    nonce: string;
-    /** Expiry timestamp (Unix ms) */
-    expiresAt: number;
-    /** Ed25519 signature over the canonical message (base64) */
-    signature: string;
-    /** Optional client ID */
-    clientId?: string;
-    /** Optional token requests */
-    tokenRequests?: IntentTokenRequest[];
-}
-type IntentSigner = (params: {
-    username: string;
-    accountAddress?: string;
-    targetChain: number;
-    calls: IntentCall[];
-    tokenRequests?: IntentTokenRequest[];
-    sourceAssets?: string[];
-}) => Promise<DeveloperSignedIntent>;
 /**
  * Options for sendIntent
  */
 interface SendIntentOptions {
-    /** Username of the signer (for unsigned requests) */
+    /** Username of the signer */
     username?: string;
-    /** Account address of the signer (alternative to username for unsigned requests) */
+    /** Account address of the signer (alternative to username) */
     accountAddress?: string;
-    /** Target chain ID (for unsigned requests) */
+    /** Target chain ID */
     targetChain?: number;
-    /** Calls to execute on the target chain (for unsigned requests) */
+    /** Calls to execute on the target chain */
     calls?: IntentCall[];
-    /** Optional token requests (for unsigned requests) */
+    /** Optional token requests */
     tokenRequests?: IntentTokenRequest[];
     /**
      * Constrain which tokens can be used as input/payment.
@@ -347,11 +311,6 @@ interface SendIntentOptions {
     sourceChainId?: number;
     /** When to close the dialog and return success. Defaults to "preconfirmed" */
     closeOn?: CloseOnStatus;
-    /**
-     * Pre-signed intent from developer backend (XSS protected)
-     * If provided, username/targetChain/calls/tokenRequests are ignored
-     */
-    signedIntent?: DeveloperSignedIntent;
     /**
      * Wait for a transaction hash before resolving.
      * Defaults to false to preserve existing behavior.
@@ -792,23 +751,58 @@ interface RequestConsentResult {
 declare class OneAuthClient {
     private config;
     private theme;
+    /**
+     * Create a new OneAuthClient.
+     *
+     * Normalizes the config (filling in default URLs), then immediately injects
+     * `<link rel="preconnect">` tags for the passkey domain so that DNS lookup
+     * and TLS handshake start before the first dialog is opened, shaving
+     * noticeable latency from the first user interaction.
+     *
+     * @param config - Client configuration including optional providerUrl, dialogUrl,
+     *   clientId, theme, and redirect settings.
+     */
     constructor(config: PasskeyProviderConfig);
     /**
      * Update the theme configuration at runtime
      */
     setTheme(theme: ThemeConfig): void;
     /**
-     * Build theme URL parameters
+     * Serialize the active theme into URL query parameters for the dialog.
+     *
+     * Merges the instance-level theme (set via constructor or `setTheme`) with any
+     * per-call override, so callers can temporarily change the appearance for a
+     * single dialog invocation without mutating shared state.
+     *
+     * @param overrideTheme - One-shot theme values that take precedence over the
+     *   instance theme for this call only.
+     * @returns A URL-encoded query string (e.g. `"theme=dark&accent=%230090ff"`),
+     *   or an empty string if no theme properties are set.
      */
     private getThemeParams;
     /**
-     * Get the dialog URL (Vite app URL)
-     * Defaults to providerUrl if dialogUrl is not set
+     * Resolve the URL of the dialog app (the Vite/Next.js frontend that renders
+     * the WebAuthn UI inside the iframe).
+     *
+     * `dialogUrl` is a separate config option to support split deployments where
+     * the API server and the dialog frontend run at different origins. Falls back
+     * to `providerUrl` when not explicitly configured — the common case.
+     *
+     * @returns The base URL used when constructing all dialog endpoint paths.
      */
     private getDialogUrl;
     /**
-     * Get the origin for message validation
-     * Uses dialogUrl origin if set, otherwise providerUrl origin
+     * Extract the trusted origin used to validate incoming postMessage events.
+     *
+     * All `window.addEventListener("message", ...)` handlers in this class check
+     * `event.origin` against this value to prevent cross-origin spoofing. Wraps
+     * `getDialogUrl()` in a `new URL()` parse so that paths and query strings are
+     * stripped — only the scheme + host + port are compared.
