@orangecheck/auth-client 2.33.4 → 2.35.0

package/dist/chunk-4E7GJ5IB.mjs

@@ -0,0 +1,1184 @@
+import {
+  LinkPromptStep
+} from "./chunk-UFRU3I3D.mjs";
+import {
+  SIGNIN_ARROW,
+  SIGNIN_BUTTON_RADIUS,
+  SIGNIN_CASE,
+  SIGNIN_FONT,
+  SIGNIN_STRONG,
+  signinRadius,
+  signinRoleSize,
+  signinSize,
+  signinTracking
+} from "./chunk-H2TXOCXH.mjs";
+import {
+  stripFragment
+} from "./chunk-CYR7J4UY.mjs";
+import {
+  clearTabSession
+} from "./chunk-TJJNTITX.mjs";
+
+// src/signin.tsx
+import * as React from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function isSameOriginPath(candidate, origin) {
+  try {
+    return new URL(candidate, origin).origin === origin;
+  } catch {
+    return false;
+  }
+}
+function resolutionOrigin() {
+  return typeof window === "undefined" ? "https://ochk.io" : window.location.origin;
+}
+function safeReturnTo(input) {
+  const candidate = input ?? "/";
+  if (typeof candidate !== "string") return "/";
+  if (!candidate.startsWith("/")) return "/";
+  return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : "/";
+}
+function familyReturnTarget(input) {
+  if (typeof input !== "string" || input.length === 0) return void 0;
+  if (input.startsWith("/") && isSameOriginPath(input, resolutionOrigin())) {
+    return input;
+  }
+  try {
+    const u = new URL(input);
+    if (u.protocol !== "https:") return void 0;
+    const host = u.hostname.toLowerCase();
+    if (host === "ochk.io" || host.endsWith(".ochk.io")) return u.toString();
+  } catch {
+  }
+  return void 0;
+}
+function hardNavigate(target) {
+  if (typeof window === "undefined") return;
+  window.location.assign(target);
+}
+var SIGNIN_ERRORS = {
+  bad_request: "That doesn't look like a Bitcoin address.",
+  invalid_challenge: "That signature doesn't match this address. Sign with the wallet that holds it.",
+  sig_invalid: "That signature doesn't match this address. Sign with the wallet that holds it.",
+  sig_unsupported_scheme: "We can't check this wallet's signature format yet. Try another wallet, or use email.",
+  expired: "That request timed out. Try again for a fresh one.",
+  not_yet_valid: "That request is not valid yet. Check your device clock, then try again.",
+  nonce_mismatch: "That request didn't match. Try again for a fresh one.",
+  audience_mismatch: "That request didn't match this site. Reload the page and try again.",
+  purpose_mismatch: "That request didn't match. Try again for a fresh one.",
+  malformed: "That signature couldn't be read. Copy it again, whole.",
+  cross_site_blocked: "Your browser blocked this request. Reload the page and try again.",
+  rate_limited: "Too many tries. Wait a minute, then try again.",
+  invalid_email: "That email address doesn't look right.",
+  mailer_unavailable: "We couldn't send the email right now. Try again in a minute.",
+  mailer_error: "We couldn't send the email right now. Try again in a minute.",
+  wrong_code: "That code isn't right. Check the newest email from us.",
+  replay: "That code was already used. Send a new one.",
+  invalid_token: "That code is no longer valid. Send a new one.",
+  email_mismatch: "That code was sent to a different address. Send a new one."
+};
+var EMAIL_ERRORS = {
+  expired: "That code expired. Send a new one."
+};
+var SUBMIT_ERRORS = {
+  bad_request: "That signature couldn't be read. Copy it again, whole."
