@rhinestone/1auth 0.6.8 → 0.6.9

package/dist/headless.mjs

@@ -0,0 +1,280 @@
+import {
+  tokenFetchError
+} from "./chunk-IIACVHR3.mjs";
+
+// src/headless-client.ts
+var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var MISSING_APP_CREDENTIALS_MESSAGE = "No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT \u2014 pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.";
+function normalizeSponsorship(config) {
+  if (!config) return null;
+  if ("accessToken" in config && "getExtensionToken" in config) {
+    return config;
+  }
+  const { accessTokenUrl, extensionTokenUrl } = config;
+  return {
+    accessToken: async () => {
+      const response = await fetch(accessTokenUrl, { credentials: "include" });
+      if (!response.ok) {
+        throw await tokenFetchError("access token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Access token response missing `token` field");
+      }
+      return data.token;
+    },
+    getExtensionToken: async (intentOp) => {
+      const response = await fetch(extensionTokenUrl, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ intentOp })
+      });
+      if (!response.ok) {
+        throw await tokenFetchError("extension token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Extension token response missing `token` field");
+      }
+      return data.token;
+    }
+  };
+}
+var OneAuthHeadlessClient = class {
+  constructor(config) {
+    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;
+    this.clientId = config.clientId;
+    this.sponsorship = normalizeSponsorship(config.sponsorship);
+  }
+  setSponsorship(sponsorship) {
+    this.sponsorship = normalizeSponsorship(sponsorship);
+  }
+  // ---------------------------------------------------------------------------
+  // Sponsorship JWT fetchers
+  // ---------------------------------------------------------------------------
+  async fetchAccessToken() {
+    if (!this.sponsorship) {
+      return {
+        ok: false,
+        code: "MISSING_APP_CREDENTIALS",
+        message: MISSING_APP_CREDENTIALS_MESSAGE
+      };
+    }
+    try {
+      const accessToken = await this.sponsorship.accessToken();
+      return { ok: true, accessToken };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async fetchExtensionToken(intentOp, sponsor) {
+    if (!sponsor) return { ok: true, extensionToken: void 0 };
+    if (!this.sponsorship) {
+      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
+    }
+    try {
+      const token = await this.sponsorship.getExtensionToken(intentOp);
+      return { ok: true, extensionToken: token };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Intent prepare / submit
+  // ---------------------------------------------------------------------------
+  /**
+   * Quote an intent without opening any dialog. Returns the orchestrator's
+   * `intentOp` plus the digest the caller must sign with their own
+   * validator (e.g. SmartSession). The caller is responsible for
+   * encoding signatures and submitting via {@link submitIntent}.
+   */
+  async prepareIntent(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error("prepareIntent requires either `username` or `accountAddress`");
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const tokenRequests = options.tokenRequests?.map((tr) => ({
+      token: tr.token,
+      amount: tr.amount.toString()
+    }));
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      tokenRequests,
+      sourceAssets: options.sourceAssets,
+      sourceChainId: options.sourceChainId,
+      sessionKeyHandle: options.sessionKeyHandle,
+      clientId: this.clientId,
+      signingMode: "headless",
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Prepare failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Forward a pre-signed intent to the orchestrator. The caller has
+   * already encoded validator-prefixed origin + destination signatures
+   * (one origin signature per intent element); 1auth treats them as
+   * opaque bytes.
+   *
+   * If `sponsor` is omitted or `true`, an extension token is fetched
+   * just-in-time and bound to the intent. Pass `sponsor: false` for
+   * self-paying intents.
+   */
+  async submitIntent(options) {
+    const sponsor = options.sponsor ?? true;
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);
+    if (!extensionResult.ok) {
+      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);
+    }
+    const body = {
+      intentOp: options.intentOp,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      expiresAt: options.expiresAt,
+      originSignatures: options.originSignatures,
+      destinationSignature: options.destinationSignature,
+      targetExecutionSignature: options.targetExecutionSignature,
+      auth: {
+        accessToken: accessTokenResult.accessToken,
+        ...extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }
+      }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Headless execute failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // Status / wait — proxies to the existing routes (no headless variant needed).
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch the latest known status for a submitted headless intent.
+   * This is a non-blocking read and may return `pending` before a
+   * solver has produced a fill transaction hash.
+   */
+  async getIntentStatus(intentId) {
+    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);
+    if (!response.ok) {
+      throw new Error(`Status fetch failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Wait for a submitted headless intent to produce a status update and,
+   * when available, the final fill transaction hash. The wait endpoint
+   * needs the opaque `transactionResult` returned by submit because 1auth
+   * does not persist that SDK object in its database.
+   */
+  async waitForIntent(intentId, transactionResult) {
+    if (!transactionResult) {
+      throw new Error("waitForIntent requires submitResult.transactionResult");
+    }
+    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ transactionResult })
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(
+        errorData.details || errorData.error || `Wait fetch failed (${response.status})`
+      );
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // SmartSession install (one-time, passkey-signed)
+  // ---------------------------------------------------------------------------
+  /**
+   * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+   * with the supplied `permissions`.
