@rhinestone/1auth 0.6.8 → 0.6.9

package/dist/{client-BrMrhetG.d.mts → client-BNluVe4_.d.ts}

@@ -1,756 +1,11 @@
-/**
- * Theme configuration for the dialog UI
- */
-interface ThemeConfig {
-    /** Color mode: 'light', 'dark', or 'system' (follows user's OS preference) */
-    mode?: 'light' | 'dark' | 'system';
-    /** Primary accent color (hex). Used for buttons and interactive elements */
-    accent?: string;
-}
-interface PasskeyProviderConfig {
-    /** Base URL of the auth API. Defaults to https://passkey.1auth.box */
-    providerUrl?: string;
-    /** Client identifier for this application (optional for development) */
-    clientId?: string;
-    /** Optional redirect URL for redirect flow */
-    redirectUrl?: string;
-    /** Optional URL of the dialog UI. Defaults to providerUrl */
-    dialogUrl?: string;
-    /** Optional theme configuration for the dialog */
-    theme?: ThemeConfig;
-}
-/**
- * Result of {@link OneAuthClient.authWithModal} — covers both sign-in and sign-up.
- *
- * @example
- * ```typescript
- * const result = await client.authWithModal();
- * if (result.success) {
- *   console.log(result.user?.username);  // "alice"
- *   console.log(result.user?.address);   // "0x1234..."
- * }
- * ```
- */
-interface AuthResult {
-    success: boolean;
-    /** Authenticated user details (present when `success` is true) */
-    user?: {
-        id: string;
-        username?: string;
-        address: `0x${string}`;
-    };
-    error?: {
-        code: string;
-        message: string;
-    };
-}
-/**
- * Result of the connect modal (lightweight connection without passkey auth)
- */
-interface ConnectResult {
-    success: boolean;
-    /** Connected user details (present when `success` is true) */
-    user?: {
-        username?: string;
-        address: `0x${string}`;
-    };
-    /** Whether this was auto-connected (user had auto-connect enabled) */
-    autoConnected?: boolean;
-    /** Action to take when connection was not successful */
-    action?: "switch" | "cancel";
-    error?: {
-        code: string;
-        message: string;
-    };
-}
-/**
- * Options for the authenticate() method
- */
-interface AuthenticateOptions {
-    /**
-     * Human-readable challenge message for the user to sign.
-     * The provider will hash this with a domain separator to prevent
-     * the signature from being reused for transaction signing.
-     */
-    challenge?: string;
-}
-/**
- * Result of {@link OneAuthClient.authenticate} — extends {@link AuthResult}
- * with challenge-signing fields.
- *
- * @example
- * ```typescript
- * const result = await client.authenticate({
- *   challenge: `Login to MyApp\nNonce: ${crypto.randomUUID()}`
- * });
- * if (result.success && result.challenge) {
- *   await verifyOnServer(result.user?.username, result.challenge.signature, result.challenge.signedHash);
- * }
- * ```
- */
-interface AuthenticateResult extends AuthResult {
-    /** Challenge signing result (present when a challenge was provided) */
-    challenge?: {
-        /** WebAuthn signature of the hashed challenge */
-        signature: WebAuthnSignature;
-        /**
-         * The hash that was actually signed (so apps can verify server-side).
-         * Computed as: keccak256("\x19Ethereum Signed Message:\n" + len + challenge) (EIP-191)
-         */
-        signedHash: `0x${string}`;
-    };
-}
-/**
- * Options for signMessage
- */
-interface SignMessageOptions {
-    /** Username of the signer (required if accountAddress is not provided) */
-    username?: string;
-    /** Account address of the signer (alternative to username) */
-    accountAddress?: string;
-    /** Human-readable message to sign */
-    message: string;
-    /** Optional custom challenge (defaults to message hash) */
-    challenge?: string;
-    /** Description shown to user in the dialog */
-    description?: string;
-    /** Optional metadata to display to the user */
-    metadata?: Record<string, unknown>;
-    /** Theme configuration */
-    theme?: ThemeConfig;
-}
-/**
- * Base result for all signing operations (message signing, typed data signing).
- */
-interface SigningResultBase {
-    success: boolean;
-    /** WebAuthn signature if successful */
-    signature?: WebAuthnSignature;
-    /** The hash that was signed */
-    signedHash?: `0x${string}`;
-    /** Passkey credentials used for signing */
-    passkey?: PasskeyCredentials;
-    /** Error details if failed */
-    error?: {
-        code: SigningErrorCode;
-        message: string;
-    };
-}
-/**
- * Result of signMessage
- */
-interface SignMessageResult extends SigningResultBase {
-    /** The original message that was signed */
-    signedMessage?: string;
-}
-interface ClearSignData {
-    decoded: boolean;
-    verified: boolean;
-    functionName?: string;
-    intent?: string;
-    args?: Array<{
-        name: string;
-        type: string;
-        value: string;
-        label?: string;
-    }>;
-    selector?: string;
-}
-interface TransactionAction {
-    type: 'send' | 'receive' | 'approve' | 'swap' | 'mint' | 'custom' | 'module_install';
-    label: string;
-    sublabel?: string;
-    amount?: string;
-    icon?: string;
-    clearSign?: ClearSignData;
-}
-interface TransactionFees {
-    estimated: string;
-    network: {
-        name: string;
-        icon?: string;
-    };
-}
-interface BalanceRequirement {
-    token: string;
-    amount: string;
-    faucetUrl?: string;
-}
-interface TransactionDetails {
-    actions: TransactionAction[];
-    fees?: TransactionFees;
-    requiredBalance?: BalanceRequirement;
-    account?: {
-        address: string;
-        label?: string;
-    };
-}
-interface SigningRequestOptions {
-    challenge: string;
-    username: string;
-    description?: string;
-    metadata?: Record<string, unknown>;
-    transaction?: TransactionDetails;
-}
-interface PasskeyCredential {
-    id: string;
-    deviceName: string | null;
-    publicKeyX: string;
-    publicKeyY: string;
-}
-interface UserPasskeysResponse {
-    passkeys: PasskeyCredential[];
-}
-interface WebAuthnSignature {
-    authenticatorData: string;
-    clientDataJSON: string;
-    challengeIndex: number;
-    typeIndex: number;
-    r: string;
-    s: string;
-    topOrigin: string | null;
-}
-interface PasskeyCredentials {
-    credentialId: string;
-    publicKeyX: string;
-    publicKeyY: string;
-}
-interface SigningSuccess {
-    success: true;
-    requestId?: string;
-    /** WebAuthn signature - present for message/typedData signing */
-    signature?: WebAuthnSignature;
-    /** Array of signatures for multi-origin cross-chain intents (one per source chain) */
-    originSignatures?: WebAuthnSignature[];
-    /** Credentials of the passkey used for signing - present for message/typedData signing */
-    passkey?: PasskeyCredentials;