+};
+function networkError(authOrigin) {
+  let host = authOrigin;
+  try {
+    host = new URL(authOrigin).host;
+  } catch {
+  }
+  return `We couldn't reach the orangecheck sign-in service at ${host}. Check your connection, then try again.`;
+}
+function humanSigninError(reason, path, step = "challenge") {
+  if (!/^[a-z0-9_]+$/.test(reason)) return reason;
+  if (path === "wallet" && step === "submit" && SUBMIT_ERRORS[reason]) return SUBMIT_ERRORS[reason];
+  if (path === "email" && EMAIL_ERRORS[reason]) return EMAIL_ERRORS[reason];
+  return SIGNIN_ERRORS[reason] ?? (path === "email" ? "That didn't work. Try again, or send a new code." : "That didn't work. Try again.");
+}
+function failureMessage(err, path, step, authOrigin) {
+  if (err instanceof TypeError || err instanceof SyntaxError) return networkError(authOrigin);
+  return humanSigninError(err instanceof Error ? err.message : "failed", path, step);
+}
+var BECH32_ADDRESS = /^(bc1|tb1|bcrt1)[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{8,87}$/i;
+var BASE58_ADDRESS = /^[123mn][1-9A-HJ-NP-Za-km-z]{25,34}$/;
+function looksLikeBitcoinAddress(input) {
+  const s = input.trim();
+  return BECH32_ADDRESS.test(s) || BASE58_ADDRESS.test(s);
+}
+function OcSignIn({
+  audience,
+  returnTo,
+  onSuccess,
+  resolveReturnTo,
+  linkPrompt: linkPromptProp = true,
+  add: addProp,
+  authOrigin = "https://ochk.io",
+  initialPath,
+  providersFirst = true,
+  paths,
+  className,
+  mode,
+  providerHref
+}) {
+  const walletEnabled = paths?.wallet ?? true;
+  const emailEnabled = paths?.email ?? true;
+  const firstParty = mode === "first-party";
+  const credentials = firstParty ? "omit" : "include";
+  const linkPrompt = linkPromptProp && !firstParty;
+  const [resolvedReturn, setResolvedReturn] = React.useState(
+    () => familyReturnTarget(returnTo) ?? safeReturnTo(returnTo)
+  );
+  React.useEffect(() => {
+    const fromProp = familyReturnTarget(returnTo);
+    if (fromProp) {
+      setResolvedReturn(fromProp);
+      return;
+    }
+    if (typeof window === "undefined") return;
+    const q = new URLSearchParams(window.location.search);
+    const fromQuery = familyReturnTarget(q.get("return_to")) ?? familyReturnTarget(q.get("next"));
+    setResolvedReturn(fromQuery ?? "/");
+  }, [returnTo]);
+  const [addMode, setAddMode] = React.useState(Boolean(addProp) && !firstParty);
+  React.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (firstParty) {
+      setAddMode(false);
+      return;
+    }
+    if (addProp !== void 0) {
+      setAddMode(Boolean(addProp));
+      return;
+    }
+    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
+  }, [addProp, firstParty]);
+  const [path, setPath] = React.useState(
+    initialPath ?? (providersFirst ? "email" : "wallet")
+  );
+  const tabsId = React.useId();
+  const tabOrder = providersFirst ? ["email", "wallet"] : ["wallet", "email"];
+  const tabRefs = React.useRef({});
+  const onTabKey = (e) => {
+    const i = tabOrder.indexOf(path);
+    const last = tabOrder.length - 1;
+    const to = e.key === "ArrowRight" ? (i + 1) % tabOrder.length : e.key === "ArrowLeft" ? (i + last) % tabOrder.length : e.key === "Home" ? 0 : e.key === "End" ? last : -1;
+    if (to < 0) return;
+    e.preventDefault();
+    const next = tabOrder[to];
+    setPath(next);
+    tabRefs.current[next]?.focus();
+  };
+  const [signedIn, setSignedIn] = React.useState(null);
+  const [linkAlso, setLinkAlso] = React.useState(false);
+  const [oauthError, setOauthError] = React.useState(false);
+  React.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (new URLSearchParams(window.location.search).has("oauth_error")) {
+      setOauthError(true);
+    }
+  }, []);
+  const navigate = React.useCallback(
+    async (account) => {
+      if (resolveReturnTo) {
+        try {
+          const resolved = familyReturnTarget(await resolveReturnTo(account));
+          hardNavigate(resolved ?? resolvedReturn);
+          return;
+        } catch {
+        }
+      }
+      hardNavigate(resolvedReturn);
+    },
+    [resolveReturnTo, resolvedReturn]
+  );
+  const handleSuccess = React.useCallback(
+    async (account, token, via) => {
+      const proceed = () => {
+        clearTabSession();
+        if (onSuccess) onSuccess(account, token);
+        else void navigate(account);
+      };
+      if (!linkPrompt || !linkAlso) {
+        proceed();
+        return;
+      }
+      try {
+        const meRes = await fetch(`${authOrigin}/api/auth/me`, {
+          credentials: "include",
+          headers: { Accept: "application/json" }
+        });
+        const me = meRes.ok ? await meRes.json() : null;
+        const didOc = me?.account?.did_oc;
+        if (didOc) {
+          setSignedIn({
+            method: via === "email" ? "btc" : "email",
+            didOc,
+            proceed
+          });
+          return;
+        }
+      } catch {
+      }
+      proceed();
+    },
+    [onSuccess, linkPrompt, linkAlso, navigate, authOrigin]
+  );
+  if (!walletEnabled && !emailEnabled) {
+    return /* @__PURE__ */ jsxs(
+      "div",
+      {
+        className,
+        "data-oc-signin": "",
+        style: {
+          padding: "1rem",
+          border: "1px solid var(--border, #27272a)",
+          color: "var(--foreground, #fafafa)",
+          fontFamily: SIGNIN_FONT,
+          fontSize: signinSize(12)
+        },
+        children: [
+          "no signin paths enabled \u2014 set ",
+          /* @__PURE__ */ jsx("code", { children: "paths.wallet" }),
+          " or",
+          " ",
+          /* @__PURE__ */ jsx("code", { children: "paths.email" }),
+          " to ",
+          /* @__PURE__ */ jsx("code", { children: "true" })
+        ]
+      }
+    );
+  }
+  if (signedIn) {
+    return /* @__PURE__ */ jsx("div", { className, "data-oc-signin": "", children: /* @__PURE__ */ jsx(
+      LinkPromptStep,
+      {
+        method: signedIn.method,
+        didOc: signedIn.didOc,
+        authOrigin,
+        onResolved: signedIn.proceed
+      }
+    ) });
+  }
+  const showWallet = walletEnabled && (path === "wallet" || !emailEnabled);
+  const showEmail = emailEnabled && (path === "email" || !walletEnabled);
+  const bothEnabled = walletEnabled && emailEnabled;
+  const activeMethod = !emailEnabled ? "wallet" : !walletEnabled ? "email" : path;
+  return /* @__PURE__ */ jsxs("div", { className, "data-oc-signin": "", children: [
+    oauthError && /* @__PURE__ */ jsx(
+      "div",
+      {
+        "data-oc-signin-oauth-error": "",
+        style: {
+          marginBottom: 14,
+          padding: "0.6rem 0.75rem",
+          border: "1px solid var(--destructive, #ef4444)",
+          borderRadius: signinRadius(6),
+          color: "var(--destructive, #ef4444)",
+          fontFamily: SIGNIN_FONT,
+          fontSize: signinRoleSize("text", signinSize(11))
+        },
+        children: "That sign-in didn't finish. Try again, or use another way below."
