@rhinestone/1auth 0.6.8 → 0.6.10

package/dist/index.mjs

@@ -1,7 +1,15 @@
 import {
-  buildTransactionReview,
-  createOneAuthProvider,
-  encodeWebAuthnSignature,
+  tokenFetchError
+} from "./chunk-IIACVHR3.mjs";
+import {
+  ETHEREUM_MESSAGE_PREFIX,
+  hashMessage,
+  verifyMessageHash
+} from "./chunk-IHBVEU33.mjs";
+import {
+  createOneAuthProvider
+} from "./chunk-THKG3FAG.mjs";
+import {
   getAllSupportedChainsAndTokens,
   getChainById,
   getChainExplorerUrl,
@@ -14,19 +22,280 @@ import {
   getTokenAddress,
   getTokenDecimals,
   getTokenSymbol,
-  hashCalls,
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress
-} from "./chunk-SXISYG2P.mjs";
+} from "./chunk-GUAI55LL.mjs";
+import {
+  buildTransactionReview,
+  encodeWebAuthnSignature,
+  hashCalls
+} from "./chunk-N6KE5CII.mjs";
+
+// src/client.ts
+import { hashTypedData } from "viem";
+
+// src/assets.ts
+function withNetworkBucket(balance) {
+  return {
+    ...balance,
+    isTestnet: balance.isTestnet ?? isTestnet(balance.chainId)
+  };
+}
+function bucketAssetBalances(balances) {
+  const mainnetBalances = [];
+  const testnetBalances = [];
+  for (const balance of balances) {
+    const normalized = withNetworkBucket(balance);
+    if (normalized.isTestnet) {
+      testnetBalances.push(normalized);
+    } else {
+      mainnetBalances.push(normalized);
+    }
+  }
+  return {
+    mainnets: { balances: mainnetBalances },
+    testnets: { balances: testnetBalances }
+  };
+}
+function normalizeAssetsResponse(payload) {
+  const data = payload && typeof payload === "object" ? payload : {};
+  if (Array.isArray(data.balances)) {
+    const balances2 = data.balances.map(withNetworkBucket);
+    const buckets = bucketAssetBalances(balances2);
+    return { ...data, balances: balances2, ...buckets };
+  }
+  const balances = [];
+  const assets = Array.isArray(data.assets) ? data.assets : [];
+  for (const asset of assets) {
+    const symbol = asset.symbol ?? "UNKNOWN";
+    const decimals = asset.decimals ?? 18;
+    const chains = Array.isArray(asset.chains) ? asset.chains : [];
+    if (chains.length === 0) {
+      const token = asset.token ?? asset.address;
+      if (token) {
+        balances.push(withNetworkBucket({
+          chainId: 0,
+          token,
+          symbol,
+          decimals,
+          balance: asset.balance ?? asset.amount ?? "0",
+          ...asset.usdValue !== void 0 && { usdValue: asset.usdValue }
+        }));
+      }
+      continue;
+    }
+    for (const chain of chains) {
+      const chainId = chain.chainId ?? chain.chain;
+      const token = chain.token ?? chain.address;
+      if (typeof chainId !== "number" || !token) continue;
+      balances.push(withNetworkBucket({
+        chainId,
+        token,
+        symbol,
+        decimals: chain.decimals ?? decimals,
+        balance: chain.balance ?? chain.amount ?? "0",
+        ...asset.usdValue !== void 0 && { usdValue: asset.usdValue },
+        ...chain.isTestnet !== void 0 && { isTestnet: chain.isTestnet }
+      }));
+    }
+  }
+  return { ...data, balances, ...bucketAssetBalances(balances) };
+}
+async function fetchAssetsResponse(options) {
+  const portfolioUrl = new URL(
+    `/api/users/${encodeURIComponent(options.identifier)}/portfolio`,
+    options.providerUrl
+  );
+  portfolioUrl.searchParams.set("all", "true");
+  const response = await fetch(portfolioUrl.toString(), {
+    headers: {
+      ...options.headers,
+      ...options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {},
+      ...options.clientId ? { "x-client-id": options.clientId } : {}
+    }
+  });
+  if (!response.ok) {
+    const data = await response.json().catch(() => ({}));
+    throw new Error(data.error || "Failed to get assets");
+  }
+  return normalizeAssetsResponse(await response.json());
+}
+
+// ../loading-tokens/src/index.ts
+var SPINNER_SIZE = 82;
+var SPINNER_STROKE = 2.4118;
+var SPINNER_RADIUS = (SPINNER_SIZE - SPINNER_STROKE) / 2;
+var SPINNER_CIRCUMFERENCE = 2 * Math.PI * SPINNER_RADIUS;
+var SPINNER_ARC_FRACTION = 0.17;
+var SPINNER_ARC = SPINNER_CIRCUMFERENCE * SPINNER_ARC_FRACTION;
+var SPINNER_SPIN_DURATION_MS = 800;
+var LOADING_MODAL_WIDTH = 380;
+var LOADING_MODAL_PADDING = 12;
+var LOADING_MODAL_RADIUS = 16;
+var LOADING_BODY_GAP = 12;
+var LOADING_ICON_PADDING = 12;
+var LOADING_TITLE_BLOCK_GAP = 4;
+var LOADING_TITLE_FONT_SIZE = 20;
+var LOADING_TITLE_FONT_WEIGHT = 700;
+var LOADING_SUBTITLE_FONT_SIZE = 12;
+var LOADING_SUBTITLE_FONT_WEIGHT = 500;
+var LOADING_LINE_HEIGHT = "normal";
+var LOADING_FONT_FAMILY = "'Inter', ui-sans-serif, system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji'";
+var BRAND_PURPLE = "#685bff";
+var LIGHT_TOKENS = {
+  bgPrimary: "#ffffff",
+  borderColor: "#f4f4f5",
+  textPrimary: "#27272a",
+  textSecondary: "#71717b"
+};
+var DARK_TOKENS = {
+  bgPrimary: "#0a0a0a",
+  borderColor: "#18181b",
+  textPrimary: "#e4e4e7",
+  textSecondary: "#9f9fa9"
+};
+var LOADING_TITLE = "Loading...";
+var LOADING_SUBTITLE = "This will only take a few moments, do not close the window.";
 
 // src/client.ts
-import { parseUnits, hashTypedData } from "viem";
-var POPUP_WIDTH = 450;
+var POPUP_WIDTH = LOADING_MODAL_WIDTH;
 var POPUP_HEIGHT = 600;
-var DEFAULT_EMBED_WIDTH = "400px";
+var DEFAULT_EMBED_WIDTH = `${LOADING_MODAL_WIDTH}px`;
 var DEFAULT_EMBED_HEIGHT = "500px";
 var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+function currentWindowOrigin() {
+  if (typeof window === "undefined") return null;
+  const origin = window.location?.origin;
+  return typeof origin === "string" && origin.length > 0 ? origin : null;
+}
+function appendParentOriginParam(params) {
+  const origin = currentWindowOrigin();
+  if (origin) params.set("parentOrigin", origin);
+}
+var MAX_LABEL_LEN = 20;
+var DEFAULT_BACKDROP_COLOR = "#000000";
+var DEFAULT_BACKDROP_OPACITY = 0.4;
+var DEFAULT_BACKDROP_BLUR = 8;
+var HEX_COLOR_RE = /^#[0-9a-fA-F]{6}$/;
+function resolveBackdropStyle(params) {
+  const rawColor = params.get("backdropColor");
+  const hex = (rawColor && HEX_COLOR_RE.test(rawColor) ? rawColor : DEFAULT_BACKDROP_COLOR).slice(1);
+  const r = parseInt(hex.slice(0, 2), 16);
+  const g = parseInt(hex.slice(2, 4), 16);
+  const b = parseInt(hex.slice(4, 6), 16);
+  const clampNumber = (key, min, max, fallback) => {
+    const raw = params.get(key);
+    if (!raw) return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) ? Math.min(max, Math.max(min, n)) : fallback;
+  };
+  const opacity = clampNumber("backdropOpacity", 0, 1, DEFAULT_BACKDROP_OPACITY);
+  const blur = clampNumber("backdropBlur", 0, 40, DEFAULT_BACKDROP_BLUR);
+  return { background: `rgba(${r}, ${g}, ${b}, ${opacity})`, blur };
+}
+function generateModalNonce() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function generateTelemetryOperationId() {
+  return `1auth-${generateModalNonce()}`;
+}
+function cleanTelemetryAttributes(attributes) {
+  if (!attributes) return void 0;
+  const clean = {};
+  for (const [key, value] of Object.entries(attributes)) {
+    if (value !== void 0) clean[key] = value;
+  }
+  return Object.keys(clean).length > 0 ? clean : void 0;
+}
+function describeTelemetryError(error) {
+  if (!error) return {};
+  if (error instanceof Error) {
+    return { errorCode: error.name, errorMessage: error.message };
+  }
+  if (typeof error === "object") {
+    const err = error;
+    return {
+      errorCode: typeof err.code === "string" ? err.code : void 0,
+      errorMessage: typeof err.message === "string" ? err.message : String(error)
+    };
+  }
+  return { errorMessage: String(error) };
+}
+function capCallLabels(calls) {
+  if (!calls) return calls;
+  return calls.map((c) => {
+    const cappedLabel = c.label && c.label.length > MAX_LABEL_LEN ? c.label.slice(0, MAX_LABEL_LEN - 1) + "\u2026" : c.label;
+    const cappedSublabel = c.sublabel && c.sublabel.length > MAX_LABEL_LEN ? c.sublabel.slice(0, MAX_LABEL_LEN - 1) + "\u2026" : c.sublabel;
+    if (cappedLabel === c.label && cappedSublabel === c.sublabel) return c;
+    return { ...c, label: cappedLabel, sublabel: cappedSublabel };
+  });
+}
+function getStoredSignerType() {
+  if (typeof window === "undefined") return "passkey";
+  try {
+    const raw = window.localStorage.getItem("1auth-user");
+    if (!raw) return "passkey";
+    const parsed = JSON.parse(raw);
+    return parsed?.signerType === "eoa" ? "eoa" : "passkey";
+  } catch {
+    return "passkey";
+  }
+}
+var DEFAULT_BLIND_SIGNING = true;
+var MISSING_APP_CREDENTIALS_MESSAGE = "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.";
+function normalizeSponsorship(config) {
+  if (!config) return null;
+  if ("accessToken" in config && "getExtensionToken" in config) {
+    return config;
+  }
+  const { accessTokenUrl, extensionTokenUrl } = config;
+  return {
+    accessToken: async () => {
+      const response = await fetch(accessTokenUrl, { credentials: "include" });
+      if (!response.ok) {
+        throw await tokenFetchError("access token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Access token response missing `token` field");
+      }
+      return data.token;
+    },
+    getExtensionToken: async (intentOp) => {
+      const response = await fetch(extensionTokenUrl, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ intentOp })
+      });
+      if (!response.ok) {
+        throw await tokenFetchError("extension token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Extension token response missing `token` field");
+      }
+      return data.token;
+    }
+  };
+}
+function grantPermissionReplacer(_key, value) {
+  return typeof value === "bigint" ? value.toString() : value;
+}
+function cloneGrantPayload(value) {
+  return JSON.parse(JSON.stringify(value, grantPermissionReplacer));
+}
+function normalizeGrantTargetChains(options) {
+  const chainCandidates = options.targetChains ?? (options.targetChain !== void 0 ? [options.targetChain] : []);
+  return Array.from(new Set(chainCandidates));
+}
+function normalizeGrantSourceChains(options) {
+  return Array.from(new Set(options.sourceChains ?? []));
+}
 var OneAuthClient = class {
   /**
    * Create a new OneAuthClient.
@@ -40,15 +309,246 @@ var OneAuthClient = class {
    *   clientId, theme, and redirect settings.
    */
   constructor(config) {
+    // Persistent state for EOA forwarding via `/dialog/sign-eoa`. The iframe
+    // is created lazily on the first `requestWithWallet` call and reused for
+    // every subsequent call so its WalletConnect SignClient survives between
+    // transactions — otherwise each call would spin up a fresh SignClient
+    // that restores stale relay state from localStorage, producing
+    // "Restore will override" warnings and "emitting session_request:N
+    // without any listeners" errors on the second and later txs.
+    this.eoaDialogState = null;
+    // Hidden iframe that warms the dialog ahead of the first real open (see
+    // `prewarm()`). The passkey app runs on a long-lived server (not serverless),
+    // so there is no backend cold-start to hide — what stays expensive is the
+    // *browser-side* cost of a freshly created cross-origin iframe: downloading
+    // the dialog HTML + JS bundle, parsing it, hydrating React, and loading the
+    // font. Loading that bundle once into a parked hidden iframe lets the real
+    // open hit the HTTP cache (Next.js chunks/fonts are immutable-cached) over an
+    // already-warm connection, so the SDK preload overlay is shown only briefly.
+    this.prewarmState = null;
+    // Serialises concurrent `requestWithWallet` calls — they would otherwise
+    // both try to drive the same iframe and cross-resolve each other.
+    this.eoaSerialQueue = Promise.resolve();
     const providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;
     const dialogUrl = config.dialogUrl || providerUrl;
     this.config = { ...config, providerUrl, dialogUrl };
     this.theme = this.config.theme || {};
+    this.sponsorship = normalizeSponsorship(config.sponsorship);
     if (typeof document !== "undefined") {
       this.injectPreconnect(providerUrl);
       if (dialogUrl !== providerUrl) {
         this.injectPreconnect(dialogUrl);
       }
+      if (this.config.prewarm) {
+        const warm = () => void this.prewarm();
+        const ric = window.requestIdleCallback;
+        if (typeof ric === "function") {
+          ric(warm, { timeout: 2e3 });
+        } else {
+          setTimeout(warm, 200);
+        }
+      }
+    }
+    const initOperation = this.createTelemetryOperation("client", {
+      hasClientId: !!this.config.clientId,
+      hasDialogUrlOverride: dialogUrl !== providerUrl
+    });
+    this.emitTelemetry("client.init", initOperation, { outcome: "started" });
+  }
+  /**
+   * Update the sponsorship configuration at runtime. Pass `undefined` to
+   * disable sponsorship.
+   */
+  setSponsorship(sponsorship) {
+    this.sponsorship = normalizeSponsorship(sponsorship);
+  }
+  /**
+   * Whether the caller opted into SDK telemetry propagation or callbacks.
+   */
+  shouldUseTelemetry() {
+    return !!this.config.telemetry && this.config.telemetry.enabled !== false;
+  }
+  /**
+   * Resolve the host app's current trace context. Callback failures are
+   * ignored because observability can never be allowed to break signing.
+   */
+  getTelemetryTraceContext() {
+    const traceContext = this.config.telemetry?.traceContext;
+    if (!traceContext || !this.shouldUseTelemetry()) return void 0;
+    try {
+      return typeof traceContext === "function" ? traceContext() : traceContext;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Resolve host-provided SDK event attributes and remove undefined fields.
+   */
+  getTelemetryAttributes() {
+    const attributes = this.config.telemetry?.attributes;
+    if (!attributes || !this.shouldUseTelemetry()) return void 0;
+    try {
+      const resolved = typeof attributes === "function" ? attributes() : attributes;
+      return cleanTelemetryAttributes(resolved);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Create per-operation telemetry context shared by callbacks, HTTP headers,
+   * dialog URL params, and PASSKEY_INIT messages.
+   */
+  createTelemetryOperation(flow, attributes) {
+    return {
+      operationId: generateTelemetryOperationId(),
+      flow,
+      startedAt: Date.now(),
+      trace: this.getTelemetryTraceContext(),
+      attributes: cleanTelemetryAttributes({
+        ...this.getTelemetryAttributes(),
+        ...attributes
+      })
+    };
+  }
+  /**
+   * Emit a telemetry event to the host app. The callback is intentionally
+   * fire-and-forget and exception-safe so app telemetry cannot affect users.
+   */
+  emitTelemetry(name, operation, patch = {}) {
+    const onEvent = this.config.telemetry?.onEvent;
+    if (!onEvent || !this.shouldUseTelemetry()) return;
+    const attributes = cleanTelemetryAttributes({
+      ...operation.attributes,
+      ...patch.attributes
+    });
+    const event = {
+      name,
+      operationId: operation.operationId,
+      flow: operation.flow,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: patch.durationMs ?? Date.now() - operation.startedAt,
+      clientId: this.config.clientId,
+      providerUrl: this.config.providerUrl,
+      dialogUrl: this.getDialogUrl(),
+      trace: operation.trace,
+      ...patch,
+      attributes
+    };
+    try {
+      onEvent(event);
+    } catch {
+    }
+  }
+  /**
+   * Attach SDK correlation and optional W3C trace context to dialog URLs.
+   */
+  appendTelemetryParams(params, operation) {
+    if (!this.shouldUseTelemetry()) return;
+    params.set("sdkOperationId", operation.operationId);
+    params.set("sdkTelemetryFlow", operation.flow);
+    if (operation.trace?.traceparent) {
+      params.set("traceparent", operation.trace.traceparent);
+    }
+    if (operation.trace?.tracestate) {
+      params.set("tracestate", operation.trace.tracestate);
+    }
+    if (operation.trace?.traceId) {
+      params.set("sdkTraceId", operation.trace.traceId);
+    }
+    if (operation.trace?.spanId) {
+      params.set("sdkSpanId", operation.trace.spanId);
+    }
+  }
+  /**
+   * Add SDK correlation headers to passkey API calls. These headers are also
+   * valid W3C trace propagation inputs when the host app supplies traceparent.
+   */
+  telemetryHeaders(operation) {
+    if (!operation || !this.shouldUseTelemetry()) return {};
+    return {
+      "x-1auth-sdk-operation-id": operation.operationId,
+      "x-1auth-sdk-flow": operation.flow,
+      ...operation.trace?.traceparent ? { traceparent: operation.trace.traceparent } : {},
+      ...operation.trace?.tracestate ? { tracestate: operation.trace.tracestate } : {}
+    };
+  }
+  /**
+   * Embed telemetry context in PASSKEY_INIT payloads for dialog-side API calls.
+   */
+  telemetryPayload(operation) {
+    if (!this.shouldUseTelemetry()) return void 0;
+    return {
+      operationId: operation.operationId,
+      flow: operation.flow,
+      ...operation.trace?.traceparent ? { traceparent: operation.trace.traceparent } : {},
+      ...operation.trace?.tracestate ? { tracestate: operation.trace.tracestate } : {},
+      ...operation.trace?.traceId ? { traceId: operation.trace.traceId } : {},
+      ...operation.trace?.spanId ? { spanId: operation.trace.spanId } : {}
+    };
+  }
+  /**
+   * Determine whether this signing call should request invisible dialog mode.
+   * Resolution order: per-call option wins over the constructor config, which
+   * wins over the platform-wide {@link DEFAULT_BLIND_SIGNING}. This lets an app
+   * flip the global default for itself while still overriding individual
+   * high-risk calls — e.g. default-blind but force the review UI for a large
+   * transfer, or default-visible but blind-sign selected low-risk signatures.
