@rhinestone/1auth 0.7.6 → 0.8.1

package/dist/index.js

@@ -34,6 +34,8 @@ __export(index_exports, {
   BatchQueueWidget: () => BatchQueueWidget,
   ETHEREUM_MESSAGE_PREFIX: () => ETHEREUM_MESSAGE_PREFIX,
   OneAuthClient: () => OneAuthClient,
+  OneAuthError: () => OneAuthError,
+  SIGNING_ERROR_CODES: () => SIGNING_ERROR_CODES,
   createCrossChainPermission: () => createCrossChainPermission,
   createOneAuthConnection: () => createOneAuthConnection,
   createOneAuthProvider: () => createOneAuthProvider,
@@ -55,6 +57,7 @@ __export(index_exports, {
   getTokenSymbol: () => getTokenSymbol,
   hashCalls: () => hashCalls,
   hashMessage: () => hashMessage,
+  isSigningErrorCode: () => isSigningErrorCode,
   isTestnet: () => isTestnet,
   isTokenAddressSupported: () => isTokenAddressSupported,
   resolveTokenAddress: () => resolveTokenAddress,
@@ -338,6 +341,111 @@ async function tokenFetchError(label, response) {
   );
 }
 
+// src/types.ts
+var SIGNING_ERROR_CODES = [
+  "USER_REJECTED",
+  "EXPIRED",
+  "INVALID_REQUEST",
+  "NETWORK_ERROR",
+  "POPUP_BLOCKED",
+  "SIGNING_FAILED",
+  "UNKNOWN"
+];
+function isSigningErrorCode(value) {
+  return typeof value === "string" && SIGNING_ERROR_CODES.includes(value);
+}
+
+// src/errors.ts
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function normalizeCandidateError(value) {
+  if (!isPlainRecord(value)) return void 0;
+  const candidate = {};
+  if (typeof value.code === "string") candidate.code = value.code;
+  if (typeof value.message === "string") candidate.message = value.message;
+  const details = normalizeOneAuthErrorDetails(value.details);
+  if (details) candidate.details = details;
+  return Object.keys(candidate).length > 0 ? candidate : void 0;
+}
+function normalizeOneAuthErrorDetails(value) {
+  if (typeof value === "string") return { reason: value };
+  if (Array.isArray(value)) {
+    const candidateErrors = value.map(normalizeCandidateError).filter((candidate) => candidate !== void 0);
+    return candidateErrors.length > 0 ? { candidateErrors } : void 0;
+  }
+  if (!isPlainRecord(value)) return void 0;
+  const details = {};
+  if (typeof value.providerCode === "string") details.providerCode = value.providerCode;
+  if (typeof value.traceId === "string") details.traceId = value.traceId;
+  if (typeof value.statusCode === "number" && Number.isFinite(value.statusCode)) {
+    details.statusCode = value.statusCode;
+  }
+  if (typeof value.errorType === "string") details.errorType = value.errorType;
+  if (Array.isArray(value.simulationUrls)) {
+    const simulationUrls = value.simulationUrls.filter(
+      (url) => typeof url === "string"
+    );
+    if (simulationUrls.length > 0) details.simulationUrls = simulationUrls;
+  }
+  if (typeof value.reason === "string") details.reason = value.reason;
+  if (Array.isArray(value.candidateErrors)) {
+    const candidateErrors = value.candidateErrors.map(normalizeCandidateError).filter((candidate) => candidate !== void 0);
+    if (candidateErrors.length > 0) details.candidateErrors = candidateErrors;
+  }
+  return Object.keys(details).length > 0 ? details : void 0;
+}
+function parseSigningResultError(value, fallbackCode = "SIGNING_FAILED", fallbackMessage = "Signing failed") {
+  if (!isPlainRecord(value)) return { code: fallbackCode, message: fallbackMessage };
+  const code = isSigningErrorCode(value.code) ? value.code : value.code === void 0 ? fallbackCode : "UNKNOWN";
+  return {
+    code,
+    message: typeof value.message === "string" ? value.message : fallbackMessage,
+    details: normalizeOneAuthErrorDetails(value.details)
+  };
+}
+var OneAuthError = class extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.name = "OneAuthError";
+    this.code = code;
+    this.details = details;
+  }
+};
+function toOneAuthError(error, fallbackMessage, fallbackCode = "UNKNOWN") {
+  return new OneAuthError(
+    error?.code || fallbackCode,
+    error?.message || fallbackMessage,
+    normalizeOneAuthErrorDetails(error?.details)
+  );
+}
+function executeErrorCode(errorData) {
+  if (!errorData || typeof errorData !== "object" || !("code" in errorData)) {
+    return "EXECUTE_FAILED";
+  }
+  return errorData.code === "INVALID_SIGNATURE" ? "INVALID_SIGNATURE" : "EXECUTE_FAILED";
+}
+function executeErrorDetails(debug) {
+  if (!debug || typeof debug !== "object") return void 0;
+  const details = {};
+  if ("code" in debug && typeof debug.code === "string") details.providerCode = debug.code;
+  if ("traceId" in debug && typeof debug.traceId === "string") details.traceId = debug.traceId;
+  if ("statusCode" in debug && typeof debug.statusCode === "number") {
+    details.statusCode = debug.statusCode;
+  }
+  if ("errorType" in debug && typeof debug.errorType === "string") {
+    details.errorType = debug.errorType;
+  }
+  if ("simulationUrls" in debug && Array.isArray(debug.simulationUrls)) {
+    details.simulationUrls = debug.simulationUrls.filter(
+      (url) => typeof url === "string"
+    );
+  }
+  return Object.keys(details).length > 0 ? details : void 0;
+}
+
 // ../loading-tokens/src/index.ts
 var SPINNER_SIZE = 82;
 var SPINNER_STROKE = 2.4118;
@@ -375,6 +483,10 @@ var LOADING_TITLE = "Loading...";
 var LOADING_SUBTITLE = "This will only take a few moments, do not close the window.";
 
 // src/client.ts
+function requireSigningPasskeyCredentials(value) {
+  if (!value) return void 0;
+  return typeof value.keyId === "number" ? value : void 0;
+}
 var POPUP_WIDTH = LOADING_MODAL_WIDTH;
 var POPUP_HEIGHT = 600;
 var DEFAULT_EMBED_WIDTH = `${LOADING_MODAL_WIDTH}px`;
@@ -512,6 +624,16 @@ function normalizeGrantTargetChains(options) {
 function normalizeGrantSourceChains(options) {
   return Array.from(new Set(options.sourceChains ?? []));
 }
+var sessionForgetHandlers = /* @__PURE__ */ new WeakMap();
+function registerSessionForgetHandler(client, handler) {
+  const handlers = sessionForgetHandlers.get(client) ?? /* @__PURE__ */ new Set();
+  handlers.add(handler);
+  sessionForgetHandlers.set(client, handlers);
+  return () => {
+    handlers.delete(handler);
+    if (handlers.size === 0) sessionForgetHandlers.delete(client);
+  };
+}
 var OneAuthClient = class {
   /**
    * Create a new OneAuthClient.
