@orangecheck/auth-client 2.28.0 → 2.30.0

package/dist/index.d.mts

@@ -166,6 +166,30 @@ interface OcLinkedIdentitiesProps {
 }
 declare function OcLinkedIdentities({ authOrigin, className, onChange, attestationLink, }: OcLinkedIdentitiesProps): React.ReactElement;
 
+interface Floors {
+    sats_floor: number;
+    days_floor: number;
+}
+interface OcBondView extends Floors {
+    address: string;
+    outpoint: string;
+    sats: number;
+    confirmed_height: number;
+    checked_at: string;
+    checked_height: number;
+    created_at: string;
+}
+interface OcBondProps {
+    authOrigin?: string;
+    onChange?: (bond: OcBondView | null) => void;
+    className?: string;
+}
+declare function bondFloorsText(f: Floors): string;
+declare function fetchOcBond(opts?: {
+    authOrigin?: string;
+}): Promise<OcBondView | null>;
+declare function OcBond({ authOrigin, onChange, className, }: OcBondProps): React.ReactElement;
+
 declare const TAB_SESSION_HEADER = "x-oc-tab-session";
 declare const TAB_SESSION_STORAGE_KEY = "oc_tab_session";
 declare const TAB_ACCOUNT_HINT_KEY = "oc-as";
@@ -269,4 +293,4 @@ declare function isSudoAccountMismatch(body: {
     reason?: string;
 } | null | undefined): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, SUDO_ACCOUNT_MISMATCH_MESSAGE, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, isSudoAccountMismatch, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcBond, type OcBondProps, type OcBondView, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, SUDO_ACCOUNT_MISMATCH_MESSAGE, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, bondFloorsText, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcBond, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, isSudoAccountMismatch, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.d.ts

@@ -166,6 +166,30 @@ interface OcLinkedIdentitiesProps {
 }
 declare function OcLinkedIdentities({ authOrigin, className, onChange, attestationLink, }: OcLinkedIdentitiesProps): React.ReactElement;
 
+interface Floors {
+    sats_floor: number;
+    days_floor: number;
+}
+interface OcBondView extends Floors {
+    address: string;
+    outpoint: string;
+    sats: number;
+    confirmed_height: number;
+    checked_at: string;
+    checked_height: number;
+    created_at: string;
+}
+interface OcBondProps {
+    authOrigin?: string;
+    onChange?: (bond: OcBondView | null) => void;
+    className?: string;
+}
+declare function bondFloorsText(f: Floors): string;
+declare function fetchOcBond(opts?: {
+    authOrigin?: string;
+}): Promise<OcBondView | null>;
+declare function OcBond({ authOrigin, onChange, className, }: OcBondProps): React.ReactElement;
+
 declare const TAB_SESSION_HEADER = "x-oc-tab-session";
 declare const TAB_SESSION_STORAGE_KEY = "oc_tab_session";
 declare const TAB_ACCOUNT_HINT_KEY = "oc-as";
@@ -269,4 +293,4 @@ declare function isSudoAccountMismatch(body: {
     reason?: string;
 } | null | undefined): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, SUDO_ACCOUNT_MISMATCH_MESSAGE, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, isSudoAccountMismatch, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcBond, type OcBondProps, type OcBondView, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, SUDO_ACCOUNT_MISMATCH_MESSAGE, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, bondFloorsText, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcBond, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, isSudoAccountMismatch, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.js

@@ -1196,6 +1196,7 @@ var signinSize = (px) => `calc(${px}px * var(--oc-signin-scale, 1))`;
 var signinRadius = (px) => `var(--oc-signin-radius, ${px}px)`;
 var SIGNIN_BUTTON_RADIUS = "var(--oc-signin-button-radius, 6px)";
 var SIGNIN_STRONG = "var(--oc-signin-strong, 600)";
+var SIGNIN_ARROW = "var(--oc-signin-arrow, inline)";
 var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
 async function fetchOcLinkedIdentities(opts) {
   const authOrigin = opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN;
@@ -2371,7 +2372,7 @@ function OcSignIn({
             {
               active: path === "email",
               onClick: () => setPath("email"),
-              children: "email"
+              children: "Email"
             }
           ),
           /* @__PURE__ */ jsxRuntime.jsx(
@@ -2379,7 +2380,7 @@ function OcSignIn({
             {
               active: path === "wallet",
               onClick: () => setPath("wallet"),
-              children: "bitcoin wallet"
+              children: "Bitcoin wallet"
             }
           )
         ] }) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
@@ -2388,7 +2389,7 @@ function OcSignIn({
             {
               active: path === "wallet",
               onClick: () => setPath("wallet"),
-              children: "bitcoin wallet"
+              children: "Bitcoin wallet"
             }
           ),
           /* @__PURE__ */ jsxRuntime.jsx(
@@ -2396,7 +2397,7 @@ function OcSignIn({
             {
               active: path === "email",
               onClick: () => setPath("email"),
-              children: "email"
+              children: "Email"
             }
           )
         ] })
@@ -2758,7 +2759,7 @@ function WalletFlow({
         address.trim(),
         ", sign the text below, and paste the signature back here. Nothing is spent."
       ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.message, children: "message to sign" }),
+      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.message, children: "Message to sign" }),
       /* @__PURE__ */ jsxRuntime.jsx(
         "textarea",
         {
@@ -2770,10 +2771,10 @@ function WalletFlow({
           style: { ...inputStyle2, resize: "vertical" }
         }
       ),
-      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: () => void copyMessage(), style: linkButtonStyle, children: copied === "copied" ? "copied" : "copy message" }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: () => void copyMessage(), style: linkButtonStyle, children: copied === "copied" ? "Copied" : "Copy message" }),
       copied === "failed" && /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "Couldn't copy here. Select the text above and copy it." }),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { marginTop: 14 }, children: [
-        /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.signature, children: "signature" }),
+        /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.signature, children: "Signature" }),
         /* @__PURE__ */ jsxRuntime.jsx(
           "textarea",
           {
@@ -2799,7 +2800,7 @@ function WalletFlow({
           type: "submit",
           disabled: submitting || !pasted.trim(),
           style: submitStyle(submitting || !pasted.trim()),
-          children: submitting ? "checking\u2026" : "sign me in \u2192"
+          children: submitting ? "Checking\u2026" : /* @__PURE__ */ jsxRuntime.jsx(Submit, { children: "Sign me in" })
         }
       ),
       /* @__PURE__ */ jsxRuntime.jsx(
@@ -2813,7 +2814,7 @@ function WalletFlow({
             setCopied("idle");
           },
           style: linkButtonStyle,
-          children: "use a different address"
+          children: "Use a different address"
         }
       )
     ] });
@@ -2821,7 +2822,7 @@ function WalletFlow({
   const noBrowserWallet = wallets !== null && wallets.length === 0;
   return /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: signIn, "data-oc-signin-wallet": "", children: [
     /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { children: "Your wallet signs a short message to prove you hold the address. Nothing is spent and your key never leaves the wallet. Works with browser wallets, or any wallet that can sign a message, like Sparrow." }),
-    /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.address, children: "bitcoin address" }),
+    /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.address, children: "Bitcoin address" }),
     /* @__PURE__ */ jsxRuntime.jsx(
       "input",
       {
@@ -2842,7 +2843,7 @@ function WalletFlow({
       }
     ),
     wallets && wallets.length > 1 && /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { marginTop: 12 }, children: [
-      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.wallet, children: "sign with" }),
+      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: ids.wallet, children: "Sign with" }),
       /* @__PURE__ */ jsxRuntime.jsx(
         "select",
         {
@@ -2861,7 +2862,7 @@ function WalletFlow({
         type: "submit",
         disabled: submitting || !address.trim(),
         style: submitStyle(submitting || !address.trim()),
-        children: submitting ? "waiting for wallet\u2026" : noBrowserWallet ? "get the message to sign \u2192" : "sign in with wallet \u2192"
+        children: submitting ? "Waiting for wallet\u2026" : noBrowserWallet ? /* @__PURE__ */ jsxRuntime.jsx(Submit, { children: "Get the message to sign" }) : /* @__PURE__ */ jsxRuntime.jsx(Submit, { children: "Sign in with wallet" })
       }
     ),
     noBrowserWallet && /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "No browser wallet found here. You can sign with any wallet and paste." })
@@ -2959,7 +2960,7 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
   if (stage === "enter") {
     return /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: start, "data-oc-signin-email": "", children: [
       /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { children: "We email you a 6-digit code. No password, and no wallet needed to start. Link a Bitcoin address any time \u2014 that is the identity you hold yourself." }),
-      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: `${uid}-email`, children: "email" }),
+      /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: `${uid}-email`, children: "Email" }),
       /* @__PURE__ */ jsxRuntime.jsx(
         "input",