+   */
+  shouldRequestBlindSigning(options) {
+    return options?.blind_signing ?? this.config.blind_signing ?? DEFAULT_BLIND_SIGNING;
+  }
+  /**
+   * Fetch the app's access token (JWT). Called up front, before
+   * `/api/intent/prepare`, so the passkey server can authenticate the
+   * orchestrator quote call with the app's JWT instead of a service-level
+   * API key.
+   *
+   * Does not depend on `intentOp` — can run in parallel with anything that
+   * also doesn't depend on the quote.
+   */
+  async fetchAccessToken() {
+    if (!this.sponsorship) {
+      return {
+        ok: false,
+        code: "MISSING_APP_CREDENTIALS",
+        message: MISSING_APP_CREDENTIALS_MESSAGE
+      };
+    }
+    try {
+      const accessToken = await this.sponsorship.accessToken();
+      return { ok: true, accessToken };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  /**
+   * Fetch one extension token per intent, aligned with `sponsorFlags`.
+   * Returns an empty array when no intent is sponsored. Fired after
+   * `/prepare` so each token can be bound to its quote's `intentOp`, and
+   * overlaps the dialog / WebAuthn ceremony for no added serial latency.
+   */
+  async fetchExtensionTokens(intentOps, sponsorFlags) {
+    if (!this.sponsorship) {
+      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
+    }
+    const anySponsored = sponsorFlags.some(Boolean);
+    if (!anySponsored) return { ok: true, extensionTokens: [] };
+    try {
+      const sponsorship = this.sponsorship;
+      const tokens = await Promise.all(
+        intentOps.map(
+          (op, i) => sponsorFlags[i] ? sponsorship.getExtensionToken(op) : Promise.resolve("")
+        )
+      );
+      return { ok: true, extensionTokens: tokens };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
     }
   }
   /**
@@ -75,8 +575,23 @@ var OneAuthClient = class {
     if (theme.mode) {
       params.set("theme", theme.mode);
     }
-    if (theme.accent) {
-      params.set("accent", theme.accent);
+    const instancePrimary = this.theme.primaryColor ?? this.theme.accent;
+    const overridePrimary = overrideTheme?.primaryColor ?? overrideTheme?.accent;
+    const primary = overridePrimary ?? instancePrimary;
+    if (primary) {
+      params.set("accent", primary);
+    }
+    const backdrop = theme.backdrop;
+    if (backdrop) {
+      if (backdrop.color) {
+        params.set("backdropColor", backdrop.color);
+      }
+      if (backdrop.opacity !== void 0) {
+        params.set("backdropOpacity", String(backdrop.opacity));
+      }
+      if (backdrop.blur !== void 0) {
+        params.set("backdropBlur", String(backdrop.blur));
+      }
     }
     return params.toString();
   }
@@ -126,6 +641,60 @@ var OneAuthClient = class {
   getClientId() {
     return this.config.clientId;
   }
+  /**
+   * Whether this client operates on testnet chains only.
+   */
+  getTestnets() {
+    return this.config.testnets ?? false;
+  }
+  /**
+   * Get a unified token portfolio for a 1auth account across mainnets and
+   * testnets.
+   *
+   * @example
+   * ```typescript
+   * const assets = await client.getAssets({
+   *   accountAddress: "0x1111111111111111111111111111111111111111",
+   * });
+   * console.log(assets.mainnets.balances, assets.testnets.balances);
+   * ```
+   */
+  async getAssets(options) {
+    if (!options.accountAddress) {
+      throw new Error("getAssets requires accountAddress");
+    }
+    const telemetry = this.createTelemetryOperation("assets", {
+      hasAccountAddress: !!options.accountAddress
+    });
+    try {
+      const accessTokenResult = await this.fetchAccessToken();
+      if (!accessTokenResult.ok) {
+        throw new Error(accessTokenResult.message);
+      }
+      const result = await fetchAssetsResponse({
+        providerUrl: this.config.providerUrl,
+        identifier: options.accountAddress,
+        clientId: this.config.clientId,
+        accessToken: accessTokenResult.accessToken,
+        headers: this.telemetryHeaders(telemetry)
+      });
+      this.emitTelemetry("assets.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          balanceCount: result.balances.length,
+          mainnetBalanceCount: result.mainnets.balances.length,
+          testnetBalanceCount: result.testnets.balances.length
+        }
+      });
+      return result;
+    } catch (error) {
+      this.emitTelemetry("assets.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(error)
+      });
+      throw error;
+    }
+  }
   /**
    * Poll the intent status endpoint until a transaction hash appears or the
    * intent reaches a terminal failure state.
@@ -144,7 +713,7 @@ var OneAuthClient = class {
    * @returns The transaction hash string, or `undefined` if the deadline was
    *   reached or the intent failed/expired before a hash was produced.
    */
-  async waitForTransactionHash(intentId, options = {}) {
+  async waitForTransactionHash(intentId, options = {}, telemetry) {
     const timeoutMs = options.timeoutMs ?? 12e4;
     const intervalMs = options.intervalMs ?? 2e3;
     const deadline = Date.now() + timeoutMs;
@@ -153,7 +722,10 @@ var OneAuthClient = class {
         const response = await fetch(
           `${this.config.providerUrl}/api/intent/status/${intentId}`,
           {
-            headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+            headers: {
+              ...this.telemetryHeaders(telemetry),
+              ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+            }
           }
         );
         if (response.ok) {
@@ -181,6 +753,8 @@ var OneAuthClient = class {
    * @param options.username - Pre-fill the username field
    * @param options.theme - Override the theme for this modal invocation
    * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+   * @param options.flow - Force the login or account-creation route instead
+   *   of the default auto-detect entry route
    * @returns {@link AuthResult} with user details and typed address
    *
    * @example
@@ -196,9 +770,54 @@ var OneAuthClient = class {
    * ```
    */
   async authWithModal(options) {
+    return this.openAuthModal(options);
+  }
+  /**
+   * Open the sign-in modal directly.
+   *
+   * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+   * returning-user flow. Use it when the embedding app already knows the user
+   * is creating a login session, for example after an app-level "Log in"
+   * button. The result intentionally matches {@link authWithModal}.
+   *
+   * @param options.username - Optional account hint for the sign-in ceremony
+   * @param options.theme - Override the theme for this modal invocation
+   * @returns {@link AuthResult} with user details and typed address
+   */
+  async loginWithModal(options) {
+    return this.openAuthModal({ ...options, flow: "login" });
+  }
+  /**
+   * Open the account-creation modal directly.
+   *
+   * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+   * sign-up flow. Account creation still happens server-side in the passkey
+   * service; the SDK only opens the dialog and receives the postMessage result.
+   *
+   * @param options.theme - Override the theme for this modal invocation
+   * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+   * @returns {@link AuthResult} with the newly authenticated account details
+   */
+  async createAccountWithModal(options) {
+    return this.openAuthModal({ ...options, flow: "create-account" });
+  }
+  /**
+   * Open one of the passkey authentication modal routes and wait for the
+   * login-result message.
+   *
+   * Keeping URL construction in one helper prevents the explicit login/signup
+   * methods from drifting away from the legacy `authWithModal` behavior.
+   */
+  async openAuthModal(options) {
+    const telemetry = this.createTelemetryOperation("auth", {
+      flow: options?.flow ?? "auto",
+      hasUsernameHint: !!options?.username
+    });
     const dialogUrl = this.getDialogUrl();
+    const requestId = this.createDialogRequestId();
     const params = new URLSearchParams({
-      mode: "iframe"
+      mode: "iframe",
+      requestId
     });
     if (this.config.clientId) {
       params.set("clientId", this.config.clientId);
@@ -209,14 +828,58 @@ var OneAuthClient = class {
     if (options?.oauthEnabled === false) {
       params.set("oauth", "0");
     }
+    if (options?.flow === "create-account") {
+      params.set("switch", "1");
+    }
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
       themeParsed.forEach((value, key) => params.set(key, value));
     }
-    const url = `${dialogUrl}/dialog/auth?${params.toString()}`;
+    const authPath = this.getAuthDialogPath(options?.flow);
+    const url = `${dialogUrl}${authPath}?${params.toString()}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    return this.waitForModalAuthResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.opened", telemetry, { outcome: "started" });
+    const result = await this.waitForModalAuthResponse(dialog, iframe, cleanup, requestId);
+    if (result.success) {
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signerType: result.signerType ?? "passkey" }
+      });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "auth.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * Generate a per-dialog nonce used to correlate iframe close messages with
+   * the SDK modal that opened them. Chromium can report a different
+   * `MessageEvent.source` WindowProxy after the `/dialog/auth` redirect, so
+   * auth close handling needs a stable in-band identifier without accepting
+   * stale close messages from earlier dialogs.
+   */
+  createDialogRequestId() {
+    if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+      return crypto.randomUUID();
+    }
+    return `dialog-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  }
+  /**
+   * Resolve the passkey app route for a requested auth flow.
+   */
+  getAuthDialogPath(flow = "auto") {
+    if (flow === "login") return "/dialog/auth/signin";
+    if (flow === "create-account") return "/dialog/auth/signup";
+    return "/dialog/auth";
   }
   /**
    * Open the connect dialog (lightweight connection without passkey auth).
@@ -241,6 +904,7 @@ var OneAuthClient = class {
    * ```
    */
   async connectWithModal(options) {
+    const telemetry = this.createTelemetryOperation("connect");
     const dialogUrl = this.getDialogUrl();
     const params = new URLSearchParams({
       mode: "iframe"
@@ -248,6 +912,8 @@ var OneAuthClient = class {
     if (this.config.clientId) {
       params.set("clientId", this.config.clientId);
     }
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
@@ -255,17 +921,104 @@ var OneAuthClient = class {
     }
     const url = `${dialogUrl}/dialog/connect?${params.toString()}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    this.emitTelemetry("dialog.opened", telemetry, { outcome: "started" });
     const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
-      mode: "iframe"
+      mode: "iframe",
+      telemetry: this.telemetryPayload(telemetry)
     });
     if (!ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "Connection was cancelled before the dialog became ready"
+      });
       return {
         success: false,
         action: "cancel",
         error: { code: "USER_CANCELLED", message: "Connection was cancelled" }
       };
     }
-    return this.waitForConnectResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
+    const result = await this.waitForConnectResponse(dialog, iframe, cleanup);
+    if (result.success) {
+      this.emitTelemetry("connect.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          autoConnected: result.autoConnected === true,
+          signerType: result.signerType ?? "passkey"
+        }
+      });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "connect.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error),
+          attributes: { action: result.action }
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * High-level connect entry point — the method most integrators want.
+   *
+   * Tries the lightweight {@link connectWithModal} first (no passkey ceremony
+   * for returning users on the same browser), and transparently falls back to
+   * {@link authWithModal} when the connect dialog reports it has no stored
+   * credentials for this origin (`action: "switch"`). First-time visitors get
+   * one passkey ceremony to register; subsequent connects on the same browser
+   * resolve with no biometric prompt — and silently when the user has enabled
+   * "Connect automatically".
+   *
+   * The return shape is the same {@link ConnectResult} discriminated union as
+   * {@link connectWithModal}, so callers can treat both paths uniformly. When
+   * the auth-modal fallback runs, its successful result is normalized into a
+   * `ConnectResult` (no `id` field — the embedder origin must not see it).
+   *
+   * Cancellation: if the user cancels either dialog, the result is
+   * `{ success: false, action: "cancel", error: { code: "USER_CANCELLED", … } }`.
+   *
+   * @param options - Forwarded to whichever underlying modal is shown.
+   *   `username` and `oauthEnabled` only apply to the auth-modal fallback path.
+   * @returns A {@link ConnectResult} discriminated union.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.connect();
+   * if (result.success) {
+   *   console.log("Connected as", result.user?.username ?? result.user?.address);
+   * }
+   * ```
+   */
+  async connect(options) {
+    const connectResult = await this.connectWithModal(
+      options?.theme ? { theme: options.theme } : void 0
+    );
+    if (connectResult.success) return connectResult;
+    if (connectResult.action === "switch") {
+      const authResult = await this.authWithModal(options);
+      if (authResult.success && authResult.user) {
+        return {
+          success: true,
+          user: {
+            username: authResult.user.username,
+            address: authResult.user.address
+          },
+          autoConnected: false
+        };
+      }
+      return {
+        success: false,
+        action: "cancel",
+        error: authResult.error ?? {
+          code: "USER_CANCELLED",
+          message: "Connection was cancelled"
+        }
+      };
+    }
+    return connectResult;
   }
   /**
    * Open the account management dialog.
@@ -290,10 +1043,13 @@ var OneAuthClient = class {
       themeParsed.forEach((value, key) => params.set(key, value));
     }
     const url = `${dialogUrl}/dialog/account?${params.toString()}`;
+    const accessTokenResult = await this.fetchAccessToken();
+    const initMessage = { mode: "iframe" };
+    if (accessTokenResult.ok) {
+      initMessage.auth = { accessToken: accessTokenResult.accessToken };
+    }
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
-      mode: "iframe"
-    });
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, initMessage);
     if (!ready) return;
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
@@ -315,131 +1071,275 @@ var OneAuthClient = class {
     });
   }
   /**
-   * Check if a user has already granted consent for the requested fields.
-   * This is a read-only check — no dialog is shown.
+   * Open the account-recovery backup flow directly.
    *
-   * @example
-   * ```typescript
-   * const result = await client.checkConsent({
-   *   username: "alice",
-   *   fields: ["email"],
-   * });
-   * if (result.hasConsent) {
-   *   console.log(result.data?.email);
-   * }
-   * ```
+   * Deep-links into the "Backup your account" flow inside the account dialog
+   * (rather than the account overview): the user verifies with their passkey,
+   * then saves a recovery passphrase and downloads an encrypted backup file.
+   * Use this to prompt users to secure their account after sign-up.
+   *
+   * Requires an authenticated user (call `authWithModal()` / `connect()`
+   * first) — the dialog reads the signed-in user from the passkey origin.
+   *
+   * Resolves `{ completed: true }` when the user finishes the backup, or
+   * `{ completed: false }` if they dismiss it — so callers can mark an
+   * onboarding step done or re-prompt later.
    */
-  async checkConsent(options) {
-    const clientId = options.clientId ?? this.config.clientId;
-    if (!clientId) {
-      return {
-        hasConsent: false
-      };
+  async setupRecovery(options) {
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({
+      mode: "iframe",
+      // Deep-link the account dialog straight into the backup nudge instead
+      // of the account overview.
+      action: "backup"
+    });
+    const themeParams = this.getThemeParams(options?.theme);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
     }
-    const username = options.username ?? options.accountAddress;
-    if (!username) {
-      return {
-        hasConsent: false
+    const url = `${dialogUrl}/dialog/account?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe"
+    });
+    if (!ready) return { completed: false };
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let completed = false;
+      const finish = () => {
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+        cleanup();
+        resolve({ completed });
       };
-    }
-    try {
-      const res = await fetch(`${this.config.providerUrl || "https://passkey.1auth.box"}/api/consent`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          ...clientId ? { "x-client-id": clientId } : {}
-        },
-        body: JSON.stringify({
-          username,
-          requestedFields: options.fields,
-          clientId
-        })
-      });
-      if (!res.ok) {
-        return { hasConsent: false };
-      }
-      const data = await res.json();
-      return {
-        hasConsent: data.hasConsent ?? false,
-        data: data.data,
-        grantedAt: data.grantedAt
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const type = event.data?.type;
+        if (type === "PASSKEY_RECOVERY_RESULT") {
+          completed = Boolean(event.data?.data?.completed ?? event.data?.success);
+          return;
+        }
+        if (type === "PASSKEY_CLOSE" || type === "PASSKEY_DISCONNECT") {
+          finish();
+        }
       };
-    } catch {
-      return { hasConsent: false };
-    }
+      const handleClose = () => {
+        window.removeEventListener("message", handleMessage);
+        resolve({ completed });
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
+  /**
+   * Check if a user has already granted consent for the requested fields.
+   *
+   * @deprecated Data-sharing consent is disabled.
+   *
+   * Always returns `{ hasConsent: false }`.
+   */
+  async checkConsent(options) {
+    void options;
+    return { hasConsent: false };
   }
   /**
    * Request consent from the user to share their data.
    *
-   * First checks if consent was already granted (returns cached data immediately).
-   * If not, opens the consent dialog where the user can review and approve sharing.
+   * @deprecated Data-sharing consent is disabled.
    *
-   * @example
-   * ```typescript
-   * const result = await client.requestConsent({
-   *   username: "alice",
-   *   fields: ["email", "deviceNames"],
-   * });
-   * if (result.success) {
-   *   console.log(result.data?.email);
-   *   console.log(result.cached); // true if no dialog was shown
-   * }
-   * ```
+   * Always returns an `INVALID_REQUEST` result.
    */
   async requestConsent(options) {
-    const clientId = options.clientId ?? this.config.clientId;
-    if (!clientId) {
+    void options;
+    return {
+      success: false,
+      error: {
+        code: "INVALID_REQUEST",
+        message: "Data-sharing consent is disabled"
+      }
+    };
+  }
+  /**
+   * Open the dedicated SmartSession permission grant dialog.
+   *
+   * The app owns the session key material and sends only the public
+   * `sessionKeyAddress`. 1auth renders the permission review, collects the
+   * owner's passkey authorization, submits the install/enable intent, and
+   * returns a persistable session handle.