-    /** Intent ID - present for intent signing (after execute in dialog) */
-    intentId?: string;
-}
-type SigningErrorCode = "USER_REJECTED" | "EXPIRED" | "INVALID_REQUEST" | "NETWORK_ERROR" | "POPUP_BLOCKED" | "SIGNING_FAILED" | "UNKNOWN";
-interface EmbedOptions {
-    container: HTMLElement;
-    width?: string;
-    height?: string;
-    onReady?: () => void;
-    onClose?: () => void;
-}
-interface SigningError {
-    success: false;
-    requestId?: string;
-    error: {
-        code: SigningErrorCode;
-        message: string;
-    };
-}
-type SigningResult = SigningSuccess | SigningError;
-interface CreateSigningRequestResponse {
-    requestId: string;
-    nonce: string;
-    signingUrl: string;
-    expiresAt: string;
-}
-interface SigningRequestStatus {
-    id: string;
-    status: "PENDING" | "COMPLETED" | "REJECTED" | "EXPIRED" | "FAILED";
-    signature?: WebAuthnSignature;
-    error?: {
-        code: SigningErrorCode;
-        message: string;
-    };
-}
-/**
- * A call to execute on the target chain
- */
-interface IntentCall {
-    /** Target contract address */
-    to: string;
-    /** Calldata to send */
-    data?: string;
-    /** Value in wei (as string for serialization) */
-    value?: string;
-    /** Optional label for the transaction review UI */
-    label?: string;
-    /** Optional sublabel for additional context */
-    sublabel?: string;
-}
-/**
- * Token request for the intent
- */
-interface IntentTokenRequest {
-    /** Token contract address */
-    token: string;
-    /** Amount in base units (use parseUnits for decimals) */
-    amount: bigint;
-}
-/**
- * Options for sendIntent
- */
-interface SendIntentOptions {
-    /** Username of the signer */
-    username?: string;
-    /** Account address of the signer (alternative to username) */
-    accountAddress?: string;
-    /** Target chain ID */
-    targetChain?: number;
-    /** Calls to execute on the target chain */
-    calls?: IntentCall[];
-    /** Optional token requests */
-    tokenRequests?: IntentTokenRequest[];
-    /**
-     * Constrain which tokens can be used as input/payment.
-     * If not specified, orchestrator picks from all available balances.
-     * Example: ['USDC'] or ['0x...'] to only use USDC as input.
-     */
-    sourceAssets?: string[];
-    /**
-     * Source chain ID for the assets.
-     * When specified with sourceAssets containing addresses, tells orchestrator
-     * which chain to look for those tokens on.
-     */
-    sourceChainId?: number;
-    /** When to close the dialog and return success. Defaults to "preconfirmed" */
-    closeOn?: CloseOnStatus;
-    /**
-     * Wait for a transaction hash before resolving.
-     * Defaults to false to preserve existing behavior.
-     */
-    waitForHash?: boolean;
-    /** Maximum time to wait for a transaction hash in ms. */
-    hashTimeoutMs?: number;
-    /** Poll interval for transaction hash in ms. */
-    hashIntervalMs?: number;
-}
-/**
- * Quote from the Rhinestone orchestrator
- */
-interface IntentQuote {
-    /** Total cost in input tokens */
-    cost: {
-        total: string;
-        breakdown?: {
-            gas?: string;
-            bridge?: string;
-            swap?: string;
-        };
-    };
-    /** Token requirements to fulfill the intent */
-    tokenRequirements: Array<{
-        token: string;
-        amount: string;
-        chainId: number;
-    }>;
-}
-/**
- * Status of an intent (local states)
- */
-type IntentStatus = "pending" | "quoted" | "signed" | "submitted" | "claimed" | "preconfirmed" | "filled" | "completed" | "failed" | "expired" | "unknown";
-/**
- * Orchestrator status (from Rhinestone)
- * These are the statuses we can receive when polling
- */
-type OrchestratorStatus = "PENDING" | "CLAIMED" | "PRECONFIRMED" | "FILLED" | "COMPLETED" | "FAILED" | "EXPIRED";
-/**
- * When to consider the transaction complete and close the dialog
- * - "claimed" - Close when a solver has claimed the intent (fastest)
- * - "preconfirmed" - Close on pre-confirmation (recommended)
- * - "filled" - Close when the transaction is filled
- * - "completed" - Wait for full completion (slowest, most certain)
- */
-type CloseOnStatus = "claimed" | "preconfirmed" | "filled" | "completed";
-/**
- * Result of sendIntent
- */
-interface SendIntentResult {
-    /** Whether the intent was successfully submitted */
-    success: boolean;
-    /** Intent ID for tracking */
-    intentId: string;
-    /** Current status */
-    status: IntentStatus;
-    /** Transaction hash if completed */
-    transactionHash?: string;
-    /** Operation ID from orchestrator */
-    operationId?: string;
-    /** Error details if failed */
-    error?: {
-        code: string;
-        message: string;
-    };
-}
-/**
- * Prepare intent response from auth service
- */
-interface PrepareIntentResponse {
-    quote: IntentQuote;
-    transaction: TransactionDetails;
-    challenge: string;
-    expiresAt: string;
-    /** Account address for the sign dialog to detect self-transfer vs external send */
-    accountAddress?: string;
-    /** Serialized PreparedTransactionData from orchestrator - needed for execute */
-    intentOp: string;
-    /** User ID for creating intent record on execute */
-    userId: string;
-    /** Target chain ID */
-    targetChain: number;
-    /** JSON stringified calls */
-    calls: string;
-    /** Origin message hashes for multi-source cross-chain intents */
-    originMessages?: Array<{
-        chainId: number;
-        messageHash: string;
-    }>;
-    /** Serialized DigestResult from module SDK (EIP-712 wrapped challenge + merkle proofs) */
-    digestResult?: string;
-}
-/**
- * Execute intent response from auth service
- */
-interface ExecuteIntentResponse {
-    success: boolean;
-    intentId: string;
-    operationId?: string;
-    status: IntentStatus;
-    transactionHash?: string;
-    /** Transaction result data needed for waiting via POST /api/intent/wait */
-    transactionResult?: unknown;
-    error?: {
-        code: string;
-        message: string;
-    };
-}
-/**
- * Options for sendSwap - high-level swap abstraction
- */
-interface SendSwapOptions {
-    /** Username of the signer */
-    username: string;
-    /** Target chain ID where swap executes */
-    targetChain: number;
-    /** Token to swap from (address or supported symbol like 'ETH', 'USDC'). Omit to let the orchestrator pick. */
-    fromToken?: string;
-    /** Token to swap to (address or supported symbol) */
-    toToken: string;
-    /** Amount to swap in human-readable format (e.g., "0.1") */
-    amount: string;
-    /** Maximum slippage in basis points (1 bp = 0.01%). Default: 50 (0.5%) */
-    slippageBps?: number;
-    /**
-     * Override source assets for the swap. If not specified, defaults to [fromToken].