@@ -550,6 +672,7 @@ var OneAuthClient = class {
     this.config = { ...config, providerUrl, dialogUrl };
     this.theme = this.config.theme || {};
     this.sponsorship = normalizeSponsorship(config.sponsorship);
+    this.installDisconnectListener();
     if (typeof document !== "undefined") {
       this.injectPreconnect(providerUrl);
       if (dialogUrl !== providerUrl) {
@@ -571,6 +694,26 @@ var OneAuthClient = class {
     });
     this.emitTelemetry("client.init", initOperation, { outcome: "started" });
   }
+  /** Clear the default cache plus every provider bound to this client. */
+  forgetApplicationSessions() {
+    if (typeof window !== "undefined") localStorage.removeItem("1auth-user");
+    for (const handler of sessionForgetHandlers.get(this) ?? []) handler();
+    try {
+      this.config.onDisconnect?.();
+    } catch {
+    }
+  }
+  /** Forget embedder-side sessions from any trusted dialog transport. */
+  installDisconnectListener() {
+    if (typeof window === "undefined" || typeof document === "undefined" || typeof window.addEventListener !== "function") return;
+    const dialogOrigin = this.getDialogOrigin();
+    window.addEventListener("message", (event) => {
+      if (event.origin !== dialogOrigin) return;
+      if (event.data?.type === "PASSKEY_DISCONNECT") {
+        this.forgetApplicationSessions();
+      }
+    });
+  }
   /**
    * Update the sponsorship configuration at runtime. Pass `undefined` to
    * disable sponsorship.
@@ -702,13 +845,16 @@ var OneAuthClient = class {
       ...operation.trace?.spanId ? { spanId: operation.trace.spanId } : {}
     };
   }
+  /** Resolve the public funding policy while preserving the legacy user-paid alias. */
+  resolveSponsorshipMode(options) {
+    return options.sponsorshipMode ?? (options.sponsor === false ? "disabled" : "required");
+  }
   /**
    * Determine whether this signing call should request invisible dialog mode.
    * Resolution order: per-call option wins over the constructor config, which
    * wins over the platform-wide {@link DEFAULT_BLIND_SIGNING}. This lets an app
    * flip the global default for itself while still overriding individual
-   * high-risk calls — e.g. default-blind but force the review UI for a large
-   * transfer, or default-visible but blind-sign selected low-risk signatures.
+   * high-risk calls.
    */
   shouldRequestBlindSigning(options) {
     return options?.blind_signing ?? this.config.blind_signing ?? DEFAULT_BLIND_SIGNING;
@@ -741,12 +887,12 @@ var OneAuthClient = class {
     }
   }
   /**
-   * Fetch one extension token per intent, aligned with `sponsorFlags`.
-   * Returns an empty array when no intent is sponsored. Fired after
-   * `/prepare` so each token can be bound to its quote's `intentOp`, and
-   * overlaps the dialog / WebAuthn ceremony for no added serial latency.
+   * Fetch one extension token per canonical sponsorship intent input, aligned
+   * with `sponsorFlags`. Sponsored prepare uses the same token for the final
+   * quote and later submission, so route construction and execution share one
+   * digest-bound authorization.
    */
-  async fetchExtensionTokens(intentOps, sponsorFlags) {
+  async fetchExtensionTokens(sponsorshipIntentInputs, sponsorFlags) {
     if (!this.sponsorship) {
       return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
     }
@@ -755,8 +901,8 @@ var OneAuthClient = class {
     try {
       const sponsorship = this.sponsorship;
       const tokens = await Promise.all(
-        intentOps.map(
-          (op, i) => sponsorFlags[i] ? sponsorship.getExtensionToken(op) : Promise.resolve("")
+        sponsorshipIntentInputs.map(
+          (input, i) => sponsorFlags[i] ? sponsorship.getExtensionToken(input) : Promise.resolve("")
         )
       );
       return { ok: true, extensionTokens: tokens };
@@ -1765,11 +1911,13 @@ var OneAuthClient = class {
   async sendIntent(options) {
     const { accountAddress, targetChain } = options;
     const calls = capCallLabels(options.calls);
-    const sponsor = options.sponsor !== false;
+    const sponsorshipMode = this.resolveSponsorshipMode(options);
+    const sponsor = sponsorshipMode !== "disabled";
     const telemetry = this.createTelemetryOperation("intent", {
       targetChain: targetChain ?? null,
       callsCount: calls?.length ?? 0,
       sponsor,
+      sponsorshipMode,
       blindSigning: this.shouldRequestBlindSigning(options)
     });
     if (getStoredSignerType() === "eoa") {
@@ -1972,43 +2120,129 @@ var OneAuthClient = class {
     });
     const prepareStartedAt = Date.now();
     let prepareDurationMs;
-    const runPrepare = () => this.prepareIntent(requestBody, telemetry).then((r) => {
-      earlyPrepareResult = r;
+    const runPrepare = async () => {
+      let result;
+      if (sponsorshipMode === "disabled") {
+        result = await this.prepareIntent(
+          { ...requestBody, quoteMode: "final", sponsorshipMode: "self-funded" },
+          telemetry
+        );
+      } else {
+        const draft = await this.prepareSponsorshipDraft(
+          { ...requestBody, sponsorshipMode: "required" },
+          telemetry
+        );
+        if (!draft.success) {
+          result = draft;
+        } else {
+          const extensionTokensStartedAt = Date.now();
+          const quoteGrantResult = await this.fetchExtensionTokens(
+            [JSON.stringify(draft.sponsorshipIntentInput)],
+            [true]
+          );
+          extensionTokensDurationMs = Date.now() - extensionTokensStartedAt;
+          if (!quoteGrantResult.ok) {
+            if (sponsorshipMode === "preferred") {
+              extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+              result = await this.prepareIntent(
+                { ...requestBody, quoteMode: "final", sponsorshipMode: "self-funded" },
+                telemetry
+              );
+            } else {
+              result = {
+                success: false,
+                error: {
+                  code: "SPONSORSHIP_FETCH_FAILED",
+                  message: quoteGrantResult.message
+                }
+              };
+            }
+          } else {
+            const prepareFinalQuote = (quoteGrant) => this.prepareIntent(
+              {
+                ...requestBody,
+                quoteMode: "final",
+                sponsorshipMode: "required",
+                auth: {
+                  accessToken,
+                  extensionToken: quoteGrant
+                }
+              },
+              telemetry
+            );
+            let quoteIsSponsored = true;
+            result = await prepareFinalQuote(quoteGrantResult.extensionTokens[0]);
+            if (!result.success) {
+              const replacementQuoteGrant = await this.fetchExtensionTokens(
+                [JSON.stringify(draft.sponsorshipIntentInput)],
+                [true]
