@orangecheck/auth-client 2.33.4 → 2.35.0

package/dist/chunk-UFRU3I3D.mjs

@@ -0,0 +1,913 @@
+import {
+  SUDO_ACCOUNT_MISMATCH_MESSAGE,
+  handleSudoRequired,
+  isSudoAccountMismatch
+} from "./chunk-XCZVSE7M.mjs";
+import {
+  SIGNIN_BUTTON_RADIUS,
+  SIGNIN_CASE,
+  SIGNIN_FONT,
+  signinRadius,
+  signinSize,
+  signinTracking
+} from "./chunk-H2TXOCXH.mjs";
+import {
+  tabSessionHeader
+} from "./chunk-TJJNTITX.mjs";
+
+// src/linked-identities.tsx
+import * as React from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
+async function fetchOcLinkedIdentities(opts) {
+  const authOrigin = opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN;
+  const r = await fetch(`${authOrigin}/api/auth/identities`, {
+    credentials: "include",
+    headers: { ...tabSessionHeader() }
+  });
+  if (r.status === 401) return [];
+  if (!r.ok) throw new Error(`identities fetch failed: http_${r.status}`);
+  const body = await r.json();
+  return body.linked ?? [];
+}
+function OcLinkedIdentities({
+  authOrigin = DEFAULT_AUTH_ORIGIN,
+  className,
+  onChange,
+  attestationLink = true
+}) {
+  const [resp, setResp] = React.useState(null);
+  const [error, setError] = React.useState(null);
+  const [showEmailLink, setShowEmailLink] = React.useState(false);
+  const [showBtcLink, setShowBtcLink] = React.useState(false);
+  const refresh = React.useCallback(async () => {
+    setError(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/identities`, {
+        credentials: "include",
+        headers: { ...tabSessionHeader() }
+      });
+      if (!r.ok) {
+        if (r.status === 401) {
+          setError("not signed in");
+          return;
+        }
+        throw new Error(`http_${r.status}`);
+      }
+      setResp(await r.json());
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "load failed");
+    }
+  }, [authOrigin]);
+  React.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const afterChange = React.useCallback(() => {
+    setShowEmailLink(false);
+    setShowBtcLink(false);
+    void refresh();
+    onChange?.();
+  }, [refresh, onChange]);
+  if (error) {
+    return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: panelStyle("warn"), role: "alert", children: [
+      /* @__PURE__ */ jsx(SectionLabel, { tone: "warn", children: "\xA7 identities \xB7 load deferred" }),
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Couldn't reach the auth host (",
+        error,
+        "). Linking is temporarily unavailable; your signed-in identity still works as normal."
+      ] }),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => void refresh(), style: ghostBtnStyle(false), children: "retry" })
+    ] });
+  }
+  if (!resp) {
+    return /* @__PURE__ */ jsx("div", { className, "data-oc-li": "", style: panelStyle(), children: /* @__PURE__ */ jsx("span", { style: hintStyle, children: "loading\u2026" }) });
+  }
+  const linked = resp.linked ?? [];
+  const emailRows = linked.filter((i) => i.kind === "email");
+  const btcRows = linked.filter((i) => i.kind === "btc");
+  const hasEmail = emailRows.some((i) => i.value);
+  const hasBtc = btcRows.some((i) => i.value);
+  const mergedFrom = resp.merged_from ?? [];
+  return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: { display: "grid", gap: 16 }, children: [
+    /* @__PURE__ */ jsxs("div", { style: panelStyle(), children: [
+      /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 what this is" }),
+      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "These are the ways you can sign in to this account. An app you sign in to sees one only if you grant it. Linking a second one is also your way back in: lose one, and the other still signs you in." })
+    ] }),
+    mergedFrom.length > 0 && /* @__PURE__ */ jsx(ConsolidationPanel, { entries: mergedFrom }),
+    /* @__PURE__ */ jsxs("div", { style: panelStyle("plain"), "data-oc-li-rows": "", children: [
+      /* @__PURE__ */ jsx(
+        IdentityGroup,
+        {
+          kind: "email",
+          title: "email",
+          rows: emailRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasEmail ? null : "link an email",
+          onAdd: () => {
+            setShowEmailLink((v) => !v);
+            setShowBtcLink(false);
+          }
+        }
+      ),
+      /* @__PURE__ */ jsx("div", { style: { borderTop: `1px solid ${V.border}` } }),
+      /* @__PURE__ */ jsx(
+        IdentityGroup,
+        {
+          kind: "btc",
+          title: "bitcoin address",
+          rows: btcRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasBtc ? null : "link a Bitcoin address",
+          onAdd: () => {
+            setShowBtcLink((v) => !v);
+            setShowEmailLink(false);
+          }
+        }
+      )
+    ] }),
+    showEmailLink && /* @__PURE__ */ jsx(
+      EmailLinkForm,
+      {
+        authOrigin,
+        onDone: afterChange,