+     *
+     * Falls back to the raw dialog URL string if URL parsing fails (e.g. during
+     * unit tests with non-standard URL formats).
+     *
+     * @returns The scheme + host + optional port of the dialog app (e.g. `"https://passkey.1auth.box"`).
      */
     private getDialogOrigin;
     /**
@@ -819,6 +813,24 @@ declare class OneAuthClient {
      * Get the configured client ID
      */
     getClientId(): string | undefined;
+    /**
+     * Poll the intent status endpoint until a transaction hash appears or the
+     * intent reaches a terminal failure state.
+     *
+     * This is used after `sendIntent` resolves (with `waitForHash: true`) to
+     * continue waiting for the on-chain hash even after the dialog has been
+     * dismissed. It is intentionally separate from the in-dialog polling loop so
+     * callers that don't need the hash can skip it entirely.
+     *
+     * Errors during individual poll attempts are swallowed so that transient
+     * network issues don't abort the wait prematurely.
+     *
+     * @param intentId - The Rhinestone intent ID returned by the execute endpoint.
+     * @param options.timeoutMs - Maximum wait time in milliseconds (default 120 000).
+     * @param options.intervalMs - Time between polls in milliseconds (default 2 000).
+     * @returns The transaction hash string, or `undefined` if the deadline was
+     *   reached or the intent failed/expired before a hash was produced.
+     */
     private waitForTransactionHash;
     /**
      * Open the authentication modal (sign in + sign up).
@@ -1027,42 +1039,169 @@ declare class OneAuthClient {
      */
     private sendTransactionStatus;
     /**
-     * Wait for the signing result without closing the modal
+     * Listen for a signing result that belongs to a specific `requestId`.
+     *
+     * Used by legacy server-side signing request flows (popup/embed/modal) where
+     * the dialog was pre-loaded with a signing request created via the API. The
+     * `requestId` filter is needed because multiple dialogs may be open or there
+     * may be stale messages from a previous dialog in the queue.
+     *
+     * Resolves on `PASSKEY_SIGNING_RESULT` matching `requestId`, or on
+     * `PASSKEY_CLOSE` (user dismissed the dialog).
+     *
+     * @param requestId - The signing request ID to match against incoming messages.
+     * @param dialog - The `<dialog>` element (opened before this call) used to
+     *   `showModal()` so the dialog becomes interactive.
+     * @param _iframe - Unused; kept for signature consistency with other wait helpers.
+     * @param cleanup - Idempotent teardown function that closes and removes the dialog.
+     * @returns A `SigningResult` discriminated union.
      */
     private waitForIntentSigningResponse;
     /**
-     * Wait for signing result (simplified - no requestId matching)
+     * Listen for a signing result from the currently open modal dialog.
+     *
+     * Unlike `waitForIntentSigningResponse`, this variant does not filter by
+     * `requestId` because the inline intent flow (sendIntent / signMessage /
+     * signTypedData) owns the dialog exclusively — there is no risk of collisions
+     * from other dialogs.
+     *
+     * Handles two result shapes:
+     *   - New "secure flow": dialog executed the intent server-side and returns
+     *     only an `intentId` (no signature exposed to the SDK).
+     *   - Legacy flow: dialog returns a raw `WebAuthnSignature` for the SDK to
+     *     forward to the execute endpoint.
+     *
+     * @param dialog - The `<dialog>` element wrapping the signing iframe.
+     * @param _iframe - Unused; kept for signature consistency with other wait helpers.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
+     * @returns A `SigningResult` extended with an optional `signedHash` field
+     *   populated when the dialog performs message signing.
      */
     private waitForSigningResponse;
     /**
-     * Wait for signing result with auto-refresh support
-     * This method handles both signing results and quote refresh requests from the dialog
+     * Listen for a signing result while also handling quote-refresh requests.
+     *
+     * Quotes from the Rhinestone orchestrator have a short TTL (typically ~60 s).
+     * When the user takes too long to review and the quote expires, the dialog
+     * sends `PASSKEY_REFRESH_QUOTE`. This method intercepts that message, calls
+     * the provided `onRefresh` callback to fetch a new quote, and replies with
+     * either `PASSKEY_REFRESH_COMPLETE` (success) or `PASSKEY_REFRESH_ERROR`
+     * (failure) — allowing the dialog to stay open and show the updated fees
+     * without requiring a full restart.
