@rhinestone/1auth 0.6.8 → 0.6.10

package/dist/headless.d.mts

@@ -0,0 +1,109 @@
+import { P as PasskeyProviderConfig, S as SponsorshipConfig, H as HeadlessIntentOptions, a as HeadlessPrepareResult, b as HeadlessSubmitOptions, c as HeadlessSubmitResult, d as HeadlessIntentStatusResult, I as InstallSmartSessionOptions, e as InstallSmartSessionResult, f as SessionKeyHandle } from './types-U_dwxbtS.mjs';
+export { g as SmartSessionEnableRequest } from './types-U_dwxbtS.mjs';
+import * as _rhinestone_sdk from '@rhinestone/sdk';
+import { Hex, Address } from 'viem';
+
+/**
+ * Headless 1auth client.
+ *
+ * Used by integrators that hold their own ECDSA signer in localStorage
+ * and produce signatures for an ERC-7579 validator other than the
+ * passkey one (typically `@rhinestone/sdk` experimental SmartSession).
+ *
+ * Responsibilities:
+ *  - Fetch sponsorship JWTs from the app's own backend.
+ *  - Call `/api/intent/prepare?signingMode=headless` to get an
+ *    orchestrator-quoted `intentOp` + `digestResult`.
+ *  - Forward pre-encoded validator-prefixed signatures to the new
+ *    `/api/intent/headless-execute` route.
+ *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for
+ *    the one-time SmartSession install ceremony.
+ *
+ * 1auth itself stays ignorant of session keys — the on-chain
+ * SmartSession validator is the only authority over what a session key
+ * may sign for. The host app persists `{ sessionKeyAddress, permissionId,
+ * accountAddress, permissions }` in its own storage.
+ */
+
+declare class OneAuthHeadlessClient {
+    private providerUrl;
+    private clientId?;
+    private sponsorship;
+    constructor(config: PasskeyProviderConfig);
+    setSponsorship(sponsorship: SponsorshipConfig | undefined): void;
+    private fetchAccessToken;
+    private fetchExtensionToken;
+    /**
+     * Quote an intent without opening any dialog. Returns the orchestrator's
+     * `intentOp` plus the digest the caller must sign with their own
+     * validator (e.g. SmartSession). The caller is responsible for
+     * encoding signatures and submitting via {@link submitIntent}.
+     */
+    prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult>;
+    /**
+     * Forward a pre-signed intent to the orchestrator. The caller has
+     * already encoded validator-prefixed origin + destination signatures
+     * (one origin signature per intent element); 1auth treats them as
+     * opaque bytes.
+     *
+     * If `sponsor` is omitted or `true`, an extension token is fetched
+     * just-in-time and bound to the intent. Pass `sponsor: false` for
+     * self-paying intents.
+     */
+    submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult>;
+    /**
+     * Fetch the latest known status for a submitted headless intent.
+     * This is a non-blocking read and may return `pending` before a
+     * solver has produced a fill transaction hash.
+     */
+    getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Wait for a submitted headless intent to produce a status update and,
+     * when available, the final fill transaction hash. The wait endpoint
+     * needs the opaque `transactionResult` returned by submit because 1auth
+     * does not persist that SDK object in its database.
+     */
+    waitForIntent(intentId: string, transactionResult: unknown): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+     * with the supplied `permissions`.
+     *
+     * Returns `{ install, sessionKeyHandle }`:
+     *
+     *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+     *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+     *    so the user passkey-signs the install via the existing dialog.
+     *  - `sessionKeyHandle` contains the deterministic `permissionId`
+     *    plus metadata to persist in localStorage. Persist this BEFORE
+     *    submitting the install so a refresh during signing doesn't
+     *    lose the handle.
+     *
+     * If the validator is already installed on the user's account,
+     * `install.calls` is empty and `install.alreadyInstalled` is true.
+     * The caller should still persist `sessionKeyHandle` — the on-chain
+     * session enabling happens at first headless use via SmartSession's
+     * ENABLE-mode signature wrapping (see follow-up).
