@orangecheck/auth-client 2.33.4 → 2.35.0

package/dist/index.mjs

@@ -1,4003 +1,114 @@
-import * as React4 from 'react';
-import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
-import { startRegistration, startAuthentication } from '@simplewebauthn/browser';
-
-// src/provider.tsx
-
-// src/tab-session.ts
-var TAB_SESSION_HEADER = "x-oc-tab-session";
-var TAB_SESSION_STORAGE_KEY = "oc_tab_session";
-var TAB_ACCOUNT_HINT_KEY = "oc-as";
-var TAB_ADOPT_HASH = "#oc-adopt";
-function readTabSession() {
-  if (typeof window === "undefined") return null;
-  try {
-    const raw = window.sessionStorage.getItem(TAB_SESSION_STORAGE_KEY);
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.token !== "string" || parsed.token.length === 0) return null;
-    if (typeof parsed.didOc !== "string" || parsed.didOc.length === 0) return null;
-    return { token: parsed.token, didOc: parsed.didOc };
-  } catch {
-    return null;
-  }
-}
-function writeTabSession(session) {
-  if (typeof window === "undefined") return;
-  try {
-    window.sessionStorage.setItem(TAB_SESSION_STORAGE_KEY, JSON.stringify(session));
-  } catch {
-  }
-}
-function clearTabSession() {
-  if (typeof window === "undefined") return;
-  try {
-    window.sessionStorage.removeItem(TAB_SESSION_STORAGE_KEY);
-  } catch {
-  }
-}
-function tabSessionHeader() {
-  const pin = readTabSession();
-  return pin ? { [TAB_SESSION_HEADER]: pin.token } : {};
-}
-function isPinnableUrl(url, authOrigin) {
-  if (typeof window === "undefined") return false;
-  try {
-    const u = new URL(url, window.location.href);
-    return u.origin === window.location.origin || u.origin === authOrigin;
-  } catch {
-    return false;
-  }
-}
-function installTabFetchInterceptor(authOrigin) {
-  if (typeof window === "undefined") return () => {
-  };
-  const original = window.fetch;
-  const wrapped = (input, init) => {
-    try {
-      const pin = readTabSession();
-      if (pin) {
-        const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-        if (isPinnableUrl(url, authOrigin)) {
-          const headers = new Headers(
-            init?.headers ?? (input instanceof Request ? input.headers : void 0)
-          );
-          if (!headers.has("authorization") && !headers.has(TAB_SESSION_HEADER)) {
-            headers.set(TAB_SESSION_HEADER, pin.token);
-            init = { ...init, headers };
-          }
-        }
-      }
-    } catch {
-    }
-    return original.call(window, input, init);
-  };
-  window.fetch = wrapped;
-  return () => {
-    if (window.fetch === wrapped) window.fetch = original;
-  };
-}
-function consumeTabAdoptMarker() {
-  if (typeof window === "undefined") return false;
-  if (!window.location.hash.includes(TAB_ADOPT_HASH.slice(1))) return false;
-  clearTabSession();
-  try {
-    const url = new URL(window.location.href);
-    url.hash = "";
-    window.history.replaceState(window.history.state, "", url.toString());
-  } catch {
-  }
-  return true;
-}
-var OC_AS_HINT_RE = /^oc-as=(did:oc:[0-9a-f]{32})$/;
-function familyApex(authOrigin) {
-  try {
-    return new URL(authOrigin).hostname.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function isFamilyUrl(u, authOrigin) {
-  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
-  if (typeof window !== "undefined" && u.origin === window.location.origin) return true;
-  const apex = familyApex(authOrigin);
-  if (!apex) return false;
-  const host = u.hostname.toLowerCase();
-  return host === apex || host.endsWith(`.${apex}`);
-}
-function opensWithoutTabPin(e, anchor, dest) {
-  if (typeof window !== "undefined" && dest.origin !== window.location.origin) return true;
-  const target = (anchor.getAttribute("target") ?? "").toLowerCase();
-  return e.button === 1 || // middle-click
-  e.metaKey || e.ctrlKey || e.shiftKey || target === "_blank";
-}
-function installTabLinkDecorator(authOrigin) {
-  if (typeof window === "undefined" || typeof document === "undefined") return () => {
-  };
-  const onActivate = (e) => {
-    try {
-      const pin = readTabSession();
-      if (!pin) return;
-      const target = e.target;
-      if (!(target instanceof Element)) return;
-      const anchor = target.closest("a[href]");
-      if (!anchor || anchor.hasAttribute("download")) return;
-      const raw = anchor.getAttribute("href");
-      if (!raw || raw.includes(`${TAB_ACCOUNT_HINT_KEY}=`)) return;
-      let dest;
-      try {
-        dest = new URL(anchor.href);
-      } catch {
-        return;
-      }
-      if (dest.hash) return;
-      if (!isFamilyUrl(dest, authOrigin)) return;
-      if (!opensWithoutTabPin(e, anchor, dest)) return;
-      anchor.setAttribute("href", `${raw}#${TAB_ACCOUNT_HINT_KEY}=${pin.didOc}`);
-    } catch {
-    }
-  };
-  window.addEventListener("click", onActivate, true);
-  window.addEventListener("auxclick", onActivate, true);
-  return () => {
-    window.removeEventListener("click", onActivate, true);
-    window.removeEventListener("auxclick", onActivate, true);
-  };
-}
-async function consumeTabAccountHint(authOrigin) {
-  if (typeof window === "undefined") return null;
-  const frag = window.location.hash.replace(/^#/, "");
-  const m = OC_AS_HINT_RE.exec(frag);
-  if (!m) return null;
-  const did = m[1];
-  try {
-    const url = new URL(window.location.href);
-    url.hash = "";
-    window.history.replaceState(window.history.state, "", url.toString());
-  } catch {
-  }
-  const existing = readTabSession();
-  if (existing && existing.didOc === did) return did;
-  try {
-    const res = await fetch(`${authOrigin}/api/auth/tab`, {
-      method: "POST",
-      credentials: "include",
-      headers: { Accept: "application/json", "Content-Type": "application/json" },
-      body: JSON.stringify({ did_oc: did })
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    if (body.ok && typeof body.token === "string" && body.account?.did_oc === did) {
-      writeTabSession({ token: body.token, didOc: did });
-      return did;
-    }
-  } catch {
-  }
-  return null;
-}
-
-// src/return-to.ts
-var PREFIX = "oc:return-fragment:";
-var HOLD_MS = 1e4;
-var FRAGMENT_TTL_MS = 15 * 60 * 1e3;
-function store() {
-  try {
-    return window.sessionStorage;
-  } catch {
-    return null;
-  }
-}
-function stripFragment(target) {
-  const cut = target.indexOf("#");
-  return cut < 0 ? target : target.slice(0, cut);
-}
-function keep(pathAndQuery, hash) {
-  if (hash.length < 2) return;
-  try {
-    store()?.setItem(PREFIX + pathAndQuery, JSON.stringify({ hash, at: Date.now() }));
-  } catch {
-  }
-}
-function withoutFragment(target) {
-  if (typeof window !== "undefined" && target.includes("#")) {
-    try {
-      const u = new URL(target, window.location.href);
-      if (u.origin === window.location.origin) keep(u.pathname + u.search, u.hash);
-    } catch {
-    }
-  }
-  return stripFragment(target);
-}
-function returnToHere() {
-  if (typeof window === "undefined") return "/";
-  const { pathname, search, hash } = window.location;
-  return withoutFragment(pathname + search + hash);
-}
-function keepFragmentOnReturnLinks() {
-  if (typeof document === "undefined") return () => {
-  };
-  const onClick = (e) => {
-    const { pathname, search, hash, href } = window.location;
-    if (hash.length < 2 || e.defaultPrevented) return;
-    const link = e.target?.closest?.("a[href]");
-    if (!link) return;
-    try {
-      const to = new URL(link.getAttribute("href") ?? "", href);
-      const back = to.searchParams.get("return_to");
-      if (!back) return;
-      const here = new URL(back, href);
-      if (here.origin === window.location.origin && here.pathname === pathname && here.search === search) {
-        keep(pathname + search, hash);
-      }
-    } catch {
-    }
-  };
-  document.addEventListener("click", onClick, true);
-  return () => document.removeEventListener("click", onClick, true);
-}
-function restoreReturnFragment() {
-  if (typeof window === "undefined") return false;
-  const s = store();
-  if (!s) return false;
-  const { pathname, search, hash } = window.location;
-  const key = PREFIX + pathname + search;
-  let raw;
-  try {
-    raw = s.getItem(key);
-    if (raw === null) return false;
-    s.removeItem(key);
-  } catch {
-    return false;
-  }
-  if (hash) return false;
-  try {
-    const kept = JSON.parse(raw);
-    if (typeof kept.hash !== "string" || !kept.hash.startsWith("#")) return false;
-    if (typeof kept.at !== "number" || Date.now() - kept.at > FRAGMENT_TTL_MS) return false;
-    const restored = pathname + search + kept.hash;
-    window.history.replaceState(window.history.state, "", restored);
-    holdFragment(pathname + search, kept.hash, restored);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function holdFragment(pathAndQuery, hash, restored) {
-  const until = Date.now() + HOLD_MS;
-  const check = () => {
-    const l = window.location;
-    if (l.pathname + l.search !== pathAndQuery || l.hash === hash) {
-      if (l.pathname + l.search === pathAndQuery && Date.now() < until) {
-        window.setTimeout(check, 50);
-      }
-      return;
-    }
-    if (l.hash && l.hash !== TAB_ADOPT_HASH) return;
-    try {
-      window.history.replaceState(window.history.state, "", restored);
-    } catch {
-    }
-  };
-  window.setTimeout(check, 0);
-}
-
-// src/types.ts
-var DISPLAY_IDENTITY_KINDS = ["did", "btc", "email", "nostr"];
-var DEFAULT_CONFIG = {
-  authOrigin: "https://ochk.io",
-  signInPath: "/signin",
-  mePath: "/api/auth/me",
-  logoutPath: "/api/auth/logout",
-  multiAccount: true
+import {
+  useStepUpAuth,
+  useWebAuthnList,
+  useWebAuthnRegister
+} from "./chunk-BYAF2P2L.mjs";
+import {
+  OcBond,
+  bondFloorsText,
+  fetchOcBond
+} from "./chunk-HZ4FJMF3.mjs";
+import {
+  OcAccountChip,
+  OcAccountPill,
+  OcAddressInput,
+  OcSignInButton,
+  useOcAddressSuggestion
+} from "./chunk-7UYPMTAV.mjs";
+import {
+  OcSessionProvider,
+  useOcSession,
+  useOptionalOcSession
+} from "./chunk-7ST4Q5KR.mjs";
+import {
+  OcSignIn,
+  familyReturnTarget,
+  safeReturnTo
+} from "./chunk-4E7GJ5IB.mjs";
+import {
+  OcLinkedIdentities,
+  fetchOcLinkedIdentities
+} from "./chunk-UFRU3I3D.mjs";
+import {
+  SUDO_ACCOUNT_MISMATCH_MESSAGE,
+  handleSudoRequired,
+  isSudoAccountMismatch,
+  redirectToSudo
+} from "./chunk-XCZVSE7M.mjs";
+import "./chunk-H2TXOCXH.mjs";
+import {
+  DEFAULT_CONFIG,
+  DISPLAY_IDENTITY_KINDS,
+  buildAddAccountUrl,
+  buildSignInUrl
+} from "./chunk-VRLFZAGK.mjs";
+import {
+  FRAGMENT_TTL_MS,
+  keepFragmentOnReturnLinks,
+  restoreReturnFragment,
+  returnToHere,
+  stripFragment,
+  withoutFragment
+} from "./chunk-CYR7J4UY.mjs";
+import {
+  TAB_ACCOUNT_HINT_KEY,
+  TAB_ADOPT_HASH,
+  TAB_SESSION_HEADER,
+  TAB_SESSION_STORAGE_KEY,
+  clearTabSession,
+  consumeTabAccountHint,
+  consumeTabAdoptMarker,
+  installTabFetchInterceptor,
+  installTabLinkDecorator,
+  readTabSession,
+  tabSessionHeader,
+  writeTabSession
+} from "./chunk-TJJNTITX.mjs";
+export {
+  DEFAULT_CONFIG,
+  DISPLAY_IDENTITY_KINDS,
+  FRAGMENT_TTL_MS,
+  OcAccountChip,
+  OcAccountPill,
+  OcAddressInput,
+  OcBond,
+  OcLinkedIdentities,
+  OcSessionProvider,
+  OcSignIn,
+  OcSignInButton,
+  SUDO_ACCOUNT_MISMATCH_MESSAGE,
+  TAB_ACCOUNT_HINT_KEY,
+  TAB_ADOPT_HASH,
+  TAB_SESSION_HEADER,
+  TAB_SESSION_STORAGE_KEY,
+  bondFloorsText,
+  buildAddAccountUrl,
+  buildSignInUrl,
+  clearTabSession,
+  consumeTabAccountHint,
+  consumeTabAdoptMarker,
+  familyReturnTarget,
+  fetchOcBond,
+  fetchOcLinkedIdentities,
+  handleSudoRequired,
+  installTabFetchInterceptor,
+  installTabLinkDecorator,
+  isSudoAccountMismatch,
+  keepFragmentOnReturnLinks,
+  readTabSession,
+  redirectToSudo,
+  restoreReturnFragment,
+  returnToHere,
+  safeReturnTo,
+  stripFragment,
+  tabSessionHeader,
+  useOcAddressSuggestion,
+  useOcSession,
+  useOptionalOcSession,
+  useStepUpAuth,
+  useWebAuthnList,
+  useWebAuthnRegister,
+  withoutFragment,
+  writeTabSession
 };
-function resolveConfig(cfg) {
-  return { ...DEFAULT_CONFIG, ...cfg ?? {} };
-}
-function buildSignInUrl(cfg, returnTo) {
-  const base = `${cfg.authOrigin}${cfg.signInPath}`;
-  if (!returnTo) return base;
-  const u = new URL(base);
-  u.searchParams.set("return_to", stripFragment(returnTo));
-  return u.toString();
-}
-function buildAddAccountUrl(cfg, returnTo) {
-  const u = new URL(buildSignInUrl(cfg, returnTo));
-  u.searchParams.set("add", "1");
-  return u.toString();
-}
-var SessionContext = React4.createContext(null);
-function normalizeDisplayIdentity(raw, didOc) {
-  const di = raw.display_identity ?? raw.displayIdentity;
-  if (di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind)) {
-    return { kind: di.kind, value: di.value };
-  }
-  return { kind: "did", value: didOc };
-}
-function normalizeRosterEntry(raw) {
-  const didOc = raw.did_oc ?? raw.didOc;
-  if (!didOc) return null;
-  const di = raw.display_identity ?? raw.displayIdentity;
-  const displayIdentity = di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind) ? { kind: di.kind, value: di.value } : { kind: "did", value: didOc };
-  return {
-    didOc,
-    displayName: raw.display_name ?? raw.displayName ?? null,
-    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
-    displayIdentity,
-    lastSeenAt: raw.last_seen_at ?? raw.lastSeenAt ?? null
-  };
-}
-async function fetchHostRoster(cfg) {
-  try {
-    const res = await fetch(`${cfg.authOrigin}${cfg.mePath}`, {
-      method: "GET",
-      credentials: "include",
-      headers: { Accept: "application/json", ...tabSessionHeader() }
-    });
-    if (!res.ok) return [];
-    const body = await res.json();
-    return Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
-  } catch {
-    return [];
-  }
-}
-function normalizeAccount(raw) {
-  if (!raw) return null;
-  const didOc = raw.did_oc ?? raw.didOc;
-  const accountId = raw.id ?? raw.account_id ?? raw.accountId;
-  if (!didOc || !accountId) return null;
-  return {
-    accountId,
-    didOc,
-    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
-    hasEmail: raw.has_email ?? raw.hasEmail ?? false,
-    displayName: raw.display_name ?? raw.displayName ?? null,
-    nostrNpub: raw.nostr_npub ?? raw.nostrNpub ?? null,
-    homeFederation: raw.home_federation_slug ?? raw.homeFederation ?? null,
-    signingMethod: raw.signing_method ?? raw.signingMethod ?? null,
-    isOwner: Boolean(raw.is_owner ?? raw.isOwner ?? false),
-    displayIdentity: normalizeDisplayIdentity(raw, didOc)
-  };
-}
-function OcSessionProvider({
-  children,
-  config,
-  defaultReturnTo
-}) {
-  const cfg = React4.useMemo(() => resolveConfig(config), [config]);
-  React4.useState(() => {
-    if (typeof window !== "undefined") {
-      consumeTabAdoptMarker();
-      restoreReturnFragment();
-    }
-    return null;
-  });
-  const [account, setAccount] = React4.useState(null);
-  const [roster, setRoster] = React4.useState([]);
-  const [status, setStatus] = React4.useState("loading");
-  const [error, setError] = React4.useState(null);
-  const [tabPinned, setTabPinned] = React4.useState(false);
-  const pinInFlightRef = React4.useRef(false);
-  const pinThisTab = React4.useCallback(
-    async (didOc) => {
-      if (!cfg.multiAccount || pinInFlightRef.current || readTabSession()) return;
-      pinInFlightRef.current = true;
-      try {
-        const res = await fetch(`${cfg.authOrigin}/api/auth/tab`, {
-          method: "POST",
-          credentials: "include",
-          headers: { Accept: "application/json" }
-        });
-        if (!res.ok) return;
-        const body = await res.json();
-        if (body.ok && typeof body.token === "string" && body.account?.did_oc === didOc) {
-          writeTabSession({ token: body.token, didOc });
-          setTabPinned(true);
-        }
-      } catch {
-      } finally {
-        pinInFlightRef.current = false;
-      }
-    },
-    [cfg.authOrigin, cfg.multiAccount]
-  );
-  const refresh = React4.useCallback(async () => {
-    if (typeof window === "undefined") return;
-    try {
-      let pin = readTabSession();
-      let res = await fetch(cfg.mePath, {
-        method: "GET",
-        credentials: "include",
-        headers: { Accept: "application/json", ...tabSessionHeader() }
-      });
-      if (res.status === 401 && pin) {
-        clearTabSession();
-        pin = null;
-        setTabPinned(false);
-        res = await fetch(cfg.mePath, {
-          method: "GET",
-          credentials: "include",
-          headers: { Accept: "application/json" }
-        });
-      }
-      if (res.status === 401) {
-        setAccount(null);
-        setRoster([]);
-        setStatus("anonymous");
-        setError(null);
-        return;
-      }
-      if (!res.ok) {
-        setStatus("error");
-        setError(new Error(`me endpoint returned ${res.status}`));
-        return;
-      }
-      const body = await res.json();
-      const acct = normalizeAccount(body.account);
-      if (acct && pin && acct.didOc !== pin.didOc) {
-        clearTabSession();
-        pin = null;
-      }
-      setTabPinned(pin !== null);
-      const rosterEntries = Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
-      setAccount(acct);
-      setRoster(rosterEntries);
-      setStatus(acct ? "authenticated" : "anonymous");
-      setError(null);
-      if (acct && !pin) void pinThisTab(acct.didOc);
-      const currentOrigin = typeof window !== "undefined" ? window.location.origin : null;
-      if (cfg.multiAccount && acct && rosterEntries.length === 0 && currentOrigin !== null && !cfg.authOrigin.startsWith(currentOrigin)) {
-        const peers = await fetchHostRoster(cfg);
-        if (peers.length > 0) setRoster(peers);
-      }
-    } catch (err) {
-      setStatus("error");
-      setError(err instanceof Error ? err : new Error(String(err)));
-    }
-  }, [cfg, pinThisTab]);
-  React4.useEffect(() => {
-    let cancelled = false;
-    consumeTabAdoptMarker();
-    void (async () => {
-      if (cfg.multiAccount) await consumeTabAccountHint(cfg.authOrigin);
-      if (!cancelled) void refresh();
-    })();
-    return () => {
-      cancelled = true;
-    };
-  }, [refresh, cfg.authOrigin, cfg.multiAccount]);
-  React4.useEffect(() => keepFragmentOnReturnLinks(), []);
-  React4.useEffect(
-    () => cfg.multiAccount ? installTabFetchInterceptor(cfg.authOrigin) : void 0,
-    [cfg.authOrigin, cfg.multiAccount]
-  );
-  React4.useEffect(
-    () => cfg.multiAccount ? installTabLinkDecorator(cfg.authOrigin) : void 0,
-    [cfg.authOrigin, cfg.multiAccount]
-  );
-  const signOut = React4.useCallback(
-    async (opts) => {
-      const scope = opts?.scope ?? "all";
-      try {
-        const url = new URL(`${cfg.authOrigin}${cfg.logoutPath}`);
-        if (scope === "current") url.searchParams.set("scope", "current");
-        const res = await fetch(url.toString(), {
-          method: "POST",
-          credentials: "include",
-          // Per-tab · carry the pin so scope='current' signs out
-          // the account THIS tab is operating as, not whichever
-          // account the shared cookie happens to point at.