+     *
+     * Once the user confirms or rejects, the promise resolves with the signing
+     * result exactly as `waitForSigningResponse` would.
+     *
+     * @param dialog - The `<dialog>` element wrapping the signing iframe.
+     * @param iframe - The iframe element; used to post refresh messages back.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
+     * @param dialogOrigin - Trusted origin for message validation (passed in to
+     *   avoid redundant `getDialogOrigin()` calls from the hot path).
+     * @param onRefresh - Async callback that fetches a fresh quote and returns the
+     *   updated intent fields, or `null` if the refresh failed.
+     * @returns A `SigningResult` extended with an optional `signedHash`.
      */
     private waitForSigningWithRefresh;
     /**
-     * Wait for the dialog to be closed
+     * Wait for the dialog to be explicitly closed by the user or the iframe.
+     *
+     * Resolves on either:
+     *   - `PASSKEY_CLOSE` postMessage from the iframe (user clicked the X button
+     *     or the dialog programmatically closed itself after showing a result).
+     *   - The native `<dialog> close` event (escape key or `dialog.close()` call).
+     *
+     * Calling `cleanup()` before awaiting this is safe — both resolution paths
+     * call `cleanup()` internally but it is idempotent. The primary use case is
+     * keeping the dialog open while the SDK polls for a transaction hash, then
+     * showing the final success/error state before letting the user dismiss.
+     *
+     * @param dialog - The `<dialog>` element to watch.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
      */
     private waitForDialogClose;
     /**
-     * Inject a preconnect link tag to pre-warm DNS + TLS for a given URL.
+     * Inject a `<link rel="preconnect">` tag for the given URL's origin.
+     *
+     * Browsers use preconnect hints to resolve DNS, perform the TCP handshake,
+     * and negotiate TLS before a resource is actually requested, reducing
+     * time-to-first-byte when the dialog iframe loads. The tag is deduplicated —
+     * if one already exists for the same origin it will not be added again.
+     *
+     * Only called in browser environments (guarded by `typeof document` in the
+     * constructor). Invalid URLs are silently ignored.
+     *
+     * @param url - Any URL whose origin should be preconnected to.
      */
     private injectPreconnect;
     /**
-     * Wait for the dialog iframe to signal ready without sending init data.
-     * Returns a sendInit function the caller uses once prepare data is available.
+     * Wait for the dialog iframe to signal ready, but defer sending `PASSKEY_INIT`
+     * until the caller decides the time is right.
+     *
+     * This is the deferred variant of `waitForDialogReady`, used by flows that run
+     * the dialog and a background API call in parallel (the "two-phase" approach).
+     * Rather than blocking until both the iframe is ready AND the API call is done,
+     * this method resolves as soon as `PASSKEY_READY` arrives and returns a
+     * `sendInit` callback. The caller invokes `sendInit` once prepare data is
+     * available, which may happen before or after the iframe is ready.
+     *
+     * Timeout: if the iframe never signals ready within 10 seconds (e.g. network
+     * error, origin mismatch), resolves with `{ ready: false }` and calls cleanup.
+     *
+     * @param dialog - The `<dialog>` element wrapping the iframe.
+     * @param iframe - The iframe element that will receive `PASSKEY_INIT`.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
+     * @returns `{ ready: true, sendInit }` when the iframe is ready, or
+     *   `{ ready: false }` if the dialog was closed or timed out first.
      */
     private waitForDialogReadyDeferred;
     /**
-     * Prepare an intent by calling the orchestrator for a quote.
-     * Returns the prepare response and the origin tier from the response header.
+     * Call the passkey service to obtain a Rhinestone orchestrator quote for an
+     * intent (a single target-chain transaction or swap).
+     *
+     * The service contacts the Rhinestone orchestrator, which returns a signed
+     * `intentOp` structure containing the quote, fees, and a WebAuthn challenge
+     * the user must sign to authorize execution.
+     *
+     * The `X-Origin-Tier` response header is forwarded to the dialog so it can
+     * display tier-specific UI (e.g. "Free" vs "Premium" badge).
+     *
+     * Side effect: if the server returns "User not found", the cached user entry
+     * is removed from `localStorage` to force re-authentication.