+        onCancel: () => setShowEmailLink(false)
+      }
+    ),
+    showBtcLink && /* @__PURE__ */ jsx(
+      BtcLinkForm,
+      {
+        authOrigin,
+        didOc: resp.did_oc ?? null,
+        onDone: afterChange,
+        onCancel: () => setShowBtcLink(false)
+      }
+    ),
+    hasBtc && attestationLink && /* @__PURE__ */ jsx(AttestationLink, {})
+  ] });
+}
+function IdentityGroup({
+  kind,
+  title,
+  rows,
+  authOrigin,
+  onChange,
+  addCta,
+  onAdd
+}) {
+  if (rows.length === 0) {
+    return /* @__PURE__ */ jsxs("div", { style: rowStyle, children: [
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsxs("div", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          title
+        ] }),
+        /* @__PURE__ */ jsx("div", { style: { ...bodyStyle, marginTop: 4 }, children: "none linked" })
+      ] }),
+      addCta && /* @__PURE__ */ jsxs("button", { type: "button", onClick: onAdd, style: primaryChipStyle, children: [
+        "+ ",
+        addCta
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children: rows.map((r) => /* @__PURE__ */ jsx(
+    IdentityRow,
+    {
+      row: r,
+      kind,
+      authOrigin,
+      onChange
+    },
+    r.id
+  )) });
+}
+function IdentityRow({
+  row,
+  kind,
+  authOrigin,
+  onChange
+}) {
+  const [shown, setShown] = React.useState(false);
+  const [confirming, setConfirming] = React.useState(false);
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+  const masked = row.value ? mask(row.value, kind) : "\u2014 pending recovery \u2014";
+  const display = shown && row.value ? row.value : masked;
+  async function unlink() {
+    if (row.is_primary) return;
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/auth/identities?id=${encodeURIComponent(row.id)}`,
+        { method: "DELETE", credentials: "include" }
+      );
+      if (!r.ok) {
+        const j = await r.json().catch(() => ({}));
+        throw new Error(j.reason ?? `http_${r.status}`);
+      }
+      onChange();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "unlink failed");
+      setBusy(false);
+      setConfirming(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: rowStyle, "data-oc-li-row": kind, children: [
+    /* @__PURE__ */ jsxs("div", { style: { minWidth: 0, flex: 1 }, children: [
+      /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexWrap: "wrap", gap: "4px 12px" }, children: [
+        /* @__PURE__ */ jsxs("span", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          kind === "email" ? "email" : "bitcoin address"
+        ] }),
+        row.is_primary && /* @__PURE__ */ jsx("span", { style: { ...rowLabelStyle, color: V.primary }, children: "primary \xB7 signup-time" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "div",
+        {
+          style: {
+            marginTop: 4,
+            color: V.foreground,
+            fontFamily: SIGNIN_FONT,
+            fontSize: signinSize(12),
+            wordBreak: "break-all"
+          },
+          children: display
+        }
+      ),
+      row.verified_at && /* @__PURE__ */ jsxs("div", { style: { ...hintStyle, marginTop: 4 }, children: [
+        "verified \xB7 ",
+        new Date(row.verified_at).toUTCString()
+      ] }),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err })
+    ] }),
+    /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexShrink: 0, gap: 8, flexWrap: "wrap" }, children: [
+      row.value && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setShown((s) => !s),
+          style: ghostBtnStyle(false),
+          children: shown ? "hide" : "show"
+        }
+      ),
+      !row.is_primary && !confirming && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setConfirming(true),
+          style: dangerBtnStyle(false),
+          children: "unlink"
+        }
+      ),
+      !row.is_primary && confirming && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void unlink(),
+            disabled: busy,
+            style: dangerBtnStyle(busy),
+            children: busy ? "unlinking\u2026" : "confirm unlink"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setConfirming(false),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "cancel"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function ConsolidationPanel({ entries }) {
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("success"), "data-oc-li-consolidated": "", children: [
+    /* @__PURE__ */ jsxs(SectionLabel, { tone: "success", children: [
+      "\xA7 consolidated accounts \xB7 ",
+      entries.length
+    ] }),
+    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+      entries.length === 1 ? "A previous OC account" : "Previous OC accounts",
+      " you signed up with, folded into this one under dual proof of control. Historical activity is unioned into this account automatically;",
+      " ",
+      entries.length === 1 ? "it" : "they",
+      " can no longer sign in."