+      }
+    ),
+    addMode && /* @__PURE__ */ jsxs(
+      "div",
+      {
+        "data-oc-signin-add-mode": "",
+        style: {
+          marginBottom: 14,
+          padding: "0.6rem 0.75rem",
+          border: "1px solid var(--primary, #f97316)",
+          borderLeftWidth: 3,
+          borderRadius: signinRadius(4),
+          background: "color-mix(in srgb, var(--primary, #f97316) 8%, transparent)",
+          color: "var(--foreground, #fafafa)",
+          fontFamily: SIGNIN_FONT,
+          fontSize: signinRoleSize("text", signinSize(11)),
+          lineHeight: 1.6
+        },
+        children: [
+          /* @__PURE__ */ jsx(
+            "strong",
+            {
+              style: {
+                color: "var(--primary, #f97316)",
+                letterSpacing: signinTracking("0.12em"),
+                textTransform: SIGNIN_CASE,
+                fontSize: signinSize(10),
+                display: "block",
+                marginBottom: 3
+              },
+              children: "\xA7 adding another account"
+            }
+          ),
+          "Your current OrangeCheck account stays signed in. The new account joins your browser's roster; you can switch between them anytime from the account menu."
+        ]
+      }
+    ),
+    providersFirst && /* @__PURE__ */ jsx(
+      ProviderSignIn,
+      {
+        authOrigin,
+        returnTo: resolvedReturn,
+        add: addMode,
+        credentials,
+        firstParty,
+        providerHref,
+        first: true
+      }
+    ),
+    bothEnabled && /* @__PURE__ */ jsx(
+      "div",
+      {
+        role: "tablist",
+        "aria-label": "Sign-in method",
+        "data-oc-signin-tabs": "",
+        style: {
+          display: "flex",
+          gap: 8,
+          marginBottom: 16,
+          borderBottom: "1px solid var(--border, #27272a)"
+        },
+        children: tabOrder.map((p) => /* @__PURE__ */ jsx(
+          SigninTab,
+          {
+            id: `${tabsId}-${p}`,
+            controls: `${tabsId}-panel`,
+            active: path === p,
+            onClick: () => setPath(p),
+            onKeyDown: onTabKey,
+            ref: (el) => {
+              tabRefs.current[p] = el;
+            },
+            children: p === "email" ? "Email" : "Bitcoin wallet"
+          },
+          p
+        ))
+      }
+    ),
+    /* @__PURE__ */ jsxs(
+      "div",
+      {
+        "data-oc-signin-panel": "",
+        ...bothEnabled ? {
+          id: `${tabsId}-panel`,
+          role: "tabpanel",
+          "aria-labelledby": `${tabsId}-${path}`
+        } : {},
+        children: [
+          showWallet && /* @__PURE__ */ jsx(
+            WalletFlow,
+            {
+              authOrigin,
+              audience,
+              add: addMode,
+              credentials,
+              onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
+            }
+          ),
+          showEmail && /* @__PURE__ */ jsx(
+            EmailFlow,
+            {
+              authOrigin,
+              add: addMode,
+              credentials,
+              onSuccess: (a, t) => void handleSuccess(a, t, "email")
+            }
+          )
+        ]
+      }
+    ),
+    !providersFirst && /* @__PURE__ */ jsx(
+      ProviderSignIn,
+      {
+        authOrigin,
+        returnTo: resolvedReturn,
+        add: addMode,
+        credentials,
+        firstParty,
+        providerHref
+      }
+    ),
+    linkPrompt && /* @__PURE__ */ jsxs("label", { "data-oc-signin-linkalso": "", style: linkAlsoStyle, children: [
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "checkbox",
+          checked: linkAlso,
+          onChange: (e) => setLinkAlso(e.target.checked),
+          style: { margin: 0, accentColor: "var(--primary, #f97316)" }
+        }
+      ),
+      /* @__PURE__ */ jsxs("span", { children: [
+        "After signing in, also link",
+        " ",
+        activeMethod === "email" ? "a Bitcoin wallet" : "an email",
+        " ",
+        /* @__PURE__ */ jsx("span", { children: "\u2014 optional, one more signature." })
+      ] })
+    ] })
+  ] });
+}
+var SigninTab = React.forwardRef(function SigninTab2({ id, controls, active, onClick, onKeyDown, children }, ref) {
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      ref,
+      type: "button",
+      role: "tab",
+      id,
+      "aria-selected": active,
+      "aria-controls": controls,
+      tabIndex: active ? 0 : -1,
+      onClick,
+      onKeyDown,
+      "data-oc-signin-tab": active ? "active" : "inactive",
+      style: {
+        minHeight: 44,
+        padding: "0.6rem 0.875rem",
+        background: "transparent",
+        border: "none",