+   */
+  async grantPermissions(options) {
+    const telemetry = this.createTelemetryOperation("grant_permission", {
+      targetChains: normalizeGrantTargetChains(options).join(","),
+      sponsor: options.sponsor !== false
+    });
+    if (!options.username && !options.accountAddress) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "clientId is required (set in config or options)" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "Either username or accountAddress is required"
+        }
       };
     }
-    const username = options.username ?? options.accountAddress;
-    if (!username) {
+    const targetChains = normalizeGrantTargetChains(options);
+    const sourceChains = normalizeGrantSourceChains(options);
+    if (targetChains.length === 0 || !options.sessionKeyAddress || !options.permissions?.length) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "targetChains, sessionKeyAddress, and permissions are required"
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "username or accountAddress is required" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "targetChains, sessionKeyAddress, and permissions are required"
+        }
       };
     }
-    if (!options.fields || options.fields.length === 0) {
+    if (!this.sponsorship) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: MISSING_APP_CREDENTIALS_MESSAGE
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "At least one field is required" }
+        error: {
+          code: "MISSING_APP_CREDENTIALS",
+          message: MISSING_APP_CREDENTIALS_MESSAGE
+        }
       };
     }
-    const existing = await this.checkConsent({ ...options, clientId });
-    if (existing.hasConsent && existing.data) {
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "SPONSORSHIP_FETCH_FAILED",
+        errorMessage: accessTokenResult.message
+      });
       return {
-        success: true,
-        data: existing.data,
-        grantedAt: existing.grantedAt,
-        cached: true
+        success: false,
+        error: {
+          code: "SPONSORSHIP_FETCH_FAILED",
+          message: accessTokenResult.message
+        }
       };
     }
     const dialogUrl = this.getDialogUrl();
-    const params = new URLSearchParams({
-      mode: "iframe",
-      username,
-      clientId,
-      fields: options.fields.join(",")
-    });
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
       themeParsed.forEach((value, key) => params.set(key, value));
     }
-    const url = `${dialogUrl}/dialog/consent?${params.toString()}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
-      mode: "iframe"
+    const grantUrl = `${dialogUrl}/dialog/grant-permission?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(grantUrl);
+    const initPayload = {
+      mode: "iframe",
+      clientId: this.config.clientId,
+      grant: cloneGrantPayload({
+        username: options.username,
+        accountAddress: options.accountAddress,
+        targetChain: targetChains[0],
+        targetChains,
+        sourceChains,
+        sessionKeyAddress: options.sessionKeyAddress,
+        permissions: options.permissions,
+        crossChainPermits: options.crossChainPermits,
+        validUntil: options.validUntil,
+        validAfter: options.validAfter,
+        maxUses: options.maxUses,
+        contracts: options.contracts
+      }),
+      auth: { accessToken: accessTokenResult.accessToken },
+      sponsor: options.sponsor !== false,
+      telemetry: this.telemetryPayload(telemetry)
+    };
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      targetChains
     });
-    if (!ready) {
+    const result = await this.waitForGrantPermissionResponse(
+      dialog,
+      iframe,
+      cleanup,
+      options.sponsor !== false,
+      initPayload
+    );
+    if (result.success) {
+      this.emitTelemetry("grant_permission.succeeded", telemetry, {
+        outcome: "success",
+        targetChains,
+        status: result.status ? String(result.status) : void 0
+      });
+      await this.waitForDialogClose(dialog, cleanup);
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "grant_permission.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          targetChains,
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * List SmartSession grants previously granted to the current browser origin.
+   *
+   * 1auth derives the app identity from the request Origin header. The SDK does
+   * not send `clientId` for this lookup because grants are origin-scoped.
+   */
+  async listSessionGrants(options) {
+    if (!options.username && !options.accountAddress) {
       return {
         success: false,
-        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "Either username or accountAddress is required"
+        }
+      };
+    }
+    const params = new URLSearchParams();
+    if (options.username) params.set("username", options.username);
+    if (options.accountAddress) params.set("accountAddress", options.accountAddress);
+    if (options.includeRevoked) params.set("includeRevoked", "true");
+    try {
+      const response = await fetch(
+        `${this.config.providerUrl}/api/sessions/grants?${params.toString()}`,
+        { credentials: "include" }
+      );
+      const data = await response.json();
+      if (!response.ok) {
+        return {
+          success: false,
+          error: {
+            code: "LIST_SESSION_GRANTS_FAILED",
+            message: data?.error ?? `Request failed with status ${response.status}`
+          }
+        };
+      }
+      return { success: true, grants: data.grants ?? [] };
+    } catch (err) {
+      return {
+        success: false,
+        error: {
+          code: "LIST_SESSION_GRANTS_FAILED",
+          message: err instanceof Error ? err.message : String(err)
+        }
       };
     }
-    return this.waitForConsentResponse(dialog, iframe, cleanup);
   }
   /**
    * Authenticate a user with an optional challenge to sign.
@@ -448,13 +1348,13 @@ var OneAuthClient = class {
    * challenge signing, enabling off-chain login without on-chain transactions.
    *
    * When a challenge is provided:
-   * 1. User authenticates (sign in or sign up)
-   * 2. The challenge is hashed with a domain separator
-   * 3. User signs the hash with their passkey
-   * 4. Returns user info + signature for server-side verification
+   * 1. User authenticates (sign in or sign up) through the normal auth dialog
+   * 2. User signs the challenge through the normal signing dialog
+   * 3. Returns user info + signature for server-side verification
    *
-   * The domain separator ("\x19Passkey Signed Message:\n") ensures the signature
-   * cannot be reused for transaction signing, preventing phishing attacks.
+   * This composes the same supported provider routes as calling
+   * `authWithModal()` followed by `signMessage()`, so challenge auth cannot
+   * drift onto a provider route that the passkey service does not expose.
    *
    * @example
    * ```typescript
@@ -473,42 +1373,131 @@ var OneAuthClient = class {
    * ```
    */
   async authenticate(options) {
-    const dialogUrl = this.getDialogUrl();
-    const params = new URLSearchParams({
-      mode: "iframe"
+    const telemetry = this.createTelemetryOperation("authenticate", {
+      hasChallenge: !!options?.challenge
     });
-    if (this.config.clientId) {
-      params.set("clientId", this.config.clientId);
+    const authResult = await this.authWithModal(options?.theme ? { theme: options.theme } : void 0);
+    if (!authResult.success) {
+      this.emitTelemetry(
+        authResult.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "auth.failed",
+        telemetry,
+        {
+          outcome: authResult.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(authResult.error)
+        }
+      );
+      return authResult;
     }
-    if (options?.challenge) {
-      params.set("challenge", options.challenge);
+    if (!options?.challenge) {
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { challengeSigned: false }
+      });
+      return authResult;
     }
-    const themeParams = this.getThemeParams(options?.theme);
-    if (themeParams) {
-      const themeParsed = new URLSearchParams(themeParams);
-      themeParsed.forEach((value, key) => params.set(key, value));
+    const accountAddress = authResult.user?.address;
+    const username = authResult.user?.username;
+    if (!accountAddress && !username) {
+      const result2 = {
+        success: false,
+        user: authResult.user,
+        signerType: authResult.signerType,
+        error: {
+          code: "AUTHENTICATE_USER_MISSING",
+          message: "Authentication succeeded but no username or account address was returned for challenge signing"
+        }
+      };
+      this.emitTelemetry("auth.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(result2.error)
+      });
+      return result2;
     }
-    const url = `${dialogUrl}/dialog/authenticate?${params.toString()}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    return this.waitForAuthenticateResponse(dialog, iframe, cleanup);
+    const signResult = await this.signMessage({
+      username,
+      accountAddress,
+      message: options.challenge,
+      description: "Verify your identity",
+      theme: options.theme
+    });
+    if (signResult.success && signResult.signature && signResult.signedHash) {
+      const result2 = {
+        ...authResult,
+        challenge: {
+          signature: signResult.signature,
+          signedHash: signResult.signedHash
+        }
+      };
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { challengeSigned: true }
+      });
+      return result2;
+    }
+    const error = signResult.error ? { code: signResult.error.code, message: signResult.error.message } : { code: "SIGNING_FAILED", message: "Challenge signing failed" };
+    const result = {
+      success: false,
+      user: authResult.user,
+      signerType: authResult.signerType,
+      error
+    };
+    const cancelled = error.code === "USER_CANCELLED" || error.code === "USER_REJECTED";
+    this.emitTelemetry(
+      cancelled ? "dialog.cancelled" : "auth.failed",
+      telemetry,
+      {
+        outcome: cancelled ? "cancelled" : "failure",
+        ...describeTelemetryError(error)
+      }
+    );
+    return result;
   }
   /**
    * Show signing in a modal overlay (iframe dialog)
    */
   async signWithModal(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "transaction",
+      hasTransaction: !!options.transaction,
+      hasAccountAddress: !!options.accountAddress
+    });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
     const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
       mode: "iframe",
       challenge: options.challenge,
       username: options.username,
+      accountAddress: options.accountAddress,
       description: options.description,
       transaction: options.transaction,
-      metadata: options.metadata
+      metadata: options.metadata,
+      telemetry: this.telemetryPayload(telemetry)
+    }, {
+      blindSigning: requestedBlindSigning,
+      reveal
     });
     if (!ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -517,7 +1506,21 @@ var OneAuthClient = class {
         }
       };
     }
-    return this.waitForSigningResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
+    const result = await this.waitForSigningResponse(dialog, iframe, cleanup);
+    if (result.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, { outcome: "success" });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
   }
   /**
    * Send an intent to the Rhinestone orchestrator
@@ -549,8 +1552,37 @@ var OneAuthClient = class {
    * ```
    */
   async sendIntent(options) {
-    const { username, accountAddress, targetChain, calls } = options;
+    const { username, accountAddress, targetChain } = options;
+    const calls = capCallLabels(options.calls);
+    const sponsor = options.sponsor !== false;
+    const telemetry = this.createTelemetryOperation("intent", {
+      targetChain: targetChain ?? null,
+      callsCount: calls?.length ?? 0,
+      sponsor,
+      blindSigning: this.shouldRequestBlindSigning(options)
+    });
+    if (getStoredSignerType() === "eoa") {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "E_SIGNER_UNSUPPORTED",
+        errorMessage: "Cross-chain intents are not supported for EOA sessions"
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "E_SIGNER_UNSUPPORTED",
+          message: "Cross-chain intents are not supported for EOA sessions. Use the connected wallet's native RPC instead."
+        }
+      };
+    }
     if (!username && !accountAddress) {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
         intentId: "",
@@ -561,44 +1593,265 @@ var OneAuthClient = class {
         }
       };
     }
-    if (!targetChain || !calls?.length) {
+    const hasCalls = !!calls?.length;
+    const hasTokenRequests = !!options.tokenRequests?.length;
+    if (!targetChain || !hasCalls && !hasTokenRequests) {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "targetChain and calls or tokenRequests are required"
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "targetChain and calls or tokenRequests are required"
+        }
+      };
+    }
+    if (!this.sponsorship) {
+      this.emitTelemetry("intent.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: "No sponsorship configured on OneAuthClient"
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "MISSING_APP_CREDENTIALS",
+          message: "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 configure `sponsorship` on the client."
+        }
+      };
+    }
+    const serializedTokenRequests = options.tokenRequests?.map((r) => ({
+      token: r.token,
+      amount: r.amount.toString()
+    }));
+    let prepareResponse;
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
+    const themeParams = this.getThemeParams();
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogOrigin = this.getDialogOrigin();
+    const dialogOpenedAt = Date.now();
+    let iframeReadyObserved = false;
+    let stopEarlyCloseWatch = () => void 0;
+    const earlyDialogClosePromise = new Promise((resolve) => {
+      let settled = false;
+      const stop = () => {
+        if (settled) return;
+        settled = true;
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      stopEarlyCloseWatch = stop;
+      const resolveClosed = (ready) => {
+        stop();
+        cleanup();
+        resolve({ type: "dialog_closed", ready });
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_CLOSE") {
+          resolveClosed(iframeReadyObserved);
+        }
+      };
+      const handleClose = () => {
+        resolveClosed(iframeReadyObserved);
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+    let dialogReadyDurationMs;
+    const dialogReadyPromise = this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    }).then((result) => {
+      dialogReadyDurationMs = Date.now() - dialogOpenedAt;
+      iframeReadyObserved = result.ready;
+      return result;
+    });
+    const dialogClosedBeforeReadyPromise = dialogReadyPromise.then(
+      (result) => result.ready ? new Promise(() => void 0) : { type: "dialog_closed", ready: false }
+    );
+    const accessTokenStartedAt = Date.now();
+    let accessTokenDurationMs;
+    const accessTokenPromise = this.fetchAccessToken().then((result) => {
+      accessTokenDurationMs = Date.now() - accessTokenStartedAt;
+      return result;
+    });
+    const accessOrClose = await Promise.race([
+      accessTokenPromise.then((result) => ({ type: "access_token", result })),
+      dialogClosedBeforeReadyPromise,
+      earlyDialogClosePromise
+    ]);
+    if (accessOrClose.type === "dialog_closed") {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: accessOrClose.ready ? "User closed the dialog while intent setup was still loading" : "User closed the dialog before it became ready",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs
+        }
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+      };
+    }
+    const accessTokenResult = accessOrClose.result;
+    let accessTokenFailure = null;
+    if (!accessTokenResult.ok) {
+      const errorCode = accessTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED";
+      this.emitTelemetry("intent.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode,
+        errorMessage: accessTokenResult.message,
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          loadingPhase: "access_token"
+        }
+      });
+      accessTokenFailure = { code: errorCode, message: accessTokenResult.message };
+    }
+    let accessToken = accessTokenResult.ok ? accessTokenResult.accessToken : "";
+    const requestBody = {
+      username,
+      accountAddress,
+      targetChain,
+      calls,
+      tokenRequests: serializedTokenRequests,
+      sourceAssets: options.sourceAssets,
+      sourceChainId: options.sourceChainId,
+      auth: { accessToken },
+      ...this.config.clientId && { clientId: this.config.clientId }
+    };
+    let earlyPrepareResult = null;
+    let extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+    let extensionTokensDurationMs;
+    this.emitTelemetry("intent.prepare.started", telemetry, {
+      outcome: "started",
+      targetChain,
+      attributes: {
+        accessTokenDurationMs,
+        dialogReadyDurationMs
+      }
+    });
+    const prepareStartedAt = Date.now();
+    let prepareDurationMs;
+    const runPrepare = () => this.prepareIntent(requestBody, telemetry).then((r) => {
+      earlyPrepareResult = r;
+      prepareDurationMs = Date.now() - prepareStartedAt;
+      if (r.success) {
+        this.emitTelemetry("intent.prepare.succeeded", telemetry, {
+          outcome: "success",
+          targetChain,
+          status: "quoted",
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs
+          }
+        });
+        const extensionTokensStartedAt = Date.now();
+        extensionTokensPromise = this.fetchExtensionTokens(
+          [r.data.intentOp],
+          [sponsor]
+        ).then((result) => {
+          extensionTokensDurationMs = Date.now() - extensionTokensStartedAt;
+          return result;
+        });
+      } else {
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          targetChain,
+          ...describeTelemetryError(r.error),
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            loadingPhase: "prepare"
+          }
+        });
+      }
+      return r;
+    });
+    const preparePromise = accessTokenFailure ? Promise.resolve({
+      success: false,
+      error: accessTokenFailure
+    }).then((r) => {
+      earlyPrepareResult = r;
+      return r;
+    }) : runPrepare();
+    const retryPrepare = async () => {
+      const retryTokenResult = await this.fetchAccessToken();
+      if (!retryTokenResult.ok) {
+        return {
+          success: false,
+          error: {
+            code: retryTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED",
+            message: retryTokenResult.message
+          }
+        };
+      }
+      accessToken = retryTokenResult.accessToken;
+      requestBody.auth = { accessToken };
+      return runPrepare();
+    };
+    const readyOrClose = await Promise.race([
+      dialogReadyPromise.then((result) => ({ type: "ready", result })),
+      earlyDialogClosePromise
+    ]);
+    if (readyOrClose.type === "dialog_closed") {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: readyOrClose.ready ? "User closed the dialog while intent setup was still loading" : "User closed the dialog before it became ready",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          prepareDurationMs
+        }
+      });
       return {
         success: false,
         intentId: "",
         status: "failed",
-        error: {
-          code: "INVALID_OPTIONS",
-          message: "targetChain and calls are required"
-        }
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
       };
     }
-    const serializedTokenRequests = options.tokenRequests?.map((r) => ({
-      token: r.token,
-      amount: r.amount.toString()
-    }));
-    let prepareResponse;
-    const requestBody = {
-      username,
-      accountAddress,
-      targetChain,
-      calls,
-      tokenRequests: serializedTokenRequests,
-      sourceAssets: options.sourceAssets,
-      sourceChainId: options.sourceChainId,
-      ...this.config.clientId && { clientId: this.config.clientId }
-    };
-    const dialogUrl = this.getDialogUrl();
-    const themeParams = this.getThemeParams();
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogOrigin = this.getDialogOrigin();
-    let earlyPrepareResult = null;
-    const preparePromise = this.prepareIntent(requestBody).then((r) => {
-      earlyPrepareResult = r;
-      return r;
-    });
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    const dialogResult = readyOrClose.result;
     if (!dialogResult.ready) {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "User closed the dialog before it became ready"
+      });
       return {
         success: false,
         intentId: "",
@@ -606,126 +1859,355 @@ var OneAuthClient = class {
         error: { code: "USER_CANCELLED", message: "User closed the dialog" }
       };
     }
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, {
+      outcome: "started",
+      attributes: {
+        accessTokenDurationMs,
+        dialogReadyDurationMs
+      }
+    });
     let currentInitPayload;
-    if (earlyPrepareResult) {
-      const prepareResult = earlyPrepareResult;
-      if (!prepareResult.success) {
-        this.sendPrepareError(iframe, prepareResult.error.message);
-        await this.waitForDialogClose(dialog, cleanup);
+    const refreshQuote = async () => {
+      try {
+        const refreshedTokenResult = await this.fetchAccessToken();
+        const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
+        const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+          body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } }),
+          credentials: "include"
+        });
+        if (!refreshResponse.ok) {
+          console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
+          return null;
+        }
+        const refreshedData = await refreshResponse.json();
+        const refreshedExtensionPromise = this.fetchExtensionTokens(
+          [refreshedData.intentOp],
+          [sponsor]
+        );
+        const extensionResult = await refreshedExtensionPromise;
+        if (!extensionResult.ok) {
+          console.error(
+            "[SDK] Extension token refresh failed:",
+            extensionResult.message
+          );
+          return null;
+        }
+        const refreshedAuth = {
+          accessToken: refreshToken,
+          extensionTokens: extensionResult.extensionTokens
+        };
+        prepareResponse = refreshedData;
+        accessToken = refreshToken;
+        requestBody.auth = { accessToken: refreshToken };
+        extensionTokensPromise = refreshedExtensionPromise;
+        currentInitPayload = {
+          ...currentInitPayload,
+          transaction: refreshedData.transaction,
+          challenge: refreshedData.challenge,
+          originMessages: refreshedData.originMessages,
+          expiresAt: refreshedData.expiresAt,
+          intentOp: refreshedData.intentOp,
+          digestResult: refreshedData.digestResult,
+          // A refreshed quote mints a fresh binding — it MUST replace the old
+          // one, or execute would verify the new intentOp against a stale
+          // binding and reject (once enforce mode is on).
+          binding: refreshedData.binding,
+          auth: refreshedAuth
+        };
         return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: prepareResult.error
+          intentOp: refreshedData.intentOp,
+          expiresAt: refreshedData.expiresAt,
+          challenge: refreshedData.challenge,
+          originMessages: refreshedData.originMessages,
+          transaction: refreshedData.transaction,
+          digestResult: refreshedData.digestResult,
+          binding: refreshedData.binding,
+          // Dialog-executed intents read auth from dialog state — ship the
+          // rebound bundle with the refresh so PASSKEY_REFRESH_COMPLETE
+          // updates it alongside the quote.