-          headers: { ...tabSessionHeader() },
-          // `keepalive` lets the logout round-trip complete even if
-          // the caller hard-navigates away in the same tick (e.g.
-          // `<OcAccountMenu>` redirects home immediately on sign-out).
-          // Without it the in-flight request is cancelled on unload
-          // and the `.ochk.io` cookie may never get cleared.
-          keepalive: true
-        });
-        clearTabSession();
-        setTabPinned(false);
-        if (scope === "current" && res.ok) {
-          await refresh();
-          return;
-        }
-      } catch {
-        clearTabSession();
-        setTabPinned(false);
-      }
-      setAccount(null);
-      setRoster([]);
-      setStatus("anonymous");
-    },
-    [cfg.authOrigin, cfg.logoutPath, refresh]
-  );
-  const switchAccount = React4.useCallback(
-    async (didOc) => {
-      if (typeof window === "undefined") return;
-      const res = await fetch(`${cfg.authOrigin}/api/auth/switch`, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json", ...tabSessionHeader() },
-        body: JSON.stringify({ did_oc: didOc })
-      });
-      if (!res.ok) {
-        let reason = `http_${res.status}`;
-        try {
-          const body = await res.json();
-          if (body.reason) reason = body.reason;
-        } catch {
-        }
-        throw new Error(`[@orangecheck/auth-client] switchAccount failed: ${reason}`);
-      }
-      try {
-        const body = await res.json();
-        if (typeof body.token === "string" && body.account?.did_oc) {
-          writeTabSession({ token: body.token, didOc: body.account.did_oc });
-          setTabPinned(true);
-        }
-      } catch {
-      }
-      await refresh();
-    },
-    [cfg.authOrigin, refresh]
-  );
-  const addAccountUrl = React4.useCallback(
-    (returnTo) => {
-      const rt = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
-      return buildAddAccountUrl(cfg, rt);
-    },
-    [cfg]
-  );
-  const setDisplayIdentity = React4.useCallback(
-    async (kind) => {
-      if (typeof window === "undefined") return;
-      const res = await fetch(`${cfg.authOrigin}/api/auth/account`, {
-        method: "PATCH",
-        credentials: "include",
-        headers: { "Content-Type": "application/json", ...tabSessionHeader() },
-        body: JSON.stringify({ display_identity: kind })
-      });
-      if (!res.ok) {
-        let reason = `http_${res.status}`;
-        try {
-          const body = await res.json();
-          if (body.reason) reason = body.reason;
-        } catch {
-        }
-        throw new Error(`[@orangecheck/auth-client] setDisplayIdentity failed: ${reason}`);
-      }
-      try {
-        const body = await res.json();
-        const pin = readTabSession();
-        if (pin && typeof body.token === "string" && body.account?.did_oc === pin.didOc) {
-          writeTabSession({ token: body.token, didOc: pin.didOc });
-        }
-      } catch {
-      }
-      await refresh();
-    },
-    [cfg.authOrigin, refresh]
-  );
-  const value = React4.useMemo(() => {
-    const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
-    return {
-      status,
-      account,
-      roster,
-      tabPinned,
-      error,
-      refresh,
-      signOut,
-      switchAccount,
-      addAccountUrl,
-      setDisplayIdentity,
-      signInUrl: buildSignInUrl(cfg, returnTo)
-    };
-  }, [
-    status,
-    account,
-    roster,
-    tabPinned,
-    error,
-    refresh,
-    signOut,
-    switchAccount,
-    addAccountUrl,
-    setDisplayIdentity,
-    cfg,
-    defaultReturnTo
-  ]);
-  return /* @__PURE__ */ jsx(SessionContext.Provider, { value, children });
-}
-function useOcSession() {
-  const ctx = React4.useContext(SessionContext);
-  if (!ctx) {
-    throw new Error(
-      "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
-    );
-  }
-  return ctx;
-}
-function useOptionalOcSession() {
-  return React4.useContext(SessionContext);
-}
-function shortenAddress(addr) {
-  if (addr.length <= 12) return addr;
-  return `${addr.slice(0, 6)}\u2026${addr.slice(-4)}`;
-}
-function shortenAddressMid(addr) {
-  if (addr.length <= 16) return addr;
-  return `${addr.slice(0, 8)}\u2026${addr.slice(-6)}`;
-}
-function isPrefixOf(value, target) {
-  return target.toLowerCase().startsWith(value.toLowerCase());
-}
-var listboxIdCounter = 0;
-function useUniqueId(prefix) {
-  const [id] = React4.useState(() => `${prefix}-${++listboxIdCounter}`);
-  return id;
-}
-function OcAccountChip({
-  dashboardUrl = "https://ochk.io/dashboard",
-  signInUrl: signInUrlOverride,
-  signInLabel = "sign in",
-  className,
-  triggerClassName,
-  popoverClassName,
-  menuItemClassName
-}) {
-  const { status, account, signInUrl: sessionSignInUrl, signOut } = useOcSession();
-  const signInUrl = signInUrlOverride ?? sessionSignInUrl;
-  const [open, setOpen] = React4.useState(false);
-  const wrapRef = React4.useRef(null);
-  React4.useEffect(() => {
-    if (!open) return;
-    function handleClickOutside(e) {
-      if (wrapRef.current && !wrapRef.current.contains(e.target)) {
-        setOpen(false);
-      }
-    }
-    function handleEscape(e) {
-      if (e.key === "Escape") setOpen(false);
-    }
-    document.addEventListener("mousedown", handleClickOutside);
-    document.addEventListener("keydown", handleEscape);
-    return () => {
-      document.removeEventListener("mousedown", handleClickOutside);
-      document.removeEventListener("keydown", handleEscape);
-    };
-  }, [open]);
-  if (status === "loading") return null;
-  if (status !== "authenticated" || !account) {
-    return /* @__PURE__ */ jsx(
-      "a",
-      {
-        href: signInUrl,
-        className: triggerClassName ?? className,
-        "data-oc-account-chip-signin": "",
-        children: signInLabel
-      }
-    );
-  }
-  return /* @__PURE__ */ jsxs(
-    "div",
-    {
-      ref: wrapRef,
-      className,
-      "data-oc-account-chip": "",
-      style: { position: "relative", display: "inline-block" },
-      children: [
-        /* @__PURE__ */ jsxs(
-          "button",
-          {
-            type: "button",
-            onClick: () => setOpen((v) => !v),
-            "aria-haspopup": "menu",
-            "aria-expanded": open,
-            "aria-label": `Signed in as ${account.didOc}. Open account menu.`,
-            className: triggerClassName,
-            "data-oc-account-chip-trigger": "",
-            style: triggerClassName ? void 0 : {
-              display: "inline-flex",
-              alignItems: "center",
-              gap: "0.4rem",
-              padding: "0.25rem 0.625rem",
-              borderRadius: "9999px",
-              border: "1px solid var(--border, #27272a)",
-              background: "color-mix(in oklch, var(--muted, #27272a) 40%, transparent)",
-              color: "var(--foreground, #fafafa)",
-              fontFamily: "ui-monospace, SFMono-Regular, monospace",
-              fontSize: 12,
-              cursor: "pointer"
-            },
-            children: [
-              /* @__PURE__ */ jsx("span", { "aria-hidden": "true", style: { color: "#22c55e", fontSize: 8 }, children: "\u25CF" }),
-              /* @__PURE__ */ jsx("span", { children: account.displayName ?? shortenAddress(account.didOc) }),
-              /* @__PURE__ */ jsx(
-                "svg",
-                {
-                  width: "9",
-                  height: "9",
-                  viewBox: "0 0 10 10",
-                  "aria-hidden": "true",
-                  style: {
-                    transition: "transform 120ms",
-                    transform: open ? "rotate(180deg)" : "rotate(0)",
-                    opacity: 0.6
-                  },
-                  children: /* @__PURE__ */ jsx(
-                    "path",
-                    {
-                      d: "M2 4 L5 7 L8 4",
-                      stroke: "currentColor",
-                      strokeWidth: "1.5",
-                      fill: "none",
-                      strokeLinecap: "round"
-                    }
-                  )
-                }
-              )
-            ]
-          }
-        ),
-        open && /* @__PURE__ */ jsxs(
-          "div",
-          {
-            role: "menu",
-            "aria-label": "Account menu",
-            className: popoverClassName,
-            "data-oc-account-chip-popover": "",
-            style: popoverClassName ? { position: "absolute", zIndex: 50, top: "calc(100% + 6px)", right: 0 } : {
-              position: "absolute",
-              zIndex: 50,
-              top: "calc(100% + 6px)",
-              right: 0,
-              minWidth: 240,
-              background: "var(--popover, #0a0a0a)",
-              color: "var(--popover-foreground, #fafafa)",
-              border: "1px solid var(--border, #27272a)",
-              boxShadow: "0 10px 32px -4px rgba(0,0,0,0.35)",
-              fontFamily: "ui-monospace, SFMono-Regular, monospace"
-            },
-            children: [
-              /* @__PURE__ */ jsxs(
-                "div",
-                {
-                  "data-oc-account-chip-header": "",
-                  style: {
-                    padding: "0.75rem 0.75rem 0.625rem",
-                    borderBottom: "1px solid var(--border, #27272a)"
-                  },
-                  children: [
-                    /* @__PURE__ */ jsx(
-                      "div",
-                      {
-                        "data-oc-account-chip-label": "",
-                        style: {
-                          color: "var(--primary, #f97316)",
-                          fontSize: 10,
-                          letterSpacing: "0.18em",
-                          textTransform: "uppercase",
-                          marginBottom: 4
-                        },
-                        children: "\xA7 signed in"
-                      }
-                    ),
-                    /* @__PURE__ */ jsx(
-                      "div",
-                      {
-                        "data-oc-account-chip-address": "",
-                        style: {
-                          color: "var(--popover-foreground, #fafafa)",
-                          fontSize: 11,
-                          wordBreak: "break-all",
-                          lineHeight: 1.35
-                        },
-                        children: account.didOc
-                      }
-                    ),
-                    account.displayName ? /* @__PURE__ */ jsx(
-                      "div",
-                      {
-                        style: {
-                          color: "var(--muted-foreground, #a1a1aa)",
-                          fontSize: 10,
-                          marginTop: 4,
-                          letterSpacing: "0.06em"
-                        },
-                        children: account.displayName
-                      }
-                    ) : null
-                  ]
-                }
-              ),
-              /* @__PURE__ */ jsxs("div", { role: "none", style: { padding: "0.25rem" }, children: [
-                dashboardUrl ? /* @__PURE__ */ jsxs(
-                  "a",
-                  {
-                    role: "menuitem",
-                    href: dashboardUrl,
-                    onClick: () => setOpen(false),
-                    className: menuItemClassName,
-                    "data-oc-account-chip-item": "",
-                    style: menuItemClassName ? void 0 : {
-                      display: "flex",
-                      alignItems: "center",
-                      gap: "0.5rem",
-                      padding: "0.5rem 0.625rem",
-                      fontSize: 12,
-                      color: "var(--popover-foreground, #fafafa)",
-                      textDecoration: "none",
-                      cursor: "pointer"
-                    },
-                    children: [
-                      /* @__PURE__ */ jsx(
-                        "span",
-                        {
-                          "aria-hidden": "true",
-                          style: { color: "var(--muted-foreground, #a1a1aa)" },
-                          children: "\u2192"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx("span", { style: { flex: 1 }, children: "dashboard" }),
-                      /* @__PURE__ */ jsx(
-                        "span",
-                        {
-                          style: {
-                            color: "var(--muted-foreground, #a1a1aa)",
-                            fontSize: 10
-                          },
-                          children: "\u2197"
-                        }
-                      )
-                    ]
-                  }
-                ) : null,
-                /* @__PURE__ */ jsxs(
-                  "button",
-                  {
-                    type: "button",
-                    role: "menuitem",
-                    onClick: () => {
-                      setOpen(false);
-                      void signOut();
-                    },
-                    className: menuItemClassName,
-                    "data-oc-account-chip-item": "",
-                    "data-oc-account-chip-signout": "",
-                    style: menuItemClassName ? void 0 : {
-                      display: "flex",
-                      alignItems: "center",
-                      gap: "0.5rem",
-                      width: "100%",
-                      padding: "0.5rem 0.625rem",
-                      fontSize: 12,
-                      color: "var(--popover-foreground, #fafafa)",
-                      background: "transparent",
-                      border: 0,
-                      fontFamily: "inherit",
-                      textAlign: "left",
-                      cursor: "pointer"
-                    },
-                    children: [
-                      /* @__PURE__ */ jsx(
-                        "span",
-                        {
-                          "aria-hidden": "true",
-                          style: { color: "var(--muted-foreground, #a1a1aa)" },
-                          children: "\u2192"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx("span", { style: { flex: 1 }, children: "sign out" })
-                    ]
-                  }
-                )
-              ] })
-            ]
-          }
-        )
-      ]
-    }
-  );
-}
-function OcSignInButton({
-  label = "sign in",
-  eager = false,
-  className,
-  signInUrl: signInUrlOverride,
-  ...rest
-}) {
-  const { status, signInUrl: sessionSignInUrl } = useOcSession();
-  const href = signInUrlOverride ?? sessionSignInUrl;
-  if (status === "authenticated") return null;
-  if (!eager && status === "loading") return null;
-  return /* @__PURE__ */ jsx(
-    "a",
-    {
-      ...rest,