+        borderBottom: active ? "2px solid var(--primary, #f97316)" : "2px solid transparent",
+        color: active ? "var(--foreground, #fafafa)" : "var(--muted-foreground, #a1a1aa)",
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinRoleSize("label", signinSize(11)),
+        letterSpacing: signinTracking("0.12em"),
+        textTransform: SIGNIN_CASE,
+        cursor: "pointer",
+        marginBottom: -1
+      },
+      children
+    }
+  );
+});
+function ProviderIcon({ id }) {
+  const common = {
+    width: 14,
+    height: 14,
+    viewBox: "0 0 24 24",
+    fill: "currentColor",
+    "aria-hidden": true,
+    style: { flex: "0 0 auto" }
+  };
+  if (id === "google") {
+    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z" }) });
+  }
+  if (id === "github") {
+    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12" }) });
+  }
+  return null;
+}
+function ProviderSignIn({
+  authOrigin,
+  returnTo,
+  add,
+  credentials,
+  firstParty,
+  providerHref,
+  first = false
+}) {
+  const [providers, setProviders] = React.useState(null);
+  const [origin, setOrigin] = React.useState("");
+  const hidden = firstParty && !providerHref;
+  React.useEffect(() => {
+    setOrigin(window.location.origin);
+    if (hidden) return;
+    let cancelled = false;
+    fetch(`${authOrigin}/api/auth/providers`, { credentials }).then((r) => r.ok ? r.json() : null).then((body) => {
+      if (!cancelled) setProviders(body?.providers ?? []);
+    }).catch(() => {
+      if (!cancelled) setProviders([]);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [authOrigin, credentials, hidden]);
+  if (hidden) return null;
+  if (providers !== null && providers.length === 0) return null;
+  const providerReturnTo = stripFragment(
+    returnTo.startsWith("/") ? origin ? `${origin}${returnTo}` : returnTo : returnTo
+  );
+  const line = { flex: 1, height: 1, background: "var(--border, #27272a)" };
+  const BLOCK_GAP = 16;
+  const BUTTON_GAP = 8;
+  const divider = /* @__PURE__ */ jsxs(
+    "div",
+    {
+      style: {
+        display: "flex",
+        alignItems: "center",
+        gap: 10,
+        // Symmetric in both orderings: in `first` mode the divider
+        // owns the gap on both sides; at the bottom the container's
+        // marginTop owns the gap above, so the divider only pads below.
+        margin: first ? `${BLOCK_GAP}px 0` : `0 0 ${BLOCK_GAP}px`,
+        color: "var(--muted-foreground, #a1a1aa)",
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinRoleSize("hint", signinSize(10)),
+        letterSpacing: signinTracking("0.16em"),
+        textTransform: SIGNIN_CASE
+      },
+      children: [
+        /* @__PURE__ */ jsx("span", { style: line }),
+        "or",
+        /* @__PURE__ */ jsx("span", { style: line })
+      ]
+    }
+  );
+  const buttonStyle = (i) => ({
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: 10,
+    boxSizing: "border-box",
+    width: "100%",
+    minHeight: 44,
+    marginTop: i === 0 ? 0 : BUTTON_GAP,
+    padding: "0.6rem 0.875rem",
+    border: "1px solid var(--border, #27272a)",
+    borderRadius: SIGNIN_BUTTON_RADIUS,
+    background: "transparent",
+    color: "var(--muted-foreground, #a1a1aa)",
+    fontFamily: SIGNIN_FONT,
+    fontSize: signinSize(12),
+    textDecoration: "none"
+  });
+  if (providers === null) {
+    if (!first) return null;
+    return /* @__PURE__ */ jsxs("div", { "data-oc-signin-providers": "", "aria-hidden": "true", children: [
+      [0, 1].map((i) => /* @__PURE__ */ jsx("div", { style: { ...buttonStyle(i), visibility: "hidden" }, children: "\xA0" }, i)),
+      divider
+    ] });
+  }
+  const buttons = providers.map((p, i) => /* @__PURE__ */ jsxs(
+    "a",
+    {
+      href: providerHref ? providerHref(p.id) : `${authOrigin}/api/auth/${p.id}/start?return_to=${encodeURIComponent(
+        providerReturnTo
+      )}${add ? "&add=1" : ""}`,
+      "data-oc-signin-provider": p.id,
+      style: buttonStyle(i),
+      children: [
+        /* @__PURE__ */ jsx(ProviderIcon, { id: p.id }),
+        /* @__PURE__ */ jsx("span", { children: p.label })
+      ]
+    },
+    p.id
+  ));
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      "data-oc-signin-providers": "",
+      style: first ? { marginBottom: 0 } : { marginTop: BLOCK_GAP },
+      children: first ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        buttons,
+        divider
+      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        divider,
+        buttons
+      ] })
+    }
+  );
+}
+async function loadAdapter() {
+  return await import("@orangecheck/wallet-adapter");
+}
+async function detectBrowserWallets() {