+              );
+              if (replacementQuoteGrant.ok) {
+                result = await prepareFinalQuote(replacementQuoteGrant.extensionTokens[0]);
+              }
+            }
+            if (!result.success && sponsorshipMode === "preferred") {
+              extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+              quoteIsSponsored = false;
+              result = await this.prepareIntent(
+                { ...requestBody, quoteMode: "final", sponsorshipMode: "self-funded" },
+                telemetry
+              );
+            }
+            if (result.success && quoteIsSponsored) {
+              const executionGrantResult = await this.fetchExtensionTokens(
+                [result.data.intentOp],
+                [true]
+              );
+              extensionTokensDurationMs = Date.now() - extensionTokensStartedAt;
+              if (!executionGrantResult.ok) {
+                if (sponsorshipMode === "preferred") {
+                  extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+                  quoteIsSponsored = false;
+                  result = await this.prepareIntent(
+                    { ...requestBody, quoteMode: "final", sponsorshipMode: "self-funded" },
+                    telemetry
+                  );
+                } else {
+                  result = {
+                    success: false,
+                    error: {
+                      code: "SPONSORSHIP_FETCH_FAILED",
+                      message: executionGrantResult.message
+                    }
+                  };
+                }
+              } else {
+                extensionTokensPromise = Promise.resolve(executionGrantResult);
+              }
+            }
+          }
+        }
+      }
+      earlyPrepareResult = result;
       prepareDurationMs = Date.now() - prepareStartedAt;
-      if (r.success) {
-        this.emitTelemetry("intent.prepare.succeeded", telemetry, {
+      this.emitTelemetry(
+        result.success ? "intent.prepare.succeeded" : "intent.prepare.failed",
+        telemetry,
+        result.success ? {
           outcome: "success",
           targetChain,
           status: "quoted",
-          attributes: {
-            accessTokenDurationMs,
-            dialogReadyDurationMs,
-            prepareDurationMs
-          }
-        });
-        const extensionTokensStartedAt = Date.now();
-        extensionTokensPromise = this.fetchExtensionTokens(
-          [r.data.intentOp],
-          [sponsor]
-        ).then((result) => {
-          extensionTokensDurationMs = Date.now() - extensionTokensStartedAt;
-          return result;
-        });
-      } else {
-        this.emitTelemetry("intent.prepare.failed", telemetry, {
+          attributes: { accessTokenDurationMs, dialogReadyDurationMs, prepareDurationMs }
+        } : {
           outcome: "failure",
           targetChain,
-          ...describeTelemetryError(r.error),
+          ...describeTelemetryError(result.error),
           attributes: {
             accessTokenDurationMs,
             dialogReadyDurationMs,
             prepareDurationMs,
             loadingPhase: "prepare"
           }
-        });
-      }
-      return r;
-    });
+        }
+      );
+      return result;
+    };
     const preparePromise = accessTokenFailure ? Promise.resolve({
       success: false,
       error: accessTokenFailure
@@ -2029,6 +2263,7 @@ var OneAuthClient = class {
       }
       accessToken = retryTokenResult.accessToken;
       requestBody.auth = { accessToken };
+      extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
       return runPrepare();
     };
     const readyOrClose = await Promise.race([
@@ -2082,27 +2317,18 @@ var OneAuthClient = class {
       try {
         const refreshedTokenResult = await this.fetchAccessToken();
         const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
-        const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
-          body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } }),
-          credentials: "include"
-        });
-        if (!refreshResponse.ok) {
-          console.error("[SDK] Quote refresh failed:", await refreshResponse.text());
+        accessToken = refreshToken;
+        requestBody.auth = { accessToken: refreshToken };
+        extensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
+        const refreshedResult = await runPrepare();
+        if (!refreshedResult.success) {
+          console.error("[SDK] Quote refresh failed:", refreshedResult.error.message);
           return null;
         }
-        const refreshedData = await refreshResponse.json();
-        const refreshedExtensionPromise = this.fetchExtensionTokens(
-          [refreshedData.intentOp],
-          [sponsor]
-        );
-        const extensionResult = await refreshedExtensionPromise;
+        const refreshedData = refreshedResult.data;
+        const extensionResult = await extensionTokensPromise;
         if (!extensionResult.ok) {
-          console.error(
-            "[SDK] Extension token refresh failed:",
-            extensionResult.message
-          );
+          console.error("[SDK] Extension token refresh failed:", extensionResult.message);
           return null;
         }
         const refreshedAuth = {
@@ -2110,9 +2336,7 @@ var OneAuthClient = class {
           extensionTokens: extensionResult.extensionTokens
         };
         prepareResponse = refreshedData;
-        accessToken = refreshToken;
-        requestBody.auth = { accessToken: refreshToken };
-        extensionTokensPromise = refreshedExtensionPromise;
+        extensionTokensPromise = Promise.resolve(extensionResult);
         currentInitPayload = {
           ...currentInitPayload,
           transaction: refreshedData.transaction,
@@ -2131,7 +2355,10 @@ var OneAuthClient = class {
           intentOp: refreshedData.intentOp,
           expiresAt: refreshedData.expiresAt,
           challenge: refreshedData.challenge,
-          originMessages: refreshedData.originMessages,
+          originMessages: refreshedData.originMessages?.map((message) => ({
+            chainId: message.chainId,
+            hash: message.messageHash
+          })),
           transaction: refreshedData.transaction,
           digestResult: refreshedData.digestResult,
           binding: refreshedData.binding,
@@ -2505,8 +2732,7 @@ var OneAuthClient = class {
             binding: prepareResponse.binding,
             // Signature from dialog
             signature: signingResult.signature,
-            passkey: signingResult.passkey,
-            // Include passkey info for signature encoding
+            passkey: requireSigningPasskeyCredentials(signingResult.passkey),
             // App JWT — `accessToken` is always present. `extensionToken` is
             // only included when sponsorship was requested (sponsor !== false).