-      href,
-      className,
-      "data-oc-sign-in-button": "",
-      children: label
-    }
-  );
-}
-function OcAccountPill({
-  dashboardUrl,
-  render,
-  className,
-  ...rest
-}) {
-  const { status, account, signOut } = useOcSession();
-  if (status !== "authenticated" || !account) return null;
-  const label = render ? render({ address: account.didOc, displayName: account.displayName }) : account.displayName ?? shortenAddress(account.didOc);
-  return /* @__PURE__ */ jsxs(
-    "div",
-    {
-      ...rest,
-      className,
-      "data-oc-account-pill": "",
-      style: { display: "inline-flex", alignItems: "center", gap: "0.5rem", ...rest.style ?? {} },
-      children: [
-        dashboardUrl ? /* @__PURE__ */ jsx("a", { href: dashboardUrl, children: label }) : /* @__PURE__ */ jsx("span", { children: label }),
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => {
-              void signOut();
-            },
-            "aria-label": "Sign out",
-            style: {
-              background: "none",
-              border: "none",
-              cursor: "pointer",
-              color: "inherit",
-              font: "inherit",
-              padding: 0
-            },
-            children: "sign out"
-          }
-        )
-      ]
-    }
-  );
-}
-function accountAddress(account) {
-  if (account?.primaryBtc) return account.primaryBtc;
-  return account?.displayIdentity?.kind === "btc" ? account.displayIdentity.value : null;
-}
-function useOcAddressSuggestion(options) {
-  const {
-    value,
-    onValueChange,
-    suggestionLabel = "use your address",
-    popoverClassName,
-    suggestionClassName
-  } = options;
-  const { status, account } = useOcSession();
-  const sessionAddress = status === "authenticated" ? accountAddress(account) : null;
-  const [open, setOpen] = React4.useState(false);
-  const [highlighted, setHighlighted] = React4.useState(false);
-  const blurTimer = React4.useRef(null);
-  const listboxId = useUniqueId("oc-addr-listbox");
-  const optionId = `${listboxId}-opt`;
-  const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
-  const canSuggest = sessionAddress != null && sessionAddress.length > 0 && !valueMatchesSession && isPrefixOf(value, sessionAddress);
-  const showPopover = open && canSuggest;
-  function selectSuggestion() {
-    if (!sessionAddress) return;
-    onValueChange(sessionAddress);
-    setOpen(false);
-    setHighlighted(false);
-  }
-  React4.useEffect(() => {
-    return () => {
-      if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
-    };
-  }, []);
-  const inputProps = {
-    onFocus: () => {
-      if (blurTimer.current != null) {
-        window.clearTimeout(blurTimer.current);
-        blurTimer.current = null;
-      }
-      setOpen(true);
-    },
-    onBlur: () => {
-      blurTimer.current = window.setTimeout(() => {
-        setOpen(false);
-        setHighlighted(false);
-      }, 120);
-    },
-    onKeyDown: (e) => {
-      if (!showPopover) return;
-      if (e.key === "ArrowDown") {
-        e.preventDefault();
-        setHighlighted(true);
-      } else if (e.key === "ArrowUp") {
-        e.preventDefault();
-        setHighlighted(false);
-      } else if (e.key === "Escape") {
-        e.preventDefault();
-        setOpen(false);
-        setHighlighted(false);
-      } else if (e.key === "Enter" && highlighted) {
-        e.preventDefault();
-        selectSuggestion();
-      }
-    },
-    role: "combobox",
-    "aria-haspopup": "listbox",
-    "aria-expanded": showPopover,
-    "aria-controls": showPopover ? listboxId : void 0,
-    "aria-activedescendant": highlighted ? optionId : void 0,
-    autoComplete: "off",
-    spellCheck: false
-  };
-  const popover = showPopover && sessionAddress ? /* @__PURE__ */ jsx(
-    "div",
-    {
-      id: listboxId,
-      role: "listbox",
-      "data-oc-address-popover": "",
-      className: popoverClassName,
-      style: {
-        position: "absolute",
-        zIndex: 50,
-        top: "calc(100% + 4px)",
-        left: 0,
-        right: 0
-      },
-      onMouseDown: (e) => e.preventDefault(),
-      children: /* @__PURE__ */ jsxs(
-        "button",
-        {
-          type: "button",
-          id: optionId,
-          role: "option",
-          "aria-selected": highlighted,
-          "data-oc-address-suggestion": "",
-          "data-highlighted": highlighted ? "" : void 0,
-          className: suggestionClassName,
-          onClick: selectSuggestion,
-          onMouseEnter: () => setHighlighted(true),
-          onMouseLeave: () => setHighlighted(false),
-          style: {
-            display: "flex",
-            alignItems: "center",
-            justifyContent: "space-between",
-            gap: "0.75rem",
-            width: "100%",
-            textAlign: "left",
-            cursor: "pointer",
-            font: "inherit",
-            background: "inherit",
-            color: "inherit",
-            border: 0,
-            padding: "inherit"
-          },
-          children: [
-            /* @__PURE__ */ jsx("span", { "data-oc-address-suggestion-label": "", children: suggestionLabel }),
-            /* @__PURE__ */ jsx(
-              "span",
-              {
-                "data-oc-address-suggestion-value": "",
-                style: { fontFamily: "ui-monospace, monospace" },
-                children: shortenAddressMid(sessionAddress)
-              }
-            )
-          ]
-        }
-      )
-    }
-  ) : null;
-  return { inputProps, popover };
-}
-var OcAddressInput = React4.forwardRef(
-  function OcAddressInput2({
-    value,
-    onValueChange,
-    suggestionLabel = "use your address",
-    wrapperClassName,
-    popoverClassName,
-    suggestionClassName,
-    onFocus,
-    onBlur,
-    onKeyDown,
-    ...rest
-  }, forwardedRef) {
-    const { status, account } = useOcSession();
-    const sessionAddress = status === "authenticated" ? accountAddress(account) : null;
-    const [open, setOpen] = React4.useState(false);
-    const [highlighted, setHighlighted] = React4.useState(false);
-    const innerRef = React4.useRef(null);
-    const setRef = (node) => {
-      innerRef.current = node;
-      if (typeof forwardedRef === "function") forwardedRef(node);
-      else if (forwardedRef) forwardedRef.current = node;
-    };
-    const blurTimer = React4.useRef(null);
-    const listboxId = useUniqueId("oc-addr-listbox");
-    const optionId = `${listboxId}-opt`;
-    const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
-    const canSuggest = sessionAddress != null && sessionAddress.length > 0 && !valueMatchesSession && isPrefixOf(value, sessionAddress);
-    const showPopover = open && canSuggest;
-    function selectSuggestion() {
-      if (!sessionAddress) return;
-      onValueChange(sessionAddress);
-      setOpen(false);
-      setHighlighted(false);
-      innerRef.current?.focus();
-    }
-    function handleFocus(e) {
-      if (blurTimer.current != null) {
-        window.clearTimeout(blurTimer.current);
-        blurTimer.current = null;
-      }
-      setOpen(true);
-      onFocus?.(e);
-    }
-    function handleBlur(e) {
-      blurTimer.current = window.setTimeout(() => {
-        setOpen(false);
-        setHighlighted(false);
-      }, 120);
-      onBlur?.(e);
-    }
-    function handleKeyDown(e) {
-      if (showPopover) {
-        if (e.key === "ArrowDown") {
-          e.preventDefault();
-          setHighlighted(true);
-        } else if (e.key === "ArrowUp") {
-          e.preventDefault();
-          setHighlighted(false);
-        } else if (e.key === "Escape") {
-          e.preventDefault();
-          setOpen(false);
-          setHighlighted(false);
-        } else if (e.key === "Enter" && highlighted) {
-          e.preventDefault();
-          selectSuggestion();
-        }
-      }
-      onKeyDown?.(e);
-    }
-    React4.useEffect(() => {
-      return () => {
-        if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
-      };
-    }, []);
-    return /* @__PURE__ */ jsxs(
-      "div",
-      {
-        "data-oc-address-input": "",
-        className: wrapperClassName,
-        style: { position: "relative" },
-        children: [
-          /* @__PURE__ */ jsx(
-            "input",
-            {
-              ...rest,
-              ref: setRef,
-              value,
-              onChange: (e) => onValueChange(e.target.value),
-              onFocus: handleFocus,
-              onBlur: handleBlur,
-              onKeyDown: handleKeyDown,
-              role: "combobox",
-              "aria-haspopup": "listbox",
-              "aria-expanded": showPopover,
-              "aria-controls": showPopover ? listboxId : void 0,
-              "aria-activedescendant": highlighted ? optionId : void 0,
-              autoComplete: "off",
-              spellCheck: false
-            }
-          ),
-          showPopover && sessionAddress && /* @__PURE__ */ jsx(
-            "div",
-            {
-              id: listboxId,
-              role: "listbox",
-              "data-oc-address-popover": "",
-              className: popoverClassName,
-              style: {
-                position: "absolute",
-                zIndex: 50,
-                top: "calc(100% + 4px)",
-                left: 0,
-                right: 0
-              },
-              onMouseDown: (e) => e.preventDefault(),
-              children: /* @__PURE__ */ jsxs(
-                "button",
-                {
-                  type: "button",
-                  id: optionId,
-                  role: "option",
-                  "aria-selected": highlighted,
-                  "data-oc-address-suggestion": "",
-                  "data-highlighted": highlighted ? "" : void 0,
-                  className: suggestionClassName,
-                  onClick: selectSuggestion,
-                  onMouseEnter: () => setHighlighted(true),
-                  onMouseLeave: () => setHighlighted(false),
-                  style: {
-                    display: "flex",
-                    alignItems: "center",
-                    justifyContent: "space-between",
-                    gap: "0.75rem",
-                    width: "100%",
-                    textAlign: "left",
-                    cursor: "pointer",
-                    font: "inherit",
-                    background: "inherit",
-                    color: "inherit",
-                    border: "inherit",
-                    padding: "inherit"
-                  },
-                  children: [
-                    /* @__PURE__ */ jsx("span", { "data-oc-address-suggestion-label": "", children: suggestionLabel }),
-                    /* @__PURE__ */ jsx(
-                      "span",
-                      {
-                        "data-oc-address-suggestion-value": "",
-                        style: { fontFamily: "ui-monospace, monospace" },
-                        children: shortenAddressMid(sessionAddress)
-                      }
-                    )
-                  ]
-                }
-              )
-            }
-          )
-        ]
-      }
-    );
-  }
-);
-
-// src/sudo.tsx
-function redirectToSudo(args = {}) {
-  if (typeof window === "undefined") {
-    throw new Error(
-      "[@orangecheck/auth-client] redirectToSudo() requires a browser environment"
-    );
-  }
-  const cfg = resolveConfig(args.config);
-  const url = new URL("/sudo", cfg.authOrigin);
-  const returnTo = withoutFragment(args.returnTo ?? window.location.href);
-  if (returnTo) url.searchParams.set("return_to", returnTo);
-  if (args.purpose) url.searchParams.set("purpose", args.purpose);
-  window.location.assign(url.toString());
-}
-function handleSudoRequired(body, args = {}) {
-  if (body && body.reason === "sudo_required") {
-    redirectToSudo(args);
-    return true;
-  }
-  return false;
-}
-var SUDO_ACCOUNT_MISMATCH_MESSAGE = "Switch this tab to that account first \u2014 the confirmation on file is for a different one.";
-function isSudoAccountMismatch(body) {
-  return body?.reason === "sudo_account_mismatch";
-}
-
-// src/appearance.ts
-var SIGNIN_FONT = "var(--oc-signin-font, ui-monospace, SFMono-Regular, monospace)";
-var SIGNIN_CASE = "var(--oc-signin-case, uppercase)";
-var signinTracking = (em) => `var(--oc-signin-tracking, ${em})`;
-var signinSize = (px) => `calc(${px}px * var(--oc-signin-scale, 1))`;
-var signinRadius = (px) => `var(--oc-signin-radius, ${px}px)`;
-var SIGNIN_BUTTON_RADIUS = "var(--oc-signin-button-radius, 6px)";
-var SIGNIN_STRONG = "var(--oc-signin-strong, 600)";
-var SIGNIN_ARROW = "var(--oc-signin-arrow, inline)";
-var signinRoleSize = (role, fallback) => `var(--oc-signin-${role}-size, ${fallback})`;
-var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
-async function fetchOcLinkedIdentities(opts) {
-  const authOrigin = opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN;
-  const r = await fetch(`${authOrigin}/api/auth/identities`, {
-    credentials: "include",
-    headers: { ...tabSessionHeader() }
-  });
-  if (r.status === 401) return [];
-  if (!r.ok) throw new Error(`identities fetch failed: http_${r.status}`);
-  const body = await r.json();
-  return body.linked ?? [];
-}
-function OcLinkedIdentities({
-  authOrigin = DEFAULT_AUTH_ORIGIN,
-  className,
-  onChange,
-  attestationLink = true
-}) {
-  const [resp, setResp] = React4.useState(null);
-  const [error, setError] = React4.useState(null);
-  const [showEmailLink, setShowEmailLink] = React4.useState(false);
-  const [showBtcLink, setShowBtcLink] = React4.useState(false);
-  const refresh = React4.useCallback(async () => {
-    setError(null);
-    try {
-      const r = await fetch(`${authOrigin}/api/auth/identities`, {
-        credentials: "include",
-        headers: { ...tabSessionHeader() }
-      });
-      if (!r.ok) {
-        if (r.status === 401) {
-          setError("not signed in");
-          return;
-        }
-        throw new Error(`http_${r.status}`);
-      }
-      setResp(await r.json());
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "load failed");
-    }
-  }, [authOrigin]);
-  React4.useEffect(() => {
-    void refresh();
-  }, [refresh]);
-  const afterChange = React4.useCallback(() => {
-    setShowEmailLink(false);
-    setShowBtcLink(false);
-    void refresh();
-    onChange?.();
-  }, [refresh, onChange]);
-  if (error) {
-    return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: panelStyle("warn"), role: "alert", children: [
-      /* @__PURE__ */ jsx(SectionLabel, { tone: "warn", children: "\xA7 identities \xB7 load deferred" }),
-      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "Couldn't reach the auth host (",
-        error,
-        "). Linking is temporarily unavailable; your signed-in identity still works as normal."
