@orangecheck/auth-client 2.36.0 → 2.37.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/dist/address.mjs +7 -0
  2. package/dist/address.mjs.map +1 -0
  3. package/dist/bond.mjs +3 -2
  4. package/dist/{chunk-HOCQ722N.mjs → chunk-BMMNHG74.mjs} +5 -2
  5. package/dist/chunk-BMMNHG74.mjs.map +1 -0
  6. package/dist/{chunk-NCJZBLNF.mjs → chunk-EFMTFRCS.mjs} +6 -3
  7. package/dist/chunk-EFMTFRCS.mjs.map +1 -0
  8. package/dist/chunk-U7IUGDLW.mjs +10 -0
  9. package/dist/chunk-U7IUGDLW.mjs.map +1 -0
  10. package/dist/{chunk-FZ6RPWWR.mjs → chunk-VOO5KQQW.mjs} +25 -10
  11. package/dist/chunk-VOO5KQQW.mjs.map +1 -0
  12. package/dist/index.js +26 -10
  13. package/dist/index.js.map +1 -1
  14. package/dist/index.mjs +13 -12
  15. package/dist/linked-identities.mjs +2 -1
  16. package/dist/signin.mjs +3 -2
  17. package/package.json +2 -1
  18. package/dist/chunk-FZ6RPWWR.mjs.map +0 -1
  19. package/dist/chunk-HOCQ722N.mjs.map +0 -1
  20. package/dist/chunk-NCJZBLNF.mjs.map +0 -1
package/dist/chunk-VOO5KQQW.mjs.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/signin.tsx"],"sourcesContent":["/**\n * @orangecheck/auth-client · OcSignIn\n *\n * In-place dual-path signin component for every `X.ochk.io` consumer site.\n * Calls the cross-subdomain auth host (`ochk.io`) via family-CORS so the\n * `.ochk.io` session cookie lands without any redirect.\n *\n * Two paths, one component:\n *\n * 1. Bitcoin wallet · BIP-322\n * - Paste address, in-page wallet extension signs a challenge\n * - POSTs { message, signature, expectedNonce, expectedAudience,\n * expectedPurpose } to ochk.io/api/auth/signin\n * - Identity is `did:oc:<rand>` linked to the BTC address\n *\n * 2. Email · OTP\n * - Enter email → ochk.io/api/auth/email-otp/start delivers a code\n * - Enter code → ochk.io/api/auth/email-otp/verify lands the cookie\n * - Identity is `did:oc:<rand>`. No wallet is created here: a Fedimint\n * wallet is provisioned client-side on first /me visit, and its sats\n * are held by the FEDERATION'S GUARDIANS — not by OrangeCheck, which\n * coordinates and never custodies (see oc-www's email-otp/verify\n * route). Naming the custodian is family invariant 8; the old wording\n * here and in the form copy said \"a custodial wallet\" with no subject,\n * which reads as OC holding it and contradicts the charter.\n *\n * **Both paths resolve to the same did:oc canonical identity** via the\n * auth host's account-linking logic — a user who started with email can\n * later link their BTC address (and vice versa). One identity, two doors,\n * persistent across every family subdomain.\n *\n * On success, the component **hard-navigates** (window.location.assign)\n * rather than calling onSuccess + relying on the consumer to route. This\n * is non-negotiable: OcSessionProvider does not auto-refetch /api/auth/me\n * on client-side route changes, so a soft redirect leaves it with stale\n * `status: 'anonymous'`. Hard nav forces the provider to remount with\n * the fresh cookie. Override via onSuccess if you must.\n */\n\nimport * as React from 'react';\n\nimport { addressInputValue } from './address';\nimport { LinkPromptStep } from './linked-identities';\nimport { stripFragment } from './return-to';\nimport { clearTabSession } from './tab-session';\nimport type { OcAccount } from './types';\nimport {\n SIGNIN_ARROW,\n SIGNIN_BUTTON_RADIUS,\n SIGNIN_CASE,\n SIGNIN_FONT,\n SIGNIN_STRONG,\n signinRadius,\n signinRoleSize,\n signinSize,\n signinTracking,\n} from './appearance';\n\n/* --- props --- */\n\ninterface OcSignInBaseProps {\n /**\n * Consumer-site audience URL passed as `expectedAudience` on the\n * BIP-322 challenge. e.g. `'https://vault.ochk.io'`. Required —\n * the challenge nonce is bound to this audience.\n */\n audience: string;\n /**\n * Where to navigate after success. Defaults to `'/'`.\n * Open-redirect-safe: a same-origin path (must start with `/`, NOT\n * `//`) or an absolute `https://` URL on `ochk.io` / `*.ochk.io` —\n * the add-another-account flow starts on a consumer subdomain and\n * must round-trip back to it, including through the OAuth provider\n * hop. Anything else is ignored. When omitted, the component reads\n * `?return_to=` (or `?next=`) from the page URL — so the auth\n * host's `/signin?add=1&return_to=…` entry point Just Works, the\n * same way the `add` prop auto-detects `?add=1`.\n */\n returnTo?: string;\n /**\n * Override the default hard-navigation behavior. When provided,\n * called with the account and the session JWT. The component will\n * NOT navigate — the caller is responsible. Use for custom\n * post-signin routing — e.g. /popup/signin postMessages\n * `{ account, token }` to its opener so a cross-domain integrator\n * (different eTLD+1 from .ochk.io, which the HttpOnly cookie can't\n * reach) can verify the session via JWKS.\n */\n onSuccess?: (account: OcAccount, token?: string) => void;\n /**\n * Async post-success routing. When provided (and `onSuccess` is\n * not), the component awaits `resolveReturnTo(account)` and\n * hard-navigates to the result instead of the static `returnTo`.\n *\n * This is the seam that lets a site keep persona-aware routing\n * without forking the ceremony — e.g. me.ochk.io resolves\n * `/api/me/intent` and routes to `/me/developer` | `/me/operator`\n * | `/me`. The returned value is open-redirect-checked exactly\n * like `returnTo` (same-origin paths only); on a resolver throw\n * the component falls back to the static `returnTo`.\n */\n resolveReturnTo?: (account: OcAccount) => string | Promise<string>;\n /**\n * Override the auth host. Defaults to `'https://ochk.io'`. For\n * preview / dev / staging only.\n */\n authOrigin?: string;\n /**\n * Initial visible tab. Defaults to `'email'` (since {@link providersFirst}\n * is on by default); resolves to `'wallet'` only when\n * `providersFirst={false}` and this is left unspecified.\n */\n initialPath?: 'wallet' | 'email';\n /**\n * Re-order the ceremony so the third-party providers (Google / GitHub)\n * render **above** the wallet + email panel, and the email path is the\n * default active tab. **On by default — the family standard.** A\n * first-time, non-Bitcoiner visitor sees the most familiar on-ramp\n * (Google / GitHub / email one-time code) first; the BIP-322 wallet path\n * stays one tab away, reframed as the most-sovereign option.\n *\n * Pass `providersFirst={false}` for the legacy bitcoin-first ordering.\n * Honors family rule #3 — email / OAuth is the easy bridge, the Bitcoin\n * address remains the canonical identity it resolves to.\n */\n providersFirst?: boolean;\n /**\n * Disable one of the two paths. Default is both enabled.\n * Useful for B2B-only sites that don't want to expose email-OTP.\n */\n paths?: { wallet?: boolean; email?: boolean };\n /**\n * Whether to show the \"also link my other identity\" checkbox on the\n * sign-in form. **On by default.** The checkbox is optional and\n * unchecked by default; it is shown on both the wallet and email\n * paths. If the user ticks it, the complementary identity's link\n * ceremony (BIP-322 for a wallet, OTP for an email) runs inline\n * immediately after a successful sign-in — before `onSuccess` /\n * `returnTo`, so it composes with custom routing — because the\n * sign-in just proved one credential and the link ceremony proves\n * the second. Pass `linkPrompt={false}` to omit the checkbox.