+  return (await loadAdapter()).detectWallets().filter((w) => w.detected && w.id !== "manual").map((w) => ({ id: w.id, name: w.name }));
+}
+function WalletFlow({
+  authOrigin,
+  audience,
+  add,
+  credentials,
+  onSuccess
+}) {
+  const uid = React.useId();
+  const ids = {
+    address: `${uid}-address`,
+    wallet: `${uid}-wallet`,
+    message: `${uid}-message`,
+    signature: `${uid}-signature`
+  };
+  const [address, setAddress] = React.useState("");
+  const [error, setError] = React.useState(null);
+  const [submitting, setSubmitting] = React.useState(false);
+  const [wallets, setWallets] = React.useState(null);
+  const [walletId, setWalletId] = React.useState(null);
+  const [manual, setManual] = React.useState(null);
+  const [pasted, setPasted] = React.useState("");
+  const [copied, setCopied] = React.useState("idle");
+  React.useEffect(() => {
+    let cancelled = false;
+    detectBrowserWallets().then((found) => {
+      if (cancelled) return;
+      setWallets(found);
+      setWalletId(found[0]?.id ?? null);
+    }).catch(() => {
+      if (!cancelled) setWallets([]);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+  async function fetchChallenge(addr) {
+    const res = await fetch(
+      `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&audience=${encodeURIComponent(audience)}&purpose=login`
+    );
+    const json = await res.json();
+    if (!res.ok || !json.message || !json.nonce) {
+      throw new Error(json.error ?? "challenge_failed");
+    }
+    return { message: json.message, nonce: json.nonce };
+  }
+  async function submitSignature(message, nonce, signature, scheme) {
+    const res = await fetch(`${authOrigin}/api/auth/signin`, {
+      method: "POST",
+      credentials,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        message,
+        signature,
+        ...scheme ? { scheme } : {},
+        expectedNonce: nonce,
+        expectedAudience: audience,
+        expectedPurpose: "login",
+        // Multi-account add-mode · the auth host preserves the current
+        // roster_id when set, instead of minting a fresh one.
+        ...add ? { add: true } : {}
+      })
+    });
+    const json = await res.json();
+    if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
+      throw new Error(
+        "reason" in json && json.reason || "error" in json && json.error || "verify_failed"
+      );
+    }
+    onSuccess(json.account, json.token);
+  }
+  async function signIn(e) {
+    e.preventDefault();
+    const addr = address.trim();
+    if (!addr) {
+      setError("Paste your Bitcoin address.");
+      return;
+    }
+    if (!looksLikeBitcoinAddress(addr)) {
+      setError(humanSigninError("bad_request", "wallet"));
+      return;
+    }
+    setError(null);
+    setSubmitting(true);
+    let step = "challenge";
+    try {
+      let id = walletId;
+      if (wallets === null) {
+        const found = await detectBrowserWallets().catch(() => []);
+        setWallets(found);
+        id = found[0]?.id ?? null;
+        setWalletId(id);
+      }
+      const challenge = await fetchChallenge(addr);
+      if (!id) {
+        setManual(challenge);
+        setSubmitting(false);
+        return;
+      }
+      const signer = (await loadAdapter()).getSigner(id, { address: addr });
+      const signature = await signer(challenge.message);
+      step = "submit";
+      await submitSignature(challenge.message, challenge.nonce, signature, "bip322");
+    } catch (err) {
+      setError(failureMessage(err, "wallet", step, authOrigin));
+      setSubmitting(false);
+    }
+  }
+  async function signInManual(e) {
+    e.preventDefault();
+    if (!manual) return;
+    const sig = pasted.trim();
+    if (!sig) {
+      setError("Paste the signature your wallet gave you.");
+      return;
+    }
+    setError(null);
+    setSubmitting(true);
+    try {
+      await submitSignature(manual.message, manual.nonce, sig, void 0);
+    } catch (err) {
+      setError(failureMessage(err, "wallet", "submit", authOrigin));
+      setSubmitting(false);
+    }
+  }
+  async function copyMessage() {
+    if (!manual) return;
+    try {
+      await navigator.clipboard.writeText(manual.message);
+      setCopied("copied");
+    } catch {
+      setCopied("failed");
+    }
+  }
+  if (manual) {
+    return /* @__PURE__ */ jsxs("form", { onSubmit: signInManual, "data-oc-signin-wallet-manual": "", children: [
+      /* @__PURE__ */ jsxs(FlowHeader, { children: [
+        "In your wallet, use \u201Csign message\u201D (BIP-322) with ",
+        address.trim(),
+        ", sign the text below, and paste the signature back here. Nothing is spent."