-      ] }),
-      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => void refresh(), style: ghostBtnStyle(false), children: "retry" })
-    ] });
-  }
-  if (!resp) {
-    return /* @__PURE__ */ jsx("div", { className, "data-oc-li": "", style: panelStyle(), children: /* @__PURE__ */ jsx("span", { style: hintStyle, children: "loading\u2026" }) });
-  }
-  const linked = resp.linked ?? [];
-  const emailRows = linked.filter((i) => i.kind === "email");
-  const btcRows = linked.filter((i) => i.kind === "btc");
-  const hasEmail = emailRows.some((i) => i.value);
-  const hasBtc = btcRows.some((i) => i.value);
-  const mergedFrom = resp.merged_from ?? [];
-  return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: { display: "grid", gap: 16 }, children: [
-    /* @__PURE__ */ jsxs("div", { style: panelStyle(), children: [
-      /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 what this is" }),
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "These are the ways you can sign in to this account. An app you sign in to sees one only if you grant it. Linking a second one is also your way back in: lose one, and the other still signs you in." })
-    ] }),
-    mergedFrom.length > 0 && /* @__PURE__ */ jsx(ConsolidationPanel, { entries: mergedFrom }),
-    /* @__PURE__ */ jsxs("div", { style: panelStyle("plain"), "data-oc-li-rows": "", children: [
-      /* @__PURE__ */ jsx(
-        IdentityGroup,
-        {
-          kind: "email",
-          title: "email",
-          rows: emailRows,
-          authOrigin,
-          onChange: afterChange,
-          addCta: hasEmail ? null : "link an email",
-          onAdd: () => {
-            setShowEmailLink((v) => !v);
-            setShowBtcLink(false);
-          }
-        }
-      ),
-      /* @__PURE__ */ jsx("div", { style: { borderTop: `1px solid ${V.border}` } }),
-      /* @__PURE__ */ jsx(
-        IdentityGroup,
-        {
-          kind: "btc",
-          title: "bitcoin address",
-          rows: btcRows,
-          authOrigin,
-          onChange: afterChange,
-          addCta: hasBtc ? null : "link a Bitcoin address",
-          onAdd: () => {
-            setShowBtcLink((v) => !v);
-            setShowEmailLink(false);
-          }
-        }
-      )
-    ] }),
-    showEmailLink && /* @__PURE__ */ jsx(
-      EmailLinkForm,
-      {
-        authOrigin,
-        onDone: afterChange,
-        onCancel: () => setShowEmailLink(false)
-      }
-    ),
-    showBtcLink && /* @__PURE__ */ jsx(
-      BtcLinkForm,
-      {
-        authOrigin,
-        didOc: resp.did_oc ?? null,
-        onDone: afterChange,
-        onCancel: () => setShowBtcLink(false)
-      }
-    ),
-    hasBtc && attestationLink && /* @__PURE__ */ jsx(AttestationLink, {})
-  ] });
-}
-function IdentityGroup({
-  kind,
-  title,
-  rows,
-  authOrigin,
-  onChange,
-  addCta,
-  onAdd
-}) {
-  if (rows.length === 0) {
-    return /* @__PURE__ */ jsxs("div", { style: rowStyle, children: [
-      /* @__PURE__ */ jsxs("div", { children: [
-        /* @__PURE__ */ jsxs("div", { style: rowLabelStyle, children: [
-          "\xA7 ",
-          title
-        ] }),
-        /* @__PURE__ */ jsx("div", { style: { ...bodyStyle, marginTop: 4 }, children: "none linked" })
-      ] }),
-      addCta && /* @__PURE__ */ jsxs("button", { type: "button", onClick: onAdd, style: primaryChipStyle, children: [
-        "+ ",
-        addCta
-      ] })
-    ] });
-  }
-  return /* @__PURE__ */ jsx(Fragment, { children: rows.map((r) => /* @__PURE__ */ jsx(
-    IdentityRow,
-    {
-      row: r,
-      kind,
-      authOrigin,
-      onChange
-    },
-    r.id
-  )) });
-}
-function IdentityRow({
-  row,
-  kind,
-  authOrigin,
-  onChange
-}) {
-  const [shown, setShown] = React4.useState(false);
-  const [confirming, setConfirming] = React4.useState(false);
-  const [busy, setBusy] = React4.useState(false);
-  const [err, setErr] = React4.useState(null);
-  const masked = row.value ? mask(row.value, kind) : "\u2014 pending recovery \u2014";
-  const display = shown && row.value ? row.value : masked;
-  async function unlink() {
-    if (row.is_primary) return;
-    setBusy(true);
-    setErr(null);
-    try {
-      const r = await fetch(
-        `${authOrigin}/api/auth/identities?id=${encodeURIComponent(row.id)}`,
-        { method: "DELETE", credentials: "include" }
-      );
-      if (!r.ok) {
-        const j = await r.json().catch(() => ({}));
-        throw new Error(j.reason ?? `http_${r.status}`);
-      }
-      onChange();
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "unlink failed");
-      setBusy(false);
-      setConfirming(false);
-    }
-  }
-  return /* @__PURE__ */ jsxs("div", { style: rowStyle, "data-oc-li-row": kind, children: [
-    /* @__PURE__ */ jsxs("div", { style: { minWidth: 0, flex: 1 }, children: [
-      /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexWrap: "wrap", gap: "4px 12px" }, children: [
-        /* @__PURE__ */ jsxs("span", { style: rowLabelStyle, children: [
-          "\xA7 ",
-          kind === "email" ? "email" : "bitcoin address"
-        ] }),
-        row.is_primary && /* @__PURE__ */ jsx("span", { style: { ...rowLabelStyle, color: V.primary }, children: "primary \xB7 signup-time" })
-      ] }),
-      /* @__PURE__ */ jsx(
-        "div",
-        {
-          style: {
-            marginTop: 4,
-            color: V.foreground,
-            fontFamily: SIGNIN_FONT,
-            fontSize: signinSize(12),
-            wordBreak: "break-all"
-          },
-          children: display
-        }
-      ),
-      row.verified_at && /* @__PURE__ */ jsxs("div", { style: { ...hintStyle, marginTop: 4 }, children: [
-        "verified \xB7 ",
-        new Date(row.verified_at).toUTCString()
-      ] }),
-      err && /* @__PURE__ */ jsx(ErrorLine, { children: err })
-    ] }),
-    /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexShrink: 0, gap: 8, flexWrap: "wrap" }, children: [
-      row.value && /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => setShown((s) => !s),
-          style: ghostBtnStyle(false),
-          children: shown ? "hide" : "show"
-        }
-      ),
-      !row.is_primary && !confirming && /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => setConfirming(true),
-          style: dangerBtnStyle(false),
-          children: "unlink"
-        }
-      ),
-      !row.is_primary && confirming && /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => void unlink(),
-            disabled: busy,
-            style: dangerBtnStyle(busy),
-            children: busy ? "unlinking\u2026" : "confirm unlink"
-          }
-        ),
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => setConfirming(false),
-            disabled: busy,
-            style: ghostBtnStyle(busy),
-            children: "cancel"
-          }
-        )
-      ] })
-    ] })
-  ] });
-}
-function ConsolidationPanel({ entries }) {
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle("success"), "data-oc-li-consolidated": "", children: [
-    /* @__PURE__ */ jsxs(SectionLabel, { tone: "success", children: [
-      "\xA7 consolidated accounts \xB7 ",
-      entries.length
-    ] }),
-    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-      entries.length === 1 ? "A previous OC account" : "Previous OC accounts",
-      " you signed up with, folded into this one under dual proof of control. Historical activity is unioned into this account automatically;",
-      " ",
-      entries.length === 1 ? "it" : "they",
-      " can no longer sign in."
-    ] }),
-    /* @__PURE__ */ jsx("ul", { style: { listStyle: "none", margin: "12px 0 0", padding: 0 }, children: entries.map((e) => /* @__PURE__ */ jsxs(
-      "li",
-      {
-        style: {
-          display: "flex",
-          flexWrap: "wrap",
-          gap: 8,
-          padding: "8px 0",
-          borderTop: `1px solid ${V.border}`,
-          fontFamily: SIGNIN_FONT,
-          fontSize: signinSize(11)
-        },
-        children: [
-          /* @__PURE__ */ jsx("code", { style: { color: V.foreground, wordBreak: "break-all" }, children: e.did_oc }),
-          /* @__PURE__ */ jsxs("span", { style: { ...hintStyle, marginLeft: "auto" }, children: [
-            "created ",
-            new Date(e.created_at).toLocaleDateString()
-          ] })
-        ]
-      },
-      e.did_oc
-    )) })
-  ] });
-}
-function AttestationLink() {
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle(), "data-oc-li-attest": "", children: [
-    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 portable attestation" }),
-    /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "Make your identity links portable: publish a standard OrangeCheck attestation \u2014 one Bitcoin-wallet signature (BIP-322) binding your address to your handles (Nostr, GitHub, \u2026). It is published to Nostr and verifies with zero trust in OrangeCheck, so it outlives any single service." }),
-    /* @__PURE__ */ jsx(
-      "a",
-      {
-        href: "https://attest.ochk.io/create",
-        target: "_blank",
-        rel: "noreferrer",
-        style: { ...primaryChipStyle, textDecoration: "none", display: "inline-block" },
-        "data-oc-li-attest-link": "",
-        children: "open the attestation builder \u2197"
-      }
-    )
-  ] });
-}
-var ACCOUNT_WAYS_URL = "https://ochk.app/me/account#ways";
-function LinkPromptStep({
-  method,
-  didOc,
-  authOrigin,
-  onResolved
-}) {
-  const what = method === "btc" ? "a Bitcoin address" : "an email";
-  return /* @__PURE__ */ jsxs("div", { "data-oc-linkprompt": method, children: [
-    /* @__PURE__ */ jsxs("div", { style: { ...panelStyle("success"), marginBottom: 16 }, children: [
-      /* @__PURE__ */ jsx(SectionLabel, { tone: "success", children: "\xA7 signed in" }),
-      /* @__PURE__ */ jsxs("p", { style: { ...bodyStyle, margin: 0 }, children: [
-        "You chose to also link ",
-        what,
-        ". Complete it below \u2014 or skip for now; it is entirely optional and changes nothing about the sign-in you just completed."
-      ] })
-    ] }),
-    method === "btc" ? /* @__PURE__ */ jsx(
-      BtcLinkForm,
-      {
-        authOrigin,
-        didOc,
-        onDone: onResolved,
-        onCancel: onResolved
-      }
-    ) : /* @__PURE__ */ jsx(EmailLinkForm, { authOrigin, onDone: onResolved, onCancel: onResolved }),
-    /* @__PURE__ */ jsxs(
-      "div",
-      {
-        "data-oc-linkprompt-skip": "",
-        style: { marginTop: 14, paddingTop: 14, borderTop: `1px solid ${V.border}` },
-        children: [
-          /* @__PURE__ */ jsx("button", { type: "button", onClick: onResolved, style: ghostBtnStyle(false), children: "skip \u2014 I'll do this later" }),
-          /* @__PURE__ */ jsxs("p", { style: { ...hintStyle, marginTop: 8 }, children: [
-            "Changed your mind? Skipping continues you straight on \u2014 your sign-in is unaffected. You can link ",
-            what,
-            " anytime later from your account page,",
-            " ",
-            /* @__PURE__ */ jsx(
-              "a",
-              {
-                href: ACCOUNT_WAYS_URL,
-                target: "_blank",
-                rel: "noreferrer",
-                style: { color: "inherit" },
-                "data-oc-linkprompt-account": "",
-                children: "ochk.app/me/account"
-              }
-            ),
-            "."
-          ] })
-        ]
-      }
-    )
-  ] });
-}
-function EmailLinkForm({
-  authOrigin,
-  onDone,
-  onCancel
-}) {
-  const [step, setStep] = React4.useState("email");
-  const [email, setEmail] = React4.useState("");
-  const [code, setCode] = React4.useState("");
-  const [token, setToken] = React4.useState("");
-  const [busy, setBusy] = React4.useState(false);
-  const [err, setErr] = React4.useState(null);
-  const [transfer, setTransfer] = React4.useState(false);
-  async function start() {
-    setBusy(true);
-    setErr(null);
-    try {
-      const r = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: email.trim().toLowerCase() })
-      });
-      const j = await r.json();
-      if (!r.ok || !j.token) throw new Error(j.reason ?? `http_${r.status}`);
-      setToken(j.token);
-      setStep("code");
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "could not send code");
-    } finally {
-      setBusy(false);
-    }
-  }
-  async function verify(confirmTransfer) {
-    setBusy(true);
-    setErr(null);
-    try {
-      const r = await fetch(`${authOrigin}/api/auth/link/email`, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          email: email.trim().toLowerCase(),
-          code: code.trim(),
-          token,
-          ...confirmTransfer ? { confirm_transfer: true } : {}
-        })
-      });
-      const j = await r.json();
-      if (r.status === 409 && j.reason === "email_linked_elsewhere") {
-        setTransfer(true);
-        setBusy(false);
-        return;
-      }
-      if (handleSudoRequired(j, { purpose: "link an email" })) return;
-      if (isSudoAccountMismatch(j)) {
-        setErr(SUDO_ACCOUNT_MISMATCH_MESSAGE);
-        setBusy(false);
-        return;
-      }
-      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
-      onDone();
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "link failed");
-      setBusy(false);
-    }
-  }
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "email", children: [
-    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link an email" }),
-    step === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          type: "email",
-          autoComplete: "email",
-          value: email,
-          onChange: (e) => setEmail(e.target.value),
-          placeholder: "you@example.com",
-          style: inputStyle
-        }
-      ),
-      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => void start(),
-            disabled: busy || email.trim().length < 5,
-            style: primaryBtnStyle(busy || email.trim().length < 5),
-            children: busy ? "sending\u2026" : "send code"
-          }
-        ),
-        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
-      ] })
-    ] }) : transfer ? /* @__PURE__ */ jsx(
-      TransferConfirm,
-      {
-        what: "email",
-        busy,
-        onConfirm: () => void verify(true),
-        onCancel,
-        err
-      }
-    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "Enter the 6-digit code sent to ",
-        email,
-        "."
-      ] }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          type: "text",
-          inputMode: "numeric",
-          autoComplete: "one-time-code",
-          maxLength: 6,
-          value: code,
-          onChange: (e) => setCode(e.target.value.replace(/\D/g, "").slice(0, 6)),
-          placeholder: "123456",
-          style: { ...inputStyle, letterSpacing: "0.3em" }
-        }
-      ),
-      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => void verify(false),
-            disabled: busy || code.length !== 6,
-            style: primaryBtnStyle(busy || code.length !== 6),
-            children: busy ? "linking\u2026" : "verify + link"
-          }
-        ),
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => setStep("email"),
-            disabled: busy,
-            style: ghostBtnStyle(busy),
-            children: "back"
-          }
-        )
-      ] })
-    ] })
-  ] });
-}
-function BtcLinkForm({
-  authOrigin,
-  didOc,
-  onDone,
-  onCancel
-}) {
-  const [step, setStep] = React4.useState("request");
-  const [addr, setAddr] = React4.useState("");
-  const [challenge, setChallenge] = React4.useState("");
-  const [busy, setBusy] = React4.useState(false);
-  const [err, setErr] = React4.useState(null);
-  const [pendingSig, setPendingSig] = React4.useState(null);
-  async function getChallenge() {
-    if (!didOc) {
-      setErr("session not loaded yet \xB7 refresh and retry");
-      return;
-    }
-    setBusy(true);
-    setErr(null);
-    try {
-      const r = await fetch(
-        `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&purpose=link&audience=${encodeURIComponent(didOc)}`
-      );
-      const j = await r.json();
-      if (!r.ok || !j.message) throw new Error(j.reason ?? `http_${r.status}`);
-      setChallenge(j.message);
-      setStep("sign");
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "challenge failed");
-    } finally {
-      setBusy(false);
-    }
-  }
-  async function postLink(sig, confirmTransfer) {
-    setBusy(true);
-    setErr(null);
-    try {
-      const r = await fetch(`${authOrigin}/api/auth/link/btc`, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          message: challenge,
-          signature: sig,
-          ...confirmTransfer ? { confirm_transfer: true } : {}
-        })
-      });
-      const j = await r.json();
-      if (r.status === 409 && j.reason === "address_linked_elsewhere") {
-        setPendingSig(sig);
-        setBusy(false);
-        return;
-      }
-      if (handleSudoRequired(j, { purpose: "link a Bitcoin address" })) return;
-      if (isSudoAccountMismatch(j)) {
-        setErr(SUDO_ACCOUNT_MISMATCH_MESSAGE);
-        setBusy(false);
-        return;
-      }
-      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
-      onDone();
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "link failed");
-      setBusy(false);
-    }
-  }
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "btc", children: [
-    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link a Bitcoin address" }),
-    step === "request" ? /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "Enter a Bitcoin address you control. We generate a challenge and your wallet signs it (BIP-322)." }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          type: "text",
-          value: addr,
-          onChange: (e) => setAddr(e.target.value.trim()),
-          placeholder: "bc1q\u2026",
-          autoCapitalize: "none",
-          spellCheck: false,
-          style: { ...inputStyle, fontFamily: SIGNIN_FONT }
-        }
-      ),
-      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            onClick: () => void getChallenge(),
-            disabled: busy || addr.length < 14,
-            style: primaryBtnStyle(busy || addr.length < 14),
-            children: busy ? "requesting\u2026" : "get challenge"
-          }
-        ),
-        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
-      ] })
-    ] }) : pendingSig ? /* @__PURE__ */ jsx(
-      TransferConfirm,
-      {
-        what: "bitcoin address",
-        busy,
-        onConfirm: () => void postLink(pendingSig, true),
-        onCancel,
-        err
-      }
-    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "Sign the challenge with the wallet that controls",
-        " ",
-        /* @__PURE__ */ jsx("span", { style: { fontFamily: SIGNIN_FONT, wordBreak: "break-all" }, children: addr }),
-        "."
-      ] }),
-      /* @__PURE__ */ jsx(
-        LazyWalletButton,
-        {
-          address: addr,
-          message: challenge,
-          showManual: true,
-          layout: "list",
-          heading: null,
-          onSigned: (sig) => void postLink(sig, false),
-          onError: (e) => setErr(e?.message ?? "wallet rejected")
-        }
-      ),
-      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
-      /* @__PURE__ */ jsx(FormButtons, { children: /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => {
-            setStep("request");
-            setErr(null);
-          },
-          disabled: busy,
-          style: ghostBtnStyle(busy),
-          children: "back"
-        }
-      ) })
-    ] })
-  ] });
-}
-function TransferConfirm({
-  what,
-  busy,
-  onConfirm,
-  onCancel,
-  err
-}) {
-  return /* @__PURE__ */ jsxs(Fragment, { children: [
-    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-      "This ",
-      what,
-      " is already linked to another OrangeCheck account. You've just proven control of it \u2014 you can transfer the link to this account under dual proof of control. The other account loses this sign-in path; its history stays verifiable. Continue?"