+     *
+     * @param requestBody - Serialized intent options (bigint amounts converted to
+     *   strings before this call).
+     * @returns On success: `{ success: true, data: PrepareIntentResponse, tier }`.
+     *   On failure: `{ success: false, error: { code, message } }`.
      */
     private prepareIntent;
     /**
-     * Prepare a batch intent by calling the orchestrator for quotes on all intents.
+     * Call the passkey service to obtain orchestrator quotes for all intents in a
+     * batch, returning a single shared WebAuthn challenge.
+     *
+     * The service prepares each intent independently and assembles a merkle tree
+     * whose root becomes the challenge. Signing that root once authorizes every
+     * intent in the batch. Partially-failed batches are supported: the response
+     * includes both `intents` (succeeded) and `failedIntents` (per-intent errors),
+     * so the dialog can still show the successful subset for signing.
+     *
+     * Side effect: same "User not found" localStorage cleanup as `prepareIntent`.
+     *
+     * @param requestBody - Serialized batch options (bigint amounts converted to
+     *   strings before this call).
+     * @returns On success: `{ success: true, data: PrepareBatchIntentResponse, tier }`.
+     *   On failure: `{ success: false, error, failedIntents? }`.
      */
     private prepareBatchIntent;
     /**
-     * Send a prepare error message to the dialog iframe.
+     * Forward a prepare-phase error to the dialog iframe so it can display a
+     * human-readable failure message instead of hanging on the loading state.
+     *
+     * The dialog listens for `PASSKEY_PREPARE_ERROR` and transitions to an error
+     * view. The user can then dismiss the dialog, at which point
+     * `waitForDialogClose` resolves and the SDK returns the error to the caller.
+     *
+     * @param iframe - The iframe element to post the error to.
+     * @param error - Human-readable error message from the prepare response.
      */
     private sendPrepareError;
     /**
@@ -1200,7 +1339,34 @@ declare class OneAuthClient {
     signWithPopup(options: SigningRequestOptions): Promise<SigningResult>;
     signWithRedirect(options: SigningRequestOptions, redirectUrl?: string): Promise<void>;
     signWithEmbed(options: SigningRequestOptions, embedOptions: EmbedOptions): Promise<SigningResult>;
+    /**
+     * Create and append a signing iframe to a caller-supplied container element.
+     *
+     * Used by the `signWithEmbed` flow where the integrator wants the signing UI
+     * to appear inline on their page rather than in a modal overlay. The iframe
+     * loads a pre-created signing request URL and fires `options.onReady` once
+     * the page has loaded.
+     *
+     * @param requestId - The signing request ID; used to construct the iframe src
+     *   and give it a stable DOM id for later removal via `removeEmbed`.
+     * @param options - Embed configuration including the container element,
+     *   optional dimensions, and lifecycle callbacks.
+     * @returns The created `<iframe>` element (already appended to the container).
+     */
     private createEmbed;
+    /**
+     * Listen for a signing result from an embedded (inline) signing iframe.
+     *
+     * Matches incoming `PASSKEY_SIGNING_RESULT` messages against `requestId`
+     * to avoid reacting to messages from other iframes on the page. On resolution
+     * (success or failure), the iframe is removed from the DOM and
+     * `embedOptions.onClose` is invoked.
+     *
+     * @param requestId - The signing request ID to match against incoming messages.
+     * @param iframe - The embedded signing iframe.
+     * @param embedOptions - Embed configuration; `onClose` is called after cleanup.
+     * @returns A `SigningResult` discriminated union.
+     */
     private waitForEmbedResponse;
     removeEmbed(requestId: string): void;
     handleRedirectCallback(): Promise<SigningResult>;
@@ -1208,33 +1374,203 @@ declare class OneAuthClient {
      * Fetch passkeys for a user from the auth provider
      */
     getPasskeys(username: string): Promise<PasskeyCredential[]>;
+    /**
+     * Register a signing request with the passkey service and receive a
+     * short-lived `requestId`.
+     *
+     * Used by the legacy popup, redirect, and embed flows. The passkey service
+     * stores the challenge and metadata server-side so the dialog page can fetch
+     * them by `requestId` without relying on URL parameters alone. This avoids
+     * exposing potentially large challenge payloads in query strings.
+     *
+     * @param options - The signing options (challenge, username, description, etc.).