             auth: {
@@ -2524,7 +2750,7 @@ var OneAuthClient = class {
           this.emitTelemetry("intent.execute.failed", telemetry, {
             outcome: "failure",
             targetChain: prepareResponse.targetChain,
-            errorCode: "EXECUTE_FAILED",
+            errorCode: executeErrorCode(errorData),
             errorMessage: errorData.error || "Failed to execute intent"
           });
           return {
@@ -2533,8 +2759,9 @@ var OneAuthClient = class {
             // No intentId - execute failed before creation
             status: "failed",
             error: {
-              code: "EXECUTE_FAILED",
-              message: errorData.error || "Failed to execute intent"
+              code: executeErrorCode(errorData),
+              message: errorData.error || "Failed to execute intent",
+              details: executeErrorDetails(errorData.debug)
             }
           };
         }
@@ -2791,7 +3018,7 @@ var OneAuthClient = class {
         error: "No sponsorship configured on OneAuthClient. Every user intent must carry the app's JWT \u2014 configure `sponsorship` on the client."
       };
     }
-    const sponsorFlags = options.intents.map((intent) => intent.sponsor !== false);
+    const sponsorshipModes = options.intents.map((intent) => this.resolveSponsorshipMode(intent));
     const accessTokenResult = await this.fetchAccessToken();
     if (!accessTokenResult.ok) {
       this.emitTelemetry("batch.prepare.failed", telemetry, {
@@ -2803,8 +3030,7 @@ var OneAuthClient = class {
         success: false,
         results: [],
         successCount: 0,
-        failureCount: 0,
-        error: accessTokenResult.message
+        failureCount: 0
       };
     }
     let accessToken = accessTokenResult.accessToken;
@@ -2846,13 +3072,12 @@ var OneAuthClient = class {
     });
     const dialogOrigin = this.getDialogOrigin();
     let earlyBatchResult = null;
-    let batchExtensionTokensPromise = Promise.resolve({ ok: true, extensionTokens: [] });
     this.emitTelemetry("batch.prepare.started", telemetry, {
       outcome: "started",
       intentCount: options.intents.length,
       targetChains: serializedIntents.map((intent) => intent.targetChain)
     });
-    const preparePromise = this.prepareBatchIntent(requestBody, telemetry).then((r) => {
+    const preparePromise = this.prepareBatchWithFunding(requestBody, sponsorshipModes, telemetry).then((r) => {
       earlyBatchResult = r;
       if (r.success) {
         this.emitTelemetry("batch.prepare.succeeded", telemetry, {
@@ -2860,10 +3085,6 @@ var OneAuthClient = class {
           intentCount: r.data.intents.length,
           targetChains: serializedIntents.map((intent) => intent.targetChain)
         });
-        batchExtensionTokensPromise = this.fetchExtensionTokens(
-          r.data.intents.map((intent) => intent.intentOp),
-          sponsorFlags
-        );
       } else {
         this.emitTelemetry("batch.prepare.failed", telemetry, {
           outcome: "failure",
@@ -2912,17 +3133,6 @@ var OneAuthClient = class {
         error: prepareResult.error
       };
     };
-    const handleSponsorshipFailure = async (message) => {
-      this.sendPrepareError(iframe, message);
-      await this.waitForDialogCloseUnlessBlind(blindSigning, dialog, cleanup);
-      return {
-        success: false,
-        results: [],
-        successCount: 0,
-        failureCount: 0,
-        error: `Sponsorship token fetch failed: ${message}`
-      };
-    };
     let prepareResponse;
     if (earlyBatchResult) {
       const prepareResult = earlyBatchResult;
@@ -2930,13 +3140,9 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
-      const batchExtensionResult = await batchExtensionTokensPromise;
-      if (!batchExtensionResult.ok) {
-        return handleSponsorshipFailure(batchExtensionResult.message);
-      }
       const batchSponsorshipTokens = {
         accessToken,
-        extensionTokens: batchExtensionResult.extensionTokens
+        extensionTokens: prepareResult.extensionTokens
       };
       currentBatchPayload = {
         mode: "iframe",
@@ -2972,13 +3178,9 @@ var OneAuthClient = class {
         return handleBatchPrepareFailure(prepareResult);
       }
       prepareResponse = prepareResult.data;
-      const batchExtensionResult = await batchExtensionTokensPromise;
-      if (!batchExtensionResult.ok) {
-        return handleSponsorshipFailure(batchExtensionResult.message);
-      }
       const batchSponsorshipTokens = {
         accessToken,
-        extensionTokens: batchExtensionResult.extensionTokens
+        extensionTokens: prepareResult.extensionTokens
       };
       currentBatchPayload = {
         mode: "iframe",
@@ -3013,41 +3215,40 @@ var OneAuthClient = class {
       const handleMessage = async (event) => {
         if (event.origin !== dialogOrigin) return;
         const message = event.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          this.emitTelemetry("dialog.cancelled", telemetry, {
+            outcome: "cancelled",
+            errorCode: "USER_REJECTED",
+            errorMessage: "Session disconnected"
+          });
+          resolve({
+            success: false,
+            results: [],
+            successCount: 0,
+            failureCount: 0
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_REFRESH_QUOTE") {
           try {
             const refreshedTokenResult = await this.fetchAccessToken();
             const refreshToken = refreshedTokenResult.ok ? refreshedTokenResult.accessToken : accessToken;
-            const refreshResponse = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
-              method: "POST",
-              headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
-              body: JSON.stringify({ ...requestBody, auth: { accessToken: refreshToken } })
-            });
-            if (refreshResponse.ok) {
-              const refreshed = await refreshResponse.json();
-              const refreshedExtensionPromise = this.fetchExtensionTokens(
-                refreshed.intents.map((intent) => intent.intentOp),
-                sponsorFlags
-              );
-              const extensionResult = await refreshedExtensionPromise;
-              if (!extensionResult.ok) {
-                console.error(
-                  "[SDK] Batch extension token refresh failed:",
-                  extensionResult.message
-                );
-                iframe.contentWindow?.postMessage({
-                  type: "PASSKEY_REFRESH_ERROR",
-                  error: "Failed to refresh batch quotes"
-                }, dialogOrigin);
-                return;
-              }
+            const refreshResult = await this.prepareBatchWithFunding(