+          auth: refreshedAuth
         };
+      } catch (error) {
+        console.error("[SDK] Quote refresh error:", error);
+        return null;
+      }
+    };
+    const signingResultPromise = this.waitForSigningWithRefresh(
+      dialog,
+      iframe,
+      cleanup,
+      dialogOrigin,
+      refreshQuote
+    );
+    stopEarlyCloseWatch();
+    if (earlyPrepareResult) {
+      let prepareResult = earlyPrepareResult;
+      for (; ; ) {
+        while (!prepareResult.success) {
+          this.sendPrepareError(iframe, prepareResult.error.message);
+          if (blindSigning) {
+            cleanup();
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          const next2 = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+          if (next2 === "closed") {
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          prepareResult = await retryPrepare();
+        }
+        prepareResponse = prepareResult.data;
+        const extensionResult = await extensionTokensPromise;
+        if (extensionResult.ok) {
+          const sponsorshipTokens = {
+            accessToken,
+            extensionTokens: extensionResult.extensionTokens
+          };
+          currentInitPayload = {
+            mode: "iframe",
+            calls,
+            chainId: targetChain,
+            transaction: prepareResponse.transaction,
+            challenge: prepareResponse.challenge,
+            username,
+            accountAddress: prepareResponse.accountAddress,
+            originMessages: prepareResponse.originMessages,
+            tokenRequests: serializedTokenRequests,
+            expiresAt: prepareResponse.expiresAt,
+            userId: prepareResponse.userId,
+            intentOp: prepareResponse.intentOp,
+            digestResult: prepareResponse.digestResult,
+            binding: prepareResponse.binding,
+            tier: prepareResult.tier,
+            auth: sponsorshipTokens,
+            telemetry: this.telemetryPayload(telemetry)
+          };
+          dialogResult.sendInit(currentInitPayload);
+          break;
+        }
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
+          }
+        });
+        this.sendPrepareError(iframe, extensionResult.message);
+        if (blindSigning) {
+          cleanup();
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        const next = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+        if (next === "closed") {
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        prepareResult = await retryPrepare();
       }
-      prepareResponse = prepareResult.data;
-      currentInitPayload = {
-        mode: "iframe",
-        calls,
-        chainId: targetChain,
-        transaction: prepareResponse.transaction,
-        challenge: prepareResponse.challenge,
-        username,
-        accountAddress: prepareResponse.accountAddress,
-        originMessages: prepareResponse.originMessages,
-        tokenRequests: serializedTokenRequests,
-        expiresAt: prepareResponse.expiresAt,
-        userId: prepareResponse.userId,
-        intentOp: prepareResponse.intentOp,
-        digestResult: prepareResponse.digestResult,
-        tier: prepareResult.tier
-      };
-      dialogResult.sendInit(currentInitPayload);
     } else {
       currentInitPayload = {
         mode: "iframe",
+        signingMode: "transaction",
         calls,
         chainId: targetChain,
         username,
         accountAddress: options.accountAddress,
-        tokenRequests: serializedTokenRequests
+        tokenRequests: serializedTokenRequests,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentInitPayload);
-      const prepareResult = await preparePromise;
-      if (!prepareResult.success) {
-        this.sendPrepareError(iframe, prepareResult.error.message);
-        await this.waitForDialogClose(dialog, cleanup);
-        return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: prepareResult.error
+      const prepareOrCancel = await Promise.race([
+        preparePromise.then((prepareResult2) => ({
+          type: "prepare",
+          prepareResult: prepareResult2
+        })),
+        signingResultPromise.then((signingResult2) => ({
+          type: "signing",
+          signingResult: signingResult2
+        }))
+      ]);
+      let prepareResult;
+      if (prepareOrCancel.type === "signing") {
+        const earlySigningResult = prepareOrCancel.signingResult;
+        if (earlySigningResult.success) {
+          prepareResult = await preparePromise;
+        } else {
+          const signingError = earlySigningResult.error;
+          this.emitTelemetry(
+            signingError?.code === "USER_REJECTED" ? "dialog.cancelled" : "intent.sign.failed",
+            telemetry,
+            {
+              outcome: signingError?.code === "USER_REJECTED" ? "cancelled" : "failure",
+              ...describeTelemetryError(signingError)
+            }
+          );
+          if (blindSigning) cleanup();
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: signingError
+          };
+        }
+      } else {
+        prepareResult = prepareOrCancel.prepareResult;
+      }
+      for (; ; ) {
+        while (!prepareResult.success) {
+          this.sendPrepareError(iframe, prepareResult.error.message);
+          if (blindSigning) {
+            cleanup();
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          const next2 = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+          if (next2 === "closed") {
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          prepareResult = await retryPrepare();
+        }
+        prepareResponse = prepareResult.data;
+        const authReady = !sponsor ? {
+          accessToken,
+          extensionTokens: []
+        } : void 0;
+        currentInitPayload = {
+          mode: "iframe",
+          calls,
+          chainId: targetChain,
+          transaction: prepareResponse.transaction,
+          challenge: prepareResponse.challenge,
+          username,
+          accountAddress: prepareResponse.accountAddress,
+          originMessages: prepareResponse.originMessages,
+          tokenRequests: serializedTokenRequests,
+          expiresAt: prepareResponse.expiresAt,
+          userId: prepareResponse.userId,
+          intentOp: prepareResponse.intentOp,
+          digestResult: prepareResponse.digestResult,
+          binding: prepareResponse.binding,
+          tier: prepareResult.tier,
+          ...authReady && { auth: authReady },
+          telemetry: this.telemetryPayload(telemetry)
         };
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_QUOTE_READY", ...currentInitPayload, fullViewport: true, blindSigning },
+          dialogOrigin
+        );
+        if (!sponsor) break;
+        const extensionResult = await extensionTokensPromise;
+        if (extensionResult.ok) {
+          const sponsorshipTokens = {
+            accessToken,
+            extensionTokens: extensionResult.extensionTokens
+          };
+          currentInitPayload = {
+            ...currentInitPayload,
+            auth: sponsorshipTokens
+          };
+          iframe.contentWindow?.postMessage(
+            { type: "PASSKEY_QUOTE_READY", auth: sponsorshipTokens, fullViewport: true, blindSigning },
+            dialogOrigin
+          );
+          break;
+        }
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
+          }
+        });
+        this.sendPrepareError(iframe, extensionResult.message);
+        if (blindSigning) {
+          cleanup();
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        const next = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+        if (next === "closed") {
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        prepareResult = await retryPrepare();
       }
-      prepareResponse = prepareResult.data;
-      currentInitPayload = {
-        mode: "iframe",
-        calls,
-        chainId: targetChain,
-        transaction: prepareResponse.transaction,
-        challenge: prepareResponse.challenge,
-        username,
-        accountAddress: prepareResponse.accountAddress,
-        originMessages: prepareResponse.originMessages,
-        tokenRequests: serializedTokenRequests,
-        expiresAt: prepareResponse.expiresAt,
-        userId: prepareResponse.userId,
-        intentOp: prepareResponse.intentOp,
-        digestResult: prepareResponse.digestResult,
-        tier: prepareResult.tier
-      };
-      iframe.contentWindow?.postMessage(
-        { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true },
-        dialogOrigin
-      );
     }
     const handleReReady = (event) => {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
     };
     window.addEventListener("message", handleReReady);
-    const signingResult = await this.waitForSigningWithRefresh(
-      dialog,
-      iframe,
-      cleanup,
-      dialogOrigin,
-      // Refresh callback - called when dialog requests a quote refresh
-      async () => {
-        try {
-          const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(requestBody),
-            credentials: "include"
-          });
-          if (!refreshResponse.ok) {
-            console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
-            return null;
-          }
-          const refreshedData = await refreshResponse.json();
-          prepareResponse = refreshedData;
-          return {
-            intentOp: refreshedData.intentOp,
-            expiresAt: refreshedData.expiresAt,
-            challenge: refreshedData.challenge,
-            originMessages: refreshedData.originMessages,
-            transaction: refreshedData.transaction,
-            digestResult: refreshedData.digestResult
-          };
-        } catch (error) {
-          console.error("[SDK] Quote refresh error:", error);
-          return null;
-        }
-      }
-    );
+    const signingResult = await signingResultPromise;
     window.removeEventListener("message", handleReReady);
     if (!signingResult.success) {
+      this.emitTelemetry(
+        signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "intent.sign.failed",
+        telemetry,
+        {
+          outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+          ...describeTelemetryError(signingResult.error),
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs
+          }
+        }
+      );
+      if (blindSigning) cleanup();
       return {
         success: false,
         intentId: "",
@@ -742,12 +2224,67 @@ var OneAuthClient = class {
         intentId: signingResult.intentId,
         status: "pending"
       };
+      this.emitTelemetry("intent.sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          prepareDurationMs,
+          extensionTokensDurationMs,
+          dialogExecuted: true
+        }
+      });
     } else {
+      const extensionResult = await extensionTokensPromise;
+      if (!extensionResult.ok) {
+        this.emitTelemetry("intent.sign.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
+          }
+        });
+        this.sendTransactionStatus(iframe, "failed");
+        await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+        return {
+          success: false,
+          intentId: "",
+          status: "failed",
+          error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+        };
+      }
+      const extensionTokens = extensionResult.extensionTokens;
       try {
+        this.emitTelemetry("intent.sign.succeeded", telemetry, {
+          outcome: "success",
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            dialogExecuted: false
+          }
+        });
+        this.emitTelemetry("intent.execute.started", telemetry, {
+          outcome: "started",
+          targetChain: prepareResponse.targetChain,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs
+          }
+        });
         const response = await fetch(`${this.config.providerUrl}/api/intent/execute`, {
           method: "POST",
           headers: {
-            "Content-Type": "application/json"
+            "Content-Type": "application/json",
+            ...this.telemetryHeaders(telemetry)
           },
           body: JSON.stringify({
             // Data from prepare response (no intentId yet - created on execute)
@@ -757,16 +2294,32 @@ var OneAuthClient = class {
             calls: prepareResponse.calls,
             expiresAt: prepareResponse.expiresAt,
             digestResult: prepareResponse.digestResult,
+            // Opaque prepare->execute binding, forwarded unchanged.
+            binding: prepareResponse.binding,
             // Signature from dialog
             signature: signingResult.signature,
-            passkey: signingResult.passkey
+            passkey: signingResult.passkey,
             // Include passkey info for signature encoding
+            // App JWT — `accessToken` is always present. `extensionToken` is
+            // only included when sponsorship was requested (sponsor !== false).
+            auth: {
+              accessToken,
+              ...extensionTokens.length > 0 && {
+                extensionToken: extensionTokens[0]
+              }
+            }
           })
         });
         if (!response.ok) {
           const errorData = await response.json().catch(() => ({}));
           this.sendTransactionStatus(iframe, "failed");
-          await this.waitForDialogClose(dialog, cleanup);
+          await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+          this.emitTelemetry("intent.execute.failed", telemetry, {
+            outcome: "failure",
+            targetChain: prepareResponse.targetChain,
+            errorCode: "EXECUTE_FAILED",
+            errorMessage: errorData.error || "Failed to execute intent"
+          });
           return {
             success: false,
             intentId: "",
@@ -779,9 +2332,19 @@ var OneAuthClient = class {
           };
         }
         executeResponse = await response.json();
+        this.emitTelemetry("intent.execute.succeeded", telemetry, {
+          outcome: "success",
+          targetChain: prepareResponse.targetChain,
+          status: executeResponse.status
+        });
       } catch (error) {
         this.sendTransactionStatus(iframe, "failed");
-        await this.waitForDialogClose(dialog, cleanup);
+        await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+        this.emitTelemetry("intent.execute.failed", telemetry, {
+          outcome: "failure",
+          targetChain: prepareResponse.targetChain,
+          ...describeTelemetryError(error)
+        });
         return {
           success: false,
           intentId: "",
@@ -798,6 +2361,10 @@ var OneAuthClient = class {
     let finalTxHash = executeResponse.transactionHash;
     if (finalStatus === "pending") {
       this.sendTransactionStatus(iframe, "pending");
+      this.emitTelemetry("intent.status.started", telemetry, {
+        outcome: "started",
+        status: finalStatus
+      });
       let userClosedEarly = false;
       const dialogOrigin2 = this.getDialogOrigin();
       const earlyCloseHandler = (event) => {
@@ -818,7 +2385,10 @@ var OneAuthClient = class {
             `${this.config.providerUrl}/api/intent/status/${executeResponse.intentId}`,
             {
               method: "GET",
-              headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+              headers: {
+                ...this.telemetryHeaders(telemetry),
+                ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+              }
             }
           );
           if (statusResponse.ok) {
@@ -850,6 +2420,12 @@ var OneAuthClient = class {
       window.removeEventListener("message", earlyCloseHandler);
       if (userClosedEarly) {
         cleanup();
+        this.emitTelemetry("intent.status.failed", telemetry, {
+          outcome: "cancelled",
+          status: finalStatus,
+          errorCode: "USER_CANCELLED",
+          errorMessage: "User closed the dialog while status polling"
+        });
         return {
           success: false,
           intentId: executeResponse.intentId,
@@ -872,19 +2448,25 @@ var OneAuthClient = class {
     };
     const isSuccessStatus = successStatuses[closeOn]?.includes(finalStatus) ?? false;
     const displayStatus = isSuccessStatus ? "confirmed" : finalStatus;
-    const closePromise = this.waitForDialogClose(dialog, cleanup);
+    const closePromise = this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
     this.sendTransactionStatus(iframe, displayStatus, finalTxHash);
     await closePromise;
     if (options.waitForHash && !finalTxHash) {
       const hash = await this.waitForTransactionHash(executeResponse.intentId, {
         timeoutMs: options.hashTimeoutMs,
         intervalMs: options.hashIntervalMs
-      });
+      }, telemetry);
       if (hash) {
         finalTxHash = hash;
         finalStatus = "completed";
       } else {
         finalStatus = "failed";
+        this.emitTelemetry("intent.status.failed", telemetry, {
+          outcome: "failure",
+          status: finalStatus,
+          errorCode: "HASH_TIMEOUT",
+          errorMessage: "Timed out waiting for transaction hash"
+        });
         return {
           success: false,
           intentId: executeResponse.intentId,
@@ -898,6 +2480,15 @@ var OneAuthClient = class {
         };
       }
     }
+    this.emitTelemetry("intent.status.succeeded", telemetry, {
+      outcome: isSuccessStatus ? "success" : "failure",
+      status: finalStatus
+    });
+    this.emitTelemetry("intent.completed", telemetry, {
+      outcome: isSuccessStatus ? "success" : "failure",
+      status: finalStatus,
+      targetChain
+    });
     return {
       success: isSuccessStatus,
       intentId: executeResponse.intentId,
@@ -935,7 +2526,30 @@ var OneAuthClient = class {
    * ```
    */
   async sendBatchIntent(options) {
+    const telemetry = this.createTelemetryOperation("batch_intent", {
+      intentCount: options.intents?.length ?? 0,
+      blindSigning: this.shouldRequestBlindSigning(options)
+    });
+    if (getStoredSignerType() === "eoa") {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "E_SIGNER_UNSUPPORTED",
+        errorMessage: "Batch intents are not supported for EOA sessions"
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: "Batch intents are not supported for EOA sessions. Use the connected wallet's native RPC instead."
+      };
+    }
     if (!options.username && !options.accountAddress) {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
         results: [],
@@ -944,6 +2558,11 @@ var OneAuthClient = class {
       };
     }
     if (!options.intents?.length) {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "At least one intent is required"
+      });
       return {
         success: false,
         results: [],
@@ -951,9 +2570,40 @@ var OneAuthClient = class {
         failureCount: 0
       };
     }
+    if (!this.sponsorship) {
+      this.emitTelemetry("batch.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: "No sponsorship configured on OneAuthClient"
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 configure `sponsorship` on the client."