\n */\n linkPrompt?: boolean;\n /**\n * Multi-account · when `true`, the sign-in is performed in \"add\"\n * mode: the resulting session is appended to the browser's existing\n * roster instead of replacing it. The previously-active account\n * stays signed in and remains a switch target on the auth host. Off\n * by default (back-compat). The component also reads `?add=1` from\n * the URL search params and treats it the same — so the auth host's\n * `/signin?add=1` entry point Just Works without any extra prop.\n *\n * The `add` flag is forwarded as a body field to the host's\n * `/api/auth/signin` and `/api/auth/email-otp/verify`; if the host\n * hasn't deployed the multi-account migration yet it silently\n * ignores the field and the call falls back to ordinary signin.\n */\n add?: boolean;\n /** className for the outer container. */\n className?: string;\n}\n\n/**\n * Where the ceremony's session goes.\n *\n * `family` (default): a `*.ochk.io` site. The auth host sets the shared\n * `.ochk.io` cookie and the component navigates.\n *\n * `first-party`: orangecheck's own site on another domain (ochk.app). Every\n * call to the auth host omits credentials, so the family cookie is neither\n * sent nor set; the host answers with a token bound to `audience`, handed to\n * `onSuccess` for the site to turn into its own cookie. No add-account or\n * link prompts (there is no family session to add to), and provider buttons\n * appear only when `providerHref` says where the site starts each one.\n */\nexport type OcSignInProps = OcSignInBaseProps &\n (\n | { mode?: 'family'; providerHref?: undefined }\n | {\n mode: 'first-party';\n onSuccess: (account: OcAccount, token?: string) => void;\n /** The site's own start URL for a provider (`google`, `github`). */\n providerHref?: (providerId: string) => string;\n }\n );\n\n/* --- shared types --- */\n\ninterface SigninJsonOk {\n ok: true;\n account: OcAccount;\n /**\n * The session JWT, echoed alongside the `Set-Cookie`. Cross-domain\n * integrators capture this to verify the session via JWKS — the\n * HttpOnly `.ochk.io` cookie never reaches their origin. Family\n * `.ochk.io` sites ignore it and rely on the cookie.\n */\n token?: string;\n}\n\ninterface SigninJsonErr {\n ok?: false;\n reason?: string;\n error?: string;\n issues?: unknown;\n}\n\ntype SigninJson = SigninJsonOk | SigninJsonErr;\n\n/* --- helpers --- */\n\n/**\n * A relative path is same-origin only if it RESOLVES to this origin.\n *\n * Prefix checks are not enough. `startsWith('/') && !startsWith('//')` accepts\n * `/\\evil.example`, and the WHATWG URL parser treats a backslash as a slash in\n * special schemes, so the browser resolves it to `https://evil.example/`:\n *\n * new URL('/\\evil.example', 'https://attest.ochk.io').href\n * -> 'https://evil.example/'\n *\n * Since hardNavigate() below hands its argument to window.location.assign,\n * that was a post-authentication open redirect on every consumer of this\n * package — the user completes a real sign-in on a real ochk.io domain and\n * lands on an attacker's page. `\\t`, `\\n` and `\\r` are stripped by the parser\n * too, so `/\\t/evil.example` is the same trick with different bytes.\n *\n * So instead of blacklisting characters, resolve and compare: whatever the URL\n * parser makes of the input is what the browser will navigate to, and that is\n * the thing that has to be same-origin.\n */\nfunction isSameOriginPath(candidate: string, origin: string): boolean {\n try {\n return new URL(candidate, origin).origin === origin;\n } catch {\n return false;\n }\n}\n\n/** Origin to resolve relative candidates against. Any absolute https origin\n * works for the comparison; on the server there is no window to read. */\nfunction resolutionOrigin(): string {\n return typeof window === 'undefined' ? 'https://ochk.io' : window.location.origin;\n}\n\nexport function safeReturnTo(input: string | undefined): string {\n const candidate = input ?? '/';\n if (typeof candidate !== 'string') return '/';\n if (!candidate.startsWith('/')) return '/';\n return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : '/';\n}\n\n/**\n * Family-aware return target. Accepts a same-origin relative path\n * (exactly like {@link safeReturnTo}) OR an absolute `https://` URL on\n * `ochk.io` / `*.ochk.io` — mirroring the auth host's own post-signin\n * redirect allowlist. Returns `undefined` when the input is neither, so\n * callers can layer fallbacks.\n */\nexport function familyReturnTarget(input: string | undefined | null): string | undefined {\n if (typeof input !== 'string' || input.length === 0) return undefined;\n // Same-origin relative path — resolved, not prefix-matched. See\n // isSameOriginPath for why `/\\evil.example` defeated the old check.\n if (input.startsWith('/') && isSameOriginPath(input, resolutionOrigin())) {\n return input;\n }\n try {\n const u = new URL(input);\n if (u.protocol !== 'https:') return undefined;\n const host = u.hostname.toLowerCase();\n if (host === 'ochk.io' || host.endsWith('.ochk.io')) return u.toString();\n } catch {\n // not an absolute URL either\n }\n return undefined;\n}\n\nfunction hardNavigate(target: string): void {\n if (typeof window === 'undefined') return;\n window.location.assign(target);\n}\n\n/* --- failures people can act on --- */\n\n/**\n * The auth host answers with machine reasons. Its /api/auth/signin says it\n * exposes them \"so the /signin UI can give an actionable message\", and this\n * form printed them verbatim instead: typing \"hello\" as an address showed\n * `bad_request`. Each reason maps to what happened and what to do next.\n */\nconst SIGNIN_ERRORS: Record<string, string> = {\n bad_request: \"That doesn't look like a Bitcoin address.\",\n invalid_challenge:\n \"That signature doesn't match this address. Sign with the wallet that holds it.\",\n sig_invalid: \"That signature doesn't match this address. Sign with the wallet that holds it.\",\n sig_unsupported_scheme:\n \"We can't check this wallet's signature format yet. Try another wallet, or use email.\",\n expired: 'That request timed out. Try again for a fresh one.',\n not_yet_valid: 'That request is not valid yet. Check your device clock, then try again.',\n nonce_mismatch: \"That request didn't match. Try again for a fresh one.\",\n audience_mismatch: \"That request didn't match this site. Reload the page and try again.\",\n purpose_mismatch: \"That request didn't match. Try again for a fresh one.\",\n malformed: \"That signature couldn't be read. Copy it again, whole.\",\n cross_site_blocked: 'Your browser blocked this request. Reload the page and try again.',\n rate_limited: 'Too many tries. Wait a minute, then try again.',\n invalid_email: \"That email address doesn't look right.\",\n mailer_unavailable: \"We couldn't send the email right now. Try again in a minute.\",\n mailer_error: \"We couldn't send the email right now. Try again in a minute.\",\n wrong_code: \"That code isn't right. Check the newest email from us.\",\n replay: 'That code was already used. Send a new one.',\n invalid_token: 'That code is no longer valid. Send a new one.',\n email_mismatch: 'That code was sent to a different address. Send a new one.',\n};\n\nconst EMAIL_ERRORS: Record<string, string> = {\n expired: 'That code expired. Send a new one.',\n};\n\n/**\n * `bad_request` means the host's body schema failed. Fetching a challenge\n * that is the address; submitting a signature it is the pasted signature\n * (under 10 characters, say), which is not an address problem at all.