+     */
+    installSmartSession(options: InstallSmartSessionOptions): Promise<InstallSmartSessionResult>;
+}
+
+interface BuildSmartSessionHeadlessSignaturesOptions {
+    /** ECDSA private key for the locally-held SmartSession signer. */
+    privateKey: Hex;
+    /** Smart account address the SmartSession is scoped to. */
+    accountAddress: Address;
+    /** Persisted handle returned by `grantPermissions` / SmartSession install. */
+    sessionKeyHandle: SessionKeyHandle;
+    /** Prepared headless intent returned by `OneAuthHeadlessClient.prepareIntent`. */
+    prepared: HeadlessPrepareResult;
+}
+/**
+ * Builds SmartSession signatures for `OneAuthHeadlessClient.submitIntent`.
+ *
+ * This intentionally delegates signing and SmartSession signature packing to
+ * `@rhinestone/sdk`. 1auth only rebuilds the persisted session descriptor and
+ * supplies the SDK-native `SignData` returned by the orchestrator quote.
+ */
+declare function buildSmartSessionHeadlessSignatures(options: BuildSmartSessionHeadlessSignaturesOptions): Promise<_rhinestone_sdk.SignedIntentData>;
+
+export { type BuildSmartSessionHeadlessSignaturesOptions, HeadlessIntentOptions, HeadlessIntentStatusResult, HeadlessPrepareResult, HeadlessSubmitOptions, HeadlessSubmitResult, InstallSmartSessionOptions, InstallSmartSessionResult, OneAuthHeadlessClient, SessionKeyHandle, buildSmartSessionHeadlessSignatures };

package/dist/headless.d.ts

@@ -0,0 +1,109 @@
+import { P as PasskeyProviderConfig, S as SponsorshipConfig, H as HeadlessIntentOptions, a as HeadlessPrepareResult, b as HeadlessSubmitOptions, c as HeadlessSubmitResult, d as HeadlessIntentStatusResult, I as InstallSmartSessionOptions, e as InstallSmartSessionResult, f as SessionKeyHandle } from './types-U_dwxbtS.js';
+export { g as SmartSessionEnableRequest } from './types-U_dwxbtS.js';
+import * as _rhinestone_sdk from '@rhinestone/sdk';
+import { Hex, Address } from 'viem';
+
+/**
+ * Headless 1auth client.
+ *
+ * Used by integrators that hold their own ECDSA signer in localStorage
+ * and produce signatures for an ERC-7579 validator other than the
+ * passkey one (typically `@rhinestone/sdk` experimental SmartSession).
+ *
+ * Responsibilities:
+ *  - Fetch sponsorship JWTs from the app's own backend.
+ *  - Call `/api/intent/prepare?signingMode=headless` to get an
+ *    orchestrator-quoted `intentOp` + `digestResult`.
+ *  - Forward pre-encoded validator-prefixed signatures to the new
+ *    `/api/intent/headless-execute` route.
+ *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for
+ *    the one-time SmartSession install ceremony.
+ *
+ * 1auth itself stays ignorant of session keys — the on-chain
+ * SmartSession validator is the only authority over what a session key
+ * may sign for. The host app persists `{ sessionKeyAddress, permissionId,
+ * accountAddress, permissions }` in its own storage.
+ */
+
+declare class OneAuthHeadlessClient {
+    private providerUrl;
+    private clientId?;
+    private sponsorship;
+    constructor(config: PasskeyProviderConfig);
+    setSponsorship(sponsorship: SponsorshipConfig | undefined): void;
+    private fetchAccessToken;
+    private fetchExtensionToken;
+    /**
+     * Quote an intent without opening any dialog. Returns the orchestrator's
+     * `intentOp` plus the digest the caller must sign with their own
+     * validator (e.g. SmartSession). The caller is responsible for
+     * encoding signatures and submitting via {@link submitIntent}.