+   *
+   * Returns `{ install, sessionKeyHandle }`:
+   *
+   *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+   *    so the user passkey-signs the install via the existing dialog.
+   *  - `sessionKeyHandle` contains the deterministic `permissionId`
+   *    plus metadata to persist in localStorage. Persist this BEFORE
+   *    submitting the install so a refresh during signing doesn't
+   *    lose the handle.
+   *
+   * If the validator is already installed on the user's account,
+   * `install.calls` is empty and `install.alreadyInstalled` is true.
+   * The caller should still persist `sessionKeyHandle` — the on-chain
+   * session enabling happens at first headless use via SmartSession's
+   * ENABLE-mode signature wrapping (see follow-up).
+   */
+  async installSmartSession(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error(
+        "installSmartSession requires either `username` or `accountAddress`"
+      );
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(
+        `Sponsorship access token fetch failed: ${accessTokenResult.message}`
+      );
+    }
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      sessionKeyAddress: options.sessionKeyAddress,
+      permissions: options.permissions,
+      validUntil: options.validUntil,
+      validAfter: options.validAfter,
+      maxUses: options.maxUses,
+      enableSessionSignature: options.enableSessionSignature,
+      label: options.label,
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Install failed (${response.status})`);
+    }
+    return await response.json();
+  }
+};
+export {
+  OneAuthHeadlessClient
+};
+//# sourceMappingURL=headless.mjs.map

package/dist/headless.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/headless-client.ts"],"sourcesContent":["/**\n * Headless 1auth client.\n *\n * Used by integrators that hold their own ECDSA signer in localStorage\n * and produce signatures for an ERC-7579 validator other than the\n * passkey one (typically `@rhinestone/sdk` experimental SmartSession).\n *\n * Responsibilities:\n *  - Fetch sponsorship JWTs from the app's own backend.\n *  - Call `/api/intent/prepare?signingMode=headless` to get an\n *    orchestrator-quoted `intentOp` + `digestResult`.\n *  - Forward pre-encoded validator-prefixed signatures to the new\n *    `/api/intent/headless-execute` route.\n *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for\n *    the one-time SmartSession install ceremony.\n *\n * 1auth itself stays ignorant of session keys — the on-chain\n * SmartSession validator is the only authority over what a session key\n * may sign for. The host app persists `{ sessionKeyAddress, permissionId,\n * accountAddress, permissions }` in its own storage.\n */\n\nimport type {\n  HeadlessIntentOptions,\n  HeadlessIntentStatusResult,\n  HeadlessPrepareResult,\n  HeadlessSubmitOptions,\n  HeadlessSubmitResult,\n  InstallSmartSessionOptions,\n  InstallSmartSessionResult,\n  IntentTokenRequest,\n  PasskeyProviderConfig,\n  SponsorshipCallbackConfig,\n  SponsorshipConfig,\n} from \"./types\";\nimport { tokenFetchError } from \"./sponsorship-fetch\";\n\nconst DEFAULT_PROVIDER_URL = \"https://passkey.1auth.box\";\n\nconst MISSING_APP_CREDENTIALS_MESSAGE =\n  \"No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT — pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.\";\n\ntype AccessTokenFetchResult =\n  | { ok: true; accessToken: string }\n  | { ok: false; code?: \"MISSING_APP_CREDENTIALS\"; message: string };\n\ntype ExtensionTokenFetchResult =\n  | { ok: true; extensionToken: string | undefined }\n  | { ok: false; message: string };\n\n/**\n * Mirrors `normalizeSponsorship` in `client.ts`. Kept local so the\n * headless entry point doesn't pull in the whole OneAuthClient module\n * graph for callers that only need the headless surface.\n */\nfunction normalizeSponsorship(\n  config: SponsorshipConfig | undefined,\n): SponsorshipCallbackConfig | null {\n  if (!config) return null;\n  if (\"accessToken\" in config && \"getExtensionToken\" in config) {\n    return config;\n  }\n  const { accessTokenUrl, extensionTokenUrl } = config;\n  return {\n    accessToken: async () => {\n      const response = await fetch(accessTokenUrl, { credentials: \"include\" });\n      if (!response.ok) {\n        throw await tokenFetchError(\"access token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Access token response missing `token` field\");\n      }\n      return data.token;\n    },\n    getExtensionToken: async (intentOp: string) => {\n      const response = await fetch(extensionTokenUrl, {\n        method: \"POST\",\n        credentials: \"include\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ intentOp }),\n      });\n      if (!response.ok) {\n        throw await tokenFetchError(\"extension token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Extension token response missing `token` field\");\n      }\n      return data.token;\n    },\n  };\n}\n\nexport class OneAuthHeadlessClient {\n  private providerUrl: string;\n  private clientId?: string;\n  private sponsorship: SponsorshipCallbackConfig | null;\n\n  constructor(config: PasskeyProviderConfig) {\n    