\n */\nconst SUBMIT_ERRORS: Record<string, string> = {\n bad_request: \"That signature couldn't be read. Copy it again, whole.\",\n};\n\n/** The auth host by name, so an outage reads as theirs and not the page's. */\nexport function networkError(authOrigin: string): string {\n let host = authOrigin;\n try {\n host = new URL(authOrigin).host;\n } catch {\n // not a URL: name it as given\n }\n return `We couldn't reach the orangecheck sign-in service at ${host}. Check your connection, then try again.`;\n}\n\nexport function humanSigninError(\n reason: string,\n path: 'wallet' | 'email',\n step: 'challenge' | 'submit' = 'challenge'\n): string {\n // A reason that is not a code is already a sentence.\n if (!/^[a-z0-9_]+$/.test(reason)) return reason;\n if (path === 'wallet' && step === 'submit' && SUBMIT_ERRORS[reason]) return SUBMIT_ERRORS[reason];\n if (path === 'email' && EMAIL_ERRORS[reason]) return EMAIL_ERRORS[reason];\n return (\n SIGNIN_ERRORS[reason] ??\n (path === 'email'\n ? \"That didn't work. Try again, or send a new code.\"\n : \"That didn't work. Try again.\")\n );\n}\n\n/**\n * A failed fetch (\"Failed to fetch\") or an HTML error page parsed as JSON\n * (a SyntaxError) is not prose meant for a person; everything else thrown\n * here carries a host reason code. A wallet's failure never comes here.\n */\nfunction failureMessage(\n err: unknown,\n path: 'wallet' | 'email',\n step: 'challenge' | 'submit',\n authOrigin: string\n): string {\n if (err instanceof TypeError || err instanceof SyntaxError) return networkError(authOrigin);\n return humanSigninError(err instanceof Error ? err.message : 'failed', path, step);\n}\n\nconst BECH32_ADDRESS = /^(bc1|tb1|bcrt1)[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{8,87}$/i;\nconst BASE58_ADDRESS = /^[123mn][1-9A-HJ-NP-Za-km-z]{25,34}$/;\n\n/**\n * Shape check only, so a typo fails here with a clear message instead of\n * fetching a challenge for it and then blaming a missing wallet extension.\n * The host still verifies the signature against the real address.\n */\nexport function looksLikeBitcoinAddress(input: string): boolean {\n const s = input.trim();\n // BIP-173: bech32 is all lowercase or all uppercase, never mixed.\n if (BECH32_ADDRESS.test(s)) return s === s.toLowerCase() || s === s.toUpperCase();\n return BASE58_ADDRESS.test(s);\n}\n\n/* --- main component --- */\n\n/** Provider refusals whose way back in is an email code. */\nconst OAUTH_EMAIL_CODE_REASONS = new Set(['email_code_required', 'account_mismatch']);\n\n/** What a refused provider sign-in (`?oauth_error=`) says to the person. */\nfunction oauthErrorText(reason: string): string {\n if (reason === 'email_code_required') {\n return 'This email already has an orangecheck account. Sign in to it with an email code below.';\n }\n if (reason === 'account_mismatch') {\n return 'A different Google or GitHub account is already linked to this email. Use that one, or sign in with an email code below.';\n }\n return \"That sign-in didn't finish. Try again, or use another way below.\";\n}\n\nexport function OcSignIn({\n audience,\n returnTo,\n onSuccess,\n resolveReturnTo,\n linkPrompt: linkPromptProp = true,\n add: addProp,\n authOrigin = 'https://ochk.io',\n initialPath,\n providersFirst = true,\n paths,\n className,\n mode,\n providerHref,\n}: OcSignInProps): React.ReactElement {\n const walletEnabled = paths?.wallet ?? true;\n const emailEnabled = paths?.email ?? true;\n const firstParty = mode === 'first-party';\n // First-party: the family cookie must be neither sent nor set.\n const credentials: RequestCredentials = firstParty ? 'omit' : 'include';\n const linkPrompt = linkPromptProp && !firstParty;\n\n // Return target · prop wins; otherwise honor `?return_to=` / `?next=`\n // from the URL — the auth host's `/signin?add=1&return_to=…` entry\n // point needs the OAuth provider hop to carry the same target the\n // embedding page honors (the add-another-account fix: a vault user\n // adding an account via Google must land back on vault, not on the\n // host's homepage). Absolute https://*.ochk.io URLs are allowed;\n // everything else clamps to `/`.\n const [resolvedReturn, setResolvedReturn] = React.useState<string>(\n () => familyReturnTarget(returnTo) ?? safeReturnTo(returnTo)\n );\n React.useEffect(() => {\n const fromProp = familyReturnTarget(returnTo);\n if (fromProp) {\n setResolvedReturn(fromProp);\n return;\n }\n if (typeof window === 'undefined') return;\n const q = new URLSearchParams(window.location.search);\n const fromQuery =\n familyReturnTarget(q.get('return_to')) ?? familyReturnTarget(q.get('next'));\n setResolvedReturn(fromQuery ?? '/');\n }, [returnTo]);\n\n // Multi-account · prop wins; otherwise honor `?add=1` from the URL\n // so the auth host's /signin?add=1 entry point doesn't need any\n // extra wiring on every consumer's sign-in page.\n const [addMode, setAddMode] = React.useState<boolean>(Boolean(addProp) && !firstParty);\n React.useEffect(() => {\n if (typeof window === 'undefined') return;\n if (firstParty) {\n setAddMode(false);\n return;\n }\n if (addProp !== undefined) {\n setAddMode(Boolean(addProp));\n return;\n }\n setAddMode(new URLSearchParams(window.location.search).get('add') === '1');\n }, [addProp, firstParty]);\n\n // When providers lead the ceremony (ochk.io homepage), the email path\n // is the friendlier default tab; otherwise the canonical bitcoin-first\n // default holds. An explicit `initialPath` always wins.\n const [path, setPath] = React.useState<'wallet' | 'email'>(\n initialPath ?? (providersFirst ? 'email' : 'wallet')\n );\n // The two methods are one tablist: one Tab stop, arrows and Home/End move\n // between them, and moving selects (both are always offered).\n const tabsId = React.useId();\n const tabOrder: Array<'wallet' | 'email'> = providersFirst\n ? ['email', 'wallet']\n : ['wallet', 'email'];\n const tabRefs = React.useRef<Partial<Record<'wallet' | 'email', HTMLButtonElement | null>>>({});\n const onTabKey = (e: React.KeyboardEvent<HTMLButtonElement>) => {\n const i = tabOrder.indexOf(path);\n const last = tabOrder.length - 1;\n const to =\n e.key === 'ArrowRight' ? (i + 1) % tabOrder.length\n : e.key === 'ArrowLeft' ? (i + last) % tabOrder.length\n : e.key === 'Home' ? 0\n : e.key === 'End' ? last\n : -1;\n if (to < 0) return;\n e.preventDefault();\n const next = tabOrder[to]!;\n setPath(next);\n tabRefs.current[next]?.focus();\n };\n // Set once sign-in succeeds and the account is missing its\n // complementary identity — the component then renders the focused\n // link step (LinkPromptStep) before running `proceed`.\n const [signedIn, setSignedIn] = React.useState<{\n method: 'btc' | 'email';\n didOc: string;\n proceed: () => void;\n } | null>(null);\n // The optional \"also link my other identity\" checkbox on the form.\n const [linkAlso, setLinkAlso] = React.useState(false);\n // Set when the user is bounced back here after a failed provider\n // (e.g. Google) sign-in — the auth host redirects to\n // `/signin?oauth_error=…`.