+     * @param mode - How the dialog will be opened (`"popup"`, `"redirect"`, or `"embed"`).
+     * @param redirectUrl - Only required for `"redirect"` mode; the URL the dialog
+     *   will navigate back to after signing.
+     * @returns The created signing request with its unique `requestId`.
+     * @throws If the API call fails.
+     */
     private createSigningRequest;
+    /**
+     * Open a centered popup window for the signing or auth dialog.
+     *
+     * Positions the popup near the top of the current window (50px from the top)
+     * and horizontally centered relative to the browser window. Uses `popup=true`
+     * to request a minimal chrome popup (no address bar) on browsers that support
+     * the Window Management API.
+     *
+     * @param url - The full URL to open in the popup.
+     * @returns The popup `Window` reference, or `null` if the browser blocked it.
+     */
     private openPopup;
     /**
-     * Wait for the dialog iframe to signal ready, then send init data.
-     * Also handles early close (X button, escape, backdrop) during the ready phase.
-     * Returns true if dialog is ready, false if it was closed before becoming ready.
+     * Wait for the dialog iframe to signal ready, then immediately send init data.
+     *
+     * This is the synchronous-init variant: `initMessage` is available at call
+     * time, so it can be posted as soon as `PASSKEY_READY` arrives. Use
+     * `waitForDialogReadyDeferred` when init data depends on an in-flight API call.
+     *
+     * Also handles early close (X button, escape key, backdrop click) during the
+     * ready phase so those paths resolve cleanly without leaking event listeners.
+     *
+     * Timeout: resolves `false` after 10 seconds if the iframe never signals ready
+     * (e.g. origin mismatch or network error loading the dialog app).
+     *
+     * @param dialog - The `<dialog>` element wrapping the iframe.
+     * @param iframe - The iframe element that will receive `PASSKEY_INIT`.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
+     * @param initMessage - The `PASSKEY_INIT` payload to send when ready.
+     * @returns `true` if the dialog is ready and init was sent; `false` if the
+     *   dialog was closed or timed out before becoming ready.
      */
     private waitForDialogReady;
     /**
-     * Create a modal dialog with a full-viewport iframe inside.
-     * All visual chrome (backdrop, positioning, animations) is rendered
-     * by the passkey app inside the iframe — the SDK just provides
-     * a transparent full-screen container.
+     * Create and open a full-viewport `<dialog>` containing a passkey iframe.
+     *
+     * The SDK owns only the transparent outer shell; all visible UI (backdrop,
+     * card, animations, close button) is rendered by the passkey app inside the
+     * iframe. This approach means design changes can be shipped server-side
+     * without updating SDK consumers.
+     *
+     * Lifecycle:
+     *   1. A themed "Loading…" overlay is injected and shown immediately while the
+     *      iframe loads, matching the exact visual structure of the passkey app's
+     *      TitleBar + IndeterminateLoader so the transition is seamless.
+     *   2. When the iframe sends `PASSKEY_RENDERED`, the overlay fades out and
+     *      the iframe becomes fully visible.
+     *   3. The returned `cleanup` function tears down all event listeners,
+     *      disconnects the MutationObserver, closes the `<dialog>`, and removes
+     *      it from the DOM. It is idempotent — safe to call multiple times.
+     *
+     * Browser quirks handled:
+     *   - The 1Password extension sets `inert` on the `<dialog>`, making it
+     *     non-interactive. A MutationObserver removes the attribute immediately.
+     *   - Password managers may also set `inert` on dialog siblings; cleanup
+     *     restores those as well.
+     *   - The iframe sandbox includes `allow-popups-to-escape-sandbox` so that
+     *     1Password's popup UI can render outside the sandboxed context.
+     *
+     * @param url - The full URL (including query params) to load in the iframe.
+     * @returns References to the dialog, iframe, and a cleanup function.
      */
     private createModalDialog;
+    /**
+     * Listen for the auth result from the modal dialog.
+     *
+     * Waits for `PASSKEY_READY` before processing any other messages to avoid
+     * acting on stale `PASSKEY_CLOSE` events that may still be in the event queue
+     * from a previously closed dialog.