         {
@@ -2978,7 +2979,7 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
         }
       ),
       emailError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine2, { children: emailError }),
-      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "sending\u2026" : "send one-time code \u2192" })
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "Sending\u2026" : /* @__PURE__ */ jsxRuntime.jsx(Submit, { children: "Send one-time code" }) })
     ] });
   }
   return /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: verify, "data-oc-signin-email-verify": "", children: [
@@ -2987,7 +2988,7 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
       /* @__PURE__ */ jsxRuntime.jsx("span", { style: { color: "var(--foreground, #fafafa)" }, children: email }),
       ". It expires in 10 minutes."
     ] }),
-    /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: `${uid}-code`, children: "one-time code" }),
+    /* @__PURE__ */ jsxRuntime.jsx(Label, { htmlFor: `${uid}-code`, children: "One-time code" }),
     /* @__PURE__ */ jsxRuntime.jsx(
       "input",
       {
@@ -3016,7 +3017,7 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
         type: "submit",
         disabled: submitting || code.length !== 6,
         style: submitStyle(submitting || code.length !== 6),
-        children: submitting ? "verifying\u2026" : "verify \xB7 sign me in \u2192"
+        children: submitting ? "Verifying\u2026" : /* @__PURE__ */ jsxRuntime.jsx(Submit, { children: "Verify \xB7 sign me in" })
       }
     ),
     /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
@@ -3027,7 +3028,7 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
           onClick: () => void resend(),
           disabled: submitting,
           style: linkButtonStyle,
-          children: "send a new code"
+          children: "Send a new code"
         }
       ),
       /* @__PURE__ */ jsxRuntime.jsx(
@@ -3041,12 +3042,18 @@ function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
             setResent(false);
           },
           style: linkButtonStyle,
-          children: "use a different email"
+          children: "Use a different email"
         }
       )
     ] })
   ] });
 }
+function Submit({ children }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+    children,
+    /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", style: { display: SIGNIN_ARROW }, children: " \u2192" })
+  ] });
+}
 function FlowHeader({
   label,
   children
@@ -3200,6 +3207,297 @@ function Hint({ children }) {
     }
   );
 }
+var DEFAULT_AUTH_ORIGIN2 = "https://ochk.io";
+var MIN_CONFIRMATIONS = 6;
+var n = (v) => v.toLocaleString("en-US");
+function bondFloorsText(f) {
+  const sats = f.sats_floor > 0 ? `at least ${n(f.sats_floor)} sats` : "under 1,000 sats";
+  const days = f.days_floor > 0 ? `held ${f.days_floor} days or more` : "held under 7 days";
+  return `${sats}, ${days}`;
+}
+var short = (outpoint) => {
+  const [txid = "", vout = ""] = outpoint.split(":");
+  return `${txid.slice(0, 8)}\u2026${txid.slice(-4)}:${vout}`;
+};
+var REFUSAL = {
+  invalid_address: "that isn't a Bitcoin address we can read",
+  chain_unavailable: "couldn't read the chain just now \xB7 nothing changed, try again in a minute",
+  sig_invalid: "that signature isn't from this coin's address \xB7 sign with the wallet that holds it",
+  bond_expired: "the message expired \xB7 start again",
+  bond_not_yet_valid: "your device's clock looks wrong",
+  bond_subject_mismatch: "that message was for another account \xB7 start again",
+  bond_malformed: "the signed message changed on the way \xB7 start again",
+  coin_not_found: "that coin doesn't exist on-chain",
+  coin_address_mismatch: "that coin isn't at this address",
+  coin_unconfirmed: "that coin isn't confirmed yet",
+  coin_too_recent: "that coin needs six confirmations first, about an hour",
+  coin_spent: "that coin has been spent \xB7 pick one still in your wallet",
+  coin_backs_another_account: "that coin already backs another orangecheck account",
+  not_authenticated: "your session ended \xB7 sign in again"
+};
+var refusal = (reason) => reason && REFUSAL[reason] || "your backing didn't save \xB7 nothing changed, try again";
+async function fetchOcBond(opts) {
+  const r = await fetch(`${opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN2}/api/auth/bond`, {
+    credentials: "include"
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok || !j.ok) throw new Error(`http_${r.status}`);
+  return j.bond ?? null;
+}
+function OcBond({