\n const [oauthError, setOauthError] = React.useState<string | null>(null);\n React.useEffect(() => {\n if (typeof window === 'undefined') return;\n const reason = new URLSearchParams(window.location.search).get('oauth_error');\n if (reason === null) return;\n setOauthError(reason);\n // The way back in is an email code, so open on it.\n if (OAUTH_EMAIL_CODE_REASONS.has(reason) && emailEnabled) setPath('email');\n }, [emailEnabled]);\n\n const navigate = React.useCallback(\n async (account: OcAccount) => {\n if (resolveReturnTo) {\n try {\n const resolved = familyReturnTarget(await resolveReturnTo(account));\n hardNavigate(resolved ?? resolvedReturn);\n return;\n } catch {\n // resolver failed — fall through to the static returnTo\n }\n }\n hardNavigate(resolvedReturn);\n },\n [resolveReturnTo, resolvedReturn]\n );\n\n const handleSuccess = React.useCallback(\n async (account: OcAccount, token: string | undefined, via: 'wallet' | 'email') => {\n // The post-sign-in handoff — custom `onSuccess`, else navigation.\n const proceed = () => {\n // Per-tab · the user just completed a ceremony IN this tab —\n // it must adopt the new identity, not keep a stale pin.\n clearTabSession();\n if (onSuccess) onSuccess(account, token);\n else void navigate(account);\n };\n\n // Linking is opt-in via the form checkbox. Unchecked (or the\n // checkbox suppressed) → ordinary sign-in.\n if (!linkPrompt || !linkAlso) {\n proceed();\n return;\n }\n\n // Checked: run the complementary identity's link ceremony now.\n // /api/auth/me resolves the did:oc the BIP-322 link challenge is\n // bound to; a failure here must not strand the signed-in user.\n try {\n const meRes = await fetch(`${authOrigin}/api/auth/me`, {\n credentials: 'include',\n headers: { Accept: 'application/json' },\n });\n const me = meRes.ok\n ? ((await meRes.json()) as { account?: { did_oc?: string } })\n : null;\n const didOc = me?.account?.did_oc;\n if (didOc) {\n setSignedIn({\n method: via === 'email' ? 'btc' : 'email',\n didOc,\n proceed,\n });\n return;\n }\n } catch {\n // /api/auth/me unreachable — proceed without the link step.\n }\n proceed();\n },\n [onSuccess, linkPrompt, linkAlso, navigate, authOrigin]\n );\n\n if (!walletEnabled && !emailEnabled) {\n return (\n <div\n className={className}\n data-oc-signin=\"\"\n style={{\n padding: '1rem',\n border: '1px solid var(--border, #27272a)',\n color: 'var(--foreground, #fafafa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinSize(12),\n }}\n >\n no signin paths enabled — set <code>paths.wallet</code> or{' '}\n <code>paths.email</code> to <code>true</code>\n </div>\n );\n }\n\n if (signedIn) {\n return (\n <div className={className} data-oc-signin=\"\">\n <LinkPromptStep\n method={signedIn.method}\n didOc={signedIn.didOc}\n authOrigin={authOrigin}\n onResolved={signedIn.proceed}\n />\n </div>\n );\n }\n\n const showWallet = walletEnabled && (path === 'wallet' || !emailEnabled);\n const showEmail = emailEnabled && (path === 'email' || !walletEnabled);\n const bothEnabled = walletEnabled && emailEnabled;\n // The method the user will actually sign in with — the active tab,\n // clamped when only one path is enabled. Drives the checkbox wording.\n const activeMethod: 'wallet' | 'email' = !emailEnabled\n ? 'wallet'\n : !walletEnabled\n ? 'email'\n : path;\n\n return (\n <div className={className} data-oc-signin=\"\">\n {oauthError && (\n <div\n data-oc-signin-oauth-error=\"\"\n style={{\n marginBottom: 14,\n padding: '0.6rem 0.75rem',\n border: '1px solid var(--destructive, #ef4444)',\n borderRadius: signinRadius(6),\n color: 'var(--destructive, #ef4444)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('text', signinSize(11)),\n }}\n >\n {oauthErrorText(oauthError)}\n </div>\n )}\n {addMode && (\n <div\n data-oc-signin-add-mode=\"\"\n style={{\n marginBottom: 14,\n padding: '0.6rem 0.75rem',\n border: '1px solid var(--primary, #f97316)',\n borderLeftWidth: 3,\n borderRadius: signinRadius(4),\n background: 'color-mix(in srgb, var(--primary, #f97316) 8%, transparent)',\n color: 'var(--foreground, #fafafa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('text', signinSize(11)),\n lineHeight: 1.6,\n }}\n >\n <strong\n style={{\n color: 'var(--primary, #f97316)',\n letterSpacing: signinTracking('0.12em'),\n textTransform: SIGNIN_CASE,\n fontSize: signinSize(10),\n display: 'block',\n marginBottom: 3,\n }}\n >\n § adding another account\n </strong>\n Your current OrangeCheck account stays signed in. The new account joins your\n browser&apos;s roster; you can switch between them anytime from the account\n menu.\n </div>\n )}\n {/* Providers-first (ochk.io homepage): the familiar Google /\n GitHub on-ramp leads, with the wallet/email panel below the\n divider. Everywhere else this block stays at the bottom. */}\n {providersFirst && (\n <ProviderSignIn\n authOrigin={authOrigin}\n returnTo={resolvedReturn}\n add={addMode}\n credentials={credentials}\n firstParty={firstParty}\n providerHref={providerHref}\n first\n />\n )}\n {bothEnabled && (\n <div\n role=\"tablist\"\n aria-label=\"Sign-in method\"\n data-oc-signin-tabs=\"\"\n style={{\n display: 'flex',\n gap: 8,\n marginBottom: 16,\n borderBottom: '1px solid var(--border, #27272a)',\n }}\n >\n {/* When providers lead, the easy email path reads first\n and the wallet path sits beside it as the upgrade. */}\n {tabOrder.map((p) => (\n <SigninTab\n key={p}\n id={`${tabsId}-${p}`}\n controls={`${tabsId}-panel`}\n active={path === p}\n onClick={() => setPath(p)}\n onKeyDown={onTabKey}\n ref={(el) => {\n tabRefs.current[p] = el;\n }}\n >\n {p === 'email' ? 'Email' : 'Bitcoin wallet'}\n </SigninTab>\n ))}\n </div>\n )}\n\n <div\n data-oc-signin-panel=\"\"\n {...(bothEnabled\n ? {\n id: `${tabsId}-panel`,\n role: 'tabpanel',\n 'aria-labelledby': `${tabsId}-${path}`,\n }\n : {})}\n >\n {showWallet && (\n <WalletFlow\n authOrigin={authOrigin}\n audience={audience}\n add={addMode}\n credentials={credentials}\n onSuccess={(a, t) => void handleSuccess(a, t, 'wallet')}\n />\n )}\n {showEmail && (\n <EmailFlow\n authOrigin={authOrigin}\n add={addMode}\n credentials={credentials}\n onSuccess={(a, t) => void handleSuccess(a, t, 'email')}\n />\n )}\n </div>\n\n {!providersFirst && (\n <ProviderSignIn\n authOrigin={authOrigin}\n returnTo={resolvedReturn}\n add={addMode}\n credentials={credentials}\n firstParty={firstParty}\n providerHref={providerHref}\n />\n )}\n\n {linkPrompt && (\n <label data-oc-signin-linkalso=\"\" style={linkAlsoStyle}>\n <input\n type=\"checkbox\"\n checked={linkAlso}\n onChange={(e) => setLinkAlso(e.target.checked)}\n style={{ margin: 0, accentColor: 'var(--primary, #f97316)' }}\n />\n <span>\n After signing in, also link{' '}\n {activeMethod === 'email' ? 'a Bitcoin wallet' : 'an email'}{' '}\n <span>— optional, one more signature.</span>\n </span>\n </label>\n )}\n </div>\n );\n}\n\n/* --- tab --- */\n\nconst SigninTab = React.forwardRef<\n HTMLButtonElement,\n {\n id: string;\n controls: string;\n active: boolean;\n onClick: () => void;\n onKeyDown: (e: React.KeyboardEvent<HTMLButtonElement>) => void;\n children: React.ReactNode;\n }\n>(function SigninTab({ id, controls, active, onClick, onKeyDown, children }, ref) {\n return (\n <button\n ref={ref}\n type=\"button\"\n role=\"tab\"\n id={id}\n aria-selected={active}\n aria-controls={controls}\n tabIndex={active ? 0 : -1}\n onClick={onClick}\n onKeyDown={onKeyDown}\n data-oc-signin-tab={active ? 