+      };
+    }
+    const sponsorFlags = options.intents.map((intent) => intent.sponsor !== false);
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      this.emitTelemetry("batch.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: accessTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED",
+        errorMessage: accessTokenResult.message
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: accessTokenResult.message
+      };
+    }
+    let accessToken = accessTokenResult.accessToken;
     const serializedIntents = options.intents.map((intent) => ({
       targetChain: intent.targetChain,
-      calls: intent.calls,
+      calls: capCallLabels(intent.calls),
       tokenRequests: intent.tokenRequests?.map((r) => ({
         token: r.token,
         amount: r.amount.toString()
@@ -966,20 +2616,67 @@ var OneAuthClient = class {
       ...options.username && { username: options.username },
       ...options.accountAddress && { accountAddress: options.accountAddress },
       intents: serializedIntents,
+      auth: { accessToken },
       ...this.config.clientId && { clientId: this.config.clientId }
     };
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams();
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      intentCount: options.intents.length,
+      attributes: { blindSigning: requestedBlindSigning }
+    });
     const dialogOrigin = this.getDialogOrigin();
     let earlyBatchResult = null;
-    const preparePromise = this.prepareBatchIntent(requestBody).then((r) => {
+    let batchExtensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+    this.emitTelemetry("batch.prepare.started", telemetry, {
+      outcome: "started",
+      intentCount: options.intents.length,
+      targetChains: serializedIntents.map((intent) => intent.targetChain)
+    });
+    const preparePromise = this.prepareBatchIntent(requestBody, telemetry).then((r) => {
       earlyBatchResult = r;
+      if (r.success) {
+        this.emitTelemetry("batch.prepare.succeeded", telemetry, {
+          outcome: "success",
+          intentCount: r.data.intents.length,
+          targetChains: serializedIntents.map((intent) => intent.targetChain)
+        });
+        batchExtensionTokensPromise = this.fetchExtensionTokens(
+          r.data.intents.map((intent) => intent.intentOp),
+          sponsorFlags
+        );
+      } else {
+        this.emitTelemetry("batch.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorMessage: r.error,
+          intentCount: options.intents.length
+        });
+      }
       return r;
     });
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "User closed the dialog before it became ready"
+      });
       return {
         success: false,
         results: [],
@@ -987,6 +2684,8 @@ var OneAuthClient = class {
         failureCount: 0
       };
     }
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     let currentBatchPayload;
     const handleBatchPrepareFailure = async (prepareResult) => {
       const failedIntents = prepareResult.failedIntents;
@@ -998,7 +2697,7 @@ var OneAuthClient = class {
         error: { message: f.error, code: "PREPARE_FAILED" }
       })) ?? [];
       this.sendPrepareError(iframe, prepareResult.error);
-      await this.waitForDialogClose(dialog, cleanup);
+      await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
       return {
         success: false,
         results: failureResults,
@@ -1007,6 +2706,17 @@ var OneAuthClient = class {
         error: prepareResult.error
       };
     };
+    const handleSponsorshipFailure = async (message) => {
+      this.sendPrepareError(iframe, message);
+      await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: `Sponsorship token fetch failed: ${message}`
+      };
+    };
     let prepareResponse;
     if (earlyBatchResult) {
       const prepareResult = earlyBatchResult;
@@ -1014,17 +2724,28 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
+      const batchExtensionResult = await batchExtensionTokensPromise;
+      if (!batchExtensionResult.ok) {
+        return handleSponsorshipFailure(batchExtensionResult.message);
+      }
+      const batchSponsorshipTokens = {
+        accessToken,
+        extensionTokens: batchExtensionResult.extensionTokens
+      };
       currentBatchPayload = {
         mode: "iframe",
         batchMode: true,
         batchIntents: prepareResponse.intents,
         batchFailedIntents: prepareResponse.failedIntents,
         challenge: prepareResponse.challenge,
+        binding: prepareResponse.binding,
         username: options.username,
         accountAddress: prepareResponse.accountAddress,
         userId: prepareResponse.userId,
         expiresAt: prepareResponse.expiresAt,
-        tier: prepareResult.tier
+        tier: prepareResult.tier,
+        auth: batchSponsorshipTokens,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentBatchPayload);
     } else {
@@ -1038,7 +2759,8 @@ var OneAuthClient = class {
           // No: transaction, intentOp, expiresAt, originMessages
         })),
         username: options.username,
-        accountAddress: options.accountAddress
+        accountAddress: options.accountAddress,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentBatchPayload);
       const prepareResult = await preparePromise;
@@ -1046,20 +2768,31 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
+      const batchExtensionResult = await batchExtensionTokensPromise;
+      if (!batchExtensionResult.ok) {
+        return handleSponsorshipFailure(batchExtensionResult.message);
+      }
+      const batchSponsorshipTokens = {
+        accessToken,
+        extensionTokens: batchExtensionResult.extensionTokens
+      };
       currentBatchPayload = {
         mode: "iframe",
         batchMode: true,
         batchIntents: prepareResponse.intents,
         batchFailedIntents: prepareResponse.failedIntents,
         challenge: prepareResponse.challenge,
+        binding: prepareResponse.binding,
         username: options.username,
         accountAddress: prepareResponse.accountAddress,
         userId: prepareResponse.userId,
         expiresAt: prepareResponse.expiresAt,
-        tier: prepareResult.tier
+        tier: prepareResult.tier,
+        auth: batchSponsorshipTokens,
+        telemetry: this.telemetryPayload(telemetry)
       };
       iframe.contentWindow?.postMessage(
-        { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true },
+        { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true, blindSigning },
         dialogOrigin
       );
     }
@@ -1067,7 +2800,7 @@ var OneAuthClient = class {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -1079,19 +2812,55 @@ var OneAuthClient = class {
         const message = event.data;
         if (message?.type === "PASSKEY_REFRESH_QUOTE") {
           try {
+            const refreshedTokenResult = await this.fetchAccessToken();
+            const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
             const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
               method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify(requestBody)
+              headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+              body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } })
             });
             if (refreshResponse.ok) {
               const refreshed = await refreshResponse.json();
+              const refreshedExtensionPromise = this.fetchExtensionTokens(
+                refreshed.intents.map((intent) => intent.intentOp),
+                sponsorFlags
+              );
+              const extensionResult = await refreshedExtensionPromise;
+              if (!extensionResult.ok) {
+                console.error(
+                  "[SDK] Batch extension token refresh failed:",
+                  extensionResult.message
+                );
+                iframe.contentWindow?.postMessage({
+                  type: "PASSKEY_REFRESH_ERROR",
+                  error: "Failed to refresh batch quotes"
+                }, dialogOrigin);
+                return;
+              }
+              const refreshedAuth = {
+                accessToken: refreshToken,
+                extensionTokens: extensionResult.extensionTokens
+              };
               prepareResponse = refreshed;
+              accessToken = refreshToken;
+              requestBody.auth = { accessToken: refreshToken };
+              batchExtensionTokensPromise = refreshedExtensionPromise;
+              currentBatchPayload = {
+                ...currentBatchPayload,
+                batchIntents: refreshed.intents,
+                batchFailedIntents: refreshed.failedIntents,
+                challenge: refreshed.challenge,
+                binding: refreshed.binding,
+                expiresAt: refreshed.expiresAt,
+                auth: refreshedAuth
+              };
               iframe.contentWindow?.postMessage({
                 type: "PASSKEY_REFRESH_COMPLETE",
                 batchIntents: refreshed.intents,
                 challenge: refreshed.challenge,
-                expiresAt: refreshed.expiresAt
+                binding: refreshed.binding,
+                expiresAt: refreshed.expiresAt,
+                auth: refreshedAuth
               }, dialogOrigin);
             } else {
               iframe.contentWindow?.postMessage({
@@ -1127,7 +2896,11 @@ var OneAuthClient = class {
             }));
             const allResults = [...results, ...prepareFailures].sort((a, b) => a.index - b.index);
             const successCount = allResults.filter((r) => r.success).length;
-            await this.waitForDialogClose(dialog, cleanup);
+            await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+            this.emitTelemetry("batch.sign.succeeded", telemetry, {
+              outcome: "success",
+              intentCount: allResults.length
+            });
             resolve({
               success: successCount === allResults.length,
               results: allResults,
@@ -1136,6 +2909,11 @@ var OneAuthClient = class {
             });
           } else {
             cleanup();
+            this.emitTelemetry("batch.sign.failed", telemetry, {
+              outcome: "failure",
+              errorCode: "SIGNING_FAILED",
+              errorMessage: "Batch signing failed or was cancelled"
+            });
             resolve({
               success: false,
               results: [],
@@ -1147,6 +2925,11 @@ var OneAuthClient = class {
         if (message?.type === "PASSKEY_CLOSE") {
           window.removeEventListener("message", handleMessage);
           cleanup();
+          this.emitTelemetry("dialog.cancelled", telemetry, {
+            outcome: "cancelled",
+            errorCode: "USER_CANCELLED",
+            errorMessage: "User closed the batch dialog"
+          });
           resolve({
             success: false,
             results: [],
@@ -1158,6 +2941,15 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
     window.removeEventListener("message", handleBatchReReady);
+    this.emitTelemetry("batch.completed", telemetry, {
+      outcome: batchResult.success ? "success" : "failure",
+      intentCount: batchResult.results.length,
+      attributes: {
+        successCount: batchResult.successCount,
+        failureCount: batchResult.failureCount
+      },
+      ...batchResult.error ? { errorMessage: batchResult.error } : {}
+    });
     return batchResult;
   }
   /**
@@ -1276,6 +3068,7 @@ var OneAuthClient = class {
               signedHash: payload.signedHash
             });
           } else {
+            cleanup();
             resolve({
               success: false,
               error: message.error || {
@@ -1358,6 +3151,7 @@ var OneAuthClient = class {
               signedHash: payload.signedHash
             });
           } else {
+            cleanup();
             resolve({
               success: false,
               error: message.error || {
@@ -1418,6 +3212,56 @@ var OneAuthClient = class {
       dialog.addEventListener("close", handleClose);
     });
   }
+  /**
+   * Hidden blind-signing iframes have no user-visible Done or Close button.
+   * Once the SDK has the result it needs, tear them down immediately instead
+   * of waiting for an iframe close event that can never be clicked.
+   */
+  async waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup) {
+    if (blindSigning) {
+      cleanup();
+      return;
+    }
+    await this.waitForDialogClose(dialog, cleanup);
+  }
+  /**
+   * After a prepare error has been surfaced in the dialog, wait for the user
+   * to either close the dialog (give up) or click "Try Again", which the
+   * dialog forwards as `PASSKEY_RETRY_PREPARE`.
+   *
+   * On `"closed"` the dialog has been cleaned up; on `"retry"` it stays open
+   * (showing its loading skeleton) while the caller re-runs prepare. Without
+   * this, "Try Again" after a prepare failure was a dead end: the dialog
+   * reset its local state but the SDK had already given up, so the quote
+   * never arrived and the Sign button stayed disabled forever.
+   */
+  waitForPrepareRetryOrClose(dialog, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      const stop = () => {
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_RETRY_PREPARE") {
+          stop();
+          resolve("retry");
+        } else if (event.data?.type === "PASSKEY_CLOSE") {
+          stop();
+          cleanup();
+          resolve("closed");
+        }
+      };
+      const handleClose = () => {
+        stop();
+        cleanup();
+        resolve("closed");
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
   /**
    * Inject a `<link rel="preconnect">` tag for the given URL's origin.
    *
@@ -1443,6 +3287,82 @@ var OneAuthClient = class {
     } catch {
     }
   }
+  /**
+   * Warm the dialog ahead of the first user interaction.
+   *
+   * `preconnect` (run in the constructor) only warms DNS/TLS. This goes
+   * further: it loads the dialog into a hidden, off-screen iframe so the
+   * browser downloads and parses the dialog HTML + JS bundle and the font, and
+   * keeps the cross-origin connection alive. When the user later opens a real
+   * auth/sign dialog, the fresh iframe serves those bytes from cache over the
+   * warm connection and paints far sooner — so the SDK preload overlay is shown
+   * only briefly (or imperceptibly) instead of covering a full cold load.
+   *
+   * It loads a dedicated `/dialog/warm` route, NOT a real flow route. That
+   * matters for two reasons:
+   *   - **No side effects.** The real `/dialog/auth` route runs the signup
+   *     flow on mount (identity probe → `POST /api/auth/register?step=start`),
+   *     which writes an `AuthChallenge` row and counts against the register
+   *     rate limiter. Warming must never create backend auth state for a user
+   *     who hasn't acted, so the warm route renders nothing and runs no flow.
+   *   - **No message cross-talk.** The warm route posts no `PASSKEY_READY` /
+   *     `PASSKEY_RENDERED`, so a slow warm can never satisfy a visible modal's
+   *     readiness listener and drive it to `PASSKEY_INIT` at the wrong moment.
+   * The warm route still pulls the shared Next.js framework + main + dialog
+   * layout chunks (the bulk of every flow's bundle), so the real open is fast.
+   *
+   * Best called on a *likely-intent* signal — `pointerenter`/`focus` of your
+   * "Sign in" / "Pay" button — rather than on page load, so visitors who never
+   * authenticate don't pay for a cross-origin iframe. Pass `prewarm: true` in
+   * the client config to have the SDK schedule this once on an idle callback.
+   *
+   * Idempotent: repeated calls return the same in-flight/settled promise.
+   * Resolves `true` once the hidden iframe's document has loaded, `false` on
+   * timeout or failure. Never throws and never blocks a real dialog open — a
+   * failed prewarm just means the next open does a normal (cold) load.
+   *
+   * @returns Whether the dialog became warm.
+   */
+  async prewarm() {
+    if (typeof document === "undefined") return false;
+    if (this.prewarmState) return this.prewarmState.ready;
+    const warmUrl = `${this.getDialogUrl()}/dialog/warm`;
+    const iframe = document.createElement("iframe");
+    iframe.setAttribute("aria-hidden", "true");
+    iframe.setAttribute("tabindex", "-1");
+    iframe.title = "1auth dialog prewarm";
+    iframe.style.cssText = "position:fixed;left:-9999px;top:0;width:1px;height:1px;opacity:0;border:0;pointer-events:none;";
+    const ready = new Promise((resolve) => {
+      let settled = false;
+      const finish = (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(value);
+      };
+      iframe.onload = () => finish(true);
+      iframe.onerror = () => finish(false);
+      const timer = setTimeout(() => finish(false), 1e4);
+    });
+    iframe.src = warmUrl;
+    document.body.appendChild(iframe);
+    this.prewarmState = { iframe, ready };
+    return ready;
+  }
+  /**
+   * Tear down the hidden prewarm iframe created by {@link prewarm}.
+   *
+   * The HTTP cache that prewarm populated survives teardown, so a subsequent
+   * open is still bundle-warm; this only releases the parked frame (and its
+   * keep-alive connection). Call it when auth is no longer likely on the
+   * current view. Safe to call when nothing is warmed.
+   */
+  destroyPrewarm() {
+    const state = this.prewarmState;
+    if (!state) return;
+    this.prewarmState = null;
+    state.iframe.remove();
+  }
   /**
    * Wait for the dialog iframe to signal ready, but defer sending `PASSKEY_INIT`
    * until the caller decides the time is right.
@@ -1463,7 +3383,7 @@ var OneAuthClient = class {
    * @returns `{ ready: true, sendInit }` when the iframe is ready, or
    *   `{ ready: false }` if the dialog was closed or timed out first.
    */
-  waitForDialogReadyDeferred(dialog, iframe, cleanup) {
+  waitForDialogReadyDeferred(dialog, iframe, cleanup, options = {}) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       let settled = false;
@@ -1477,12 +3397,15 @@ var OneAuthClient = class {
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         if (event.data?.type === "PASSKEY_READY") {
+          const blindSigning = options.blindSigning === true;
           teardown();
           resolve({
             ready: true,
+            blindSigning,
             sendInit: (initMessage) => {
+              if (blindSigning) iframe.focus({ preventScroll: true });
               iframe.contentWindow?.postMessage(
-                { type: "PASSKEY_INIT", ...initMessage, fullViewport: true },
+                { type: "PASSKEY_INIT", ...initMessage, fullViewport: true, blindSigning },
                 dialogOrigin
               );
             }
@@ -1523,13 +3446,13 @@ var OneAuthClient = class {
    * @param requestBody - Serialized intent options (bigint amounts converted to
    *   strings before this call).
    * @returns On success: `{ success: true, data: PrepareIntentResponse, tier }`.
-   *   On failure: `{ success: false, error: { code, message } }`.
+   *   On failure: `{ success: false, error: { code, message, details? } }`.
    */
-  async prepareIntent(requestBody) {
+  async prepareIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
         body: JSON.stringify(requestBody)
       });
       if (!response.ok) {
@@ -1542,7 +3465,8 @@ var OneAuthClient = class {
           success: false,
           error: {
             code: errorMessage.includes("User not found") ? "USER_NOT_FOUND" : "PREPARE_FAILED",
-            message: errorMessage
+            message: errorMessage,
+            details: errorData.details ?? errorData.candidateErrors ?? errorData
           }
         };
       }
@@ -1575,11 +3499,11 @@ var OneAuthClient = class {
    * @returns On success: `{ success: true, data: PrepareBatchIntentResponse, tier }`.
    *   On failure: `{ success: false, error, failedIntents? }`.
    */
-  async prepareBatchIntent(requestBody) {
+  async prepareBatchIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
         body: JSON.stringify(requestBody)
       });
       if (!response.ok) {
@@ -1625,15 +3549,28 @@ var OneAuthClient = class {
    * that hasn't completed yet.
    */
   async getIntentStatus(intentId) {
+    const telemetry = this.createTelemetryOperation("status");
+    this.emitTelemetry("intent.status.started", telemetry, {
+      outcome: "started",
+      attributes: { directStatusCheck: true }
+    });
     try {
       const response = await fetch(
         `${this.config.providerUrl}/api/intent/status/${intentId}`,
         {
-          headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+          headers: {
+            ...this.telemetryHeaders(telemetry),
+            ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+          }
         }
       );
       if (!response.ok) {
         const errorData = await response.json().catch(() => ({}));
+        this.emitTelemetry("status.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "STATUS_FAILED",
+          errorMessage: errorData.error || "Failed to get intent status"
+        });
         return {
           success: false,
           intentId,
@@ -1645,6 +3582,10 @@ var OneAuthClient = class {
         };
       }
       const data = await response.json();
+      this.emitTelemetry("status.succeeded", telemetry, {
+        outcome: data.status === "completed" ? "success" : "started",
+        status: data.status
+      });
       return {
         success: data.status === "completed",
         intentId,
@@ -1653,6 +3594,10 @@ var OneAuthClient = class {
         operationId: data.operationId
       };
     } catch (error) {
+      this.emitTelemetry("status.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(error)
+      });
       return {
         success: false,
         intentId,
@@ -1684,6 +3629,9 @@ var OneAuthClient = class {
    * ```
    */
   async getIntentHistory(options) {
+    const telemetry = this.createTelemetryOperation("history", {
+      hasStatusFilter: !!options?.status
+    });
     const queryParams = new URLSearchParams();
     if (options?.limit) queryParams.set("limit", String(options.limit));
     if (options?.offset) queryParams.set("offset", String(options.offset));
@@ -1692,184 +3640,188 @@ var OneAuthClient = class {
     if (options?.to) queryParams.set("to", options.to);
     const url = `${this.config.providerUrl}/api/intent/history${queryParams.toString() ? `?${queryParams}` : ""}`;
     const response = await fetch(url, {
-      headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {},
+      headers: {
+        ...this.telemetryHeaders(telemetry),
+        ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+      },
       credentials: "include"
     });
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
+      this.emitTelemetry("history.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "HISTORY_FAILED",
+        errorMessage: errorData.error || "Failed to get intent history"
+      });
       throw new Error(errorData.error || "Failed to get intent history");
     }
-    return response.json();
+    const result = await response.json();
+    this.emitTelemetry("history.succeeded", telemetry, {
+      outcome: "success",
+      attributes: {
+        total: result.total,
+        returned: result.intents?.length ?? 0
+      }
+    });
+    return result;
   }
   /**
-   * Send a swap intent through the Rhinestone orchestrator
-   *
-   * This is a high-level abstraction for token swaps (including cross-chain):
-   * 1. Resolves token symbols to addresses
-   * 2. Builds the swap intent with tokenRequests (output-first model)
-   * 3. The orchestrator's solver network finds the best route
-   * 4. Executes via the standard intent flow
-   *
-   * NOTE: The `amount` parameter specifies the OUTPUT amount (what the user wants to receive),
-   * not the input amount. The orchestrator will calculate the required input from sourceAssets.
-   *
-   * @example
-   * ```typescript
-   * // Buy 100 USDC using ETH on Base
-   * const result = await client.sendSwap({
-   *   username: 'alice',
-   *   targetChain: 8453,
-   *   fromToken: 'ETH',
-   *   toToken: 'USDC',
-   *   amount: '100', // Receive 100 USDC
-   * });
-   *
-   * // Cross-chain: Buy 50 USDC on Base, paying with ETH from any chain
-   * const result = await client.sendSwap({
-   *   username: 'alice',
-   *   targetChain: 8453, // Base
-   *   fromToken: 'ETH',
-   *   toToken: 'USDC',
-   *   amount: '50', // Receive 50 USDC
-   * });
-   * ```
+   * Forward a raw EIP-1193 request to the iframe so the active EOA connector
+   * can handle it (wallet-connect session or injected wallet). Opens
+   * `/dialog/sign-eoa`, which looks up the wagmi connector and delegates to
+   * `connector.getProvider().request({ method, params })`. The wallet's own
+   * UI is the review screen; the dialog just transports the request.