+  authOrigin = DEFAULT_AUTH_ORIGIN2,
+  onChange,
+  className
+}) {
+  const [bond, setBond] = React4__namespace.useState(void 0);
+  const [loadErr, setLoadErr] = React4__namespace.useState(false);
+  const [nonce, setNonce] = React4__namespace.useState(0);
+  const [adding, setAdding] = React4__namespace.useState(false);
+  const [busy, setBusy] = React4__namespace.useState(false);
+  const [err, setErr] = React4__namespace.useState(null);
+  React4__namespace.useEffect(() => {
+    let alive = true;
+    fetchOcBond({ authOrigin }).then(
+      (b) => alive && setBond(b),
+      () => alive && setLoadErr(true)
+    );
+    return () => {
+      alive = false;
+    };
+  }, [authOrigin, nonce]);
+  const call = React4__namespace.useCallback(
+    async (method, body) => {
+      const r = await fetch(`${authOrigin}/api/auth/bond`, {
+        method,
+        credentials: "include",
+        headers: body ? { "Content-Type": "application/json" } : void 0,
+        body: body ? JSON.stringify(body) : void 0
+      });
+      const j = await r.json().catch(() => ({}));
+      return { ok: r.ok && j.ok === true, ...j };
+    },
+    [authOrigin]
+  );
+  async function release() {
+    setBusy(true);
+    setErr(null);
+    const j = await call("DELETE").catch(() => ({ ok: false, reason: "network" }));
+    setBusy(false);
+    if (!j.ok) return setErr(refusal(j.reason));
+    setBond(null);
+    onChange?.(null);
+  }
+  if (loadErr) {
+    return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, "data-oc-bond": "", style: panelStyle("warn"), role: "alert", children: [
+      /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "couldn't read your backing \xB7 nothing was changed" }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          style: ghostBtnStyle(false),
+          onClick: () => {
+            setLoadErr(false);
+            setNonce((x) => x + 1);
+          },
+          children: "try again"
+        }
+      )
+    ] });
+  }
+  if (bond === void 0) {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-oc-bond": "", style: panelStyle(), children: /* @__PURE__ */ jsxRuntime.jsxs("span", { style: hintStyle, children: [
+      "> ",
+      "reading your backing\u2026"
+    ] }) });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, "data-oc-bond": "", style: { display: "grid", gap: 16 }, children: [
+    bond && !adding ? /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("success"), children: [
+      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { tone: "success", children: "\xA7 backed by bitcoin" }),
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: { ...bodyStyle, color: V.foreground }, children: [
+        "apps see a coin ",
+        bondFloorsText(bond),
+        "."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "coin ",
+        short(bond.outpoint),
+        ", ",
+        n(bond.sats),
+        " sats \xB7 last found unspent at block ",
+        n(bond.checked_height),
+        " \xB7 only you and orangecheck see this line"
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: () => setAdding(true), children: "use another coin" }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", style: dangerBtnStyle(busy), disabled: busy, onClick: () => void release(), children: "stop backing" })
+      ] }),
+      err ? /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }) : null
+    ] }) : null,
+    !bond && !adding ? /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle(), children: [
+      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 not backed" }),
+      /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "your account works everywhere as it is. apps that want to keep out bots can ask for a backed account: one coin you hold, that never moves and that they never see." }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", style: primaryBtnStyle(false), onClick: () => setAdding(true), children: "back it with a coin" })
+    ] }) : null,
+    adding ? /* @__PURE__ */ jsxRuntime.jsx(
+      BondForm,
+      {
+        call,
+        onCancel: () => setAdding(false),
+        onDone: (b) => {
+          setBond(b);
+          setAdding(false);
+          onChange?.(b);
+        }
+      }
+    ) : null,
+    /* @__PURE__ */ jsxRuntime.jsxs("p", { style: hintStyle, children: [
+      "> ",
+      "apps see that a coin backs you, in rough steps, and a number unique to each app, so they can't compare notes. an app can block that number; getting past it means moving the coin, and a moved coin starts its age again."