'active' : 'inactive'}\n style={{\n minHeight: 44,\n padding: '0.6rem 0.875rem',\n background: 'transparent',\n border: 'none',\n borderBottom: active\n ? '2px solid var(--primary, #f97316)'\n : '2px solid transparent',\n color: active\n ? 'var(--foreground, #fafafa)'\n : 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('label', signinSize(11)),\n letterSpacing: signinTracking('0.12em'),\n textTransform: SIGNIN_CASE,\n cursor: 'pointer',\n marginBottom: -1,\n }}\n >\n {children}\n </button>\n );\n});\n\n/* --- third-party provider sign-in --- */\n\ninterface OAuthProviderEntry {\n id: string;\n label: string;\n}\n\n/**\n * Brand glyph for a known OAuth provider — rendered inside the\n * provider button so each entry is visually recognisable, but drawn\n * in `currentColor` so it picks up the OC muted-foreground theme\n * (the family palette wins over each vendor's brand colours by\n * design). Unknown providers fall through to no icon — the button\n * still renders, just text-only, so the registry is forward-compatible.\n */\nfunction ProviderIcon({ id }: { id: string }): React.ReactElement | null {\n const common = {\n width: 14,\n height: 14,\n viewBox: '0 0 24 24',\n fill: 'currentColor',\n 'aria-hidden': true,\n style: { flex: '0 0 auto' } as React.CSSProperties,\n } as const;\n if (id === 'google') {\n return (\n <svg {...common}>\n <path d=\"M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z\" />\n </svg>\n );\n }\n if (id === 'github') {\n return (\n <svg {...common}>\n <path d=\"M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\" />\n </svg>\n );\n }\n return null;\n}\n\n/**\n * The secondary sign-in block — rendered below BIP-322 and email-OTP,\n * visibly less prominent. Each button is a plain navigation to the\n * auth host, which runs the OAuth dance and mints the family\n * `.ochk.io` session.\n *\n * The provider list is fetched from the auth host's\n * `/api/auth/providers` — a button appears only once that provider's\n * credentials are configured host-side. So enabling GitHub / Apple\n * later is a host env change, not a redeploy of every consumer site.\n * With no providers configured the whole block renders nothing.\n */\nfunction ProviderSignIn({\n authOrigin,\n returnTo,\n add,\n credentials,\n firstParty,\n providerHref,\n first = false,\n}: {\n authOrigin: string;\n returnTo: string;\n add: boolean;\n credentials: RequestCredentials;\n /** See OcSignInProps.mode: buttons only where the site starts them. */\n firstParty: boolean;\n providerHref?: (providerId: string) => string;\n /**\n * Render this block at the TOP of the ceremony (above the wallet/email\n * panel) rather than the default bottom. The \"or\" divider then sits\n * below the provider buttons, and the block reserves space beneath\n * itself instead of above. Set by {@link OcSignIn} when\n * `providersFirst` is on.\n */\n first?: boolean;\n}): React.ReactElement | null {\n // null while the list loads; [] once the host says none are configured.\n const [providers, setProviders] = React.useState<OAuthProviderEntry[] | null>(null);\n // A provider sign-in redirects THROUGH the auth host, so its final\n // redirect must carry an ABSOLUTE return target — a bare path would\n // resolve against ochk.io and strand a subdomain user there. The\n // origin is only knowable client-side.\n const [origin, setOrigin] = React.useState('');\n // A first-party site with no start route of its own has no provider path.\n const hidden = firstParty && !providerHref;\n\n React.useEffect(() => {\n setOrigin(window.location.origin);\n if (hidden) return;\n let cancelled = false;\n fetch(`${authOrigin}/api/auth/providers`, { credentials })\n .then((r) => (r.ok ? (r.json() as Promise<{ providers?: OAuthProviderEntry[] }>) : null))\n .then((body) => {\n if (!cancelled) setProviders(body?.providers ?? []);\n })\n .catch(() => {\n // auth host unreachable — no provider buttons; the\n // BIP-322 / email-OTP paths are unaffected.\n if (!cancelled) setProviders([]);\n });\n return () => {\n cancelled = true;\n };\n }, [authOrigin, credentials, hidden]);\n\n if (hidden) return null;\n if (providers !== null && providers.length === 0) return null;\n\n // An absolute family URL (the add-another-account round trip back to\n // a consumer subdomain) is carried verbatim through the OAuth hop;\n // a relative path is anchored to THIS page's origin.\n // It rides in the provider's start URL, so never with its fragment.\n const providerReturnTo = stripFragment(\n returnTo.startsWith('/') ? (origin ? `${origin}${returnTo}` : returnTo) : returnTo\n );\n const line = { flex: 1, height: 1, background: 'var(--border, #27272a)' } as const;\n // Vertical rhythm. The \"or\" divider is a horizontal rule between two\n // blocks, so it must sit EQUIDISTANT from both — otherwise it reads as\n // belonging to whichever block it is closer to. It previously ran\n // 14px above / 4px below (plus 4px of container margin), which glued the\n // rule to the panel beneath it and left the provider buttons floating.\n // BLOCK_GAP matches the tab row's own 16px marginBottom so the whole\n // ceremony sits on one 4px-scale rhythm rather than an ad-hoc\n // 0/4/8/14/16/20 mix.\n const BLOCK_GAP = 16;\n const BUTTON_GAP = 8; // siblings group tighter than blocks separate\n const divider = (\n <div\n style={{\n display: 'flex',\n alignItems: 'center',\n gap: 10,\n // Symmetric in both orderings: in `first` mode the divider\n // owns the gap on both sides; at the bottom the container's\n // marginTop owns the gap above, so the divider only pads below.\n margin: first ? `${BLOCK_GAP}px 0` : `0 0 ${BLOCK_GAP}px`,\n color: 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('hint', signinSize(10)),\n letterSpacing: signinTracking('0.16em'),\n textTransform: SIGNIN_CASE,\n }}\n >\n <span style={line} />\n or\n <span style={line} />\n </div>\n );\n const buttonStyle = (i: number): React.CSSProperties => ({\n display: 'flex',\n alignItems: 'center',\n justifyContent: 'center',\n gap: 10,\n boxSizing: 'border-box',\n width: '100%',\n minHeight: 44,\n marginTop: i === 0 ? 0 : BUTTON_GAP,\n padding: '0.6rem 0.875rem',\n border: '1px solid var(--border, #27272a)',\n borderRadius: SIGNIN_BUTTON_RADIUS,\n background: 'transparent',\n color: 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinSize(12),\n textDecoration: 'none',\n });\n // While the list loads, hold the space two buttons will take. Rendering\n // nothing and then inserting them above the form pushed it down after\n // first paint: most of /signin?add=1's CLS (0.11 at 390).\n if (providers === null) {\n if (!first) return null;\n return (\n <div data-oc-signin-providers=\"\" aria-hidden=\"true\">\n {[0, 1].map((i) => (\n <div key={i} style={{ ...buttonStyle(i), visibility: 'hidden' }}>\n &nbsp;\n </div>\n ))}\n {divider}\n </div>\n );\n }\n const buttons = providers.map((p, i) => (\n <a\n key={p.id}\n href={\n providerHref\n ? providerHref(p.id)\n : `${authOrigin}/api/auth/${p.id}/start?return_to=${encodeURIComponent(\n providerReturnTo\n )}${add ? '&add=1' : ''}`\n }\n data-oc-signin-provider={p.id}\n style={buttonStyle(i)}\n >\n <ProviderIcon id={p.id} />\n <span>{p.label}</span>\n </a>\n ));\n // first → providers lead: buttons, then the \"or\" divider before the\n // wallet/email panel below. Otherwise the canonical bottom placement:\n // divider, then buttons.