+    ] }),
+    /* @__PURE__ */ jsx("ul", { style: { listStyle: "none", margin: "12px 0 0", padding: 0 }, children: entries.map((e) => /* @__PURE__ */ jsxs(
+      "li",
+      {
+        style: {
+          display: "flex",
+          flexWrap: "wrap",
+          gap: 8,
+          padding: "8px 0",
+          borderTop: `1px solid ${V.border}`,
+          fontFamily: SIGNIN_FONT,
+          fontSize: signinSize(11)
+        },
+        children: [
+          /* @__PURE__ */ jsx("code", { style: { color: V.foreground, wordBreak: "break-all" }, children: e.did_oc }),
+          /* @__PURE__ */ jsxs("span", { style: { ...hintStyle, marginLeft: "auto" }, children: [
+            "created ",
+            new Date(e.created_at).toLocaleDateString()
+          ] })
+        ]
+      },
+      e.did_oc
+    )) })
+  ] });
+}
+function AttestationLink() {
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle(), "data-oc-li-attest": "", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 portable attestation" }),
+    /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "Make your identity links portable: publish a standard OrangeCheck attestation \u2014 one Bitcoin-wallet signature (BIP-322) binding your address to your handles (Nostr, GitHub, \u2026). It is published to Nostr and verifies with zero trust in OrangeCheck, so it outlives any single service." }),
+    /* @__PURE__ */ jsx(
+      "a",
+      {
+        href: "https://attest.ochk.io/create",
+        target: "_blank",
+        rel: "noreferrer",
+        style: { ...primaryChipStyle, textDecoration: "none", display: "inline-block" },
+        "data-oc-li-attest-link": "",
+        children: "open the attestation builder \u2197"
+      }
+    )
+  ] });
+}
+var ACCOUNT_WAYS_URL = "https://ochk.app/me/account#ways";
+function LinkPromptStep({
+  method,
+  didOc,
+  authOrigin,
+  onResolved
+}) {
+  const what = method === "btc" ? "a Bitcoin address" : "an email";
+  return /* @__PURE__ */ jsxs("div", { "data-oc-linkprompt": method, children: [
+    /* @__PURE__ */ jsxs("div", { style: { ...panelStyle("success"), marginBottom: 16 }, children: [
+      /* @__PURE__ */ jsx(SectionLabel, { tone: "success", children: "\xA7 signed in" }),
+      /* @__PURE__ */ jsxs("p", { style: { ...bodyStyle, margin: 0 }, children: [
+        "You chose to also link ",
+        what,
+        ". Complete it below \u2014 or skip for now; it is entirely optional and changes nothing about the sign-in you just completed."
+      ] })
+    ] }),
+    method === "btc" ? /* @__PURE__ */ jsx(
+      BtcLinkForm,
+      {
+        authOrigin,
+        didOc,
+        onDone: onResolved,
+        onCancel: onResolved
+      }
+    ) : /* @__PURE__ */ jsx(EmailLinkForm, { authOrigin, onDone: onResolved, onCancel: onResolved }),
+    /* @__PURE__ */ jsxs(
+      "div",
+      {
+        "data-oc-linkprompt-skip": "",
+        style: { marginTop: 14, paddingTop: 14, borderTop: `1px solid ${V.border}` },
+        children: [
+          /* @__PURE__ */ jsx("button", { type: "button", onClick: onResolved, style: ghostBtnStyle(false), children: "skip \u2014 I'll do this later" }),
+          /* @__PURE__ */ jsxs("p", { style: { ...hintStyle, marginTop: 8 }, children: [
+            "Changed your mind? Skipping continues you straight on \u2014 your sign-in is unaffected. You can link ",
+            what,
+            " anytime later from your account page,",
+            " ",
+            /* @__PURE__ */ jsx(
+              "a",
+              {
+                href: ACCOUNT_WAYS_URL,
+                target: "_blank",
+                rel: "noreferrer",
+                style: { color: "inherit" },
+                "data-oc-linkprompt-account": "",
+                children: "ochk.app/me/account"
+              }
+            ),
+            "."