+              { ...requestBody, auth: { accessToken: refreshToken } },
+              sponsorshipModes,
+              telemetry
+            );
+            if (refreshResult.success) {
+              const refreshed = refreshResult.data;
               const refreshedAuth = {
                 accessToken: refreshToken,
-                extensionTokens: extensionResult.extensionTokens
+                extensionTokens: refreshResult.extensionTokens
               };
               prepareResponse = refreshed;
               accessToken = refreshToken;
               requestBody.auth = { accessToken: refreshToken };
-              batchExtensionTokensPromise = refreshedExtensionPromise;
               currentBatchPayload = {
                 ...currentBatchPayload,
                 batchIntents: refreshed.intents,
@@ -3194,6 +3395,15 @@ var OneAuthClient = class {
         if (event.origin !== dialogOrigin) return;
         const message = event.data;
         const payload = message?.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: { code: "USER_REJECTED", message: "Session disconnected" }
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_SIGNING_RESULT" && payload?.requestId === requestId) {
           window.removeEventListener("message", handleMessage);
           if (message.success && payload.signature) {
@@ -3207,10 +3417,7 @@ var OneAuthClient = class {
           } else {
             resolve({
               success: false,
-              error: message.error || {
-                code: "SIGNING_FAILED",
-                message: "Signing failed"
-              }
+              error: parseSigningResultError(message.error)
             });
           }
         } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
@@ -3257,6 +3464,15 @@ var OneAuthClient = class {
         if (event.origin !== dialogOrigin) return;
         const message = event.data;
         const payload = message?.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: { code: "USER_REJECTED", message: "Session disconnected" }
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_SIGNING_RESULT") {
           window.removeEventListener("message", handleMessage);
           if (message.success && payload?.intentId) {
@@ -3275,10 +3491,7 @@ var OneAuthClient = class {
             cleanup();
             resolve({
               success: false,
-              error: message.error || {
-                code: "SIGNING_FAILED",
-                message: "Signing failed"
-              }
+              error: parseSigningResultError(message.error)
             });
           }
         } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
@@ -3324,6 +3537,15 @@ var OneAuthClient = class {
       const handleMessage = async (event) => {
         if (event.origin !== dialogOrigin) return;
         const message = event.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            error: { code: "USER_REJECTED", message: "Session disconnected" }
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_REFRESH_QUOTE") {
           const refreshedData = await onRefresh();
           if (refreshedData) {
@@ -3358,10 +3580,7 @@ var OneAuthClient = class {
             cleanup();
             resolve({
               success: false,
-              error: message.error || {
-                code: "SIGNING_FAILED",
-                message: "Signing failed"
-              }
+              error: parseSigningResultError(message.error)
             });
           }
         } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
@@ -3530,7 +3749,8 @@ var OneAuthClient = class {
   async prewarm() {
     if (typeof document === "undefined") return false;
     if (this.prewarmState) return this.prewarmState.ready;
-    const warmUrl = `${this.getDialogUrl()}/dialog/warm`;
+    const warmParams = new URLSearchParams({ parentOrigin: window.location.origin });
+    const warmUrl = `${this.getDialogUrl()}/dialog/warm?${warmParams.toString()}`;
     const iframe = document.createElement("iframe");
     iframe.setAttribute("aria-hidden", "true");
     iframe.setAttribute("tabindex", "-1");
@@ -3652,6 +3872,47 @@ var OneAuthClient = class {
    * @returns On success: `{ success: true, data: PrepareIntentResponse, tier }`.
    *   On failure: `{ success: false, error: { code, message, details? } }`.
    */
+  /**
+   * Request a non-sponsored draft solely to obtain the SDK-canonical intent
+   * input that the embedding app must authorize. The passkey service returns
+   * no signable quote or user data in this phase.
+   */
+  async prepareSponsorshipDraft(requestBody, telemetry) {
+    try {
+      const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+        body: JSON.stringify({ ...requestBody, quoteMode: "draft" })
+      });
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        return {
+          success: false,
+          error: {
+            code: "PREPARE_FAILED",
+            message: errorData.error || "Failed to prepare sponsorship draft",
+            details: errorData.details ?? errorData.candidateErrors ?? errorData
+          }
+        };
+      }
+      const data = await response.json();
+      if (data.sponsorshipIntentInput === void 0) {
+        return {
+          success: false,
+          error: { code: "PREPARE_FAILED", message: "Prepare response missing sponsorship intent input" }
+        };
+      }
+      return { success: true, sponsorshipIntentInput: data.sponsorshipIntentInput };
+    } catch (error) {
+      return {
+        success: false,
+        error: {
+          code: "NETWORK_ERROR",
+          message: error instanceof Error ? error.message : "Network error"
+        }
+      };
+    }
+  }
   async prepareIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/prepare`, {
@@ -3670,7 +3931,9 @@ var OneAuthClient = class {
           error: {
             code: errorMessage.includes("User not found") ? "USER_NOT_FOUND" : "PREPARE_FAILED",
             message: errorMessage,
-            details: errorData.details ?? errorData.candidateErrors ?? errorData
+            details: normalizeOneAuthErrorDetails(
+              errorData.details ?? (errorData.candidateErrors === void 0 ? errorData : { candidateErrors: errorData.candidateErrors })
+            )
           }
         };
       }
@@ -3703,6 +3966,134 @@ var OneAuthClient = class {
    * @returns On success: `{ success: true, data: PrepareBatchIntentResponse, tier }`.
    *   On failure: `{ success: false, error, failedIntents? }`.
    */
+  /**
+   * Draft, authorize, and authoritatively quote a batch without losing caller indices.
+   * Preferred sponsorship failures are retried only by an explicit full-batch
+   * self-funded re-quote so every returned intent shares one fresh merkle root.