-     * This constrains which tokens the orchestrator can use as input.
-     */
-    sourceAssets?: string[];
-    /**
-     * Source chain ID for the assets. When specified, the orchestrator will only
-     * look for source assets on this specific chain.
-     */
-    sourceChainId?: number;
-    /** When to close the dialog. Defaults to "preconfirmed" */
-    closeOn?: CloseOnStatus;
-    /** Wait for a transaction hash before resolving. */
-    waitForHash?: boolean;
-    /** Maximum time to wait for a transaction hash in ms. */
-    hashTimeoutMs?: number;
-    /** Poll interval for transaction hash in ms. */
-    hashIntervalMs?: number;
-}
-/**
- * Quote information from DEX aggregator
- */
-interface SwapQuote {
-    /** Token being sold (undefined when orchestrator picks) */
-    fromToken?: string;
-    /** Token being bought */
-    toToken: string;
-    /** Amount of fromToken being sold */
-    amountIn: string;
-    /** Amount of toToken being received */
-    amountOut: string;
-    /** Exchange rate (amountOut / amountIn) */
-    rate: string;
-    /** Price impact percentage (if available) */
-    priceImpact?: string;
-}
-/**
- * Result of sendSwap - extends SendIntentResult with swap-specific data
- */
-interface SendSwapResult extends SendIntentResult {
-    /** The swap quote that was executed */
-    quote?: SwapQuote;
-}
-/**
- * EIP-712 Domain parameters
- */
-interface EIP712Domain {
-    /** Name of the signing domain (e.g., "Dai Stablecoin") */
-    name: string;
-    /** Version of the signing domain (e.g., "1") */
-    version: string;
-    /** Chain ID (optional) */
-    chainId?: number;
-    /** Verifying contract address (optional) */
-    verifyingContract?: `0x${string}`;
-    /** Salt for disambiguation (optional) */
-    salt?: `0x${string}`;
-}
-/**
- * EIP-712 Type field definition
- */
-interface EIP712TypeField {
-    /** Field name */
-    name: string;
-    /** Solidity type (e.g., "address", "uint256", "bytes32") */
-    type: string;
-}
-/**
- * EIP-712 Types map - maps type names to their field definitions
- */
-type EIP712Types = {
-    [typeName: string]: EIP712TypeField[];
-};
-/**
- * Options for signTypedData
- */
-interface SignTypedDataOptions {
-    /** Username of the signer (required if accountAddress is not provided) */
-    username?: string;
-    /** Account address of the signer (alternative to username) */
-    accountAddress?: string;
-    /** EIP-712 domain parameters */
-    domain: EIP712Domain;
-    /** Type definitions for all types used in the message */
-    types: EIP712Types;
-    /** Primary type being signed (must be a key in types) */
-    primaryType: string;
-    /** Message values matching the primaryType structure */
-    message: Record<string, unknown>;
-    /** Optional description shown in the dialog */
-    description?: string;
-    /** Theme configuration */
-    theme?: ThemeConfig;
-}
-/**
- * Result of signTypedData
- */
-interface SignTypedDataResult extends SigningResultBase {
-}
-/**
- * Options for querying intent history
- */
-interface IntentHistoryOptions {
-    /** Maximum number of intents to return (default: 50, max: 100) */
-    limit?: number;
-    /** Number of intents to skip for pagination */
-    offset?: number;
-    /** Filter by intent status */
-    status?: IntentStatus;
-    /** Filter by creation date (ISO string) - intents created on or after this date */
-    from?: string;
-    /** Filter by creation date (ISO string) - intents created on or before this date */
-    to?: string;
-}
-/**
- * Single intent item in history response
- */
-interface IntentHistoryItem {
-    /** Intent identifier (orchestrator's ID, used as primary key) */
-    intentId: string;
-    /** Current status of the intent */
-    status: IntentStatus;
-    /** Transaction hash (if completed) */
-    transactionHash?: string;
-    /** Target chain ID */
-    targetChain: number;
-    /** Calls that were executed */
-    calls: IntentCall[];
-    /** When the intent was created (ISO string) */
-    createdAt: string;
-    /** When the intent was last updated (ISO string) */
-    updatedAt: string;
-}
-/**
- * Result of getIntentHistory
- */
-interface IntentHistoryResult {
-    /** List of intents */
-    intents: IntentHistoryItem[];
-    /** Total count of matching intents */
-    total: number;
-    /** Whether there are more intents beyond this page */
-    hasMore: boolean;
-}
-/**
- * A single intent within a batch
- */
-interface BatchIntentItem {
-    /** Target chain ID */
-    targetChain: number;
-    /** Calls to execute on the target chain */
-    calls?: IntentCall[];
-    /** Optional token requests */
-    tokenRequests?: IntentTokenRequest[];
-    /** Constrain which tokens can be used as input */
-    sourceAssets?: string[];
-    /** Source chain ID for the assets */
-    sourceChainId?: number;
-    /** Install an ERC-7579 module instead of executing calls */
-    moduleInstall?: {
-        moduleType: "validator" | "executor" | "fallback" | "hook";
-        moduleAddress: string;
-        initData?: string;
-    };
-}
-/**
- * Options for sendBatchIntent
- */
-interface SendBatchIntentOptions {
-    /** Username of the signer */
-    username?: string;
-    /** Account address of the signer (alternative to username) */