+          ] })
+        ]
+      }
+    )
+  ] });
+}
+function EmailLinkForm({
+  authOrigin,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React.useState("email");
+  const [email, setEmail] = React.useState("");
+  const [code, setCode] = React.useState("");
+  const [token, setToken] = React.useState("");
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+  const [transfer, setTransfer] = React.useState(false);
+  async function start() {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email.trim().toLowerCase() })
+      });
+      const j = await r.json();
+      if (!r.ok || !j.token) throw new Error(j.reason ?? `http_${r.status}`);
+      setToken(j.token);
+      setStep("code");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "could not send code");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function verify(confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/email`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          email: email.trim().toLowerCase(),
+          code: code.trim(),
+          token,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "email_linked_elsewhere") {
+        setTransfer(true);
+        setBusy(false);
+        return;
+      }
+      if (handleSudoRequired(j, { purpose: "link an email" })) return;
+      if (isSudoAccountMismatch(j)) {
+        setErr(SUDO_ACCOUNT_MISMATCH_MESSAGE);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "email", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link an email" }),
+    step === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "email",
+          autoComplete: "email",
+          value: email,
+          onChange: (e) => setEmail(e.target.value),
+          placeholder: "you@example.com",
+          style: inputStyle
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void start(),
+            disabled: busy || email.trim().length < 5,
+            style: primaryBtnStyle(busy || email.trim().length < 5),
+            children: busy ? "sending\u2026" : "send code"
+          }
+        ),
+        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : transfer ? /* @__PURE__ */ jsx(
+      TransferConfirm,
+      {
+        what: "email",
+        busy,
+        onConfirm: () => void verify(true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Enter the 6-digit code sent to ",
+        email,
+        "."
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          inputMode: "numeric",
+          autoComplete: "one-time-code",
+          maxLength: 6,
+          value: code,
+          onChange: (e) => setCode(e.target.value.replace(/\D/g, "").slice(0, 6)),
+          placeholder: "123456",
+          style: { ...inputStyle, letterSpacing: "0.3em" }
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void verify(false),
+            disabled: busy || code.length !== 6,
+            style: primaryBtnStyle(busy || code.length !== 6),
+            children: busy ? "linking\u2026" : "verify + link"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setStep("email"),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "back"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function BtcLinkForm({
+  authOrigin,
+  didOc,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React.useState("request");
+  const [addr, setAddr] = React.useState("");
+  const [challenge, setChallenge] = React.useState("");
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+  const [pendingSig, setPendingSig] = React.useState(null);
+  async function getChallenge() {
+    if (!didOc) {
+      setErr("session not loaded yet \xB7 refresh and retry");
+      return;
+    }
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&purpose=link&audience=${encodeURIComponent(didOc)}`
+      );
+      const j = await r.json();
+      if (!r.ok || !j.message) throw new Error(j.reason ?? `http_${r.status}`);
+      setChallenge(j.message);
+      setStep("sign");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "challenge failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function postLink(sig, confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/btc`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          message: challenge,
+          signature: sig,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "address_linked_elsewhere") {
+        setPendingSig(sig);
+        setBusy(false);
+        return;
+      }
+      if (handleSudoRequired(j, { purpose: "link a Bitcoin address" })) return;
+      if (isSudoAccountMismatch(j)) {
+        setErr(SUDO_ACCOUNT_MISMATCH_MESSAGE);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "btc", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link a Bitcoin address" }),
+    step === "request" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "Enter a Bitcoin address you control. We generate a challenge and your wallet signs it (BIP-322)." }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: addr,
+          onChange: (e) => setAddr(e.target.value.trim()),
+          placeholder: "bc1q\u2026",
+          autoCapitalize: "none",
+          spellCheck: false,
+          style: { ...inputStyle, fontFamily: SIGNIN_FONT }
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void getChallenge(),
+            disabled: busy || addr.length < 14,
+            style: primaryBtnStyle(busy || addr.length < 14),
+            children: busy ? "requesting\u2026" : "get challenge"
+          }
+        ),
+        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : pendingSig ? /* @__PURE__ */ jsx(
+      TransferConfirm,
+      {
+        what: "bitcoin address",
+        busy,
+        onConfirm: () => void postLink(pendingSig, true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Sign the challenge with the wallet that controls",
+        " ",
+        /* @__PURE__ */ jsx("span", { style: { fontFamily: SIGNIN_FONT, wordBreak: "break-all" }, children: addr }),
+        "."