+     *
+     * Also handles the `PASSKEY_RETRY_POPUP` message: sent by the dialog when a
+     * password manager (e.g. Bitwarden) intercepts the WebAuthn call inside the
+     * iframe. In that case the SDK seamlessly re-opens a standalone popup window,
+     * where WebAuthn works without cross-origin iframe restrictions, and waits
+     * for the result from there instead.
+     *
+     * @param _dialog - Unused; kept for signature consistency.
+     * @param iframe - The iframe element; used to send `PASSKEY_INIT` on ready.
+     * @param cleanup - Idempotent teardown for the modal dialog.
+     * @returns An `AuthResult` discriminated union.
+     */
     private waitForModalAuthResponse;
     /**
      * Open a popup for auth and wait for the result.
      * Used when iframe mode fails (e.g., due to password manager interference).
      */
     private waitForPopupAuthResponse;
+    /**
+     * Listen for the authenticate result from the modal dialog.
+     *
+     * The authenticate flow combines sign-in/sign-up with optional off-chain
+     * challenge signing. The dialog sends `PASSKEY_AUTHENTICATE_RESULT` on
+     * completion with both user details and, if a challenge was requested, the
+     * WebAuthn signature and the hashed challenge value for server-side
+     * verification.
+     *
+     * @param _dialog - Unused; kept for signature consistency.
+     * @param _iframe - Unused; kept for signature consistency.
+     * @param cleanup - Idempotent teardown for the modal dialog.
+     * @returns An `AuthenticateResult` discriminated union.
+     */
     private waitForAuthenticateResponse;
+    /**
+     * Listen for the connect result from the connect dialog.
+     *
+     * The connect flow is a lightweight "are you still you?" confirmation that
+     * does not require a new passkey ceremony. On success, the dialog returns the
+     * user's username, address, and an `autoConnected` flag indicating whether the
+     * user had previously enabled auto-connect (in which case no UI was shown).
+     *
+     * On failure with `action: "switch"`, the caller should redirect to the full
+     * auth flow because the user has no cached session to confirm.
+     *
+     * @param _dialog - Unused; kept for signature consistency.
+     * @param _iframe - Unused; kept for signature consistency.
+     * @param cleanup - Idempotent teardown for the modal dialog.
+     * @returns A `ConnectResult` discriminated union.
+     */
     private waitForConnectResponse;
+    /**
+     * Listen for the consent result from the consent dialog.
+     *
+     * The consent dialog shows the user which data fields an app is requesting
+     * access to and lets them approve or deny. On approval, `data` contains the
+     * consented field values (e.g. email address, device names) and `grantedAt`
+     * records when consent was given.
+     *
+     * A `PASSKEY_CLOSE` without a prior `PASSKEY_CONSENT_RESULT` is treated as an
+     * explicit user cancellation (distinct from denial, though both yield
+     * `success: false`).
+     *
+     * @param _dialog - Unused; kept for signature consistency.
+     * @param _iframe - Unused; kept for signature consistency.
+     * @param cleanup - Idempotent teardown for the modal dialog.
+     * @returns A `RequestConsentResult` discriminated union.
+     */
     private waitForConsentResponse;
+    /**
+     * Listen for a signing result from a server-request-based modal dialog.
+     *
+     * Similar to `waitForIntentSigningResponse` but intended for the older
+     * `signWithModal` path that pre-creates a signing request via the API (rather
+     * than inlining all data in `PASSKEY_INIT`). Filters by `requestId` to handle
+     * the case where stale messages from a previous dialog may still be in flight.
+     *
+     * @param requestId - The signing request ID to match against incoming messages.
+     * @param _dialog - Unused; kept for signature consistency.
+     * @param _iframe - Unused; kept for signature consistency.
+     * @param cleanup - Idempotent teardown that closes and removes the dialog.
+     * @returns A `SigningResult` discriminated union.
+     */
     private waitForModalSigningResponse;
+    /**
+     * Listen for a signing result from a popup window.
+     *
+     * Polls for popup closure every 500 ms as a fallback to detect when the user
+     * closes the popup without completing the signing flow (no `PASSKEY_CLOSE`
+     * message is fired in that case because the popup's unload event cannot
+     * reliably postMessage to the opener on all browsers).
+     *
+     * On success or cancellation, the popup is programmatically closed and the
+     * interval is cleared.
+     *
+     * @param requestId - The signing request ID to match against incoming messages.