+      ] }),
+      /* @__PURE__ */ jsx(Label, { htmlFor: ids.message, children: "Message to sign" }),
+      /* @__PURE__ */ jsx(
+        "textarea",
+        {
+          id: ids.message,
+          readOnly: true,
+          value: manual.message,
+          rows: 5,
+          onFocus: (e) => e.currentTarget.select(),
+          style: { ...inputStyle, resize: "vertical" }
+        }
+      ),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => void copyMessage(), style: linkButtonStyle, children: copied === "copied" ? "Copied" : "Copy message" }),
+      copied === "failed" && /* @__PURE__ */ jsx(Hint, { children: "Couldn't copy here. Select the text above and copy it." }),
+      /* @__PURE__ */ jsxs("div", { style: { marginTop: 14 }, children: [
+        /* @__PURE__ */ jsx(Label, { htmlFor: ids.signature, children: "Signature" }),
+        /* @__PURE__ */ jsx(
+          "textarea",
+          {
+            id: ids.signature,
+            value: pasted,
+            onChange: (e) => {
+              setPasted(e.target.value);
+              if (error) setError(null);
+            },
+            rows: 3,
+            placeholder: "paste the signature",
+            spellCheck: false,
+            autoFocus: true,
+            "aria-invalid": error ? true : void 0,
+            style: { ...inputStyle, resize: "vertical" }
+          }
+        )
+      ] }),
+      error && /* @__PURE__ */ jsx(ErrorLine, { children: error }),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "submit",
+          disabled: submitting || !pasted.trim(),
+          style: submitStyle(submitting || !pasted.trim()),
+          children: submitting ? "Checking\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Sign me in" })
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => {
+            setManual(null);
+            setPasted("");
+            setError(null);
+            setCopied("idle");
+          },
+          style: linkButtonStyle,
+          children: "Use a different address"
+        }
+      )
+    ] });
+  }
+  const noBrowserWallet = wallets !== null && wallets.length === 0;
+  return /* @__PURE__ */ jsxs("form", { onSubmit: signIn, "data-oc-signin-wallet": "", children: [
+    /* @__PURE__ */ jsx(FlowHeader, { children: "Your wallet signs a short message to prove you hold the address. Nothing is spent and your key never leaves the wallet. Works with browser wallets, or any wallet that can sign a message, like Sparrow." }),
+    /* @__PURE__ */ jsx(Label, { htmlFor: ids.address, children: "Bitcoin address" }),
+    /* @__PURE__ */ jsx(
+      "input",
+      {
+        id: ids.address,
+        type: "text",
+        value: address,
+        onChange: (e) => {
+          setAddress(e.target.value);
+          if (error) setError(null);
+        },
+        placeholder: "bc1q\u2026 \xB7 3\u2026 \xB7 1\u2026",
+        autoComplete: "off",
+        autoCapitalize: "none",
+        spellCheck: false,
+        required: true,
+        "aria-invalid": error ? true : void 0,
+        style: inputStyle
+      }
+    ),
+    wallets && wallets.length > 1 && /* @__PURE__ */ jsxs("div", { style: { marginTop: 12 }, children: [
+      /* @__PURE__ */ jsx(Label, { htmlFor: ids.wallet, children: "Sign with" }),
+      /* @__PURE__ */ jsx(
+        "select",
+        {
+          id: ids.wallet,
+          value: walletId ?? "",
+          onChange: (e) => setWalletId(e.target.value),
+          style: inputStyle,
+          children: wallets.map((w) => /* @__PURE__ */ jsx("option", { value: w.id, children: w.name }, w.id))
+        }
+      )
+    ] }),
+    error && /* @__PURE__ */ jsx(ErrorLine, { children: error }),
+    /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "submit",
+        disabled: submitting || !address.trim(),
+        style: submitStyle(submitting || !address.trim()),
+        children: submitting ? "Waiting for wallet\u2026" : noBrowserWallet ? /* @__PURE__ */ jsx(Submit, { children: "Get the message to sign" }) : /* @__PURE__ */ jsx(Submit, { children: "Sign in with wallet" })
+      }
+    ),
+    noBrowserWallet && /* @__PURE__ */ jsx(Hint, { children: "No browser wallet found here. You can sign with any wallet and paste." })
+  ] });
+}
+function EmailFlow({ authOrigin, add, credentials, onSuccess }) {
+  const uid = React.useId();
+  const [stage, setStage] = React.useState("enter");
+  const [email, setEmail] = React.useState("");
+  const [emailError, setEmailError] = React.useState(null);
+  const [code, setCode] = React.useState("");
+  const [codeError, setCodeError] = React.useState(null);
+  const [token, setToken] = React.useState(null);
+  const [submitting, setSubmitting] = React.useState(false);
+  const [resent, setResent] = React.useState(false);
+  async function sendCode(address) {