\n return (\n <div\n data-oc-signin-providers=\"\"\n style={first ? { marginBottom: 0 } : { marginTop: BLOCK_GAP }}\n >\n {first ? (\n <>\n {buttons}\n {divider}\n </>\n ) : (\n <>\n {divider}\n {buttons}\n </>\n )}\n </div>\n );\n}\n\n/* --- wallet flow --- */\n\ninterface FlowProps {\n authOrigin: string;\n /** Multi-account add-mode · see OcSignIn.add. */\n add?: boolean;\n /** `omit` in first-party mode · see OcSignInProps.mode. */\n credentials: RequestCredentials;\n onSuccess: (account: OcAccount, token?: string) => void;\n}\n\ninterface WalletFlowProps extends FlowProps {\n audience: string;\n}\n\ntype AdapterShape = {\n detectWallets: () => Array<{ id: string; name: string; detected: boolean }>;\n getSigner: (id: string, opts: { address: string }) => (message: string) => Promise<string>;\n walletFailureText: (err: unknown, opts?: { paste?: boolean }) => string;\n};\n\nasync function loadAdapter(): Promise<AdapterShape> {\n // A dependency, not an optional peer: this is a *static* dynamic import, so\n // the consumer's bundler must resolve it at build time and a missing package\n // fails the build. The old `Function('m','return import(m)')` trick produced\n // a runtime bare-specifier `import()` the browser cannot resolve without an\n // import map — which is what broke sign-in everywhere.\n return (await import('@orangecheck/wallet-adapter')) as unknown as AdapterShape;\n}\n\ntype DetectedWallet = { id: string; name: string };\n\nasync function detectBrowserWallets(): Promise<DetectedWallet[]> {\n return (await loadAdapter())\n .detectWallets()\n .filter((w) => w.detected && w.id !== 'manual')\n .map((w) => ({ id: w.id, name: w.name }));\n}\n\nfunction WalletFlow({\n authOrigin,\n audience,\n add,\n credentials,\n onSuccess,\n}: WalletFlowProps): React.ReactElement {\n const uid = React.useId();\n const ids = {\n address: `${uid}-address`,\n wallet: `${uid}-wallet`,\n message: `${uid}-message`,\n signature: `${uid}-signature`,\n };\n const [address, setAddress] = React.useState('');\n const [error, setError] = React.useState<string | null>(null);\n const [submitting, setSubmitting] = React.useState(false);\n // Browser wallets on this device; null until the adapter has loaded.\n const [wallets, setWallets] = React.useState<DetectedWallet[] | null>(null);\n const [walletId, setWalletId] = React.useState<string | null>(null);\n // No browser wallet (every phone, Sparrow, hardware wallets): show the\n // challenge to sign elsewhere and take the signature back. This used to\n // end in \"no BIP-322 wallet extension detected · install one and refresh\".\n const [manual, setManual] = React.useState<{ message: string; nonce: string } | null>(null);\n const [pasted, setPasted] = React.useState('');\n const [copied, setCopied] = React.useState<'idle' | 'copied' | 'failed'>('idle');\n\n React.useEffect(() => {\n let cancelled = false;\n detectBrowserWallets()\n .then((found) => {\n if (cancelled) return;\n setWallets(found);\n setWalletId(found[0]?.id ?? null);\n })\n .catch(() => {\n if (!cancelled) setWallets([]);\n });\n return () => {\n cancelled = true;\n };\n }, []);\n\n async function fetchChallenge(addr: string): Promise<{ message: string; nonce: string }> {\n const res = await fetch(\n `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&audience=${encodeURIComponent(audience)}&purpose=login`\n );\n const json = (await res.json()) as { message?: string; nonce?: string; error?: string };\n if (!res.ok || !json.message || !json.nonce) {\n throw new Error(json.error ?? 'challenge_failed');\n }\n return { message: json.message, nonce: json.nonce };\n }\n\n /**\n * POST the signature. A browser wallet signs BIP-322, so that path names\n * the scheme; a pasted one may be legacy BIP-137, so the manual path names\n * none. The host decides from the signature's bytes either way.\n */\n async function submitSignature(\n message: string,\n nonce: string,\n signature: string,\n scheme: 'bip322' | undefined\n ): Promise<void> {\n // Family-CORS lets the .ochk.io session cookie land cross-origin.\n const res = await fetch(`${authOrigin}/api/auth/signin`, {\n method: 'POST',\n credentials,\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n message,\n signature,\n ...(scheme ? { scheme } : {}),\n expectedNonce: nonce,\n expectedAudience: audience,\n expectedPurpose: 'login',\n // Multi-account add-mode · the auth host preserves the current\n // roster_id when set, instead of minting a fresh one.\n ...(add ? { add: true } : {}),\n }),\n });\n const json = (await res.json()) as SigninJson;\n if (!res.ok || !('ok' in json) || !json.ok || !json.account) {\n throw new Error(\n ('reason' in json && json.reason) ||\n ('error' in json && json.error) ||\n 'verify_failed'\n );\n }\n onSuccess(json.account, json.token);\n }\n\n async function signIn(e: React.FormEvent): Promise<void> {\n e.preventDefault();\n const addr = address.trim();\n if (!addr) {\n setError('Paste your Bitcoin address.');\n return;\n }\n if (!looksLikeBitcoinAddress(addr)) {\n setError(humanSigninError('bad_request', 'wallet'));\n return;\n }\n setError(null);\n setSubmitting(true);\n let step: 'challenge' | 'submit' = 'challenge';\n try {\n // Submitting before detection finished must not send someone with\n // an extension to the paste-a-signature path.\n let id = walletId;\n if (wallets === null) {\n const found = await detectBrowserWallets().catch(() => []);\n setWallets(found);\n id = found[0]?.id ?? null;\n setWalletId(id);\n }\n const challenge = await fetchChallenge(addr);\n if (!id) {\n setManual(challenge);\n setSubmitting(false);\n return;\n }\n const adapter = await loadAdapter();\n let signature: string;\n try {\n signature = await adapter.getSigner(id, { address: addr })(challenge.message);\n } catch (err) {\n // The wallet's own words never reach a person; the adapter names the cause.\n setError(adapter.walletFailureText(err));\n setSubmitting(false);\n return;\n }\n step = 'submit';\n await submitSignature(challenge.message, challenge.nonce, signature, 'bip322');\n } catch (err) {\n setError(failureMessage(err, 'wallet', step, authOrigin));\n setSubmitting(false);\n }\n }\n\n async function signInManual(e: React.FormEvent): Promise<void> {\n e.preventDefault();\n if (!manual) return;\n const sig = pasted.trim();\n if (!sig) {\n setError('Paste the signature your wallet gave you.');\n return;\n }\n setError(null);\n setSubmitting(true);\n try {\n await submitSignature(manual.message, manual.nonce, sig, undefined);\n } catch (err) {\n setError(failureMessage(err, 'wallet', 'submit', authOrigin));\n setSubmitting(false);\n }\n }\n\n async function copyMessage(): Promise<void> {\n if (!manual) return;\n try {\n await navigator.clipboard.writeText(manual.message);\n setCopied('copied');\n } catch {\n setCopied('failed');\n }\n }\n\n if (manual) {\n return (\n <form onSubmit={signInManual} data-oc-signin-wallet-manual=\"\">\n <FlowHeader>\n In your wallet, use “sign message” (BIP-322) with {address.trim()}, sign the\n text below, and paste the signature back here. Nothing is spent.\n </FlowHeader>\n <Label htmlFor={ids.message}>Message to sign</Label>\n <textarea\n data-oca-field=\"\"\n id={ids.message}\n readOnly\n value={manual.message}\n rows={5}\n onFocus={(e) => e.currentTarget.select()}\n style={{ ...inputStyle, resize: 'vertical' }}\n />\n <button type=\"button\" onClick={() => void copyMessage()} style={linkButtonStyle}>\n {copied === 'copied' ? 