-    accountAddress?: string;
-    /** Array of intents to execute as a batch */
-    intents: BatchIntentItem[];
-    /** When to close the dialog for each intent. Defaults to "preconfirmed" */
-    closeOn?: CloseOnStatus;
-}
-/**
- * Result for a single intent within a batch
- */
-interface BatchIntentItemResult {
-    /** Index in the original batch */
-    index: number;
-    /** Whether this intent succeeded */
-    success: boolean;
-    /** Intent ID from orchestrator */
-    intentId: string;
-    /** Current status */
-    status: IntentStatus;
-    /** Error details if failed */
-    error?: {
-        code: string;
-        message: string;
-    };
-}
-/**
- * Result of sendBatchIntent
- */
-interface SendBatchIntentResult {
-    /** Whether ALL intents succeeded */
-    success: boolean;
-    /** Per-intent results */
-    results: BatchIntentItemResult[];
-    /** Count of successful intents */
-    successCount: number;
-    /** Count of failed intents */
-    failureCount: number;
-    /** Top-level error message when batch-prepare itself fails */
-    error?: string;
-}
-/**
- * Prepared intent data within a batch response
- */
-interface PreparedBatchIntent {
-    /** Index in the original batch */
-    index: number;
-    /** Quote from orchestrator */
-    quote: IntentQuote;
-    /** Decoded transaction details for UI */
-    transaction: TransactionDetails;
-    /** Serialized PreparedTransactionData from orchestrator */
-    intentOp: string;
-    /** Expiry for this specific intent */
-    expiresAt: string;
-    /** Target chain ID */
-    targetChain: number;
-    /** JSON stringified calls */
-    calls: string;
-    /** Origin message hashes for this intent */
-    originMessages: Array<{
-        chainId: number;
-        messageHash: string;
-    }>;
-}
-/**
- * Prepare batch intent response from auth service
- */
-interface PrepareBatchIntentResponse {
-    /** Per-intent prepared data (successful quotes only) */
-    intents: PreparedBatchIntent[];
-    /** Intents that failed to get quotes (unsupported chains, etc.) */
-    failedIntents?: Array<{
-        index: number;
-        targetChain: number;
-        error: string;
-    }>;
-    /** Shared challenge (merkle root of ALL origin hashes across ALL intents) */
-    challenge: string;
-    /** User ID */
-    userId: string;
-    /** Account address */
-    accountAddress?: string;
-    /** Global expiry (earliest of all intent expiries) */
-    expiresAt: string;
-}
-/** Fields available for consent sharing */
-type ConsentField = "email" | "deviceNames";
-/** Shared data returned from consent */
-interface ConsentData {
-    email?: string;
-    deviceNames?: string[];
-}
-/** Options for checkConsent (read-only, no dialog) */
-interface CheckConsentOptions {
-    /** Username of the account (required if accountAddress not provided) */
-    username?: string;
-    /** Account address (alternative to username) */
-    accountAddress?: string;
-    /** Fields to check */
-    fields: ConsentField[];
-    /** Override clientId from SDK config */
-    clientId?: string;
-}
-/** Result of checkConsent */
-interface CheckConsentResult {
-    /** Whether consent has been granted for ALL requested fields */
-    hasConsent: boolean;
-    /** Shared data (present when hasConsent is true) */
-    data?: ConsentData;
-    /** When consent was granted (ISO timestamp) */
-    grantedAt?: string;
-}
-/** Options for requestConsent (opens dialog if needed) */
-interface RequestConsentOptions {
-    /** Username of the account (required if accountAddress not provided) */
-    username?: string;
-    /** Account address (alternative to username) */
-    accountAddress?: string;
-    /** Fields to request access to */
-    fields: ConsentField[];
-    /** Override clientId from SDK config */
-    clientId?: string;
-    /** Theme configuration */
-    theme?: ThemeConfig;
-}
-/** Result of requestConsent */
-interface RequestConsentResult {
-    success: boolean;
-    /** Shared data (present when success is true) */
-    data?: ConsentData;
-    /** When consent was granted (ISO timestamp) */
-    grantedAt?: string;
-    /** Whether data came from an existing grant (no dialog shown) */
-    cached?: boolean;
-    /** Error details */
-    error?: {
-        code: "USER_REJECTED" | "USER_CANCELLED" | "INVALID_REQUEST" | "NETWORK_ERROR" | "UNKNOWN";
-        message: string;
-    };
-}
+import { P as PasskeyProviderConfig, S as SponsorshipConfig, aa as ThemeConfig, a6 as GetAssetsOptions, a9 as AssetsResponse, v as AuthWithModalOptions, A as AuthResult, L as LoginWithModalOptions, w as CreateAccountWithModalOptions, y as ConnectResult, ad as CheckConsentOptions, ae as CheckConsentResult, af as RequestConsentOptions, ag as RequestConsentResult, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, z as AuthenticateOptions, B as AuthenticateResult, m as SigningRequestOptions, n as SigningResult, Y as SendIntentOptions, i as SendIntentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, E as EmbedOptions, t as PasskeyCredential } from './types-1BMD1PSH.js';
 
 declare class OneAuthClient {
     private config;
     private theme;
+    private sponsorship;
+    private eoaDialogState;
+    private eoaSerialQueue;
     /**
      * Create a new OneAuthClient.