    */
-  async sendSwap(options) {
-    try {
-      getChainById(options.targetChain);
-    } catch {
-      return {
-        success: false,
-        intentId: "",
-        status: "failed",
-        error: {
-          code: "INVALID_CHAIN",
-          message: `Unsupported chain: ${options.targetChain}`
-        }
-      };
-    }
-    const resolveToken = (token, label) => {
-      try {
-        const address = resolveTokenAddress(token, options.targetChain);
-        if (!isTokenAddressSupported(address, options.targetChain)) {
-          return {
-            error: `Unsupported ${label}: ${token} on chain ${options.targetChain}`
-          };
-        }
-        return { address };
-      } catch (error) {
-        return {
-          error: error instanceof Error ? error.message : `Unsupported ${label}: ${token} on chain ${options.targetChain}`
-        };
-      }
-    };
-    let fromTokenAddress;
-    if (options.fromToken) {
-      const fromTokenResult = resolveToken(options.fromToken, "fromToken");
-      if (!fromTokenResult.address) {
-        return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: {
-            code: "INVALID_TOKEN",
-            message: fromTokenResult.error || `Unknown fromToken: ${options.fromToken}`
-          }
-        };
-      }
-      fromTokenAddress = fromTokenResult.address;
-    }
-    const toTokenResult = resolveToken(options.toToken, "toToken");
-    if (!toTokenResult.address) {
+  async requestWithWallet(options) {
+    const job = this.eoaSerialQueue.then(
+      () => this.doRequestWithWallet(options),
+      () => this.doRequestWithWallet(options)
+    );
+    this.eoaSerialQueue = job.then(
+      () => void 0,
+      () => void 0
+    );
+    return job;
+  }
+  async doRequestWithWallet(options) {
+    const dialogOrigin = this.getDialogOrigin();
+    const ensureResult = await this.ensureEoaDialog(options?.theme);
+    if (!ensureResult.ok) {
       return {
         success: false,
-        intentId: "",
-        status: "failed",
-        error: {
-          code: "INVALID_TOKEN",
-          message: toTokenResult.error || `Unknown toToken: ${options.toToken}`
-        }
+        error: { code: "USER_REJECTED", message: "User closed the dialog" }
       };
     }
-    const toTokenAddress = toTokenResult.address;
-    const formatTokenLabel = (token, fallback) => {
-      if (!token.startsWith("0x")) {
-        return token;
-      }
-      try {
-        return getTokenSymbol(token, options.targetChain);
-      } catch {
-        return fallback;
-      }
+    const { dialog, iframe } = ensureResult;
+    const requestId = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const hideDialog = () => {
+      if (dialog.open) dialog.close();
     };
-    const toSymbol = formatTokenLabel(
-      options.toToken,
-      `${options.toToken.slice(0, 6)}...${options.toToken.slice(-4)}`
+    const responsePromise = this.waitForEoaResponse(
+      iframe,
+      hideDialog,
+      requestId,
+      dialogOrigin
     );
-    const isFromNativeEth = fromTokenAddress ? fromTokenAddress === "0x0000000000000000000000000000000000000000" : false;
-    const isToNativeEth = toTokenAddress === "0x0000000000000000000000000000000000000000";
-    const KNOWN_DECIMALS = {
-      ETH: 18,
-      WETH: 18,
-      USDC: 6,
-      USDT: 6,
-      USDT0: 6
+    const initPayload = {
+      mode: "iframe",
+      method: options.method,
+      params: options.params,
+      expectedAddress: options.expectedAddress,
+      requestId
     };
-    const getDecimals = (symbol, chainId) => {
-      try {
-        const match = getSupportedTokens(chainId).find(
-          (t) => t.symbol.toUpperCase() === symbol.toUpperCase()
+    iframe.contentWindow?.postMessage(
+      { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+      dialogOrigin
+    );
+    const handleReReady = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.source !== iframe.contentWindow) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          dialogOrigin
         );
-        if (match) return match.decimals;
-        return getTokenDecimals(symbol, chainId);
-      } catch {
-        const upperSymbol = symbol.toUpperCase();
-        return KNOWN_DECIMALS[upperSymbol] ?? 18;
       }
     };
-    const toDecimals = getDecimals(options.toToken, options.targetChain);
-    const isBridge = options.fromToken ? options.fromToken.toUpperCase() === options.toToken.toUpperCase() : false;
-    const tokenRequests = [{
-      token: toTokenAddress,
-      amount: parseUnits(options.amount, toDecimals)
-    }];
-    const result = await this.sendIntent({
-      username: options.username,
-      targetChain: options.targetChain,
-      calls: [
-        {
-          // Minimal call - just signals to orchestrator we want the tokenRequests delivered
-          to: toTokenAddress,
-          value: "0",
-          // SDK provides labels so dialog shows "Buy ETH" not "Send ETH / To: 0x000..."
-          label: `Buy ${toSymbol}`,
-          sublabel: `${options.amount} ${toSymbol}`
-        }
-      ],
-      // Request specific output tokens - this is what actually matters for swaps
-      tokenRequests,
-      // Constrain orchestrator to use only the fromToken as input
-      // This ensures the swap uses the correct source token
-      // Use canonical symbol casing from registry (e.g. "MockUSD" not "MOCKUSD")
-      sourceAssets: options.sourceAssets || (options.fromToken ? [options.fromToken] : void 0),
-      // Pass source chain ID so orchestrator knows which chain to look for tokens on
-      sourceChainId: options.sourceChainId,
-      closeOn: options.closeOn || "preconfirmed",
-      waitForHash: options.waitForHash,
-      hashTimeoutMs: options.hashTimeoutMs,
-      hashIntervalMs: options.hashIntervalMs
+    window.addEventListener("message", handleReReady);
+    const result = await responsePromise;
+    window.removeEventListener("message", handleReReady);
+    hideDialog();
+    return result;
+  }
+  /**
+   * Lazily create the persistent `/dialog/sign-eoa` iframe and reveal it.
+   * Subsequent calls just re-open the existing `<dialog>` so the iframe's
+   * in-page state (notably the WalletConnect SignClient) is preserved
+   * between transactions.
+   */
+  async ensureEoaDialog(theme) {
+    if (this.eoaDialogState) {
+      const { dialog: dialog2, iframe: iframe2 } = this.eoaDialogState;
+      if (!dialog2.open) {
+        dialog2.showModal();
+      }
+      return { ok: true, dialog: dialog2, iframe: iframe2 };
+    }
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    const themeParams = this.getThemeParams(theme);
+    if (themeParams) {
+      new URLSearchParams(themeParams).forEach((value, key) => {
+        params.set(key, value);
+      });
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign-eoa?${params.toString()}`;
+    const { dialog, iframe, destroy } = this.createModalDialog(signingUrl, {
+      persistent: true
+    });
+    const ready = await this.waitForEoaIframeReady(iframe);
+    if (!ready) {
+      destroy();
+      return { ok: false };
+    }
+    this.eoaDialogState = { dialog, iframe };
+    return { ok: true, dialog, iframe };
+  }
+  waitForEoaIframeReady(iframe) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let timeoutId = null;
+      const cleanup = () => {
+        if (timeoutId !== null) clearTimeout(timeoutId);
+        window.removeEventListener("message", handler);
+      };
+      const handler = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.source !== iframe.contentWindow) return;
+        if (event.data?.type === "PASSKEY_READY") {
+          cleanup();
+          resolve(true);
+        }
+      };
+      window.addEventListener("message", handler);
+      timeoutId = setTimeout(() => {
+        cleanup();
+        resolve(false);
+      }, 1e4);
+    });
+  }
+  waitForEoaResponse(iframe, cleanup, requestId, dialogOrigin) {
+    return new Promise((resolve) => {
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.source !== iframe.contentWindow) return;
+        const message = event.data;
+        if (message?.type === "PASSKEY_EOA_RESULT" || message?.type === "PASSKEY_EOA_CLOSE") {
+          if (message.requestId !== requestId) return;
+        } else {
+          return;
+        }
+        window.removeEventListener("message", handleMessage);
+        if (message.type === "PASSKEY_EOA_CLOSE") {
+          cleanup();
+          resolve({
+            success: false,
+            error: { code: "USER_REJECTED", message: "User closed the dialog" }
+          });
+          return;
+        }
+        if (message.success) {
+          resolve({ success: true, result: message.data?.result });
+        } else {
+          resolve({
+            success: false,
+            error: message.error || {
+              code: "EOA_REQUEST_FAILED",
+              message: "Wallet request failed"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
     });
-    return {
-      ...result,
-      quote: result.success ? {
-        fromToken: fromTokenAddress ?? options.fromToken,
-        toToken: toTokenAddress,
-        amountIn: options.amount,
-        amountOut: "",
-        // Filled by orchestrator quote
-        rate: ""
-      } : void 0
-    };
   }
   /**
    * Sign an arbitrary message with the user's passkey
@@ -1900,12 +3852,38 @@ var OneAuthClient = class {
    * ```
    */
   async signMessage(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "message",
+      hasAccountAddress: !!options.accountAddress
+    });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -1921,15 +3899,18 @@ var OneAuthClient = class {
       username: options.username,
       accountAddress: options.accountAddress,
       description: options.description,
-      metadata: options.metadata
+      metadata: options.metadata,
+      telemetry: this.telemetryPayload(telemetry)
     };
     dialogResult.sendInit(initPayload);
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     const dialogOrigin = this.getDialogOrigin();
     const handleReReady = (event) => {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -1939,6 +3920,10 @@ var OneAuthClient = class {
     window.removeEventListener("message", handleReReady);
     cleanup();
     if (signingResult.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signingMode: "message" }
+      });
       return {
         success: true,
         signature: signingResult.signature,
@@ -1947,6 +3932,15 @@ var OneAuthClient = class {
         passkey: signingResult.passkey
       };
     }
+    this.emitTelemetry(
+      signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+      telemetry,
+      {
+        outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+        ...describeTelemetryError(signingResult.error),
+        attributes: { signingMode: "message" }
+      }
+    );
     return {
       success: false,
       error: signingResult.error
@@ -1994,6 +3988,11 @@ var OneAuthClient = class {
    * ```
    */
   async signTypedData(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "typedData",
+      primaryType: options.primaryType,
+      hasAccountAddress: !!options.accountAddress
+    });
     const signedHash = hashTypedData({
       domain: options.domain,
       types: options.types,
@@ -2001,11 +4000,33 @@ var OneAuthClient = class {
       message: options.message
     });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    appendParentOriginParam(params);
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -2026,15 +4047,18 @@ var OneAuthClient = class {
       challenge: signedHash,
       username: options.username,
       accountAddress: options.accountAddress,
-      description: options.description
+      description: options.description,
+      telemetry: this.telemetryPayload(telemetry)
     };
     dialogResult.sendInit(initPayload);
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     const dialogOrigin = this.getDialogOrigin();
     const handleReReady = (event) => {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -2044,6 +4068,10 @@ var OneAuthClient = class {
     window.removeEventListener("message", handleReReady);
     cleanup();
     if (signingResult.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signingMode: "typedData", primaryType: options.primaryType }
+      });
       return {
         success: true,
         signature: signingResult.signature,
@@ -2051,6 +4079,15 @@ var OneAuthClient = class {
         passkey: signingResult.passkey
       };
     }
+    this.emitTelemetry(
+      signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+      telemetry,
+      {
+        outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+        ...describeTelemetryError(signingResult.error),
+        attributes: { signingMode: "typedData", primaryType: options.primaryType }
+      }
+    );
     return {
       success: false,
       error: signingResult.error
@@ -2121,8 +4158,66 @@ var OneAuthClient = class {
     iframe.onload = () => {
       options.onReady?.();
     };
-    options.container.appendChild(iframe);
-    return iframe;
+    options.container.appendChild(iframe);
+    this.wireViewportInfo(iframe);
+    const host = new URL(dialogUrl);
+    const onResize = (event) => {
+      if (event.source !== iframe.contentWindow) return;
+      if (event.origin !== host.origin) return;
+      if (event.data?.type !== "PASSKEY_RESIZE") return;
+      const h = Number(event.data.height);
+      if (Number.isFinite(h) && h > 0) {
+        iframe.style.height = `${h}px`;
+      }
+    };
+    window.addEventListener("message", onResize);
+    return iframe;
+  }
+  /**
+   * Post `PASSKEY_VIEWPORT_INFO` with the parent's
+   * `window.innerHeight` to the iframe whenever it signals
+   * `PASSKEY_READY`, and re-post on `window.resize` (rAF-debounced)
+   * so the dialog's internal max-height cap follows the user's
+   * actual screen.
+   *
+   * Inside the iframe, `vh`/`dvh` units refer to the iframe's own
+   * height (recursive when the iframe auto-sizes), so the parent is
+   * the only reliable source of "what 75% of the user's screen is".
+   * The dialog stores the value in `dialog-context` and falls back
+   * to auto-grow when the value is absent — so it's safe to call
+   * this even for embedders that don't actually cap (modal mode
+   * uses `fullViewport` which has its own outer cap).
+   */
+  wireViewportInfo(iframe) {
+    const dialogOrigin = this.getDialogOrigin();
+    const post = () => {
+      iframe.contentWindow?.postMessage(
+        { type: "PASSKEY_VIEWPORT_INFO", height: window.innerHeight },
+        dialogOrigin
+      );
+    };
+    const handleMessage = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.source !== iframe.contentWindow) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        post();
+      }
+    };
+    window.addEventListener("message", handleMessage);
+    let raf = null;
+    const onResize = () => {
+      if (raf !== null) return;
+      raf = requestAnimationFrame(() => {
+        raf = null;
+        post();
+      });
+    };
+    window.addEventListener("resize", onResize);
+    return () => {
+      window.removeEventListener("message", handleMessage);
+      window.removeEventListener("resize", onResize);
+      if (raf !== null) cancelAnimationFrame(raf);
+    };
   }
   /**
    * Listen for a signing result from an embedded (inline) signing iframe.
@@ -2258,6 +4353,7 @@ var OneAuthClient = class {
         body: JSON.stringify({
           ...this.config.clientId && { clientId: this.config.clientId },
           username: options.username,
+          accountAddress: options.accountAddress,
           challenge: options.challenge,
           description: options.description,
           metadata: options.metadata,
@@ -2313,7 +4409,7 @@ var OneAuthClient = class {
    * @returns `true` if the dialog is ready and init was sent; `false` if the
    *   dialog was closed or timed out before becoming ready.
    */
-  waitForDialogReady(dialog, iframe, cleanup, initMessage) {
+  waitForDialogReady(dialog, iframe, cleanup, initMessage, options = {}) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       let settled = false;
@@ -2327,11 +4423,14 @@ var OneAuthClient = class {
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         if (event.data?.type === "PASSKEY_READY") {
+          const blindSigning = options.blindSigning === true;
           teardown();
+          if (blindSigning) iframe.focus({ preventScroll: true });
           iframe.contentWindow?.postMessage({
             type: "PASSKEY_INIT",
             ...initMessage,
-            fullViewport: true
+            fullViewport: true,
+            blindSigning
           }, dialogOrigin);
           resolve(true);
         } else if (event.data?.type === "PASSKEY_CLOSE") {
@@ -2356,17 +4455,17 @@ var OneAuthClient = class {
   /**
    * Create and open a full-viewport `<dialog>` containing a passkey iframe.
    *
-   * The SDK owns only the transparent outer shell; all visible UI (backdrop,
-   * card, animations, close button) is rendered by the passkey app inside the
-   * iframe. This approach means design changes can be shipped server-side
-   * without updating SDK consumers.
+   * The SDK owns the browser `<dialog>` plus a minimal generic preload shell
+   * that appears immediately on click. The passkey iframe owns all branded and
+   * origin-specific UI (TitleBar, trust icon, action cards); the shell is
+   * removed as soon as the iframe reports that its centered card has painted.
    *
    * Lifecycle:
-   *   1. A themed "Loading…" overlay is injected and shown immediately while the
-   *      iframe loads, matching the exact visual structure of the passkey app's
-   *      TitleBar + IndeterminateLoader so the transition is seamless.
-   *   2. When the iframe sends `PASSKEY_RENDERED`, the overlay fades out and
-   *      the iframe becomes fully visible.
+   *   1. A themed generic preload shell is injected and shown immediately
+   *      while the iframe loads. It intentionally contains no TitleBar or
+   *      origin chrome so that UI has a single implementation in apps/passkey.
+   *   2. When the iframe sends `PASSKEY_RENDERED`, the overlay is removed and
+   *      the iframe becomes fully visible in the same frame.
    *   3. The returned `cleanup` function tears down all event listeners,
    *      disconnects the MutationObserver, closes the `<dialog>`, and removes
    *      it from the DOM. It is idempotent — safe to call multiple times.
@@ -2378,29 +4477,25 @@ var OneAuthClient = class {
    *     restores those as well.
    *   - The iframe sandbox includes `allow-popups-to-escape-sandbox` so that
    *     1Password's popup UI can render outside the sandboxed context.
+   *   - `allow-downloads` lets the passkey iframe trigger the recovery-key
+   *     JSON fallback download without sending sensitive data to the parent.
    *
    * @param url - The full URL (including query params) to load in the iframe.
    * @returns References to the dialog, iframe, and a cleanup function.