+    try {
+      const res = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
+        method: "POST",
+        credentials,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: address })
+      });
+      const json = await res.json();
+      if (!res.ok || !json.token) return humanSigninError(json.reason ?? "server_error", "email");
+      setToken(json.token);
+      return null;
+    } catch {
+      return networkError(authOrigin);
+    }
+  }
+  async function start(e) {
+    e.preventDefault();
+    const trimmed = email.trim().toLowerCase();
+    if (!trimmed || !/.+@.+\..+/.test(trimmed)) {
+      setEmailError(humanSigninError("invalid_email", "email"));
+      return;
+    }
+    setEmailError(null);
+    setSubmitting(true);
+    const err = await sendCode(trimmed);
+    setSubmitting(false);
+    if (err) {
+      setEmailError(err);
+      return;
+    }
+    setEmail(trimmed);
+    setStage("code");
+  }
+  async function resend() {
+    setCodeError(null);
+    setResent(false);
+    setSubmitting(true);
+    const err = await sendCode(email);
+    setSubmitting(false);
+    setCode("");
+    if (err) setCodeError(err);
+    else setResent(true);
+  }
+  async function verify(e) {
+    e.preventDefault();
+    if (!token) return;
+    if (code.length !== 6) {
+      setCodeError("The code is 6 digits.");
+      return;
+    }
+    setCodeError(null);
+    setSubmitting(true);
+    try {
+      const res = await fetch(`${authOrigin}/api/auth/email-otp/verify`, {
+        method: "POST",
+        credentials,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          email,
+          code,
+          token,
+          // Multi-account add-mode · see WalletFlow.
+          ...add ? { add: true } : {}
+        })
+      });
+      const json = await res.json();
+      if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
+        throw new Error(
+          "reason" in json && json.reason || "error" in json && json.error || "server_error"
+        );
+      }
+      onSuccess(json.account, json.token);
+    } catch (err) {
+      setCodeError(failureMessage(err, "email", "submit", authOrigin));
+    } finally {
+      setSubmitting(false);
+    }
+  }
+  if (stage === "enter") {
+    return /* @__PURE__ */ jsxs("form", { onSubmit: start, "data-oc-signin-email": "", children: [
+      /* @__PURE__ */ jsx(FlowHeader, { children: "We email you a 6-digit code. No password, and no wallet needed to start. Add a Bitcoin address any time: a way in that only you hold." }),
+      /* @__PURE__ */ jsx(Label, { htmlFor: `${uid}-email`, children: "Email" }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          id: `${uid}-email`,
+          type: "email",
+          autoComplete: "email",
+          value: email,
+          onChange: (e) => {
+            setEmail(e.target.value);
+            if (emailError) setEmailError(null);
+          },
+          placeholder: "you@example.com",
+          required: true,
+          "aria-invalid": emailError ? true : void 0,
+          style: inputStyle
+        }
+      ),
+      emailError && /* @__PURE__ */ jsx(ErrorLine, { children: emailError }),
+      /* @__PURE__ */ jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "Sending\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Send one-time code" }) })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs("form", { onSubmit: verify, "data-oc-signin-email-verify": "", children: [
+    /* @__PURE__ */ jsxs(FlowHeader, { children: [
+      resent ? "Sent a new code to " : "Sent a 6-digit code to ",
+      /* @__PURE__ */ jsx("span", { style: { color: "var(--foreground, #fafafa)" }, children: email }),
+      ". It expires in 10 minutes."
+    ] }),
+    /* @__PURE__ */ jsx(Label, { htmlFor: `${uid}-code`, children: "One-time code" }),
+    /* @__PURE__ */ jsx(
+      "input",
+      {
+        id: `${uid}-code`,
+        type: "text",
+        inputMode: "numeric",
+        pattern: "\\d{6}",
+        maxLength: 6,
+        autoComplete: "one-time-code",
+        value: code,
+        onChange: (e) => {
+          setCode(e.target.value.replace(/\D/g, "").slice(0, 6));
+          if (codeError) setCodeError(null);
+        },
+        placeholder: "6 digits",
+        required: true,
+        autoFocus: true,
+        "aria-invalid": codeError ? true : void 0,
+        style: { ...inputStyle, letterSpacing: "0.4em", fontSize: 16 }
+      }
+    ),
+    codeError && /* @__PURE__ */ jsx(ErrorLine, { children: codeError }),
+    /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "submit",
+        disabled: submitting || code.length !== 6,
+        style: submitStyle(submitting || code.length !== 6),
+        children: submitting ? "Verifying\u2026" : /* @__PURE__ */ jsx(Submit, { children: "Verify \xB7 sign me in" })
