@orangecheck/auth-client 2.30.0 → 2.31.0

package/dist/index.mjs

@@ -3187,6 +3187,7 @@ function Hint({ children }) {
 }
 var DEFAULT_AUTH_ORIGIN2 = "https://ochk.io";
 var MIN_CONFIRMATIONS = 6;
+var MIN_SATS = 1e3;
 var n = (v) => v.toLocaleString("en-US");
 function bondFloorsText(f) {
   const sats = f.sats_floor > 0 ? `at least ${n(f.sats_floor)} sats` : "under 1,000 sats";
@@ -3197,23 +3198,56 @@ var short = (outpoint) => {
   const [txid = "", vout = ""] = outpoint.split(":");
   return `${txid.slice(0, 8)}\u2026${txid.slice(-4)}:${vout}`;
 };
+var usable = (c) => c.sats >= MIN_SATS && c.age_blocks >= MIN_CONFIRMATIONS;
+var dustText = (count) => `${n(count)} ${count === 1 ? "coin" : "coins"} under ${n(MIN_SATS)} sats, too small to back an account`;
 var REFUSAL = {
   invalid_address: "that isn't a Bitcoin address we can read",
   chain_unavailable: "couldn't read the chain just now \xB7 nothing changed, try again in a minute",
   sig_invalid: "that signature isn't from this coin's address \xB7 sign with the wallet that holds it",
   bond_expired: "the message expired \xB7 start again",
-  bond_not_yet_valid: "your device's clock looks wrong",
+  bond_not_yet_valid: "your device's clock looks wrong \xB7 check it and start again",
   bond_subject_mismatch: "that message was for another account \xB7 start again",
   bond_malformed: "the signed message changed on the way \xB7 start again",
+  bond_window_too_long: "that message's signing window is too long \xB7 start again",
   coin_not_found: "that coin doesn't exist on-chain",
   coin_address_mismatch: "that coin isn't at this address",
   coin_unconfirmed: "that coin isn't confirmed yet",
   coin_too_recent: "that coin needs six confirmations first, about an hour",
   coin_spent: "that coin has been spent \xB7 pick one still in your wallet",
+  coin_too_small: `that coin is under ${n(MIN_SATS)} sats, too small to back an account`,
   coin_backs_another_account: "that coin already backs another orangecheck account",
-  not_authenticated: "your session ended \xB7 sign in again"
+  coin_backed_another_recently: "that coin backed another account until recently \xB7 it can back this one 30 days after it was released",
+  not_authenticated: "your session ended \xB7 sign in again",
+  rate_limited: "too many tries \xB7 wait a minute, then try again"
 };
-var refusal = (reason) => reason && REFUSAL[reason] || "your backing didn't save \xB7 nothing changed, try again";
+var bondRefusal = (reason) => reason && REFUSAL[reason] || "your backing didn't save \xB7 nothing changed, try again";
+var smallStyle = { ...bodyStyle, fontSize: 12, margin: 0 };
+var explainerStyle = {
+  ...hintStyle,
+  fontSize: 12,
+  lineHeight: 1.55,
+  opacity: 1,
+  margin: 0
+};
+var fieldLabelStyle = {
+  display: "block",
+  color: V.foreground,
+  fontSize: 13,
+  fontWeight: 500,
+  margin: "0 0 4px"
+};
+var addressStyle = { wordBreak: "break-all", color: V.foreground };
+function coinStyle(picked, young) {
+  return {
+    background: V.card,
+    border: `1px ${young ? "dashed" : "solid"} ${picked ? V.primary : V.border}`,
+    padding: "0.75rem",
+    display: "flex",
+    gap: 10,
+    alignItems: "flex-start",
+    cursor: young ? "not-allowed" : "pointer"
+  };
+}
 async function fetchOcBond(opts) {
   const r = await fetch(`${opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN2}/api/auth/bond`, {
     credentials: "include"
@@ -3231,6 +3265,7 @@ function OcBond({
   const [loadErr, setLoadErr] = React4.useState(false);
   const [nonce, setNonce] = React4.useState(0);
   const [adding, setAdding] = React4.useState(false);
+  const [confirming, setConfirming] = React4.useState(false);
   const [busy, setBusy] = React4.useState(false);
   const [err, setErr] = React4.useState(null);
   React4.useEffect(() => {
@@ -3252,6 +3287,10 @@ function OcBond({
         body: body ? JSON.stringify(body) : void 0
       });
       const j = await r.json().catch(() => ({}));