+    ] })
+  ] });
+}
+function BondForm({
+  call,
+  onCancel,
+  onDone
+}) {
+  const [address, setAddress] = React4__namespace.useState("");
+  const [coins, setCoins] = React4__namespace.useState(null);
+  const [chosen, setChosen] = React4__namespace.useState("");
+  const [message, setMessage] = React4__namespace.useState(null);
+  const [busy, setBusy] = React4__namespace.useState(false);
+  const [err, setErr] = React4__namespace.useState(null);
+  async function run(fn) {
+    setBusy(true);
+    setErr(null);
+    try {
+      await fn();
+    } catch {
+      setErr(refusal("chain_unavailable"));
+    } finally {
+      setBusy(false);
+    }
+  }
+  const findCoins = () => run(async () => {
+    const j = await call("POST", { action: "coins", address: address.trim() });
+    if (!j.ok) return setErr(refusal(j.reason));
+    const list = j.coins ?? [];
+    setCoins(list);
+    setChosen(list.find((c) => c.age_blocks >= MIN_CONFIRMATIONS)?.outpoint ?? "");
+  });
+  const getMessage = () => run(async () => {
+    const j = await call("POST", { action: "message", address: address.trim(), outpoint: chosen });
+    if (!j.ok || typeof j.message !== "string") return setErr(refusal(j.reason));
+    setMessage(j.message);
+  });
+  const submit = (signature) => run(async () => {
+    const j = await call("POST", { action: "bond", message, signature });
+    if (!j.ok || !j.bond) return setErr(refusal(j.reason));
+    onDone(j.bond);
+  });
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("accent"), "data-oc-bond-form": "", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 back your account with a coin" }),
+    message ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "sign with the wallet that holds",
+        " ",
+        /* @__PURE__ */ jsxRuntime.jsx("span", { style: { wordBreak: "break-all", color: V.foreground }, children: address.trim() }),
+        ". the coin doesn't move and nothing is spent."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        LazyWalletButton,
+        {
+          address: address.trim(),
+          message,
+          showManual: true,
+          onSigned: (sig) => void submit(sig),
+          onError: (e) => setErr(e.message ?? "the wallet refused to sign")
+        }
+      )
+    ] }) : coins ? coins.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "no confirmed coins at that address \xB7 send some sats there and wait for six confirmations, about an hour. the longer a coin sits, the more it says." }) : /* @__PURE__ */ jsxRuntime.jsxs("div", { role: "radiogroup", "aria-label": "pick one coin", style: { display: "grid", gap: 8 }, children: [
+      /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "pick one coin \xB7 value spread over several coins doesn't add up" }),
+      coins.map((c) => {
+        const young = c.age_blocks < MIN_CONFIRMATIONS;
+        return /* @__PURE__ */ jsxRuntime.jsxs(
+          "label",
+          {
+            style: {
+              ...panelStyle(chosen === c.outpoint ? "accent" : "default"),
+              padding: "0.75rem",
+              display: "flex",
+              gap: 10,
+              alignItems: "flex-start",
+              cursor: young ? "not-allowed" : "pointer",
+              opacity: young ? 0.6 : 1
+            },
+            children: [
+              /* @__PURE__ */ jsxRuntime.jsx(
+                "input",
+                {
+                  type: "radio",
+                  name: "oc-bond-coin",
+                  value: c.outpoint,
+                  checked: chosen === c.outpoint,
+                  disabled: young,
+                  onChange: () => setChosen(c.outpoint)
+                }
+              ),
+              /* @__PURE__ */ jsxRuntime.jsxs("span", { style: { display: "grid", gap: 2, minWidth: 0 }, children: [
+                /* @__PURE__ */ jsxRuntime.jsxs("span", { style: { color: V.foreground, fontSize: 13 }, children: [
+                  n(c.sats),
+                  " sats, held ",
+                  Math.floor(c.age_blocks / 144),
+                  " days"
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsx("span", { style: hintStyle, children: young ? "too recent: needs six confirmations" : `apps would see ${bondFloorsText(c)}` }),
+                /* @__PURE__ */ jsxRuntime.jsx("span", { style: { ...hintStyle, wordBreak: "break-all" }, children: short(c.outpoint) })
+              ] })
+            ]
+          },
+          c.outpoint
+        );
+      })
+    ] }) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "which address holds the coin? use one that holds nothing else of yours: orangecheck learns its address and amount. apps never do." }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "input",
+        {
+          style: inputStyle,
+          value: address,
+          onChange: (e) => setAddress(e.target.value),
+          placeholder: "bc1q\u2026",
+          spellCheck: false,
+          autoComplete: "off",
+          "aria-label": "Bitcoin address"
+        }
+      )
+    ] }),
+    err ? /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }) : null,
+    /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+      !coins && !message ? /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          style: primaryBtnStyle(busy || address.trim().length < 14),
+          disabled: busy || address.trim().length < 14,
+          onClick: () => void findCoins(),
+          children: "find its coins"
+        }
+      ) : null,
+      coins && coins.length > 0 && !message ? /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          style: primaryBtnStyle(busy || !chosen),
+          disabled: busy || !chosen,
+          onClick: () => void getMessage(),
+          children: "continue"
+        }
+      ) : null,
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: onCancel, children: "cancel" })
+    ] })
+  ] });
+}
 function resolveAuthOrigin(opts) {
   if (!opts) return resolveConfig(void 0).authOrigin;
   return resolveConfig(opts).authOrigin;
@@ -3439,6 +3737,7 @@ exports.DISPLAY_IDENTITY_KINDS = DISPLAY_IDENTITY_KINDS;
 exports.OcAccountChip = OcAccountChip;
 exports.OcAccountPill = OcAccountPill;
 exports.OcAddressInput = OcAddressInput;
+exports.OcBond = OcBond;
 exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;
@@ -3448,12 +3747,14 @@ exports.TAB_ACCOUNT_HINT_KEY = TAB_ACCOUNT_HINT_KEY;
 exports.TAB_ADOPT_HASH = TAB_ADOPT_HASH;
 exports.TAB_SESSION_HEADER = TAB_SESSION_HEADER;
 exports.TAB_SESSION_STORAGE_KEY = TAB_SESSION_STORAGE_KEY;
+exports.bondFloorsText = bondFloorsText;
 exports.buildAddAccountUrl = buildAddAccountUrl;
 exports.buildSignInUrl = buildSignInUrl;
 exports.clearTabSession = clearTabSession;
 exports.consumeTabAccountHint = consumeTabAccountHint;
 exports.consumeTabAdoptMarker = consumeTabAdoptMarker;
 exports.familyReturnTarget = familyReturnTarget;
+exports.fetchOcBond = fetchOcBond;
 exports.fetchOcLinkedIdentities = fetchOcLinkedIdentities;
 exports.handleSudoRequired = handleSudoRequired;
 exports.installTabFetchInterceptor = installTabFetchInterceptor;