+      }
+    ),
+    /* @__PURE__ */ jsxs("div", { children: [
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => void resend(),
+          disabled: submitting,
+          style: linkButtonStyle,
+          children: "Send a new code"
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => {
+            setStage("enter");
+            setCode("");
+            setToken(null);
+            setResent(false);
+          },
+          style: linkButtonStyle,
+          children: "Use a different email"
+        }
+      )
+    ] })
+  ] });
+}
+function Submit({ children }) {
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    children,
+    /* @__PURE__ */ jsx("span", { "aria-hidden": "true", style: { display: SIGNIN_ARROW }, children: " \u2192" })
+  ] });
+}
+function FlowHeader({
+  label,
+  children
+}) {
+  return /* @__PURE__ */ jsxs("div", { style: { marginBottom: 16 }, children: [
+    label && /* @__PURE__ */ jsx(
+      "div",
+      {
+        style: {
+          color: "var(--primary, #f97316)",
+          fontFamily: SIGNIN_FONT,
+          fontSize: signinSize(10),
+          letterSpacing: signinTracking("0.18em"),
+          textTransform: SIGNIN_CASE,
+          marginBottom: 6
+        },
+        children: label
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      "p",
+      {
+        style: {
+          color: "var(--muted-foreground, #a1a1aa)",
+          fontSize: signinRoleSize("text", "13px"),
+          lineHeight: 1.55,
+          margin: 0
+        },
+        children
+      }
+    )
+  ] });
+}
+var linkButtonStyle = {
+  display: "inline-flex",
+  alignItems: "center",
+  minHeight: 44,
+  marginTop: 4,
+  marginRight: 16,
+  background: "transparent",
+  border: "none",
+  color: "var(--muted-foreground, #a1a1aa)",
+  fontFamily: SIGNIN_FONT,
+  fontSize: signinRoleSize("button", signinSize(11)),
+  letterSpacing: signinTracking("0.12em"),
+  textTransform: SIGNIN_CASE,
+  cursor: "pointer",
+  padding: 0
+};
+function Label({
+  htmlFor,
+  children
+}) {
+  return /* @__PURE__ */ jsx(
+    "label",
+    {
+      htmlFor,
+      style: {
+        display: "block",
+        color: "var(--foreground, #fafafa)",
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinRoleSize("label", signinSize(11)),
+        letterSpacing: signinTracking("0.12em"),
+        textTransform: SIGNIN_CASE,
+        marginBottom: 6
+      },
+      children
+    }
+  );
+}
+var inputStyle = {
+  width: "100%",
+  padding: "0.55rem 0.75rem",
+  background: "var(--background, #0a0a0a)",
+  color: "var(--foreground, #fafafa)",
+  border: "1px solid var(--input, #27272a)",
+  borderRadius: signinRadius(6),
+  fontFamily: SIGNIN_FONT,
+  // 16px — never below it. A sub-16px font-size makes iOS Safari
+  // auto-zoom the viewport on focus; the family rule is >=16px on
+  // every form field. Desktop reads fine at 16 too.
+  fontSize: 16
+};
+var linkAlsoStyle = {
+  display: "flex",
+  alignItems: "center",
+  // The whole row is the checkbox's hit area; the 13px box alone was not.
+  minHeight: 44,
+  gap: 8,
+  marginTop: 16,
+  paddingTop: 14,
+  borderTop: "1px solid var(--border, #27272a)",
+  color: "var(--muted-foreground, #a1a1aa)",
+  fontFamily: SIGNIN_FONT,
+  fontSize: signinRoleSize("text", signinSize(12)),
+  lineHeight: 1.5,
+  cursor: "pointer"
+};
+function submitStyle(disabled) {
+  return {
+    marginTop: 12,
+    padding: "0.6rem 1rem",
+    background: "var(--primary, #f97316)",
+    color: "var(--primary-foreground, #0a0a0a)",
+    border: "none",
+    borderRadius: SIGNIN_BUTTON_RADIUS,
+    fontFamily: SIGNIN_FONT,
+    fontSize: signinRoleSize("button", signinSize(11)),
+    letterSpacing: signinTracking("0.14em"),
+    textTransform: SIGNIN_CASE,
+    fontWeight: SIGNIN_STRONG,
+    cursor: disabled ? "not-allowed" : "pointer",
+    opacity: disabled ? 0.5 : 1,
+    width: "100%"
+  };
+}
+function ErrorLine({ children }) {
+  return /* @__PURE__ */ jsx(
+    "p",
+    {
+      role: "alert",
+      style: {
+        marginTop: 6,
+        marginBottom: 0,
+        color: "var(--destructive, #ef4444)",
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinRoleSize("hint", signinSize(11)),
+        letterSpacing: "0.04em"
+      },
+      children
+    }
+  );
+}
+function Hint({ children }) {
+  return /* @__PURE__ */ jsx(
+    "p",
+    {
+      style: {
+        marginTop: 12,
+        marginBottom: 0,
+        color: "var(--muted-foreground, #a1a1aa)",
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinRoleSize("hint", "10.5px"),
+        lineHeight: 1.55
+      },
+      children
+    }
+  );
+}
+
+export {
+  safeReturnTo,
+  familyReturnTarget,
+  networkError,
+  humanSigninError,
+  looksLikeBitcoinAddress,
+  OcSignIn
+};
+//# sourceMappingURL=chunk-4E7GJ5IB.mjs.map