+   */
+  async prepareBatchWithFunding(requestBody, sponsorshipModes, telemetry) {
+    const draftFundingModes = sponsorshipModes.map(
+      (mode) => mode === "disabled" ? "self-funded" : "required"
+    );
+    const draftResult = await this.prepareBatchDraft(
+      { ...requestBody, quoteMode: "draft", fundingModes: draftFundingModes },
+      telemetry
+    );
+    if (!draftResult.success) return draftResult;
+    const draftFailedIntents = draftResult.data.failedIntents ?? [];
+    const draftSuccessfulIndices = new Set(
+      Object.keys(draftResult.data.sponsorshipIntentInputs).map(Number)
+    );
+    if (draftSuccessfulIndices.size === 0) {
+      return {
+        success: false,
+        error: "All intents failed to get sponsorship drafts",
+        failedIntents: draftFailedIntents
+      };
+    }
+    const finalIntents = requestBody.intents.flatMap((intent, index) => draftSuccessfulIndices.has(index) ? [{ ...intent, originalIndex: index }] : []);
+    const grantsByIndex = {};
+    const finalFundingModes = [...draftFundingModes];
+    const sponsoredIndices = Object.keys(draftResult.data.sponsorshipIntentInputs).map(Number).filter((index) => sponsorshipModes[index] !== "disabled");
+    const grantResults = await Promise.allSettled(
+      sponsoredIndices.map(async (index) => ({
+        index,
+        token: await this.sponsorship.getExtensionToken(
+          JSON.stringify(draftResult.data.sponsorshipIntentInputs[String(index)])
+        )
+      }))
+    );
+    for (let i = 0; i < grantResults.length; i++) {
+      const result = grantResults[i];
+      const index = sponsoredIndices[i];
+      if (result.status === "fulfilled") {
+        grantsByIndex[String(index)] = result.value.token;
+      } else if (sponsorshipModes[index] === "preferred") {
+        finalFundingModes[index] = "self-funded";
+      } else {
+        return { success: false, error: `Sponsorship token fetch failed for required intent ${index}` };
+      }
+    }
+    const runFinal = (fundingModes) => this.prepareBatchIntent({
+      ...requestBody,
+      intents: finalIntents,
+      quoteMode: "final",
+      fundingModes,
+      quoteExtensionTokens: grantsByIndex
+    }, telemetry);
+    let finalResult = await runFinal(finalFundingModes);
+    const preferredSponsoredFailures = finalResult.success ? (finalResult.data.failedIntents ?? []).map((failure) => failure.index) : (finalResult.failedIntents ?? []).map((failure) => failure.index);
+    const preferredFallbackIndices = preferredSponsoredFailures.filter(
+      (index) => sponsorshipModes[index] === "preferred" && finalFundingModes[index] === "required"
+    );
+    if (preferredFallbackIndices.length > 0) {
+      for (const index of preferredFallbackIndices) {
+        finalFundingModes[index] = "self-funded";
+        delete grantsByIndex[String(index)];
+      }
+      finalResult = await runFinal(finalFundingModes);
+    }
+    if (!finalResult.success) return finalResult;
+    if (draftFailedIntents.length > 0) {
+      const draftFailedIndices = new Set(
+        draftFailedIntents.map((failure) => failure.index)
+      );
+      finalResult = {
+        ...finalResult,
+        data: {
+          ...finalResult.data,
+          failedIntents: [
+            ...draftFailedIntents,
+            ...(finalResult.data.failedIntents ?? []).filter(
+              (failure) => !draftFailedIndices.has(failure.index)
+            )
+          ]
+        }
+      };
+    }
+    const sponsoredPreparedIntents = finalResult.data.intents.filter(
+      (intent) => finalFundingModes[intent.index] === "required"
+    );
+    const executionGrantResults = await Promise.allSettled(
+      sponsoredPreparedIntents.map(async (intent) => ({
+        index: intent.index,
+        token: await this.sponsorship.getExtensionToken(intent.intentOp)
+      }))
+    );
+    const executionGrantsByIndex = {};
+    for (let i = 0; i < executionGrantResults.length; i++) {
+      const result = executionGrantResults[i];
+      const index = sponsoredPreparedIntents[i].index;
+      if (result.status === "fulfilled") {
+        executionGrantsByIndex[String(index)] = result.value.token;
+      } else {
+        return { success: false, error: `Execution sponsorship token fetch failed for intent ${index}` };
+      }
+    }
+    return {
+      ...finalResult,
+      extensionTokens: finalResult.data.intents.map(
+        (intent) => finalFundingModes[intent.index] === "required" ? executionGrantsByIndex[String(intent.index)] ?? "" : ""
+      )
+    };
+  }
+  /** Request canonical batch sponsorship inputs without returning signable data. */
+  async prepareBatchDraft(requestBody, telemetry) {
+    try {
+      const response = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...this.telemetryHeaders(telemetry) },
+        body: JSON.stringify(requestBody)
+      });
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        return { success: false, error: errorData.error || "Failed to prepare batch sponsorship draft", failedIntents: errorData.failedIntents };
+      }
+      return { success: true, data: await response.json(), tier: response.headers.get("X-Origin-Tier") };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
   async prepareBatchIntent(requestBody, telemetry) {
     try {
       const response = await fetch(`${this.config.providerUrl}/api/intent/batch-prepare`, {
@@ -4460,7 +4851,7 @@ var OneAuthClient = class {
             resolve({
               success: false,
               requestId,
-              error: message.error
+              error: parseSigningResultError(message.error)
             });
           }
         }
@@ -4485,7 +4876,7 @@ var OneAuthClient = class {
         success: false,
         requestId: requestId || void 0,
         error: {
-          code: error,
+          code: parseSigningResultError({ code: error }).code,
           message: errorMessage || "Unknown error"
         }
       };
@@ -4511,26 +4902,6 @@ var OneAuthClient = class {
     }
     return this.fetchSigningResult(requestId);
   }
-  /**
-   * Fetch passkeys for a user from the auth provider.
-   *
-   * The account address is the sole identity; the backend `resolveUserWhere`
-   * accepts an address as a globally-unique path identifier.
-   */
-  async getPasskeys(accountAddress) {
-    const response = await fetch(
-      `${this.config.providerUrl}/api/users/${encodeURIComponent(accountAddress)}/passkeys`,
-      {
-        headers: this.config.clientId ? { "x-client-id": this.config.clientId } : {}
-      }
-    );
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new Error(errorData.error || errorData.message || "Failed to fetch passkeys");
-    }
-    const data = await response.json();
-    return data.passkeys;
-  }
   /**
    * Register a signing request with the passkey service and receive a
    * short-lived `requestId`.