+     * @param popup - The popup `Window` reference returned by `openPopup`.
+     * @returns A `SigningResult` discriminated union.
+     */
     private waitForPopupResponse;
+    /**
+     * Fetch the completed signing result from the passkey service by request ID.
+     *
+     * Used by the redirect flow: after the passkey service redirects back to
+     * `redirectUrl`, the integrator calls `handleRedirectCallback()`, which
+     * extracts `requestId` from the URL query params and delegates here to
+     * retrieve the full signature from the server.
+     *
+     * @param requestId - The signing request ID from the redirect callback URL.
+     * @returns A `SigningResult` discriminated union.
+     */
     private fetchSigningResult;
 }
 
-export { type RequestConsentResult as $, type AuthResult as A, type BalanceRequirement as B, type CreateSigningRequestResponse as C, type DeveloperSignedIntent as D, type EmbedOptions as E, type CloseOnStatus as F, type PrepareIntentResponse as G, type ExecuteIntentResponse as H, type IntentSigner as I, type IntentHistoryOptions as J, type IntentHistoryItem as K, type IntentHistoryResult as L, type SendSwapOptions as M, type SendSwapResult as N, OneAuthClient as O, type PasskeyProviderConfig as P, type SwapQuote as Q, type ThemeConfig as R, type SendIntentResult as S, type TransactionAction as T, type UserPasskeysResponse as U, type ConsentField as V, type WebAuthnSignature as W, type ConsentData as X, type CheckConsentOptions as Y, type CheckConsentResult as Z, type RequestConsentOptions as _, type IntentCall as a, type BatchIntentItem as a0, type SendBatchIntentOptions as a1, type SendBatchIntentResult as a2, type BatchIntentItemResult as a3, type PreparedBatchIntent as a4, type PrepareBatchIntentResponse as a5, type SigningRequestOptions as b, type SigningResult as c, type SigningSuccess as d, type SigningError as e, type SigningErrorCode as f, type SigningRequestStatus as g, type PasskeyCredential as h, type ConnectResult as i, type AuthenticateOptions as j, type AuthenticateResult as k, type SigningResultBase as l, type SignMessageOptions as m, type SignMessageResult as n, type SignTypedDataOptions as o, type SignTypedDataResult as p, type EIP712Domain as q, type EIP712Types as r, type EIP712TypeField as s, type TransactionFees as t, type TransactionDetails as u, type IntentTokenRequest as v, type SendIntentOptions as w, type IntentQuote as x, type IntentStatus as y, type OrchestratorStatus as z };
+export { type SendBatchIntentOptions as $, type AuthResult as A, type BalanceRequirement as B, type CreateSigningRequestResponse as C, type PrepareIntentResponse as D, type EmbedOptions as E, type ExecuteIntentResponse as F, type IntentHistoryOptions as G, type IntentHistoryItem as H, type IntentCall as I, type IntentHistoryResult as J, type SendSwapOptions as K, type SendSwapResult as L, type SwapQuote as M, type ThemeConfig as N, OneAuthClient as O, type PasskeyProviderConfig as P, type ConsentField as Q, type ConsentData as R, type SendIntentResult as S, type TransactionAction as T, type UserPasskeysResponse as U, type CheckConsentOptions as V, type WebAuthnSignature as W, type CheckConsentResult as X, type RequestConsentOptions as Y, type RequestConsentResult as Z, type BatchIntentItem as _, type SigningRequestOptions as a, type SendBatchIntentResult as a0, type BatchIntentItemResult as a1, type PreparedBatchIntent as a2, type PrepareBatchIntentResponse as a3, type SigningResult as b, type SigningSuccess as c, type SigningError as d, type SigningErrorCode as e, type SigningRequestStatus as f, type PasskeyCredential as g, type ConnectResult as h, type AuthenticateOptions as i, type AuthenticateResult as j, type SigningResultBase as k, type SignMessageOptions as l, type SignMessageResult as m, type SignTypedDataOptions as n, type SignTypedDataResult as o, type EIP712Domain as p, type EIP712Types as q, type EIP712TypeField as r, type TransactionFees as s, type TransactionDetails as t, type IntentTokenRequest as u, type SendIntentOptions as v, type IntentQuote as w, type IntentStatus as x, type OrchestratorStatus as y, type CloseOnStatus as z };