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;\n    this.clientId = config.clientId;\n    this.sponsorship = normalizeSponsorship(config.sponsorship);\n  }\n\n  setSponsorship(sponsorship: SponsorshipConfig | undefined): void {\n    this.sponsorship = normalizeSponsorship(sponsorship);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Sponsorship JWT fetchers\n  // ---------------------------------------------------------------------------\n\n  private async fetchAccessToken(): Promise<AccessTokenFetchResult> {\n    if (!this.sponsorship) {\n      return {\n        ok: false,\n        code: \"MISSING_APP_CREDENTIALS\",\n        message: MISSING_APP_CREDENTIALS_MESSAGE,\n      };\n    }\n    try {\n      const accessToken = await this.sponsorship.accessToken();\n      return { ok: true, accessToken };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  private async fetchExtensionToken(\n    intentOp: string,\n    sponsor: boolean,\n  ): Promise<ExtensionTokenFetchResult> {\n    if (!sponsor) return { ok: true, extensionToken: undefined };\n    if (!this.sponsorship) {\n      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };\n    }\n    try {\n      const token = await this.sponsorship.getExtensionToken(intentOp);\n      return { ok: true, extensionToken: token };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Intent prepare / submit\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Quote an intent without opening any dialog. Returns the orchestrator's\n   * `intentOp` plus the digest the caller must sign with their own\n   * validator (e.g. SmartSession). The caller is responsible for\n   * encoding signatures and submitting via {@link submitIntent}.\n   */\n  async prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\"prepareIntent requires either `username` or `accountAddress`\");\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    // bigint → string conversion for token requests; matches what the\n    // dialog flow does before serializing requestBody.\n    const tokenRequests = options.tokenRequests?.map((tr: IntentTokenRequest) => ({\n      token: tr.token,\n      amount: tr.amount.toString(),\n    }));\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      tokenRequests,\n      sourceAssets: options.sourceAssets,\n      sourceChainId: options.sourceChainId,\n      sessionKeyHandle: options.sessionKeyHandle,\n      clientId: this.clientId,\n      signingMode: \"headless\" as const,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Prepare failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessPrepareResult;\n  }\n\n  /**\n   * Forward a pre-signed intent to the orchestrator. The caller has\n   * already encoded validator-prefixed origin + destination signatures\n   * (one origin signature per intent element); 1auth treats them as\n   * opaque bytes.\n   *\n   * If `sponsor` is omitted or `true`, an extension token is fetched\n   * just-in-time and bound to the intent. Pass `sponsor: false` for\n   * self-paying intents.\n   */\n  async submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult> {\n    const sponsor = options.sponsor ?? true;\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);\n    if (!extensionResult.ok) {\n      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);\n    }\n\n    const body = {\n      intentOp: options.intentOp,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      expiresAt: options.expiresAt,\n      originSignatures: options.originSignatures,\n      destinationSignature: options.destinationSignature,\n      targetExecutionSignature: options.targetExecutionSignature,\n      auth: {\n        accessToken: accessTokenResult.accessToken,\n        ...(extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }),\n      },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Headless execute failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessSubmitResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Status / wait — proxies to the existing routes (no headless variant needed).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch the latest known status for a submitted headless intent.\n   * This is a non-blocking read and may return `pending` before a\n   * solver has produced a fill transaction hash.\n   */\n  async getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult> {\n    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);\n    if (!response.ok) {\n      throw new Error(`Status fetch failed (${response.status})`);\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  /**\n   * Wait for a submitted headless intent to produce a status update and,\n   * when available, the final fill transaction hash. The wait endpoint\n   * needs the opaque `transactionResult` returned by submit because 1auth\n   * does not persist that SDK object in its database.\n   */\n  async waitForIntent(\n    intentId: string,\n    transactionResult: unknown,\n  ): Promise<HeadlessIntentStatusResult> {\n    if (!transactionResult) {\n      throw new Error(\"waitForIntent requires submitResult.transactionResult\");\n    }\n\n    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ transactionResult }),\n    });\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n        details?: string;\n      };\n      throw new Error(\n        errorData.details || errorData.error || `Wait fetch failed (${response.status})`,\n      );\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // SmartSession install (one-time, passkey-signed)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Resolve the SmartSession install call(s) for `sessionKeyAddress`\n   * with the supplied `permissions`.\n   *\n   * Returns `{ install, sessionKeyHandle }`:\n   *\n   *  - `install` is a `{ targetChain, calls }` pair the caller feeds\n   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`\n   *    so the user passkey-signs the install via the existing dialog.\n   *  - `sessionKeyHandle` contains the deterministic `permissionId`\n   *    plus metadata to persist in localStorage. Persist this BEFORE\n   *    submitting the install so a refresh during signing doesn't\n   *    lose the handle.\n   *\n   * If the validator is already installed on the user's account,\n   * `install.calls` is empty and `install.alreadyInstalled` is true.\n   * The caller should still persist `sessionKeyHandle` — the on-chain\n   * session enabling happens at first headless use via SmartSession's\n   * ENABLE-mode signature wrapping (see follow-up).\n   */\n  async installSmartSession(\n    options: InstallSmartSessionOptions,\n  ): Promise<InstallSmartSessionResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\n        \"installSmartSession requires either `username` or `accountAddress`\",\n      );\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(\n        `Sponsorship access token fetch failed: ${accessTokenResult.message}`,\n      );\n    }\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      sessionKeyAddress: options.sessionKeyAddress,\n      permissions: options.permissions,\n      validUntil: options.validUntil,\n      validAfter: options.validAfter,\n      maxUses: options.maxUses,\n      enableSessionSignature: options.enableSessionSignature,\n      label: options.label,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n      };\n      throw new Error(errorData.error || `Install failed (${response.status})`);\n    }\n\n    return (await response.json()) as InstallSmartSessionResult;\n  }\n}\n"],"mappings":";;;;;AAqCA,IAAM,uBAAuB;AAE7B,IAAM,kCACJ;AAeF,SAAS,qBACP,QACkC;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,iBAAiB,UAAU,uBAAuB,QAAQ;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,EAAE,gBAAgB,kBAAkB,IAAI;AAC9C,SAAO;AAAA,IACL,aAAa,YAAY;AACvB,YAAM,WAAW,MAAM,MAAM,gBAAgB,EAAE,aAAa,UAAU,CAAC;AACvE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,gBAAgB,QAAQ;AAAA,MACtD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC/D;AACA,aAAO,KAAK;AAAA,IACd;AAAA,IACA,mBAAmB,OAAO,aAAqB;AAC7C,YAAM,WAAW,MAAM,MAAM,mBAAmB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,mBAAmB,QAAQ;AAAA,MACzD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAKjC,YAAY,QAA+B;AACzC,SAAK,cAAc,OAAO,eAAe;AACzC,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,qBAAqB,OAAO,WAAW;AAAA,EAC5D;AAAA,EAEA,eAAe,aAAkD;AAC/D,SAAK,cAAc,qBAAqB,WAAW;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAoD;AAChE,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,YAAY,YAAY;AACvD,aAAO,EAAE,IAAI,MAAM,YAAY;AAAA,IACjC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBACZ,UACA,SACoC;AACpC,QAAI,CAAC,QAAS,QAAO,EAAE,IAAI,MAAM,gBAAgB,OAAU;AAC3D,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,gCAAgC;AAAA,IAC/D;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAC/D,aAAO,EAAE,IAAI,MAAM,gBAAgB,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,SAAgE;AAClF,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAIA,UAAM,gBAAgB,QAAQ,eAAe,IAAI,CAAC,QAA4B;AAAA,MAC5E,OAAO,GAAG;AAAA,MACV,QAAQ,GAAG,OAAO,SAAS;AAAA,IAC7B,EAAE;AAEF,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ;AAAA,MACvB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,uBAAuB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAa,SAA+D;AAChF,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAEA,UAAM,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,UAAU,OAAO;AAChF,QAAI,CAAC,gBAAgB,IAAI;AACvB,YAAM,IAAI,MAAM,6CAA6C,gBAAgB,OAAO,EAAE;AAAA,IACxF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,sBAAsB,QAAQ;AAAA,MAC9B,0BAA0B,QAAQ;AAAA,MAClC,MAAM;AAAA,QACJ,aAAa,kBAAkB;AAAA,QAC/B,GAAI,gBAAgB,kBAAkB,EAAE,gBAAgB,gBAAgB,eAAe;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,gCAAgC;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,4BAA4B,SAAS,MAAM,GAAG;AAAA,IACnF;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,gBAAgB,UAAuD;AAC3E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,sBAAsB,QAAQ,EAAE;AAChF,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,IAC5D;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cACJ,UACA,mBACqC;AACrC,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,oBAAoB,QAAQ,IAAI;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAIzD,YAAM,IAAI;AAAA,QACR,UAAU,WAAW,UAAU,SAAS,sBAAsB,SAAS,MAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,oBACJ,SACoC;AACpC,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI;AAAA,QACR,0CAA0C,kBAAkB,OAAO;AAAA,MACrE;AAAA,IACF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,wBAAwB,QAAQ;AAAA,MAChC,OAAO,QAAQ;AAAA,MACf,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,yBAAyB;AAAA,MACvE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAGzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AACF;","names":[]}

package/dist/index.d.mts

@@ -1,10 +1,71 @@
-import { O as OneAuthClient, W as WebAuthnSignature, I as IntentCall, S as SendIntentResult } from './client-BrMrhetG.mjs';
-export { A as AuthResult, i as AuthenticateOptions, j as AuthenticateResult, B as BalanceRequirement, _ as BatchIntentItem, a1 as BatchIntentItemResult, V as CheckConsentOptions, X as CheckConsentResult, z as CloseOnStatus, h as ConnectResult, R as ConsentData, Q as ConsentField, C as CreateSigningRequestResponse, p as EIP712Domain, r as EIP712TypeField, q as EIP712Types, E as EmbedOptions, F as ExecuteIntentResponse, H as IntentHistoryItem, G as IntentHistoryOptions, J as IntentHistoryResult, w as IntentQuote, x as IntentStatus, u as IntentTokenRequest, y as OrchestratorStatus, g as PasskeyCredential, P as PasskeyProviderConfig, a3 as PrepareBatchIntentResponse, D as PrepareIntentResponse, a2 as PreparedBatchIntent, Y as RequestConsentOptions, Z as RequestConsentResult, $ as SendBatchIntentOptions, a0 as SendBatchIntentResult, v as SendIntentOptions, K as SendSwapOptions, L as SendSwapResult, l as SignMessageOptions, m as SignMessageResult, n as SignTypedDataOptions, o as SignTypedDataResult, d as SigningError, e as SigningErrorCode, a as SigningRequestOptions, f as SigningRequestStatus, b as SigningResult, k as SigningResultBase, c as SigningSuccess, M as SwapQuote, N as ThemeConfig, T as TransactionAction, t as TransactionDetails, s as TransactionFees, U as UserPasskeysResponse } from './client-BrMrhetG.mjs';
-export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-CDl9wYEc.mjs';
-import { Address, LocalAccount, Chain, Transport, Hex, WalletClient, Hash } from 'viem';
+import { O as OneAuthClient } from './client-CLCdahyj.mjs';
+import { Abi, Address, LocalAccount, WalletClient, Hash, Chain } from 'viem';
+import { Permission } from '@rhinestone/sdk';
+export { Permission } from '@rhinestone/sdk';
+import { h as IntentCall, i as SendIntentResult } from './types-1BMD1PSH.mjs';
+export { a7 as AssetBalance, a8 as AssetBalanceBucket, a9 as AssetsResponse, u as AuthFlow, A as AuthResult, v as AuthWithModalOptions, z as AuthenticateOptions, B as AuthenticateResult, R as BalanceRequirement, ap as BatchIntentItem, as as BatchIntentItemResult, ad as CheckConsentOptions, ae as CheckConsentResult, a0 as CloseOnStatus, y as ConnectResult, ac as ConsentData, ab as ConsentField, w as CreateAccountWithModalOptions, C as CreateCrossChainPermissionInput, r as CreateSigningRequestResponse, k as CrossChainPermit, l as CrossChainSettlementLayer, M as EIP712Domain, O as EIP712TypeField, N as EIP712Types, E as EmbedOptions, a2 as ExecuteIntentResponse, a6 as GetAssetsOptions, an as GrantPermissionContractMetadata, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, a4 as IntentHistoryItem, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, Z as IntentQuote, _ as IntentStatus, X as IntentTokenRequest, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, L as LoginWithModalOptions, ax as OneAuthTelemetryAttributeValue, ay as OneAuthTelemetryAttributes, az as OneAuthTelemetryConfig, aA as OneAuthTelemetryEvent, aB as OneAuthTelemetryEventName, aC as OneAuthTelemetryFlow, aD as OneAuthTelemetryTraceContext, $ as OrchestratorStatus, t as PasskeyCredential, P as PasskeyProviderConfig, au as PrepareBatchIntentResponse, a1 as PrepareIntentResponse, at as PreparedBatchIntent, af as RequestConsentOptions, ag as RequestConsentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, Y as SendIntentOptions, am as SessionGrantChain, al as SessionGrantRecord, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, x as SignerType, p as SigningError, q as SigningErrorCode, m as SigningRequestOptions, s as SigningRequestStatus, n as SigningResult, D as SigningResultBase, o as SigningSuccess, ao as SmartSessionPolicy, av as SponsorshipCallbackConfig, S as SponsorshipConfig, aw as SponsorshipUrlConfig, aa as ThemeConfig, T as TransactionAction, V as TransactionDetails, Q as TransactionFees, U as UserPasskeysResponse, W as WebAuthnSignature, j as createCrossChainPermission } from './types-1BMD1PSH.mjs';
+export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-hxHGb6SX.mjs';
+import { P as PasskeyWalletClientConfig, S as SendCallsParams } from './verify-D3FaLeAi.mjs';
+export { E as ETHEREUM_MESSAGE_PREFIX, T as TransactionCall, e as encodeWebAuthnSignature, h as hashCalls, a as hashMessage, v as verifyMessageHash } from './verify-D3FaLeAi.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
-export { getTokenAddress, getTokenDecimals } from '@rhinestone/sdk';
+
+type DefinePermissionsConfig<TAbi extends Abi> = Permission<TAbi> & {
+    /** Optional human-readable name surfaced in the review UI. */
+    name?: string;
+};
+interface DefinedPermissions<TAbi extends Abi = Abi> {
+    /**
+     * v2 SmartSession permissions, ready to pass to
+     * `OneAuthClient.grantPermissions({ ...definePermissions(...) })`.
+     *
+     * Always a single-element array so the `...spread` pattern works cleanly
+     * with `grantPermissions`, which accepts `permissions: Permission[]`.
+     *
+     * Widened to `Permission<Abi>` (rather than `Permission<TAbi>`) so the
+     * spread composes with `GrantPermissionsOptions.permissions: Permission<Abi>[]`.
+     * The SDK's v2 `Permission<TAbi>` includes conditional `SpendingLimitField<TFn>` /
+     * `ValueLimitField<TFn>` types that break covariance over `TAbi`, so an inferred
+     * narrow `Permission<erc20Abi>` is no longer assignable to `Permission<Abi>`.
+     * We keep `TAbi` on the type parameter so `contracts[].abi` retains its
+     * narrow shape for the review UI.
+     */
+    permissions: [Permission<Abi>];
+    /**
+     * Contract metadata for the permission review UI. The address and ABI
+     * here mirror the entry in `permissions[0]`; `name` is optional and
+     * purely cosmetic (it's never sent to a contract).
+     */
+    contracts: Array<{
+        address: Address;
+        name?: string;
+        abi: TAbi;
+    }>;
+}
+/**
+ * Build a v2 SmartSession `Permission` from an ABI + function map.
+ *
+ * The Rhinestone SDK derives function selectors and universal-action
+ * calldata offsets from the ABI internally, so app code no longer needs
+ * to spell out raw 4-byte selectors or parameter indices. The accepted
+ * shape is the SDK's own `Permission<TAbi>` plus an optional `name` for
+ * the review UI.
+ *
+ * @example
+ * const permissions = definePermissions({
+ *   address: USDC,
+ *   abi: erc20Abi,
+ *   name: "USDC",
+ *   functions: {
+ *     transfer: {
+ *       params: { to: { condition: "equal", value: RECIPIENT } },
+ *     },
+ *   },
+ * });
+ *
+ * await oneAuth.grantPermissions({ ...permissions, sessionKeyAddress });
+ */
+declare function definePermissions<const TAbi extends Abi>(config: DefinePermissionsConfig<TAbi>): DefinedPermissions<TAbi>;
 
 /**
  * viem LocalAccount adapter for 1auth passkey-controlled smart accounts.
@@ -18,7 +79,10 @@ export { getTokenAddress, getTokenDecimals } from '@rhinestone/sdk';
  */
 
 type PasskeyAccount = LocalAccount<"1auth"> & {
-    username: string;
+    /** Optional username hint retained for legacy integrations. */
+    username?: string;
+    /** Smart account address used as the canonical signer identity. */
+    accountAddress: Address;
 };
 /**
  * Creates a viem `LocalAccount` that delegates signing to the 1auth passkey service.
@@ -34,9 +98,8 @@ type PasskeyAccount = LocalAccount<"1auth"> & {
  *
  * @param client - A configured `OneAuthClient` instance
  * @param params.address - The EVM address of the user's smart account
- * @param params.username - The 1auth username associated with the account; included
- *   in signing requests so the passkey service can look up the correct credential
- * @returns A `PasskeyAccount` extending `LocalAccount<"1auth">` with a `username` field
+ * @param params.username - Optional 1auth username hint for older accounts
+ * @returns A `PasskeyAccount` extending `LocalAccount<"1auth">`
  *
  * @example
  * ```typescript
@@ -47,7 +110,6 @@ type PasskeyAccount = LocalAccount<"1auth"> & {
  * const client = new OneAuthClient({ clientId: "my-app" });
  * const account = createPasskeyAccount(client, {
  *   address: "0xYourSmartAccountAddress",
- *   username: "alice",
  * });
  *
  * const walletClient = createWalletClient({
@@ -61,82 +123,8 @@ type PasskeyAccount = LocalAccount<"1auth"> & {
  */
 declare function createPasskeyAccount(client: OneAuthClient, params: {
     address: Address;
-    username: string;
-}): PasskeyAccount;
-
-/**
- * Configuration for creating a passkey-enabled WalletClient
- */
-interface PasskeyWalletClientConfig {
-    /** User's smart account address */
-    accountAddress: Address;
-    /** Username for the passkey provider (defaults to accountAddress) */
     username?: string;
-    /** Base URL of the auth API (defaults to https://passkey.1auth.box) */
-    providerUrl?: string;
-    /** Client identifier for this application */
-    clientId: string;
-    /** Optional URL of the dialog UI */
-    dialogUrl?: string;
-    /** Chain configuration */
-    chain: Chain;
-    /** Transport (e.g., http(), webSocket()) */
-    transport: Transport;
-    /** Wait for a transaction hash before resolving send calls. */
-    waitForHash?: boolean;
-    /** Maximum time to wait for a transaction hash in ms. */
-    hashTimeoutMs?: number;
-    /** Poll interval for transaction hash in ms. */
-    hashIntervalMs?: number;
-}
-/**
- * A single call in a batch transaction
- */
-interface TransactionCall {
-    /** Target contract address */
-    to: Address;
-    /** Calldata to send */
-    data?: Hex;
-    /** Value in wei to send */
-    value?: bigint;
-    /** Optional label for the transaction review UI (e.g., "Swap ETH for USDC") */
-    label?: string;
-    /** Optional sublabel for additional context (e.g., "1 ETH → 2,500 USDC") */
-    sublabel?: string;
-}
-/**
- * Parameters for sendCalls (batched transactions)
- */
-interface SendCallsParams {
-    /** Array of calls to execute */
-    calls: TransactionCall[];
-    /** Optional chain id override */
-    chainId?: number;
-    /** Optional token requests for orchestrator output (what tokens/amounts to deliver) */
-    tokenRequests?: {
-        token: string;
-        amount: bigint;
-    }[];
-    /** Constrain which tokens the orchestrator can use as input/payment */
-    sourceAssets?: string[];
-    /** Which chain to look for source assets on */
-    sourceChainId?: number;
-}
-
-/**
- * Encode a WebAuthn signature for ERC-1271 verification on-chain
- *
- * @param sig - The WebAuthn signature from the passkey
- * @returns ABI-encoded signature bytes
- */
-declare function encodeWebAuthnSignature(sig: WebAuthnSignature): Hex;
-/**
- * Hash an array of transaction calls for signing
- *
- * @param calls - Array of transaction calls
- * @returns keccak256 hash of the encoded calls
- */
-declare function hashCalls(calls: TransactionCall[]): Hex;
+}): PasskeyAccount;
 
 /**
  * @file viem WalletClient factory backed by passkey signing.
@@ -196,6 +184,13 @@ type PasskeyWalletClient = WalletClient & {
  */
 declare function createPasskeyWalletClient(config: PasskeyWalletClientConfig): PasskeyWalletClient;
 
+/** Identity used to sign a queued batch. Account address is the canonical path. */
+interface BatchQueueIdentity {
+    /** Optional username hint for legacy accounts. */
+    username?: string;
+    /** Smart account address of the signer. */
+    accountAddress?: string;
+}
 /**
  * A batched call in the queue
  */
@@ -228,7 +223,7 @@ interface BatchQueueContextValue {
     /** Clear all calls from the batch */
     clearBatch: () => void;
     /** Sign and execute all batched calls */
-    signAll: (username: string) => Promise<SendIntentResult>;
+    signAll: (identity?: string | BatchQueueIdentity) => Promise<SendIntentResult>;
     /** Whether the widget is expanded */
     isExpanded: boolean;
     /** Set widget expanded state */
@@ -245,15 +240,17 @@ declare function useBatchQueue(): BatchQueueContextValue;
 interface BatchQueueProviderProps {
     /** The OneAuthClient instance */
     client: OneAuthClient;
-    /** Optional username for localStorage persistence key */
+    /** Optional username for legacy localStorage persistence and account lookup. */
     username?: string;
+    /** Optional account address for address-only sessions and persistence. */
+    accountAddress?: string;
     /** Children to render */
     children: React.ReactNode;
 }
 /**
  * Provider component for the batch queue
  */
-declare function BatchQueueProvider({ client, username, children, }: BatchQueueProviderProps): react_jsx_runtime.JSX.Element;
+declare function BatchQueueProvider({ client, username, accountAddress, children, }: BatchQueueProviderProps): react_jsx_runtime.JSX.Element;
 
 /**
  * @file Floating UI widget for the 1auth batch transaction queue.
@@ -268,7 +265,7 @@ declare function BatchQueueProvider({ client, username, children, }: BatchQueueP
  * consumer's bundler.
  */
 interface BatchQueueWidgetProps {
-    /** Callback when "Sign All" is clicked - should provide username */
+    /** Callback when "Sign All" is clicked. */
     onSignAll: () => void;
 }
 /**
@@ -287,18 +284,19 @@ interface BatchQueueWidgetProps {
  * Must be rendered inside a `BatchQueueProvider`.
  *
  * @param props.onSignAll - Called when the user clicks "Sign All". The
- *   implementor is responsible for resolving the username and passing it to
- *   `useBatchQueue().signAll(username)`.
+ *   implementor is responsible for resolving the account identity and passing
+ *   it to `useBatchQueue().signAll({ accountAddress, username })`.
  */
 declare function BatchQueueWidget({ onSignAll }: BatchQueueWidgetProps): react_jsx_runtime.JSX.Element | null;
 
 /**
  * @file Chain and token registry for the 1auth SDK.
  *
- * Wraps `@rhinestone/sdk` chain/token data and combines it with viem's chain
- * definitions to expose a filtered, testnet-aware registry. Consumers can
- * look up supported chains and tokens, resolve token addresses by symbol, and
- * retrieve chain metadata such as explorer URLs and default RPC endpoints.
+ * Wraps `@rhinestone/shared-configs` chain/token data and combines it with
+ * viem's chain definitions to expose a filtered, testnet-aware registry.
+ * Consumers can look up supported chains and tokens, resolve token addresses
+ * by symbol, and retrieve chain metadata such as explorer URLs and default RPC
+ * endpoints.
  *
  * Testnet inclusion is controlled by the `includeTestnets` option on each
  * function or, as a project-wide default, by the environment variables
@@ -309,8 +307,6 @@ type TokenConfig = {
     symbol: string;
     address: Address;
     decimals: number;
-    supportsMultichain?: boolean;
-    [key: string]: unknown;
 };
 type ChainFilterOptions = {
     includeTestnets?: boolean;
@@ -327,55 +323,11 @@ declare function getChainExplorerUrl(chainId: number): string | undefined;
 declare function getChainRpcUrl(chainId: number): string | undefined;
 declare function getSupportedTokens(chainId: number): TokenConfig[];
 declare function getSupportedTokenSymbols(chainId: number): string[];
+declare function getTokenAddress(symbolOrAddress: string, chainId: number): Address;
+declare function getTokenDecimals(symbolOrAddress: string, chainId: number): number;
 declare function resolveTokenAddress(token: string, chainId: number): Address;
 declare function isTestnet(chainId: number): boolean;
 declare function getTokenSymbol(tokenAddress: Address, chainId: number): string;
 declare function isTokenAddressSupported(tokenAddress: Address, chainId: number): boolean;
 
-/**
- * The EIP-191 prefix used for personal message signing.
- * This is the standard Ethereum message prefix for `personal_sign`.
- */
-declare const ETHEREUM_MESSAGE_PREFIX = "\u0019Ethereum Signed Message:\n";
-/**
- * Hash a message with the EIP-191 Ethereum prefix.
- *
- * This is the same hashing function used by the passkey sign dialog.
- * Use this to verify that the `signedHash` returned from `signMessage()`
- * matches your original message.
- *
- * Format: keccak256("\x19Ethereum Signed Message:\n" + len + message)
- *
- * @example
- * ```typescript
- * const message = "Sign in to MyApp\nTimestamp: 1234567890";
- * const result = await client.signMessage({ username: 'alice', message });
- *
- * // Verify the hash matches
- * const expectedHash = hashMessage(message);
- * if (result.signedHash === expectedHash) {
- *   console.log('Hash matches - signature is for this message');
- * }
- * ```
- */
-declare function hashMessage(message: string): `0x${string}`;
-/**
- * Verify that a signedHash matches the expected message.
- *
- * This is a convenience wrapper around `hashMessage()` that returns
- * a boolean. For full cryptographic verification of the P256 signature,
- * use on-chain verification via the WebAuthn.sol contract.
- *
- * @example
- * ```typescript
- * const result = await client.signMessage({ username: 'alice', message });
- *
- * if (result.success && verifyMessageHash(message, result.signedHash)) {
- *   // The signature is for this exact message
- *   // For full verification, verify the P256 signature on-chain or server-side
- * }
- * ```
- */
-declare function verifyMessageHash(message: string, signedHash: string | undefined): boolean;
-
-export { type BatchQueueContextValue, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type ChainFilterOptions, ETHEREUM_MESSAGE_PREFIX, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, type PasskeyWalletClientConfig, type SendCallsParams, SendIntentResult, type TokenConfig, type TransactionCall, WebAuthnSignature, createPasskeyAccount, createPasskeyWalletClient, encodeWebAuthnSignature, getAllSupportedChainsAndTokens, getChainById, getChainExplorerUrl, getChainName, getChainRpcUrl, getSupportedChainIds, getSupportedChains, getSupportedTokenSymbols, getSupportedTokens, getTokenSymbol, hashCalls, hashMessage, isTestnet, isTokenAddressSupported, resolveTokenAddress, useBatchQueue, verifyMessageHash };
+export { type BatchQueueContextValue, type BatchQueueIdentity, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type ChainFilterOptions, type DefinePermissionsConfig, type DefinedPermissions, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, PasskeyWalletClientConfig, SendCallsParams, SendIntentResult, type TokenConfig, createPasskeyAccount, createPasskeyWalletClient, definePermissions, getAllSupportedChainsAndTokens, getChainById, getChainExplorerUrl, getChainName, getChainRpcUrl, getSupportedChainIds, getSupportedChains, getSupportedTokenSymbols, getSupportedTokens, getTokenAddress, getTokenDecimals, getTokenSymbol, isTestnet, isTokenAddressSupported, resolveTokenAddress, useBatchQueue };