@@ -4917,9 +5288,6 @@ var OneAuthClient = class {
       } else if (event.data?.type === "PASSKEY_READY" && !revealed && readyFailsafe === void 0) {
         readyFailsafe = setTimeout(revealIframe, 1e3);
       }
-      if (event.data?.type === "PASSKEY_DISCONNECT") {
-        localStorage.removeItem("1auth-user");
-      }
     };
     window.addEventListener("message", handleMessage);
     const iframeUrl = new URL(url, window.location.href);
@@ -4951,6 +5319,27 @@ var OneAuthClient = class {
       iframe.style.opacity = "1";
       overlay.style.display = "none";
     };
+    const RESTORE_FRAME_BUDGET = 18;
+    const holdScroll = (target) => {
+      let frames = 0;
+      const tick = () => {
+        if (window.scrollY !== target) {
+          window.scrollTo({ top: target, left: window.scrollX, behavior: "auto" });
+        }
+        if (++frames < RESTORE_FRAME_BUDGET) requestAnimationFrame(tick);
+      };
+      tick();
+    };
+    let scrollBeforeBlur = null;
+    const onHostBlur = () => {
+      if (dialog.open) scrollBeforeBlur = window.scrollY;
+    };
+    const onHostFocus = () => {
+      if (!dialog.open || scrollBeforeBlur === null) return;
+      holdScroll(scrollBeforeBlur);
+    };
+    window.addEventListener("blur", onHostBlur);
+    window.addEventListener("focus", onHostFocus);
     if (options?.hidden) {
       dialog.show();
     } else {
@@ -4965,7 +5354,10 @@ var OneAuthClient = class {
       inertObserver.disconnect();
       viewportInfoCleanup();
       window.removeEventListener("message", handleMessage);
+      window.removeEventListener("blur", onHostBlur);
+      window.removeEventListener("focus", onHostFocus);
       document.removeEventListener("keydown", handleEscape);
+      const scrollAtClose = !options?.hidden && dialog.open ? window.scrollY : null;
       dialog.close();
       if (dialog.parentNode) {
         for (const sibling of Array.from(dialog.parentNode.children)) {
@@ -4975,9 +5367,13 @@ var OneAuthClient = class {
         }
       }
       dialog.remove();
+      if (scrollAtClose !== null) holdScroll(scrollAtClose);
     };
     const cleanup = options?.persistent ? () => {
-      if (dialog.open) dialog.close();
+      if (!dialog.open) return;
+      const scrollAtClose = options?.hidden ? null : window.scrollY;
+      dialog.close();
+      if (scrollAtClose !== null) holdScroll(scrollAtClose);
     } : destroy;
     return { dialog, iframe, cleanup, destroy, reveal };
   }
@@ -5075,57 +5471,73 @@ var OneAuthClient = class {
    */
   waitForPopupAuthResponse(url) {
     const dialogOrigin = this.getDialogOrigin();
+    const modalNonce = generateModalNonce();
     const popup = this.openPopup(url);
-    return new Promise((resolve) => {
-      const pollTimer = setInterval(() => {
-        if (popup?.closed) {
-          clearInterval(pollTimer);
-          window.removeEventListener("message", handleMessage);
-          resolve({
-            success: false,
-            error: {
-              code: "USER_CANCELLED",
-              message: "Authentication was cancelled"
-            }
-          });
+    if (!popup) {
+      return Promise.resolve({
+        success: false,
+        error: {
+          code: "USER_CANCELLED",
+          message: "Authentication was cancelled"
         }
-      }, 500);
+      });
+    }
+    return new Promise((resolve) => {
+      let settled = false;
       const handleMessage = (event) => {
-        if (event.origin !== dialogOrigin) return;
+        if (event.origin !== dialogOrigin || event.source !== popup) return;
         const data = event.data;
+        if (data?.type === "PASSKEY_READY") {
+          popup.postMessage({
+            type: "PASSKEY_INIT",
+            mode: "popup",
+            fullViewport: true,
+            modalNonce
+          }, dialogOrigin);
+          return;
+        }
         if (data?.type === "PASSKEY_LOGIN_RESULT") {
-          clearInterval(pollTimer);
-          window.removeEventListener("message", handleMessage);
-          popup?.close();
-          if (data.success) {
-            resolve({
+          finish(
+            data.success ? {
               success: true,
               user: {
                 id: data.data?.user?.id,
                 address: data.data?.address
               },
               signerType: data.data?.signerType ?? "passkey"
-            });
-          } else {
-            resolve({
-              success: false,
-              error: data.error
-            });
-          }
+            } : { success: false, error: data.error },
+            true
+          );
         } else if (data?.type === "PASSKEY_CLOSE") {
-          clearInterval(pollTimer);
-          window.removeEventListener("message", handleMessage);
-          popup?.close();
-          resolve({
+          finish({
             success: false,
             error: {
               code: "USER_CANCELLED",
               message: "Authentication was cancelled"
             }
-          });
+          }, true);
         }
       };
+      const finish = (result, closePopup) => {
+        if (settled) return;
+        settled = true;
+        clearInterval(pollTimer);
+        window.removeEventListener("message", handleMessage);
+        if (closePopup) popup.close();
+        resolve(result);
+      };
       window.addEventListener("message", handleMessage);
+      const pollTimer = setInterval(() => {
+        if (popup.closed) {
+          finish({
+            success: false,
+            error: {
+              code: "USER_CANCELLED",
+              message: "Authentication was cancelled"
+            }
+          }, false);
+        }
+      }, 500);
     });
   }
   /**
@@ -5331,6 +5743,16 @@ var OneAuthClient = class {
         if (event.origin !== dialogOrigin) return;
         const message = event.data;
         const payload = message?.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          window.removeEventListener("message", handleMessage);
+          cleanup();
+          resolve({
+            success: false,
+            requestId,
+            error: { code: "USER_REJECTED", message: "Session disconnected" }
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_SIGNING_RESULT" && payload?.requestId === requestId) {
           window.removeEventListener("message", handleMessage);
           cleanup();
@@ -5344,7 +5766,7 @@ var OneAuthClient = class {
             resolve({
               success: false,
               requestId,
-              error: message.error
+              error: parseSigningResultError(message.error)
             });
           }
         } else if (message?.type === "PASSKEY_CLOSE") {
@@ -5401,6 +5823,17 @@ var OneAuthClient = class {
         }
         const message = event.data;
         const payload = message?.data;
+        if (message?.type === "PASSKEY_DISCONNECT") {
+          clearInterval(checkClosed);
+          window.removeEventListener("message", handleMessage);
+          popup.close();
+          resolve({
+            success: false,
+            requestId,
+            error: { code: "USER_REJECTED", message: "Session disconnected" }
+          });
+          return;
+        }
         if (message?.type === "PASSKEY_SIGNING_RESULT" && payload?.requestId === requestId) {
           clearInterval(checkClosed);
           window.removeEventListener("message", handleMessage);