    */
-  createModalDialog(url) {
+  createModalDialog(url, options) {
     const dialogUrl = this.getDialogUrl();
     const hostUrl = new URL(dialogUrl);
     const urlParams = new URL(url, window.location.href).searchParams;
+    const { background: backdropBackground, blur: backdropBlur } = resolveBackdropStyle(urlParams);
     const themeMode = urlParams.get("theme") || "light";
-    const accentColor = urlParams.get("accent") || "#0090ff";
     const isDark = themeMode === "dark" || themeMode !== "light" && window.matchMedia("(prefers-color-scheme: dark)").matches;
-    const bgPrimary = isDark ? "#191919" : "#fcfcfc";
-    const bgSecondary = isDark ? "#222222" : "#f9f9f9";
-    const borderColor = isDark ? "#2a2a2a" : "#e0e0e0";
-    const textPrimary = isDark ? "#eeeeee" : "#202020";
-    const textSecondary = isDark ? "#7b7b7b" : "#838383";
-    const bgSurface = isDark ? "#222222" : "#f0f0f0";
-    const ah = accentColor.replace("#", "");
-    const accentRgb = `${parseInt(ah.slice(0, 2), 16)},${parseInt(ah.slice(2, 4), 16)},${parseInt(ah.slice(4, 6), 16)}`;
-    const accentTint = isDark ? `rgba(${accentRgb},0.15)` : `rgba(${accentRgb},0.1)`;
-    const hostname = window.location.hostname;
+    const theme = isDark ? DARK_TOKENS : LIGHT_TOKENS;
     const dialog = document.createElement("dialog");
     dialog.dataset.passkey = "";
+    if (options?.hidden) {
+      dialog.dataset.passkeyHidden = "";
+    }
     dialog.style.opacity = "1";
     dialog.style.background = "transparent";
     document.body.appendChild(dialog);
@@ -2427,83 +4522,159 @@ var OneAuthClient = class {
       dialog[data-passkey]::backdrop {
         background: transparent !important;
       }
-      dialog[data-passkey] iframe {
-        position: fixed;
-        top: 0;
-        left: 0;
-        width: 100%;
-        height: 100%;
-        border: 0;
-        background-color: transparent;
-        color-scheme: normal;
-        pointer-events: auto;
-        backdrop-filter: blur(8px);
-        -webkit-backdrop-filter: blur(8px);
+      dialog[data-passkey][data-passkey-hidden] {
+        width: 1px;
+        height: 1px;
+        max-width: 1px;
+        max-height: 1px;
+        opacity: 0;
+        pointer-events: none;
+      }
+      dialog[data-passkey][data-passkey-hidden] iframe {
+        width: 1px;
+        height: 1px;
+        opacity: 0 !important;
+        pointer-events: none;
+        backdrop-filter: none;
+        -webkit-backdrop-filter: none;
       }
       dialog[data-passkey] [data-passkey-overlay] {
         position: fixed;
-        top: 0;
-        left: 0;
-        width: 100%;
-        height: 100%;
+        inset: 0;
         display: flex;
-        align-items: flex-start;
+        align-items: center;
         justify-content: center;
-        padding-top: 50px;
-        background: rgba(0, 0, 0, 0.4);
-        backdrop-filter: blur(8px);
-        -webkit-backdrop-filter: blur(8px);
+        background: ${backdropBackground};
+        backdrop-filter: blur(${backdropBlur}px);
+        -webkit-backdrop-filter: blur(${backdropBlur}px);
         z-index: 1;
-        animation: _1auth-backdrop-in 0.2s ease-out;
+        pointer-events: none;
       }
-      @media (max-width: 768px) {
-        dialog[data-passkey] [data-passkey-overlay] {
-          align-items: flex-end;
-          padding-top: 0;
-        }
+      dialog[data-passkey][data-passkey-hidden] [data-passkey-overlay] {
+        display: none;
       }
-      dialog[data-passkey] [data-passkey-card] {
-        width: 340px;
+      dialog[data-passkey] [data-passkey-preload-card] {
+        width: ${LOADING_MODAL_WIDTH}px;
+        max-width: 100%;
         overflow: hidden;
-        border-radius: 14px;
-        box-shadow: 0 8px 32px rgba(0,0,0,0.12), 0 2px 8px rgba(0,0,0,0.08);
-        animation: _1auth-card-in 0.2s cubic-bezier(0.32, 0.72, 0, 1);
-        max-height: calc(100dvh - 100px);
+        border-radius: ${LOADING_MODAL_RADIUS}px;
+        background: ${theme.bgPrimary};
+        box-shadow: 0 24px 80px rgba(0, 0, 0, 0.24), 0 2px 12px rgba(0, 0, 0, 0.12);
+        font-family: ${LOADING_FONT_FAMILY};
+        line-height: ${LOADING_LINE_HEIGHT};
+        -webkit-font-smoothing: antialiased;
+        -moz-osx-font-smoothing: grayscale;
       }
-      @media (max-width: 768px) {
-        dialog[data-passkey] [data-passkey-card] {
-          width: 100%;
-          border-bottom-left-radius: 0;
-          border-bottom-right-radius: 0;
-          animation: _1auth-card-slide 0.3s cubic-bezier(0.32, 0.72, 0, 1);
-        }
+      dialog[data-passkey] [data-passkey-preload-body] {
+        box-sizing: border-box;
+        display: flex;
+        width: 100%;
+        flex-direction: column;
+        align-items: center;
+        gap: ${LOADING_BODY_GAP}px;
+        padding: ${LOADING_MODAL_PADDING}px;
+        border-radius: ${LOADING_MODAL_RADIUS}px;
+        background: ${theme.bgPrimary};
+      }
+      dialog[data-passkey] [data-passkey-preload-spinner-wrap] {
+        display: flex;
+        align-items: center;
+        padding: ${LOADING_ICON_PADDING}px;
       }
-      @keyframes _1auth-backdrop-in {
-        from { opacity: 0; } to { opacity: 1; }
+      dialog[data-passkey] [data-passkey-preload-spinner] {
+        position: relative;
+        width: ${SPINNER_SIZE}px;
+        height: ${SPINNER_SIZE}px;
       }
-      @keyframes _1auth-card-in {
-        from { opacity: 0; transform: scale(0.96) translateY(8px); }
-        to { opacity: 1; transform: scale(1) translateY(0); }
+      dialog[data-passkey] [data-passkey-preload-spinner] svg {
+        position: absolute;
+        inset: 0;
+        width: 100%;
+        height: 100%;
+        color: ${BRAND_PURPLE};
+        animation: _1auth-spin ${SPINNER_SPIN_DURATION_MS}ms linear infinite;
+      }
+      dialog[data-passkey] [data-passkey-preload-copy] {
+        display: flex;
+        width: 100%;
+        flex-direction: column;
+        align-items: center;
+        gap: ${LOADING_TITLE_BLOCK_GAP}px;
+        text-align: center;
+      }
+      dialog[data-passkey] [data-passkey-preload-title] {
+        margin: 0;
+        color: ${theme.textPrimary};
+        font-size: ${LOADING_TITLE_FONT_SIZE}px;
+        font-weight: ${LOADING_TITLE_FONT_WEIGHT};
+        line-height: ${LOADING_LINE_HEIGHT};
+      }
+      dialog[data-passkey] [data-passkey-preload-subtitle] {
+        margin: 0;
+        color: ${theme.textSecondary};
+        font-size: ${LOADING_SUBTITLE_FONT_SIZE}px;
+        font-weight: ${LOADING_SUBTITLE_FONT_WEIGHT};
+        line-height: ${LOADING_LINE_HEIGHT};
       }
-      @keyframes _1auth-card-slide {
-        from { transform: translate3d(0, 100%, 0); }
-        to { transform: translate3d(0, 0, 0); }
+      @media (max-width: 639px) {
+        dialog[data-passkey] [data-passkey-overlay] {
+          align-items: flex-end;
+        }
+        dialog[data-passkey] [data-passkey-preload-card] {
+          width: 100%;
+          border-bottom-right-radius: 0;
+          border-bottom-left-radius: 0;
+        }
+        dialog[data-passkey] [data-passkey-preload-body] {
+          padding-bottom: calc(${LOADING_MODAL_PADDING}px + env(safe-area-inset-bottom));
+        }
       }
       @keyframes _1auth-spin {
         from { transform: rotate(0deg); }
         to { transform: rotate(360deg); }
       }
+      dialog[data-passkey] iframe {
+        position: fixed;
+        top: 0;
+        left: 0;
+        width: 100%;
+        height: 100%;
+        border: 0;
+        background-color: transparent;
+        color-scheme: normal;
+        pointer-events: auto;
+        backdrop-filter: blur(${backdropBlur}px);
+        -webkit-backdrop-filter: blur(${backdropBlur}px);
+        transition: none;
+      }
     `;
     dialog.appendChild(style);
     const overlay = document.createElement("div");
     overlay.dataset.passkeyOverlay = "";
-    const _sp = '<path d="M10 0.5C8.02219 0.5 6.08879 1.08649 4.4443 2.1853C2.79981 3.28412 1.51809 4.8459 0.761209 6.67316C0.00433288 8.50043 -0.1937 10.5111 0.192152 12.4509C0.578004 14.3907 1.53041 16.1725 2.92894 17.5711C4.32746 18.9696 6.10929 19.922 8.0491 20.3078C9.98891 20.6937 11.9996 20.4957 13.8268 19.7388C15.6541 18.9819 17.2159 17.7002 18.3147 16.0557C19.4135 14.4112 20 12.4778 20 10.5C20 7.84783 18.9464 5.3043 17.0711 3.42893C15.1957 1.55357 12.6522 0.5 10 0.5ZM10 17.7727C8.56159 17.7727 7.15549 17.3462 5.95949 16.547C4.7635 15.7479 3.83134 14.6121 3.28088 13.2831C2.73042 11.9542 2.5864 10.4919 2.86702 9.08116C3.14764 7.67039 3.8403 6.37451 4.85741 5.3574C5.87452 4.3403 7.17039 3.64764 8.58116 3.36702C9.99193 3.0864 11.4542 3.23042 12.7832 3.78088C14.1121 4.33133 15.2479 5.26349 16.0471 6.45949C16.8462 7.65548 17.2727 9.06159 17.2727 10.5C17.2727 12.4288 16.5065 14.2787 15.1426 15.6426C13.7787 17.0065 11.9288 17.7727 10 17.7727Z" fill="currentColor" opacity="0.3"/><path d="M10 3.22767C11.7423 3.22846 13.4276 3.8412 14.7556 4.95667C16.0837 6.07214 16.9681 7.61784 17.2512 9.31825C17.3012 9.64364 17.4662 9.94096 17.7169 10.1573C17.9677 10.3737 18.2878 10.4951 18.6205 10.5C18.8211 10.5001 19.0193 10.457 19.2012 10.3735C19.3832 10.2901 19.5445 10.1684 19.674 10.017C19.8036 9.86549 19.8981 9.68789 19.9511 9.49656C20.004 9.30523 20.0141 9.10478 19.9807 8.90918C19.5986 6.56305 18.3843 4.42821 16.5554 2.88726C14.7265 1.34631 12.4025 0.5 10 0.5C7.59751 0.5 5.27354 1.34631 3.44461 2.88726C1.61569 4.42821 0.401366 6.56305 0.0192815 8.90918C-0.0141442 9.10478 -0.00402016 9.30523 0.0489472 9.49656C0.101914 9.68789 0.196449 9.86549 0.325956 10.017C0.455463 10.1684 0.616823 10.2901 0.798778 10.3735C0.980732 10.457 1.1789 10.5001 1.37945 10.5C1.71216 10.4951 2.03235 10.3737 2.28307 10.1573C2.5338 9.94096 2.69883 9.64364 2.74882 9.31825C3.03193 7.61784 3.91633 6.07214 5.24436 4.95667C6.57239 3.8412 8.25775 3.22846 10 3.22767Z" fill="currentColor"/>';
-    overlay.innerHTML = `<div data-passkey-card style="background:${bgPrimary};border:1px solid ${borderColor};font-family:ui-sans-serif,system-ui,sans-serif,'Apple Color Emoji','Segoe UI Emoji'"><div style="height:36px;display:flex;align-items:center;justify-content:space-between;padding:0 12px;background:${bgSecondary};border-bottom:1px solid ${borderColor}"><div style="display:flex;align-items:center;gap:8px"><div style="display:flex;width:20px;height:20px;align-items:center;justify-content:center;border-radius:4px;background:${bgSurface}"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="${textPrimary}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12V7H5a2 2 0 0 1 0-4h14v4"/><path d="M3 5v14a2 2 0 0 0 2 2h16v-5"/><path d="M18 12a2 2 0 0 0 0 4h4v-4Z"/></svg></div><span style="font-size:13px;font-weight:500;color:${textPrimary};max-width:200px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${hostname}</span><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="${textSecondary}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"/><path d="m9 12 2 2 4-4"/></svg></div><div style="display:flex;align-items:center;gap:4px"><div style="display:flex;width:24px;height:24px;align-items:center;justify-content:center;border-radius:6px;color:${textSecondary}"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/></svg></div><button data-passkey-close style="display:flex;width:24px;height:24px;align-items:center;justify-content:center;border-radius:6px;color:${textSecondary};border:none;background:none;cursor:pointer;padding:0"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></svg></button></div></div><div style="padding:12px"><div style="display:flex;align-items:center;gap:8px"><div style="display:flex;width:32px;height:32px;min-width:32px;align-items:center;justify-content:center;border-radius:50%;background:${accentTint};padding:6px"><svg style="width:100%;height:100%;animation:_1auth-spin 0.8s linear infinite;color:${accentColor}" fill="none" viewBox="0 0 20 21" xmlns="http://www.w3.org/2000/svg">${_sp}</svg></div><div style="font-weight:500;font-size:18px;color:${textPrimary}">Loading...</div></div><div style="margin-top:8px"><div style="font-size:15px;line-height:20px;color:${textPrimary}">This will only take a few moments.</div><div style="font-size:15px;line-height:20px;color:${textSecondary}">Please do not close the window.</div></div></div></div>`;
-    overlay.addEventListener("click", (e) => {
-      if (e.target === overlay) cleanup();
-    });
-    const overlayCloseBtn = overlay.querySelector("[data-passkey-close]");
-    if (overlayCloseBtn) overlayCloseBtn.addEventListener("click", () => cleanup());
+    const preloadCard = document.createElement("div");
+    preloadCard.dataset.passkeyPreloadCard = "";
+    const preloadBody = document.createElement("div");
+    preloadBody.dataset.passkeyPreloadBody = "";
+    const spinnerWrap = document.createElement("div");
+    spinnerWrap.dataset.passkeyPreloadSpinnerWrap = "";
+    const spinner = document.createElement("div");
+    spinner.dataset.passkeyPreloadSpinner = "";
+    const spinnerCenter = SPINNER_SIZE / 2;
+    const spinnerGap = SPINNER_CIRCUMFERENCE - SPINNER_ARC;
+    spinner.innerHTML = `<svg viewBox="0 0 ${SPINNER_SIZE} ${SPINNER_SIZE}" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><circle cx="${spinnerCenter}" cy="${spinnerCenter}" r="${SPINNER_RADIUS}" stroke="currentColor" opacity="0.3" stroke-width="${SPINNER_STROKE}"/><circle cx="${spinnerCenter}" cy="${spinnerCenter}" r="${SPINNER_RADIUS}" stroke="currentColor" stroke-width="${SPINNER_STROKE}" stroke-linecap="round" stroke-dasharray="${SPINNER_ARC} ${spinnerGap}" transform="rotate(-90 ${spinnerCenter} ${spinnerCenter})"/></svg>`;
+    spinnerWrap.appendChild(spinner);
+    const preloadCopy = document.createElement("div");
+    preloadCopy.dataset.passkeyPreloadCopy = "";
+    const preloadTitle = document.createElement("p");
+    preloadTitle.dataset.passkeyPreloadTitle = "";
+    preloadTitle.textContent = LOADING_TITLE;
+    const preloadSubtitle = document.createElement("p");
+    preloadSubtitle.dataset.passkeyPreloadSubtitle = "";
+    preloadSubtitle.textContent = LOADING_SUBTITLE;
+    preloadCopy.append(preloadTitle, preloadSubtitle);
+    preloadBody.append(spinnerWrap, preloadCopy);
+    preloadCard.appendChild(preloadBody);
+    overlay.appendChild(preloadCard);
     dialog.appendChild(overlay);
     const iframe = document.createElement("iframe");
     iframe.setAttribute(
@@ -2519,51 +4690,75 @@ var OneAuthClient = class {
     iframe.setAttribute("tabindex", "0");
     iframe.setAttribute(
       "sandbox",
-      "allow-forms allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox"
+      "allow-forms allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-downloads"
     );
-    iframe.setAttribute("src", url);
     iframe.setAttribute("title", "Passkey");
     iframe.style.opacity = "0";
-    dialog.appendChild(iframe);
-    const inertObserver = new MutationObserver((mutations) => {
-      for (const mutation of mutations) {
-        if (mutation.attributeName === "inert") {
-          dialog.removeAttribute("inert");
-        }
-      }
-    });
-    inertObserver.observe(dialog, { attributes: true });
-    let overlayHidden = false;
-    const hideOverlay = () => {
-      if (overlayHidden) return;
-      overlayHidden = true;
+    let revealed = false;
+    let readyFailsafe;
+    const revealIframe = () => {
+      if (revealed) return;
+      revealed = true;
+      clearTimeout(readyFailsafe);
       iframe.style.opacity = "1";
-      requestAnimationFrame(() => {
-        overlay.style.display = "none";
-      });
+      overlay.style.display = "none";
     };
+    const revealFailsafe = setTimeout(revealIframe, 8e3);
     const handleMessage = (event) => {
       if (event.origin !== hostUrl.origin) return;
+      if (event.source !== iframe.contentWindow) return;
       if (event.data?.type === "PASSKEY_RENDERED") {
-        hideOverlay();
+        revealIframe();
+      } else if (event.data?.type === "PASSKEY_READY" && !revealed && readyFailsafe === void 0) {
+        readyFailsafe = setTimeout(revealIframe, 1e3);
       }
       if (event.data?.type === "PASSKEY_DISCONNECT") {
         localStorage.removeItem("1auth-user");
       }
     };
     window.addEventListener("message", handleMessage);
+    const iframeUrl = new URL(url, window.location.href);
+    iframeUrl.searchParams.set("fullViewport", "1");
+    iframe.setAttribute("src", iframeUrl.toString());
+    dialog.appendChild(iframe);
+    const viewportInfoCleanup = this.wireViewportInfo(iframe);
+    const inertObserver = new MutationObserver((mutations) => {
+      for (const mutation of mutations) {
+        if (mutation.attributeName === "inert") {
+          dialog.removeAttribute("inert");
+        }
+      }
+    });
+    inertObserver.observe(dialog, { attributes: true });
     const handleEscape = (event) => {
       if (event.key === "Escape") {
         cleanup();
       }
     };
     document.addEventListener("keydown", handleEscape);
-    dialog.showModal();
+    const reveal = () => {
+      delete dialog.dataset.passkeyHidden;
+      if (!revealed) {
+        revealed = true;
+        clearTimeout(readyFailsafe);
+        clearTimeout(revealFailsafe);
+      }
+      iframe.style.opacity = "1";
+      overlay.style.display = "none";
+    };
+    if (options?.hidden) {
+      dialog.show();
+    } else {
+      dialog.showModal();
+    }
     let cleanedUp = false;
-    const cleanup = () => {
+    const destroy = () => {
       if (cleanedUp) return;
       cleanedUp = true;
+      clearTimeout(revealFailsafe);
+      clearTimeout(readyFailsafe);
       inertObserver.disconnect();
+      viewportInfoCleanup();
       window.removeEventListener("message", handleMessage);
       document.removeEventListener("keydown", handleEscape);
       dialog.close();
@@ -2576,14 +4771,23 @@ var OneAuthClient = class {
       }
       dialog.remove();
     };
-    return { dialog, iframe, cleanup };
+    const cleanup = options?.persistent ? () => {
+      if (dialog.open) dialog.close();
+    } : destroy;
+    return { dialog, iframe, cleanup, destroy, reveal };
   }
   /**
    * Listen for the auth result from the modal dialog.
    *
-   * Waits for `PASSKEY_READY` before processing any other messages to avoid
-   * acting on stale `PASSKEY_CLOSE` events that may still be in the event queue
-   * from a previously closed dialog.
+   * Each modal call generates a per-session nonce that the iframe must
+   * echo back in `PASSKEY_CLOSE` / `PASSKEY_LOGIN_RESULT` /
+   * `PASSKEY_RETRY_POPUP` messages. Without an echo, a queued CLOSE
+   * from the previous iframe could be dispatched to the new modal's
+   * listener (postMessage events tagged with `event.source` from a now-
+   * destroyed iframe still reach the parent's message handler) and
+   * silently cancel the fresh auth attempt. The nonce makes that race
+   * harmless: a stale message that doesn't carry the current modal's
+   * nonce is ignored.
    *
    * Also handles the `PASSKEY_RETRY_POPUP` message: sent by the dialog when a
    * password manager (e.g. Bitwarden) intercepts the WebAuthn call inside the
@@ -2596,25 +4800,42 @@ var OneAuthClient = class {
    * @param cleanup - Idempotent teardown for the modal dialog.
    * @returns An `AuthResult` discriminated union.