+     */
+    prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult>;
+    /**
+     * Forward a pre-signed intent to the orchestrator. The caller has
+     * already encoded validator-prefixed origin + destination signatures
+     * (one origin signature per intent element); 1auth treats them as
+     * opaque bytes.
+     *
+     * If `sponsor` is omitted or `true`, an extension token is fetched
+     * just-in-time and bound to the intent. Pass `sponsor: false` for
+     * self-paying intents.
+     */
+    submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult>;
+    /**
+     * Fetch the latest known status for a submitted headless intent.
+     * This is a non-blocking read and may return `pending` before a
+     * solver has produced a fill transaction hash.
+     */
+    getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Wait for a submitted headless intent to produce a status update and,
+     * when available, the final fill transaction hash. The wait endpoint
+     * needs the opaque `transactionResult` returned by submit because 1auth
+     * does not persist that SDK object in its database.
+     */
+    waitForIntent(intentId: string, transactionResult: unknown): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+     * with the supplied `permissions`.
+     *
+     * Returns `{ install, sessionKeyHandle }`:
+     *
+     *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+     *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+     *    so the user passkey-signs the install via the existing dialog.
+     *  - `sessionKeyHandle` contains the deterministic `permissionId`
+     *    plus metadata to persist in localStorage. Persist this BEFORE
+     *    submitting the install so a refresh during signing doesn't
+     *    lose the handle.
+     *
+     * If the validator is already installed on the user's account,
+     * `install.calls` is empty and `install.alreadyInstalled` is true.
+     * The caller should still persist `sessionKeyHandle` — the on-chain
+     * session enabling happens at first headless use via SmartSession's
+     * ENABLE-mode signature wrapping (see follow-up).
+     */
+    installSmartSession(options: InstallSmartSessionOptions): Promise<InstallSmartSessionResult>;
+}
+
+interface BuildSmartSessionHeadlessSignaturesOptions {
+    /** ECDSA private key for the locally-held SmartSession signer. */
+    privateKey: Hex;
+    /** Smart account address the SmartSession is scoped to. */
+    accountAddress: Address;
+    /** Persisted handle returned by `grantPermissions` / SmartSession install. */
+    sessionKeyHandle: SessionKeyHandle;
+    /** Prepared headless intent returned by `OneAuthHeadlessClient.prepareIntent`. */
+    prepared: HeadlessPrepareResult;
+}
+/**
+ * Builds SmartSession signatures for `OneAuthHeadlessClient.submitIntent`.
+ *
+ * This intentionally delegates signing and SmartSession signature packing to
+ * `@rhinestone/sdk`. 1auth only rebuilds the persisted session descriptor and
+ * supplies the SDK-native `SignData` returned by the orchestrator quote.
+ */
+declare function buildSmartSessionHeadlessSignatures(options: BuildSmartSessionHeadlessSignaturesOptions): Promise<_rhinestone_sdk.SignedIntentData>;
+
+export { type BuildSmartSessionHeadlessSignaturesOptions, HeadlessIntentOptions, HeadlessIntentStatusResult, HeadlessPrepareResult, HeadlessSubmitOptions, HeadlessSubmitResult, InstallSmartSessionOptions, InstallSmartSessionResult, OneAuthHeadlessClient, SessionKeyHandle, buildSmartSessionHeadlessSignatures };

package/dist/headless.js

@@ -0,0 +1,467 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/headless.ts
+var headless_exports = {};
+__export(headless_exports, {
+  OneAuthHeadlessClient: () => OneAuthHeadlessClient,
+  buildSmartSessionHeadlessSignatures: () => buildSmartSessionHeadlessSignatures
+});
+module.exports = __toCommonJS(headless_exports);
+
+// src/sponsorship-fetch.ts
+async function extractServerReason(response) {
+  try {
+    const text = await response.clone().text();
+    if (!text) return response.statusText;
+    try {
+      const data = JSON.parse(text);
+      const reason = data.error ?? data.message;
+      if (typeof reason === "string" && reason.trim()) return reason;
+    } catch {
+    }
+    return text.slice(0, 200);
+  } catch {