-    ] }),
-    err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
-    /* @__PURE__ */ jsxs(FormButtons, { children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: onConfirm,
-          disabled: busy,
-          style: dangerBtnStyle(busy),
-          children: busy ? "transferring\u2026" : "transfer link here"
-        }
-      ),
-      /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, disabled: busy, style: ghostBtnStyle(busy), children: "cancel" })
-    ] })
-  ] });
-}
-function LazyWalletButton(props) {
-  const [Comp, setComp] = React4.useState(null);
-  const [failed, setFailed] = React4.useState(false);
-  React4.useEffect(() => {
-    let alive = true;
-    import('@orangecheck/wallet-adapter/react').then((m) => {
-      if (alive) {
-        setComp(
-          () => m.OcWalletButton
-        );
-      }
-    }).catch(() => {
-      if (alive) setFailed(true);
-    });
-    return () => {
-      alive = false;
-    };
-  }, []);
-  if (failed) {
-    return /* @__PURE__ */ jsx(ErrorLine, { children: "could not load wallet support \xB7 refresh to try again" });
-  }
-  if (!Comp) return /* @__PURE__ */ jsx("span", { style: hintStyle, children: "loading wallet options\u2026" });
-  return /* @__PURE__ */ jsx(Comp, { ...props });
-}
-function mask(value, kind) {
-  if (kind === "email") {
-    const [user, host] = value.split("@");
-    if (!user || !host) return "\u2022\u2022\u2022\u2022";
-    const m = user.length <= 2 ? "\u2022".repeat(user.length) : user[0] + "\u2022".repeat(user.length - 2) + user.slice(-1);
-    return `${m}@${host}`;
-  }
-  if (value.length <= 12) return "\u2022".repeat(value.length);
-  return `${value.slice(0, 6)}\u2026${value.slice(-4)}`;
-}
-function SectionLabel({
-  children,
-  tone = "primary"
-}) {
-  const color = tone === "success" ? V.success : tone === "warn" ? V.warn : V.primary;
-  return /* @__PURE__ */ jsx(
-    "div",
-    {
-      style: {
-        color,
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinSize(10),
-        letterSpacing: signinTracking("0.18em"),
-        textTransform: SIGNIN_CASE,
-        marginBottom: 8
-      },
-      children
-    }
-  );
-}
-function ErrorLine({ children }) {
-  return /* @__PURE__ */ jsx(
-    "p",
-    {
-      role: "alert",
-      style: {
-        margin: "8px 0 0",
-        color: V.destructive,
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinSize(11)
-      },
-      children
-    }
-  );
-}
-function FormButtons({ children }) {
-  return /* @__PURE__ */ jsx("div", { style: { display: "flex", flexWrap: "wrap", gap: 8, marginTop: 12 }, children });
-}
-var V = {
-  primary: "var(--primary, #f97316)",
-  foreground: "var(--foreground, #fafafa)",
-  muted: "var(--muted-foreground, #a1a1aa)",
-  background: "var(--background, #0a0a0a)",
-  card: "var(--card, #111113)",
-  border: "var(--border, #27272a)",
-  destructive: "var(--destructive, #ef4444)",
-  success: "var(--success, #22c55e)",
-  warn: "var(--warning, #eab308)"
-};
-function panelStyle(tone = "default") {
-  const base = {
-    background: V.card,
-    border: `1px solid ${V.border}`,
-    padding: "1.25rem"
-  };
-  if (tone === "plain") return { ...base, padding: 0 };
-  if (tone === "accent") return { ...base, borderColor: V.primary, background: "var(--card, #111113)" };
-  if (tone === "success") return { ...base, borderColor: V.success };
-  if (tone === "warn") return { ...base, borderColor: V.warn };
-  return base;
-}
-var bodyStyle = {
-  color: V.muted,
-  fontSize: 13,
-  lineHeight: 1.55,
-  margin: "0 0 12px"
-};
-var hintStyle = {
-  color: V.muted,
-  fontFamily: SIGNIN_FONT,
-  fontSize: signinSize(10.5),
-  opacity: 0.8
-};
-var rowStyle = {
-  display: "flex",
-  flexWrap: "wrap",
-  alignItems: "center",
-  justifyContent: "space-between",
-  gap: 12,
-  padding: "1rem"
-};
-var rowLabelStyle = {
-  color: V.foreground,
-  fontFamily: SIGNIN_FONT,
-  fontSize: signinSize(10.5),
-  letterSpacing: signinTracking("0.12em"),
-  textTransform: SIGNIN_CASE,
-  opacity: 0.8
-};
-var inputStyle = {
-  width: "100%",
-  padding: "0.55rem 0.75rem",
-  background: V.background,
-  color: V.foreground,
-  border: `1px solid ${V.border}`,
-  borderRadius: signinRadius(6),
-  fontFamily: SIGNIN_FONT,
-  // 16px — never lower · suppresses iOS Safari focus auto-zoom.
-  fontSize: 16,
-  outline: "none",
-  boxSizing: "border-box"
-};
-function btnBase(disabled) {
-  return {
-    padding: "0.5rem 0.875rem",
-    borderRadius: SIGNIN_BUTTON_RADIUS,
-    fontFamily: SIGNIN_FONT,
-    fontSize: signinSize(10.5),
-    letterSpacing: signinTracking("0.12em"),
-    textTransform: SIGNIN_CASE,
-    cursor: disabled ? "not-allowed" : "pointer",
-    opacity: disabled ? 0.5 : 1
-  };
-}
-function primaryBtnStyle(disabled) {
-  return {
-    ...btnBase(disabled),
-    background: V.primary,
-    color: "var(--primary-foreground, #0a0a0a)",
-    border: `1px solid ${V.primary}`,
-    fontWeight: 600
-  };
-}
-function ghostBtnStyle(disabled) {
-  return {
-    ...btnBase(disabled),
-    background: V.background,
-    color: V.foreground,
-    border: `1px solid ${V.border}`
-  };
-}
-function dangerBtnStyle(disabled) {
-  return {
-    ...btnBase(disabled),
-    background: "transparent",
-    color: V.destructive,
-    border: `1px solid ${V.destructive}`
-  };
-}
-var primaryChipStyle = {
-  ...btnBase(false),
-  background: "transparent",
-  color: V.primary,
-  border: `1px solid ${V.primary}`
-};
-function isSameOriginPath(candidate, origin) {
-  try {
-    return new URL(candidate, origin).origin === origin;
-  } catch {
-    return false;
-  }
-}
-function resolutionOrigin() {
-  return typeof window === "undefined" ? "https://ochk.io" : window.location.origin;
-}
-function safeReturnTo(input) {
-  const candidate = input ?? "/";
-  if (typeof candidate !== "string") return "/";
-  if (!candidate.startsWith("/")) return "/";
-  return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : "/";
-}
-function familyReturnTarget(input) {
-  if (typeof input !== "string" || input.length === 0) return void 0;
-  if (input.startsWith("/") && isSameOriginPath(input, resolutionOrigin())) {
-    return input;
-  }
-  try {
-    const u = new URL(input);
-    if (u.protocol !== "https:") return void 0;
-    const host = u.hostname.toLowerCase();
-    if (host === "ochk.io" || host.endsWith(".ochk.io")) return u.toString();
-  } catch {
-  }
-  return void 0;
-}
-function hardNavigate(target) {
-  if (typeof window === "undefined") return;
-  window.location.assign(target);
-}
-var SIGNIN_ERRORS = {
-  bad_request: "That doesn't look like a Bitcoin address.",
-  invalid_challenge: "That signature doesn't match this address. Sign with the wallet that holds it.",
-  sig_invalid: "That signature doesn't match this address. Sign with the wallet that holds it.",
-  sig_unsupported_scheme: "We can't check this wallet's signature format yet. Try another wallet, or use email.",
-  expired: "That request timed out. Try again for a fresh one.",
-  not_yet_valid: "That request is not valid yet. Check your device clock, then try again.",
-  nonce_mismatch: "That request didn't match. Try again for a fresh one.",
-  audience_mismatch: "That request didn't match this site. Reload the page and try again.",
-  purpose_mismatch: "That request didn't match. Try again for a fresh one.",
-  malformed: "That signature couldn't be read. Copy it again, whole.",
-  cross_site_blocked: "Your browser blocked this request. Reload the page and try again.",
-  rate_limited: "Too many tries. Wait a minute, then try again.",
-  invalid_email: "That email address doesn't look right.",
-  mailer_unavailable: "We couldn't send the email right now. Try again in a minute.",
-  mailer_error: "We couldn't send the email right now. Try again in a minute.",
-  wrong_code: "That code isn't right. Check the newest email from us.",
-  replay: "That code was already used. Send a new one.",
-  invalid_token: "That code is no longer valid. Send a new one.",
-  email_mismatch: "That code was sent to a different address. Send a new one."
-};
-var EMAIL_ERRORS = {
-  expired: "That code expired. Send a new one."
-};
-var SUBMIT_ERRORS = {
-  bad_request: "That signature couldn't be read. Copy it again, whole."
-};
-var NETWORK_ERROR = "We couldn't reach the server. Check your connection and try again.";
-function humanSigninError(reason, path, step = "challenge") {
-  if (!/^[a-z0-9_]+$/.test(reason)) return reason;
-  if (path === "wallet" && step === "submit" && SUBMIT_ERRORS[reason]) return SUBMIT_ERRORS[reason];
-  if (path === "email" && EMAIL_ERRORS[reason]) return EMAIL_ERRORS[reason];
-  return SIGNIN_ERRORS[reason] ?? (path === "email" ? "That didn't work. Try again, or send a new code." : "That didn't work. Try again.");
-}
-function failureMessage(err, path, step) {
-  if (err instanceof TypeError || err instanceof SyntaxError) return NETWORK_ERROR;
-  return humanSigninError(err instanceof Error ? err.message : "failed", path, step);
-}
-var BECH32_ADDRESS = /^(bc1|tb1|bcrt1)[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{8,87}$/i;
-var BASE58_ADDRESS = /^[123mn][1-9A-HJ-NP-Za-km-z]{25,34}$/;
-function looksLikeBitcoinAddress(input) {
-  const s = input.trim();
-  return BECH32_ADDRESS.test(s) || BASE58_ADDRESS.test(s);
-}
-function OcSignIn({
-  audience,
-  returnTo,
-  onSuccess,
-  resolveReturnTo,
-  linkPrompt: linkPromptProp = true,
-  add: addProp,
-  authOrigin = "https://ochk.io",
-  initialPath,
-  providersFirst = true,
-  paths,
-  className,
-  mode,
-  providerHref
-}) {
-  const walletEnabled = paths?.wallet ?? true;
-  const emailEnabled = paths?.email ?? true;
-  const firstParty = mode === "first-party";
-  const credentials = firstParty ? "omit" : "include";
-  const linkPrompt = linkPromptProp && !firstParty;
-  const [resolvedReturn, setResolvedReturn] = React4.useState(
-    () => familyReturnTarget(returnTo) ?? safeReturnTo(returnTo)
-  );
-  React4.useEffect(() => {
-    const fromProp = familyReturnTarget(returnTo);
-    if (fromProp) {
-      setResolvedReturn(fromProp);
-      return;
-    }
-    if (typeof window === "undefined") return;
-    const q = new URLSearchParams(window.location.search);
-    const fromQuery = familyReturnTarget(q.get("return_to")) ?? familyReturnTarget(q.get("next"));
-    setResolvedReturn(fromQuery ?? "/");
-  }, [returnTo]);
-  const [addMode, setAddMode] = React4.useState(Boolean(addProp) && !firstParty);
-  React4.useEffect(() => {
-    if (typeof window === "undefined") return;
-    if (firstParty) {
-      setAddMode(false);
-      return;
-    }
-    if (addProp !== void 0) {
-      setAddMode(Boolean(addProp));
-      return;
-    }
-    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
-  }, [addProp, firstParty]);
-  const [path, setPath] = React4.useState(
-    initialPath ?? (providersFirst ? "email" : "wallet")
-  );
-  const [signedIn, setSignedIn] = React4.useState(null);
-  const [linkAlso, setLinkAlso] = React4.useState(false);
-  const [oauthError, setOauthError] = React4.useState(false);
-  React4.useEffect(() => {
-    if (typeof window === "undefined") return;
-    if (new URLSearchParams(window.location.search).has("oauth_error")) {
-      setOauthError(true);
-    }
-  }, []);
-  const navigate = React4.useCallback(
-    async (account) => {
-      if (resolveReturnTo) {
-        try {
-          const resolved = familyReturnTarget(await resolveReturnTo(account));
-          hardNavigate(resolved ?? resolvedReturn);
-          return;
-        } catch {
-        }
-      }
-      hardNavigate(resolvedReturn);
-    },
-    [resolveReturnTo, resolvedReturn]
-  );
-  const handleSuccess = React4.useCallback(
-    async (account, token, via) => {
-      const proceed = () => {
-        clearTabSession();
-        if (onSuccess) onSuccess(account, token);
-        else void navigate(account);
-      };
-      if (!linkPrompt || !linkAlso) {
-        proceed();
-        return;
-      }
-      try {
-        const meRes = await fetch(`${authOrigin}/api/auth/me`, {
-          credentials: "include",
-          headers: { Accept: "application/json" }
-        });
-        const me = meRes.ok ? await meRes.json() : null;
-        const didOc = me?.account?.did_oc;
-        if (didOc) {
-          setSignedIn({
-            method: via === "email" ? "btc" : "email",
-            didOc,
-            proceed
-          });
-          return;
-        }
-      } catch {
-      }
-      proceed();
-    },
-    [onSuccess, linkPrompt, linkAlso, navigate, authOrigin]
-  );
-  if (!walletEnabled && !emailEnabled) {
-    return /* @__PURE__ */ jsxs(
-      "div",
-      {
-        className,
-        "data-oc-signin": "",
-        style: {
-          padding: "1rem",
-          border: "1px solid var(--border, #27272a)",
-          color: "var(--foreground, #fafafa)",
-          fontFamily: SIGNIN_FONT,
-          fontSize: signinSize(12)
-        },
-        children: [
-          "no signin paths enabled \u2014 set ",
-          /* @__PURE__ */ jsx("code", { children: "paths.wallet" }),
-          " or",
-          " ",
-          /* @__PURE__ */ jsx("code", { children: "paths.email" }),
-          " to ",
-          /* @__PURE__ */ jsx("code", { children: "true" })
-        ]
-      }
-    );
-  }
-  if (signedIn) {
-    return /* @__PURE__ */ jsx("div", { className, "data-oc-signin": "", children: /* @__PURE__ */ jsx(
-      LinkPromptStep,
-      {
-        method: signedIn.method,
-        didOc: signedIn.didOc,
-        authOrigin,
-        onResolved: signedIn.proceed
-      }
-    ) });
-  }
-  const showWallet = walletEnabled && (path === "wallet" || !emailEnabled);
-  const showEmail = emailEnabled && (path === "email" || !walletEnabled);
-  const bothEnabled = walletEnabled && emailEnabled;
-  const activeMethod = !emailEnabled ? "wallet" : !walletEnabled ? "email" : path;
-  return /* @__PURE__ */ jsxs("div", { className, "data-oc-signin": "", children: [
-    oauthError && /* @__PURE__ */ jsx(
-      "div",
-      {
-        "data-oc-signin-oauth-error": "",
-        style: {
-          marginBottom: 14,
-          padding: "0.6rem 0.75rem",
-          border: "1px solid var(--destructive, #ef4444)",
-          borderRadius: signinRadius(6),
-          color: "var(--destructive, #ef4444)",
-          fontFamily: SIGNIN_FONT,
-          fontSize: signinRoleSize("text", signinSize(11))
-        },
-        children: "That sign-in didn't finish. Try again, or use another way below."
-      }
-    ),
-    addMode && /* @__PURE__ */ jsxs(
-      "div",
-      {
-        "data-oc-signin-add-mode": "",
-        style: {
-          marginBottom: 14,
-          padding: "0.6rem 0.75rem",
-          border: "1px solid var(--primary, #f97316)",
-          borderLeftWidth: 3,
-          borderRadius: signinRadius(4),
-          background: "color-mix(in srgb, var(--primary, #f97316) 8%, transparent)",
-          color: "var(--foreground, #fafafa)",
-          fontFamily: SIGNIN_FONT,
-          fontSize: signinRoleSize("text", signinSize(11)),
-          lineHeight: 1.6
-        },
-        children: [
-          /* @__PURE__ */ jsx(
-            "strong",
-            {
-              style: {
-                color: "var(--primary, #f97316)",
-                letterSpacing: signinTracking("0.12em"),
-                textTransform: SIGNIN_CASE,
-                fontSize: signinSize(10),
-                display: "block",
-                marginBottom: 3
-              },
-              children: "\xA7 adding another account"
-            }
-          ),
-          "Your current OrangeCheck account stays signed in. The new account joins your browser's roster; you can switch between them anytime from the account menu."