      *
@@ -763,6 +18,73 @@ declare class OneAuthClient {
      *   clientId, theme, and redirect settings.
      */
     constructor(config: PasskeyProviderConfig);
+    /**
+     * Update the sponsorship configuration at runtime. Pass `undefined` to
+     * disable sponsorship.
+     */
+    setSponsorship(sponsorship: SponsorshipConfig | undefined): void;
+    /**
+     * Whether the caller opted into SDK telemetry propagation or callbacks.
+     */
+    private shouldUseTelemetry;
+    /**
+     * Resolve the host app's current trace context. Callback failures are
+     * ignored because observability can never be allowed to break signing.
+     */
+    private getTelemetryTraceContext;
+    /**
+     * Resolve host-provided SDK event attributes and remove undefined fields.
+     */
+    private getTelemetryAttributes;
+    /**
+     * Create per-operation telemetry context shared by callbacks, HTTP headers,
+     * dialog URL params, and PASSKEY_INIT messages.
+     */
+    private createTelemetryOperation;
+    /**
+     * Emit a telemetry event to the host app. The callback is intentionally
+     * fire-and-forget and exception-safe so app telemetry cannot affect users.
+     */
+    private emitTelemetry;
+    /**
+     * Attach SDK correlation and optional W3C trace context to dialog URLs.
+     */
+    private appendTelemetryParams;
+    /**
+     * Add SDK correlation headers to passkey API calls. These headers are also
+     * valid W3C trace propagation inputs when the host app supplies traceparent.
+     */
+    private telemetryHeaders;
+    /**
+     * Embed telemetry context in PASSKEY_INIT payloads for dialog-side API calls.
+     */
+    private telemetryPayload;
+    /**
+     * Determine whether this signing call should request invisible dialog mode.
+     * Resolution order: per-call option wins over the constructor config, which
+     * wins over the platform-wide {@link DEFAULT_BLIND_SIGNING}. This lets an app
+     * flip the global default for itself while still overriding individual
+     * high-risk calls — e.g. default-blind but force the review UI for a large
+     * transfer, or default-visible but blind-sign selected low-risk signatures.
+     */
+    private shouldRequestBlindSigning;
+    /**
+     * Fetch the app's access token (JWT). Called up front, before
+     * `/api/intent/prepare`, so the passkey server can authenticate the
+     * orchestrator quote call with the app's JWT instead of a service-level
+     * API key.
+     *
+     * Does not depend on `intentOp` — can run in parallel with anything that
+     * also doesn't depend on the quote.
+     */
+    private fetchAccessToken;
+    /**
+     * Fetch one extension token per intent, aligned with `sponsorFlags`.
+     * Returns an empty array when no intent is sponsored. Fired after
+     * `/prepare` so each token can be bound to its quote's `intentOp`, and
+     * overlaps the dialog / WebAuthn ceremony for no added serial latency.
+     */
+    private fetchExtensionTokens;
     /**
      * Update the theme configuration at runtime
      */
@@ -813,6 +135,23 @@ declare class OneAuthClient {
      * Get the configured client ID
      */
     getClientId(): string | undefined;
+    /**
+     * Whether this client operates on testnet chains only.
+     */
+    getTestnets(): boolean;
+    /**
+     * Get a unified token portfolio for a 1auth account across mainnets and
+     * testnets.
+     *
+     * @example
+     * ```typescript
+     * const assets = await client.getAssets({
+     *   accountAddress: "0x1111111111111111111111111111111111111111",
+     * });
+     * console.log(assets.mainnets.balances, assets.testnets.balances);
+     * ```
+     */
+    getAssets(options: GetAssetsOptions): Promise<AssetsResponse>;
     /**
      * Poll the intent status endpoint until a transaction hash appears or the
      * intent reaches a terminal failure state.
@@ -842,6 +181,8 @@ declare class OneAuthClient {
      * @param options.username - Pre-fill the username field
      * @param options.theme - Override the theme for this modal invocation
      * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+     * @param options.flow - Force the login or account-creation route instead
+     *   of the default auto-detect entry route
      * @returns {@link AuthResult} with user details and typed address
      *
      * @example
@@ -856,11 +197,52 @@ declare class OneAuthClient {
      * }
      * ```
      */
-    authWithModal(options?: {
-        username?: string;
-        theme?: ThemeConfig;
-        oauthEnabled?: boolean;
-    }): Promise<AuthResult>;
+    authWithModal(options?: AuthWithModalOptions): Promise<AuthResult>;
+    /**
+     * Open the sign-in modal directly.
+     *
+     * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+     * returning-user flow. Use it when the embedding app already knows the user
+     * is creating a login session, for example after an app-level "Log in"
+     * button. The result intentionally matches {@link authWithModal}.
+     *
+     * @param options.username - Optional account hint for the sign-in ceremony
+     * @param options.theme - Override the theme for this modal invocation
+     * @returns {@link AuthResult} with user details and typed address
+     */
+    loginWithModal(options?: LoginWithModalOptions): Promise<AuthResult>;
+    /**
+     * Open the account-creation modal directly.
+     *
+     * This bypasses the `/dialog/auth` auto-router and targets the dedicated
+     * sign-up flow. Account creation still happens server-side in the passkey
+     * service; the SDK only opens the dialog and receives the postMessage result.
+     *
+     * @param options.theme - Override the theme for this modal invocation
+     * @param options.oauthEnabled - Set to false to hide OAuth sign-in buttons
+     * @returns {@link AuthResult} with the newly authenticated account details
+     */
+    createAccountWithModal(options?: CreateAccountWithModalOptions): Promise<AuthResult>;
+    /**
+     * Open one of the passkey authentication modal routes and wait for the
+     * login-result message.
+     *
+     * Keeping URL construction in one helper prevents the explicit login/signup
+     * methods from drifting away from the legacy `authWithModal` behavior.
+     */
+    private openAuthModal;
+    /**
+     * Generate a per-dialog nonce used to correlate iframe close messages with
+     * the SDK modal that opened them. Chromium can report a different
+     * `MessageEvent.source` WindowProxy after the `/dialog/auth` redirect, so
+     * auth close handling needs a stable in-band identifier without accepting
+     * stale close messages from earlier dialogs.
+     */
+    private createDialogRequestId;
+    /**
+     * Resolve the passkey app route for a requested auth flow.
+     */
+    private getAuthDialogPath;
     /**
      * Open the connect dialog (lightweight connection without passkey auth).
      *
@@ -886,6 +268,42 @@ declare class OneAuthClient {
     connectWithModal(options?: {
         theme?: ThemeConfig;
     }): Promise<ConnectResult>;
+    /**
+     * High-level connect entry point — the method most integrators want.
+     *
+     * Tries the lightweight {@link connectWithModal} first (no passkey ceremony
+     * for returning users on the same browser), and transparently falls back to
+     * {@link authWithModal} when the connect dialog reports it has no stored
+     * credentials for this origin (`action: "switch"`). First-time visitors get
+     * one passkey ceremony to register; subsequent connects on the same browser
+     * resolve with no biometric prompt — and silently when the user has enabled
+     * "Connect automatically".
+     *
+     * The return shape is the same {@link ConnectResult} discriminated union as
+     * {@link connectWithModal}, so callers can treat both paths uniformly. When
+     * the auth-modal fallback runs, its successful result is normalized into a
+     * `ConnectResult` (no `id` field — the embedder origin must not see it).
+     *
+     * Cancellation: if the user cancels either dialog, the result is
+     * `{ success: false, action: "cancel", error: { code: "USER_CANCELLED", … } }`.
+     *
+     * @param options - Forwarded to whichever underlying modal is shown.
+     *   `username` and `oauthEnabled` only apply to the auth-modal fallback path.
+     * @returns A {@link ConnectResult} discriminated union.
+     *
+     * @example
+     * ```typescript
+     * const result = await client.connect();
+     * if (result.success) {
+     *   console.log("Connected as", result.user?.username ?? result.user?.address);
+     * }
+     * ```
+     */
+    connect(options?: {
+        username?: string;
+        theme?: ThemeConfig;
+        oauthEnabled?: boolean;
+    }): Promise<ConnectResult>;
     /**
      * Open the account management dialog.
      *
@@ -901,41 +319,58 @@ declare class OneAuthClient {
     openAccountDialog(options?: {
         theme?: ThemeConfig;
     }): Promise<void>;
+    /**
+     * Open the account-recovery backup flow directly.
+     *
+     * Deep-links into the "Backup your account" flow inside the account dialog
+     * (rather than the account overview): the user verifies with their passkey,
+     * then saves a recovery passphrase and downloads an encrypted backup file.
+     * Use this to prompt users to secure their account after sign-up.
+     *
+     * Requires an authenticated user (call `authWithModal()` / `connect()`
+     * first) — the dialog reads the signed-in user from the passkey origin.
+     *
+     * Resolves `{ completed: true }` when the user finishes the backup, or
+     * `{ completed: false }` if they dismiss it — so callers can mark an
+     * onboarding step done or re-prompt later.
+     */
+    setupRecovery(options?: {
+        theme?: ThemeConfig;
+    }): Promise<{
+        completed: boolean;
+    }>;
     /**
      * Check if a user has already granted consent for the requested fields.
-     * This is a read-only check — no dialog is shown.
      *
-     * @example
-     * ```typescript
-     * const result = await client.checkConsent({
-     *   username: "alice",
-     *   fields: ["email"],
-     * });
-     * if (result.hasConsent) {
-     *   console.log(result.data?.email);
-     * }
-     * ```
+     * @deprecated Data-sharing consent is disabled.
+     *
+     * Always returns `{ hasConsent: false }`.
      */
     checkConsent(options: CheckConsentOptions): Promise<CheckConsentResult>;
     /**
      * Request consent from the user to share their data.
      *
-     * First checks if consent was already granted (returns cached data immediately).
-     * If not, opens the consent dialog where the user can review and approve sharing.
+     * @deprecated Data-sharing consent is disabled.
      *
-     * @example
-     * ```typescript
-     * const result = await client.requestConsent({
-     *   username: "alice",
-     *   fields: ["email", "deviceNames"],
-     * });
-     * if (result.success) {
-     *   console.log(result.data?.email);
-     *   console.log(result.cached); // true if no dialog was shown
-     * }
-     * ```
+     * Always returns an `INVALID_REQUEST` result.
      */
     requestConsent(options: RequestConsentOptions): Promise<RequestConsentResult>;
+    /**
+     * Open the dedicated SmartSession permission grant dialog.
+     *
+     * The app owns the session key material and sends only the public
+     * `sessionKeyAddress`. 1auth renders the permission review, collects the
+     * owner's passkey authorization, submits the install/enable intent, and
+     * returns a persistable session handle.
+     */
+    grantPermissions(options: GrantPermissionsOptions): Promise<GrantPermissionsResult>;
+    /**
+     * List SmartSession grants previously granted to the current browser origin.
+     *
+     * 1auth derives the app identity from the request Origin header. The SDK does
+     * not send `clientId` for this lookup because grants are origin-scoped.
+     */
+    listSessionGrants(options: ListSessionGrantsOptions): Promise<ListSessionGrantsResult>;
     /**
      * Authenticate a user with an optional challenge to sign.
      *
@@ -943,13 +378,13 @@ declare class OneAuthClient {
      * challenge signing, enabling off-chain login without on-chain transactions.
      *
      * When a challenge is provided:
-     * 1. User authenticates (sign in or sign up)
-     * 2. The challenge is hashed with a domain separator
-     * 3. User signs the hash with their passkey
-     * 4. Returns user info + signature for server-side verification
+     * 1. User authenticates (sign in or sign up) through the normal auth dialog
+     * 2. User signs the challenge through the normal signing dialog
+     * 3. Returns user info + signature for server-side verification
      *
-     * The domain separator ("\x19Passkey Signed Message:\n") ensures the signature
-     * cannot be reused for transaction signing, preventing phishing attacks.
+     * This composes the same supported provider routes as calling
+     * `authWithModal()` followed by `signMessage()`, so challenge auth cannot
+     * drift onto a provider route that the passkey service does not expose.
      *
      * @example
      * ```typescript
@@ -1119,6 +554,24 @@ declare class OneAuthClient {
      * @param cleanup - Idempotent teardown that closes and removes the dialog.
      */
     private waitForDialogClose;
+    /**
+     * Hidden blind-signing iframes have no user-visible Done or Close button.
+     * Once the SDK has the result it needs, tear them down immediately instead
+     * of waiting for an iframe close event that can never be clicked.
+     */
+    private waitForDialogCloseUnlessBlind;
+    /**
+     * After a prepare error has been surfaced in the dialog, wait for the user
+     * to either close the dialog (give up) or click "Try Again", which the
+     * dialog forwards as `PASSKEY_RETRY_PREPARE`.
+     *
+     * On `"closed"` the dialog has been cleaned up; on `"retry"` it stays open
+     * (showing its loading skeleton) while the caller re-runs prepare. Without
+     * this, "Try Again" after a prepare failure was a dead end: the dialog
+     * reset its local state but the SDK had already given up, so the quote
+     * never arrived and the Sign button stayed disabled forever.
+     */
+    private waitForPrepareRetryOrClose;
     /**
      * Inject a `<link rel="preconnect">` tag for the given URL's origin.
      *
@@ -1171,7 +624,7 @@ declare class OneAuthClient {
      * @param requestBody - Serialized intent options (bigint amounts converted to
      *   strings before this call).
      * @returns On success: `{ success: true, data: PrepareIntentResponse, tier }`.
-     *   On failure: `{ success: false, error: { code, message } }`.
+     *   On failure: `{ success: false, error: { code, message, details? } }`.
      */
     private prepareIntent;
     /**
@@ -1232,39 +685,37 @@ declare class OneAuthClient {
      */
     getIntentHistory(options?: IntentHistoryOptions): Promise<IntentHistoryResult>;
     /**
-     * Send a swap intent through the Rhinestone orchestrator
-     *
-     * This is a high-level abstraction for token swaps (including cross-chain):
-     * 1. Resolves token symbols to addresses
-     * 2. Builds the swap intent with tokenRequests (output-first model)
-     * 3. The orchestrator's solver network finds the best route
-     * 4. Executes via the standard intent flow
-     *
-     * NOTE: The `amount` parameter specifies the OUTPUT amount (what the user wants to receive),
-     * not the input amount. The orchestrator will calculate the required input from sourceAssets.
-     *
-     * @example
-     * ```typescript
-     * // Buy 100 USDC using ETH on Base
-     * const result = await client.sendSwap({
-     *   username: 'alice',
-     *   targetChain: 8453,
-     *   fromToken: 'ETH',
-     *   toToken: 'USDC',
-     *   amount: '100', // Receive 100 USDC
-     * });
-     *
-     * // Cross-chain: Buy 50 USDC on Base, paying with ETH from any chain
-     * const result = await client.sendSwap({
-     *   username: 'alice',
-     *   targetChain: 8453, // Base
-     *   fromToken: 'ETH',
-     *   toToken: 'USDC',
-     *   amount: '50', // Receive 50 USDC
-     * });
-     * ```
+     * Forward a raw EIP-1193 request to the iframe so the active EOA connector
+     * can handle it (wallet-connect session or injected wallet). Opens
+     * `/dialog/sign-eoa`, which looks up the wagmi connector and delegates to
+     * `connector.getProvider().request({ method, params })`. The wallet's own
+     * UI is the review screen; the dialog just transports the request.
+     */
+    requestWithWallet(options: {
+        method: string;
+        params?: unknown[] | Record<string, unknown>;
+        expectedAddress?: `0x${string}`;
+        theme?: ThemeConfig;
+    }): Promise<{
+        success: true;
+        result: unknown;
+    } | {
+        success: false;
+        error: {
+            code: string;
+            message: string;
+        };
+    }>;
+    private doRequestWithWallet;
+    /**
+     * Lazily create the persistent `/dialog/sign-eoa` iframe and reveal it.
+     * Subsequent calls just re-open the existing `<dialog>` so the iframe's
+     * in-page state (notably the WalletConnect SignClient) is preserved
+     * between transactions.
      */
-    sendSwap(options: SendSwapOptions): Promise<SendSwapResult>;
+    private ensureEoaDialog;
+    private waitForEoaIframeReady;
+    private waitForEoaResponse;
     /**
      * Sign an arbitrary message with the user's passkey
      *
@@ -1354,6 +805,22 @@ declare class OneAuthClient {
      * @returns The created `<iframe>` element (already appended to the container).
      */
     private createEmbed;
+    /**
+     * Post `PASSKEY_VIEWPORT_INFO` with the parent's
+     * `window.innerHeight` to the iframe whenever it signals
+     * `PASSKEY_READY`, and re-post on `window.resize` (rAF-debounced)
+     * so the dialog's internal max-height cap follows the user's
+     * actual screen.
+     *
+     * Inside the iframe, `vh`/`dvh` units refer to the iframe's own
+     * height (recursive when the iframe auto-sizes), so the parent is
+     * the only reliable source of "what 75% of the user's screen is".
+     * The dialog stores the value in `dialog-context` and falls back
+     * to auto-grow when the value is absent — so it's safe to call
+     * this even for embedders that don't actually cap (modal mode
+     * uses `fullViewport` which has its own outer cap).
+     */
+    private wireViewportInfo;
     /**
      * Listen for a signing result from an embedded (inline) signing iframe.
      *
@@ -1427,7 +894,7 @@ declare class OneAuthClient {
     /**
      * Create and open a full-viewport `<dialog>` containing a passkey iframe.
      *
-     * The SDK owns only the transparent outer shell; all visible UI (backdrop,
+     * The SDK owns only the hidden outer shell; all visible UI (backdrop,
      * card, animations, close button) is rendered by the passkey app inside the
      * iframe. This approach means design changes can be shipped server-side
      * without updating SDK consumers.
@@ -1449,6 +916,8 @@ declare class OneAuthClient {
      *     restores those as well.
      *   - The iframe sandbox includes `allow-popups-to-escape-sandbox` so that
      *     1Password's popup UI can render outside the sandboxed context.
+     *   - `allow-downloads` lets the passkey iframe trigger the recovery-key
+     *     JSON fallback download without sending sensitive data to the parent.
      *
      * @param url - The full URL (including query params) to load in the iframe.
      * @returns References to the dialog, iframe, and a cleanup function.
@@ -1457,9 +926,15 @@ declare class OneAuthClient {
     /**
      * Listen for the auth result from the modal dialog.
      *
-     * Waits for `PASSKEY_READY` before processing any other messages to avoid
-     * acting on stale `PASSKEY_CLOSE` events that may still be in the event queue
-     * from a previously closed dialog.
+     * Each modal call generates a per-session nonce that the iframe must
+     * echo back in `PASSKEY_CLOSE` / `PASSKEY_LOGIN_RESULT` /
+     * `PASSKEY_RETRY_POPUP` messages. Without an echo, a queued CLOSE
+     * from the previous iframe could be dispatched to the new modal's
+     * listener (postMessage events tagged with `event.source` from a now-
+     * destroyed iframe still reach the parent's message handler) and
+     * silently cancel the fresh auth attempt. The nonce makes that race
+     * harmless: a stale message that doesn't carry the current modal's
+     * nonce is ignored.
      *
      * Also handles the `PASSKEY_RETRY_POPUP` message: sent by the dialog when a
      * password manager (e.g. Bitwarden) intercepts the WebAuthn call inside the
@@ -1478,21 +953,6 @@ declare class OneAuthClient {
      * Used when iframe mode fails (e.g., due to password manager interference).
      */
     private waitForPopupAuthResponse;
-    /**
-     * Listen for the authenticate result from the modal dialog.
-     *
-     * The authenticate flow combines sign-in/sign-up with optional off-chain
-     * challenge signing. The dialog sends `PASSKEY_AUTHENTICATE_RESULT` on
-     * completion with both user details and, if a challenge was requested, the
-     * WebAuthn signature and the hashed challenge value for server-side
-     * verification.
-     *
-     * @param _dialog - Unused; kept for signature consistency.
-     * @param _iframe - Unused; kept for signature consistency.
-     * @param cleanup - Idempotent teardown for the modal dialog.
-     * @returns An `AuthenticateResult` discriminated union.
-     */
-    private waitForAuthenticateResponse;
     /**
      * Listen for the connect result from the connect dialog.
      *
@@ -1511,23 +971,19 @@ declare class OneAuthClient {
      */
     private waitForConnectResponse;
     /**
-     * Listen for the consent result from the consent dialog.
+     * Listen for grant-permission results and bridge sponsorship token requests.
      *
-     * The consent dialog shows the user which data fields an app is requesting
-     * access to and lets them approve or deny. On approval, `data` contains the
-     * consented field values (e.g. email address, device names) and `grantedAt`
-     * records when consent was given.
-     *
-     * A `PASSKEY_CLOSE` without a prior `PASSKEY_CONSENT_RESULT` is treated as an
-     * explicit user cancellation (distinct from denial, though both yield
-     * `success: false`).
+     * The grant iframe owns the passkey ceremony and install intent submission.
+     * Extension-token minting stays in the app origin, so the SDK exposes a
+     * narrow postMessage round-trip that never gives the iframe app secrets.
      *
      * @param _dialog - Unused; kept for signature consistency.
-     * @param _iframe - Unused; kept for signature consistency.
+     * @param iframe - The grant iframe that receives extension-token responses.
      * @param cleanup - Idempotent teardown for the modal dialog.
-     * @returns A `RequestConsentResult` discriminated union.
+     * @param sponsor - Whether this grant flow should request an extension token.
+     * @returns A `GrantPermissionsResult` discriminated union.
      */
-    private waitForConsentResponse;
+    private waitForGrantPermissionResponse;
     /**
      * Listen for a signing result from a server-request-based modal dialog.
      *
@@ -1573,4 +1029,4 @@ declare class OneAuthClient {
     private fetchSigningResult;
 }
 
-export { type SendBatchIntentOptions as $, type AuthResult as A, type BalanceRequirement as B, type CreateSigningRequestResponse as C, type PrepareIntentResponse as D, type EmbedOptions as E, type ExecuteIntentResponse as F, type IntentHistoryOptions as G, type IntentHistoryItem as H, type IntentCall as I, type IntentHistoryResult as J, type SendSwapOptions as K, type SendSwapResult as L, type SwapQuote as M, type ThemeConfig as N, OneAuthClient as O, type PasskeyProviderConfig as P, type ConsentField as Q, type ConsentData as R, type SendIntentResult as S, type TransactionAction as T, type UserPasskeysResponse as U, type CheckConsentOptions as V, type WebAuthnSignature as W, type CheckConsentResult as X, type RequestConsentOptions as Y, type RequestConsentResult as Z, type BatchIntentItem as _, type SigningRequestOptions as a, type SendBatchIntentResult as a0, type BatchIntentItemResult as a1, type PreparedBatchIntent as a2, type PrepareBatchIntentResponse as a3, type SigningResult as b, type SigningSuccess as c, type SigningError as d, type SigningErrorCode as e, type SigningRequestStatus as f, type PasskeyCredential as g, type ConnectResult as h, type AuthenticateOptions as i, type AuthenticateResult as j, type SigningResultBase as k, type SignMessageOptions as l, type SignMessageResult as m, type SignTypedDataOptions as n, type SignTypedDataResult as o, type EIP712Domain as p, type EIP712Types as q, type EIP712TypeField as r, type TransactionFees as s, type TransactionDetails as t, type IntentTokenRequest as u, type SendIntentOptions as v, type IntentQuote as w, type IntentStatus as x, type OrchestratorStatus as y, type CloseOnStatus as z };
+export { OneAuthClient as O };