+    return response.statusText;
+  }
+}
+async function tokenFetchError(label, response) {
+  const reason = await extractServerReason(response);
+  const suffix = reason ? `: ${reason}` : "";
+  return new Error(
+    `Failed to fetch ${label} (${response.status} ${response.statusText})${suffix}`
+  );
+}
+
+// src/headless-client.ts
+var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var MISSING_APP_CREDENTIALS_MESSAGE = "No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT \u2014 pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.";
+function normalizeSponsorship(config) {
+  if (!config) return null;
+  if ("accessToken" in config && "getExtensionToken" in config) {
+    return config;
+  }
+  const { accessTokenUrl, extensionTokenUrl } = config;
+  return {
+    accessToken: async () => {
+      const response = await fetch(accessTokenUrl, { credentials: "include" });
+      if (!response.ok) {
+        throw await tokenFetchError("access token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Access token response missing `token` field");
+      }
+      return data.token;
+    },
+    getExtensionToken: async (intentOp) => {
+      const response = await fetch(extensionTokenUrl, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ intentOp })
+      });
+      if (!response.ok) {
+        throw await tokenFetchError("extension token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Extension token response missing `token` field");
+      }
+      return data.token;
+    }
+  };
+}
+var OneAuthHeadlessClient = class {
+  constructor(config) {
+    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;
+    this.clientId = config.clientId;
+    this.sponsorship = normalizeSponsorship(config.sponsorship);
+  }
+  setSponsorship(sponsorship) {
+    this.sponsorship = normalizeSponsorship(sponsorship);
+  }
+  // ---------------------------------------------------------------------------
+  // Sponsorship JWT fetchers
+  // ---------------------------------------------------------------------------
+  async fetchAccessToken() {
+    if (!this.sponsorship) {
+      return {
+        ok: false,
+        code: "MISSING_APP_CREDENTIALS",
+        message: MISSING_APP_CREDENTIALS_MESSAGE
+      };
+    }
+    try {
+      const accessToken = await this.sponsorship.accessToken();
+      return { ok: true, accessToken };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async fetchExtensionToken(intentOp, sponsor) {
+    if (!sponsor) return { ok: true, extensionToken: void 0 };
+    if (!this.sponsorship) {
+      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
+    }
+    try {
+      const token = await this.sponsorship.getExtensionToken(intentOp);
+      return { ok: true, extensionToken: token };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Intent prepare / submit
+  // ---------------------------------------------------------------------------
+  /**
+   * Quote an intent without opening any dialog. Returns the orchestrator's
+   * `intentOp` plus the digest the caller must sign with their own
+   * validator (e.g. SmartSession). The caller is responsible for
+   * encoding signatures and submitting via {@link submitIntent}.
+   */
+  async prepareIntent(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error("prepareIntent requires either `username` or `accountAddress`");
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const tokenRequests = options.tokenRequests?.map((tr) => ({
+      token: tr.token,
+      amount: tr.amount.toString()
+    }));
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      tokenRequests,
+      sourceAssets: options.sourceAssets,
+      sourceChainId: options.sourceChainId,
+      sessionKeyHandle: options.sessionKeyHandle,
+      clientId: this.clientId,
+      signingMode: "headless",
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Prepare failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Forward a pre-signed intent to the orchestrator. The caller has
+   * already encoded validator-prefixed origin + destination signatures
+   * (one origin signature per intent element); 1auth treats them as
+   * opaque bytes.
+   *
+   * If `sponsor` is omitted or `true`, an extension token is fetched
+   * just-in-time and bound to the intent. Pass `sponsor: false` for
+   * self-paying intents.