-        ]
-      }
-    ),
-    providersFirst && /* @__PURE__ */ jsx(
-      ProviderSignIn,
-      {
-        authOrigin,
-        returnTo: resolvedReturn,
-        add: addMode,
-        credentials,
-        firstParty,
-        providerHref,
-        first: true
-      }
-    ),
-    bothEnabled && /* @__PURE__ */ jsx(
-      "div",
-      {
-        role: "tablist",
-        "aria-label": "signin method",
-        "data-oc-signin-tabs": "",
-        style: {
-          display: "flex",
-          gap: 8,
-          marginBottom: 16,
-          borderBottom: "1px solid var(--border, #27272a)"
-        },
-        children: providersFirst ? /* @__PURE__ */ jsxs(Fragment, { children: [
-          /* @__PURE__ */ jsx(
-            SigninTab,
-            {
-              active: path === "email",
-              onClick: () => setPath("email"),
-              children: "Email"
-            }
-          ),
-          /* @__PURE__ */ jsx(
-            SigninTab,
-            {
-              active: path === "wallet",
-              onClick: () => setPath("wallet"),
-              children: "Bitcoin wallet"
-            }
-          )
-        ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-          /* @__PURE__ */ jsx(
-            SigninTab,
-            {
-              active: path === "wallet",
-              onClick: () => setPath("wallet"),
-              children: "Bitcoin wallet"
-            }
-          ),
-          /* @__PURE__ */ jsx(
-            SigninTab,
-            {
-              active: path === "email",
-              onClick: () => setPath("email"),
-              children: "Email"
-            }
-          )
-        ] })
-      }
-    ),
-    /* @__PURE__ */ jsxs("div", { "data-oc-signin-panel": "", role: "tabpanel", children: [
-      showWallet && /* @__PURE__ */ jsx(
-        WalletFlow,
-        {
-          authOrigin,
-          audience,
-          add: addMode,
-          credentials,
-          onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
-        }
-      ),
-      showEmail && /* @__PURE__ */ jsx(
-        EmailFlow,
-        {
-          authOrigin,
-          add: addMode,
-          credentials,
-          onSuccess: (a, t) => void handleSuccess(a, t, "email")
-        }
-      )
-    ] }),
-    !providersFirst && /* @__PURE__ */ jsx(
-      ProviderSignIn,
-      {
-        authOrigin,
-        returnTo: resolvedReturn,
-        add: addMode,
-        credentials,
-        firstParty,
-        providerHref
-      }
-    ),
-    linkPrompt && /* @__PURE__ */ jsxs("label", { "data-oc-signin-linkalso": "", style: linkAlsoStyle, children: [
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          type: "checkbox",
-          checked: linkAlso,
-          onChange: (e) => setLinkAlso(e.target.checked),
-          style: { margin: 0, accentColor: "var(--primary, #f97316)" }
-        }
-      ),
-      /* @__PURE__ */ jsxs("span", { children: [
-        "After signing in, also link",
-        " ",
-        activeMethod === "email" ? "a Bitcoin wallet" : "an email",
-        " ",
-        /* @__PURE__ */ jsx("span", { children: "\u2014 optional, one more signature." })
-      ] })
-    ] })
-  ] });
-}
-function SigninTab({
-  active,
-  onClick,
-  children
-}) {
-  return /* @__PURE__ */ jsx(
-    "button",
-    {
-      type: "button",
-      role: "tab",
-      "aria-selected": active,
-      onClick,
-      "data-oc-signin-tab": active ? "active" : "inactive",
-      style: {
-        minHeight: 44,
-        padding: "0.6rem 0.875rem",
-        background: "transparent",
-        border: "none",
-        borderBottom: active ? "2px solid var(--primary, #f97316)" : "2px solid transparent",
-        color: active ? "var(--foreground, #fafafa)" : "var(--muted-foreground, #a1a1aa)",
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinRoleSize("label", signinSize(11)),
-        letterSpacing: signinTracking("0.12em"),
-        textTransform: SIGNIN_CASE,
-        cursor: "pointer",
-        marginBottom: -1
-      },
-      children
-    }
-  );
-}
-function ProviderIcon({ id }) {
-  const common = {
-    width: 14,
-    height: 14,
-    viewBox: "0 0 24 24",
-    fill: "currentColor",
-    "aria-hidden": true,
-    style: { flex: "0 0 auto" }
-  };
-  if (id === "google") {
-    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z" }) });
-  }
-  if (id === "github") {
-    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12" }) });
-  }
-  return null;
-}
-function ProviderSignIn({
-  authOrigin,
-  returnTo,
-  add,
-  credentials,
-  firstParty,
-  providerHref,
-  first = false
-}) {
-  const [providers, setProviders] = React4.useState(null);
-  const [origin, setOrigin] = React4.useState("");
-  const hidden = firstParty && !providerHref;
-  React4.useEffect(() => {
-    setOrigin(window.location.origin);
-    if (hidden) return;
-    let cancelled = false;
-    fetch(`${authOrigin}/api/auth/providers`, { credentials }).then((r) => r.ok ? r.json() : null).then((body) => {
-      if (!cancelled) setProviders(body?.providers ?? []);
-    }).catch(() => {
-      if (!cancelled) setProviders([]);
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [authOrigin, credentials, hidden]);
-  if (hidden) return null;
-  if (providers !== null && providers.length === 0) return null;
-  const providerReturnTo = stripFragment(
-    returnTo.startsWith("/") ? origin ? `${origin}${returnTo}` : returnTo : returnTo
-  );
-  const line = { flex: 1, height: 1, background: "var(--border, #27272a)" };
-  const BLOCK_GAP = 16;
-  const BUTTON_GAP = 8;
-  const divider = /* @__PURE__ */ jsxs(
-    "div",
-    {
-      style: {
-        display: "flex",
-        alignItems: "center",
-        gap: 10,
-        // Symmetric in both orderings: in `first` mode the divider
-        // owns the gap on both sides; at the bottom the container's
-        // marginTop owns the gap above, so the divider only pads below.
-        margin: first ? `${BLOCK_GAP}px 0` : `0 0 ${BLOCK_GAP}px`,
-        color: "var(--muted-foreground, #a1a1aa)",
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinRoleSize("hint", signinSize(10)),
-        letterSpacing: signinTracking("0.16em"),
-        textTransform: SIGNIN_CASE
-      },
-      children: [
-        /* @__PURE__ */ jsx("span", { style: line }),
-        "or",
-        /* @__PURE__ */ jsx("span", { style: line })
-      ]
-    }
-  );
-  const buttonStyle = (i) => ({
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    gap: 10,
-    boxSizing: "border-box",
-    width: "100%",
-    minHeight: 44,
-    marginTop: i === 0 ? 0 : BUTTON_GAP,
-    padding: "0.6rem 0.875rem",
-    border: "1px solid var(--border, #27272a)",
-    borderRadius: SIGNIN_BUTTON_RADIUS,
-    background: "transparent",
-    color: "var(--muted-foreground, #a1a1aa)",
-    fontFamily: SIGNIN_FONT,
-    fontSize: signinSize(12),
-    textDecoration: "none"
-  });
-  if (providers === null) {
-    if (!first) return null;
-    return /* @__PURE__ */ jsxs("div", { "data-oc-signin-providers": "", "aria-hidden": "true", children: [
-      [0, 1].map((i) => /* @__PURE__ */ jsx("div", { style: { ...buttonStyle(i), visibility: "hidden" }, children: "\xA0" }, i)),
-      divider
-    ] });
-  }
-  const buttons = providers.map((p, i) => /* @__PURE__ */ jsxs(
-    "a",
-    {
-      href: providerHref ? providerHref(p.id) : `${authOrigin}/api/auth/${p.id}/start?return_to=${encodeURIComponent(
-        providerReturnTo
-      )}${add ? "&add=1" : ""}`,
-      "data-oc-signin-provider": p.id,
-      style: buttonStyle(i),
-      children: [
-        /* @__PURE__ */ jsx(ProviderIcon, { id: p.id }),
-        /* @__PURE__ */ jsx("span", { children: p.label })
-      ]
-    },
-    p.id
-  ));
-  return /* @__PURE__ */ jsx(
-    "div",
-    {
-      "data-oc-signin-providers": "",
-      style: first ? { marginBottom: 0 } : { marginTop: BLOCK_GAP },
-      children: first ? /* @__PURE__ */ jsxs(Fragment, { children: [
-        buttons,
-        divider
-      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-        divider,
-        buttons
-      ] })
-    }
-  );
-}
-async function loadAdapter() {
-  return await import('@orangecheck/wallet-adapter');
-}
-async function detectBrowserWallets() {
-  return (await loadAdapter()).detectWallets().filter((w) => w.detected && w.id !== "manual").map((w) => ({ id: w.id, name: w.name }));
-}
-function WalletFlow({
-  authOrigin,
-  audience,
-  add,
-  credentials,
-  onSuccess
-}) {
-  const uid = React4.useId();
-  const ids = {
-    address: `${uid}-address`,
-    wallet: `${uid}-wallet`,
-    message: `${uid}-message`,
-    signature: `${uid}-signature`
-  };
-  const [address, setAddress] = React4.useState("");
-  const [error, setError] = React4.useState(null);
-  const [submitting, setSubmitting] = React4.useState(false);
-  const [wallets, setWallets] = React4.useState(null);
-  const [walletId, setWalletId] = React4.useState(null);
-  const [manual, setManual] = React4.useState(null);
-  const [pasted, setPasted] = React4.useState("");
-  const [copied, setCopied] = React4.useState("idle");
-  React4.useEffect(() => {
-    let cancelled = false;
-    detectBrowserWallets().then((found) => {
-      if (cancelled) return;
-      setWallets(found);
-      setWalletId(found[0]?.id ?? null);
-    }).catch(() => {
-      if (!cancelled) setWallets([]);
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, []);
-  async function fetchChallenge(addr) {
-    const res = await fetch(
-      `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&audience=${encodeURIComponent(audience)}&purpose=login`
-    );
-    const json = await res.json();
-    if (!res.ok || !json.message || !json.nonce) {
-      throw new Error(json.error ?? "challenge_failed");
-    }
-    return { message: json.message, nonce: json.nonce };
-  }
-  async function submitSignature(message, nonce, signature, scheme) {
-    const res = await fetch(`${authOrigin}/api/auth/signin`, {
-      method: "POST",
-      credentials,
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        message,
-        signature,
-        ...scheme ? { scheme } : {},
-        expectedNonce: nonce,
-        expectedAudience: audience,
-        expectedPurpose: "login",
-        // Multi-account add-mode · the auth host preserves the current
-        // roster_id when set, instead of minting a fresh one.
-        ...add ? { add: true } : {}
-      })
-    });
-    const json = await res.json();
-    if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
-      throw new Error(
-        "reason" in json && json.reason || "error" in json && json.error || "verify_failed"
-      );
-    }
-    onSuccess(json.account, json.token);
-  }
-  async function signIn(e) {
-    e.preventDefault();
-    const addr = address.trim();
-    if (!addr) {
-      setError("Paste your Bitcoin address.");
-      return;
-    }
-    if (!looksLikeBitcoinAddress(addr)) {
-      setError(humanSigninError("bad_request", "wallet"));
-      return;
-    }
-    setError(null);
-    setSubmitting(true);
-    let step = "challenge";
-    try {
-      let id = walletId;
-      if (wallets === null) {
-        const found = await detectBrowserWallets().catch(() => []);
-        setWallets(found);
-        id = found[0]?.id ?? null;
-        setWalletId(id);
-      }
-      const challenge = await fetchChallenge(addr);
-      if (!id) {
-        setManual(challenge);
-        setSubmitting(false);
-        return;
-      }
-      const signer = (await loadAdapter()).getSigner(id, { address: addr });
-      const signature = await signer(challenge.message);
-      step = "submit";
-      await submitSignature(challenge.message, challenge.nonce, signature, "bip322");
-    } catch (err) {
-      setError(failureMessage(err, "wallet", step));
-      setSubmitting(false);
-    }
-  }
-  async function signInManual(e) {
-    e.preventDefault();
-    if (!manual) return;
-    const sig = pasted.trim();
-    if (!sig) {
-      setError("Paste the signature your wallet gave you.");
-      return;
-    }
-    setError(null);
-    setSubmitting(true);
-    try {
-      await submitSignature(manual.message, manual.nonce, sig, void 0);
-    } catch (err) {
-      setError(failureMessage(err, "wallet", "submit"));
-      setSubmitting(false);
-    }
-  }
-  async function copyMessage() {
-    if (!manual) return;
-    try {
-      await navigator.clipboard.writeText(manual.message);
-      setCopied("copied");
-    } catch {
-      setCopied("failed");
-    }
-  }
-  if (manual) {
-    return /* @__PURE__ */ jsxs("form", { onSubmit: signInManual, "data-oc-signin-wallet-manual": "", children: [
-      /* @__PURE__ */ jsxs(FlowHeader, { children: [
-        "In your wallet, use \u201Csign message\u201D (BIP-322) with ",
-        address.trim(),
-        ", sign the text below, and paste the signature back here. Nothing is spent."
-      ] }),
-      /* @__PURE__ */ jsx(Label, { htmlFor: ids.message, children: "Message to sign" }),
-      /* @__PURE__ */ jsx(
-        "textarea",
-        {
-          id: ids.message,
-          readOnly: true,
-          value: manual.message,
-          rows: 5,
-          onFocus: (e) => e.currentTarget.select(),
-          style: { ...inputStyle2, resize: "vertical" }
-        }
-      ),
-      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => void copyMessage(), style: linkButtonStyle, children: copied === "copied" ? "Copied" : "Copy message" }),
-      copied === "failed" && /* @__PURE__ */ jsx(Hint, { children: "Couldn't copy here. Select the text above and copy it." }),
-      /* @__PURE__ */ jsxs("div", { style: { marginTop: 14 }, children: [
-        /* @__PURE__ */ jsx(Label, { htmlFor: ids.signature, children: "Signature" }),
-        /* @__PURE__ */ jsx(
-          "textarea",
-          {
-            id: ids.signature,
-            value: pasted,
-            onChange: (e) => {
-              setPasted(e.target.value);
-              if (error) setError(null);
-            },
-            rows: 3,
-            placeholder: "paste the signature",
-            spellCheck: false,
-            autoFocus: true,
-            "aria-invalid": error ? true : void 0,
-            style: { ...inputStyle2, resize: "vertical" }
-          }
-        )
-      ] }),
-      error && /* @__PURE__ */ jsx(ErrorLine2, { children: error }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "submit",
-          disabled: submitting || !pasted.trim(),
-          style: submitStyle(submitting || !pasted.trim()),
-          children: submitting ? "Checking\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Sign me in" })
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => {
-            setManual(null);
-            setPasted("");
-            setError(null);
-            setCopied("idle");
-          },
-          style: linkButtonStyle,
-          children: "Use a different address"
-        }
-      )
-    ] });
-  }
-  const noBrowserWallet = wallets !== null && wallets.length === 0;
-  return /* @__PURE__ */ jsxs("form", { onSubmit: signIn, "data-oc-signin-wallet": "", children: [
-    /* @__PURE__ */ jsx(FlowHeader, { children: "Your wallet signs a short message to prove you hold the address. Nothing is spent and your key never leaves the wallet. Works with browser wallets, or any wallet that can sign a message, like Sparrow." }),
-    /* @__PURE__ */ jsx(Label, { htmlFor: ids.address, children: "Bitcoin address" }),
-    /* @__PURE__ */ jsx(
-      "input",
-      {
-        id: ids.address,
-        type: "text",
-        value: address,
-        onChange: (e) => {
-          setAddress(e.target.value);
-          if (error) setError(null);
-        },
-        placeholder: "bc1q\u2026 \xB7 3\u2026 \xB7 1\u2026",
-        autoComplete: "off",
-        autoCapitalize: "none",
-        spellCheck: false,
-        required: true,
-        "aria-invalid": error ? true : void 0,
-        style: inputStyle2
-      }
-    ),
-    wallets && wallets.length > 1 && /* @__PURE__ */ jsxs("div", { style: { marginTop: 12 }, children: [
-      /* @__PURE__ */ jsx(Label, { htmlFor: ids.wallet, children: "Sign with" }),
-      /* @__PURE__ */ jsx(
-        "select",
-        {
-          id: ids.wallet,
-          value: walletId ?? "",
-          onChange: (e) => setWalletId(e.target.value),
-          style: inputStyle2,
-          children: wallets.map((w) => /* @__PURE__ */ jsx("option", { value: w.id, children: w.name }, w.id))
-        }
-      )
-    ] }),
-    error && /* @__PURE__ */ jsx(ErrorLine2, { children: error }),
-    /* @__PURE__ */ jsx(
-      "button",
-      {
-        type: "submit",
-        disabled: submitting || !address.trim(),
-        style: submitStyle(submitting || !address.trim()),
-        children: submitting ? "Waiting for wallet\u2026" : noBrowserWallet ? /* @__PURE__ */ jsx(Submit, { children: "Get the message to sign" }) : /* @__PURE__ */ jsx(Submit, { children: "Sign in with wallet" })
-      }
-    ),
-    noBrowserWallet && /* @__PURE__ */ jsx(Hint, { children: "No browser wallet found here. You can sign with any wallet and paste." })
-  ] });
-}
-function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
-  const uid = React4.useId();
-  const [stage, setStage] = React4.useState("enter");
-  const [email, setEmail] = React4.useState("");
-  const [emailError, setEmailError] = React4.useState(null);
-  const [code, setCode] = React4.useState("");
-  const [codeError, setCodeError] = React4.useState(null);
-  const [token, setToken] = React4.useState(null);
-  const [submitting, setSubmitting] = React4.useState(false);
-  const [resent, setResent] = React4.useState(false);
-  async function sendCode(address) {
-    try {
-      const res = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
-        method: "POST",
-        credentials,
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: address })
-      });
-      const json = await res.json();
-      if (!res.ok || !json.token) return humanSigninError(json.reason ?? "server_error", "email");
-      setToken(json.token);
-      return null;
-    } catch {
-      return NETWORK_ERROR;
-    }
-  }
-  async function start(e) {
-    e.preventDefault();
-    const trimmed = email.trim().toLowerCase();
-    if (!trimmed || !/.+@.+\..+/.test(trimmed)) {
-      setEmailError(humanSigninError("invalid_email", "email"));
-      return;
-    }
-    setEmailError(null);
-    setSubmitting(true);
-    const err = await sendCode(trimmed);
-    setSubmitting(false);
-    if (err) {
-      setEmailError(err);
-      return;
-    }
-    setEmail(trimmed);
-    setStage("code");
-  }
-  async function resend() {
-    setCodeError(null);
-    setResent(false);
-    setSubmitting(true);
-    const err = await sendCode(email);
-    setSubmitting(false);
-    setCode("");
-    if (err) setCodeError(err);
-    else setResent(true);
-  }
-  async function verify(e) {
-    e.preventDefault();
-    if (!token) return;
-    if (code.length !== 6) {
-      setCodeError("The code is 6 digits.");
-      return;
-    }
-    setCodeError(null);
-    setSubmitting(true);
-    try {
-      const res = await fetch(`${authOrigin}/api/auth/email-otp/verify`, {
-        method: "POST",
-        credentials,
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          email,
-          code,
-          token,
-          // Multi-account add-mode · see WalletFlow.