'Copied' : 'Copy message'}\n </button>\n {copied === 'failed' && (\n <Hint>Couldn&apos;t copy here. Select the text above and copy it.</Hint>\n )}\n <div style={{ marginTop: 14 }}>\n <Label htmlFor={ids.signature}>Signature</Label>\n <textarea\n data-oca-field=\"\"\n id={ids.signature}\n value={pasted}\n onChange={(e) => {\n setPasted(e.target.value);\n if (error) setError(null);\n }}\n rows={3}\n placeholder=\"paste the signature\"\n spellCheck={false}\n autoFocus\n aria-invalid={error ? true : undefined}\n style={{ ...inputStyle, resize: 'vertical' }}\n />\n </div>\n {error && <ErrorLine>{error}</ErrorLine>}\n <button\n type=\"submit\"\n disabled={submitting || !pasted.trim()}\n style={submitStyle(submitting || !pasted.trim())}\n >\n {submitting ? 'Checking…' : <Submit>Sign me in</Submit>}\n </button>\n <button\n type=\"button\"\n onClick={() => {\n setManual(null);\n setPasted('');\n setError(null);\n setCopied('idle');\n }}\n style={linkButtonStyle}\n >\n Use a different address\n </button>\n </form>\n );\n }\n\n const noBrowserWallet = wallets !== null && wallets.length === 0;\n return (\n <form onSubmit={signIn} data-oc-signin-wallet=\"\">\n <FlowHeader>\n Your wallet signs a short message to prove you hold the address. Nothing is spent\n and your key never leaves the wallet. Works with browser wallets, or any wallet that\n can sign a message, like Sparrow.\n </FlowHeader>\n <Label htmlFor={ids.address}>Bitcoin address</Label>\n <input\n data-oca-field=\"\"\n id={ids.address}\n type=\"text\"\n value={address}\n onChange={(e) => {\n setAddress(addressInputValue(e.target.value));\n if (error) setError(null);\n }}\n placeholder=\"bc1q… · 3… · 1…\"\n autoComplete=\"off\"\n autoCapitalize=\"none\"\n spellCheck={false}\n required\n aria-invalid={error ? true : undefined}\n style={inputStyle}\n />\n {wallets && wallets.length > 1 && (\n <div style={{ marginTop: 12 }}>\n <Label htmlFor={ids.wallet}>Sign with</Label>\n <select\n id={ids.wallet}\n value={walletId ?? ''}\n onChange={(e) => setWalletId(e.target.value)}\n style={inputStyle}\n >\n {wallets.map((w) => (\n <option key={w.id} value={w.id}>\n {w.name}\n </option>\n ))}\n </select>\n </div>\n )}\n {error && <ErrorLine>{error}</ErrorLine>}\n <button\n type=\"submit\"\n disabled={submitting || !address.trim()}\n style={submitStyle(submitting || !address.trim())}\n >\n {submitting\n ? 'Waiting for wallet…'\n : noBrowserWallet\n ? <Submit>Get the message to sign</Submit>\n : <Submit>Sign in with wallet</Submit>}\n </button>\n {noBrowserWallet && (\n <Hint>No browser wallet found here. You can sign with any wallet and paste.</Hint>\n )}\n </form>\n );\n}\n\n/* --- email flow --- */\n\ntype EmailStage = 'enter' | 'code';\n\nfunction EmailFlow({ authOrigin, add, credentials, onSuccess }: FlowProps): React.ReactElement {\n const uid = React.useId();\n const [stage, setStage] = React.useState<EmailStage>('enter');\n const [email, setEmail] = React.useState('');\n const [emailError, setEmailError] = React.useState<string | null>(null);\n const [code, setCode] = React.useState('');\n const [codeError, setCodeError] = React.useState<string | null>(null);\n const [token, setToken] = React.useState<string | null>(null);\n const [submitting, setSubmitting] = React.useState(false);\n const [resent, setResent] = React.useState(false);\n\n /** Ask the host to email a code. Returns a human error, or null on success. */\n async function sendCode(address: string): Promise<string | null> {\n try {\n const res = await fetch(`${authOrigin}/api/auth/email-otp/start`, {\n method: 'POST',\n credentials,\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: address }),\n });\n const json = (await res.json()) as { ok?: boolean; token?: string; reason?: string };\n if (!res.ok || !json.token) return humanSigninError(json.reason ?? 'server_error', 'email');\n setToken(json.token);\n return null;\n } catch {\n return networkError(authOrigin);\n }\n }\n\n async function start(e: React.FormEvent): Promise<void> {\n e.preventDefault();\n const trimmed = email.trim().toLowerCase();\n if (!trimmed || !/.+@.+\\..+/.test(trimmed)) {\n setEmailError(humanSigninError('invalid_email', 'email'));\n return;\n }\n setEmailError(null);\n setSubmitting(true);\n const err = await sendCode(trimmed);\n setSubmitting(false);\n if (err) {\n setEmailError(err);\n return;\n }\n setEmail(trimmed);\n setStage('code');\n }\n\n async function resend(): Promise<void> {\n setCodeError(null);\n setResent(false);\n setSubmitting(true);\n const err = await sendCode(email);\n setSubmitting(false);\n setCode('');\n if (err) setCodeError(err);\n else setResent(true);\n }\n\n async function verify(e: React.FormEvent): Promise<void> {\n e.preventDefault();\n if (!token) return;\n if (code.length !== 6) {\n setCodeError('The code is 6 digits.');\n return;\n }\n setCodeError(null);\n setSubmitting(true);\n try {\n const res = await fetch(`${authOrigin}/api/auth/email-otp/verify`, {\n method: 'POST',\n credentials,\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n email,\n code,\n token,\n // Multi-account add-mode · see WalletFlow.\n ...(add ? { add: true } : {}),\n }),\n });\n const json = (await res.json()) as SigninJson;\n if (!res.ok || !('ok' in json) || !json.ok || !json.account) {\n throw new Error(\n ('reason' in json && json.reason) ||\n ('error' in json && json.error) ||\n 'server_error'\n );\n }\n onSuccess(json.account, json.token);\n } catch (err) {\n setCodeError(failureMessage(err, 'email', 'submit', authOrigin));\n } finally {\n setSubmitting(false);\n }\n }\n\n if (stage === 'enter') {\n return (\n <form onSubmit={start} data-oc-signin-email=\"\">\n <FlowHeader>\n We email you a 6-digit code. No password, and no wallet needed to start. Add a\n Bitcoin address any time: a way in that only you hold.\n </FlowHeader>\n <Label htmlFor={`${uid}-email`}>Email</Label>\n <input\n data-oca-field=\"\"\n id={`${uid}-email`}\n type=\"email\"\n autoComplete=\"email\"\n value={email}\n onChange={(e) => {\n setEmail(e.target.value);\n if (emailError) setEmailError(null);\n }}\n placeholder=\"you@example.com\"\n required\n aria-invalid={emailError ? true : undefined}\n style={inputStyle}\n />\n {emailError && <ErrorLine>{emailError}</ErrorLine>}\n <button type=\"submit\" disabled={submitting} style={submitStyle(submitting)}>\n {submitting ? 'Sending…' : <Submit>Send one-time code</Submit>}\n </button>\n </form>\n );\n }\n\n return (\n <form onSubmit={verify} data-oc-signin-email-verify=\"\">\n <FlowHeader>\n {resent ? 'Sent a new code to ' : 'Sent a 6-digit code to '}\n <span style={{ color: 'var(--foreground, #fafafa)' }}>{email}</span>. It expires in\n 10 minutes.\n </FlowHeader>\n <Label htmlFor={`${uid}-code`}>One-time code</Label>\n <input\n data-oca-field=\"\"\n id={`${uid}-code`}\n type=\"text\"\n inputMode=\"numeric\"\n pattern=\"\\d{6}\"\n maxLength={6}\n autoComplete=\"one-time-code\"\n value={code}\n onChange={(e) => {\n setCode(e.target.value.replace(/\\D/g, '').slice(0, 6));\n if (codeError) setCodeError(null);\n }}\n placeholder=\"6 digits\"\n required\n autoFocus\n aria-invalid={codeError ? true : undefined}\n style={{ ...inputStyle, letterSpacing: '0.4em', fontSize: 16 }}\n />\n {codeError && <ErrorLine>{codeError}</ErrorLine>}\n <button\n type=\"submit\"\n disabled={submitting || code.length !