+      const pin = readTabSession();
+      if (pin && r.ok && typeof j.token === "string") {
+        writeTabSession({ token: j.token, didOc: pin.didOc });
+      }
       return { ok: r.ok && j.ok === true, ...j };
     },
     [authOrigin]
@@ -3261,7 +3300,8 @@ function OcBond({
     setErr(null);
     const j = await call("DELETE").catch(() => ({ ok: false, reason: "network" }));
     setBusy(false);
-    if (!j.ok) return setErr(refusal(j.reason));
+    if (!j.ok) return setErr(bondRefusal(j.reason));
+    setConfirming(false);
     setBond(null);
     onChange?.(null);
   }
@@ -3305,16 +3345,71 @@ function OcBond({
         n(bond.checked_height),
         " \xB7 only you and orangecheck see this line"
       ] }),
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: () => setAdding(true), children: "use another coin" }),
-        /* @__PURE__ */ jsx("button", { type: "button", style: dangerBtnStyle(busy), disabled: busy, onClick: () => void release(), children: "stop backing" })
+      confirming ? /* @__PURE__ */ jsxs("div", { role: "group", "aria-label": "stop backing", "data-oc-bond-confirm": "", children: [
+        /* @__PURE__ */ jsx("p", { style: { ...bodyStyle, color: V.foreground, margin: 0 }, children: "stop backing? apps that ask for a backed account may stop letting you in." }),
+        /* @__PURE__ */ jsxs(FormButtons, { children: [
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              style: dangerBtnStyle(busy),
+              disabled: busy,
+              onClick: () => void release(),
+              children: "stop backing"
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              style: ghostBtnStyle(busy),
+              disabled: busy,
+              autoFocus: true,
+              onClick: () => {
+                setErr(null);
+                setConfirming(false);
+              },
+              children: "keep"
+            }
+          )
+        ] })
+      ] }) : /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            style: ghostBtnStyle(false),
+            onClick: () => {
+              setErr(null);
+              setAdding(true);
+            },
+            children: "use another coin"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            style: dangerBtnStyle(false),
+            onClick: () => setConfirming(true),
+            children: "stop backing"
+          }
+        )
       ] }),
       err ? /* @__PURE__ */ jsx(ErrorLine, { children: err }) : null
     ] }) : null,
     !bond && !adding ? /* @__PURE__ */ jsxs("div", { style: panelStyle(), children: [
       /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 not backed" }),
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "your account works everywhere as it is. apps that want to keep out bots can ask for a backed account: one coin you hold, that never moves and that they never see." }),
-      /* @__PURE__ */ jsx("button", { type: "button", style: primaryBtnStyle(false), onClick: () => setAdding(true), children: "back it with a coin" })
+      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "your account works everywhere as it is. some apps let in only accounts backed by a coin you hold. it stays in your wallet, and apps never see which coin." }),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          style: primaryBtnStyle(false),
+          onClick: () => setAdding(true),
+          children: "back your account"
+        }
+      )
     ] }) : null,
     adding ? /* @__PURE__ */ jsx(
       BondForm,
@@ -3328,9 +3423,9 @@ function OcBond({
         }
       }
     ) : null,
-    /* @__PURE__ */ jsxs("p", { style: hintStyle, children: [
+    /* @__PURE__ */ jsxs("p", { style: explainerStyle, children: [
       "> ",
-      "apps see that a coin backs you, in rough steps, and a number unique to each app, so they can't compare notes. an app can block that number; getting past it means moving the coin, and a moved coin starts its age again."
+      "apps see only rough floors, like \u201Cat least 100,000 sats, held 30 days or more\u201D, and a number unique to that app. never the coin, your address or your balance. an app can block that number; only moving the coin gets past it, and a moved coin starts its age again."
     ] })
   ] });
 }
@@ -3345,135 +3440,212 @@ function BondForm({
   const [message, setMessage] = React4.useState(null);
   const [busy, setBusy] = React4.useState(false);
   const [err, setErr] = React4.useState(null);
+  const id = React4.useId();
+  const addr = address.trim();
+  const canFind = addr.length >= 14;
   async function run(fn) {
     setBusy(true);
     setErr(null);
     try {
       await fn();
     } catch {
-      setErr(refusal("chain_unavailable"));
+      setErr(bondRefusal("chain_unavailable"));
     } finally {
       setBusy(false);
     }
   }
   const findCoins = () => run(async () => {
-    const j = await call("POST", { action: "coins", address: address.trim() });
-    if (!j.ok) return setErr(refusal(j.reason));
+    const j = await call("POST", { action: "coins", address: addr });
+    if (!j.ok) return setErr(bondRefusal(j.reason));
     const list = j.coins ?? [];
     setCoins(list);
-    setChosen(list.find((c) => c.age_blocks >= MIN_CONFIRMATIONS)?.outpoint ?? "");
+    setChosen(list.find(usable)?.outpoint ?? "");
   });
   const getMessage = () => run(async () => {
-    const j = await call("POST", { action: "message", address: address.trim(), outpoint: chosen });
-    if (!j.ok || typeof j.message !== "string") return setErr(refusal(j.reason));
+    const j = await call("POST", { action: "message", address: addr, outpoint: chosen });
+    if (!j.ok || typeof j.message !== "string") return setErr(bondRefusal(j.reason));
     setMessage(j.message);
   });
   const submit = (signature) => run(async () => {
     const j = await call("POST", { action: "bond", message, signature });
-    if (!j.ok || !j.bond) return setErr(refusal(j.reason));
+    if (!j.ok || !j.bond) return setErr(bondRefusal(j.reason));
     onDone(j.bond);
   });
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-bond-form": "", children: [
-    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 back your account with a coin" }),
-    message ? /* @__PURE__ */ jsxs(Fragment, { children: [
+  function back() {
+    setErr(null);
+    if (message) setMessage(null);
+    else setCoins(null);
+  }
+  const error = err ? /* @__PURE__ */ jsx(ErrorLine, { children: err }) : null;
+  const backButton = /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: back, children: "back" });
+  const cancelButton = /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: onCancel, children: "cancel" });
+  let step;
+  if (message) {
+    step = /* @__PURE__ */ jsxs(Fragment, { children: [
       /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "sign with the wallet that holds",
-        " ",
-        /* @__PURE__ */ jsx("span", { style: { wordBreak: "break-all", color: V.foreground }, children: address.trim() }),
-        ". the coin doesn't move and nothing is spent."
+        "sign with the wallet that holds ",
+        /* @__PURE__ */ jsx("span", { style: addressStyle, children: addr }),
+        ". signing spends nothing, and the coin stays in your wallet."
       ] }),
       /* @__PURE__ */ jsx(
         LazyWalletButton,
         {
-          address: address.trim(),
+          address: addr,
           message,
           showManual: true,
           onSigned: (sig) => void submit(sig),
           onError: (e) => setErr(e.message ?? "the wallet refused to sign")
         }
-      )
-    ] }) : coins ? coins.length === 0 ? /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "no confirmed coins at that address \xB7 send some sats there and wait for six confirmations, about an hour. the longer a coin sits, the more it says." }) : /* @__PURE__ */ jsxs("div", { role: "radiogroup", "aria-label": "pick one coin", style: { display: "grid", gap: 8 }, children: [
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "pick one coin \xB7 value spread over several coins doesn't add up" }),
-      coins.map((c) => {
-        const young = c.age_blocks < MIN_CONFIRMATIONS;
-        return /* @__PURE__ */ jsxs(
-          "label",
+      ),
+      error,
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        backButton,
+        cancelButton
+      ] })
+    ] });
+  } else if (coins) {
+    const eligible = coins.filter((c) => c.sats >= MIN_SATS);
+    const dust = coins.length - eligible.length;
+    step = /* @__PURE__ */ jsxs(Fragment, { children: [
+      coins.length === 0 ? /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "no confirmed coins at that address \xB7 send at least ",
+        n(MIN_SATS),
+        " sats there and wait for six confirmations, about an hour. the longer a coin sits, the more it says."
+      ] }) : eligible.length === 0 ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("p", { style: { ...bodyStyle, color: V.foreground }, children: dustText(dust) }),
+        /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+          "send at least ",
+          n(MIN_SATS),
+          " sats there in one payment and wait for six confirmations, about an hour. coins aren't added together."
+        ] })
+      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("p", { id: `${id}-pick`, style: bodyStyle, children: "pick one coin \xB7 coins aren't added together" }),
+        /* @__PURE__ */ jsx(
+          "div",
           {
-            style: {
-              ...panelStyle(chosen === c.outpoint ? "accent" : "default"),
-              padding: "0.75rem",
-              display: "flex",
-              gap: 10,
-              alignItems: "flex-start",
-              cursor: young ? "not-allowed" : "pointer",
-              opacity: young ? 0.6 : 1
-            },
-            children: [
-              /* @__PURE__ */ jsx(
-                "input",
+            role: "radiogroup",
+            "aria-labelledby": `${id}-pick`,
+            style: { display: "grid", gap: 8 },
+            children: eligible.map((c) => {
+              const young = c.age_blocks < MIN_CONFIRMATIONS;
+              return /* @__PURE__ */ jsxs(
+                "label",
                 {
-                  type: "radio",
-                  name: "oc-bond-coin",
-                  value: c.outpoint,
-                  checked: chosen === c.outpoint,
-                  disabled: young,
-                  onChange: () => setChosen(c.outpoint)
-                }
-              ),
-              /* @__PURE__ */ jsxs("span", { style: { display: "grid", gap: 2, minWidth: 0 }, children: [
-                /* @__PURE__ */ jsxs("span", { style: { color: V.foreground, fontSize: 13 }, children: [
-                  n(c.sats),
-                  " sats, held ",
-                  Math.floor(c.age_blocks / 144),
-                  " days"
-                ] }),
-                /* @__PURE__ */ jsx("span", { style: hintStyle, children: young ? "too recent: needs six confirmations" : `apps would see ${bondFloorsText(c)}` }),
-                /* @__PURE__ */ jsx("span", { style: { ...hintStyle, wordBreak: "break-all" }, children: short(c.outpoint) })
-              ] })
-            ]
-          },
-          c.outpoint
-        );
-      })
-    ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "which address holds the coin? use one that holds nothing else of yours: orangecheck learns its address and amount. apps never do." }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          style: inputStyle,
-          value: address,
-          onChange: (e) => setAddress(e.target.value),
-          placeholder: "bc1q\u2026",
-          spellCheck: false,
-          autoComplete: "off",
-          "aria-label": "Bitcoin address"
-        }
-      )
-    ] }),
-    err ? /* @__PURE__ */ jsx(ErrorLine, { children: err }) : null,
-    /* @__PURE__ */ jsxs(FormButtons, { children: [
-      !coins && !message ? /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: primaryBtnStyle(busy || address.trim().length < 14),
-          disabled: busy || address.trim().length < 14,
-          onClick: () => void findCoins(),
-          children: "find its coins"
-        }
-      ) : null,
-      coins && coins.length > 0 && !message ? /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: primaryBtnStyle(busy || !chosen),
-          disabled: busy || !chosen,
-          onClick: () => void getMessage(),
-          children: "continue"
-        }
-      ) : null,
-      /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: onCancel, children: "cancel" })
-    ] })
+                  style: coinStyle(chosen === c.outpoint, young),
+                  children: [
+                    /* @__PURE__ */ jsx(
+                      "input",
+                      {
+                        type: "radio",
+                        name: "oc-bond-coin",
+                        value: c.outpoint,
+                        checked: chosen === c.outpoint,
+                        disabled: young,
+                        onChange: () => setChosen(c.outpoint),
+                        style: { accentColor: V.primary, margin: "2px 0 0" }
+                      }
+                    ),
+                    /* @__PURE__ */ jsxs("span", { style: { display: "grid", gap: 2, minWidth: 0 }, children: [
+                      /* @__PURE__ */ jsxs(
+                        "span",
+                        {
+                          style: {
+                            color: young ? V.muted : V.foreground,
+                            fontSize: 13
+                          },
+                          children: [
+                            n(c.sats),
+                            " sats, held",
+                            " ",
+                            Math.floor(c.age_blocks / 144),
+                            " days"
+                          ]
+                        }
+                      ),
+                      /* @__PURE__ */ jsx("span", { style: smallStyle, children: young ? "too recent: needs six confirmations" : `apps would see ${bondFloorsText(c)}` }),
+                      /* @__PURE__ */ jsx(
+                        "span",
+                        {
+                          style: {
+                            ...smallStyle,
+                            fontFamily: SIGNIN_FONT,
+                            wordBreak: "break-all"
+                          },
+                          children: short(c.outpoint)
+                        }
+                      )
+                    ] })
+                  ]
+                },
+                c.outpoint
+              );
+            })
+          }
+        ),
+        dust > 0 ? /* @__PURE__ */ jsx("p", { style: { ...smallStyle, marginTop: 8 }, children: dustText(dust) }) : null
+      ] }),
+      error,
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        eligible.length > 0 ? /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            style: primaryBtnStyle(busy || !chosen),
+            disabled: busy || !chosen,
+            onClick: () => void getMessage(),
+            children: "continue"
+          }
+        ) : null,
+        backButton,
+        cancelButton
+      ] })
+    ] });
+  } else {
+    step = /* @__PURE__ */ jsxs(
+      "form",
+      {
+        style: { margin: 0 },
+        onSubmit: (e) => {
+          e.preventDefault();
+          if (canFind && !busy) void findCoins();
+        },
+        children: [
+          /* @__PURE__ */ jsx("label", { htmlFor: `${id}-address`, style: fieldLabelStyle, children: "bitcoin address that holds the coin" }),
+          /* @__PURE__ */ jsx("p", { id: `${id}-advice`, style: { ...bodyStyle, margin: "0 0 8px" }, children: "use one that holds nothing else of yours: orangecheck learns its address and amount. apps never do." }),
+          /* @__PURE__ */ jsx(
+            "input",
+            {
+              id: `${id}-address`,
+              "aria-describedby": `${id}-advice`,
+              style: inputStyle,
+              value: address,
+              onChange: (e) => setAddress(e.target.value),
+              placeholder: "bc1q\u2026",
+              spellCheck: false,
+              autoComplete: "off",
+              autoCapitalize: "off"
+            }
+          ),
+          error,
+          /* @__PURE__ */ jsxs(FormButtons, { children: [
+            /* @__PURE__ */ jsx(
+              "button",
+              {
+                type: "submit",
+                style: primaryBtnStyle(busy || !canFind),
+                disabled: busy || !canFind,
+                children: "find its coins"
+              }
+            ),
+            cancelButton
+          ] })
+        ]
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-bond-form": "", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 back your account" }),
+    step
   ] });
 }
 function resolveAuthOrigin(opts) {