-          ...add ? { add: true } : {}
-        })
-      });
-      const json = await res.json();
-      if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
-        throw new Error(
-          "reason" in json && json.reason || "error" in json && json.error || "server_error"
-        );
-      }
-      onSuccess(json.account, json.token);
-    } catch (err) {
-      setCodeError(failureMessage(err, "email", "submit"));
-    } finally {
-      setSubmitting(false);
-    }
-  }
-  if (stage === "enter") {
-    return /* @__PURE__ */ jsxs("form", { onSubmit: start, "data-oc-signin-email": "", children: [
-      /* @__PURE__ */ jsx(FlowHeader, { children: "We email you a 6-digit code. No password, and no wallet needed to start. Add a Bitcoin address any time: a way in that only you hold." }),
-      /* @__PURE__ */ jsx(Label, { htmlFor: `${uid}-email`, children: "Email" }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          id: `${uid}-email`,
-          type: "email",
-          autoComplete: "email",
-          value: email,
-          onChange: (e) => {
-            setEmail(e.target.value);
-            if (emailError) setEmailError(null);
-          },
-          placeholder: "you@example.com",
-          required: true,
-          "aria-invalid": emailError ? true : void 0,
-          style: inputStyle2
-        }
-      ),
-      emailError && /* @__PURE__ */ jsx(ErrorLine2, { children: emailError }),
-      /* @__PURE__ */ jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "Sending\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Send one-time code" }) })
-    ] });
-  }
-  return /* @__PURE__ */ jsxs("form", { onSubmit: verify, "data-oc-signin-email-verify": "", children: [
-    /* @__PURE__ */ jsxs(FlowHeader, { children: [
-      resent ? "Sent a new code to " : "Sent a 6-digit code to ",
-      /* @__PURE__ */ jsx("span", { style: { color: "var(--foreground, #fafafa)" }, children: email }),
-      ". It expires in 10 minutes."
-    ] }),
-    /* @__PURE__ */ jsx(Label, { htmlFor: `${uid}-code`, children: "One-time code" }),
-    /* @__PURE__ */ jsx(
-      "input",
-      {
-        id: `${uid}-code`,
-        type: "text",
-        inputMode: "numeric",
-        pattern: "\\d{6}",
-        maxLength: 6,
-        autoComplete: "one-time-code",
-        value: code,
-        onChange: (e) => {
-          setCode(e.target.value.replace(/\D/g, "").slice(0, 6));
-          if (codeError) setCodeError(null);
-        },
-        placeholder: "6 digits",
-        required: true,
-        autoFocus: true,
-        "aria-invalid": codeError ? true : void 0,
-        style: { ...inputStyle2, letterSpacing: "0.4em", fontSize: 16 }
-      }
-    ),
-    codeError && /* @__PURE__ */ jsx(ErrorLine2, { children: codeError }),
-    /* @__PURE__ */ jsx(
-      "button",
-      {
-        type: "submit",
-        disabled: submitting || code.length !== 6,
-        style: submitStyle(submitting || code.length !== 6),
-        children: submitting ? "Verifying\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Verify \xB7 sign me in" })
-      }
-    ),
-    /* @__PURE__ */ jsxs("div", { children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => void resend(),
-          disabled: submitting,
-          style: linkButtonStyle,
-          children: "Send a new code"
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => {
-            setStage("enter");
-            setCode("");
-            setToken(null);
-            setResent(false);
-          },
-          style: linkButtonStyle,
-          children: "Use a different email"
-        }
-      )
-    ] })
-  ] });
-}
-function Submit({ children }) {
-  return /* @__PURE__ */ jsxs(Fragment, { children: [
-    children,
-    /* @__PURE__ */ jsx("span", { "aria-hidden": "true", style: { display: SIGNIN_ARROW }, children: " \u2192" })
-  ] });
-}
-function FlowHeader({
-  label,
-  children
-}) {
-  return /* @__PURE__ */ jsxs("div", { style: { marginBottom: 16 }, children: [
-    label && /* @__PURE__ */ jsx(
-      "div",
-      {
-        style: {
-          color: "var(--primary, #f97316)",
-          fontFamily: SIGNIN_FONT,
-          fontSize: signinSize(10),
-          letterSpacing: signinTracking("0.18em"),
-          textTransform: SIGNIN_CASE,
-          marginBottom: 6
-        },
-        children: label
-      }
-    ),
-    /* @__PURE__ */ jsx(
-      "p",
-      {
-        style: {
-          color: "var(--muted-foreground, #a1a1aa)",
-          fontSize: signinRoleSize("text", "13px"),
-          lineHeight: 1.55,
-          margin: 0
-        },
-        children
-      }
-    )
-  ] });
-}
-var linkButtonStyle = {
-  display: "inline-flex",
-  alignItems: "center",
-  minHeight: 44,
-  marginTop: 4,
-  marginRight: 16,
-  background: "transparent",
-  border: "none",
-  color: "var(--muted-foreground, #a1a1aa)",
-  fontFamily: SIGNIN_FONT,
-  fontSize: signinRoleSize("button", signinSize(11)),
-  letterSpacing: signinTracking("0.12em"),
-  textTransform: SIGNIN_CASE,
-  cursor: "pointer",
-  padding: 0
-};
-function Label({
-  htmlFor,
-  children
-}) {
-  return /* @__PURE__ */ jsx(
-    "label",
-    {
-      htmlFor,
-      style: {
-        display: "block",
-        color: "var(--foreground, #fafafa)",
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinRoleSize("label", signinSize(11)),
-        letterSpacing: signinTracking("0.12em"),
-        textTransform: SIGNIN_CASE,
-        marginBottom: 6
-      },
-      children
-    }
-  );
-}
-var inputStyle2 = {
-  width: "100%",
-  padding: "0.55rem 0.75rem",
-  background: "var(--background, #0a0a0a)",
-  color: "var(--foreground, #fafafa)",
-  border: "1px solid var(--input, #27272a)",
-  borderRadius: signinRadius(6),
-  fontFamily: SIGNIN_FONT,
-  // 16px — never below it. A sub-16px font-size makes iOS Safari
-  // auto-zoom the viewport on focus; the family rule is >=16px on
-  // every form field. Desktop reads fine at 16 too.
-  fontSize: 16,
-  outline: "none"
-};
-var linkAlsoStyle = {
-  display: "flex",
-  alignItems: "center",
-  // The whole row is the checkbox's hit area; the 13px box alone was not.
-  minHeight: 44,
-  gap: 8,
-  marginTop: 16,
-  paddingTop: 14,
-  borderTop: "1px solid var(--border, #27272a)",
-  color: "var(--muted-foreground, #a1a1aa)",
-  fontFamily: SIGNIN_FONT,
-  fontSize: signinRoleSize("text", signinSize(12)),
-  lineHeight: 1.5,
-  cursor: "pointer"
-};
-function submitStyle(disabled) {
-  return {
-    marginTop: 12,
-    padding: "0.6rem 1rem",
-    background: "var(--primary, #f97316)",
-    color: "var(--primary-foreground, #0a0a0a)",
-    border: "none",
-    borderRadius: SIGNIN_BUTTON_RADIUS,
-    fontFamily: SIGNIN_FONT,
-    fontSize: signinRoleSize("button", signinSize(11)),
-    letterSpacing: signinTracking("0.14em"),
-    textTransform: SIGNIN_CASE,
-    fontWeight: SIGNIN_STRONG,
-    cursor: disabled ? "not-allowed" : "pointer",
-    opacity: disabled ? 0.5 : 1,
-    width: "100%"
-  };
-}
-function ErrorLine2({ children }) {
-  return /* @__PURE__ */ jsx(
-    "p",
-    {
-      role: "alert",
-      style: {
-        marginTop: 6,
-        marginBottom: 0,
-        color: "var(--destructive, #ef4444)",
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinRoleSize("hint", signinSize(11)),
-        letterSpacing: "0.04em"
-      },
-      children
-    }
-  );
-}
-function Hint({ children }) {
-  return /* @__PURE__ */ jsx(
-    "p",
-    {
-      style: {
-        marginTop: 12,
-        marginBottom: 0,
-        color: "var(--muted-foreground, #a1a1aa)",
-        fontFamily: SIGNIN_FONT,
-        fontSize: signinRoleSize("hint", "10.5px"),
-        lineHeight: 1.55
-      },
-      children
-    }
-  );
-}
-var DEFAULT_AUTH_ORIGIN2 = "https://ochk.io";
-var MIN_CONFIRMATIONS = 6;
-var MIN_SATS = 1e3;
-var n = (v) => v.toLocaleString("en-US");
-function bondFloorsText(f) {
-  const sats = f.sats_floor > 0 ? `at least ${n(f.sats_floor)} sats` : "under 1,000 sats";
-  const days = f.days_floor > 0 ? `held ${f.days_floor} days or more` : "held under 7 days";
-  return `${sats}, ${days}`;
-}
-var short = (outpoint) => {
-  const [txid = "", vout = ""] = outpoint.split(":");
-  return `${txid.slice(0, 8)}\u2026${txid.slice(-4)}:${vout}`;
-};
-var usable = (c) => c.sats >= MIN_SATS && c.age_blocks >= MIN_CONFIRMATIONS;
-var dustText = (count) => `${n(count)} ${count === 1 ? "coin" : "coins"} under ${n(MIN_SATS)} sats, too small to back an account`;
-var REFUSAL = {
-  invalid_address: "that isn't a Bitcoin address we can read",
-  chain_unavailable: "couldn't read the chain just now \xB7 nothing changed, try again in a minute",
-  sig_invalid: "that signature isn't from this coin's address \xB7 sign with the wallet that holds it",
-  bond_expired: "the message expired \xB7 start again",
-  bond_not_yet_valid: "your device's clock looks wrong \xB7 check it and start again",
-  bond_subject_mismatch: "that message was for another account \xB7 start again",
-  bond_malformed: "the signed message changed on the way \xB7 start again",
-  bond_window_too_long: "that message's signing window is too long \xB7 start again",
-  coin_not_found: "that coin doesn't exist on-chain",
-  coin_address_mismatch: "that coin isn't at this address",
-  coin_unconfirmed: "that coin isn't confirmed yet",
-  coin_too_recent: "that coin needs six confirmations first, about an hour",
-  coin_spent: "that coin has been spent \xB7 pick one still in your wallet",
-  coin_too_small: `that coin is under ${n(MIN_SATS)} sats, too small to back an account`,
-  coin_backs_another_account: "that coin already backs another orangecheck account",
-  coin_backed_another_recently: "that coin backed another account until recently \xB7 it can back this one 30 days after it was released",
-  not_authenticated: "your session ended \xB7 sign in again",
-  rate_limited: "too many tries \xB7 wait a minute, then try again"
-};
-var bondRefusal = (reason) => reason && REFUSAL[reason] || "your backing didn't save \xB7 nothing changed, try again";
-var smallStyle = { ...bodyStyle, fontSize: 12, margin: 0 };
-var explainerStyle = {
-  ...hintStyle,
-  fontSize: 12,
-  lineHeight: 1.55,
-  opacity: 1,
-  margin: 0
-};
-var fieldLabelStyle = {
-  display: "block",
-  color: V.foreground,
-  fontSize: 13,
-  fontWeight: 500,
-  margin: "0 0 4px"
-};
-var addressStyle = { wordBreak: "break-all", color: V.foreground };
-function coinStyle(picked, young) {
-  return {
-    background: V.card,
-    border: `1px ${young ? "dashed" : "solid"} ${picked ? V.primary : V.border}`,
-    padding: "0.75rem",
-    display: "flex",
-    gap: 10,
-    alignItems: "flex-start",
-    cursor: young ? "not-allowed" : "pointer"
-  };
-}
-async function fetchOcBond(opts) {
-  const r = await fetch(`${opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN2}/api/auth/bond`, {
-    credentials: "include"
-  });
-  const j = await r.json().catch(() => ({}));
-  if (!r.ok || !j.ok) throw new Error(`http_${r.status}`);
-  return j.bond ?? null;
-}
-function OcBond({
-  authOrigin = DEFAULT_AUTH_ORIGIN2,
-  onChange,
-  className
-}) {
-  const [bond, setBond] = React4.useState(void 0);
-  const [loadErr, setLoadErr] = React4.useState(false);
-  const [nonce, setNonce] = React4.useState(0);
-  const [adding, setAdding] = React4.useState(false);
-  const [confirming, setConfirming] = React4.useState(false);
-  const [busy, setBusy] = React4.useState(false);
-  const [err, setErr] = React4.useState(null);
-  React4.useEffect(() => {
-    let alive = true;
-    fetchOcBond({ authOrigin }).then(
-      (b) => alive && setBond(b),
-      () => alive && setLoadErr(true)
-    );
-    return () => {
-      alive = false;
-    };
-  }, [authOrigin, nonce]);
-  const call = React4.useCallback(
-    async (method, body) => {
-      const r = await fetch(`${authOrigin}/api/auth/bond`, {
-        method,
-        credentials: "include",
-        headers: body ? { "Content-Type": "application/json" } : void 0,
-        body: body ? JSON.stringify(body) : void 0
-      });
-      const j = await r.json().catch(() => ({}));
-      const pin = readTabSession();
-      if (pin && r.ok && typeof j.token === "string") {
-        writeTabSession({ token: j.token, didOc: pin.didOc });
-      }
-      return { ok: r.ok && j.ok === true, ...j };
-    },
-    [authOrigin]
-  );
-  async function release() {
-    setBusy(true);
-    setErr(null);
-    const j = await call("DELETE").catch(() => ({ ok: false, reason: "network" }));
-    setBusy(false);
-    if (!j.ok) return setErr(bondRefusal(j.reason));
-    setConfirming(false);
-    setBond(null);
-    onChange?.(null);
-  }
-  if (loadErr) {
-    return /* @__PURE__ */ jsxs("div", { className, "data-oc-bond": "", style: panelStyle("warn"), role: "alert", children: [
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "couldn't read your backing \xB7 nothing was changed" }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: ghostBtnStyle(false),
-          onClick: () => {
-            setLoadErr(false);
-            setNonce((x) => x + 1);
-          },
-          children: "try again"
-        }
-      )
-    ] });
-  }
-  if (bond === void 0) {
-    return /* @__PURE__ */ jsx("div", { className, "data-oc-bond": "", style: panelStyle(), children: /* @__PURE__ */ jsx("span", { style: hintStyle, children: "reading your backing\u2026" }) });
-  }
-  return /* @__PURE__ */ jsxs("div", { className, "data-oc-bond": "", style: { display: "grid", gap: 16 }, children: [
-    bond && !adding ? /* @__PURE__ */ jsxs("div", { style: panelStyle("success"), children: [
-      /* @__PURE__ */ jsx(SectionLabel, { tone: "success", children: "\xA7 backed by bitcoin" }),
-      /* @__PURE__ */ jsxs("p", { style: { ...bodyStyle, color: V.foreground }, children: [
-        "apps see a coin ",
-        bondFloorsText(bond),
-        "."