@@ -5415,7 +5848,7 @@ var OneAuthClient = class {
             resolve({
               success: false,
               requestId,
-              error: message.error
+              error: parseSigningResultError(message.error)
             });
           }
         }
@@ -5459,13 +5892,16 @@ var OneAuthClient = class {
         signature: data.signature
       };
     }
-    const errorCode = data.error?.code || "UNKNOWN";
+    const error = parseSigningResultError(
+      data.error,
+      data.status === "EXPIRED" ? "EXPIRED" : "UNKNOWN",
+      `Request status: ${data.status}`
+    );
     return {
       success: false,
       requestId,
       error: {
-        code: errorCode,
-        message: data.error?.message || `Request status: ${data.status}`
+        ...error
       }
     };
   }
@@ -5633,6 +6069,13 @@ function createOneAuthProvider(options) {
     if (typeof window === "undefined") return;
     localStorage.removeItem(storageKey);
   };
+  const forgetSession = () => {
+    sessionOverride = void 0;
+    clearStoredUser();
+    emit("accountsChanged", []);
+    emit("disconnect");
+  };
+  if (client) registerSessionForgetHandler(client, forgetSession);
   const connect = async () => {
     const stored = getStoredUser();
     if (stored) {
@@ -5653,17 +6096,11 @@ function createOneAuthProvider(options) {
     return [address];
   };
   const disconnect = async () => {
-    sessionOverride = void 0;
-    clearStoredUser();
-    emit("accountsChanged", []);
-    emit("disconnect");
+    forgetSession();
   };
   const setSession = (session) => {
     if (!session) {
-      sessionOverride = void 0;
-      clearStoredUser();
-      emit("accountsChanged", []);
-      emit("disconnect");
+      forgetSession();
       return;
     }
     sessionOverride = {
@@ -5786,8 +6223,11 @@ function createOneAuthProvider(options) {
       accountAddress: user.address,
       message
     });
-    if (!result.success || !result.signature) {
-      throw new Error(result.error?.message || "Signing failed");
+    if (!result.success) {
+      throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
+    }
+    if (!result.signature) {
+      throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
     }
     return encodeWebAuthnSignature(result.signature);
   };
@@ -5804,8 +6244,11 @@ function createOneAuthProvider(options) {
       primaryType: data.primaryType,
       message: data.message
     });
-    if (!result.success || !result.signature) {
-      throw new Error(result.error?.message || "Signing failed");
+    if (!result.success) {
+      throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
+    }
+    if (!result.signature) {
+      throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
     }
     return encodeWebAuthnSignature(result.signature);
   };
@@ -5827,7 +6270,7 @@ function createOneAuthProvider(options) {
       hashIntervalMs: options.hashIntervalMs
     });
     if (!result.success) {
-      throw new Error(result.error?.message || "Transaction failed");
+      throw toOneAuthError(result.error, "Transaction failed", "INTENT_FAILED");
     }
     return result.intentId;
   };
@@ -6253,8 +6696,11 @@ function createPasskeyAccount(client, params) {
         accountAddress: address,
         message: normalizeMessage(message)
       });
-      if (!result.success || !result.signature) {
-        throw new Error(result.error?.message || "Signing failed");
+      if (!result.success) {
+        throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
+      }
+      if (!result.signature) {
+        throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
       }
       return encodeWebAuthnSignature(result.signature);
     },
@@ -6291,8 +6737,11 @@ function createPasskeyAccount(client, params) {
         primaryType: typedData.primaryType,
         message: typedData.message
       });
-      if (!result.success || !result.signature) {
-        throw new Error(result.error?.message || "Signing failed");
+      if (!result.success) {
+        throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
+      }
+      if (!result.signature) {
+        throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
       }
       return encodeWebAuthnSignature(result.signature);
     }
@@ -6330,10 +6779,10 @@ function createPasskeyWalletClient(config) {
       description: "Sign message"
     });
     if (!result.success) {
-      throw new Error(result.error?.message || "Signing failed");
+      throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
     }
     if (!result.signature) {
-      throw new Error("No signature received");
+      throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
     }
     return encodeWebAuthnSignature(result.signature);
   };
@@ -6353,10 +6802,10 @@ function createPasskeyWalletClient(config) {
       transaction: buildTransactionReview(calls)
     });
     if (!result.success) {
-      throw new Error(result.error?.message || "Signing failed");
+      throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
     }
     if (!result.signature) {
-      throw new Error("No signature received");
+      throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
     }
     return encodeWebAuthnSignature(result.signature);
   };
@@ -6377,10 +6826,10 @@ function createPasskeyWalletClient(config) {
       }
     });
     if (!result.success) {
-      throw new Error(result.error?.message || "Signing failed");
+      throw toOneAuthError(result.error, "Signing failed", "SIGNING_FAILED");
     }
     if (!result.signature) {
-      throw new Error("No signature received");
+      throw toOneAuthError(void 0, "No signature received", "SIGNING_FAILED");
     }
     return encodeWebAuthnSignature(result.signature);
   };
@@ -6432,8 +6881,11 @@ function createPasskeyWalletClient(config) {
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
       });
-      if (!result.success || !result.transactionHash) {
-        throw new Error(result.error?.message || "Transaction failed");
+      if (!result.success) {
+        throw toOneAuthError(result.error, "Transaction failed", "INTENT_FAILED");
+      }
+      if (!result.transactionHash) {
+        throw toOneAuthError(void 0, "No transaction hash received", "HASH_UNAVAILABLE");
       }
       return result.transactionHash;
     },
@@ -6452,8 +6904,11 @@ function createPasskeyWalletClient(config) {
         hashTimeoutMs: config.hashTimeoutMs,
         hashIntervalMs: config.hashIntervalMs
       });
-      if (!result.success || !result.transactionHash) {
-        throw new Error(result.error?.message || "Transaction failed");
+      if (!result.success) {
+        throw toOneAuthError(result.error, "Transaction failed", "INTENT_FAILED");
+      }
+      if (!result.transactionHash) {
+        throw toOneAuthError(void 0, "No transaction hash received", "HASH_UNAVAILABLE");
       }
       return result.transactionHash;
     }
@@ -6932,6 +7387,8 @@ function verifyMessageHash(message, signedHash) {
   BatchQueueWidget,
   ETHEREUM_MESSAGE_PREFIX,
   OneAuthClient,
+  OneAuthError,
+  SIGNING_ERROR_CODES,
   createCrossChainPermission,
   createOneAuthConnection,
   createOneAuthProvider,
@@ -6953,6 +7410,7 @@ function verifyMessageHash(message, signedHash) {
   getTokenSymbol,
   hashCalls,
   hashMessage,
+  isSigningErrorCode,
   isTestnet,
   isTokenAddressSupported,
   resolveTokenAddress,