    */
-  waitForModalAuthResponse(_dialog, iframe, cleanup) {
+  waitForModalAuthResponse(_dialog, iframe, cleanup, requestId) {
     const dialogOrigin = this.getDialogOrigin();
+    const modalNonce = generateModalNonce();
     return new Promise((resolve) => {
-      let dialogReady = false;
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         const data = event.data;
+        const matchesSource = event.source === iframe.contentWindow;
+        const matchesRequest = typeof requestId === "string" && data?.requestId === requestId;
+        const matchesNonce = data?.modalNonce === modalNonce;
+        const isCurrentFrameClose = data?.type === "PASSKEY_CLOSE" && matchesSource;
+        if (data?.type === "PASSKEY_CLOSE" && (matchesRequest || matchesNonce || isCurrentFrameClose)) {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "Authentication was cancelled"
+            }
+          });
+          return;
+        }
         if (data?.type === "PASSKEY_READY") {
-          dialogReady = true;
           iframe.contentWindow?.postMessage({
             type: "PASSKEY_INIT",
             mode: "iframe",
-            fullViewport: true
+            fullViewport: true,
+            modalNonce
           }, dialogOrigin);
           return;
         }
-        if (!dialogReady && data?.type === "PASSKEY_CLOSE") {
-          return;
-        }
+        const hasModalNonce = typeof data?.modalNonce === "string";
+        const isCurrentDialogMessage = matchesSource || matchesNonce || !hasModalNonce;
+        if (!isCurrentDialogMessage) return;
+        if (data?.modalNonce && data.modalNonce !== modalNonce) return;
         if (data?.type === "PASSKEY_LOGIN_RESULT") {
           window.removeEventListener("message", handleMessage);
           cleanup();
@@ -2625,7 +4846,8 @@ var OneAuthClient = class {
                 id: data.data?.user?.id,
                 username: data.data?.username,
                 address: data.data?.address
-              }
+              },
+              signerType: data.data?.signerType ?? "passkey"
             });
           } else {
             resolve({
@@ -2638,16 +4860,6 @@ var OneAuthClient = class {
           cleanup();
           const popupUrl = data.data?.url?.replace("mode=iframe", "mode=popup") || `${this.getDialogUrl()}/dialog/auth?mode=popup${this.config.clientId ? `&clientId=${this.config.clientId}` : ""}`;
           this.waitForPopupAuthResponse(popupUrl).then(resolve);
-        } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          resolve({
-            success: false,
-            error: {
-              code: "USER_CANCELLED",
-              message: "Authentication was cancelled"
-            }
-          });
         }
       };
       window.addEventListener("message", handleMessage);
@@ -2688,7 +4900,8 @@ var OneAuthClient = class {
                 id: data.data?.user?.id,
                 username: data.data?.username,
                 address: data.data?.address
-              }
+              },
+              signerType: data.data?.signerType ?? "passkey"
             });
           } else {
             resolve({
@@ -2712,63 +4925,6 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
   }
-  /**
-   * Listen for the authenticate result from the modal dialog.
-   *
-   * The authenticate flow combines sign-in/sign-up with optional off-chain
-   * challenge signing. The dialog sends `PASSKEY_AUTHENTICATE_RESULT` on
-   * completion with both user details and, if a challenge was requested, the
-   * WebAuthn signature and the hashed challenge value for server-side
-   * verification.
-   *
-   * @param _dialog - Unused; kept for signature consistency.
-   * @param _iframe - Unused; kept for signature consistency.
-   * @param cleanup - Idempotent teardown for the modal dialog.
-   * @returns An `AuthenticateResult` discriminated union.
-   */
-  waitForAuthenticateResponse(_dialog, _iframe, cleanup) {
-    const dialogOrigin = this.getDialogOrigin();
-    return new Promise((resolve) => {
-      const handleMessage = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        const data = event.data;
-        if (data?.type === "PASSKEY_AUTHENTICATE_RESULT") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          if (data.success) {
-            resolve({
-              success: true,
-              user: {
-                id: data.data?.user?.id,
-                username: data.data?.username,
-                address: data.data?.accountAddress
-              },
-              challenge: data.data?.signature ? {
-                signature: data.data.signature,
-                signedHash: data.data.signedHash
-              } : void 0
-            });
-          } else {
-            resolve({
-              success: false,
-              error: data.error
-            });
-          }
-        } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          resolve({
-            success: false,
-            error: {
-              code: "USER_CANCELLED",
-              message: "Authentication was cancelled"
-            }
-          });
-        }
-      };
-      window.addEventListener("message", handleMessage);
-    });
-  }
   /**
    * Listen for the connect result from the connect dialog.
    *
@@ -2827,48 +4983,101 @@ var OneAuthClient = class {
     });
   }
   /**
-   * Listen for the consent result from the consent dialog.
+   * Listen for grant-permission results and bridge sponsorship token requests.
    *
-   * The consent dialog shows the user which data fields an app is requesting
-   * access to and lets them approve or deny. On approval, `data` contains the
-   * consented field values (e.g. email address, device names) and `grantedAt`
-   * records when consent was given.
-   *
-   * A `PASSKEY_CLOSE` without a prior `PASSKEY_CONSENT_RESULT` is treated as an
-   * explicit user cancellation (distinct from denial, though both yield
-   * `success: false`).
+   * The grant iframe owns the passkey ceremony and install intent submission.
+   * Extension-token minting stays in the app origin, so the SDK exposes a
+   * narrow postMessage round-trip that never gives the iframe app secrets.
    *
    * @param _dialog - Unused; kept for signature consistency.
-   * @param _iframe - Unused; kept for signature consistency.
+   * @param iframe - The grant iframe that receives extension-token responses.
    * @param cleanup - Idempotent teardown for the modal dialog.
-   * @returns A `RequestConsentResult` discriminated union.
+   * @param sponsor - Whether this grant flow should request an extension token.
+   * @returns A `GrantPermissionsResult` discriminated union.
    */
-  waitForConsentResponse(_dialog, _iframe, cleanup) {
+  waitForGrantPermissionResponse(dialog, iframe, cleanup, sponsor, initPayload) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
-      const handleMessage = (event) => {
+      let readySeen = false;
+      const teardown = () => {
+        clearTimeout(readyTimeout);
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const postInit = () => {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          dialogOrigin
+        );
+      };
+      const handleClose = () => {
+        teardown();
+        resolve({
+          success: false,
+          error: {
+            code: "USER_CANCELLED",
+            message: "User closed the dialog"
+          }
+        });
+      };
+      const handleMessage = async (event) => {
         if (event.origin !== dialogOrigin) return;
         const data = event.data;
-        if (data?.type === "PASSKEY_CONSENT_RESULT") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          if (data.success) {
-            resolve({
-              success: true,
-              data: data.data,
-              grantedAt: data.data?.grantedAt
-            });
-          } else {
-            resolve({
+        if (data?.type === "PASSKEY_READY") {
+          readySeen = true;
+          clearTimeout(readyTimeout);
+          postInit();
+          return;
+        }
+        if (data?.type === "PASSKEY_GRANT_EXTENSION_TOKEN_REQUEST") {
+          const requestId = data.requestId;
+          const intentOp = data.intentOp;
+          const postResponse = (payload) => {
+            iframe.contentWindow?.postMessage(
+              { type: "PASSKEY_GRANT_EXTENSION_TOKEN_RESPONSE", requestId, ...payload },
+              dialogOrigin
+            );
+          };
+          if (!requestId || !intentOp) {
+            postResponse({ success: false, error: "Invalid extension token request" });
+            return;
+          }
+          if (!sponsor) {
+            postResponse({ success: true });
+            return;
+          }
+          if (!this.sponsorship) {
+            postResponse({ success: false, error: MISSING_APP_CREDENTIALS_MESSAGE });
+            return;
+          }
+          try {
+            const token = await this.sponsorship.getExtensionToken(intentOp);
+            postResponse({ success: true, token });
+          } catch (err) {
+            postResponse({
               success: false,
-              error: data.error ?? {
-                code: "USER_REJECTED",
-                message: "User denied the consent request"
-              }
+              error: err instanceof Error ? err.message : String(err)
             });
           }
+          return;
+        }
+        if (data?.type === "PASSKEY_GRANT_PERMISSION_RESULT") {
+          if (data.success) {
+            teardown();
+            resolve({ success: true, ...data.data ?? {} });
+            return;
+          }
+          teardown();
+          cleanup();
+          resolve({
+            success: false,
+            error: data.error ?? data.data?.error ?? {
+              code: "GRANT_PERMISSION_FAILED",
+              message: "Permission grant failed"
+            }
+          });
         } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
+          teardown();
           cleanup();
           resolve({
             success: false,
@@ -2879,7 +5088,20 @@ var OneAuthClient = class {
           });
         }
       };
+      const readyTimeout = setTimeout(() => {
+        if (readySeen) return;
+        teardown();
+        cleanup();
+        resolve({
+          success: false,
+          error: {
+            code: "USER_CANCELLED",
+            message: "User closed the dialog"
+          }
+        });
+      }, 1e4);
       window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
     });
   }
   /**
@@ -3043,6 +5265,65 @@ var OneAuthClient = class {
   }
 };
 
+// src/permissions.ts
+function definePermissions(config) {
+  const { name, ...permission } = config;
+  return {
+    permissions: [permission],
+    contracts: [
+      {
+        address: config.address,
+        name,
+        abi: config.abi
+      }
+    ]
+  };
+}
+
+// src/crossChainPermissions.ts
+import { isAddress } from "viem";
+function toUnixSecondsBigint(input) {
+  if (typeof input === "bigint") return input;
+  return BigInt(Math.floor(input.getTime() / 1e3));
+}
+function resolveTokenForChain(token, chainId) {
+  return isAddress(token, { strict: false }) ? token : getTokenAddress(token, chainId);
+}
+function createCrossChainPermission(input) {
+  const fromLegs = Array.isArray(input.from) ? input.from : [input.from];
+  const toLegs = Array.isArray(input.to) ? input.to : [input.to];
+  if (fromLegs.length === 0) {
+    throw new Error("createCrossChainPermission: `from` must contain at least one leg");
+  }
+  if (toLegs.length === 0) {
+    throw new Error("createCrossChainPermission: `to` must contain at least one leg");
+  }
+  const validUntil = input.validUntil !== void 0 ? toUnixSecondsBigint(input.validUntil) : void 0;
+  const validAfter = input.validAfter !== void 0 ? toUnixSecondsBigint(input.validAfter) : void 0;
+  if (validUntil !== void 0 && validAfter !== void 0 && validAfter > validUntil) {
+    throw new Error(
+      `createCrossChainPermission: validAfter (${validAfter}) is greater than validUntil (${validUntil})`
+    );
+  }
+  return {
+    from: fromLegs.map((leg) => ({
+      chain: leg.chain,
+      token: resolveTokenForChain(leg.token, leg.chain.id),
+      maxAmount: leg.maxAmount
+    })),
+    to: toLegs.map((leg) => ({
+      chain: leg.chain,
+      token: resolveTokenForChain(leg.token, leg.chain.id),
+      recipient: leg.recipient
+    })),
+    validUntil,
+    validAfter,
+    fillDeadline: input.fillDeadline,
+    recipientIsAccount: !input.allowRecipientNotAccount,
+    settlementLayers: input.settlementLayers
+  };
+}
+
 // src/account.ts
 import {
   bytesToString,
@@ -3068,7 +5349,8 @@ function createPasskeyAccount(client, params) {
     address,
     signMessage: async ({ message }) => {
       const result = await client.signMessage({
-        username,
+        username: username || void 0,
+        accountAddress: address,
         message: normalizeMessage(message)
       });
       if (!result.success || !result.signature) {
@@ -3103,7 +5385,8 @@ function createPasskeyAccount(client, params) {
         ])
       );
       const result = await client.signTypedData({
-        username,
+        username: username || void 0,
+        accountAddress: address,
         domain,
         types: normalizedTypes,
         primaryType: typedData.primaryType,
@@ -3117,29 +5400,37 @@ function createPasskeyAccount(client, params) {
   });
   return {
     ...account,
-    username
+    ...username ? { username } : {},
+    accountAddress: address
   };
 }
 
 // src/walletClient/index.ts
 import {
   createWalletClient,
-  hashMessage,
+  hashMessage as hashMessage2,
   hashTypedData as hashTypedData2
 } from "viem";
 import { toAccount as toAccount2 } from "viem/accounts";
 function createPasskeyWalletClient(config) {
-  const resolvedUsername = config.username ?? config.accountAddress;
+  const identity = {
+    ...config.username ? { username: config.username } : {},
+    accountAddress: config.accountAddress
+  };
   const provider = new OneAuthClient({
     providerUrl: config.providerUrl,
     clientId: config.clientId,
-    dialogUrl: config.dialogUrl
+    dialogUrl: config.dialogUrl,
+    theme: config.theme,
+    blind_signing: config.blind_signing,
+    testnets: config.testnets,
+    sponsorship: config.sponsorship
   });
   const signMessageImpl = async (message) => {
-    const hash = hashMessage(message);
+    const hash = hashMessage2(message);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign message",
       transaction: {
         actions: [
@@ -3170,7 +5461,7 @@ function createPasskeyWalletClient(config) {
     const hash = hashCalls(calls);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign transaction",
       transaction: buildTransactionReview(calls)
     });
@@ -3186,7 +5477,7 @@ function createPasskeyWalletClient(config) {
     const hash = hashTypedData2(typedData);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign typed data",
       transaction: {
         actions: [
@@ -3213,10 +5504,12 @@ function createPasskeyWalletClient(config) {
       data: call.data || "0x",
       value: call.value !== void 0 ? call.value.toString() : "0",
       label: call.label,
-      sublabel: call.sublabel
+      sublabel: call.sublabel,
+      icon: call.icon,
+      abi: call.abi
     }));
     return {
-      username: resolvedUsername,
+      ...config.username ? { username: config.username } : {},
       accountAddress: config.accountAddress,
       targetChain,
       calls: intentCalls
@@ -3246,11 +5539,9 @@ function createPasskeyWalletClient(config) {
           value: transaction.value
         }
       ];
-      const closeOn = config.waitForHash ?? true ? "completed" : "preconfirmed";
       const intentPayload = await buildIntentPayload(calls, targetChain);
       const result = await provider.sendIntent({
         ...intentPayload,
-        closeOn,
         waitForHash: config.waitForHash ?? true,
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
@@ -3265,14 +5556,12 @@ function createPasskeyWalletClient(config) {
      */
     async sendCalls(params) {
       const { calls, chainId: targetChain, tokenRequests, sourceAssets, sourceChainId } = params;
-      const closeOn = config.waitForHash ?? true ? "completed" : "preconfirmed";
       const intentPayload = await buildIntentPayload(calls, targetChain, { tokenRequests, sourceAssets });
       const result = await provider.sendIntent({
         ...intentPayload,
         tokenRequests,
         sourceAssets,
         sourceChainId,
-        closeOn,
         waitForHash: config.waitForHash ?? true,
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
@@ -3303,21 +5592,36 @@ function useBatchQueue() {
 function generateId() {
   return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
 }
-function getStorageKey(username) {
-  return username ? `1auth_batch_queue_${username}` : "1auth_batch_queue_anonymous";
+function getStorageKey(identity) {
+  const key = identity?.accountAddress || identity?.username;
+  return key ? `1auth_batch_queue_${key.toLowerCase()}` : "1auth_batch_queue_anonymous";
+}
+function resolveIdentity(passedIdentity, providerIdentity) {
+  if (typeof passedIdentity === "string") {
+    return { username: passedIdentity, accountAddress: providerIdentity.accountAddress };
+  }
+  return {
+    username: passedIdentity?.username ?? providerIdentity.username,
+    accountAddress: passedIdentity?.accountAddress ?? providerIdentity.accountAddress
+  };
 }
 function BatchQueueProvider({
   client,
   username,
+  accountAddress,
   children
 }) {
   const [queue, setQueue] = React.useState([]);
   const [isExpanded, setExpanded] = React.useState(false);
   const [isSigning, setIsSigning] = React.useState(false);
   const [animationTrigger, setAnimationTrigger] = React.useState(0);
+  const providerIdentity = React.useMemo(
+    () => ({ username, accountAddress }),
+    [username, accountAddress]
+  );
   const batchChainId = queue.length > 0 ? queue[0].targetChain : null;
   React.useEffect(() => {
-    const storageKey = getStorageKey(username);
+    const storageKey = getStorageKey(providerIdentity);
     try {
       const stored = localStorage.getItem(storageKey);
       if (stored) {
@@ -3330,9 +5634,9 @@ function BatchQueueProvider({
       }
     } catch {
     }
-  }, [username]);
+  }, [providerIdentity]);
   React.useEffect(() => {
-    const storageKey = getStorageKey(username);
+    const storageKey = getStorageKey(providerIdentity);
     try {
       if (queue.length > 0) {
         localStorage.setItem(storageKey, JSON.stringify(queue));
@@ -3341,7 +5645,7 @@ function BatchQueueProvider({
       }
     } catch {
     }
-  }, [queue, username]);
+  }, [queue, providerIdentity]);
   const addToBatch = React.useCallback((call, targetChain) => {
     if (batchChainId !== null && batchChainId !== targetChain) {
       return {
@@ -3366,7 +5670,7 @@ function BatchQueueProvider({
     setQueue([]);
     setExpanded(false);
   }, []);
-  const signAll = React.useCallback(async (username2) => {
+  const signAll = React.useCallback(async (identity) => {
     if (queue.length === 0) {
       return {
         success: false,
@@ -3378,12 +5682,25 @@ function BatchQueueProvider({
         }
       };
     }
+    const signer = resolveIdentity(identity, providerIdentity);
+    if (!signer.username && !signer.accountAddress) {
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "MISSING_IDENTITY",
+          message: "Batch signing requires an accountAddress or username"
+        }
+      };
+    }
     const targetChain = queue[0].targetChain;
     const calls = queue.map((item) => item.call);
     setIsSigning(true);
     try {
       const result = await client.sendIntent({
-        username: username2,
+        username: signer.username,
+        accountAddress: signer.accountAddress,
         targetChain,
         calls
       });
@@ -3394,7 +5711,7 @@ function BatchQueueProvider({
     } finally {
       setIsSigning(false);
     }
-  }, [queue, client, clearBatch]);
+  }, [queue, client, clearBatch, providerIdentity]);
   const value = {
     queue,
     batchChainId,
@@ -3712,28 +6029,16 @@ function BatchQueueWidget({ onSignAll }) {
     ] })
   ] });
 }
-
-// src/verify.ts
-import { keccak256, toBytes } from "viem";
-var ETHEREUM_MESSAGE_PREFIX = "Ethereum Signed Message:\n";
-function hashMessage2(message) {
-  const messageBytes = toBytes(message);
-  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;
-  return keccak256(toBytes(prefixed));
-}
-function verifyMessageHash(message, signedHash) {
-  if (!signedHash) return false;
-  const expectedHash = hashMessage2(message);
-  return expectedHash.toLowerCase() === signedHash.toLowerCase();
-}
 export {
   BatchQueueProvider,
   BatchQueueWidget,
   ETHEREUM_MESSAGE_PREFIX,
   OneAuthClient,
+  createCrossChainPermission,
   createOneAuthProvider,
   createPasskeyAccount,
   createPasskeyWalletClient,
+  definePermissions,
   encodeWebAuthnSignature,
   getAllSupportedChainsAndTokens,
   getChainById,
@@ -3748,7 +6053,7 @@ export {
   getTokenDecimals,
   getTokenSymbol,
   hashCalls,
-  hashMessage2 as hashMessage,
+  hashMessage,
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress,