@rhinestone/1auth 0.6.8 → 0.6.9

package/dist/index.mjs

@@ -1,7 +1,13 @@
 import {
-  buildTransactionReview,
+  tokenFetchError
+} from "./chunk-IIACVHR3.mjs";
+import {
+  ETHEREUM_MESSAGE_PREFIX,
+  hashMessage,
+  verifyMessageHash
+} from "./chunk-IHBVEU33.mjs";
+import {
   createOneAuthProvider,
-  encodeWebAuthnSignature,
   getAllSupportedChainsAndTokens,
   getChainById,
   getChainExplorerUrl,
@@ -14,19 +20,258 @@ import {
   getTokenAddress,
   getTokenDecimals,
   getTokenSymbol,
-  hashCalls,
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress
-} from "./chunk-SXISYG2P.mjs";
+} from "./chunk-VZYHCFEH.mjs";
+import {
+  buildTransactionReview,
+  encodeWebAuthnSignature,
+  hashCalls
+} from "./chunk-N6KE5CII.mjs";
+
+// src/client.ts
+import { hashTypedData } from "viem";
+
+// src/assets.ts
+function withNetworkBucket(balance) {
+  return {
+    ...balance,
+    isTestnet: balance.isTestnet ?? isTestnet(balance.chainId)
+  };
+}
+function bucketAssetBalances(balances) {
+  const mainnetBalances = [];
+  const testnetBalances = [];
+  for (const balance of balances) {
+    const normalized = withNetworkBucket(balance);
+    if (normalized.isTestnet) {
+      testnetBalances.push(normalized);
+    } else {
+      mainnetBalances.push(normalized);
+    }
+  }
+  return {
+    mainnets: { balances: mainnetBalances },
+    testnets: { balances: testnetBalances }
+  };
+}
+function normalizeAssetsResponse(payload) {
+  const data = payload && typeof payload === "object" ? payload : {};
+  if (Array.isArray(data.balances)) {
+    const balances2 = data.balances.map(withNetworkBucket);
+    const buckets = bucketAssetBalances(balances2);
+    return { ...data, balances: balances2, ...buckets };
+  }
+  const balances = [];
+  const assets = Array.isArray(data.assets) ? data.assets : [];
+  for (const asset of assets) {
+    const symbol = asset.symbol ?? "UNKNOWN";
+    const decimals = asset.decimals ?? 18;
+    const chains = Array.isArray(asset.chains) ? asset.chains : [];
+    if (chains.length === 0) {
+      const token = asset.token ?? asset.address;
+      if (token) {
+        balances.push(withNetworkBucket({
+          chainId: 0,
+          token,
+          symbol,
+          decimals,
+          balance: asset.balance ?? asset.amount ?? "0",
+          ...asset.usdValue !== void 0 && { usdValue: asset.usdValue }
+        }));
+      }
+      continue;
+    }
+    for (const chain of chains) {
+      const chainId = chain.chainId ?? chain.chain;
+      const token = chain.token ?? chain.address;
+      if (typeof chainId !== "number" || !token) continue;
+      balances.push(withNetworkBucket({
+        chainId,
+        token,
+        symbol,
+        decimals: chain.decimals ?? decimals,
+        balance: chain.balance ?? chain.amount ?? "0",
+        ...asset.usdValue !== void 0 && { usdValue: asset.usdValue },
+        ...chain.isTestnet !== void 0 && { isTestnet: chain.isTestnet }
+      }));
+    }
+  }
+  return { ...data, balances, ...bucketAssetBalances(balances) };
+}
+async function fetchAssetsResponse(options) {
+  const portfolioUrl = new URL(
+    `/api/users/${encodeURIComponent(options.identifier)}/portfolio`,
+    options.providerUrl
+  );
+  portfolioUrl.searchParams.set("all", "true");
+  const response = await fetch(portfolioUrl.toString(), {
+    headers: {
+      ...options.headers,
+      ...options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {},
+      ...options.clientId ? { "x-client-id": options.clientId } : {}
+    }
+  });
+  if (!response.ok) {
+    const data = await response.json().catch(() => ({}));
+    throw new Error(data.error || "Failed to get assets");
+  }
+  return normalizeAssetsResponse(await response.json());
+}
+
+// ../loading-tokens/src/index.ts
+var SPINNER_SIZE = 82;
+var SPINNER_STROKE = 2.4118;
+var SPINNER_RADIUS = (SPINNER_SIZE - SPINNER_STROKE) / 2;
+var SPINNER_CIRCUMFERENCE = 2 * Math.PI * SPINNER_RADIUS;
+var SPINNER_ARC_FRACTION = 0.17;
+var SPINNER_ARC = SPINNER_CIRCUMFERENCE * SPINNER_ARC_FRACTION;
+var LOADING_MODAL_WIDTH = 380;
+var LOADING_MODAL_PADDING = 12;
+var LOADING_MODAL_RADIUS = 16;
+var LOADING_MOBILE_BREAKPOINT = 640;
+var LOADING_CARD_GAP = 16;
+var LOADING_BODY_GAP = 12;
+var LOADING_ICON_PADDING = 12;
+var LOADING_TITLE_BLOCK_GAP = 4;
+var LOADING_FOOTER_GAP = 4;
+var LOADING_TITLE_FONT_SIZE = 20;
+var LOADING_TITLE_FONT_WEIGHT = 700;
+var LOADING_SUBTITLE_FONT_SIZE = 12;
+var LOADING_SUBTITLE_FONT_WEIGHT = 500;
+var LOADING_FOOTER_FONT_SIZE = 11;
+var LOADING_FOOTER_FONT_WEIGHT = 500;
+var LOADING_LINE_HEIGHT = "normal";
+var LOADING_FONT_FAMILY = "'Inter', ui-sans-serif, system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji'";
+var LOGO_WIDTH = 72;
+var LOGO_HEIGHT = 16;
+var BRAND_PURPLE = "#685bff";
+var LIGHT_TOKENS = {
+  bgPrimary: "#ffffff",
+  borderColor: "#f4f4f5",
+  textPrimary: "#27272a",
+  textSecondary: "#71717b"
+};
+var DARK_TOKENS = {
+  bgPrimary: "#0a0a0a",
+  borderColor: "#18181b",
+  textPrimary: "#e4e4e7",
+  textSecondary: "#9f9fa9"
+};
+var FOOTER_TEXT_COLOR = "#71717b";
+var LOADING_TITLE = "Loading...";
+var LOADING_SUBTITLE = "This will only take a few moments, do not close the window.";
 
 // src/client.ts
-import { parseUnits, hashTypedData } from "viem";
-var POPUP_WIDTH = 450;
+var POPUP_WIDTH = LOADING_MODAL_WIDTH;
 var POPUP_HEIGHT = 600;
-var DEFAULT_EMBED_WIDTH = "400px";
+var DEFAULT_EMBED_WIDTH = `${LOADING_MODAL_WIDTH}px`;
 var DEFAULT_EMBED_HEIGHT = "500px";
 var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var MAX_LABEL_LEN = 20;
+function generateModalNonce() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function generateTelemetryOperationId() {
+  return `1auth-${generateModalNonce()}`;
+}
+function cleanTelemetryAttributes(attributes) {
+  if (!attributes) return void 0;
+  const clean = {};
+  for (const [key, value] of Object.entries(attributes)) {
+    if (value !== void 0) clean[key] = value;
+  }
+  return Object.keys(clean).length > 0 ? clean : void 0;
+}
+function describeTelemetryError(error) {
+  if (!error) return {};
+  if (error instanceof Error) {
+    return { errorCode: error.name, errorMessage: error.message };
+  }
+  if (typeof error === "object") {
+    const err = error;
+    return {
+      errorCode: typeof err.code === "string" ? err.code : void 0,
+      errorMessage: typeof err.message === "string" ? err.message : String(error)
+    };
+  }
+  return { errorMessage: String(error) };
+}
+function capCallLabels(calls) {
+  if (!calls) return calls;
+  return calls.map((c) => {
+    const cappedLabel = c.label && c.label.length > MAX_LABEL_LEN ? c.label.slice(0, MAX_LABEL_LEN - 1) + "\u2026" : c.label;
+    const cappedSublabel = c.sublabel && c.sublabel.length > MAX_LABEL_LEN ? c.sublabel.slice(0, MAX_LABEL_LEN - 1) + "\u2026" : c.sublabel;
+    if (cappedLabel === c.label && cappedSublabel === c.sublabel) return c;
+    return { ...c, label: cappedLabel, sublabel: cappedSublabel };
+  });
+}
+function getStoredSignerType() {
+  if (typeof window === "undefined") return "passkey";
+  try {
+    const raw = window.localStorage.getItem("1auth-user");
+    if (!raw) return "passkey";
+    const parsed = JSON.parse(raw);
+    return parsed?.signerType === "eoa" ? "eoa" : "passkey";
+  } catch {
+    return "passkey";
+  }
+}
+var DEFAULT_BLIND_SIGNING = true;
+var MISSING_APP_CREDENTIALS_MESSAGE = "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.";
+function normalizeSponsorship(config) {
+  if (!config) return null;
+  if ("accessToken" in config && "getExtensionToken" in config) {
+    return config;
+  }
+  const { accessTokenUrl, extensionTokenUrl } = config;
+  return {
+    accessToken: async () => {
+      const response = await fetch(accessTokenUrl, { credentials: "include" });
+      if (!response.ok) {
+        throw await tokenFetchError("access token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Access token response missing `token` field");
+      }
+      return data.token;
+    },
+    getExtensionToken: async (intentOp) => {
+      const response = await fetch(extensionTokenUrl, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ intentOp })
+      });
+      if (!response.ok) {
+        throw await tokenFetchError("extension token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Extension token response missing `token` field");
+      }
+      return data.token;
+    }
+  };
+}
+function grantPermissionReplacer(_key, value) {
+  return typeof value === "bigint" ? value.toString() : value;
+}
+function cloneGrantPayload(value) {
+  return JSON.parse(JSON.stringify(value, grantPermissionReplacer));
+}
+function normalizeGrantTargetChains(options) {
+  const chainCandidates = options.targetChains ?? (options.targetChain !== void 0 ? [options.targetChain] : []);
+  return Array.from(new Set(chainCandidates));
+}
+function normalizeGrantSourceChains(options) {
+  return Array.from(new Set(options.sourceChains ?? []));
+}
 var OneAuthClient = class {
   /**
    * Create a new OneAuthClient.
@@ -40,16 +285,229 @@ var OneAuthClient = class {
    *   clientId, theme, and redirect settings.
    */
   constructor(config) {
+    // Persistent state for EOA forwarding via `/dialog/sign-eoa`. The iframe
+    // is created lazily on the first `requestWithWallet` call and reused for
+    // every subsequent call so its WalletConnect SignClient survives between
+    // transactions — otherwise each call would spin up a fresh SignClient
+    // that restores stale relay state from localStorage, producing
+    // "Restore will override" warnings and "emitting session_request:N
+    // without any listeners" errors on the second and later txs.
+    this.eoaDialogState = null;
+    // Serialises concurrent `requestWithWallet` calls — they would otherwise
+    // both try to drive the same iframe and cross-resolve each other.
+    this.eoaSerialQueue = Promise.resolve();
     const providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;
     const dialogUrl = config.dialogUrl || providerUrl;
     this.config = { ...config, providerUrl, dialogUrl };
     this.theme = this.config.theme || {};
+    this.sponsorship = normalizeSponsorship(config.sponsorship);
     if (typeof document !== "undefined") {
       this.injectPreconnect(providerUrl);
       if (dialogUrl !== providerUrl) {
         this.injectPreconnect(dialogUrl);
       }
     }
+    const initOperation = this.createTelemetryOperation("client", {
+      hasClientId: !!this.config.clientId,
+      hasDialogUrlOverride: dialogUrl !== providerUrl
+    });
+    this.emitTelemetry("client.init", initOperation, { outcome: "started" });
+  }
+  /**
+   * Update the sponsorship configuration at runtime. Pass `undefined` to
+   * disable sponsorship.
+   */
+  setSponsorship(sponsorship) {
+    this.sponsorship = normalizeSponsorship(sponsorship);
+  }
+  /**
+   * Whether the caller opted into SDK telemetry propagation or callbacks.
+   */
+  shouldUseTelemetry() {
+    return !!this.config.telemetry && this.config.telemetry.enabled !== false;
+  }
+  /**
+   * Resolve the host app's current trace context. Callback failures are
+   * ignored because observability can never be allowed to break signing.
+   */
+  getTelemetryTraceContext() {
+    const traceContext = this.config.telemetry?.traceContext;
+    if (!traceContext || !this.shouldUseTelemetry()) return void 0;
+    try {
+      return typeof traceContext === "function" ? traceContext() : traceContext;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Resolve host-provided SDK event attributes and remove undefined fields.
+   */
+  getTelemetryAttributes() {
+    const attributes = this.config.telemetry?.attributes;
+    if (!attributes || !this.shouldUseTelemetry()) return void 0;
+    try {
+      const resolved = typeof attributes === "function" ? attributes() : attributes;
+      return cleanTelemetryAttributes(resolved);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Create per-operation telemetry context shared by callbacks, HTTP headers,
+   * dialog URL params, and PASSKEY_INIT messages.
+   */
+  createTelemetryOperation(flow, attributes) {
+    return {
+      operationId: generateTelemetryOperationId(),
+      flow,
+      startedAt: Date.now(),
+      trace: this.getTelemetryTraceContext(),
+      attributes: cleanTelemetryAttributes({
+        ...this.getTelemetryAttributes(),
+        ...attributes
+      })
+    };
+  }
+  /**
+   * Emit a telemetry event to the host app. The callback is intentionally
+   * fire-and-forget and exception-safe so app telemetry cannot affect users.
+   */
+  emitTelemetry(name, operation, patch = {}) {
+    const onEvent = this.config.telemetry?.onEvent;
+    if (!onEvent || !this.shouldUseTelemetry()) return;
+    const attributes = cleanTelemetryAttributes({
+      ...operation.attributes,
+      ...patch.attributes
+    });
+    const event = {
+      name,
+      operationId: operation.operationId,
+      flow: operation.flow,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: patch.durationMs ?? Date.now() - operation.startedAt,
+      clientId: this.config.clientId,
+      providerUrl: this.config.providerUrl,
+      dialogUrl: this.getDialogUrl(),
+      trace: operation.trace,
+      ...patch,
+      attributes
+    };
+    try {
+      onEvent(event);
+    } catch {
+    }
+  }
+  /**
+   * Attach SDK correlation and optional W3C trace context to dialog URLs.
+   */
+  appendTelemetryParams(params, operation) {
+    if (!this.shouldUseTelemetry()) return;
+    params.set("sdkOperationId", operation.operationId);
+    params.set("sdkTelemetryFlow", operation.flow);
+    if (operation.trace?.traceparent) {
+      params.set("traceparent", operation.trace.traceparent);
+    }
+    if (operation.trace?.tracestate) {
+      params.set("tracestate", operation.trace.tracestate);
+    }
+    if (operation.trace?.traceId) {
+      params.set("sdkTraceId", operation.trace.traceId);
+    }
+    if (operation.trace?.spanId) {
+      params.set("sdkSpanId", operation.trace.spanId);
+    }
+  }
+  /**
+   * Add SDK correlation headers to passkey API calls. These headers are also
+   * valid W3C trace propagation inputs when the host app supplies traceparent.
+   */
+  telemetryHeaders(operation) {
+    if (!operation || !this.shouldUseTelemetry()) return {};
+    return {
+      "x-1auth-sdk-operation-id": operation.operationId,
+      "x-1auth-sdk-flow": operation.flow,
+      ...operation.trace?.traceparent ? { traceparent: operation.trace.traceparent } : {},
+      ...operation.trace?.tracestate ? { tracestate: operation.trace.tracestate } : {}
+    };
+  }
+  /**
+   * Embed telemetry context in PASSKEY_INIT payloads for dialog-side API calls.
+   */
+  telemetryPayload(operation) {
+    if (!this.shouldUseTelemetry()) return void 0;
+    return {
+      operationId: operation.operationId,
+      flow: operation.flow,
+      ...operation.trace?.traceparent ? { traceparent: operation.trace.traceparent } : {},
+      ...operation.trace?.tracestate ? { tracestate: operation.trace.tracestate } : {},
+      ...operation.trace?.traceId ? { traceId: operation.trace.traceId } : {},
+      ...operation.trace?.spanId ? { spanId: operation.trace.spanId } : {}
+    };
+  }
+  /**
+   * Determine whether this signing call should request invisible dialog mode.
+   * Resolution order: per-call option wins over the constructor config, which
+   * wins over the platform-wide {@link DEFAULT_BLIND_SIGNING}. This lets an app
+   * flip the global default for itself while still overriding individual
+   * high-risk calls — e.g. default-blind but force the review UI for a large
+   * transfer, or default-visible but blind-sign selected low-risk signatures.
+   */
+  shouldRequestBlindSigning(options) {
+    return options?.blind_signing ?? this.config.blind_signing ?? DEFAULT_BLIND_SIGNING;
+  }
+  /**
+   * Fetch the app's access token (JWT). Called up front, before
+   * `/api/intent/prepare`, so the passkey server can authenticate the
+   * orchestrator quote call with the app's JWT instead of a service-level
+   * API key.
+   *
+   * Does not depend on `intentOp` — can run in parallel with anything that
+   * also doesn't depend on the quote.
+   */
+  async fetchAccessToken() {
+    if (!this.sponsorship) {
+      return {
+        ok: false,
+        code: "MISSING_APP_CREDENTIALS",
+        message: MISSING_APP_CREDENTIALS_MESSAGE
+      };
+    }
+    try {
+      const accessToken = await this.sponsorship.accessToken();
+      return { ok: true, accessToken };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  /**
+   * Fetch one extension token per intent, aligned with `sponsorFlags`.
+   * Returns an empty array when no intent is sponsored. Fired after
+   * `/prepare` so each token can be bound to its quote's `intentOp`, and
+   * overlaps the dialog / WebAuthn ceremony for no added serial latency.
+   */
+  async fetchExtensionTokens(intentOps, sponsorFlags) {
+    if (!this.sponsorship) {
+      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
+    }
+    const anySponsored = sponsorFlags.some(Boolean);
+    if (!anySponsored) return { ok: true, extensionTokens: [] };
+    try {
+      const sponsorship = this.sponsorship;
+      const tokens = await Promise.all(
+        intentOps.map(
+          (op, i) => sponsorFlags[i] ? sponsorship.getExtensionToken(op) : Promise.resolve("")
+        )
+      );
+      return { ok: true, extensionTokens: tokens };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
   }
   /**
    * Update the theme configuration at runtime
@@ -75,8 +533,11 @@ var OneAuthClient = class {
     if (theme.mode) {
       params.set("theme", theme.mode);
     }
-    if (theme.accent) {
-      params.set("accent", theme.accent);
+    const instancePrimary = this.theme.primaryColor ?? this.theme.accent;
+    const overridePrimary = overrideTheme?.primaryColor ?? overrideTheme?.accent;
+    const primary = overridePrimary ?? instancePrimary;
+    if (primary) {
+      params.set("accent", primary);
     }
     return params.toString();
   }
@@ -126,6 +587,60 @@ var OneAuthClient = class {
   getClientId() {
     return this.config.clientId;
   }
+  /**
+   * Whether this client operates on testnet chains only.
+   */
+  getTestnets() {
+    return this.config.testnets ?? false;
+  }
+  /**
+   * Get a unified token portfolio for a 1auth account across mainnets and
+   * testnets.
+   *
+   * @example
+   * ```typescript
+   * const assets = await client.getAssets({
+   *   accountAddress: "0x1111111111111111111111111111111111111111",
+   * });
+   * console.log(assets.mainnets.balances, assets.testnets.balances);
+   * ```
+   */
+  async getAssets(options) {
+    if (!options.accountAddress) {
+      throw new Error("getAssets requires accountAddress");
+    }
+    const telemetry = this.createTelemetryOperation("assets", {
+      hasAccountAddress: !!options.accountAddress
+    });
+    try {
+      const accessTokenResult = await this.fetchAccessToken();
+      if (!accessTokenResult.ok) {
+        throw new Error(accessTokenResult.message);
+      }
+      const result = await fetchAssetsResponse({
+        providerUrl: this.config.providerUrl,
+        identifier: options.accountAddress,
+        clientId: this.config.clientId,
+        accessToken: accessTokenResult.accessToken,
+        headers: this.telemetryHeaders(telemetry)
+      });
+      this.emitTelemetry("assets.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          balanceCount: result.balances.length,
+          mainnetBalanceCount: result.mainnets.balances.length,
+          testnetBalanceCount: result.testnets.balances.length
+        }
+      });
+      return result;
+    } catch (error) {
+      this.emitTelemetry("assets.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(error)
+      });
+      throw error;
+    }
+  }
   /**
    * Poll the intent status endpoint until a transaction hash appears or the
    * intent reaches a terminal failure state.
@@ -144,7 +659,7 @@ var OneAuthClient = class {
    * @returns The transaction hash string, or `undefined` if the deadline was
    *   reached or the intent failed/expired before a hash was produced.
    */
-  async waitForTransactionHash(intentId, options = {}) {
+  async waitForTransactionHash(intentId, options = {}, telemetry) {
     const timeoutMs = options.timeoutMs ?? 12e4;
     const intervalMs = options.intervalMs ?? 2e3;
     const deadline = Date.now() + timeoutMs;
@@ -153,7 +668,10 @@ var OneAuthClient = class {
         const response = await fetch(
           `${this.config.providerUrl}/api/intent/status/${intentId}`,
           {
-            headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+            headers: {
+              ...this.telemetryHeaders(telemetry),
+              ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+            }
           }
         );
         if (response.ok) {
@@ -181,6 +699,8 @@ var OneAuthClient = class {
    * @param options.username - Pre-fill the username field
    * @param options.theme - Override the theme for this modal invocation
    * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+   * @param options.flow - Force the login or account-creation route instead
+   *   of the default auto-detect entry route
    * @returns {@link AuthResult} with user details and typed address
    *
    * @example
@@ -196,9 +716,54 @@ var OneAuthClient = class {
    * ```
    */
   async authWithModal(options) {
+    return this.openAuthModal(options);
+  }
+  /**
+   * Open the sign-in modal directly.
+   *
+   * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+   * returning-user flow. Use it when the embedding app already knows the user
+   * is creating a login session, for example after an app-level "Log in"
+   * button. The result intentionally matches {@link authWithModal}.
+   *
+   * @param options.username - Optional account hint for the sign-in ceremony
+   * @param options.theme - Override the theme for this modal invocation
+   * @returns {@link AuthResult} with user details and typed address
+   */
+  async loginWithModal(options) {
+    return this.openAuthModal({ ...options, flow: "login" });
+  }
+  /**
+   * Open the account-creation modal directly.
+   *
+   * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+   * sign-up flow. Account creation still happens server-side in the passkey
+   * service; the SDK only opens the dialog and receives the postMessage result.
+   *
+   * @param options.theme - Override the theme for this modal invocation
+   * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+   * @returns {@link AuthResult} with the newly authenticated account details
+   */
+  async createAccountWithModal(options) {
+    return this.openAuthModal({ ...options, flow: "create-account" });
+  }
+  /**
+   * Open one of the passkey authentication modal routes and wait for the
+   * login-result message.
+   *
+   * Keeping URL construction in one helper prevents the explicit login/signup
+   * methods from drifting away from the legacy `authWithModal` behavior.
+   */
+  async openAuthModal(options) {
+    const telemetry = this.createTelemetryOperation("auth", {
+      flow: options?.flow ?? "auto",
+      hasUsernameHint: !!options?.username
+    });
     const dialogUrl = this.getDialogUrl();
+    const requestId = this.createDialogRequestId();
     const params = new URLSearchParams({
-      mode: "iframe"
+      mode: "iframe",
+      requestId
     });
     if (this.config.clientId) {
       params.set("clientId", this.config.clientId);
@@ -209,14 +774,60 @@ var OneAuthClient = class {
     if (options?.oauthEnabled === false) {
       params.set("oauth", "0");
     }
+    if (options?.flow === "create-account") {
+      params.set("switch", "1");
+    }
+    if (typeof window !== "undefined" && window.location?.origin) {
+      params.set("parentOrigin", window.location.origin);
+    }
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
       themeParsed.forEach((value, key) => params.set(key, value));
     }
-    const url = `${dialogUrl}/dialog/auth?${params.toString()}`;
+    const authPath = this.getAuthDialogPath(options?.flow);
+    const url = `${dialogUrl}${authPath}?${params.toString()}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    return this.waitForModalAuthResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.opened", telemetry, { outcome: "started" });
+    const result = await this.waitForModalAuthResponse(dialog, iframe, cleanup, requestId);
+    if (result.success) {
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signerType: result.signerType ?? "passkey" }
+      });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "auth.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * Generate a per-dialog nonce used to correlate iframe close messages with
+   * the SDK modal that opened them. Chromium can report a different
+   * `MessageEvent.source` WindowProxy after the `/dialog/auth` redirect, so
+   * auth close handling needs a stable in-band identifier without accepting
+   * stale close messages from earlier dialogs.
+   */
+  createDialogRequestId() {
+    if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+      return crypto.randomUUID();
+    }
+    return `dialog-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  }
+  /**
+   * Resolve the passkey app route for a requested auth flow.
+   */
+  getAuthDialogPath(flow = "auto") {
+    if (flow === "login") return "/dialog/auth/signin";
+    if (flow === "create-account") return "/dialog/auth/signup";
+    return "/dialog/auth";
   }
   /**
    * Open the connect dialog (lightweight connection without passkey auth).
@@ -241,6 +852,7 @@ var OneAuthClient = class {
    * ```
    */
   async connectWithModal(options) {
+    const telemetry = this.createTelemetryOperation("connect");
     const dialogUrl = this.getDialogUrl();
     const params = new URLSearchParams({
       mode: "iframe"
@@ -248,6 +860,10 @@ var OneAuthClient = class {
     if (this.config.clientId) {
       params.set("clientId", this.config.clientId);
     }
+    if (typeof window !== "undefined" && window.location?.origin) {
+      params.set("parentOrigin", window.location.origin);
+    }
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
@@ -255,17 +871,104 @@ var OneAuthClient = class {
     }
     const url = `${dialogUrl}/dialog/connect?${params.toString()}`;
     const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    this.emitTelemetry("dialog.opened", telemetry, { outcome: "started" });
     const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
-      mode: "iframe"
+      mode: "iframe",
+      telemetry: this.telemetryPayload(telemetry)
     });
     if (!ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "Connection was cancelled before the dialog became ready"
+      });
       return {
         success: false,
         action: "cancel",
         error: { code: "USER_CANCELLED", message: "Connection was cancelled" }
       };
     }
-    return this.waitForConnectResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
+    const result = await this.waitForConnectResponse(dialog, iframe, cleanup);
+    if (result.success) {
+      this.emitTelemetry("connect.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          autoConnected: result.autoConnected === true,
+          signerType: result.signerType ?? "passkey"
+        }
+      });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "connect.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error),
+          attributes: { action: result.action }
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * High-level connect entry point — the method most integrators want.
+   *
+   * Tries the lightweight {@link connectWithModal} first (no passkey ceremony
+   * for returning users on the same browser), and transparently falls back to
+   * {@link authWithModal} when the connect dialog reports it has no stored
+   * credentials for this origin (`action: "switch"`). First-time visitors get
+   * one passkey ceremony to register; subsequent connects on the same browser
+   * resolve with no biometric prompt — and silently when the user has enabled
+   * "Connect automatically".
+   *
+   * The return shape is the same {@link ConnectResult} discriminated union as
+   * {@link connectWithModal}, so callers can treat both paths uniformly. When
+   * the auth-modal fallback runs, its successful result is normalized into a
+   * `ConnectResult` (no `id` field — the embedder origin must not see it).
+   *
+   * Cancellation: if the user cancels either dialog, the result is
+   * `{ success: false, action: "cancel", error: { code: "USER_CANCELLED", … } }`.
+   *
+   * @param options - Forwarded to whichever underlying modal is shown.
+   *   `username` and `oauthEnabled` only apply to the auth-modal fallback path.
+   * @returns A {@link ConnectResult} discriminated union.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.connect();
+   * if (result.success) {
+   *   console.log("Connected as", result.user?.username ?? result.user?.address);
+   * }
+   * ```
+   */
+  async connect(options) {
+    const connectResult = await this.connectWithModal(
+      options?.theme ? { theme: options.theme } : void 0
+    );
+    if (connectResult.success) return connectResult;
+    if (connectResult.action === "switch") {
+      const authResult = await this.authWithModal(options);
+      if (authResult.success && authResult.user) {
+        return {
+          success: true,
+          user: {
+            username: authResult.user.username,
+            address: authResult.user.address
+          },
+          autoConnected: false
+        };
+      }
+      return {
+        success: false,
+        action: "cancel",
+        error: authResult.error ?? {
+          code: "USER_CANCELLED",
+          message: "Connection was cancelled"
+        }
+      };
+    }
+    return connectResult;
   }
   /**
    * Open the account management dialog.
@@ -315,131 +1018,273 @@ var OneAuthClient = class {
     });
   }
   /**
-   * Check if a user has already granted consent for the requested fields.
-   * This is a read-only check — no dialog is shown.
+   * Open the account-recovery backup flow directly.
    *
-   * @example
-   * ```typescript
-   * const result = await client.checkConsent({
-   *   username: "alice",
-   *   fields: ["email"],
-   * });
-   * if (result.hasConsent) {
-   *   console.log(result.data?.email);
-   * }
-   * ```
+   * Deep-links into the "Backup your account" flow inside the account dialog
+   * (rather than the account overview): the user verifies with their passkey,
+   * then saves a recovery passphrase and downloads an encrypted backup file.
+   * Use this to prompt users to secure their account after sign-up.
+   *
+   * Requires an authenticated user (call `authWithModal()` / `connect()`
+   * first) — the dialog reads the signed-in user from the passkey origin.
+   *
+   * Resolves `{ completed: true }` when the user finishes the backup, or
+   * `{ completed: false }` if they dismiss it — so callers can mark an
+   * onboarding step done or re-prompt later.
    */
-  async checkConsent(options) {
-    const clientId = options.clientId ?? this.config.clientId;
-    if (!clientId) {
-      return {
-        hasConsent: false
-      };
-    }
-    const username = options.username ?? options.accountAddress;
-    if (!username) {
-      return {
-        hasConsent: false
-      };
-    }
-    try {
-      const res = await fetch(`${this.config.providerUrl || "https://passkey.1auth.box"}/api/consent`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          ...clientId ? { "x-client-id": clientId } : {}
-        },
-        body: JSON.stringify({
-          username,
-          requestedFields: options.fields,
-          clientId
-        })
-      });
-      if (!res.ok) {
-        return { hasConsent: false };
-      }
-      const data = await res.json();
-      return {
-        hasConsent: data.hasConsent ?? false,
-        data: data.data,
-        grantedAt: data.grantedAt
-      };
-    } catch {
-      return { hasConsent: false };
+  async setupRecovery(options) {
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({
+      mode: "iframe",
+      // Deep-link the account dialog straight into the backup nudge instead
+      // of the account overview.
+      action: "backup"
+    });
+    const themeParams = this.getThemeParams(options?.theme);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
     }
+    const url = `${dialogUrl}/dialog/account?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(url);
+    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
+      mode: "iframe"
+    });
+    if (!ready) return { completed: false };
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let completed = false;
+      const finish = () => {
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+        cleanup();
+        resolve({ completed });
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        const type = event.data?.type;
+        if (type === "PASSKEY_RECOVERY_RESULT") {
+          completed = Boolean(event.data?.data?.completed ?? event.data?.success);
+          return;
+        }
+        if (type === "PASSKEY_CLOSE" || type === "PASSKEY_DISCONNECT") {
+          finish();
+        }
+      };
+      const handleClose = () => {
+        window.removeEventListener("message", handleMessage);
+        resolve({ completed });
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
+  /**
+   * Check if a user has already granted consent for the requested fields.
+   *
+   * @deprecated Data-sharing consent is disabled.
+   *
+   * Always returns `{ hasConsent: false }`.
+   */
+  async checkConsent(options) {
+    void options;
+    return { hasConsent: false };
   }
   /**
    * Request consent from the user to share their data.
    *
-   * First checks if consent was already granted (returns cached data immediately).
-   * If not, opens the consent dialog where the user can review and approve sharing.
+   * @deprecated Data-sharing consent is disabled.
    *
-   * @example
-   * ```typescript
-   * const result = await client.requestConsent({
-   *   username: "alice",
-   *   fields: ["email", "deviceNames"],
-   * });
-   * if (result.success) {
-   *   console.log(result.data?.email);
-   *   console.log(result.cached); // true if no dialog was shown
-   * }
-   * ```
+   * Always returns an `INVALID_REQUEST` result.
    */
   async requestConsent(options) {
-    const clientId = options.clientId ?? this.config.clientId;
-    if (!clientId) {
+    void options;
+    return {
+      success: false,
+      error: {
+        code: "INVALID_REQUEST",
+        message: "Data-sharing consent is disabled"
+      }
+    };
+  }
+  /**
+   * Open the dedicated SmartSession permission grant dialog.
+   *
+   * The app owns the session key material and sends only the public
+   * `sessionKeyAddress`. 1auth renders the permission review, collects the
+   * owner's passkey authorization, submits the install/enable intent, and
+   * returns a persistable session handle.
+   */
+  async grantPermissions(options) {
+    const telemetry = this.createTelemetryOperation("grant_permission", {
+      targetChains: normalizeGrantTargetChains(options).join(","),
+      sponsor: options.sponsor !== false
+    });
+    if (!options.username && !options.accountAddress) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "clientId is required (set in config or options)" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "Either username or accountAddress is required"
+        }
       };
     }
-    const username = options.username ?? options.accountAddress;
-    if (!username) {
+    const targetChains = normalizeGrantTargetChains(options);
+    const sourceChains = normalizeGrantSourceChains(options);
+    if (targetChains.length === 0 || !options.sessionKeyAddress || !options.permissions?.length) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "targetChains, sessionKeyAddress, and permissions are required"
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "username or accountAddress is required" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "targetChains, sessionKeyAddress, and permissions are required"
+        }
       };
     }
-    if (!options.fields || options.fields.length === 0) {
+    if (!this.sponsorship) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: MISSING_APP_CREDENTIALS_MESSAGE
+      });
       return {
         success: false,
-        error: { code: "INVALID_REQUEST", message: "At least one field is required" }
+        error: {
+          code: "MISSING_APP_CREDENTIALS",
+          message: MISSING_APP_CREDENTIALS_MESSAGE
+        }
       };
     }
-    const existing = await this.checkConsent({ ...options, clientId });
-    if (existing.hasConsent && existing.data) {
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      this.emitTelemetry("grant_permission.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "SPONSORSHIP_FETCH_FAILED",
+        errorMessage: accessTokenResult.message
+      });
       return {
-        success: true,
-        data: existing.data,
-        grantedAt: existing.grantedAt,
-        cached: true
+        success: false,
+        error: {
+          code: "SPONSORSHIP_FETCH_FAILED",
+          message: accessTokenResult.message
+        }
       };
     }
     const dialogUrl = this.getDialogUrl();
-    const params = new URLSearchParams({
-      mode: "iframe",
-      username,
-      clientId,
-      fields: options.fields.join(",")
-    });
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options.theme);
     if (themeParams) {
       const themeParsed = new URLSearchParams(themeParams);
       themeParsed.forEach((value, key) => params.set(key, value));
     }
-    const url = `${dialogUrl}/dialog/consent?${params.toString()}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
-      mode: "iframe"
+    const grantUrl = `${dialogUrl}/dialog/grant-permission?${params.toString()}`;
+    const { dialog, iframe, cleanup } = this.createModalDialog(grantUrl);
+    const initPayload = {
+      mode: "iframe",
+      clientId: this.config.clientId,
+      grant: cloneGrantPayload({
+        username: options.username,
+        accountAddress: options.accountAddress,
+        targetChain: targetChains[0],
+        targetChains,
+        sourceChains,
+        sessionKeyAddress: options.sessionKeyAddress,
+        permissions: options.permissions,
+        crossChainPermits: options.crossChainPermits,
+        validUntil: options.validUntil,
+        validAfter: options.validAfter,
+        maxUses: options.maxUses,
+        contracts: options.contracts
+      }),
+      auth: { accessToken: accessTokenResult.accessToken },
+      sponsor: options.sponsor !== false,
+      telemetry: this.telemetryPayload(telemetry)
+    };
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      targetChains
     });
-    if (!ready) {
+    const result = await this.waitForGrantPermissionResponse(
+      dialog,
+      iframe,
+      cleanup,
+      options.sponsor !== false,
+      initPayload
+    );
+    if (result.success) {
+      this.emitTelemetry("grant_permission.succeeded", telemetry, {
+        outcome: "success",
+        targetChains,
+        status: result.status ? String(result.status) : void 0
+      });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "grant_permission.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          targetChains,
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
+  }
+  /**
+   * List SmartSession grants previously granted to the current browser origin.
+   *
+   * 1auth derives the app identity from the request Origin header. The SDK does
+   * not send `clientId` for this lookup because grants are origin-scoped.
+   */
+  async listSessionGrants(options) {
+    if (!options.username && !options.accountAddress) {
       return {
         success: false,
-        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+        error: {
+          code: "INVALID_OPTIONS",
+          message: "Either username or accountAddress is required"
+        }
+      };
+    }
+    const params = new URLSearchParams();
+    if (options.username) params.set("username", options.username);
+    if (options.accountAddress) params.set("accountAddress", options.accountAddress);
+    if (options.includeRevoked) params.set("includeRevoked", "true");
+    try {
+      const response = await fetch(
+        `${this.config.providerUrl}/api/sessions/grants?${params.toString()}`,
+        { credentials: "include" }
+      );
+      const data = await response.json();
+      if (!response.ok) {
+        return {
+          success: false,
+          error: {
+            code: "LIST_SESSION_GRANTS_FAILED",
+            message: data?.error ?? `Request failed with status ${response.status}`
+          }
+        };
+      }
+      return { success: true, grants: data.grants ?? [] };
+    } catch (err) {
+      return {
+        success: false,
+        error: {
+          code: "LIST_SESSION_GRANTS_FAILED",
+          message: err instanceof Error ? err.message : String(err)
+        }
       };
     }
-    return this.waitForConsentResponse(dialog, iframe, cleanup);
   }
   /**
    * Authenticate a user with an optional challenge to sign.
@@ -448,13 +1293,13 @@ var OneAuthClient = class {
    * challenge signing, enabling off-chain login without on-chain transactions.
    *
    * When a challenge is provided:
-   * 1. User authenticates (sign in or sign up)
-   * 2. The challenge is hashed with a domain separator
-   * 3. User signs the hash with their passkey
-   * 4. Returns user info + signature for server-side verification
+   * 1. User authenticates (sign in or sign up) through the normal auth dialog
+   * 2. User signs the challenge through the normal signing dialog
+   * 3. Returns user info + signature for server-side verification
    *
-   * The domain separator ("\x19Passkey Signed Message:\n") ensures the signature
-   * cannot be reused for transaction signing, preventing phishing attacks.
+   * This composes the same supported provider routes as calling
+   * `authWithModal()` followed by `signMessage()`, so challenge auth cannot
+   * drift onto a provider route that the passkey service does not expose.
    *
    * @example
    * ```typescript
@@ -473,42 +1318,130 @@ var OneAuthClient = class {
    * ```
    */
   async authenticate(options) {
-    const dialogUrl = this.getDialogUrl();
-    const params = new URLSearchParams({
-      mode: "iframe"
+    const telemetry = this.createTelemetryOperation("authenticate", {
+      hasChallenge: !!options?.challenge
     });
-    if (this.config.clientId) {
-      params.set("clientId", this.config.clientId);
+    const authResult = await this.authWithModal(options?.theme ? { theme: options.theme } : void 0);
+    if (!authResult.success) {
+      this.emitTelemetry(
+        authResult.error?.code === "USER_CANCELLED" ? "dialog.cancelled" : "auth.failed",
+        telemetry,
+        {
+          outcome: authResult.error?.code === "USER_CANCELLED" ? "cancelled" : "failure",
+          ...describeTelemetryError(authResult.error)
+        }
+      );
+      return authResult;
     }
-    if (options?.challenge) {
-      params.set("challenge", options.challenge);
+    if (!options?.challenge) {
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { challengeSigned: false }
+      });
+      return authResult;
     }
-    const themeParams = this.getThemeParams(options?.theme);
-    if (themeParams) {
-      const themeParsed = new URLSearchParams(themeParams);
-      themeParsed.forEach((value, key) => params.set(key, value));
+    const accountAddress = authResult.user?.address;
+    const username = authResult.user?.username;
+    if (!accountAddress && !username) {
+      const result2 = {
+        success: false,
+        user: authResult.user,
+        signerType: authResult.signerType,
+        error: {
+          code: "AUTHENTICATE_USER_MISSING",
+          message: "Authentication succeeded but no username or account address was returned for challenge signing"
+        }
+      };
+      this.emitTelemetry("auth.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(result2.error)
+      });
+      return result2;
     }
-    const url = `${dialogUrl}/dialog/authenticate?${params.toString()}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(url);
-    return this.waitForAuthenticateResponse(dialog, iframe, cleanup);
+    const signResult = await this.signMessage({
+      username,
+      accountAddress,
+      message: options.challenge,
+      description: "Verify your identity",
+      theme: options.theme
+    });
+    if (signResult.success && signResult.signature && signResult.signedHash) {
+      const result2 = {
+        ...authResult,
+        challenge: {
+          signature: signResult.signature,
+          signedHash: signResult.signedHash
+        }
+      };
+      this.emitTelemetry("auth.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { challengeSigned: true }
+      });
+      return result2;
+    }
+    const error = signResult.error ? { code: signResult.error.code, message: signResult.error.message } : { code: "SIGNING_FAILED", message: "Challenge signing failed" };
+    const result = {
+      success: false,
+      user: authResult.user,
+      signerType: authResult.signerType,
+      error
+    };
+    const cancelled = error.code === "USER_CANCELLED" || error.code === "USER_REJECTED";
+    this.emitTelemetry(
+      cancelled ? "dialog.cancelled" : "auth.failed",
+      telemetry,
+      {
+        outcome: cancelled ? "cancelled" : "failure",
+        ...describeTelemetryError(error)
+      }
+    );
+    return result;
   }
   /**
    * Show signing in a modal overlay (iframe dialog)
    */
   async signWithModal(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "transaction",
+      hasTransaction: !!options.transaction,
+      hasAccountAddress: !!options.accountAddress
+    });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
     const ready = await this.waitForDialogReady(dialog, iframe, cleanup, {
       mode: "iframe",
       challenge: options.challenge,
       username: options.username,
+      accountAddress: options.accountAddress,
       description: options.description,
       transaction: options.transaction,
-      metadata: options.metadata
+      metadata: options.metadata,
+      telemetry: this.telemetryPayload(telemetry)
+    }, {
+      blindSigning: requestedBlindSigning,
+      reveal
     });
     if (!ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -517,7 +1450,21 @@ var OneAuthClient = class {
         }
       };
     }
-    return this.waitForSigningResponse(dialog, iframe, cleanup);
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
+    const result = await this.waitForSigningResponse(dialog, iframe, cleanup);
+    if (result.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, { outcome: "success" });
+    } else {
+      this.emitTelemetry(
+        result.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+        telemetry,
+        {
+          outcome: result.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+          ...describeTelemetryError(result.error)
+        }
+      );
+    }
+    return result;
   }
   /**
    * Send an intent to the Rhinestone orchestrator
@@ -549,8 +1496,37 @@ var OneAuthClient = class {
    * ```
    */
   async sendIntent(options) {
-    const { username, accountAddress, targetChain, calls } = options;
+    const { username, accountAddress, targetChain } = options;
+    const calls = capCallLabels(options.calls);
+    const sponsor = options.sponsor !== false;
+    const telemetry = this.createTelemetryOperation("intent", {
+      targetChain: targetChain ?? null,
+      callsCount: calls?.length ?? 0,
+      sponsor,
+      blindSigning: this.shouldRequestBlindSigning(options)
+    });
+    if (getStoredSignerType() === "eoa") {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "E_SIGNER_UNSUPPORTED",
+        errorMessage: "Cross-chain intents are not supported for EOA sessions"
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "E_SIGNER_UNSUPPORTED",
+          message: "Cross-chain intents are not supported for EOA sessions. Use the connected wallet's native RPC instead."
+        }
+      };
+    }
     if (!username && !accountAddress) {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
         intentId: "",
@@ -561,14 +1537,37 @@ var OneAuthClient = class {
         }
       };
     }
-    if (!targetChain || !calls?.length) {
+    const hasCalls = !!calls?.length;
+    const hasTokenRequests = !!options.tokenRequests?.length;
+    if (!targetChain || !hasCalls && !hasTokenRequests) {
+      this.emitTelemetry("intent.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "targetChain and calls or tokenRequests are required"
+      });
       return {
         success: false,
         intentId: "",
         status: "failed",
         error: {
           code: "INVALID_OPTIONS",
-          message: "targetChain and calls are required"
+          message: "targetChain and calls or tokenRequests are required"
+        }
+      };
+    }
+    if (!this.sponsorship) {
+      this.emitTelemetry("intent.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: "No sponsorship configured on OneAuthClient"
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "MISSING_APP_CREDENTIALS",
+          message: "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 configure `sponsorship` on the client."
         }
       };
     }
@@ -577,6 +1576,111 @@ var OneAuthClient = class {
       amount: r.amount.toString()
     }));
     let prepareResponse;
+    const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
+    const themeParams = this.getThemeParams();
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogOrigin = this.getDialogOrigin();
+    const dialogOpenedAt = Date.now();
+    let iframeReadyObserved = false;
+    let stopEarlyCloseWatch = () => void 0;
+    const earlyDialogClosePromise = new Promise((resolve) => {
+      let settled = false;
+      const stop = () => {
+        if (settled) return;
+        settled = true;
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      stopEarlyCloseWatch = stop;
+      const resolveClosed = (ready) => {
+        stop();
+        cleanup();
+        resolve({ type: "dialog_closed", ready });
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_CLOSE") {
+          resolveClosed(iframeReadyObserved);
+        }
+      };
+      const handleClose = () => {
+        resolveClosed(iframeReadyObserved);
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+    let dialogReadyDurationMs;
+    const dialogReadyPromise = this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    }).then((result) => {
+      dialogReadyDurationMs = Date.now() - dialogOpenedAt;
+      iframeReadyObserved = result.ready;
+      return result;
+    });
+    const dialogClosedBeforeReadyPromise = dialogReadyPromise.then(
+      (result) => result.ready ? new Promise(() => void 0) : { type: "dialog_closed", ready: false }
+    );
+    const accessTokenStartedAt = Date.now();
+    let accessTokenDurationMs;
+    const accessTokenPromise = this.fetchAccessToken().then((result) => {
+      accessTokenDurationMs = Date.now() - accessTokenStartedAt;
+      return result;
+    });
+    const accessOrClose = await Promise.race([
+      accessTokenPromise.then((result) => ({ type: "access_token", result })),
+      dialogClosedBeforeReadyPromise,
+      earlyDialogClosePromise
+    ]);
+    if (accessOrClose.type === "dialog_closed") {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: accessOrClose.ready ? "User closed the dialog while intent setup was still loading" : "User closed the dialog before it became ready",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs
+        }
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+      };
+    }
+    const accessTokenResult = accessOrClose.result;
+    let accessTokenFailure = null;
+    if (!accessTokenResult.ok) {
+      const errorCode = accessTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED";
+      this.emitTelemetry("intent.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode,
+        errorMessage: accessTokenResult.message,
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          loadingPhase: "access_token"
+        }
+      });
+      accessTokenFailure = { code: errorCode, message: accessTokenResult.message };
+    }
+    let accessToken = accessTokenResult.ok ? accessTokenResult.accessToken : "";
     const requestBody = {
       username,
       accountAddress,
@@ -585,20 +1689,112 @@ var OneAuthClient = class {
       tokenRequests: serializedTokenRequests,
       sourceAssets: options.sourceAssets,
       sourceChainId: options.sourceChainId,
+      auth: { accessToken },
       ...this.config.clientId && { clientId: this.config.clientId }
     };
-    const dialogUrl = this.getDialogUrl();
-    const themeParams = this.getThemeParams();
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogOrigin = this.getDialogOrigin();
     let earlyPrepareResult = null;
-    const preparePromise = this.prepareIntent(requestBody).then((r) => {
+    let extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+    let extensionTokensDurationMs;
+    this.emitTelemetry("intent.prepare.started", telemetry, {
+      outcome: "started",
+      targetChain,
+      attributes: {
+        accessTokenDurationMs,
+        dialogReadyDurationMs
+      }
+    });
+    const prepareStartedAt = Date.now();
+    let prepareDurationMs;
+    const runPrepare = () => this.prepareIntent(requestBody, telemetry).then((r) => {
       earlyPrepareResult = r;
+      prepareDurationMs = Date.now() - prepareStartedAt;
+      if (r.success) {
+        this.emitTelemetry("intent.prepare.succeeded", telemetry, {
+          outcome: "success",
+          targetChain,
+          status: "quoted",
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs
+          }
+        });
+        const extensionTokensStartedAt = Date.now();
+        extensionTokensPromise = this.fetchExtensionTokens(
+          [r.data.intentOp],
+          [sponsor]
+        ).then((result) => {
+          extensionTokensDurationMs = Date.now() - extensionTokensStartedAt;
+          return result;
+        });
+      } else {
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          targetChain,
+          ...describeTelemetryError(r.error),
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            loadingPhase: "prepare"
+          }
+        });
+      }
       return r;
     });
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    const preparePromise = accessTokenFailure ? Promise.resolve({
+      success: false,
+      error: accessTokenFailure
+    }).then((r) => {
+      earlyPrepareResult = r;
+      return r;
+    }) : runPrepare();
+    const retryPrepare = async () => {
+      const retryTokenResult = await this.fetchAccessToken();
+      if (!retryTokenResult.ok) {
+        return {
+          success: false,
+          error: {
+            code: retryTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED",
+            message: retryTokenResult.message
+          }
+        };
+      }
+      accessToken = retryTokenResult.accessToken;
+      requestBody.auth = { accessToken };
+      return runPrepare();
+    };
+    const readyOrClose = await Promise.race([
+      dialogReadyPromise.then((result) => ({ type: "ready", result })),
+      earlyDialogClosePromise
+    ]);
+    if (readyOrClose.type === "dialog_closed") {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: readyOrClose.ready ? "User closed the dialog while intent setup was still loading" : "User closed the dialog before it became ready",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          prepareDurationMs
+        }
+      });
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: { code: "USER_CANCELLED", message: "User closed the dialog" }
+      };
+    }
+    const dialogResult = readyOrClose.result;
     if (!dialogResult.ready) {
+      stopEarlyCloseWatch();
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "User closed the dialog before it became ready"
+      });
       return {
         success: false,
         intentId: "",
@@ -606,126 +1802,348 @@ var OneAuthClient = class {
         error: { code: "USER_CANCELLED", message: "User closed the dialog" }
       };
     }
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, {
+      outcome: "started",
+      attributes: {
+        accessTokenDurationMs,
+        dialogReadyDurationMs
+      }
+    });
     let currentInitPayload;
-    if (earlyPrepareResult) {
-      const prepareResult = earlyPrepareResult;
-      if (!prepareResult.success) {
-        this.sendPrepareError(iframe, prepareResult.error.message);
-        await this.waitForDialogClose(dialog, cleanup);
+    const refreshQuote = async () => {
+      try {
+        const refreshedTokenResult = await this.fetchAccessToken();
+        const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
+        const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+          body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } }),
+          credentials: "include"
+        });
+        if (!refreshResponse.ok) {
+          console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
+          return null;
+        }
+        const refreshedData = await refreshResponse.json();
+        const refreshedExtensionPromise = this.fetchExtensionTokens(
+          [refreshedData.intentOp],
+          [sponsor]
+        );
+        const extensionResult = await refreshedExtensionPromise;
+        if (!extensionResult.ok) {
+          console.error(
+            "[SDK] Extension token refresh failed:",
+            extensionResult.message
+          );
+          return null;
+        }
+        const refreshedAuth = {
+          accessToken: refreshToken,
+          extensionTokens: extensionResult.extensionTokens
+        };
+        prepareResponse = refreshedData;
+        accessToken = refreshToken;
+        requestBody.auth = { accessToken: refreshToken };
+        extensionTokensPromise = refreshedExtensionPromise;
+        currentInitPayload = {
+          ...currentInitPayload,
+          transaction: refreshedData.transaction,
+          challenge: refreshedData.challenge,
+          originMessages: refreshedData.originMessages,
+          expiresAt: refreshedData.expiresAt,
+          intentOp: refreshedData.intentOp,
+          digestResult: refreshedData.digestResult,
+          auth: refreshedAuth
+        };
         return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: prepareResult.error
+          intentOp: refreshedData.intentOp,
+          expiresAt: refreshedData.expiresAt,
+          challenge: refreshedData.challenge,
+          originMessages: refreshedData.originMessages,
+          transaction: refreshedData.transaction,
+          digestResult: refreshedData.digestResult,
+          // Dialog-executed intents read auth from dialog state — ship the
+          // rebound bundle with the refresh so PASSKEY_REFRESH_COMPLETE
+          // updates it alongside the quote.
+          auth: refreshedAuth
         };
+      } catch (error) {
+        console.error("[SDK] Quote refresh error:", error);
+        return null;
+      }
+    };
+    const signingResultPromise = this.waitForSigningWithRefresh(
+      dialog,
+      iframe,
+      cleanup,
+      dialogOrigin,
+      refreshQuote
+    );
+    stopEarlyCloseWatch();
+    if (earlyPrepareResult) {
+      let prepareResult = earlyPrepareResult;
+      for (; ; ) {
+        while (!prepareResult.success) {
+          this.sendPrepareError(iframe, prepareResult.error.message);
+          if (blindSigning) {
+            cleanup();
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          const next2 = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+          if (next2 === "closed") {
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          prepareResult = await retryPrepare();
+        }
+        prepareResponse = prepareResult.data;
+        const extensionResult = await extensionTokensPromise;
+        if (extensionResult.ok) {
+          const sponsorshipTokens = {
+            accessToken,
+            extensionTokens: extensionResult.extensionTokens
+          };
+          currentInitPayload = {
+            mode: "iframe",
+            calls,
+            chainId: targetChain,
+            transaction: prepareResponse.transaction,
+            challenge: prepareResponse.challenge,
+            username,
+            accountAddress: prepareResponse.accountAddress,
+            originMessages: prepareResponse.originMessages,
+            tokenRequests: serializedTokenRequests,
+            expiresAt: prepareResponse.expiresAt,
+            userId: prepareResponse.userId,
+            intentOp: prepareResponse.intentOp,
+            digestResult: prepareResponse.digestResult,
+            tier: prepareResult.tier,
+            auth: sponsorshipTokens,
+            telemetry: this.telemetryPayload(telemetry)
+          };
+          dialogResult.sendInit(currentInitPayload);
+          break;
+        }
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
+          }
+        });
+        this.sendPrepareError(iframe, extensionResult.message);
+        if (blindSigning) {
+          cleanup();
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        const next = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+        if (next === "closed") {
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        prepareResult = await retryPrepare();
       }
-      prepareResponse = prepareResult.data;
-      currentInitPayload = {
-        mode: "iframe",
-        calls,
-        chainId: targetChain,
-        transaction: prepareResponse.transaction,
-        challenge: prepareResponse.challenge,
-        username,
-        accountAddress: prepareResponse.accountAddress,
-        originMessages: prepareResponse.originMessages,
-        tokenRequests: serializedTokenRequests,
-        expiresAt: prepareResponse.expiresAt,
-        userId: prepareResponse.userId,
-        intentOp: prepareResponse.intentOp,
-        digestResult: prepareResponse.digestResult,
-        tier: prepareResult.tier
-      };
-      dialogResult.sendInit(currentInitPayload);
     } else {
       currentInitPayload = {
         mode: "iframe",
+        signingMode: "transaction",
         calls,
         chainId: targetChain,
         username,
         accountAddress: options.accountAddress,
-        tokenRequests: serializedTokenRequests
+        tokenRequests: serializedTokenRequests,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentInitPayload);
-      const prepareResult = await preparePromise;
-      if (!prepareResult.success) {
-        this.sendPrepareError(iframe, prepareResult.error.message);
-        await this.waitForDialogClose(dialog, cleanup);
-        return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: prepareResult.error
-        };
+      const prepareOrCancel = await Promise.race([
+        preparePromise.then((prepareResult2) => ({
+          type: "prepare",
+          prepareResult: prepareResult2
+        })),
+        signingResultPromise.then((signingResult2) => ({
+          type: "signing",
+          signingResult: signingResult2
+        }))
+      ]);
+      let prepareResult;
+      if (prepareOrCancel.type === "signing") {
+        const earlySigningResult = prepareOrCancel.signingResult;
+        if (earlySigningResult.success) {
+          prepareResult = await preparePromise;
+        } else {
+          const signingError = earlySigningResult.error;
+          this.emitTelemetry(
+            signingError?.code === "USER_REJECTED" ? "dialog.cancelled" : "intent.sign.failed",
+            telemetry,
+            {
+              outcome: signingError?.code === "USER_REJECTED" ? "cancelled" : "failure",
+              ...describeTelemetryError(signingError)
+            }
+          );
+          if (blindSigning) cleanup();
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: signingError
+          };
+        }
+      } else {
+        prepareResult = prepareOrCancel.prepareResult;
       }
-      prepareResponse = prepareResult.data;
-      currentInitPayload = {
-        mode: "iframe",
-        calls,
-        chainId: targetChain,
-        transaction: prepareResponse.transaction,
-        challenge: prepareResponse.challenge,
-        username,
-        accountAddress: prepareResponse.accountAddress,
-        originMessages: prepareResponse.originMessages,
-        tokenRequests: serializedTokenRequests,
-        expiresAt: prepareResponse.expiresAt,
-        userId: prepareResponse.userId,
-        intentOp: prepareResponse.intentOp,
-        digestResult: prepareResponse.digestResult,
-        tier: prepareResult.tier
-      };
-      iframe.contentWindow?.postMessage(
-        { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true },
-        dialogOrigin
-      );
-    }
-    const handleReReady = (event) => {
-      if (event.origin !== dialogOrigin) return;
-      if (event.data?.type === "PASSKEY_READY") {
+      for (; ; ) {
+        while (!prepareResult.success) {
+          this.sendPrepareError(iframe, prepareResult.error.message);
+          if (blindSigning) {
+            cleanup();
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          const next2 = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+          if (next2 === "closed") {
+            return {
+              success: false,
+              intentId: "",
+              status: "failed",
+              error: prepareResult.error
+            };
+          }
+          prepareResult = await retryPrepare();
+        }
+        prepareResponse = prepareResult.data;
+        const authReady = !sponsor ? {
+          accessToken,
+          extensionTokens: []
+        } : void 0;
+        currentInitPayload = {
+          mode: "iframe",
+          calls,
+          chainId: targetChain,
+          transaction: prepareResponse.transaction,
+          challenge: prepareResponse.challenge,
+          username,
+          accountAddress: prepareResponse.accountAddress,
+          originMessages: prepareResponse.originMessages,
+          tokenRequests: serializedTokenRequests,
+          expiresAt: prepareResponse.expiresAt,
+          userId: prepareResponse.userId,
+          intentOp: prepareResponse.intentOp,
+          digestResult: prepareResponse.digestResult,
+          tier: prepareResult.tier,
+          ...authReady && { auth: authReady },
+          telemetry: this.telemetryPayload(telemetry)
+        };
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true },
+          { type: "PASSKEY_QUOTE_READY", ...currentInitPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
-      }
-    };
-    window.addEventListener("message", handleReReady);
-    const signingResult = await this.waitForSigningWithRefresh(
-      dialog,
-      iframe,
-      cleanup,
-      dialogOrigin,
-      // Refresh callback - called when dialog requests a quote refresh
-      async () => {
-        try {
-          const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(requestBody),
-            credentials: "include"
-          });
-          if (!refreshResponse.ok) {
-            console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
-            return null;
+        if (!sponsor) break;
+        const extensionResult = await extensionTokensPromise;
+        if (extensionResult.ok) {
+          const sponsorshipTokens = {
+            accessToken,
+            extensionTokens: extensionResult.extensionTokens
+          };
+          currentInitPayload = {
+            ...currentInitPayload,
+            auth: sponsorshipTokens
+          };
+          iframe.contentWindow?.postMessage(
+            { type: "PASSKEY_QUOTE_READY", auth: sponsorshipTokens, fullViewport: true, blindSigning },
+            dialogOrigin
+          );
+          break;
+        }
+        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
           }
-          const refreshedData = await refreshResponse.json();
-          prepareResponse = refreshedData;
+        });
+        this.sendPrepareError(iframe, extensionResult.message);
+        if (blindSigning) {
+          cleanup();
           return {
-            intentOp: refreshedData.intentOp,
-            expiresAt: refreshedData.expiresAt,
-            challenge: refreshedData.challenge,
-            originMessages: refreshedData.originMessages,
-            transaction: refreshedData.transaction,
-            digestResult: refreshedData.digestResult
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
           };
-        } catch (error) {
-          console.error("[SDK] Quote refresh error:", error);
-          return null;
         }
+        const next = await this.waitForPrepareRetryOrClose(dialog, cleanup);
+        if (next === "closed") {
+          return {
+            success: false,
+            intentId: "",
+            status: "failed",
+            error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+          };
+        }
+        prepareResult = await retryPrepare();
+      }
+    }
+    const handleReReady = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...currentInitPayload, fullViewport: true, blindSigning },
+          dialogOrigin
+        );
       }
-    );
+    };
+    window.addEventListener("message", handleReReady);
+    const signingResult = await signingResultPromise;
     window.removeEventListener("message", handleReReady);
     if (!signingResult.success) {
+      this.emitTelemetry(
+        signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "intent.sign.failed",
+        telemetry,
+        {
+          outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+          ...describeTelemetryError(signingResult.error),
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs
+          }
+        }
+      );
+      if (blindSigning) cleanup();
       return {
         success: false,
         intentId: "",
@@ -742,12 +2160,67 @@ var OneAuthClient = class {
         intentId: signingResult.intentId,
         status: "pending"
       };
+      this.emitTelemetry("intent.sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: {
+          accessTokenDurationMs,
+          dialogReadyDurationMs,
+          prepareDurationMs,
+          extensionTokensDurationMs,
+          dialogExecuted: true
+        }
+      });
     } else {
+      const extensionResult = await extensionTokensPromise;
+      if (!extensionResult.ok) {
+        this.emitTelemetry("intent.sign.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "SPONSORSHIP_FETCH_FAILED",
+          errorMessage: extensionResult.message,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            loadingPhase: "extension_token"
+          }
+        });
+        this.sendTransactionStatus(iframe, "failed");
+        await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+        return {
+          success: false,
+          intentId: "",
+          status: "failed",
+          error: { code: "SPONSORSHIP_FETCH_FAILED", message: extensionResult.message }
+        };
+      }
+      const extensionTokens = extensionResult.extensionTokens;
       try {
+        this.emitTelemetry("intent.sign.succeeded", telemetry, {
+          outcome: "success",
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs,
+            dialogExecuted: false
+          }
+        });
+        this.emitTelemetry("intent.execute.started", telemetry, {
+          outcome: "started",
+          targetChain: prepareResponse.targetChain,
+          attributes: {
+            accessTokenDurationMs,
+            dialogReadyDurationMs,
+            prepareDurationMs,
+            extensionTokensDurationMs
+          }
+        });
         const response = await fetch(`${this.config.providerUrl}/api/intent/execute`, {
           method: "POST",
           headers: {
-            "Content-Type": "application/json"
+            "Content-Type": "application/json",
+            ...this.telemetryHeaders(telemetry)
           },
           body: JSON.stringify({
             // Data from prepare response (no intentId yet - created on execute)
@@ -759,14 +2232,28 @@ var OneAuthClient = class {
             digestResult: prepareResponse.digestResult,
             // Signature from dialog
             signature: signingResult.signature,
-            passkey: signingResult.passkey
+            passkey: signingResult.passkey,
             // Include passkey info for signature encoding
+            // App JWT — `accessToken` is always present. `extensionToken` is
+            // only included when sponsorship was requested (sponsor !== false).
+            auth: {
+              accessToken,
+              ...extensionTokens.length > 0 && {
+                extensionToken: extensionTokens[0]
+              }
+            }
           })
         });
         if (!response.ok) {
           const errorData = await response.json().catch(() => ({}));
           this.sendTransactionStatus(iframe, "failed");
-          await this.waitForDialogClose(dialog, cleanup);
+          await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+          this.emitTelemetry("intent.execute.failed", telemetry, {
+            outcome: "failure",
+            targetChain: prepareResponse.targetChain,
+            errorCode: "EXECUTE_FAILED",
+            errorMessage: errorData.error || "Failed to execute intent"
+          });
           return {
             success: false,
             intentId: "",
@@ -779,9 +2266,19 @@ var OneAuthClient = class {
           };
         }
         executeResponse = await response.json();
+        this.emitTelemetry("intent.execute.succeeded", telemetry, {
+          outcome: "success",
+          targetChain: prepareResponse.targetChain,
+          status: executeResponse.status
+        });
       } catch (error) {
         this.sendTransactionStatus(iframe, "failed");
-        await this.waitForDialogClose(dialog, cleanup);
+        await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+        this.emitTelemetry("intent.execute.failed", telemetry, {
+          outcome: "failure",
+          targetChain: prepareResponse.targetChain,
+          ...describeTelemetryError(error)
+        });
         return {
           success: false,
           intentId: "",
@@ -798,6 +2295,10 @@ var OneAuthClient = class {
     let finalTxHash = executeResponse.transactionHash;
     if (finalStatus === "pending") {
       this.sendTransactionStatus(iframe, "pending");
+      this.emitTelemetry("intent.status.started", telemetry, {
+        outcome: "started",
+        status: finalStatus
+      });
       let userClosedEarly = false;
       const dialogOrigin2 = this.getDialogOrigin();
       const earlyCloseHandler = (event) => {
@@ -818,7 +2319,10 @@ var OneAuthClient = class {
             `${this.config.providerUrl}/api/intent/status/${executeResponse.intentId}`,
             {
               method: "GET",
-              headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+              headers: {
+                ...this.telemetryHeaders(telemetry),
+                ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+              }
             }
           );
           if (statusResponse.ok) {
@@ -850,6 +2354,12 @@ var OneAuthClient = class {
       window.removeEventListener("message", earlyCloseHandler);
       if (userClosedEarly) {
         cleanup();
+        this.emitTelemetry("intent.status.failed", telemetry, {
+          outcome: "cancelled",
+          status: finalStatus,
+          errorCode: "USER_CANCELLED",
+          errorMessage: "User closed the dialog while status polling"
+        });
         return {
           success: false,
           intentId: executeResponse.intentId,
@@ -872,19 +2382,25 @@ var OneAuthClient = class {
     };
     const isSuccessStatus = successStatuses[closeOn]?.includes(finalStatus) ?? false;
     const displayStatus = isSuccessStatus ? "confirmed" : finalStatus;
-    const closePromise = this.waitForDialogClose(dialog, cleanup);
+    const closePromise = this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
     this.sendTransactionStatus(iframe, displayStatus, finalTxHash);
     await closePromise;
     if (options.waitForHash && !finalTxHash) {
       const hash = await this.waitForTransactionHash(executeResponse.intentId, {
         timeoutMs: options.hashTimeoutMs,
         intervalMs: options.hashIntervalMs
-      });
+      }, telemetry);
       if (hash) {
         finalTxHash = hash;
         finalStatus = "completed";
       } else {
         finalStatus = "failed";
+        this.emitTelemetry("intent.status.failed", telemetry, {
+          outcome: "failure",
+          status: finalStatus,
+          errorCode: "HASH_TIMEOUT",
+          errorMessage: "Timed out waiting for transaction hash"
+        });
         return {
           success: false,
           intentId: executeResponse.intentId,
@@ -898,6 +2414,15 @@ var OneAuthClient = class {
         };
       }
     }
+    this.emitTelemetry("intent.status.succeeded", telemetry, {
+      outcome: isSuccessStatus ? "success" : "failure",
+      status: finalStatus
+    });
+    this.emitTelemetry("intent.completed", telemetry, {
+      outcome: isSuccessStatus ? "success" : "failure",
+      status: finalStatus,
+      targetChain
+    });
     return {
       success: isSuccessStatus,
       intentId: executeResponse.intentId,
@@ -935,7 +2460,30 @@ var OneAuthClient = class {
    * ```
    */
   async sendBatchIntent(options) {
+    const telemetry = this.createTelemetryOperation("batch_intent", {
+      intentCount: options.intents?.length ?? 0,
+      blindSigning: this.shouldRequestBlindSigning(options)
+    });
+    if (getStoredSignerType() === "eoa") {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "E_SIGNER_UNSUPPORTED",
+        errorMessage: "Batch intents are not supported for EOA sessions"
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: "Batch intents are not supported for EOA sessions. Use the connected wallet's native RPC instead."
+      };
+    }
     if (!options.username && !options.accountAddress) {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "Either username or accountAddress is required"
+      });
       return {
         success: false,
         results: [],
@@ -944,6 +2492,11 @@ var OneAuthClient = class {
       };
     }
     if (!options.intents?.length) {
+      this.emitTelemetry("batch.completed", telemetry, {
+        outcome: "failure",
+        errorCode: "INVALID_OPTIONS",
+        errorMessage: "At least one intent is required"
+      });
       return {
         success: false,
         results: [],
@@ -951,9 +2504,40 @@ var OneAuthClient = class {
         failureCount: 0
       };
     }
+    if (!this.sponsorship) {
+      this.emitTelemetry("batch.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "MISSING_APP_CREDENTIALS",
+        errorMessage: "No sponsorship configured on OneAuthClient"
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 configure `sponsorship` on the client."
+      };
+    }
+    const sponsorFlags = options.intents.map((intent) => intent.sponsor !== false);
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      this.emitTelemetry("batch.prepare.failed", telemetry, {
+        outcome: "failure",
+        errorCode: accessTokenResult.code ?? "SPONSORSHIP_FETCH_FAILED",
+        errorMessage: accessTokenResult.message
+      });
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: accessTokenResult.message
+      };
+    }
+    let accessToken = accessTokenResult.accessToken;
     const serializedIntents = options.intents.map((intent) => ({
       targetChain: intent.targetChain,
-      calls: intent.calls,
+      calls: capCallLabels(intent.calls),
       tokenRequests: intent.tokenRequests?.map((r) => ({
         token: r.token,
         amount: r.amount.toString()
@@ -966,20 +2550,66 @@ var OneAuthClient = class {
       ...options.username && { username: options.username },
       ...options.accountAddress && { accountAddress: options.accountAddress },
       intents: serializedIntents,
+      auth: { accessToken },
       ...this.config.clientId && { clientId: this.config.clientId }
     };
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams();
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      intentCount: options.intents.length,
+      attributes: { blindSigning: requestedBlindSigning }
+    });
     const dialogOrigin = this.getDialogOrigin();
     let earlyBatchResult = null;
-    const preparePromise = this.prepareBatchIntent(requestBody).then((r) => {
+    let batchExtensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+    this.emitTelemetry("batch.prepare.started", telemetry, {
+      outcome: "started",
+      intentCount: options.intents.length,
+      targetChains: serializedIntents.map((intent) => intent.targetChain)
+    });
+    const preparePromise = this.prepareBatchIntent(requestBody, telemetry).then((r) => {
       earlyBatchResult = r;
+      if (r.success) {
+        this.emitTelemetry("batch.prepare.succeeded", telemetry, {
+          outcome: "success",
+          intentCount: r.data.intents.length,
+          targetChains: serializedIntents.map((intent) => intent.targetChain)
+        });
+        batchExtensionTokensPromise = this.fetchExtensionTokens(
+          r.data.intents.map((intent) => intent.intentOp),
+          sponsorFlags
+        );
+      } else {
+        this.emitTelemetry("batch.prepare.failed", telemetry, {
+          outcome: "failure",
+          errorMessage: r.error,
+          intentCount: options.intents.length
+        });
+      }
       return r;
     });
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_CANCELLED",
+        errorMessage: "User closed the dialog before it became ready"
+      });
       return {
         success: false,
         results: [],
@@ -987,6 +2617,8 @@ var OneAuthClient = class {
         failureCount: 0
       };
     }
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     let currentBatchPayload;
     const handleBatchPrepareFailure = async (prepareResult) => {
       const failedIntents = prepareResult.failedIntents;
@@ -998,7 +2630,7 @@ var OneAuthClient = class {
         error: { message: f.error, code: "PREPARE_FAILED" }
       })) ?? [];
       this.sendPrepareError(iframe, prepareResult.error);
-      await this.waitForDialogClose(dialog, cleanup);
+      await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
       return {
         success: false,
         results: failureResults,
@@ -1007,6 +2639,17 @@ var OneAuthClient = class {
         error: prepareResult.error
       };
     };
+    const handleSponsorshipFailure = async (message) => {
+      this.sendPrepareError(iframe, message);
+      await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+      return {
+        success: false,
+        results: [],
+        successCount: 0,
+        failureCount: 0,
+        error: `Sponsorship token fetch failed: ${message}`
+      };
+    };
     let prepareResponse;
     if (earlyBatchResult) {
       const prepareResult = earlyBatchResult;
@@ -1014,6 +2657,14 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
+      const batchExtensionResult = await batchExtensionTokensPromise;
+      if (!batchExtensionResult.ok) {
+        return handleSponsorshipFailure(batchExtensionResult.message);
+      }
+      const batchSponsorshipTokens = {
+        accessToken,
+        extensionTokens: batchExtensionResult.extensionTokens
+      };
       currentBatchPayload = {
         mode: "iframe",
         batchMode: true,
@@ -1024,7 +2675,9 @@ var OneAuthClient = class {
         accountAddress: prepareResponse.accountAddress,
         userId: prepareResponse.userId,
         expiresAt: prepareResponse.expiresAt,
-        tier: prepareResult.tier
+        tier: prepareResult.tier,
+        auth: batchSponsorshipTokens,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentBatchPayload);
     } else {
@@ -1038,7 +2691,8 @@ var OneAuthClient = class {
           // No: transaction, intentOp, expiresAt, originMessages
         })),
         username: options.username,
-        accountAddress: options.accountAddress
+        accountAddress: options.accountAddress,
+        telemetry: this.telemetryPayload(telemetry)
       };
       dialogResult.sendInit(currentBatchPayload);
       const prepareResult = await preparePromise;
@@ -1046,6 +2700,14 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
+      const batchExtensionResult = await batchExtensionTokensPromise;
+      if (!batchExtensionResult.ok) {
+        return handleSponsorshipFailure(batchExtensionResult.message);
+      }
+      const batchSponsorshipTokens = {
+        accessToken,
+        extensionTokens: batchExtensionResult.extensionTokens
+      };
       currentBatchPayload = {
         mode: "iframe",
         batchMode: true,
@@ -1056,10 +2718,12 @@ var OneAuthClient = class {
         accountAddress: prepareResponse.accountAddress,
         userId: prepareResponse.userId,
         expiresAt: prepareResponse.expiresAt,
-        tier: prepareResult.tier
+        tier: prepareResult.tier,
+        auth: batchSponsorshipTokens,
+        telemetry: this.telemetryPayload(telemetry)
       };
       iframe.contentWindow?.postMessage(
-        { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true },
+        { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true, blindSigning },
         dialogOrigin
       );
     }
@@ -1067,7 +2731,7 @@ var OneAuthClient = class {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...currentBatchPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -1079,19 +2743,53 @@ var OneAuthClient = class {
         const message = event.data;
         if (message?.type === "PASSKEY_REFRESH_QUOTE") {
           try {
+            const refreshedTokenResult = await this.fetchAccessToken();
+            const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
             const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
               method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify(requestBody)
+              headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+              body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } })
             });
             if (refreshResponse.ok) {
               const refreshed = await refreshResponse.json();
+              const refreshedExtensionPromise = this.fetchExtensionTokens(
+                refreshed.intents.map((intent) => intent.intentOp),
+                sponsorFlags
+              );
+              const extensionResult = await refreshedExtensionPromise;
+              if (!extensionResult.ok) {
+                console.error(
+                  "[SDK] Batch extension token refresh failed:",
+                  extensionResult.message
+                );
+                iframe.contentWindow?.postMessage({
+                  type: "PASSKEY_REFRESH_ERROR",
+                  error: "Failed to refresh batch quotes"
+                }, dialogOrigin);
+                return;
+              }
+              const refreshedAuth = {
+                accessToken: refreshToken,
+                extensionTokens: extensionResult.extensionTokens
+              };
               prepareResponse = refreshed;
+              accessToken = refreshToken;
+              requestBody.auth = { accessToken: refreshToken };
+              batchExtensionTokensPromise = refreshedExtensionPromise;
+              currentBatchPayload = {
+                ...currentBatchPayload,
+                batchIntents: refreshed.intents,
+                batchFailedIntents: refreshed.failedIntents,
+                challenge: refreshed.challenge,
+                expiresAt: refreshed.expiresAt,
+                auth: refreshedAuth
+              };
               iframe.contentWindow?.postMessage({
                 type: "PASSKEY_REFRESH_COMPLETE",
                 batchIntents: refreshed.intents,
                 challenge: refreshed.challenge,
-                expiresAt: refreshed.expiresAt
+                expiresAt: refreshed.expiresAt,
+                auth: refreshedAuth
               }, dialogOrigin);
             } else {
               iframe.contentWindow?.postMessage({
@@ -1127,7 +2825,11 @@ var OneAuthClient = class {
             }));
             const allResults = [...results, ...prepareFailures].sort((a, b) => a.index - b.index);
             const successCount = allResults.filter((r) => r.success).length;
-            await this.waitForDialogClose(dialog, cleanup);
+            await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
+            this.emitTelemetry("batch.sign.succeeded", telemetry, {
+              outcome: "success",
+              intentCount: allResults.length
+            });
             resolve({
               success: successCount === allResults.length,
               results: allResults,
@@ -1136,6 +2838,11 @@ var OneAuthClient = class {
             });
           } else {
             cleanup();
+            this.emitTelemetry("batch.sign.failed", telemetry, {
+              outcome: "failure",
+              errorCode: "SIGNING_FAILED",
+              errorMessage: "Batch signing failed or was cancelled"
+            });
             resolve({
               success: false,
               results: [],
@@ -1147,6 +2854,11 @@ var OneAuthClient = class {
         if (message?.type === "PASSKEY_CLOSE") {
           window.removeEventListener("message", handleMessage);
           cleanup();
+          this.emitTelemetry("dialog.cancelled", telemetry, {
+            outcome: "cancelled",
+            errorCode: "USER_CANCELLED",
+            errorMessage: "User closed the batch dialog"
+          });
           resolve({
             success: false,
             results: [],
@@ -1158,6 +2870,15 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
     window.removeEventListener("message", handleBatchReReady);
+    this.emitTelemetry("batch.completed", telemetry, {
+      outcome: batchResult.success ? "success" : "failure",
+      intentCount: batchResult.results.length,
+      attributes: {
+        successCount: batchResult.successCount,
+        failureCount: batchResult.failureCount
+      },
+      ...batchResult.error ? { errorMessage: batchResult.error } : {}
+    });
     return batchResult;
   }
   /**
@@ -1276,6 +2997,7 @@ var OneAuthClient = class {
               signedHash: payload.signedHash
             });
           } else {
+            cleanup();
             resolve({
               success: false,
               error: message.error || {
@@ -1358,6 +3080,7 @@ var OneAuthClient = class {
               signedHash: payload.signedHash
             });
           } else {
+            cleanup();
             resolve({
               success: false,
               error: message.error || {
@@ -1418,6 +3141,56 @@ var OneAuthClient = class {
       dialog.addEventListener("close", handleClose);
     });
   }
+  /**
+   * Hidden blind-signing iframes have no user-visible Done or Close button.
+   * Once the SDK has the result it needs, tear them down immediately instead
+   * of waiting for an iframe close event that can never be clicked.
+   */
+  async waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup) {
+    if (blindSigning) {
+      cleanup();
+      return;
+    }
+    await this.waitForDialogClose(dialog, cleanup);
+  }
+  /**
+   * After a prepare error has been surfaced in the dialog, wait for the user
+   * to either close the dialog (give up) or click "Try Again", which the
+   * dialog forwards as `PASSKEY_RETRY_PREPARE`.
+   *
+   * On `"closed"` the dialog has been cleaned up; on `"retry"` it stays open
+   * (showing its loading skeleton) while the caller re-runs prepare. Without
+   * this, "Try Again" after a prepare failure was a dead end: the dialog
+   * reset its local state but the SDK had already given up, so the quote
+   * never arrived and the Sign button stayed disabled forever.
+   */
+  waitForPrepareRetryOrClose(dialog, cleanup) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      const stop = () => {
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.data?.type === "PASSKEY_RETRY_PREPARE") {
+          stop();
+          resolve("retry");
+        } else if (event.data?.type === "PASSKEY_CLOSE") {
+          stop();
+          cleanup();
+          resolve("closed");
+        }
+      };
+      const handleClose = () => {
+        stop();
+        cleanup();
+        resolve("closed");
+      };
+      window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
+    });
+  }
   /**
    * Inject a `<link rel="preconnect">` tag for the given URL's origin.
    *
@@ -1463,7 +3236,7 @@ var OneAuthClient = class {
    * @returns `{ ready: true, sendInit }` when the iframe is ready, or
    *   `{ ready: false }` if the dialog was closed or timed out first.
    */
-  waitForDialogReadyDeferred(dialog, iframe, cleanup) {
+  waitForDialogReadyDeferred(dialog, iframe, cleanup, options = {}) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       let settled = false;
@@ -1477,12 +3250,15 @@ var OneAuthClient = class {
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         if (event.data?.type === "PASSKEY_READY") {
+          const blindSigning = options.blindSigning === true;
           teardown();
           resolve({
             ready: true,
+            blindSigning,
             sendInit: (initMessage) => {
+              if (blindSigning) iframe.focus({ preventScroll: true });
               iframe.contentWindow?.postMessage(
-                { type: "PASSKEY_INIT", ...initMessage, fullViewport: true },
+                { type: "PASSKEY_INIT", ...initMessage, fullViewport: true, blindSigning },
                 dialogOrigin
               );
             }
@@ -1523,13 +3299,13 @@ var OneAuthClient = class {
    * @param requestBody - Serialized intent options (bigint amounts converted to
    *   strings before this call).
    * @returns On success: `{ success: true, data: PrepareIntentResponse, tier }`.
-   *   On failure: `{ success: false, error: { code, message } }`.
+   *   On failure: `{ success: false, error: { code, message, details? } }`.
    */
-  async prepareIntent(requestBody) {
+  async prepareIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
         body: JSON.stringify(requestBody)
       });
       if (!response.ok) {
@@ -1542,7 +3318,8 @@ var OneAuthClient = class {
           success: false,
           error: {
             code: errorMessage.includes("User not found") ? "USER_NOT_FOUND" : "PREPARE_FAILED",
-            message: errorMessage
+            message: errorMessage,
+            details: errorData.details ?? errorData.candidateErrors ?? errorData
           }
         };
       }
@@ -1575,11 +3352,11 @@ var OneAuthClient = class {
    * @returns On success: `{ success: true, data: PrepareBatchIntentResponse, tier }`.
    *   On failure: `{ success: false, error, failedIntents? }`.
    */
-  async prepareBatchIntent(requestBody) {
+  async prepareBatchIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
         body: JSON.stringify(requestBody)
       });
       if (!response.ok) {
@@ -1625,15 +3402,28 @@ var OneAuthClient = class {
    * that hasn't completed yet.
    */
   async getIntentStatus(intentId) {
+    const telemetry = this.createTelemetryOperation("status");
+    this.emitTelemetry("intent.status.started", telemetry, {
+      outcome: "started",
+      attributes: { directStatusCheck: true }
+    });
     try {
       const response = await fetch(
         `${this.config.providerUrl}/api/intent/status/${intentId}`,
         {
-          headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+          headers: {
+            ...this.telemetryHeaders(telemetry),
+            ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+          }
         }
       );
       if (!response.ok) {
         const errorData = await response.json().catch(() => ({}));
+        this.emitTelemetry("status.failed", telemetry, {
+          outcome: "failure",
+          errorCode: "STATUS_FAILED",
+          errorMessage: errorData.error || "Failed to get intent status"
+        });
         return {
           success: false,
           intentId,
@@ -1645,6 +3435,10 @@ var OneAuthClient = class {
         };
       }
       const data = await response.json();
+      this.emitTelemetry("status.succeeded", telemetry, {
+        outcome: data.status === "completed" ? "success" : "started",
+        status: data.status
+      });
       return {
         success: data.status === "completed",
         intentId,
@@ -1653,6 +3447,10 @@ var OneAuthClient = class {
         operationId: data.operationId
       };
     } catch (error) {
+      this.emitTelemetry("status.failed", telemetry, {
+        outcome: "failure",
+        ...describeTelemetryError(error)
+      });
       return {
         success: false,
         intentId,
@@ -1684,6 +3482,9 @@ var OneAuthClient = class {
    * ```
    */
   async getIntentHistory(options) {
+    const telemetry = this.createTelemetryOperation("history", {
+      hasStatusFilter: !!options?.status
+    });
     const queryParams = new URLSearchParams();
     if (options?.limit) queryParams.set("limit", String(options.limit));
     if (options?.offset) queryParams.set("offset", String(options.offset));
@@ -1692,184 +3493,183 @@ var OneAuthClient = class {
     if (options?.to) queryParams.set("to", options.to);
     const url = `${this.config.providerUrl}/api/intent/history${queryParams.toString() ? `?${queryParams}` : ""}`;
     const response = await fetch(url, {
-      headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {},
+      headers: {
+        ...this.telemetryHeaders(telemetry),
+        ...this.config.clientId ? { "x-client-id": this.config.clientId } : {}
+      },
       credentials: "include"
     });
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
+      this.emitTelemetry("history.failed", telemetry, {
+        outcome: "failure",
+        errorCode: "HISTORY_FAILED",
+        errorMessage: errorData.error || "Failed to get intent history"
+      });
       throw new Error(errorData.error || "Failed to get intent history");
     }
-    return response.json();
+    const result = await response.json();
+    this.emitTelemetry("history.succeeded", telemetry, {
+      outcome: "success",
+      attributes: {
+        total: result.total,
+        returned: result.intents?.length ?? 0
+      }
+    });
+    return result;
   }
   /**
-   * Send a swap intent through the Rhinestone orchestrator
-   *
-   * This is a high-level abstraction for token swaps (including cross-chain):
-   * 1. Resolves token symbols to addresses
-   * 2. Builds the swap intent with tokenRequests (output-first model)
-   * 3. The orchestrator's solver network finds the best route
-   * 4. Executes via the standard intent flow
-   *
-   * NOTE: The `amount` parameter specifies the OUTPUT amount (what the user wants to receive),
-   * not the input amount. The orchestrator will calculate the required input from sourceAssets.
-   *
-   * @example
-   * ```typescript
-   * // Buy 100 USDC using ETH on Base
-   * const result = await client.sendSwap({
-   *   username: 'alice',
-   *   targetChain: 8453,
-   *   fromToken: 'ETH',
-   *   toToken: 'USDC',
-   *   amount: '100', // Receive 100 USDC
-   * });
-   *
-   * // Cross-chain: Buy 50 USDC on Base, paying with ETH from any chain
-   * const result = await client.sendSwap({
-   *   username: 'alice',
-   *   targetChain: 8453, // Base
-   *   fromToken: 'ETH',
-   *   toToken: 'USDC',
-   *   amount: '50', // Receive 50 USDC
-   * });
-   * ```
+   * Forward a raw EIP-1193 request to the iframe so the active EOA connector
+   * can handle it (wallet-connect session or injected wallet). Opens
+   * `/dialog/sign-eoa`, which looks up the wagmi connector and delegates to
+   * `connector.getProvider().request({ method, params })`. The wallet's own
+   * UI is the review screen; the dialog just transports the request.
    */
-  async sendSwap(options) {
-    try {
-      getChainById(options.targetChain);
-    } catch {
-      return {
-        success: false,
-        intentId: "",
-        status: "failed",
-        error: {
-          code: "INVALID_CHAIN",
-          message: `Unsupported chain: ${options.targetChain}`
-        }
-      };
-    }
-    const resolveToken = (token, label) => {
-      try {
-        const address = resolveTokenAddress(token, options.targetChain);
-        if (!isTokenAddressSupported(address, options.targetChain)) {
-          return {
-            error: `Unsupported ${label}: ${token} on chain ${options.targetChain}`
-          };
-        }
-        return { address };
-      } catch (error) {
-        return {
-          error: error instanceof Error ? error.message : `Unsupported ${label}: ${token} on chain ${options.targetChain}`
-        };
-      }
-    };
-    let fromTokenAddress;
-    if (options.fromToken) {
-      const fromTokenResult = resolveToken(options.fromToken, "fromToken");
-      if (!fromTokenResult.address) {
-        return {
-          success: false,
-          intentId: "",
-          status: "failed",
-          error: {
-            code: "INVALID_TOKEN",
-            message: fromTokenResult.error || `Unknown fromToken: ${options.fromToken}`
-          }
-        };
-      }
-      fromTokenAddress = fromTokenResult.address;
-    }
-    const toTokenResult = resolveToken(options.toToken, "toToken");
-    if (!toTokenResult.address) {
+  async requestWithWallet(options) {
+    const job = this.eoaSerialQueue.then(
+      () => this.doRequestWithWallet(options),
+      () => this.doRequestWithWallet(options)
+    );
+    this.eoaSerialQueue = job.then(
+      () => void 0,
+      () => void 0
+    );
+    return job;
+  }
+  async doRequestWithWallet(options) {
+    const dialogOrigin = this.getDialogOrigin();
+    const ensureResult = await this.ensureEoaDialog(options?.theme);
+    if (!ensureResult.ok) {
       return {
         success: false,
-        intentId: "",
-        status: "failed",
-        error: {
-          code: "INVALID_TOKEN",
-          message: toTokenResult.error || `Unknown toToken: ${options.toToken}`
-        }
+        error: { code: "USER_REJECTED", message: "User closed the dialog" }
       };
     }
-    const toTokenAddress = toTokenResult.address;
-    const formatTokenLabel = (token, fallback) => {
-      if (!token.startsWith("0x")) {
-        return token;
-      }
-      try {
-        return getTokenSymbol(token, options.targetChain);
-      } catch {
-        return fallback;
-      }
+    const { dialog, iframe } = ensureResult;
+    const requestId = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const hideDialog = () => {
+      if (dialog.open) dialog.close();
     };
-    const toSymbol = formatTokenLabel(
-      options.toToken,
-      `${options.toToken.slice(0, 6)}...${options.toToken.slice(-4)}`
+    const responsePromise = this.waitForEoaResponse(
+      iframe,
+      hideDialog,
+      requestId,
+      dialogOrigin
     );
-    const isFromNativeEth = fromTokenAddress ? fromTokenAddress === "0x0000000000000000000000000000000000000000" : false;
-    const isToNativeEth = toTokenAddress === "0x0000000000000000000000000000000000000000";
-    const KNOWN_DECIMALS = {
-      ETH: 18,
-      WETH: 18,
-      USDC: 6,
-      USDT: 6,
-      USDT0: 6
+    const initPayload = {
+      mode: "iframe",
+      method: options.method,
+      params: options.params,
+      expectedAddress: options.expectedAddress,
+      requestId
     };
-    const getDecimals = (symbol, chainId) => {
-      try {
-        const match = getSupportedTokens(chainId).find(
-          (t) => t.symbol.toUpperCase() === symbol.toUpperCase()
+    iframe.contentWindow?.postMessage(
+      { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+      dialogOrigin
+    );
+    const handleReReady = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.source !== iframe.contentWindow) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          dialogOrigin
         );
-        if (match) return match.decimals;
-        return getTokenDecimals(symbol, chainId);
-      } catch {
-        const upperSymbol = symbol.toUpperCase();
-        return KNOWN_DECIMALS[upperSymbol] ?? 18;
       }
     };
-    const toDecimals = getDecimals(options.toToken, options.targetChain);
-    const isBridge = options.fromToken ? options.fromToken.toUpperCase() === options.toToken.toUpperCase() : false;
-    const tokenRequests = [{
-      token: toTokenAddress,
-      amount: parseUnits(options.amount, toDecimals)
-    }];
-    const result = await this.sendIntent({
-      username: options.username,
-      targetChain: options.targetChain,
-      calls: [
-        {
-          // Minimal call - just signals to orchestrator we want the tokenRequests delivered
-          to: toTokenAddress,
-          value: "0",
-          // SDK provides labels so dialog shows "Buy ETH" not "Send ETH / To: 0x000..."
-          label: `Buy ${toSymbol}`,
-          sublabel: `${options.amount} ${toSymbol}`
-        }
-      ],
-      // Request specific output tokens - this is what actually matters for swaps
-      tokenRequests,
-      // Constrain orchestrator to use only the fromToken as input
-      // This ensures the swap uses the correct source token
-      // Use canonical symbol casing from registry (e.g. "MockUSD" not "MOCKUSD")
-      sourceAssets: options.sourceAssets || (options.fromToken ? [options.fromToken] : void 0),
-      // Pass source chain ID so orchestrator knows which chain to look for tokens on
-      sourceChainId: options.sourceChainId,
-      closeOn: options.closeOn || "preconfirmed",
-      waitForHash: options.waitForHash,
-      hashTimeoutMs: options.hashTimeoutMs,
-      hashIntervalMs: options.hashIntervalMs
+    window.addEventListener("message", handleReReady);
+    const result = await responsePromise;
+    window.removeEventListener("message", handleReReady);
+    hideDialog();
+    return result;
+  }
+  /**
+   * Lazily create the persistent `/dialog/sign-eoa` iframe and reveal it.
+   * Subsequent calls just re-open the existing `<dialog>` so the iframe's
+   * in-page state (notably the WalletConnect SignClient) is preserved
+   * between transactions.
+   */
+  async ensureEoaDialog(theme) {
+    if (this.eoaDialogState) {
+      const { dialog: dialog2, iframe: iframe2 } = this.eoaDialogState;
+      if (!dialog2.open) {
+        dialog2.showModal();
+      }
+      return { ok: true, dialog: dialog2, iframe: iframe2 };
+    }
+    const dialogUrl = this.getDialogUrl();
+    const themeParams = this.getThemeParams(theme);
+    const parentOrigin = typeof window !== "undefined" ? window.location.origin : "";
+    const parentOriginParam = parentOrigin ? `&parentOrigin=${encodeURIComponent(parentOrigin)}` : "";
+    const signingUrl = `${dialogUrl}/dialog/sign-eoa?mode=iframe${parentOriginParam}${themeParams ? `&${themeParams}` : ""}`;
+    const { dialog, iframe, destroy } = this.createModalDialog(signingUrl, {
+      persistent: true
+    });
+    const ready = await this.waitForEoaIframeReady(iframe);
+    if (!ready) {
+      destroy();
+      return { ok: false };
+    }
+    this.eoaDialogState = { dialog, iframe };
+    return { ok: true, dialog, iframe };
+  }
+  waitForEoaIframeReady(iframe) {
+    const dialogOrigin = this.getDialogOrigin();
+    return new Promise((resolve) => {
+      let timeoutId = null;
+      const cleanup = () => {
+        if (timeoutId !== null) clearTimeout(timeoutId);
+        window.removeEventListener("message", handler);
+      };
+      const handler = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.source !== iframe.contentWindow) return;
+        if (event.data?.type === "PASSKEY_READY") {
+          cleanup();
+          resolve(true);
+        }
+      };
+      window.addEventListener("message", handler);
+      timeoutId = setTimeout(() => {
+        cleanup();
+        resolve(false);
+      }, 1e4);
+    });
+  }
+  waitForEoaResponse(iframe, cleanup, requestId, dialogOrigin) {
+    return new Promise((resolve) => {
+      const handleMessage = (event) => {
+        if (event.origin !== dialogOrigin) return;
+        if (event.source !== iframe.contentWindow) return;
+        const message = event.data;
+        if (message?.type === "PASSKEY_EOA_RESULT" || message?.type === "PASSKEY_EOA_CLOSE") {
+          if (message.requestId !== requestId) return;
+        } else {
+          return;
+        }
+        window.removeEventListener("message", handleMessage);
+        if (message.type === "PASSKEY_EOA_CLOSE") {
+          cleanup();
+          resolve({
+            success: false,
+            error: { code: "USER_REJECTED", message: "User closed the dialog" }
+          });
+          return;
+        }
+        if (message.success) {
+          resolve({ success: true, result: message.data?.result });
+        } else {
+          resolve({
+            success: false,
+            error: message.error || {
+              code: "EOA_REQUEST_FAILED",
+              message: "Wallet request failed"
+            }
+          });
+        }
+      };
+      window.addEventListener("message", handleMessage);
     });
-    return {
-      ...result,
-      quote: result.success ? {
-        fromToken: fromTokenAddress ?? options.fromToken,
-        toToken: toTokenAddress,
-        amountIn: options.amount,
-        amountOut: "",
-        // Filled by orchestrator quote
-        rate: ""
-      } : void 0
-    };
   }
   /**
    * Sign an arbitrary message with the user's passkey
@@ -1900,12 +3700,37 @@ var OneAuthClient = class {
    * ```
    */
   async signMessage(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "message",
+      hasAccountAddress: !!options.accountAddress
+    });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -1921,15 +3746,18 @@ var OneAuthClient = class {
       username: options.username,
       accountAddress: options.accountAddress,
       description: options.description,
-      metadata: options.metadata
+      metadata: options.metadata,
+      telemetry: this.telemetryPayload(telemetry)
     };
     dialogResult.sendInit(initPayload);
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     const dialogOrigin = this.getDialogOrigin();
     const handleReReady = (event) => {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -1939,6 +3767,10 @@ var OneAuthClient = class {
     window.removeEventListener("message", handleReReady);
     cleanup();
     if (signingResult.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signingMode: "message" }
+      });
       return {
         success: true,
         signature: signingResult.signature,
@@ -1947,6 +3779,15 @@ var OneAuthClient = class {
         passkey: signingResult.passkey
       };
     }
+    this.emitTelemetry(
+      signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+      telemetry,
+      {
+        outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+        ...describeTelemetryError(signingResult.error),
+        attributes: { signingMode: "message" }
+      }
+    );
     return {
       success: false,
       error: signingResult.error
@@ -1994,6 +3835,11 @@ var OneAuthClient = class {
    * ```
    */
   async signTypedData(options) {
+    const telemetry = this.createTelemetryOperation("sign", {
+      signingMode: "typedData",
+      primaryType: options.primaryType,
+      hasAccountAddress: !!options.accountAddress
+    });
     const signedHash = hashTypedData({
       domain: options.domain,
       types: options.types,
@@ -2001,11 +3847,32 @@ var OneAuthClient = class {
       message: options.message
     });
     const dialogUrl = this.getDialogUrl();
+    const params = new URLSearchParams({ mode: "iframe" });
+    this.appendTelemetryParams(params, telemetry);
     const themeParams = this.getThemeParams(options?.theme);
-    const signingUrl = `${dialogUrl}/dialog/sign?mode=iframe${themeParams ? `&${themeParams}` : ""}`;
-    const { dialog, iframe, cleanup } = this.createModalDialog(signingUrl);
-    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup);
+    if (themeParams) {
+      const themeParsed = new URLSearchParams(themeParams);
+      themeParsed.forEach((value, key) => params.set(key, value));
+    }
+    const signingUrl = `${dialogUrl}/dialog/sign?${params.toString()}`;
+    const requestedBlindSigning = this.shouldRequestBlindSigning(options);
+    const { dialog, iframe, cleanup, reveal } = this.createModalDialog(signingUrl, {
+      hidden: requestedBlindSigning
+    });
+    this.emitTelemetry("dialog.opened", telemetry, {
+      outcome: "started",
+      attributes: { blindSigning: requestedBlindSigning }
+    });
+    const dialogResult = await this.waitForDialogReadyDeferred(dialog, iframe, cleanup, {
+      blindSigning: requestedBlindSigning,
+      reveal
+    });
     if (!dialogResult.ready) {
+      this.emitTelemetry("dialog.cancelled", telemetry, {
+        outcome: "cancelled",
+        errorCode: "USER_REJECTED",
+        errorMessage: "User closed the dialog before signing"
+      });
       return {
         success: false,
         error: {
@@ -2026,15 +3893,18 @@ var OneAuthClient = class {
       challenge: signedHash,
       username: options.username,
       accountAddress: options.accountAddress,
-      description: options.description
+      description: options.description,
+      telemetry: this.telemetryPayload(telemetry)
     };
     dialogResult.sendInit(initPayload);
+    const blindSigning = dialogResult.blindSigning;
+    this.emitTelemetry("dialog.ready", telemetry, { outcome: "started" });
     const dialogOrigin = this.getDialogOrigin();
     const handleReReady = (event) => {
       if (event.origin !== dialogOrigin) return;
       if (event.data?.type === "PASSKEY_READY") {
         iframe.contentWindow?.postMessage(
-          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true, blindSigning },
           dialogOrigin
         );
       }
@@ -2044,6 +3914,10 @@ var OneAuthClient = class {
     window.removeEventListener("message", handleReReady);
     cleanup();
     if (signingResult.success) {
+      this.emitTelemetry("sign.succeeded", telemetry, {
+        outcome: "success",
+        attributes: { signingMode: "typedData", primaryType: options.primaryType }
+      });
       return {
         success: true,
         signature: signingResult.signature,
@@ -2051,6 +3925,15 @@ var OneAuthClient = class {
         passkey: signingResult.passkey
       };
     }
+    this.emitTelemetry(
+      signingResult.error?.code === "USER_REJECTED" ? "dialog.cancelled" : "sign.failed",
+      telemetry,
+      {
+        outcome: signingResult.error?.code === "USER_REJECTED" ? "cancelled" : "failure",
+        ...describeTelemetryError(signingResult.error),
+        attributes: { signingMode: "typedData", primaryType: options.primaryType }
+      }
+    );
     return {
       success: false,
       error: signingResult.error
@@ -2122,8 +4005,66 @@ var OneAuthClient = class {
       options.onReady?.();
     };
     options.container.appendChild(iframe);
+    this.wireViewportInfo(iframe);
+    const host = new URL(dialogUrl);
+    const onResize = (event) => {
+      if (event.source !== iframe.contentWindow) return;
+      if (event.origin !== host.origin) return;
+      if (event.data?.type !== "PASSKEY_RESIZE") return;
+      const h = Number(event.data.height);
+      if (Number.isFinite(h) && h > 0) {
+        iframe.style.height = `${h}px`;
+      }
+    };
+    window.addEventListener("message", onResize);
     return iframe;
   }
+  /**
+   * Post `PASSKEY_VIEWPORT_INFO` with the parent's
+   * `window.innerHeight` to the iframe whenever it signals
+   * `PASSKEY_READY`, and re-post on `window.resize` (rAF-debounced)
+   * so the dialog's internal max-height cap follows the user's
+   * actual screen.
+   *
+   * Inside the iframe, `vh`/`dvh` units refer to the iframe's own
+   * height (recursive when the iframe auto-sizes), so the parent is
+   * the only reliable source of "what 75% of the user's screen is".
+   * The dialog stores the value in `dialog-context` and falls back
+   * to auto-grow when the value is absent — so it's safe to call
+   * this even for embedders that don't actually cap (modal mode
+   * uses `fullViewport` which has its own outer cap).
+   */
+  wireViewportInfo(iframe) {
+    const dialogOrigin = this.getDialogOrigin();
+    const post = () => {
+      iframe.contentWindow?.postMessage(
+        { type: "PASSKEY_VIEWPORT_INFO", height: window.innerHeight },
+        dialogOrigin
+      );
+    };
+    const handleMessage = (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.source !== iframe.contentWindow) return;
+      if (event.data?.type === "PASSKEY_READY") {
+        post();
+      }
+    };
+    window.addEventListener("message", handleMessage);
+    let raf = null;
+    const onResize = () => {
+      if (raf !== null) return;
+      raf = requestAnimationFrame(() => {
+        raf = null;
+        post();
+      });
+    };
+    window.addEventListener("resize", onResize);
+    return () => {
+      window.removeEventListener("message", handleMessage);
+      window.removeEventListener("resize", onResize);
+      if (raf !== null) cancelAnimationFrame(raf);
+    };
+  }
   /**
    * Listen for a signing result from an embedded (inline) signing iframe.
    *
@@ -2258,6 +4199,7 @@ var OneAuthClient = class {
         body: JSON.stringify({
           ...this.config.clientId && { clientId: this.config.clientId },
           username: options.username,
+          accountAddress: options.accountAddress,
           challenge: options.challenge,
           description: options.description,
           metadata: options.metadata,
@@ -2313,7 +4255,7 @@ var OneAuthClient = class {
    * @returns `true` if the dialog is ready and init was sent; `false` if the
    *   dialog was closed or timed out before becoming ready.
    */
-  waitForDialogReady(dialog, iframe, cleanup, initMessage) {
+  waitForDialogReady(dialog, iframe, cleanup, initMessage, options = {}) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       let settled = false;
@@ -2327,11 +4269,14 @@ var OneAuthClient = class {
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         if (event.data?.type === "PASSKEY_READY") {
+          const blindSigning = options.blindSigning === true;
           teardown();
+          if (blindSigning) iframe.focus({ preventScroll: true });
           iframe.contentWindow?.postMessage({
             type: "PASSKEY_INIT",
             ...initMessage,
-            fullViewport: true
+            fullViewport: true,
+            blindSigning
           }, dialogOrigin);
           resolve(true);
         } else if (event.data?.type === "PASSKEY_CLOSE") {
@@ -2356,7 +4301,7 @@ var OneAuthClient = class {
   /**
    * Create and open a full-viewport `<dialog>` containing a passkey iframe.
    *
-   * The SDK owns only the transparent outer shell; all visible UI (backdrop,
+   * The SDK owns only the hidden outer shell; all visible UI (backdrop,
    * card, animations, close button) is rendered by the passkey app inside the
    * iframe. This approach means design changes can be shipped server-side
    * without updating SDK consumers.
@@ -2378,34 +4323,42 @@ var OneAuthClient = class {
    *     restores those as well.
    *   - The iframe sandbox includes `allow-popups-to-escape-sandbox` so that
    *     1Password's popup UI can render outside the sandboxed context.
+   *   - `allow-downloads` lets the passkey iframe trigger the recovery-key
+   *     JSON fallback download without sending sensitive data to the parent.
    *
    * @param url - The full URL (including query params) to load in the iframe.
    * @returns References to the dialog, iframe, and a cleanup function.
    */
-  createModalDialog(url) {
+  createModalDialog(url, options) {
     const dialogUrl = this.getDialogUrl();
     const hostUrl = new URL(dialogUrl);
     const urlParams = new URL(url, window.location.href).searchParams;
     const themeMode = urlParams.get("theme") || "light";
-    const accentColor = urlParams.get("accent") || "#0090ff";
     const isDark = themeMode === "dark" || themeMode !== "light" && window.matchMedia("(prefers-color-scheme: dark)").matches;
-    const bgPrimary = isDark ? "#191919" : "#fcfcfc";
-    const bgSecondary = isDark ? "#222222" : "#f9f9f9";
-    const borderColor = isDark ? "#2a2a2a" : "#e0e0e0";
-    const textPrimary = isDark ? "#eeeeee" : "#202020";
-    const textSecondary = isDark ? "#7b7b7b" : "#838383";
-    const bgSurface = isDark ? "#222222" : "#f0f0f0";
-    const ah = accentColor.replace("#", "");
-    const accentRgb = `${parseInt(ah.slice(0, 2), 16)},${parseInt(ah.slice(2, 4), 16)},${parseInt(ah.slice(4, 6), 16)}`;
-    const accentTint = isDark ? `rgba(${accentRgb},0.15)` : `rgba(${accentRgb},0.1)`;
-    const hostname = window.location.hostname;
+    const theme = isDark ? DARK_TOKENS : LIGHT_TOKENS;
+    const { bgPrimary, borderColor, textPrimary, textSecondary } = theme;
+    const textFooter = FOOTER_TEXT_COLOR;
+    const spinnerColor = BRAND_PURPLE;
     const dialog = document.createElement("dialog");
     dialog.dataset.passkey = "";
+    if (options?.hidden) {
+      dialog.dataset.passkeyHidden = "";
+    }
     dialog.style.opacity = "1";
     dialog.style.background = "transparent";
     document.body.appendChild(dialog);
     const style = document.createElement("style");
     style.textContent = `
+      /* Load Inter so the overlay's title/subtitle widths match the
+         iframe (which loads Inter via next/font). Without this, host
+         pages on Arial / system-ui produce wider text that wraps to two
+         lines and breaks the visual match with the Figma. font-display:
+         swap renders immediately with a fallback and swaps when Inter
+         is ready \u2014 usually well before PASSKEY_RENDERED fires, but the
+         overlay is short-lived either way so a single-frame swap is
+         acceptable. */
+      @import url('https://fonts.googleapis.com/css2?family=Inter:wght@500;700&display=swap');
+
       dialog[data-passkey] {
         position: fixed;
         top: 0;
@@ -2427,6 +4380,22 @@ var OneAuthClient = class {
       dialog[data-passkey]::backdrop {
         background: transparent !important;
       }
+      dialog[data-passkey][data-passkey-hidden] {
+        width: 1px;
+        height: 1px;
+        max-width: 1px;
+        max-height: 1px;
+        opacity: 0;
+        pointer-events: none;
+      }
+      dialog[data-passkey][data-passkey-hidden] iframe {
+        width: 1px;
+        height: 1px;
+        opacity: 0 !important;
+        pointer-events: none;
+        backdrop-filter: none;
+        -webkit-backdrop-filter: none;
+      }
       dialog[data-passkey] iframe {
         position: fixed;
         top: 0;
@@ -2447,34 +4416,56 @@ var OneAuthClient = class {
         width: 100%;
         height: 100%;
         display: flex;
-        align-items: flex-start;
+        align-items: center;
         justify-content: center;
-        padding-top: 50px;
         background: rgba(0, 0, 0, 0.4);
         backdrop-filter: blur(8px);
         -webkit-backdrop-filter: blur(8px);
         z-index: 1;
+        /* Purely a visual loading screen \u2014 never intercept clicks.
+           If the iframe's X button or backdrop-dismiss area happens to
+           be reachable while the overlay is still painting (slow CI
+           runners, redirect remounts), the click goes straight through
+           instead of being trapped by the SDK preload. The previous
+           rAF-deferred display:none lost this race in GitHub Actions
+           \u2014 dialog-close.spec.ts repeatedly hit
+           "<div data-passkey-overlay> intercepts pointer events". */
+        pointer-events: none;
         animation: _1auth-backdrop-in 0.2s ease-out;
       }
-      @media (max-width: 768px) {
-        dialog[data-passkey] [data-passkey-overlay] {
-          align-items: flex-end;
-          padding-top: 0;
-        }
+      dialog[data-passkey][data-passkey-hidden] [data-passkey-overlay] {
+        display: none;
       }
       dialog[data-passkey] [data-passkey-card] {
-        width: 340px;
-        overflow: hidden;
-        border-radius: 14px;
-        box-shadow: 0 8px 32px rgba(0,0,0,0.12), 0 2px 8px rgba(0,0,0,0.08);
+        width: ${LOADING_MODAL_WIDTH}px;
+        box-sizing: border-box;
+        padding: ${LOADING_MODAL_PADDING}px;
+        border-radius: ${LOADING_MODAL_RADIUS}px;
+        box-shadow: inset 0 0 0 1px ${borderColor};
         animation: _1auth-card-in 0.2s cubic-bezier(0.32, 0.72, 0, 1);
-        max-height: calc(100dvh - 100px);
+        max-height: 100dvh;
+        overflow-y: auto;
+        display: flex;
+        flex-direction: column;
+        gap: ${LOADING_CARD_GAP}px;
+        font-family: ${LOADING_FONT_FAMILY};
+        /* line-height: normal must be set on the card so the host page's
+           Tailwind preflight (line-height: 1.5 on <body>) doesn't bleed
+           into our card via inheritance \u2014 that's what made the SDK preload
+           render taller than the iframe screen. */
+        line-height: ${LOADING_LINE_HEIGHT};
+        -webkit-font-smoothing: antialiased;
+        -moz-osx-font-smoothing: grayscale;
       }
-      @media (max-width: 768px) {
+      @media (max-width: ${LOADING_MOBILE_BREAKPOINT - 1}px) {
+        dialog[data-passkey] [data-passkey-overlay] {
+          align-items: flex-end;
+        }
         dialog[data-passkey] [data-passkey-card] {
           width: 100%;
           border-bottom-left-radius: 0;
           border-bottom-right-radius: 0;
+          padding-bottom: calc(${LOADING_MODAL_PADDING}px + env(safe-area-inset-bottom));
           animation: _1auth-card-slide 0.3s cubic-bezier(0.32, 0.72, 0, 1);
         }
       }
@@ -2497,13 +4488,11 @@ var OneAuthClient = class {
     dialog.appendChild(style);
     const overlay = document.createElement("div");
     overlay.dataset.passkeyOverlay = "";
-    const _sp = '<path d="M10 0.5C8.02219 0.5 6.08879 1.08649 4.4443 2.1853C2.79981 3.28412 1.51809 4.8459 0.761209 6.67316C0.00433288 8.50043 -0.1937 10.5111 0.192152 12.4509C0.578004 14.3907 1.53041 16.1725 2.92894 17.5711C4.32746 18.9696 6.10929 19.922 8.0491 20.3078C9.98891 20.6937 11.9996 20.4957 13.8268 19.7388C15.6541 18.9819 17.2159 17.7002 18.3147 16.0557C19.4135 14.4112 20 12.4778 20 10.5C20 7.84783 18.9464 5.3043 17.0711 3.42893C15.1957 1.55357 12.6522 0.5 10 0.5ZM10 17.7727C8.56159 17.7727 7.15549 17.3462 5.95949 16.547C4.7635 15.7479 3.83134 14.6121 3.28088 13.2831C2.73042 11.9542 2.5864 10.4919 2.86702 9.08116C3.14764 7.67039 3.8403 6.37451 4.85741 5.3574C5.87452 4.3403 7.17039 3.64764 8.58116 3.36702C9.99193 3.0864 11.4542 3.23042 12.7832 3.78088C14.1121 4.33133 15.2479 5.26349 16.0471 6.45949C16.8462 7.65548 17.2727 9.06159 17.2727 10.5C17.2727 12.4288 16.5065 14.2787 15.1426 15.6426C13.7787 17.0065 11.9288 17.7727 10 17.7727Z" fill="currentColor" opacity="0.3"/><path d="M10 3.22767C11.7423 3.22846 13.4276 3.8412 14.7556 4.95667C16.0837 6.07214 16.9681 7.61784 17.2512 9.31825C17.3012 9.64364 17.4662 9.94096 17.7169 10.1573C17.9677 10.3737 18.2878 10.4951 18.6205 10.5C18.8211 10.5001 19.0193 10.457 19.2012 10.3735C19.3832 10.2901 19.5445 10.1684 19.674 10.017C19.8036 9.86549 19.8981 9.68789 19.9511 9.49656C20.004 9.30523 20.0141 9.10478 19.9807 8.90918C19.5986 6.56305 18.3843 4.42821 16.5554 2.88726C14.7265 1.34631 12.4025 0.5 10 0.5C7.59751 0.5 5.27354 1.34631 3.44461 2.88726C1.61569 4.42821 0.401366 6.56305 0.0192815 8.90918C-0.0141442 9.10478 -0.00402016 9.30523 0.0489472 9.49656C0.101914 9.68789 0.196449 9.86549 0.325956 10.017C0.455463 10.1684 0.616823 10.2901 0.798778 10.3735C0.980732 10.457 1.1789 10.5001 1.37945 10.5C1.71216 10.4951 2.03235 10.3737 2.28307 10.1573C2.5338 9.94096 2.69883 9.64364 2.74882 9.31825C3.03193 7.61784 3.91633 6.07214 5.24436 4.95667C6.57239 3.8412 8.25775 3.22846 10 3.22767Z" fill="currentColor"/>';
-    overlay.innerHTML = `<div data-passkey-card style="background:${bgPrimary};border:1px solid ${borderColor};font-family:ui-sans-serif,system-ui,sans-serif,'Apple Color Emoji','Segoe UI Emoji'"><div style="height:36px;display:flex;align-items:center;justify-content:space-between;padding:0 12px;background:${bgSecondary};border-bottom:1px solid ${borderColor}"><div style="display:flex;align-items:center;gap:8px"><div style="display:flex;width:20px;height:20px;align-items:center;justify-content:center;border-radius:4px;background:${bgSurface}"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="${textPrimary}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12V7H5a2 2 0 0 1 0-4h14v4"/><path d="M3 5v14a2 2 0 0 0 2 2h16v-5"/><path d="M18 12a2 2 0 0 0 0 4h4v-4Z"/></svg></div><span style="font-size:13px;font-weight:500;color:${textPrimary};max-width:200px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${hostname}</span><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="${textSecondary}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"/><path d="m9 12 2 2 4-4"/></svg></div><div style="display:flex;align-items:center;gap:4px"><div style="display:flex;width:24px;height:24px;align-items:center;justify-content:center;border-radius:6px;color:${textSecondary}"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/></svg></div><button data-passkey-close style="display:flex;width:24px;height:24px;align-items:center;justify-content:center;border-radius:6px;color:${textSecondary};border:none;background:none;cursor:pointer;padding:0"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></svg></button></div></div><div style="padding:12px"><div style="display:flex;align-items:center;gap:8px"><div style="display:flex;width:32px;height:32px;min-width:32px;align-items:center;justify-content:center;border-radius:50%;background:${accentTint};padding:6px"><svg style="width:100%;height:100%;animation:_1auth-spin 0.8s linear infinite;color:${accentColor}" fill="none" viewBox="0 0 20 21" xmlns="http://www.w3.org/2000/svg">${_sp}</svg></div><div style="font-weight:500;font-size:18px;color:${textPrimary}">Loading...</div></div><div style="margin-top:8px"><div style="font-size:15px;line-height:20px;color:${textPrimary}">This will only take a few moments.</div><div style="font-size:15px;line-height:20px;color:${textSecondary}">Please do not close the window.</div></div></div></div>`;
-    overlay.addEventListener("click", (e) => {
-      if (e.target === overlay) cleanup();
-    });
-    const overlayCloseBtn = overlay.querySelector("[data-passkey-close]");
-    if (overlayCloseBtn) overlayCloseBtn.addEventListener("click", () => cleanup());
+    const spinnerCenter = SPINNER_SIZE / 2;
+    const spinnerGap = SPINNER_CIRCUMFERENCE - SPINNER_ARC;
+    const spinnerSvg = `<svg style="position:absolute;inset:0;width:100%;height:100%;animation:_1auth-spin 0.8s linear infinite;color:${spinnerColor}" viewBox="0 0 ${SPINNER_SIZE} ${SPINNER_SIZE}" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="${spinnerCenter}" cy="${spinnerCenter}" r="${SPINNER_RADIUS}" stroke="currentColor" opacity="0.3" stroke-width="${SPINNER_STROKE}"/><circle cx="${spinnerCenter}" cy="${spinnerCenter}" r="${SPINNER_RADIUS}" stroke="currentColor" stroke-width="${SPINNER_STROKE}" stroke-linecap="round" stroke-dasharray="${SPINNER_ARC} ${spinnerGap}" transform="rotate(-90 ${spinnerCenter} ${spinnerCenter})"/></svg>`;
+    const rhinestoneLogo = `<svg width="${LOGO_WIDTH}" height="${LOGO_HEIGHT}" viewBox="0 0 72 16" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path opacity="0.5" fill-rule="evenodd" clip-rule="evenodd" d="M10.4767 14.815C9.80706 15.3364 9.0433 15.7628 8.08753 15.8207C7.91561 15.8312 7.74321 15.8312 7.5713 15.8207C6.616 15.7628 5.85177 15.336 5.18212 14.815C4.56047 14.3303 3.87765 13.648 3.10071 12.871L2.9713 12.7416C2.19483 11.9647 1.51153 11.2818 1.02777 10.6602C0.505414 9.99055 0.0790608 9.22679 0.0211784 8.27102C0.0106814 8.0991 0.0106814 7.9267 0.0211784 7.75479C0.0790608 6.79949 0.505884 6.03526 1.02683 5.36561C1.51153 4.74349 2.19388 4.06114 2.97083 3.2842L3.03577 3.21926L3.10024 3.15479C3.87718 2.37784 4.56 1.69502 5.18165 1.21079C5.85177 0.689374 6.61647 0.26255 7.57177 0.205138C7.74368 0.194641 7.91608 0.194641 8.088 0.205138C9.04377 0.26255 9.80753 0.689374 10.4772 1.21079C11.0993 1.69502 11.7816 2.37784 12.5586 3.15431L12.6885 3.2842C13.4649 4.06067 14.1478 4.74349 14.632 5.36561C15.1534 6.03526 15.5802 6.79902 15.6381 7.75479C15.6485 7.92671 15.6485 8.09879 15.6381 8.27102C15.5802 9.22632 15.1534 9.99055 14.632 10.6602C14.1478 11.2818 13.4649 11.9647 12.6885 12.7416L12.6235 12.8061L12.5586 12.871C11.7821 13.6475 11.0993 14.3308 10.4772 14.8146M1.58306 8.17643C1.64518 9.20326 2.47718 10.0353 4.14212 11.7002C5.80706 13.3647 6.64 14.1971 7.66588 14.2588C7.77506 14.2654 7.88424 14.2654 7.99341 14.2588C9.0193 14.1967 9.85224 13.3647 11.5167 11.6997C13.1812 10.0348 14.0136 9.20279 14.0758 8.17596C14.0821 8.06688 14.0821 7.95752 14.0758 7.84843C14.0136 6.82255 13.1816 5.98961 11.5167 4.32514C9.85177 2.66067 9.01977 1.8282 7.99341 1.76608C7.88433 1.75974 7.77497 1.75974 7.66588 1.76608C6.63953 1.8282 5.80706 2.6602 4.14212 4.32514C2.47765 5.98961 1.64518 6.82208 1.58306 7.84843C1.57672 7.95752 1.57672 8.06735 1.58306 8.17643Z" fill="${textFooter}"/><path d="M3.65796 8.01173C3.65796 7.84138 3.7789 7.69549 3.94455 7.65597C4.78502 7.45502 5.44714 7.1402 6.0029 6.64797C6.16666 6.50271 6.32102 6.34836 6.46596 6.18491C6.95819 5.62914 7.27302 4.96702 7.47396 4.12655C7.49245 4.04577 7.53761 3.97356 7.60215 3.92157C7.66669 3.86958 7.74685 3.84084 7.82972 3.83997C8.00008 3.83997 8.14596 3.96044 8.18549 4.12655C8.3869 4.96702 8.70125 5.62914 9.19349 6.18491C9.33874 6.34836 9.4931 6.50271 9.65655 6.64797C10.2123 7.1402 10.8744 7.45502 11.7154 7.65597C11.7961 7.67455 11.8682 7.71975 11.9201 7.78428C11.972 7.84881 12.0006 7.92892 12.0015 8.01173C12.0006 8.09454 11.972 8.17465 11.9201 8.23918C11.8682 8.30371 11.7961 8.34891 11.7154 8.3675C10.8744 8.56844 10.2128 8.88326 9.65655 9.37549C9.4931 9.52075 9.33874 9.6751 9.19349 9.83855C8.70125 10.3943 8.38643 11.0564 8.18549 11.8969C8.16699 11.9777 8.12184 12.0499 8.0573 12.1019C7.99276 12.1539 7.91259 12.1826 7.82972 12.1835C7.74685 12.1826 7.66669 12.1539 7.60215 12.1019C7.53761 12.0499 7.49245 11.9777 7.47396 11.8969C7.27302 11.0564 6.95819 10.3943 6.46596 9.83855C6.32069 9.67537 6.16608 9.52076 6.0029 9.37549C5.44714 8.88326 4.78502 8.56844 3.94455 8.3675C3.86376 8.349 3.79156 8.30384 3.73957 8.23931C3.68758 8.17477 3.65883 8.0946 3.65796 8.01173Z" fill="${textFooter}"/><path d="M30.1186 4.56946C30.1186 5.08193 30.5031 5.44476 31.08 5.44476C31.6569 5.44476 32.0306 5.08193 32.0306 4.56946C32.0306 4.04711 31.6569 3.70593 31.08 3.70593C30.5031 3.70593 30.1186 4.04711 30.1186 4.56993M30.3106 6.00946V11.3422H31.8494V6.00946H30.3106ZM25.9115 11.3422H24.3732V3.87676H25.9115V6.86311C26.1572 6.35111 26.7129 5.84946 27.5035 5.84946C28.7958 5.84946 29.3835 6.68146 29.3835 8.13182V11.3422H27.8447V8.30264C27.8447 7.53464 27.5031 7.14029 26.9158 7.14029C26.2532 7.14029 25.9115 7.67346 25.9115 8.44146V11.3422ZM21.4682 11.3422H19.9304V6.00946H21.4687L21.1977 7.23299C21.1939 7.25002 21.1941 7.26767 21.1981 7.28464C21.202 7.30161 21.2098 7.31747 21.2207 7.33106C21.2316 7.34465 21.2455 7.35561 21.2612 7.36315C21.2769 7.3707 21.2941 7.37462 21.3115 7.37464C21.3657 7.37464 21.4127 7.33699 21.4268 7.28429C21.656 6.44193 22.3482 5.92429 23.0602 5.92429C23.3379 5.92429 23.5087 5.94546 23.6264 5.96664V7.38546C23.4061 7.36702 23.1853 7.35635 22.9642 7.35346C22.2913 7.35346 21.4687 7.66264 21.4687 9.34782L21.4682 11.3422ZM34.4626 11.3422H32.9242V6.00946H34.4631L34.4414 6.90546C34.6871 6.38311 35.264 5.84946 36.0546 5.84946C37.3473 5.84946 37.9346 6.68146 37.9346 8.13182V11.3422H36.3962V8.30264C36.3962 7.53464 36.0546 7.14029 35.4668 7.14029C34.8047 7.14029 34.4626 7.67346 34.4626 8.44146V11.3422Z" fill="${textFooter}"/><path fill-rule="evenodd" clip-rule="evenodd" d="M38.7355 8.68664C38.7355 10.3186 39.7506 11.513 41.4489 11.513C42.9548 11.513 43.7567 10.6918 43.9915 9.78499L42.56 9.51864C42.464 9.89182 42.0899 10.3398 41.4381 10.3398C40.7652 10.3398 40.2099 9.74217 40.1991 9.02782H44.0024C44.0344 8.89982 44.0555 8.71864 44.0555 8.47346C44.0555 6.92711 42.9016 5.83911 41.4598 5.83911C39.9534 5.83911 38.7355 7.04382 38.7355 8.68664ZM42.56 8.11064H40.2527C40.267 7.80585 40.3982 7.51829 40.6191 7.30777C40.8399 7.09724 41.1335 6.97995 41.4386 6.98029C42.0362 6.98029 42.5812 7.42829 42.56 8.11064Z" fill="${textFooter}"/><path d="M47.1016 11.513C45.8946 11.513 44.7732 11.097 44.5487 9.85982L45.9802 9.64664C46.1511 10.201 46.5355 10.4358 47.0805 10.4358C47.5826 10.4358 47.8494 10.201 47.8494 9.89182C47.8494 9.62499 47.6466 9.44382 47.1016 9.33746L46.5995 9.23064C45.5101 9.00664 44.8264 8.50546 44.8264 7.62029C44.8264 6.56429 45.7449 5.83911 47.0805 5.83911C48.3412 5.83911 49.2706 6.42546 49.3986 7.52382L47.9887 7.73746C47.9242 7.21511 47.5609 6.91629 47.0805 6.91629C46.5892 6.91629 46.3322 7.18264 46.3322 7.49229C46.3322 7.73699 46.5035 7.90829 46.9628 8.00429L47.4649 8.09982C48.7365 8.35582 49.3986 8.86782 49.3986 9.84899C49.3986 10.8626 48.3732 11.513 47.1016 11.513Z" fill="${textFooter}"/><path fill-rule="evenodd" clip-rule="evenodd" d="M54.4423 8.67582C54.4423 10.2118 55.5214 11.513 57.2197 11.513C58.9181 11.513 60.008 10.2118 60.008 8.67582C60.008 7.12946 58.9186 5.83911 57.2197 5.83911C55.5209 5.83911 54.4423 7.12946 54.4423 8.67582ZM58.4588 8.67582C58.4588 9.65699 57.8715 10.1266 57.2197 10.1266C56.5788 10.1266 55.991 9.65746 55.991 8.67582C55.991 7.70546 56.5788 7.21464 57.2197 7.21464C57.8715 7.21464 58.4588 7.69464 58.4588 8.67582Z" fill="${textFooter}"/><path d="M62.4071 11.3421H60.8692V6.00937H62.4071L62.3859 6.90536C62.6316 6.38301 63.2085 5.84937 63.9991 5.84937C65.2918 5.84937 65.8791 6.68137 65.8791 8.13172V11.3421H64.3407V8.30254C64.3407 7.53454 63.9991 7.14019 63.4113 7.14019C62.7492 7.14019 62.4071 7.67336 62.4071 8.44137V11.3421Z" fill="${textFooter}"/><path fill-rule="evenodd" clip-rule="evenodd" d="M66.68 8.68664C66.68 10.3186 67.6951 11.513 69.3934 11.513C70.8998 11.513 71.7012 10.6918 71.936 9.78499L70.5045 9.51864C70.4085 9.89182 70.0344 10.3398 69.3826 10.3398C68.7097 10.3398 68.1544 9.74217 68.1435 9.02782H71.9468C71.9788 8.89982 72 8.71864 72 8.47346C72 6.92711 70.8461 5.83911 69.4043 5.83911C67.8979 5.83911 66.68 7.04382 66.68 8.68664ZM70.5045 8.11064H68.1972C68.2111 7.80581 68.3422 7.51812 68.563 7.30754C68.7839 7.09696 69.0775 6.97973 69.3826 6.98029C69.9812 6.98029 70.5257 7.42829 70.5045 8.11064Z" fill="${textFooter}"/><path d="M52.4418 9.04852V7.26217H53.968V6.00005H52.4418V4.42029H50.9124V6.00005H49.8042V7.26217H50.9124V9.10923C50.9124 9.25511 50.9044 9.43394 50.9266 9.59958C50.9647 9.88194 51.0753 10.3384 51.4691 10.7313C51.8626 11.1243 52.32 11.2349 52.6023 11.2725C52.8216 11.3017 53.0654 11.3012 53.2197 11.3008L53.8743 11.3026V9.86923H53.256C52.8687 9.86923 52.6748 9.86923 52.5543 9.74876C52.4414 9.63582 52.4414 9.45793 52.4418 9.11488V9.04852Z" fill="${textFooter}"/></svg>`;
+    overlay.innerHTML = `<div data-passkey-card style="background:${bgPrimary}"><div style="display:flex;width:100%;flex-direction:column;align-items:flex-start;gap:${LOADING_CARD_GAP}px"><div style="display:flex;width:100%;flex-direction:column;align-items:center;gap:${LOADING_BODY_GAP}px"><div style="display:flex;align-items:center;padding:${LOADING_ICON_PADDING}px"><div style="position:relative;width:${SPINNER_SIZE}px;height:${SPINNER_SIZE}px">${spinnerSvg}</div></div><div style="display:flex;width:100%;flex-direction:column;align-items:center;gap:${LOADING_TITLE_BLOCK_GAP}px;text-align:center"><p style="margin:0;font-size:${LOADING_TITLE_FONT_SIZE}px;font-weight:${LOADING_TITLE_FONT_WEIGHT};color:${textPrimary};line-height:${LOADING_LINE_HEIGHT}">${LOADING_TITLE}</p><p style="margin:0;font-size:${LOADING_SUBTITLE_FONT_SIZE}px;font-weight:${LOADING_SUBTITLE_FONT_WEIGHT};color:${textSecondary};line-height:${LOADING_LINE_HEIGHT}">${LOADING_SUBTITLE}</p></div></div><div style="display:flex;width:100%;align-items:center;justify-content:center;gap:${LOADING_FOOTER_GAP}px"><span style="font-size:${LOADING_FOOTER_FONT_SIZE}px;font-weight:${LOADING_FOOTER_FONT_WEIGHT};color:${textFooter};line-height:${LOADING_LINE_HEIGHT}">Powered by</span>` + rhinestoneLogo + `</div></div></div>`;
     dialog.appendChild(overlay);
     const iframe = document.createElement("iframe");
     iframe.setAttribute(
@@ -2519,32 +4508,24 @@ var OneAuthClient = class {
     iframe.setAttribute("tabindex", "0");
     iframe.setAttribute(
       "sandbox",
-      "allow-forms allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox"
+      "allow-forms allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-downloads"
     );
-    iframe.setAttribute("src", url);
     iframe.setAttribute("title", "Passkey");
     iframe.style.opacity = "0";
-    dialog.appendChild(iframe);
-    const inertObserver = new MutationObserver((mutations) => {
-      for (const mutation of mutations) {
-        if (mutation.attributeName === "inert") {
-          dialog.removeAttribute("inert");
-        }
-      }
-    });
-    inertObserver.observe(dialog, { attributes: true });
     let overlayHidden = false;
     const hideOverlay = () => {
       if (overlayHidden) return;
       overlayHidden = true;
       iframe.style.opacity = "1";
+      overlay.style.pointerEvents = "none";
       requestAnimationFrame(() => {
         overlay.style.display = "none";
       });
     };
+    const overlayFailsafe = setTimeout(hideOverlay, 8e3);
     const handleMessage = (event) => {
       if (event.origin !== hostUrl.origin) return;
-      if (event.data?.type === "PASSKEY_RENDERED") {
+      if (event.data?.type === "PASSKEY_RENDERED" || event.data?.type === "PASSKEY_READY") {
         hideOverlay();
       }
       if (event.data?.type === "PASSKEY_DISCONNECT") {
@@ -2552,18 +4533,41 @@ var OneAuthClient = class {
       }
     };
     window.addEventListener("message", handleMessage);
+    const iframeUrl = new URL(url, window.location.href);
+    iframeUrl.searchParams.set("fullViewport", "1");
+    iframe.setAttribute("src", iframeUrl.toString());
+    dialog.appendChild(iframe);
+    const viewportInfoCleanup = this.wireViewportInfo(iframe);
+    const inertObserver = new MutationObserver((mutations) => {
+      for (const mutation of mutations) {
+        if (mutation.attributeName === "inert") {
+          dialog.removeAttribute("inert");
+        }
+      }
+    });
+    inertObserver.observe(dialog, { attributes: true });
     const handleEscape = (event) => {
       if (event.key === "Escape") {
         cleanup();
       }
     };
     document.addEventListener("keydown", handleEscape);
-    dialog.showModal();
+    const reveal = () => {
+      delete dialog.dataset.passkeyHidden;
+      iframe.style.opacity = "1";
+    };
+    if (options?.hidden) {
+      dialog.show();
+    } else {
+      dialog.showModal();
+    }
     let cleanedUp = false;
-    const cleanup = () => {
+    const destroy = () => {
       if (cleanedUp) return;
       cleanedUp = true;
+      clearTimeout(overlayFailsafe);
       inertObserver.disconnect();
+      viewportInfoCleanup();
       window.removeEventListener("message", handleMessage);
       document.removeEventListener("keydown", handleEscape);
       dialog.close();
@@ -2576,14 +4580,23 @@ var OneAuthClient = class {
       }
       dialog.remove();
     };
-    return { dialog, iframe, cleanup };
+    const cleanup = options?.persistent ? () => {
+      if (dialog.open) dialog.close();
+    } : destroy;
+    return { dialog, iframe, cleanup, destroy, reveal };
   }
   /**
    * Listen for the auth result from the modal dialog.
    *
-   * Waits for `PASSKEY_READY` before processing any other messages to avoid
-   * acting on stale `PASSKEY_CLOSE` events that may still be in the event queue
-   * from a previously closed dialog.
+   * Each modal call generates a per-session nonce that the iframe must
+   * echo back in `PASSKEY_CLOSE` / `PASSKEY_LOGIN_RESULT` /
+   * `PASSKEY_RETRY_POPUP` messages. Without an echo, a queued CLOSE
+   * from the previous iframe could be dispatched to the new modal's
+   * listener (postMessage events tagged with `event.source` from a now-
+   * destroyed iframe still reach the parent's message handler) and
+   * silently cancel the fresh auth attempt. The nonce makes that race
+   * harmless: a stale message that doesn't carry the current modal's
+   * nonce is ignored.
    *
    * Also handles the `PASSKEY_RETRY_POPUP` message: sent by the dialog when a
    * password manager (e.g. Bitwarden) intercepts the WebAuthn call inside the
@@ -2596,25 +4609,42 @@ var OneAuthClient = class {
    * @param cleanup - Idempotent teardown for the modal dialog.
    * @returns An `AuthResult` discriminated union.