+   */
+  async submitIntent(options) {
+    const sponsor = options.sponsor ?? true;
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);
+    if (!extensionResult.ok) {
+      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);
+    }
+    const body = {
+      intentOp: options.intentOp,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      expiresAt: options.expiresAt,
+      originSignatures: options.originSignatures,
+      destinationSignature: options.destinationSignature,
+      targetExecutionSignature: options.targetExecutionSignature,
+      auth: {
+        accessToken: accessTokenResult.accessToken,
+        ...extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }
+      }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Headless execute failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // Status / wait — proxies to the existing routes (no headless variant needed).
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch the latest known status for a submitted headless intent.
+   * This is a non-blocking read and may return `pending` before a
+   * solver has produced a fill transaction hash.
+   */
+  async getIntentStatus(intentId) {
+    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);
+    if (!response.ok) {
+      throw new Error(`Status fetch failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Wait for a submitted headless intent to produce a status update and,
+   * when available, the final fill transaction hash. The wait endpoint
+   * needs the opaque `transactionResult` returned by submit because 1auth
+   * does not persist that SDK object in its database.
+   */
+  async waitForIntent(intentId, transactionResult) {
+    if (!transactionResult) {
+      throw new Error("waitForIntent requires submitResult.transactionResult");
+    }
+    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ transactionResult })
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(
+        errorData.details || errorData.error || `Wait fetch failed (${response.status})`
+      );
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // SmartSession install (one-time, passkey-signed)
+  // ---------------------------------------------------------------------------
+  /**
+   * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+   * with the supplied `permissions`.
+   *
+   * Returns `{ install, sessionKeyHandle }`:
+   *
+   *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+   *    so the user passkey-signs the install via the existing dialog.
+   *  - `sessionKeyHandle` contains the deterministic `permissionId`
+   *    plus metadata to persist in localStorage. Persist this BEFORE
+   *    submitting the install so a refresh during signing doesn't
+   *    lose the handle.
+   *
+   * If the validator is already installed on the user's account,
+   * `install.calls` is empty and `install.alreadyInstalled` is true.
+   * The caller should still persist `sessionKeyHandle` — the on-chain
+   * session enabling happens at first headless use via SmartSession's
+   * ENABLE-mode signature wrapping (see follow-up).
+   */
+  async installSmartSession(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error(
+        "installSmartSession requires either `username` or `accountAddress`"
+      );
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(
+        `Sponsorship access token fetch failed: ${accessTokenResult.message}`
+      );
+    }
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      sessionKeyAddress: options.sessionKeyAddress,
+      permissions: options.permissions,
+      validUntil: options.validUntil,
+      validAfter: options.validAfter,
+      maxUses: options.maxUses,
+      enableSessionSignature: options.enableSessionSignature,
+      label: options.label,
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Install failed (${response.status})`);
+    }
+    return await response.json();
+  }
+};
+
+// src/smart-session-signatures.ts
+var import_accounts = require("viem/accounts");
+var import_sdk = require("@rhinestone/sdk");
+var import_smart_sessions = require("@rhinestone/sdk/smart-sessions");
+
+// src/registry.ts
+var import_viem = require("viem");
+var viemChains = __toESM(require("viem/chains"));
+var import_shared_configs = require("@rhinestone/shared-configs");
+var env = typeof process !== "undefined" ? process.env : {};