+      ] }),
+      /* @__PURE__ */ jsx(
+        LazyWalletButton,
+        {
+          address: addr,
+          message: challenge,
+          showManual: true,
+          layout: "list",
+          heading: null,
+          onSigned: (sig) => void postLink(sig, false),
+          onError: (e) => setErr(e?.message ?? "wallet rejected")
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsx(FormButtons, { children: /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => {
+            setStep("request");
+            setErr(null);
+          },
+          disabled: busy,
+          style: ghostBtnStyle(busy),
+          children: "back"
+        }
+      ) })
+    ] })
+  ] });
+}
+function TransferConfirm({
+  what,
+  busy,
+  onConfirm,
+  onCancel,
+  err
+}) {
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+      "This ",
+      what,
+      " is already linked to another OrangeCheck account. You've just proven control of it \u2014 you can transfer the link to this account under dual proof of control. The other account loses this sign-in path; its history stays verifiable. Continue?"
+    ] }),
+    err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+    /* @__PURE__ */ jsxs(FormButtons, { children: [
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: onConfirm,
+          disabled: busy,
+          style: dangerBtnStyle(busy),
+          children: busy ? "transferring\u2026" : "transfer link here"
+        }
+      ),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, disabled: busy, style: ghostBtnStyle(busy), children: "cancel" })
+    ] })
+  ] });
+}
+function LazyWalletButton(props) {
+  const [Comp, setComp] = React.useState(null);
+  const [failed, setFailed] = React.useState(false);
+  React.useEffect(() => {
+    let alive = true;
+    import("@orangecheck/wallet-adapter/react").then((m) => {
+      if (alive) {
+        setComp(
+          () => m.OcWalletButton
+        );
+      }
+    }).catch(() => {
+      if (alive) setFailed(true);
+    });
+    return () => {
+      alive = false;
+    };
+  }, []);
+  if (failed) {
+    return /* @__PURE__ */ jsx(ErrorLine, { children: "could not load wallet support \xB7 refresh to try again" });
+  }
+  if (!Comp) return /* @__PURE__ */ jsx("span", { style: hintStyle, children: "loading wallet options\u2026" });
+  return /* @__PURE__ */ jsx(Comp, { ...props });
+}
+function mask(value, kind) {
+  if (kind === "email") {
+    const [user, host] = value.split("@");
+    if (!user || !host) return "\u2022\u2022\u2022\u2022";
+    const m = user.length <= 2 ? "\u2022".repeat(user.length) : user[0] + "\u2022".repeat(user.length - 2) + user.slice(-1);
+    return `${m}@${host}`;
+  }
+  if (value.length <= 12) return "\u2022".repeat(value.length);
+  return `${value.slice(0, 6)}\u2026${value.slice(-4)}`;
+}
+function SectionLabel({
+  children,
+  tone = "primary"
+}) {
+  const color = tone === "success" ? V.success : tone === "warn" ? V.warn : V.primary;
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      style: {
+        color,
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinSize(10),
+        letterSpacing: signinTracking("0.18em"),
+        textTransform: SIGNIN_CASE,
+        marginBottom: 8
+      },
+      children
+    }
+  );
+}
+function ErrorLine({ children }) {
+  return /* @__PURE__ */ jsx(
+    "p",
+    {
+      role: "alert",
+      style: {
+        margin: "8px 0 0",
+        color: V.destructive,
+        fontFamily: SIGNIN_FONT,
+        fontSize: signinSize(11)
+      },
+      children
+    }
+  );
+}
+function FormButtons({ children }) {
+  return /* @__PURE__ */ jsx("div", { style: { display: "flex", flexWrap: "wrap", gap: 8, marginTop: 12 }, children });
+}
+var V = {
+  primary: "var(--primary, #f97316)",
+  foreground: "var(--foreground, #fafafa)",
+  muted: "var(--muted-foreground, #a1a1aa)",
+  background: "var(--background, #0a0a0a)",
+  card: "var(--card, #111113)",
+  border: "var(--border, #27272a)",
+  destructive: "var(--destructive, #ef4444)",
+  success: "var(--success, #22c55e)",
+  warn: "var(--warning, #eab308)"
+};
+function panelStyle(tone = "default") {
+  const base = {
+    background: V.card,
+    border: `1px solid ${V.border}`,
+    padding: "1.25rem"
+  };
+  if (tone === "plain") return { ...base, padding: 0 };
+  if (tone === "accent") return { ...base, borderColor: V.primary, background: "var(--card, #111113)" };
+  if (tone === "success") return { ...base, borderColor: V.success };
+  if (tone === "warn") return { ...base, borderColor: V.warn };
+  return base;
+}
+var bodyStyle = {
+  color: V.muted,
+  fontSize: 13,
+  lineHeight: 1.55,
+  margin: "0 0 12px"
+};
+var hintStyle = {
+  color: V.muted,
+  fontFamily: SIGNIN_FONT,
+  fontSize: signinSize(10.5),
+  opacity: 0.8
+};
+var rowStyle = {
+  display: "flex",
+  flexWrap: "wrap",
+  alignItems: "center",
+  justifyContent: "space-between",
+  gap: 12,
+  padding: "1rem"
+};
+var rowLabelStyle = {
+  color: V.foreground,
+  fontFamily: SIGNIN_FONT,
+  fontSize: signinSize(10.5),
+  letterSpacing: signinTracking("0.12em"),
+  textTransform: SIGNIN_CASE,
+  opacity: 0.8
+};
+var inputStyle = {
+  width: "100%",
+  padding: "0.55rem 0.75rem",
+  background: V.background,
+  color: V.foreground,
+  border: `1px solid ${V.border}`,
+  borderRadius: signinRadius(6),
+  fontFamily: SIGNIN_FONT,
+  // 16px — never lower · suppresses iOS Safari focus auto-zoom.
+  fontSize: 16,
+  boxSizing: "border-box"
+};
+function btnBase(disabled) {
+  return {
+    padding: "0.5rem 0.875rem",
+    borderRadius: SIGNIN_BUTTON_RADIUS,
+    fontFamily: SIGNIN_FONT,
+    fontSize: signinSize(10.5),
+    letterSpacing: signinTracking("0.12em"),
+    textTransform: SIGNIN_CASE,
+    cursor: disabled ? "not-allowed" : "pointer",
+    opacity: disabled ? 0.5 : 1
+  };
+}
+function primaryBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.primary,
+    color: "var(--primary-foreground, #0a0a0a)",
+    border: `1px solid ${V.primary}`,
+    fontWeight: 600
+  };
+}
+function ghostBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.background,
+    color: V.foreground,
+    border: `1px solid ${V.border}`
+  };
+}
+function dangerBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: "transparent",
+    color: V.destructive,
+    border: `1px solid ${V.destructive}`
+  };
+}
+var primaryChipStyle = {
+  ...btnBase(false),
+  background: "transparent",
+  color: V.primary,
+  border: `1px solid ${V.primary}`
+};
+
+export {
+  fetchOcLinkedIdentities,
+  OcLinkedIdentities,
+  LinkPromptStep,
+  LazyWalletButton,
+  SectionLabel,
+  ErrorLine,
+  FormButtons,
+  V,
+  panelStyle,
+  bodyStyle,
+  hintStyle,
+  inputStyle,
+  primaryBtnStyle,
+  ghostBtnStyle,
+  dangerBtnStyle
+};
+//# sourceMappingURL=chunk-UFRU3I3D.mjs.map