-      ] }),
-      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "coin ",
-        short(bond.outpoint),
-        ", ",
-        n(bond.sats),
-        " sats \xB7 last found unspent at block ",
-        n(bond.checked_height),
-        " \xB7 only you and orangecheck see this line"
-      ] }),
-      confirming ? /* @__PURE__ */ jsxs("div", { role: "group", "aria-label": "stop backing", "data-oc-bond-confirm": "", children: [
-        /* @__PURE__ */ jsx("p", { style: { ...bodyStyle, color: V.foreground, margin: 0 }, children: "stop backing? apps that ask for a backed account may stop letting you in." }),
-        /* @__PURE__ */ jsxs(FormButtons, { children: [
-          /* @__PURE__ */ jsx(
-            "button",
-            {
-              type: "button",
-              style: dangerBtnStyle(busy),
-              disabled: busy,
-              onClick: () => void release(),
-              children: "stop backing"
-            }
-          ),
-          /* @__PURE__ */ jsx(
-            "button",
-            {
-              type: "button",
-              style: ghostBtnStyle(busy),
-              disabled: busy,
-              autoFocus: true,
-              onClick: () => {
-                setErr(null);
-                setConfirming(false);
-              },
-              children: "keep"
-            }
-          )
-        ] })
-      ] }) : /* @__PURE__ */ jsxs(FormButtons, { children: [
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            style: ghostBtnStyle(false),
-            onClick: () => {
-              setErr(null);
-              setAdding(true);
-            },
-            children: "use another coin"
-          }
-        ),
-        /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            style: dangerBtnStyle(false),
-            onClick: () => setConfirming(true),
-            children: "stop backing"
-          }
-        )
-      ] }),
-      err ? /* @__PURE__ */ jsx(ErrorLine, { children: err }) : null
-    ] }) : null,
-    !bond && !adding ? /* @__PURE__ */ jsxs("div", { style: panelStyle(), children: [
-      /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 not backed" }),
-      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "your account works everywhere as it is. some apps let in only accounts backed by a coin you hold. it stays in your wallet, and apps never see which coin." }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: primaryBtnStyle(false),
-          onClick: () => setAdding(true),
-          children: "back your account"
-        }
-      )
-    ] }) : null,
-    adding ? /* @__PURE__ */ jsx(
-      BondForm,
-      {
-        call,
-        onCancel: () => setAdding(false),
-        onDone: (b) => {
-          setBond(b);
-          setAdding(false);
-          onChange?.(b);
-        }
-      }
-    ) : null,
-    /* @__PURE__ */ jsx("p", { style: explainerStyle, children: "Apps see only rough floors, like \u201Cat least 100,000 sats, held 30 days or more\u201D, and a number unique to that app. Never the coin, your address or your balance. An app can block that number; only moving the coin gets past it, and a moved coin starts its age again." })
-  ] });
-}
-function BondForm({
-  call,
-  onCancel,
-  onDone
-}) {
-  const [address, setAddress] = React4.useState("");
-  const [coins, setCoins] = React4.useState(null);
-  const [chosen, setChosen] = React4.useState("");
-  const [message, setMessage] = React4.useState(null);
-  const [busy, setBusy] = React4.useState(false);
-  const [err, setErr] = React4.useState(null);
-  const id = React4.useId();
-  const addr = address.trim();
-  const canFind = addr.length >= 14;
-  async function run(fn) {
-    setBusy(true);
-    setErr(null);
-    try {
-      await fn();
-    } catch {
-      setErr(bondRefusal("chain_unavailable"));
-    } finally {
-      setBusy(false);
-    }
-  }
-  const findCoins = () => run(async () => {
-    const j = await call("POST", { action: "coins", address: addr });
-    if (!j.ok) return setErr(bondRefusal(j.reason));
-    const list = j.coins ?? [];
-    setCoins(list);
-    setChosen(list.find(usable)?.outpoint ?? "");
-  });
-  const getMessage = () => run(async () => {
-    const j = await call("POST", { action: "message", address: addr, outpoint: chosen });
-    if (!j.ok || typeof j.message !== "string") return setErr(bondRefusal(j.reason));
-    setMessage(j.message);
-  });
-  const submit = (signature) => run(async () => {
-    const j = await call("POST", { action: "bond", message, signature });
-    if (!j.ok || !j.bond) return setErr(bondRefusal(j.reason));
-    onDone(j.bond);
-  });
-  function back() {
-    setErr(null);
-    if (message) setMessage(null);
-    else setCoins(null);
-  }
-  const error = err ? /* @__PURE__ */ jsx(ErrorLine, { children: err }) : null;
-  const backButton = /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: back, children: "back" });
-  const cancelButton = /* @__PURE__ */ jsx("button", { type: "button", style: ghostBtnStyle(busy), disabled: busy, onClick: onCancel, children: "cancel" });
-  let step;
-  if (message) {
-    step = /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "sign with the wallet that holds ",
-        /* @__PURE__ */ jsx("span", { style: addressStyle, children: addr }),
-        ". signing spends nothing, and the coin stays in your wallet."
-      ] }),
-      /* @__PURE__ */ jsx(
-        LazyWalletButton,
-        {
-          address: addr,
-          message,
-          showManual: true,
-          onSigned: (sig) => void submit(sig),
-          onError: (e) => setErr(e.message ?? "the wallet refused to sign")
-        }
-      ),
-      error,
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        backButton,
-        cancelButton
-      ] })
-    ] });
-  } else if (coins) {
-    const eligible = coins.filter((c) => c.sats >= MIN_SATS);
-    const dust = coins.length - eligible.length;
-    step = /* @__PURE__ */ jsxs(Fragment, { children: [
-      coins.length === 0 ? /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-        "no confirmed coins at that address \xB7 send at least ",
-        n(MIN_SATS),
-        " sats there and wait for six confirmations, about an hour. the longer a coin sits, the more it says."
-      ] }) : eligible.length === 0 ? /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx("p", { style: { ...bodyStyle, color: V.foreground }, children: dustText(dust) }),
-        /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
-          "send at least ",
-          n(MIN_SATS),
-          " sats there in one payment and wait for six confirmations, about an hour. coins aren't added together."
-        ] })
-      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx("p", { id: `${id}-pick`, style: bodyStyle, children: "pick one coin \xB7 coins aren't added together" }),
-        /* @__PURE__ */ jsx(
-          "div",
-          {
-            role: "radiogroup",
-            "aria-labelledby": `${id}-pick`,
-            style: { display: "grid", gap: 8 },
-            children: eligible.map((c) => {
-              const young = c.age_blocks < MIN_CONFIRMATIONS;
-              return /* @__PURE__ */ jsxs(
-                "label",
-                {
-                  style: coinStyle(chosen === c.outpoint, young),
-                  children: [
-                    /* @__PURE__ */ jsx(
-                      "input",
-                      {
-                        type: "radio",
-                        name: "oc-bond-coin",
-                        value: c.outpoint,
-                        checked: chosen === c.outpoint,
-                        disabled: young,
-                        onChange: () => setChosen(c.outpoint),
-                        style: { accentColor: V.primary, margin: "2px 0 0" }
-                      }
-                    ),
-                    /* @__PURE__ */ jsxs("span", { style: { display: "grid", gap: 2, minWidth: 0 }, children: [
-                      /* @__PURE__ */ jsxs(
-                        "span",
-                        {
-                          style: {
-                            color: young ? V.muted : V.foreground,
-                            fontSize: 13
-                          },
-                          children: [
-                            n(c.sats),
-                            " sats, held",
-                            " ",
-                            Math.floor(c.age_blocks / 144),
-                            " days"
-                          ]
-                        }
-                      ),
-                      /* @__PURE__ */ jsx("span", { style: smallStyle, children: young ? "too recent: needs six confirmations" : `apps would see ${bondFloorsText(c)}` }),
-                      /* @__PURE__ */ jsx(
-                        "span",
-                        {
-                          style: {
-                            ...smallStyle,
-                            fontFamily: SIGNIN_FONT,
-                            wordBreak: "break-all"
-                          },
-                          children: short(c.outpoint)
-                        }
-                      )
-                    ] })
-                  ]
-                },
-                c.outpoint
-              );
-            })
-          }
-        ),
-        dust > 0 ? /* @__PURE__ */ jsx("p", { style: { ...smallStyle, marginTop: 8 }, children: dustText(dust) }) : null
-      ] }),
-      error,
-      /* @__PURE__ */ jsxs(FormButtons, { children: [
-        eligible.length > 0 ? /* @__PURE__ */ jsx(
-          "button",
-          {
-            type: "button",
-            style: primaryBtnStyle(busy || !chosen),
-            disabled: busy || !chosen,
-            onClick: () => void getMessage(),
-            children: "continue"
-          }
-        ) : null,
-        backButton,
-        cancelButton
-      ] })
-    ] });
-  } else {
-    step = /* @__PURE__ */ jsxs(
-      "form",
-      {
-        style: { margin: 0 },
-        onSubmit: (e) => {
-          e.preventDefault();
-          if (canFind && !busy) void findCoins();
-        },
-        children: [
-          /* @__PURE__ */ jsx("label", { htmlFor: `${id}-address`, style: fieldLabelStyle, children: "bitcoin address that holds the coin" }),
-          /* @__PURE__ */ jsx("p", { id: `${id}-advice`, style: { ...bodyStyle, margin: "0 0 8px" }, children: "use one that holds nothing else of yours: orangecheck learns its address and amount. apps never do." }),
-          /* @__PURE__ */ jsx(
-            "input",
-            {
-              id: `${id}-address`,
-              "aria-describedby": `${id}-advice`,
-              style: inputStyle,
-              value: address,
-              onChange: (e) => setAddress(e.target.value),
-              placeholder: "bc1q\u2026",
-              spellCheck: false,
-              autoComplete: "off",
-              autoCapitalize: "off"
-            }
-          ),
-          error,
-          /* @__PURE__ */ jsxs(FormButtons, { children: [
-            /* @__PURE__ */ jsx(
-              "button",
-              {
-                type: "submit",
-                style: primaryBtnStyle(busy || !canFind),
-                disabled: busy || !canFind,
-                children: "find its coins"
-              }
-            ),
-            cancelButton
-          ] })
-        ]
-      }
-    );
-  }
-  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-bond-form": "", children: [
-    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 back your account" }),
-    step
-  ] });
-}
-function resolveAuthOrigin(opts) {
-  if (!opts) return resolveConfig(void 0).authOrigin;
-  return resolveConfig(opts).authOrigin;
-}
-function isAbortError(err) {
-  if (!(err instanceof Error)) return false;
-  return /NotAllowed|aborted|cancel|user cancelled/i.test(err.message);
-}
-function useWebAuthnRegister(opts) {
-  const authOrigin = resolveAuthOrigin(opts);
-  const [status, setStatus] = React4.useState("idle");
-  const [error, setError] = React4.useState(null);
-  const reset = React4.useCallback(() => {
-    setStatus("idle");
-    setError(null);
-  }, []);
-  const register = React4.useCallback(
-    async (args) => {
-      setError(null);
-      setStatus("requesting-options");
-      try {
-        const optsRes = await fetch(`${authOrigin}/api/auth/webauthn/register/options`, {
-          method: "POST",
-          credentials: "include",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ label: args?.label })
-        });
-        const optsBody = await optsRes.json();
-        if (!optsRes.ok || !optsBody.ok || !optsBody.options || !optsBody.challenge_token) {
-          const reason = optsBody.reason ?? `options_failed_${optsRes.status}`;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        setStatus("authenticating");
-        let attestation;
-        try {
-          attestation = await startRegistration({ optionsJSON: optsBody.options });
-        } catch (e) {
-          const reason = isAbortError(e) ? "cancelled" : e.message;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        setStatus("verifying");
-        const verifyRes = await fetch(`${authOrigin}/api/auth/webauthn/register/verify`, {
-          method: "POST",
-          credentials: "include",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            challenge_token: optsBody.challenge_token,
-            response: attestation,
-            label: args?.label
-          })
-        });
-        const verifyBody = await verifyRes.json();
-        if (!verifyRes.ok || !verifyBody.ok || !verifyBody.credential) {
-          const reason = verifyBody.reason ?? `verify_failed_${verifyRes.status}`;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        setStatus("success");
-        return { ok: true, credential: verifyBody.credential };
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
-        setError(new Error(reason));
-        setStatus("error");
-        return { ok: false, reason };
-      }
-    },
-    [authOrigin]
-  );
-  return { status, error, register, reset };
-}
-function useWebAuthnList(opts) {
-  const authOrigin = resolveAuthOrigin(opts);
-  const { status: sessionStatus } = useOcSession();
-  const [credentials, setCredentials] = React4.useState([]);
-  const [status, setStatus] = React4.useState("loading");
-  const [error, setError] = React4.useState(null);
-  const refetch = React4.useCallback(async () => {
-    setError(null);
-    if (sessionStatus !== "authenticated") {
-      setCredentials([]);
-      setStatus("ready");
-      return;
-    }
-    setStatus("loading");
-    try {
-      const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials`, {
-        credentials: "include"
-      });
-      if (r.status === 401) {
-        setCredentials([]);
-        setStatus("ready");
-        return;
-      }
-      const j = await r.json();
-      if (!j.ok || !j.credentials) {
-        throw new Error(j.reason ?? "list_failed");
-      }
-      setCredentials(j.credentials);
-      setStatus("ready");
-    } catch (e) {
-      setError(e instanceof Error ? e : new Error(String(e)));
-      setStatus("error");
-    }
-  }, [authOrigin, sessionStatus]);
-  React4.useEffect(() => {
-    void refetch();
-  }, [refetch]);
-  const rename = React4.useCallback(
-    async (id, label) => {
-      try {
-        const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
-          method: "PATCH",
-          credentials: "include",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ label })
-        });
-        const j = await r.json();
-        if (!j.ok || !j.credential) {
-          const reason = j.reason ?? `rename_failed_${r.status}`;
-          setError(new Error(reason));
-          return { ok: false, reason };
-        }
-        await refetch();
-        return { ok: true, credential: j.credential };
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
-        setError(new Error(reason));
-        return { ok: false, reason };
-      }
-    },
-    [authOrigin, refetch]
-  );
-  const remove = React4.useCallback(
-    async (id) => {
-      try {
-        const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
-          method: "DELETE",
-          credentials: "include"
-        });
-        const j = await r.json();
-        if (!j.ok) {
-          const reason = j.reason ?? `delete_failed_${r.status}`;
-          setError(new Error(reason));
-          return { ok: false, reason };
-        }
-        await refetch();
-        return { ok: true };
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
-        setError(new Error(reason));
-        return { ok: false, reason };
-      }
-    },
-    [authOrigin, refetch]
-  );
-  return { status, credentials, error, refetch, rename, remove };
-}
-function useStepUpAuth(opts) {
-  const authOrigin = resolveAuthOrigin(opts);
-  const { refresh } = useOcSession();
-  const [status, setStatus] = React4.useState("idle");
-  const [error, setError] = React4.useState(null);
-  const reset = React4.useCallback(() => {
-    setStatus("idle");
-    setError(null);
-  }, []);
-  const stepUp = React4.useCallback(
-    async (args) => {
-      setError(null);
-      setStatus("requesting-options");
-      try {
-        const optsRes = await fetch(`${authOrigin}/api/auth/webauthn/assertion/options`, {
-          method: "POST",
-          credentials: "include",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ purpose: args.purpose })
-        });
-        const optsBody = await optsRes.json();
-        if (!optsRes.ok || !optsBody.ok || !optsBody.options || !optsBody.challenge_token) {
-          const reason = optsBody.reason ?? `options_failed_${optsRes.status}`;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        setStatus("authenticating");
-        let assertion;
-        try {
-          assertion = await startAuthentication({ optionsJSON: optsBody.options });
-        } catch (e) {
-          const reason = isAbortError(e) ? "cancelled" : e.message;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        setStatus("verifying");
-        const verifyRes = await fetch(
-          `${authOrigin}/api/auth/webauthn/assertion/verify`,
-          {
-            method: "POST",
-            credentials: "include",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              challenge_token: optsBody.challenge_token,
-              response: assertion
-            })
-          }
-        );
-        const verifyBody = await verifyRes.json();
-        if (!verifyRes.ok || !verifyBody.ok || typeof verifyBody.step_up_at !== "number") {
-          const reason = verifyBody.reason ?? `verify_failed_${verifyRes.status}`;
-          setError(new Error(reason));
-          setStatus("error");
-          return { ok: false, reason };
-        }
-        await refresh();
-        setStatus("success");
-        return { ok: true, step_up_at: verifyBody.step_up_at };
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
-        setError(new Error(reason));
-        setStatus("error");
-        return { ok: false, reason };
-      }
-    },
-    [authOrigin, refresh]
-  );
-  return { status, error, stepUp, reset };
-}
-
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, FRAGMENT_TTL_MS, OcAccountChip, OcAccountPill, OcAddressInput, OcBond, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, SUDO_ACCOUNT_MISMATCH_MESSAGE, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, bondFloorsText, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcBond, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, isSudoAccountMismatch, keepFragmentOnReturnLinks, readTabSession, redirectToSudo, restoreReturnFragment, returnToHere, safeReturnTo, stripFragment, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, withoutFragment, writeTabSession };
-//# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map