    */
-  waitForModalAuthResponse(_dialog, iframe, cleanup) {
+  waitForModalAuthResponse(_dialog, iframe, cleanup, requestId) {
     const dialogOrigin = this.getDialogOrigin();
+    const modalNonce = generateModalNonce();
     return new Promise((resolve) => {
-      let dialogReady = false;
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
         const data = event.data;
+        const matchesSource = event.source === iframe.contentWindow;
+        const matchesRequest = typeof requestId === "string" && data?.requestId === requestId;
+        const matchesNonce = data?.modalNonce === modalNonce;
+        const isCurrentFrameClose = data?.type === "PASSKEY_CLOSE" && matchesSource;
+        if (data?.type === "PASSKEY_CLOSE" && (matchesRequest || matchesNonce || isCurrentFrameClose)) {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "Authentication was cancelled"
+            }
+          });
+          return;
+        }
         if (data?.type === "PASSKEY_READY") {
-          dialogReady = true;
           iframe.contentWindow?.postMessage({
             type: "PASSKEY_INIT",
             mode: "iframe",
-            fullViewport: true
+            fullViewport: true,
+            modalNonce
           }, dialogOrigin);
           return;
         }
-        if (!dialogReady && data?.type === "PASSKEY_CLOSE") {
-          return;
-        }
+        const hasModalNonce = typeof data?.modalNonce === "string";
+        const isCurrentDialogMessage = matchesSource || matchesNonce || !hasModalNonce;
+        if (!isCurrentDialogMessage) return;
+        if (data?.modalNonce && data.modalNonce !== modalNonce) return;
         if (data?.type === "PASSKEY_LOGIN_RESULT") {
           window.removeEventListener("message", handleMessage);
           cleanup();
@@ -2625,7 +4655,8 @@ var OneAuthClient = class {
                 id: data.data?.user?.id,
                 username: data.data?.username,
                 address: data.data?.address
-              }
+              },
+              signerType: data.data?.signerType ?? "passkey"
             });
           } else {
             resolve({
@@ -2638,16 +4669,6 @@ var OneAuthClient = class {
           cleanup();
           const popupUrl = data.data?.url?.replace("mode=iframe", "mode=popup") || `${this.getDialogUrl()}/dialog/auth?mode=popup${this.config.clientId ? `&clientId=${this.config.clientId}` : ""}`;
           this.waitForPopupAuthResponse(popupUrl).then(resolve);
-        } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          resolve({
-            success: false,
-            error: {
-              code: "USER_CANCELLED",
-              message: "Authentication was cancelled"
-            }
-          });
         }
       };
       window.addEventListener("message", handleMessage);
@@ -2688,7 +4709,8 @@ var OneAuthClient = class {
                 id: data.data?.user?.id,
                 username: data.data?.username,
                 address: data.data?.address
-              }
+              },
+              signerType: data.data?.signerType ?? "passkey"
             });
           } else {
             resolve({
@@ -2712,63 +4734,6 @@ var OneAuthClient = class {
       window.addEventListener("message", handleMessage);
     });
   }
-  /**
-   * Listen for the authenticate result from the modal dialog.
-   *
-   * The authenticate flow combines sign-in/sign-up with optional off-chain
-   * challenge signing. The dialog sends `PASSKEY_AUTHENTICATE_RESULT` on
-   * completion with both user details and, if a challenge was requested, the
-   * WebAuthn signature and the hashed challenge value for server-side
-   * verification.
-   *
-   * @param _dialog - Unused; kept for signature consistency.
-   * @param _iframe - Unused; kept for signature consistency.
-   * @param cleanup - Idempotent teardown for the modal dialog.
-   * @returns An `AuthenticateResult` discriminated union.
-   */
-  waitForAuthenticateResponse(_dialog, _iframe, cleanup) {
-    const dialogOrigin = this.getDialogOrigin();
-    return new Promise((resolve) => {
-      const handleMessage = (event) => {
-        if (event.origin !== dialogOrigin) return;
-        const data = event.data;
-        if (data?.type === "PASSKEY_AUTHENTICATE_RESULT") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          if (data.success) {
-            resolve({
-              success: true,
-              user: {
-                id: data.data?.user?.id,
-                username: data.data?.username,
-                address: data.data?.accountAddress
-              },
-              challenge: data.data?.signature ? {
-                signature: data.data.signature,
-                signedHash: data.data.signedHash
-              } : void 0
-            });
-          } else {
-            resolve({
-              success: false,
-              error: data.error
-            });
-          }
-        } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
-          cleanup();
-          resolve({
-            success: false,
-            error: {
-              code: "USER_CANCELLED",
-              message: "Authentication was cancelled"
-            }
-          });
-        }
-      };
-      window.addEventListener("message", handleMessage);
-    });
-  }
   /**
    * Listen for the connect result from the connect dialog.
    *
@@ -2827,48 +4792,100 @@ var OneAuthClient = class {
     });
   }
   /**
-   * Listen for the consent result from the consent dialog.
-   *
-   * The consent dialog shows the user which data fields an app is requesting
-   * access to and lets them approve or deny. On approval, `data` contains the
-   * consented field values (e.g. email address, device names) and `grantedAt`
-   * records when consent was given.
+   * Listen for grant-permission results and bridge sponsorship token requests.
    *
-   * A `PASSKEY_CLOSE` without a prior `PASSKEY_CONSENT_RESULT` is treated as an
-   * explicit user cancellation (distinct from denial, though both yield
-   * `success: false`).
+   * The grant iframe owns the passkey ceremony and install intent submission.
+   * Extension-token minting stays in the app origin, so the SDK exposes a
+   * narrow postMessage round-trip that never gives the iframe app secrets.
    *
    * @param _dialog - Unused; kept for signature consistency.
-   * @param _iframe - Unused; kept for signature consistency.
+   * @param iframe - The grant iframe that receives extension-token responses.
    * @param cleanup - Idempotent teardown for the modal dialog.
-   * @returns A `RequestConsentResult` discriminated union.
+   * @param sponsor - Whether this grant flow should request an extension token.
+   * @returns A `GrantPermissionsResult` discriminated union.
    */
-  waitForConsentResponse(_dialog, _iframe, cleanup) {
+  waitForGrantPermissionResponse(dialog, iframe, cleanup, sponsor, initPayload) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
-      const handleMessage = (event) => {
+      let readySeen = false;
+      const teardown = () => {
+        clearTimeout(readyTimeout);
+        window.removeEventListener("message", handleMessage);
+        dialog.removeEventListener("close", handleClose);
+      };
+      const postInit = () => {
+        iframe.contentWindow?.postMessage(
+          { type: "PASSKEY_INIT", ...initPayload, fullViewport: true },
+          dialogOrigin
+        );
+      };
+      const handleClose = () => {
+        teardown();
+        resolve({
+          success: false,
+          error: {
+            code: "USER_CANCELLED",
+            message: "User closed the dialog"
+          }
+        });
+      };
+      const handleMessage = async (event) => {
         if (event.origin !== dialogOrigin) return;
         const data = event.data;
-        if (data?.type === "PASSKEY_CONSENT_RESULT") {
-          window.removeEventListener("message", handleMessage);
+        if (data?.type === "PASSKEY_READY") {
+          readySeen = true;
+          clearTimeout(readyTimeout);
+          postInit();
+          return;
+        }
+        if (data?.type === "PASSKEY_GRANT_EXTENSION_TOKEN_REQUEST") {
+          const requestId = data.requestId;
+          const intentOp = data.intentOp;
+          const postResponse = (payload) => {
+            iframe.contentWindow?.postMessage(
+              { type: "PASSKEY_GRANT_EXTENSION_TOKEN_RESPONSE", requestId, ...payload },
+              dialogOrigin
+            );
+          };
+          if (!requestId || !intentOp) {
+            postResponse({ success: false, error: "Invalid extension token request" });
+            return;
+          }
+          if (!sponsor) {
+            postResponse({ success: true });
+            return;
+          }
+          if (!this.sponsorship) {
+            postResponse({ success: false, error: MISSING_APP_CREDENTIALS_MESSAGE });
+            return;
+          }
+          try {
+            const token = await this.sponsorship.getExtensionToken(intentOp);
+            postResponse({ success: true, token });
+          } catch (err) {
+            postResponse({
+              success: false,
+              error: err instanceof Error ? err.message : String(err)
+            });
+          }
+          return;
+        }
+        if (data?.type === "PASSKEY_GRANT_PERMISSION_RESULT") {
+          teardown();
           cleanup();
           if (data.success) {
-            resolve({
-              success: true,
-              data: data.data,
-              grantedAt: data.data?.grantedAt
-            });
+            resolve({ success: true, ...data.data ?? {} });
           } else {
             resolve({
               success: false,
-              error: data.error ?? {
-                code: "USER_REJECTED",
-                message: "User denied the consent request"
+              error: data.error ?? data.data?.error ?? {
+                code: "GRANT_PERMISSION_FAILED",
+                message: "Permission grant failed"
               }
             });
           }
         } else if (data?.type === "PASSKEY_CLOSE") {
-          window.removeEventListener("message", handleMessage);
+          teardown();
           cleanup();
           resolve({
             success: false,
@@ -2879,7 +4896,20 @@ var OneAuthClient = class {
           });
         }
       };
+      const readyTimeout = setTimeout(() => {
+        if (readySeen) return;
+        teardown();
+        cleanup();
+        resolve({
+          success: false,
+          error: {
+            code: "USER_CANCELLED",
+            message: "User closed the dialog"
+          }
+        });
+      }, 1e4);
       window.addEventListener("message", handleMessage);
+      dialog.addEventListener("close", handleClose);
     });
   }
   /**
@@ -3043,6 +5073,65 @@ var OneAuthClient = class {
   }
 };
 
+// src/permissions.ts
+function definePermissions(config) {
+  const { name, ...permission } = config;
+  return {
+    permissions: [permission],
+    contracts: [
+      {
+        address: config.address,
+        name,
+        abi: config.abi
+      }
+    ]
+  };
+}
+
+// src/crossChainPermissions.ts
+import { isAddress } from "viem";
+function toUnixSecondsBigint(input) {
+  if (typeof input === "bigint") return input;
+  return BigInt(Math.floor(input.getTime() / 1e3));
+}
+function resolveTokenForChain(token, chainId) {
+  return isAddress(token, { strict: false }) ? token : getTokenAddress(token, chainId);
+}
+function createCrossChainPermission(input) {
+  const fromLegs = Array.isArray(input.from) ? input.from : [input.from];
+  const toLegs = Array.isArray(input.to) ? input.to : [input.to];
+  if (fromLegs.length === 0) {
+    throw new Error("createCrossChainPermission: `from` must contain at least one leg");
+  }
+  if (toLegs.length === 0) {
+    throw new Error("createCrossChainPermission: `to` must contain at least one leg");
+  }
+  const validUntil = input.validUntil !== void 0 ? toUnixSecondsBigint(input.validUntil) : void 0;
+  const validAfter = input.validAfter !== void 0 ? toUnixSecondsBigint(input.validAfter) : void 0;
+  if (validUntil !== void 0 && validAfter !== void 0 && validAfter > validUntil) {
+    throw new Error(
+      `createCrossChainPermission: validAfter (${validAfter}) is greater than validUntil (${validUntil})`
+    );
+  }
+  return {
+    from: fromLegs.map((leg) => ({
+      chain: leg.chain,
+      token: resolveTokenForChain(leg.token, leg.chain.id),
+      maxAmount: leg.maxAmount
+    })),
+    to: toLegs.map((leg) => ({
+      chain: leg.chain,
+      token: resolveTokenForChain(leg.token, leg.chain.id),
+      recipient: leg.recipient
+    })),
+    validUntil,
+    validAfter,
+    fillDeadline: input.fillDeadline,
+    recipientIsAccount: !input.allowRecipientNotAccount,
+    settlementLayers: input.settlementLayers
+  };
+}
+
 // src/account.ts
 import {
   bytesToString,
@@ -3068,7 +5157,8 @@ function createPasskeyAccount(client, params) {
     address,
     signMessage: async ({ message }) => {
       const result = await client.signMessage({
-        username,
+        username: username || void 0,
+        accountAddress: address,
         message: normalizeMessage(message)
       });
       if (!result.success || !result.signature) {
@@ -3103,7 +5193,8 @@ function createPasskeyAccount(client, params) {
         ])
       );
       const result = await client.signTypedData({
-        username,
+        username: username || void 0,
+        accountAddress: address,
         domain,
         types: normalizedTypes,
         primaryType: typedData.primaryType,
@@ -3117,29 +5208,37 @@ function createPasskeyAccount(client, params) {
   });
   return {
     ...account,
-    username
+    ...username ? { username } : {},
+    accountAddress: address
   };
 }
 
 // src/walletClient/index.ts
 import {
   createWalletClient,
-  hashMessage,
+  hashMessage as hashMessage2,
   hashTypedData as hashTypedData2
 } from "viem";
 import { toAccount as toAccount2 } from "viem/accounts";
 function createPasskeyWalletClient(config) {
-  const resolvedUsername = config.username ?? config.accountAddress;
+  const identity = {
+    ...config.username ? { username: config.username } : {},
+    accountAddress: config.accountAddress
+  };
   const provider = new OneAuthClient({
     providerUrl: config.providerUrl,
     clientId: config.clientId,
-    dialogUrl: config.dialogUrl
+    dialogUrl: config.dialogUrl,
+    theme: config.theme,
+    blind_signing: config.blind_signing,
+    testnets: config.testnets,
+    sponsorship: config.sponsorship
   });
   const signMessageImpl = async (message) => {
-    const hash = hashMessage(message);
+    const hash = hashMessage2(message);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign message",
       transaction: {
         actions: [
@@ -3170,7 +5269,7 @@ function createPasskeyWalletClient(config) {
     const hash = hashCalls(calls);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign transaction",
       transaction: buildTransactionReview(calls)
     });
@@ -3186,7 +5285,7 @@ function createPasskeyWalletClient(config) {
     const hash = hashTypedData2(typedData);
     const result = await provider.signWithModal({
       challenge: hash,
-      username: resolvedUsername,
+      ...identity,
       description: "Sign typed data",
       transaction: {
         actions: [
@@ -3213,10 +5312,12 @@ function createPasskeyWalletClient(config) {
       data: call.data || "0x",
       value: call.value !== void 0 ? call.value.toString() : "0",
       label: call.label,
-      sublabel: call.sublabel
+      sublabel: call.sublabel,
+      icon: call.icon,
+      abi: call.abi
     }));
     return {
-      username: resolvedUsername,
+      ...config.username ? { username: config.username } : {},
       accountAddress: config.accountAddress,
       targetChain,
       calls: intentCalls
@@ -3246,11 +5347,9 @@ function createPasskeyWalletClient(config) {
           value: transaction.value
         }
       ];
-      const closeOn = config.waitForHash ?? true ? "completed" : "preconfirmed";
       const intentPayload = await buildIntentPayload(calls, targetChain);
       const result = await provider.sendIntent({
         ...intentPayload,
-        closeOn,
         waitForHash: config.waitForHash ?? true,
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
@@ -3265,14 +5364,12 @@ function createPasskeyWalletClient(config) {
      */
     async sendCalls(params) {
       const { calls, chainId: targetChain, tokenRequests, sourceAssets, sourceChainId } = params;
-      const closeOn = config.waitForHash ?? true ? "completed" : "preconfirmed";
       const intentPayload = await buildIntentPayload(calls, targetChain, { tokenRequests, sourceAssets });
       const result = await provider.sendIntent({
         ...intentPayload,
         tokenRequests,
         sourceAssets,
         sourceChainId,
-        closeOn,
         waitForHash: config.waitForHash ?? true,
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
@@ -3303,21 +5400,36 @@ function useBatchQueue() {
 function generateId() {
   return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
 }
-function getStorageKey(username) {
-  return username ? `1auth_batch_queue_${username}` : "1auth_batch_queue_anonymous";
+function getStorageKey(identity) {
+  const key = identity?.accountAddress || identity?.username;
+  return key ? `1auth_batch_queue_${key.toLowerCase()}` : "1auth_batch_queue_anonymous";
+}
+function resolveIdentity(passedIdentity, providerIdentity) {
+  if (typeof passedIdentity === "string") {
+    return { username: passedIdentity, accountAddress: providerIdentity.accountAddress };
+  }
+  return {
+    username: passedIdentity?.username ?? providerIdentity.username,
+    accountAddress: passedIdentity?.accountAddress ?? providerIdentity.accountAddress
+  };
 }
 function BatchQueueProvider({
   client,
   username,
+  accountAddress,
   children
 }) {
   const [queue, setQueue] = React.useState([]);
   const [isExpanded, setExpanded] = React.useState(false);
   const [isSigning, setIsSigning] = React.useState(false);
   const [animationTrigger, setAnimationTrigger] = React.useState(0);
+  const providerIdentity = React.useMemo(
+    () => ({ username, accountAddress }),
+    [username, accountAddress]
+  );
   const batchChainId = queue.length > 0 ? queue[0].targetChain : null;
   React.useEffect(() => {
-    const storageKey = getStorageKey(username);
+    const storageKey = getStorageKey(providerIdentity);
     try {
       const stored = localStorage.getItem(storageKey);
       if (stored) {
@@ -3330,9 +5442,9 @@ function BatchQueueProvider({
       }
     } catch {
     }
-  }, [username]);
+  }, [providerIdentity]);
   React.useEffect(() => {
-    const storageKey = getStorageKey(username);
+    const storageKey = getStorageKey(providerIdentity);
     try {
       if (queue.length > 0) {
         localStorage.setItem(storageKey, JSON.stringify(queue));
@@ -3341,7 +5453,7 @@ function BatchQueueProvider({
       }
     } catch {
     }
-  }, [queue, username]);
+  }, [queue, providerIdentity]);
   const addToBatch = React.useCallback((call, targetChain) => {
     if (batchChainId !== null && batchChainId !== targetChain) {
       return {
@@ -3366,7 +5478,7 @@ function BatchQueueProvider({
     setQueue([]);
     setExpanded(false);
   }, []);
-  const signAll = React.useCallback(async (username2) => {
+  const signAll = React.useCallback(async (identity) => {
     if (queue.length === 0) {
       return {
         success: false,
@@ -3378,12 +5490,25 @@ function BatchQueueProvider({
         }
       };
     }
+    const signer = resolveIdentity(identity, providerIdentity);
+    if (!signer.username && !signer.accountAddress) {
+      return {
+        success: false,
+        intentId: "",
+        status: "failed",
+        error: {
+          code: "MISSING_IDENTITY",
+          message: "Batch signing requires an accountAddress or username"
+        }
+      };
+    }
     const targetChain = queue[0].targetChain;
     const calls = queue.map((item) => item.call);
     setIsSigning(true);
     try {
       const result = await client.sendIntent({
-        username: username2,
+        username: signer.username,
+        accountAddress: signer.accountAddress,
         targetChain,
         calls
       });
@@ -3394,7 +5519,7 @@ function BatchQueueProvider({
     } finally {
       setIsSigning(false);
     }
-  }, [queue, client, clearBatch]);
+  }, [queue, client, clearBatch, providerIdentity]);
   const value = {
     queue,
     batchChainId,
@@ -3712,28 +5837,16 @@ function BatchQueueWidget({ onSignAll }) {
     ] })
   ] });
 }
-
-// src/verify.ts
-import { keccak256, toBytes } from "viem";
-var ETHEREUM_MESSAGE_PREFIX = "Ethereum Signed Message:\n";
-function hashMessage2(message) {
-  const messageBytes = toBytes(message);
-  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;
-  return keccak256(toBytes(prefixed));
-}
-function verifyMessageHash(message, signedHash) {
-  if (!signedHash) return false;
-  const expectedHash = hashMessage2(message);
-  return expectedHash.toLowerCase() === signedHash.toLowerCase();
-}
 export {
   BatchQueueProvider,
   BatchQueueWidget,
   ETHEREUM_MESSAGE_PREFIX,
   OneAuthClient,
+  createCrossChainPermission,
   createOneAuthProvider,
   createPasskeyAccount,
   createPasskeyWalletClient,
+  definePermissions,
   encodeWebAuthnSignature,
   getAllSupportedChainsAndTokens,
   getChainById,
@@ -3748,7 +5861,7 @@ export {
   getTokenDecimals,
   getTokenSymbol,
   hashCalls,
-  hashMessage2 as hashMessage,
+  hashMessage,
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress,