@rhinestone/1auth 0.7.0 → 0.7.2

package/dist/headless.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/headless-client.ts","../src/smart-session-signatures.ts"],"sourcesContent":["/**\n * Headless 1auth client.\n *\n * Used by integrators that hold their own ECDSA signer in localStorage\n * and produce signatures for an ERC-7579 validator other than the\n * passkey one (typically `@rhinestone/sdk` experimental SmartSession).\n *\n * Responsibilities:\n *  - Fetch sponsorship JWTs from the app's own backend.\n *  - Call `/api/intent/prepare?signingMode=headless` to get an\n *    orchestrator-quoted `intentOp` + `digestResult`.\n *  - Forward pre-encoded validator-prefixed signatures to the new\n *    `/api/intent/headless-execute` route.\n *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for\n *    the one-time SmartSession install ceremony.\n *\n * 1auth itself stays ignorant of session keys — the on-chain\n * SmartSession validator is the only authority over what a session key\n * may sign for. The host app persists `{ sessionKeyAddress, permissionId,\n * accountAddress, permissions }` in its own storage.\n */\n\nimport type {\n  HeadlessIntentOptions,\n  HeadlessIntentStatusResult,\n  HeadlessPrepareResult,\n  HeadlessSubmitOptions,\n  HeadlessSubmitResult,\n  InstallSmartSessionOptions,\n  InstallSmartSessionResult,\n  IntentTokenRequest,\n  PasskeyProviderConfig,\n  SponsorshipCallbackConfig,\n  SponsorshipConfig,\n} from \"./types\";\nimport { tokenFetchError } from \"./sponsorship-fetch\";\n\nconst DEFAULT_PROVIDER_URL = \"https://passkey.1auth.box\";\n\nconst MISSING_APP_CREDENTIALS_MESSAGE =\n  \"No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT — pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.\";\n\ntype AccessTokenFetchResult =\n  | { ok: true; accessToken: string }\n  | { ok: false; code?: \"MISSING_APP_CREDENTIALS\"; message: string };\n\ntype ExtensionTokenFetchResult =\n  | { ok: true; extensionToken: string | undefined }\n  | { ok: false; message: string };\n\n/**\n * Mirrors `normalizeSponsorship` in `client.ts`. Kept local so the\n * headless entry point doesn't pull in the whole OneAuthClient module\n * graph for callers that only need the headless surface.\n */\nfunction normalizeSponsorship(\n  config: SponsorshipConfig | undefined,\n): SponsorshipCallbackConfig | null {\n  if (!config) return null;\n  if (\"accessToken\" in config && \"getExtensionToken\" in config) {\n    return config;\n  }\n  const { accessTokenUrl, extensionTokenUrl } = config;\n  return {\n    accessToken: async () => {\n      const response = await fetch(accessTokenUrl, { credentials: \"include\" });\n      if (!response.ok) {\n        throw await tokenFetchError(\"access token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Access token response missing `token` field\");\n      }\n      return data.token;\n    },\n    getExtensionToken: async (intentOp: string) => {\n      const response = await fetch(extensionTokenUrl, {\n        method: \"POST\",\n        credentials: \"include\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ intentOp }),\n      });\n      if (!response.ok) {\n        throw await tokenFetchError(\"extension token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Extension token response missing `token` field\");\n      }\n      return data.token;\n    },\n  };\n}\n\nexport class OneAuthHeadlessClient {\n  private providerUrl: string;\n  private clientId?: string;\n  private sponsorship: SponsorshipCallbackConfig | null;\n\n  constructor(config: PasskeyProviderConfig) {\n    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;\n    this.clientId = config.clientId;\n    this.sponsorship = normalizeSponsorship(config.sponsorship);\n  }\n\n  setSponsorship(sponsorship: SponsorshipConfig | undefined): void {\n    this.sponsorship = normalizeSponsorship(sponsorship);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Sponsorship JWT fetchers\n  // ---------------------------------------------------------------------------\n\n  private async fetchAccessToken(): Promise<AccessTokenFetchResult> {\n    if (!this.sponsorship) {\n      return {\n        ok: false,\n        code: \"MISSING_APP_CREDENTIALS\",\n        message: MISSING_APP_CREDENTIALS_MESSAGE,\n      };\n    }\n    try {\n      const accessToken = await this.sponsorship.accessToken();\n      return { ok: true, accessToken };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  private async fetchExtensionToken(\n    intentOp: string,\n    sponsor: boolean,\n  ): Promise<ExtensionTokenFetchResult> {\n    if (!sponsor) return { ok: true, extensionToken: undefined };\n    if (!this.sponsorship) {\n      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };\n    }\n    try {\n      const token = await this.sponsorship.getExtensionToken(intentOp);\n      return { ok: true, extensionToken: token };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Intent prepare / submit\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Quote an intent without opening any dialog. Returns the orchestrator's\n   * `intentOp` plus the digest the caller must sign with their own\n   * validator (e.g. SmartSession). The caller is responsible for\n   * encoding signatures and submitting via {@link submitIntent}.\n   */\n  async prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\"prepareIntent requires either `username` or `accountAddress`\");\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    // bigint → string conversion for token requests; matches what the\n    // dialog flow does before serializing requestBody.\n    const tokenRequests = options.tokenRequests?.map((tr: IntentTokenRequest) => ({\n      token: tr.token,\n      amount: tr.amount.toString(),\n    }));\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      tokenRequests,\n      sourceAssets: options.sourceAssets,\n      sourceChainId: options.sourceChainId,\n      sessionKeyHandle: options.sessionKeyHandle,\n      clientId: this.clientId,\n      signingMode: \"headless\" as const,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Prepare failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessPrepareResult;\n  }\n\n  /**\n   * Forward a pre-signed intent to the orchestrator. The caller has\n   * already encoded validator-prefixed origin + destination signatures\n   * (one origin signature per intent element); 1auth treats them as\n   * opaque bytes.\n   *\n   * If `sponsor` is omitted or `true`, an extension token is fetched\n   * just-in-time and bound to the intent. Pass `sponsor: false` for\n   * self-paying intents.\n   */\n  async submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult> {\n    const sponsor = options.sponsor ?? true;\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);\n    if (!extensionResult.ok) {\n      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);\n    }\n\n    const body = {\n      intentOp: options.intentOp,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      expiresAt: options.expiresAt,\n      originSignatures: options.originSignatures,\n      destinationSignature: options.destinationSignature,\n      targetExecutionSignature: options.targetExecutionSignature,\n      auth: {\n        accessToken: accessTokenResult.accessToken,\n        ...(extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }),\n      },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Headless execute failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessSubmitResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Status / wait — proxies to the existing routes (no headless variant needed).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch the latest known status for a submitted headless intent.\n   * This is a non-blocking read and may return `pending` before a\n   * solver has produced a fill transaction hash.\n   */\n  async getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult> {\n    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);\n    if (!response.ok) {\n      throw new Error(`Status fetch failed (${response.status})`);\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  /**\n   * Wait for a submitted headless intent to produce a status update and,\n   * when available, the final fill transaction hash. The wait endpoint\n   * needs the opaque `transactionResult` returned by submit because 1auth\n   * does not persist that SDK object in its database.\n   */\n  async waitForIntent(\n    intentId: string,\n    transactionResult: unknown,\n  ): Promise<HeadlessIntentStatusResult> {\n    if (!transactionResult) {\n      throw new Error(\"waitForIntent requires submitResult.transactionResult\");\n    }\n\n    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ transactionResult }),\n    });\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n        details?: string;\n      };\n      throw new Error(\n        errorData.details || errorData.error || `Wait fetch failed (${response.status})`,\n      );\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // SmartSession install (one-time, passkey-signed)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Resolve the SmartSession install call(s) for `sessionKeyAddress`\n   * with the supplied `permissions`.\n   *\n   * Returns `{ install, sessionKeyHandle }`:\n   *\n   *  - `install` is a `{ targetChain, calls }` pair the caller feeds\n   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`\n   *    so the user passkey-signs the install via the existing dialog.\n   *  - `sessionKeyHandle` contains the deterministic `permissionId`\n   *    plus metadata to persist in localStorage. Persist this BEFORE\n   *    submitting the install so a refresh during signing doesn't\n   *    lose the handle.\n   *\n   * If the validator is already installed on the user's account,\n   * `install.calls` is empty and `install.alreadyInstalled` is true.\n   * The caller should still persist `sessionKeyHandle` — the on-chain\n   * session enabling happens at first headless use via SmartSession's\n   * ENABLE-mode signature wrapping (see follow-up).\n   */\n  async installSmartSession(\n    options: InstallSmartSessionOptions,\n  ): Promise<InstallSmartSessionResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\n        \"installSmartSession requires either `username` or `accountAddress`\",\n      );\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(\n        `Sponsorship access token fetch failed: ${accessTokenResult.message}`,\n      );\n    }\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      sessionKeyAddress: options.sessionKeyAddress,\n      permissions: options.permissions,\n      validUntil: options.validUntil,\n      validAfter: options.validAfter,\n      maxUses: options.maxUses,\n      enableSessionSignature: options.enableSessionSignature,\n      label: options.label,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n      };\n      throw new Error(errorData.error || `Install failed (${response.status})`);\n    }\n\n    return (await response.json()) as InstallSmartSessionResult;\n  }\n}\n","import { type Address, type Hex } from \"viem\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport {\n  createRhinestoneAccount,\n  type Session,\n  type SignData,\n  type SignerSet,\n} from \"@rhinestone/sdk\";\nimport { toSession } from \"@rhinestone/sdk/smart-sessions\";\nimport { getChainById } from \"./registry\";\nimport type { HeadlessPrepareResult, SessionKeyHandle } from \"./types\";\n\n/** Restores bigint sentinel strings emitted by 1auth's JSON transport. */\nfunction reviveBigIntStrings<T>(value: T): T {\n  if (Array.isArray(value)) return value.map((entry) => reviveBigIntStrings(entry)) as T;\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [key, reviveBigIntStrings(entry)]),\n    ) as T;\n  }\n  if (typeof value === \"string\" && value.startsWith(\"__bigint:\")) {\n    return BigInt(value.slice(\"__bigint:\".length)) as T;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) return BigInt(value) as T;\n  return value;\n}\n\n/** Parses the prepared transaction enough to recover the SDK-native SignData. */\nfunction parsePreparedSignData(value: string): SignData {\n  const prepared = JSON.parse(value, (_key, nested) => reviveBigIntStrings(nested)) as {\n    quotes?: { best?: { signData?: SignData } };\n  };\n  const signData = prepared.quotes?.best?.signData;\n  if (!signData) {\n    throw new Error(\"Prepared headless intent is missing quotes.best.signData\");\n  }\n  return signData;\n}\n\n/** Reads the numeric EIP-712 chain id from a typed-data domain. */\nfunction chainIdFromSignDataDomain(domainChainId: unknown): number | undefined {\n  if (typeof domainChainId === \"number\" && Number.isSafeInteger(domainChainId)) {\n    return domainChainId;\n  }\n  if (typeof domainChainId === \"bigint\") return Number(domainChainId);\n  if (typeof domainChainId === \"string\" && /^\\d+$/.test(domainChainId)) {\n    return Number(domainChainId);\n  }\n  return undefined;\n}\n\n/** Rebuilds the SDK SmartSession object from the persisted grant handle. */\nfunction buildSessionForChain(args: {\n  privateKey: Hex;\n  handle: SessionKeyHandle;\n  chainId: number;\n}): Session {\n  return toSession(\n    {\n      chain: getChainById(args.chainId),\n      owners: { type: \"ecdsa\", accounts: [privateKeyToAccount(args.privateKey)] },\n      permissions: reviveBigIntStrings(args.handle.permissions ?? []),\n      crossChainPermits: reviveBigIntStrings(args.handle.crossChainPermits ?? []),\n    },\n    // The production SmartSession module is deployed on testnets too. Never opt\n    // into SDK dev contracts for 1auth headless permissions.\n    { useDevContracts: false },\n  );\n}\n\n/** Builds a per-chain SmartSession signer set for every chain in SignData. */\nfunction buildSessionSigners(args: {\n  privateKey: Hex;\n  handle: SessionKeyHandle;\n  prepared: HeadlessPrepareResult;\n  signData: SignData;\n}): SignerSet {\n  const chainIds = new Set<number>([args.prepared.targetChain]);\n  for (const typedData of args.signData.origin) {\n    const chainId = chainIdFromSignDataDomain(typedData.domain?.chainId);\n    if (chainId) chainIds.add(chainId);\n  }\n  const targetExecutionChainId = chainIdFromSignDataDomain(\n    args.signData.targetExecution?.domain?.chainId,\n  );\n  if (targetExecutionChainId) chainIds.add(targetExecutionChainId);\n\n  return {\n    type: \"experimental_session\",\n    sessions: Object.fromEntries(\n      [...chainIds].map((chainId) => [\n        chainId,\n        {\n          session: buildSessionForChain({\n            privateKey: args.privateKey,\n            handle: args.handle,\n            chainId,\n          }),\n        },\n      ]),\n    ),\n  };\n}\n\nexport interface BuildSmartSessionHeadlessSignaturesOptions {\n  /** ECDSA private key for the locally-held SmartSession signer. */\n  privateKey: Hex;\n  /** Smart account address the SmartSession is scoped to. */\n  accountAddress: Address;\n  /** Persisted handle returned by `grantPermissions` / SmartSession install. */\n  sessionKeyHandle: SessionKeyHandle;\n  /** Prepared headless intent returned by `OneAuthHeadlessClient.prepareIntent`. */\n  prepared: HeadlessPrepareResult;\n}\n\n/**\n * Builds SmartSession signatures for `OneAuthHeadlessClient.submitIntent`.\n *\n * This intentionally delegates signing and SmartSession signature packing to\n * `@rhinestone/sdk`. 1auth only rebuilds the persisted session descriptor and\n * supplies the SDK-native `SignData` returned by the orchestrator quote.\n */\nexport async function buildSmartSessionHeadlessSignatures(\n  options: BuildSmartSessionHeadlessSignaturesOptions,\n) {\n  const signData = parsePreparedSignData(options.prepared.intentOp);\n  const account = await createRhinestoneAccount({\n    initData: { address: options.accountAddress },\n    owners: {\n      type: \"ecdsa\",\n      accounts: [privateKeyToAccount(options.privateKey)],\n    },\n    experimental_sessions: { enabled: true },\n  });\n\n  return account.signIntent(\n    signData,\n    getChainById(options.prepared.targetChain),\n    buildSessionSigners({\n      privateKey: options.privateKey,\n      handle: options.sessionKeyHandle,\n      prepared: options.prepared,\n      signData,\n    }),\n  );\n}\n"],"mappings":";;;;;;;;AAqCA,IAAM,uBAAuB;AAE7B,IAAM,kCACJ;AAeF,SAAS,qBACP,QACkC;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,iBAAiB,UAAU,uBAAuB,QAAQ;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,EAAE,gBAAgB,kBAAkB,IAAI;AAC9C,SAAO;AAAA,IACL,aAAa,YAAY;AACvB,YAAM,WAAW,MAAM,MAAM,gBAAgB,EAAE,aAAa,UAAU,CAAC;AACvE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,gBAAgB,QAAQ;AAAA,MACtD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC/D;AACA,aAAO,KAAK;AAAA,IACd;AAAA,IACA,mBAAmB,OAAO,aAAqB;AAC7C,YAAM,WAAW,MAAM,MAAM,mBAAmB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,mBAAmB,QAAQ;AAAA,MACzD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAKjC,YAAY,QAA+B;AACzC,SAAK,cAAc,OAAO,eAAe;AACzC,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,qBAAqB,OAAO,WAAW;AAAA,EAC5D;AAAA,EAEA,eAAe,aAAkD;AAC/D,SAAK,cAAc,qBAAqB,WAAW;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAoD;AAChE,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,YAAY,YAAY;AACvD,aAAO,EAAE,IAAI,MAAM,YAAY;AAAA,IACjC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBACZ,UACA,SACoC;AACpC,QAAI,CAAC,QAAS,QAAO,EAAE,IAAI,MAAM,gBAAgB,OAAU;AAC3D,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,gCAAgC;AAAA,IAC/D;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAC/D,aAAO,EAAE,IAAI,MAAM,gBAAgB,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,SAAgE;AAClF,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAIA,UAAM,gBAAgB,QAAQ,eAAe,IAAI,CAAC,QAA4B;AAAA,MAC5E,OAAO,GAAG;AAAA,MACV,QAAQ,GAAG,OAAO,SAAS;AAAA,IAC7B,EAAE;AAEF,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ;AAAA,MACvB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,uBAAuB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAa,SAA+D;AAChF,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAEA,UAAM,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,UAAU,OAAO;AAChF,QAAI,CAAC,gBAAgB,IAAI;AACvB,YAAM,IAAI,MAAM,6CAA6C,gBAAgB,OAAO,EAAE;AAAA,IACxF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,sBAAsB,QAAQ;AAAA,MAC9B,0BAA0B,QAAQ;AAAA,MAClC,MAAM;AAAA,QACJ,aAAa,kBAAkB;AAAA,QAC/B,GAAI,gBAAgB,kBAAkB,EAAE,gBAAgB,gBAAgB,eAAe;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,gCAAgC;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,4BAA4B,SAAS,MAAM,GAAG;AAAA,IACnF;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,gBAAgB,UAAuD;AAC3E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,sBAAsB,QAAQ,EAAE;AAChF,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,IAC5D;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cACJ,UACA,mBACqC;AACrC,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,oBAAoB,QAAQ,IAAI;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAIzD,YAAM,IAAI;AAAA,QACR,UAAU,WAAW,UAAU,SAAS,sBAAsB,SAAS,MAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,oBACJ,SACoC;AACpC,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI;AAAA,QACR,0CAA0C,kBAAkB,OAAO;AAAA,MACrE;AAAA,IACF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,wBAAwB,QAAQ;AAAA,MAChC,OAAO,QAAQ;AAAA,MACf,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,yBAAyB;AAAA,MACvE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAGzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AACF;;;ACrXA,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,iBAAiB;AAK1B,SAAS,oBAAuB,OAAa;AAC3C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,UAAU,oBAAoB,KAAK,CAAC;AAChF,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,oBAAoB,KAAK,CAAC,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,WAAW,GAAG;AAC9D,WAAO,OAAO,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,EAAG,QAAO,OAAO,KAAK;AACzE,SAAO;AACT;AAGA,SAAS,sBAAsB,OAAyB;AACtD,QAAM,WAAW,KAAK,MAAM,OAAO,CAAC,MAAM,WAAW,oBAAoB,MAAM,CAAC;AAGhF,QAAM,WAAW,SAAS,QAAQ,MAAM;AACxC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,SAAS,0BAA0B,eAA4C;AAC7E,MAAI,OAAO,kBAAkB,YAAY,OAAO,cAAc,aAAa,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,MAAI,OAAO,kBAAkB,SAAU,QAAO,OAAO,aAAa;AAClE,MAAI,OAAO,kBAAkB,YAAY,QAAQ,KAAK,aAAa,GAAG;AACpE,WAAO,OAAO,aAAa;AAAA,EAC7B;AACA,SAAO;AACT;AAGA,SAAS,qBAAqB,MAIlB;AACV,SAAO;AAAA,IACL;AAAA,MACE,OAAO,aAAa,KAAK,OAAO;AAAA,MAChC,QAAQ,EAAE,MAAM,SAAS,UAAU,CAAC,oBAAoB,KAAK,UAAU,CAAC,EAAE;AAAA,MAC1E,aAAa,oBAAoB,KAAK,OAAO,eAAe,CAAC,CAAC;AAAA,MAC9D,mBAAmB,oBAAoB,KAAK,OAAO,qBAAqB,CAAC,CAAC;AAAA,IAC5E;AAAA;AAAA;AAAA,IAGA,EAAE,iBAAiB,MAAM;AAAA,EAC3B;AACF;AAGA,SAAS,oBAAoB,MAKf;AACZ,QAAM,WAAW,oBAAI,IAAY,CAAC,KAAK,SAAS,WAAW,CAAC;AAC5D,aAAW,aAAa,KAAK,SAAS,QAAQ;AAC5C,UAAM,UAAU,0BAA0B,UAAU,QAAQ,OAAO;AACnE,QAAI,QAAS,UAAS,IAAI,OAAO;AAAA,EACnC;AACA,QAAM,yBAAyB;AAAA,IAC7B,KAAK,SAAS,iBAAiB,QAAQ;AAAA,EACzC;AACA,MAAI,uBAAwB,UAAS,IAAI,sBAAsB;AAE/D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,MACf,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,YAAY;AAAA,QAC7B;AAAA,QACA;AAAA,UACE,SAAS,qBAAqB;AAAA,YAC5B,YAAY,KAAK;AAAA,YACjB,QAAQ,KAAK;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAoBA,eAAsB,oCACpB,SACA;AACA,QAAM,WAAW,sBAAsB,QAAQ,SAAS,QAAQ;AAChE,QAAM,UAAU,MAAM,wBAAwB;AAAA,IAC5C,UAAU,EAAE,SAAS,QAAQ,eAAe;AAAA,IAC5C,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,UAAU,CAAC,oBAAoB,QAAQ,UAAU,CAAC;AAAA,IACpD;AAAA,IACA,uBAAuB,EAAE,SAAS,KAAK;AAAA,EACzC,CAAC;AAED,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,aAAa,QAAQ,SAAS,WAAW;AAAA,IACzC,oBAAoB;AAAA,MAClB,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../src/headless-client.ts","../src/smart-session-signatures.ts"],"sourcesContent":["/**\n * Headless 1auth client.\n *\n * Used by integrators that hold their own ECDSA signer in localStorage\n * and produce signatures for an ERC-7579 validator other than the\n * passkey one (typically `@rhinestone/sdk` experimental SmartSession).\n *\n * Responsibilities:\n *  - Fetch sponsorship JWTs from the app's own backend.\n *  - Call `/api/intent/prepare?signingMode=headless` to get an\n *    orchestrator-quoted `intentOp` + `digestResult`.\n *  - Forward pre-encoded validator-prefixed signatures to the new\n *    `/api/intent/headless-execute` route.\n *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for\n *    the one-time SmartSession install ceremony.\n *\n * 1auth itself stays ignorant of session keys — the on-chain\n * SmartSession validator is the only authority over what a session key\n * may sign for. The host app persists `{ sessionKeyAddress, permissionId,\n * accountAddress, permissions }` in its own storage.\n */\n\nimport type {\n  HeadlessIntentOptions,\n  HeadlessIntentStatusResult,\n  HeadlessPrepareResult,\n  HeadlessSubmitOptions,\n  HeadlessSubmitResult,\n  InstallSmartSessionOptions,\n  InstallSmartSessionResult,\n  IntentTokenRequest,\n  PasskeyProviderConfig,\n  SponsorshipCallbackConfig,\n  SponsorshipConfig,\n} from \"./types\";\nimport { tokenFetchError } from \"./sponsorship-fetch\";\n\nconst DEFAULT_PROVIDER_URL = \"https://passkey.1auth.app\";\n\nconst MISSING_APP_CREDENTIALS_MESSAGE =\n  \"No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT — pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.\";\n\ntype AccessTokenFetchResult =\n  | { ok: true; accessToken: string }\n  | { ok: false; code?: \"MISSING_APP_CREDENTIALS\"; message: string };\n\ntype ExtensionTokenFetchResult =\n  | { ok: true; extensionToken: string | undefined }\n  | { ok: false; message: string };\n\n/**\n * Mirrors `normalizeSponsorship` in `client.ts`. Kept local so the\n * headless entry point doesn't pull in the whole OneAuthClient module\n * graph for callers that only need the headless surface.\n */\nfunction normalizeSponsorship(\n  config: SponsorshipConfig | undefined,\n): SponsorshipCallbackConfig | null {\n  if (!config) return null;\n  if (\"accessToken\" in config && \"getExtensionToken\" in config) {\n    return config;\n  }\n  const { accessTokenUrl, extensionTokenUrl } = config;\n  return {\n    accessToken: async () => {\n      const response = await fetch(accessTokenUrl, { credentials: \"include\" });\n      if (!response.ok) {\n        throw await tokenFetchError(\"access token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Access token response missing `token` field\");\n      }\n      return data.token;\n    },\n    getExtensionToken: async (intentOp: string) => {\n      const response = await fetch(extensionTokenUrl, {\n        method: \"POST\",\n        credentials: \"include\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ intentOp }),\n      });\n      if (!response.ok) {\n        throw await tokenFetchError(\"extension token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Extension token response missing `token` field\");\n      }\n      return data.token;\n    },\n  };\n}\n\nexport class OneAuthHeadlessClient {\n  private providerUrl: string;\n  private clientId?: string;\n  private sponsorship: SponsorshipCallbackConfig | null;\n\n  constructor(config: PasskeyProviderConfig) {\n    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;\n    this.clientId = config.clientId;\n    this.sponsorship = normalizeSponsorship(config.sponsorship);\n  }\n\n  setSponsorship(sponsorship: SponsorshipConfig | undefined): void {\n    this.sponsorship = normalizeSponsorship(sponsorship);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Sponsorship JWT fetchers\n  // ---------------------------------------------------------------------------\n\n  private async fetchAccessToken(): Promise<AccessTokenFetchResult> {\n    if (!this.sponsorship) {\n      return {\n        ok: false,\n        code: \"MISSING_APP_CREDENTIALS\",\n        message: MISSING_APP_CREDENTIALS_MESSAGE,\n      };\n    }\n    try {\n      const accessToken = await this.sponsorship.accessToken();\n      return { ok: true, accessToken };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  private async fetchExtensionToken(\n    intentOp: string,\n    sponsor: boolean,\n  ): Promise<ExtensionTokenFetchResult> {\n    if (!sponsor) return { ok: true, extensionToken: undefined };\n    if (!this.sponsorship) {\n      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };\n    }\n    try {\n      const token = await this.sponsorship.getExtensionToken(intentOp);\n      return { ok: true, extensionToken: token };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Intent prepare / submit\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Quote an intent without opening any dialog. Returns the orchestrator's\n   * `intentOp` plus the digest the caller must sign with their own\n   * validator (e.g. SmartSession). The caller is responsible for\n   * encoding signatures and submitting via {@link submitIntent}.\n   */\n  async prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\"prepareIntent requires either `username` or `accountAddress`\");\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    // bigint → string conversion for token requests; matches what the\n    // dialog flow does before serializing requestBody.\n    const tokenRequests = options.tokenRequests?.map((tr: IntentTokenRequest) => ({\n      token: tr.token,\n      amount: tr.amount.toString(),\n    }));\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      tokenRequests,\n      sourceAssets: options.sourceAssets,\n      sourceChainId: options.sourceChainId,\n      sessionKeyHandle: options.sessionKeyHandle,\n      clientId: this.clientId,\n      signingMode: \"headless\" as const,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Prepare failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessPrepareResult;\n  }\n\n  /**\n   * Forward a pre-signed intent to the orchestrator. The caller has\n   * already encoded validator-prefixed origin + destination signatures\n   * (one origin signature per intent element); 1auth treats them as\n   * opaque bytes.\n   *\n   * If `sponsor` is omitted or `true`, an extension token is fetched\n   * just-in-time and bound to the intent. Pass `sponsor: false` for\n   * self-paying intents.\n   */\n  async submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult> {\n    const sponsor = options.sponsor ?? true;\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);\n    if (!extensionResult.ok) {\n      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);\n    }\n\n    const body = {\n      intentOp: options.intentOp,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      expiresAt: options.expiresAt,\n      originSignatures: options.originSignatures,\n      destinationSignature: options.destinationSignature,\n      targetExecutionSignature: options.targetExecutionSignature,\n      auth: {\n        accessToken: accessTokenResult.accessToken,\n        ...(extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }),\n      },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Headless execute failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessSubmitResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Status / wait — proxies to the existing routes (no headless variant needed).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch the latest known status for a submitted headless intent.\n   * This is a non-blocking read and may return `pending` before a\n   * solver has produced a fill transaction hash.\n   */\n  async getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult> {\n    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);\n    if (!response.ok) {\n      throw new Error(`Status fetch failed (${response.status})`);\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  /**\n   * Wait for a submitted headless intent to produce a status update and,\n   * when available, the final fill transaction hash. The wait endpoint\n   * needs the opaque `transactionResult` returned by submit because 1auth\n   * does not persist that SDK object in its database.\n   */\n  async waitForIntent(\n    intentId: string,\n    transactionResult: unknown,\n  ): Promise<HeadlessIntentStatusResult> {\n    if (!transactionResult) {\n      throw new Error(\"waitForIntent requires submitResult.transactionResult\");\n    }\n\n    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ transactionResult }),\n    });\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n        details?: string;\n      };\n      throw new Error(\n        errorData.details || errorData.error || `Wait fetch failed (${response.status})`,\n      );\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // SmartSession install (one-time, passkey-signed)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Resolve the SmartSession install call(s) for `sessionKeyAddress`\n   * with the supplied `permissions`.\n   *\n   * Returns `{ install, sessionKeyHandle }`:\n   *\n   *  - `install` is a `{ targetChain, calls }` pair the caller feeds\n   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`\n   *    so the user passkey-signs the install via the existing dialog.\n   *  - `sessionKeyHandle` contains the deterministic `permissionId`\n   *    plus metadata to persist in localStorage. Persist this BEFORE\n   *    submitting the install so a refresh during signing doesn't\n   *    lose the handle.\n   *\n   * If the validator is already installed on the user's account,\n   * `install.calls` is empty and `install.alreadyInstalled` is true.\n   * The caller should still persist `sessionKeyHandle` — the on-chain\n   * session enabling happens at first headless use via SmartSession's\n   * ENABLE-mode signature wrapping (see follow-up).\n   */\n  async installSmartSession(\n    options: InstallSmartSessionOptions,\n  ): Promise<InstallSmartSessionResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\n        \"installSmartSession requires either `username` or `accountAddress`\",\n      );\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(\n        `Sponsorship access token fetch failed: ${accessTokenResult.message}`,\n      );\n    }\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      sessionKeyAddress: options.sessionKeyAddress,\n      permissions: options.permissions,\n      validUntil: options.validUntil,\n      validAfter: options.validAfter,\n      maxUses: options.maxUses,\n      enableSessionSignature: options.enableSessionSignature,\n      label: options.label,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n      };\n      throw new Error(errorData.error || `Install failed (${response.status})`);\n    }\n\n    return (await response.json()) as InstallSmartSessionResult;\n  }\n}\n","import { type Address, type Hex } from \"viem\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport {\n  createRhinestoneAccount,\n  type Session,\n  type SignData,\n  type SignerSet,\n} from \"@rhinestone/sdk\";\nimport { toSession } from \"@rhinestone/sdk/smart-sessions\";\nimport { getChainById } from \"./registry\";\nimport type { HeadlessPrepareResult, SessionKeyHandle } from \"./types\";\n\n/** Restores bigint sentinel strings emitted by 1auth's JSON transport. */\nfunction reviveBigIntStrings<T>(value: T): T {\n  if (Array.isArray(value)) return value.map((entry) => reviveBigIntStrings(entry)) as T;\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [key, reviveBigIntStrings(entry)]),\n    ) as T;\n  }\n  if (typeof value === \"string\" && value.startsWith(\"__bigint:\")) {\n    return BigInt(value.slice(\"__bigint:\".length)) as T;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) return BigInt(value) as T;\n  return value;\n}\n\n/** Parses the prepared transaction enough to recover the SDK-native SignData. */\nfunction parsePreparedSignData(value: string): SignData {\n  const prepared = JSON.parse(value, (_key, nested) => reviveBigIntStrings(nested)) as {\n    quotes?: { best?: { signData?: SignData } };\n  };\n  const signData = prepared.quotes?.best?.signData;\n  if (!signData) {\n    throw new Error(\"Prepared headless intent is missing quotes.best.signData\");\n  }\n  return signData;\n}\n\n/** Reads the numeric EIP-712 chain id from a typed-data domain. */\nfunction chainIdFromSignDataDomain(domainChainId: unknown): number | undefined {\n  if (typeof domainChainId === \"number\" && Number.isSafeInteger(domainChainId)) {\n    return domainChainId;\n  }\n  if (typeof domainChainId === \"bigint\") return Number(domainChainId);\n  if (typeof domainChainId === \"string\" && /^\\d+$/.test(domainChainId)) {\n    return Number(domainChainId);\n  }\n  return undefined;\n}\n\n/** Rebuilds the SDK SmartSession object from the persisted grant handle. */\nfunction buildSessionForChain(args: {\n  privateKey: Hex;\n  handle: SessionKeyHandle;\n  chainId: number;\n}): Session {\n  return toSession(\n    {\n      chain: getChainById(args.chainId),\n      owners: { type: \"ecdsa\", accounts: [privateKeyToAccount(args.privateKey)] },\n      permissions: reviveBigIntStrings(args.handle.permissions ?? []),\n      crossChainPermits: reviveBigIntStrings(args.handle.crossChainPermits ?? []),\n    },\n    // The production SmartSession module is deployed on testnets too. Never opt\n    // into SDK dev contracts for 1auth headless permissions.\n    { useDevContracts: false },\n  );\n}\n\n/** Builds a per-chain SmartSession signer set for every chain in SignData. */\nfunction buildSessionSigners(args: {\n  privateKey: Hex;\n  handle: SessionKeyHandle;\n  prepared: HeadlessPrepareResult;\n  signData: SignData;\n}): SignerSet {\n  const chainIds = new Set<number>([args.prepared.targetChain]);\n  for (const typedData of args.signData.origin) {\n    const chainId = chainIdFromSignDataDomain(typedData.domain?.chainId);\n    if (chainId) chainIds.add(chainId);\n  }\n  const targetExecutionChainId = chainIdFromSignDataDomain(\n    args.signData.targetExecution?.domain?.chainId,\n  );\n  if (targetExecutionChainId) chainIds.add(targetExecutionChainId);\n\n  return {\n    type: \"experimental_session\",\n    sessions: Object.fromEntries(\n      [...chainIds].map((chainId) => [\n        chainId,\n        {\n          session: buildSessionForChain({\n            privateKey: args.privateKey,\n            handle: args.handle,\n            chainId,\n          }),\n        },\n      ]),\n    ),\n  };\n}\n\nexport interface BuildSmartSessionHeadlessSignaturesOptions {\n  /** ECDSA private key for the locally-held SmartSession signer. */\n  privateKey: Hex;\n  /** Smart account address the SmartSession is scoped to. */\n  accountAddress: Address;\n  /** Persisted handle returned by `grantPermissions` / SmartSession install. */\n  sessionKeyHandle: SessionKeyHandle;\n  /** Prepared headless intent returned by `OneAuthHeadlessClient.prepareIntent`. */\n  prepared: HeadlessPrepareResult;\n}\n\n/**\n * Builds SmartSession signatures for `OneAuthHeadlessClient.submitIntent`.\n *\n * This intentionally delegates signing and SmartSession signature packing to\n * `@rhinestone/sdk`. 1auth only rebuilds the persisted session descriptor and\n * supplies the SDK-native `SignData` returned by the orchestrator quote.\n */\nexport async function buildSmartSessionHeadlessSignatures(\n  options: BuildSmartSessionHeadlessSignaturesOptions,\n) {\n  const signData = parsePreparedSignData(options.prepared.intentOp);\n  const account = await createRhinestoneAccount({\n    initData: { address: options.accountAddress },\n    owners: {\n      type: \"ecdsa\",\n      accounts: [privateKeyToAccount(options.privateKey)],\n    },\n    experimental_sessions: { enabled: true },\n  });\n\n  return account.signIntent(\n    signData,\n    getChainById(options.prepared.targetChain),\n    buildSessionSigners({\n      privateKey: options.privateKey,\n      handle: options.sessionKeyHandle,\n      prepared: options.prepared,\n      signData,\n    }),\n  );\n}\n"],"mappings":";;;;;;;;AAqCA,IAAM,uBAAuB;AAE7B,IAAM,kCACJ;AAeF,SAAS,qBACP,QACkC;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,iBAAiB,UAAU,uBAAuB,QAAQ;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,EAAE,gBAAgB,kBAAkB,IAAI;AAC9C,SAAO;AAAA,IACL,aAAa,YAAY;AACvB,YAAM,WAAW,MAAM,MAAM,gBAAgB,EAAE,aAAa,UAAU,CAAC;AACvE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,gBAAgB,QAAQ;AAAA,MACtD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC/D;AACA,aAAO,KAAK;AAAA,IACd;AAAA,IACA,mBAAmB,OAAO,aAAqB;AAC7C,YAAM,WAAW,MAAM,MAAM,mBAAmB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,mBAAmB,QAAQ;AAAA,MACzD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAKjC,YAAY,QAA+B;AACzC,SAAK,cAAc,OAAO,eAAe;AACzC,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,qBAAqB,OAAO,WAAW;AAAA,EAC5D;AAAA,EAEA,eAAe,aAAkD;AAC/D,SAAK,cAAc,qBAAqB,WAAW;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAoD;AAChE,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,YAAY,YAAY;AACvD,aAAO,EAAE,IAAI,MAAM,YAAY;AAAA,IACjC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBACZ,UACA,SACoC;AACpC,QAAI,CAAC,QAAS,QAAO,EAAE,IAAI,MAAM,gBAAgB,OAAU;AAC3D,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,gCAAgC;AAAA,IAC/D;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAC/D,aAAO,EAAE,IAAI,MAAM,gBAAgB,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,SAAgE;AAClF,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAIA,UAAM,gBAAgB,QAAQ,eAAe,IAAI,CAAC,QAA4B;AAAA,MAC5E,OAAO,GAAG;AAAA,MACV,QAAQ,GAAG,OAAO,SAAS;AAAA,IAC7B,EAAE;AAEF,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ;AAAA,MACvB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,uBAAuB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAa,SAA+D;AAChF,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAEA,UAAM,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,UAAU,OAAO;AAChF,QAAI,CAAC,gBAAgB,IAAI;AACvB,YAAM,IAAI,MAAM,6CAA6C,gBAAgB,OAAO,EAAE;AAAA,IACxF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,sBAAsB,QAAQ;AAAA,MAC9B,0BAA0B,QAAQ;AAAA,MAClC,MAAM;AAAA,QACJ,aAAa,kBAAkB;AAAA,QAC/B,GAAI,gBAAgB,kBAAkB,EAAE,gBAAgB,gBAAgB,eAAe;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,gCAAgC;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,4BAA4B,SAAS,MAAM,GAAG;AAAA,IACnF;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,gBAAgB,UAAuD;AAC3E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,sBAAsB,QAAQ,EAAE;AAChF,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,IAC5D;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cACJ,UACA,mBACqC;AACrC,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,oBAAoB,QAAQ,IAAI;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAIzD,YAAM,IAAI;AAAA,QACR,UAAU,WAAW,UAAU,SAAS,sBAAsB,SAAS,MAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,oBACJ,SACoC;AACpC,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI;AAAA,QACR,0CAA0C,kBAAkB,OAAO;AAAA,MACrE;AAAA,IACF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,wBAAwB,QAAQ;AAAA,MAChC,OAAO,QAAQ;AAAA,MACf,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,yBAAyB;AAAA,MACvE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAGzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AACF;;;ACrXA,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,iBAAiB;AAK1B,SAAS,oBAAuB,OAAa;AAC3C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,UAAU,oBAAoB,KAAK,CAAC;AAChF,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,oBAAoB,KAAK,CAAC,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,WAAW,GAAG;AAC9D,WAAO,OAAO,MAAM,MAAM,YAAY,MAAM,CAAC;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,EAAG,QAAO,OAAO,KAAK;AACzE,SAAO;AACT;AAGA,SAAS,sBAAsB,OAAyB;AACtD,QAAM,WAAW,KAAK,MAAM,OAAO,CAAC,MAAM,WAAW,oBAAoB,MAAM,CAAC;AAGhF,QAAM,WAAW,SAAS,QAAQ,MAAM;AACxC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,SAAS,0BAA0B,eAA4C;AAC7E,MAAI,OAAO,kBAAkB,YAAY,OAAO,cAAc,aAAa,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,MAAI,OAAO,kBAAkB,SAAU,QAAO,OAAO,aAAa;AAClE,MAAI,OAAO,kBAAkB,YAAY,QAAQ,KAAK,aAAa,GAAG;AACpE,WAAO,OAAO,aAAa;AAAA,EAC7B;AACA,SAAO;AACT;AAGA,SAAS,qBAAqB,MAIlB;AACV,SAAO;AAAA,IACL;AAAA,MACE,OAAO,aAAa,KAAK,OAAO;AAAA,MAChC,QAAQ,EAAE,MAAM,SAAS,UAAU,CAAC,oBAAoB,KAAK,UAAU,CAAC,EAAE;AAAA,MAC1E,aAAa,oBAAoB,KAAK,OAAO,eAAe,CAAC,CAAC;AAAA,MAC9D,mBAAmB,oBAAoB,KAAK,OAAO,qBAAqB,CAAC,CAAC;AAAA,IAC5E;AAAA;AAAA;AAAA,IAGA,EAAE,iBAAiB,MAAM;AAAA,EAC3B;AACF;AAGA,SAAS,oBAAoB,MAKf;AACZ,QAAM,WAAW,oBAAI,IAAY,CAAC,KAAK,SAAS,WAAW,CAAC;AAC5D,aAAW,aAAa,KAAK,SAAS,QAAQ;AAC5C,UAAM,UAAU,0BAA0B,UAAU,QAAQ,OAAO;AACnE,QAAI,QAAS,UAAS,IAAI,OAAO;AAAA,EACnC;AACA,QAAM,yBAAyB;AAAA,IAC7B,KAAK,SAAS,iBAAiB,QAAQ;AAAA,EACzC;AACA,MAAI,uBAAwB,UAAS,IAAI,sBAAsB;AAE/D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,MACf,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,YAAY;AAAA,QAC7B;AAAA,QACA;AAAA,UACE,SAAS,qBAAqB;AAAA,YAC5B,YAAY,KAAK;AAAA,YACjB,QAAQ,KAAK;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAoBA,eAAsB,oCACpB,SACA;AACA,QAAM,WAAW,sBAAsB,QAAQ,SAAS,QAAQ;AAChE,QAAM,UAAU,MAAM,wBAAwB;AAAA,IAC5C,UAAU,EAAE,SAAS,QAAQ,eAAe;AAAA,IAC5C,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,UAAU,CAAC,oBAAoB,QAAQ,UAAU,CAAC;AAAA,IACpD;AAAA,IACA,uBAAuB,EAAE,SAAS,KAAK;AAAA,EACzC,CAAC;AAED,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,aAAa,QAAQ,SAAS,WAAW;AAAA,IACzC,oBAAoB;AAAA,MAClB,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { O as OneAuthClient } from './client-F4DnFM8d.mjs';
-import { Abi, Address, LocalAccount, WalletClient, Hash, Chain } from 'viem';
+import { O as OneAuthClient } from './client-DvtGr2xn.mjs';
+import { Abi, Address, LocalAccount, WalletClient, Hash } from 'viem';
 import { Permission } from '@rhinestone/sdk';
 export { Permission } from '@rhinestone/sdk';
-import { h as IntentCall, i as SendIntentResult } from './types-U_dwxbtS.mjs';
-export { a7 as AssetBalance, a8 as AssetBalanceBucket, a9 as AssetsResponse, u as AuthFlow, A as AuthResult, v as AuthWithModalOptions, z as AuthenticateOptions, B as AuthenticateResult, R as BalanceRequirement, ap as BatchIntentItem, as as BatchIntentItemResult, ad as CheckConsentOptions, ae as CheckConsentResult, a0 as CloseOnStatus, y as ConnectResult, ac as ConsentData, ab as ConsentField, w as CreateAccountWithModalOptions, C as CreateCrossChainPermissionInput, r as CreateSigningRequestResponse, k as CrossChainPermit, l as CrossChainSettlementLayer, M as EIP712Domain, O as EIP712TypeField, N as EIP712Types, E as EmbedOptions, a2 as ExecuteIntentResponse, a6 as GetAssetsOptions, an as GrantPermissionContractMetadata, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, a4 as IntentHistoryItem, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, Z as IntentQuote, _ as IntentStatus, X as IntentTokenRequest, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, L as LoginWithModalOptions, ax as OneAuthTelemetryAttributeValue, ay as OneAuthTelemetryAttributes, az as OneAuthTelemetryConfig, aA as OneAuthTelemetryEvent, aB as OneAuthTelemetryEventName, aC as OneAuthTelemetryFlow, aD as OneAuthTelemetryTraceContext, $ as OrchestratorStatus, t as PasskeyCredential, P as PasskeyProviderConfig, au as PrepareBatchIntentResponse, a1 as PrepareIntentResponse, at as PreparedBatchIntent, af as RequestConsentOptions, ag as RequestConsentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, Y as SendIntentOptions, am as SessionGrantChain, al as SessionGrantRecord, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, x as SignerType, p as SigningError, q as SigningErrorCode, m as SigningRequestOptions, s as SigningRequestStatus, n as SigningResult, D as SigningResultBase, o as SigningSuccess, ao as SmartSessionPolicy, av as SponsorshipCallbackConfig, S as SponsorshipConfig, aw as SponsorshipUrlConfig, aa as ThemeConfig, T as TransactionAction, V as TransactionDetails, Q as TransactionFees, U as UserPasskeysResponse, W as WebAuthnSignature, j as createCrossChainPermission } from './types-U_dwxbtS.mjs';
-export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-IvYXPMpk.mjs';
-import { P as PasskeyWalletClientConfig, S as SendCallsParams } from './verify-C8-a5c3K.mjs';
-export { E as ETHEREUM_MESSAGE_PREFIX, T as TransactionCall, e as encodeWebAuthnSignature, h as hashCalls, a as hashMessage, v as verifyMessageHash } from './verify-C8-a5c3K.mjs';
+import { h as IntentCall, i as SendIntentResult } from './types-C0jKNT_t.mjs';
+export { a7 as AssetBalance, a8 as AssetBalanceBucket, a9 as AssetsResponse, u as AuthFlow, A as AuthResult, v as AuthWithModalOptions, z as AuthenticateOptions, B as AuthenticateResult, R as BalanceRequirement, ap as BatchIntentItem, as as BatchIntentItemResult, ad as CheckConsentOptions, ae as CheckConsentResult, a0 as CloseOnStatus, y as ConnectResult, ac as ConsentData, ab as ConsentField, w as CreateAccountWithModalOptions, C as CreateCrossChainPermissionInput, r as CreateSigningRequestResponse, k as CrossChainPermit, l as CrossChainSettlementLayer, M as EIP712Domain, O as EIP712TypeField, N as EIP712Types, E as EmbedOptions, a2 as ExecuteIntentResponse, a6 as GetAssetsOptions, an as GrantPermissionContractMetadata, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, a4 as IntentHistoryItem, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, Z as IntentQuote, _ as IntentStatus, X as IntentTokenRequest, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, L as LoginWithModalOptions, ax as OneAuthTelemetryAttributeValue, ay as OneAuthTelemetryAttributes, az as OneAuthTelemetryConfig, aA as OneAuthTelemetryEvent, aB as OneAuthTelemetryEventName, aC as OneAuthTelemetryFlow, aD as OneAuthTelemetryTraceContext, $ as OrchestratorStatus, t as PasskeyCredential, P as PasskeyProviderConfig, au as PrepareBatchIntentResponse, a1 as PrepareIntentResponse, at as PreparedBatchIntent, af as RequestConsentOptions, ag as RequestConsentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, Y as SendIntentOptions, am as SessionGrantChain, al as SessionGrantRecord, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, x as SignerType, p as SigningError, q as SigningErrorCode, m as SigningRequestOptions, s as SigningRequestStatus, n as SigningResult, D as SigningResultBase, o as SigningSuccess, ao as SmartSessionPolicy, av as SponsorshipCallbackConfig, S as SponsorshipConfig, aw as SponsorshipUrlConfig, aa as ThemeConfig, T as TransactionAction, V as TransactionDetails, Q as TransactionFees, U as UserPasskeysResponse, W as WebAuthnSignature, j as createCrossChainPermission } from './types-C0jKNT_t.mjs';
+export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-NYl0jlHw.mjs';
+import { P as PasskeyWalletClientConfig, S as SendCallsParams } from './verify-aWdi5O2z.mjs';
+export { C as ChainFilterOptions, E as ETHEREUM_MESSAGE_PREFIX, p as TokenConfig, T as TransactionCall, e as encodeWebAuthnSignature, b as getAllSupportedChainsAndTokens, f as getChainById, i as getChainExplorerUrl, j as getChainRpcUrl, g as getSupportedChainIds, a as getSupportedChains, d as getSupportedTokenSymbols, c as getSupportedTokens, l as getTokenAddress, n as getTokenDecimals, m as getTokenSymbol, h as hashCalls, q as hashMessage, k as isTestnet, o as isTokenAddressSupported, r as resolveTokenAddress, v as verifyMessageHash } from './verify-aWdi5O2z.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
 
@@ -160,7 +160,7 @@ type PasskeyWalletClient = WalletClient & {
  * const walletClient = createPasskeyWalletClient({
  *   accountAddress: '0x...',
  *   username: 'alice',
- *   providerUrl: 'https://passkey.1auth.box',
+ *   providerUrl: 'https://passkey.1auth.app',
  *   clientId: 'my-dapp',
  *   chain: baseSepolia,
  *   transport: http(),
@@ -289,45 +289,4 @@ interface BatchQueueWidgetProps {
  */
 declare function BatchQueueWidget({ onSignAll }: BatchQueueWidgetProps): react_jsx_runtime.JSX.Element | null;
 
-/**
- * @file Chain and token registry for the 1auth SDK.
- *
- * Wraps `@rhinestone/shared-configs` chain/token data and combines it with
- * viem's chain definitions to expose a filtered, testnet-aware registry.
- * Consumers can look up supported chains and tokens, resolve token addresses
- * by symbol, and retrieve chain metadata such as explorer URLs and default RPC
- * endpoints.
- *
- * Testnet inclusion is controlled by the `includeTestnets` option on each
- * function or, as a project-wide default, by the environment variables
- * `NEXT_PUBLIC_ORCHESTRATOR_USE_TESTNETS` or `ORCHESTRATOR_USE_TESTNETS`.
- */
-
-type TokenConfig = {
-    symbol: string;
-    address: Address;
-    decimals: number;
-};
-type ChainFilterOptions = {
-    includeTestnets?: boolean;
-    chainIds?: number[];
-};
-declare function getSupportedChainIds(options?: ChainFilterOptions): number[];
-declare function getSupportedChains(options?: ChainFilterOptions): Chain[];
-declare function getAllSupportedChainsAndTokens(options?: ChainFilterOptions): Array<{
-    chainId: number;
-    tokens: TokenConfig[];
-}>;
-declare function getChainById(chainId: number): Chain;
-declare function getChainExplorerUrl(chainId: number): string | undefined;
-declare function getChainRpcUrl(chainId: number): string | undefined;
-declare function getSupportedTokens(chainId: number): TokenConfig[];
-declare function getSupportedTokenSymbols(chainId: number): string[];
-declare function getTokenAddress(symbolOrAddress: string, chainId: number): Address;
-declare function getTokenDecimals(symbolOrAddress: string, chainId: number): number;
-declare function resolveTokenAddress(token: string, chainId: number): Address;
-declare function isTestnet(chainId: number): boolean;
-declare function getTokenSymbol(tokenAddress: Address, chainId: number): string;
-declare function isTokenAddressSupported(tokenAddress: Address, chainId: number): boolean;
-
-export { type BatchQueueContextValue, type BatchQueueIdentity, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type ChainFilterOptions, type DefinePermissionsConfig, type DefinedPermissions, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, PasskeyWalletClientConfig, SendCallsParams, SendIntentResult, type TokenConfig, createPasskeyAccount, createPasskeyWalletClient, definePermissions, getAllSupportedChainsAndTokens, getChainById, getChainExplorerUrl, getChainName, getChainRpcUrl, getSupportedChainIds, getSupportedChains, getSupportedTokenSymbols, getSupportedTokens, getTokenAddress, getTokenDecimals, getTokenSymbol, isTestnet, isTokenAddressSupported, resolveTokenAddress, useBatchQueue };
+export { type BatchQueueContextValue, type BatchQueueIdentity, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type DefinePermissionsConfig, type DefinedPermissions, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, PasskeyWalletClientConfig, SendCallsParams, SendIntentResult, createPasskeyAccount, createPasskeyWalletClient, definePermissions, getChainName, useBatchQueue };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { O as OneAuthClient } from './client-B_CzDa_I.js';
-import { Abi, Address, LocalAccount, WalletClient, Hash, Chain } from 'viem';
+import { O as OneAuthClient } from './client-Ewr_7x-d.js';
+import { Abi, Address, LocalAccount, WalletClient, Hash } from 'viem';
 import { Permission } from '@rhinestone/sdk';
 export { Permission } from '@rhinestone/sdk';
-import { h as IntentCall, i as SendIntentResult } from './types-U_dwxbtS.js';
-export { a7 as AssetBalance, a8 as AssetBalanceBucket, a9 as AssetsResponse, u as AuthFlow, A as AuthResult, v as AuthWithModalOptions, z as AuthenticateOptions, B as AuthenticateResult, R as BalanceRequirement, ap as BatchIntentItem, as as BatchIntentItemResult, ad as CheckConsentOptions, ae as CheckConsentResult, a0 as CloseOnStatus, y as ConnectResult, ac as ConsentData, ab as ConsentField, w as CreateAccountWithModalOptions, C as CreateCrossChainPermissionInput, r as CreateSigningRequestResponse, k as CrossChainPermit, l as CrossChainSettlementLayer, M as EIP712Domain, O as EIP712TypeField, N as EIP712Types, E as EmbedOptions, a2 as ExecuteIntentResponse, a6 as GetAssetsOptions, an as GrantPermissionContractMetadata, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, a4 as IntentHistoryItem, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, Z as IntentQuote, _ as IntentStatus, X as IntentTokenRequest, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, L as LoginWithModalOptions, ax as OneAuthTelemetryAttributeValue, ay as OneAuthTelemetryAttributes, az as OneAuthTelemetryConfig, aA as OneAuthTelemetryEvent, aB as OneAuthTelemetryEventName, aC as OneAuthTelemetryFlow, aD as OneAuthTelemetryTraceContext, $ as OrchestratorStatus, t as PasskeyCredential, P as PasskeyProviderConfig, au as PrepareBatchIntentResponse, a1 as PrepareIntentResponse, at as PreparedBatchIntent, af as RequestConsentOptions, ag as RequestConsentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, Y as SendIntentOptions, am as SessionGrantChain, al as SessionGrantRecord, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, x as SignerType, p as SigningError, q as SigningErrorCode, m as SigningRequestOptions, s as SigningRequestStatus, n as SigningResult, D as SigningResultBase, o as SigningSuccess, ao as SmartSessionPolicy, av as SponsorshipCallbackConfig, S as SponsorshipConfig, aw as SponsorshipUrlConfig, aa as ThemeConfig, T as TransactionAction, V as TransactionDetails, Q as TransactionFees, U as UserPasskeysResponse, W as WebAuthnSignature, j as createCrossChainPermission } from './types-U_dwxbtS.js';
-export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-Cd7Ip5L-.js';
-import { P as PasskeyWalletClientConfig, S as SendCallsParams } from './verify-BLgZzwmJ.js';
-export { E as ETHEREUM_MESSAGE_PREFIX, T as TransactionCall, e as encodeWebAuthnSignature, h as hashCalls, a as hashMessage, v as verifyMessageHash } from './verify-BLgZzwmJ.js';
+import { h as IntentCall, i as SendIntentResult } from './types-C0jKNT_t.js';
+export { a7 as AssetBalance, a8 as AssetBalanceBucket, a9 as AssetsResponse, u as AuthFlow, A as AuthResult, v as AuthWithModalOptions, z as AuthenticateOptions, B as AuthenticateResult, R as BalanceRequirement, ap as BatchIntentItem, as as BatchIntentItemResult, ad as CheckConsentOptions, ae as CheckConsentResult, a0 as CloseOnStatus, y as ConnectResult, ac as ConsentData, ab as ConsentField, w as CreateAccountWithModalOptions, C as CreateCrossChainPermissionInput, r as CreateSigningRequestResponse, k as CrossChainPermit, l as CrossChainSettlementLayer, M as EIP712Domain, O as EIP712TypeField, N as EIP712Types, E as EmbedOptions, a2 as ExecuteIntentResponse, a6 as GetAssetsOptions, an as GrantPermissionContractMetadata, ah as GrantPermissionsOptions, ai as GrantPermissionsResult, a4 as IntentHistoryItem, a3 as IntentHistoryOptions, a5 as IntentHistoryResult, Z as IntentQuote, _ as IntentStatus, X as IntentTokenRequest, aj as ListSessionGrantsOptions, ak as ListSessionGrantsResult, L as LoginWithModalOptions, ax as OneAuthTelemetryAttributeValue, ay as OneAuthTelemetryAttributes, az as OneAuthTelemetryConfig, aA as OneAuthTelemetryEvent, aB as OneAuthTelemetryEventName, aC as OneAuthTelemetryFlow, aD as OneAuthTelemetryTraceContext, $ as OrchestratorStatus, t as PasskeyCredential, P as PasskeyProviderConfig, au as PrepareBatchIntentResponse, a1 as PrepareIntentResponse, at as PreparedBatchIntent, af as RequestConsentOptions, ag as RequestConsentResult, aq as SendBatchIntentOptions, ar as SendBatchIntentResult, Y as SendIntentOptions, am as SessionGrantChain, al as SessionGrantRecord, F as SignMessageOptions, G as SignMessageResult, J as SignTypedDataOptions, K as SignTypedDataResult, x as SignerType, p as SigningError, q as SigningErrorCode, m as SigningRequestOptions, s as SigningRequestStatus, n as SigningResult, D as SigningResultBase, o as SigningSuccess, ao as SmartSessionPolicy, av as SponsorshipCallbackConfig, S as SponsorshipConfig, aw as SponsorshipUrlConfig, aa as ThemeConfig, T as TransactionAction, V as TransactionDetails, Q as TransactionFees, U as UserPasskeysResponse, W as WebAuthnSignature, j as createCrossChainPermission } from './types-C0jKNT_t.js';
+export { O as OneAuthProvider, a as OneAuthProviderOptions, c as createOneAuthProvider } from './provider-BRHZoB8U.js';
+import { P as PasskeyWalletClientConfig, S as SendCallsParams } from './verify-CnOwPq78.js';
+export { C as ChainFilterOptions, E as ETHEREUM_MESSAGE_PREFIX, p as TokenConfig, T as TransactionCall, e as encodeWebAuthnSignature, b as getAllSupportedChainsAndTokens, f as getChainById, i as getChainExplorerUrl, j as getChainRpcUrl, g as getSupportedChainIds, a as getSupportedChains, d as getSupportedTokenSymbols, c as getSupportedTokens, l as getTokenAddress, n as getTokenDecimals, m as getTokenSymbol, h as hashCalls, q as hashMessage, k as isTestnet, o as isTokenAddressSupported, r as resolveTokenAddress, v as verifyMessageHash } from './verify-CnOwPq78.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
 
@@ -160,7 +160,7 @@ type PasskeyWalletClient = WalletClient & {
  * const walletClient = createPasskeyWalletClient({
  *   accountAddress: '0x...',
  *   username: 'alice',
- *   providerUrl: 'https://passkey.1auth.box',
+ *   providerUrl: 'https://passkey.1auth.app',
  *   clientId: 'my-dapp',
  *   chain: baseSepolia,
  *   transport: http(),
@@ -289,45 +289,4 @@ interface BatchQueueWidgetProps {
  */
 declare function BatchQueueWidget({ onSignAll }: BatchQueueWidgetProps): react_jsx_runtime.JSX.Element | null;
 
-/**
- * @file Chain and token registry for the 1auth SDK.
- *
- * Wraps `@rhinestone/shared-configs` chain/token data and combines it with
- * viem's chain definitions to expose a filtered, testnet-aware registry.
- * Consumers can look up supported chains and tokens, resolve token addresses
- * by symbol, and retrieve chain metadata such as explorer URLs and default RPC
- * endpoints.
- *
- * Testnet inclusion is controlled by the `includeTestnets` option on each
- * function or, as a project-wide default, by the environment variables
- * `NEXT_PUBLIC_ORCHESTRATOR_USE_TESTNETS` or `ORCHESTRATOR_USE_TESTNETS`.
- */
-
-type TokenConfig = {
-    symbol: string;
-    address: Address;
-    decimals: number;
-};
-type ChainFilterOptions = {
-    includeTestnets?: boolean;
-    chainIds?: number[];
-};
-declare function getSupportedChainIds(options?: ChainFilterOptions): number[];
-declare function getSupportedChains(options?: ChainFilterOptions): Chain[];
-declare function getAllSupportedChainsAndTokens(options?: ChainFilterOptions): Array<{
-    chainId: number;
-    tokens: TokenConfig[];
-}>;
-declare function getChainById(chainId: number): Chain;
-declare function getChainExplorerUrl(chainId: number): string | undefined;
-declare function getChainRpcUrl(chainId: number): string | undefined;
-declare function getSupportedTokens(chainId: number): TokenConfig[];
-declare function getSupportedTokenSymbols(chainId: number): string[];
-declare function getTokenAddress(symbolOrAddress: string, chainId: number): Address;
-declare function getTokenDecimals(symbolOrAddress: string, chainId: number): number;
-declare function resolveTokenAddress(token: string, chainId: number): Address;
-declare function isTestnet(chainId: number): boolean;
-declare function getTokenSymbol(tokenAddress: Address, chainId: number): string;
-declare function isTokenAddressSupported(tokenAddress: Address, chainId: number): boolean;
-
-export { type BatchQueueContextValue, type BatchQueueIdentity, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type ChainFilterOptions, type DefinePermissionsConfig, type DefinedPermissions, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, PasskeyWalletClientConfig, SendCallsParams, SendIntentResult, type TokenConfig, createPasskeyAccount, createPasskeyWalletClient, definePermissions, getAllSupportedChainsAndTokens, getChainById, getChainExplorerUrl, getChainName, getChainRpcUrl, getSupportedChainIds, getSupportedChains, getSupportedTokenSymbols, getSupportedTokens, getTokenAddress, getTokenDecimals, getTokenSymbol, isTestnet, isTokenAddressSupported, resolveTokenAddress, useBatchQueue };
+export { type BatchQueueContextValue, type BatchQueueIdentity, BatchQueueProvider, type BatchQueueProviderProps, BatchQueueWidget, type BatchQueueWidgetProps, type BatchedCall, type DefinePermissionsConfig, type DefinedPermissions, IntentCall, OneAuthClient, type PasskeyAccount, type PasskeyWalletClient, PasskeyWalletClientConfig, SendCallsParams, SendIntentResult, createPasskeyAccount, createPasskeyWalletClient, definePermissions, getChainName, useBatchQueue };

package/dist/index.js

@@ -378,7 +378,7 @@ var POPUP_WIDTH = LOADING_MODAL_WIDTH;
 var POPUP_HEIGHT = 600;
 var DEFAULT_EMBED_WIDTH = `${LOADING_MODAL_WIDTH}px`;
 var DEFAULT_EMBED_HEIGHT = "500px";
-var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var DEFAULT_PROVIDER_URL = "https://passkey.1auth.app";
 function currentWindowOrigin() {
   if (typeof window === "undefined") return null;
   const origin = window.location?.origin;
@@ -834,7 +834,7 @@ var OneAuthClient = class {
    * Falls back to the raw dialog URL string if URL parsing fails (e.g. during
    * unit tests with non-standard URL formats).
    *
-   * @returns The scheme + host + optional port of the dialog app (e.g. `"https://passkey.1auth.box"`).
+   * @returns The scheme + host + optional port of the dialog app (e.g. `"https://passkey.1auth.app"`).
    */
   getDialogOrigin() {
     const dialogUrl = this.getDialogUrl();
@@ -1885,7 +1885,7 @@ var OneAuthClient = class {
       };
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_CLOSE") {
+        if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           resolveClosed(iframeReadyObserved);
         }
       };
@@ -2584,7 +2584,7 @@ var OneAuthClient = class {
       const dialogOrigin2 = this.getDialogOrigin();
       const earlyCloseHandler = (event) => {
         if (event.origin !== dialogOrigin2) return;
-        if (event.data?.type === "PASSKEY_CLOSE") {
+        if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           userClosedEarly = true;
           cleanup();
         }