+var VIEM_CHAIN_BY_ID = /* @__PURE__ */ new Map();
+for (const value of Object.values(viemChains)) {
+  if (typeof value !== "object" || value === null || !("id" in value) || !("name" in value)) continue;
+  const chain = value;
+  const existing = VIEM_CHAIN_BY_ID.get(chain.id);
+  if (!existing || existing.testnet && !chain.testnet) {
+    VIEM_CHAIN_BY_ID.set(chain.id, chain);
+  }
+}
+function isEvmRegistryEntry(entry) {
+  return entry?.vmType === "evm";
+}
+var REGISTRY_CHAIN_IDS = Object.entries(import_shared_configs.chainRegistry).filter(([, entry]) => isEvmRegistryEntry(entry)).map(([id]) => Number(id));
+var SUPPORTED_CHAIN_IDS = new Set(REGISTRY_CHAIN_IDS);
+function getChainById(chainId) {
+  if (!SUPPORTED_CHAIN_IDS.has(chainId)) {
+    throw new Error(`Unsupported chain ID: ${chainId}`);
+  }
+  const chain = VIEM_CHAIN_BY_ID.get(chainId);
+  if (!chain) {
+    throw new Error(`Unsupported chain ID: ${chainId}`);
+  }
+  return chain;
+}
+
+// src/smart-session-signatures.ts
+function reviveBigIntStrings(value) {
+  if (Array.isArray(value)) return value.map((entry) => reviveBigIntStrings(entry));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, reviveBigIntStrings(entry)])
+    );
+  }
+  if (typeof value === "string" && value.startsWith("__bigint:")) {
+    return BigInt(value.slice("__bigint:".length));
+  }
+  if (typeof value === "string" && /^\d+$/.test(value)) return BigInt(value);
+  return value;
+}
+function parsePreparedSignData(value) {
+  const prepared = JSON.parse(value, (_key, nested) => reviveBigIntStrings(nested));
+  const signData = prepared.quotes?.best?.signData;
+  if (!signData) {
+    throw new Error("Prepared headless intent is missing quotes.best.signData");
+  }
+  return signData;
+}
+function chainIdFromSignDataDomain(domainChainId) {
+  if (typeof domainChainId === "number" && Number.isSafeInteger(domainChainId)) {
+    return domainChainId;
+  }
+  if (typeof domainChainId === "bigint") return Number(domainChainId);
+  if (typeof domainChainId === "string" && /^\d+$/.test(domainChainId)) {
+    return Number(domainChainId);
+  }
+  return void 0;
+}
+function buildSessionForChain(args) {
+  return (0, import_smart_sessions.toSession)(
+    {
+      chain: getChainById(args.chainId),
+      owners: { type: "ecdsa", accounts: [(0, import_accounts.privateKeyToAccount)(args.privateKey)] },
+      permissions: reviveBigIntStrings(args.handle.permissions ?? []),
+      crossChainPermits: reviveBigIntStrings(args.handle.crossChainPermits ?? [])
+    },
+    // The production SmartSession module is deployed on testnets too. Never opt
+    // into SDK dev contracts for 1auth headless permissions.
+    { useDevContracts: false }
+  );
+}
+function buildSessionSigners(args) {
+  const chainIds = /* @__PURE__ */ new Set([args.prepared.targetChain]);
+  for (const typedData of args.signData.origin) {
+    const chainId = chainIdFromSignDataDomain(typedData.domain?.chainId);
+    if (chainId) chainIds.add(chainId);
+  }
+  const targetExecutionChainId = chainIdFromSignDataDomain(
+    args.signData.targetExecution?.domain?.chainId
+  );
+  if (targetExecutionChainId) chainIds.add(targetExecutionChainId);
+  return {
+    type: "experimental_session",
+    sessions: Object.fromEntries(
+      [...chainIds].map((chainId) => [
+        chainId,
+        {
+          session: buildSessionForChain({
+            privateKey: args.privateKey,
+            handle: args.handle,
+            chainId
+          })
+        }
+      ])
+    )
+  };
+}
+async function buildSmartSessionHeadlessSignatures(options) {
+  const signData = parsePreparedSignData(options.prepared.intentOp);
+  const account = await (0, import_sdk.createRhinestoneAccount)({
+    initData: { address: options.accountAddress },
+    owners: {
+      type: "ecdsa",
+      accounts: [(0, import_accounts.privateKeyToAccount)(options.privateKey)]
+    },
+    experimental_sessions: { enabled: true }
+  });
+  return account.signIntent(
+    signData,
+    getChainById(options.prepared.targetChain),
+    buildSessionSigners({
+      privateKey: options.privateKey,
+      handle: options.sessionKeyHandle,
+      prepared: options.prepared,
+      signData
+    })
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OneAuthHeadlessClient,
+  buildSmartSessionHeadlessSignatures
+});
+//# sourceMappingURL=headless.js.map