== 6}\n style={submitStyle(submitting || code.length !== 6)}\n >\n {submitting ? 'Verifying…' : <Submit>Verify · sign me in</Submit>}\n </button>\n <div>\n <button\n type=\"button\"\n onClick={() => void resend()}\n disabled={submitting}\n style={linkButtonStyle}\n >\n Send a new code\n </button>\n <button\n type=\"button\"\n onClick={() => {\n setStage('enter');\n setCode('');\n setToken(null);\n setResent(false);\n }}\n style={linkButtonStyle}\n >\n Use a different email\n </button>\n </div>\n </form>\n );\n}\n\n/* --- shared subcomponents --- */\n\n/** A submit label and its arrow, which a site can hide (--oc-signin-arrow). */\nfunction Submit({ children }: { children: string }): React.ReactElement {\n return (\n <>\n {children}\n <span aria-hidden=\"true\" style={{ display: SIGNIN_ARROW }}>\n {' →'}\n </span>\n </>\n );\n}\n\nfunction FlowHeader({\n label,\n children,\n}: {\n /** Omitted where the active tab already names the method. */\n label?: string;\n children: React.ReactNode;\n}): React.ReactElement {\n return (\n <div style={{ marginBottom: 16 }}>\n {label && (\n <div\n style={{\n color: 'var(--primary, #f97316)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinSize(10),\n letterSpacing: signinTracking('0.18em'),\n textTransform: SIGNIN_CASE,\n marginBottom: 6,\n }}\n >\n {label}\n </div>\n )}\n <p\n style={{\n color: 'var(--muted-foreground, #a1a1aa)',\n fontSize: signinRoleSize('text', '13px'),\n lineHeight: 1.55,\n margin: 0,\n }}\n >\n {children}\n </p>\n </div>\n );\n}\n\nconst linkButtonStyle: React.CSSProperties = {\n display: 'inline-flex',\n alignItems: 'center',\n minHeight: 44,\n marginTop: 4,\n marginRight: 16,\n background: 'transparent',\n border: 'none',\n color: 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('button', signinSize(11)),\n letterSpacing: signinTracking('0.12em'),\n textTransform: SIGNIN_CASE,\n cursor: 'pointer',\n padding: 0,\n};\n\nfunction Label({\n htmlFor,\n children,\n}: {\n htmlFor: string;\n children: React.ReactNode;\n}): React.ReactElement {\n return (\n <label\n htmlFor={htmlFor}\n style={{\n display: 'block',\n color: 'var(--foreground, #fafafa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('label', signinSize(11)),\n letterSpacing: signinTracking('0.12em'),\n textTransform: SIGNIN_CASE,\n marginBottom: 6,\n }}\n >\n {children}\n </label>\n );\n}\n\nconst inputStyle: React.CSSProperties = {\n width: '100%',\n padding: '0.55rem 0.75rem',\n background: 'var(--background, #0a0a0a)',\n color: 'var(--foreground, #fafafa)',\n border: '1px solid var(--input, #27272a)',\n borderRadius: signinRadius(6),\n fontFamily: SIGNIN_FONT,\n // 16px — never below it. A sub-16px font-size makes iOS Safari\n // auto-zoom the viewport on focus; the family rule is >=16px on\n // every form field. Desktop reads fine at 16 too.\n fontSize: 16,\n};\n\nconst linkAlsoStyle: React.CSSProperties = {\n display: 'flex',\n alignItems: 'center',\n // The whole row is the checkbox's hit area; the 13px box alone was not.\n minHeight: 44,\n gap: 8,\n marginTop: 16,\n paddingTop: 14,\n borderTop: '1px solid var(--border, #27272a)',\n color: 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('text', signinSize(12)),\n lineHeight: 1.5,\n cursor: 'pointer',\n};\n\nfunction submitStyle(disabled: boolean): React.CSSProperties {\n return {\n marginTop: 12,\n padding: '0.6rem 1rem',\n background: 'var(--primary, #f97316)',\n color: 'var(--primary-foreground, #0a0a0a)',\n border: 'none',\n borderRadius: SIGNIN_BUTTON_RADIUS,\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('button', signinSize(11)),\n letterSpacing: signinTracking('0.14em'),\n textTransform: SIGNIN_CASE,\n fontWeight: SIGNIN_STRONG,\n cursor: disabled ? 'not-allowed' : 'pointer',\n opacity: disabled ? 0.5 : 1,\n width: '100%',\n };\n}\n\nfunction ErrorLine({ children }: { children: React.ReactNode }): React.ReactElement {\n return (\n <p\n role=\"alert\"\n style={{\n marginTop: 6,\n marginBottom: 0,\n color: 'var(--destructive, #ef4444)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('hint', signinSize(11)),\n letterSpacing: '0.04em',\n }}\n >\n {children}\n </p>\n );\n}\n\nfunction Hint({ children }: { children: React.ReactNode }): React.ReactElement {\n return (\n <p\n style={{\n marginTop: 12,\n marginBottom: 0,\n color: 'var(--muted-foreground, #a1a1aa)',\n fontFamily: SIGNIN_FONT,\n fontSize: signinRoleSize('hint', '10.5px'),\n lineHeight: 1.55,\n }}\n >\n {children}\n </p>\n );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,YAAY,WAAW;AA2hBX,SAwcI,UA7b8B,KAXlC;AA3VZ,SAAS,iBAAiB,WAAmB,QAAyB;AAClE,MAAI;AACA,WAAO,IAAI,IAAI,WAAW,MAAM,EAAE,WAAW;AAAA,EACjD,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAIA,SAAS,mBAA2B;AAChC,SAAO,OAAO,WAAW,cAAc,oBAAoB,OAAO,SAAS;AAC/E;AAEO,SAAS,aAAa,OAAmC;AAC5D,QAAM,YAAY,SAAS;AAC3B,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,MAAI,CAAC,UAAU,WAAW,GAAG,EAAG,QAAO;AACvC,SAAO,iBAAiB,WAAW,iBAAiB,CAAC,IAAI,YAAY;AACzE;AASO,SAAS,mBAAmB,OAAsD;AACrF,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,iBAAiB,OAAO,iBAAiB,CAAC,GAAG;AACtE,WAAO;AAAA,EACX;AACA,MAAI;AACA,UAAM,IAAI,IAAI,IAAI,KAAK;AACvB,QAAI,EAAE,aAAa,SAAU,QAAO;AACpC,UAAM,OAAO,EAAE,SAAS,YAAY;AACpC,QAAI,SAAS,aAAa,KAAK,SAAS,UAAU,EAAG,QAAO,EAAE,SAAS;AAAA,EAC3E,QAAQ;AAAA,EAER;AACA,SAAO;AACX;AAEA,SAAS,aAAa,QAAsB;AACxC,MAAI,OAAO,WAAW,YAAa;AACnC,SAAO,SAAS,OAAO,MAAM;AACjC;AAUA,IAAM,gBAAwC;AAAA,EAC1C,aAAa;AAAA,EACb,mBACI;AAAA,EACJ,aAAa;AAAA,EACb,wBACI;AAAA,EACJ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,gBAAgB;AACpB;AAEA,IAAM,eAAuC;AAAA,EACzC,SAAS;AACb;AAOA,IAAM,gBAAwC;AAAA,EAC1C,aAAa;AACjB;AAGO,SAAS,aAAa,YAA4B;AACrD,MAAI,OAAO;AACX,MAAI;AACA,WAAO,IAAI,IAAI,UAAU,EAAE;AAAA,EAC/B,QAAQ;AAAA,EAER;AACA,SAAO,wDAAwD,IAAI;AACvE;AAEO,SAAS,iBACZ,QACA,MACA,OAA+B,aACzB;AAEN,MAAI,CAAC,eAAe,KAAK,MAAM,EAAG,QAAO;AACzC,MAAI,SAAS,YAAY,SAAS,YAAY,cAAc,MAAM,EAAG,QAAO,cAAc,MAAM;AAChG,MAAI,SAAS,WAAW,aAAa,MAAM,EAAG,QAAO,aAAa,MAAM;AACxE,SACI,cAAc,MAAM,MACnB,SAAS,UACJ,qDACA;AAEd;AAOA,SAAS,eACL,KACA,MACA,MACA,YACM;AACN,MAAI,eAAe,aAAa,eAAe,YAAa,QAAO,aAAa,UAAU;AAC1F,SAAO,iBAAiB,eAAe,QAAQ,IAAI,UAAU,UAAU,MAAM,IAAI;AACrF;AAEA,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAOhB,SAAS,wBAAwB,OAAwB;AAC5D,QAAM,IAAI,MAAM,KAAK;AAErB,MAAI,eAAe,KAAK,CAAC,EAAG,QAAO,MAAM,EAAE,YAAY,KAAK,MAAM,EAAE,YAAY;AAChF,SAAO,eAAe,KAAK,CAAC;AAChC;AAKA,IAAM,2BAA2B,oBAAI,IAAI,CAAC,uBAAuB,kBAAkB,CAAC;AAGpF,SAAS,eAAe,QAAwB;AAC5C,MAAI,WAAW,uBAAuB;AAClC,WAAO;AAAA,EACX;AACA,MAAI,WAAW,oBAAoB;AAC/B,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAEO,SAAS,SAAS;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,iBAAiB;AAAA,EAC7B,KAAK;AAAA,EACL,aAAa;AAAA,EACb;AAAA,EACA,iBAAiB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,GAAsC;AAClC,QAAM,gBAAgB,OAAO,UAAU;AACvC,QAAM,eAAe,OAAO,SAAS;AACrC,QAAM,aAAa,SAAS;AAE5B,QAAM,cAAkC,aAAa,SAAS;AAC9D,QAAM,aAAa,kBAAkB,CAAC;AAStC,QAAM,CAAC,gBAAgB,iBAAiB,IAAU;AAAA,IAC9C,MAAM,mBAAmB,QAAQ,KAAK,aAAa,QAAQ;AAAA,EAC/D;AACA,EAAM,gBAAU,MAAM;AAClB,UAAM,WAAW,mBAAmB,QAAQ;AAC5C,QAAI,UAAU;AACV,wBAAkB,QAAQ;AAC1B;AAAA,IACJ;AACA,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,IAAI,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACpD,UAAM,YACF,mBAAmB,EAAE,IAAI,WAAW,CAAC,KAAK,mBAAmB,EAAE,IAAI,MAAM,CAAC;AAC9E,sBAAkB,aAAa,GAAG;AAAA,EACtC,GAAG,CAAC,QAAQ,CAAC;AAKb,QAAM,CAAC,SAAS,UAAU,IAAU,eAAkB,QAAQ,OAAO,KAAK,CAAC,UAAU;AACrF,EAAM,gBAAU,MAAM;AAClB,QAAI,OAAO,WAAW,YAAa;AACnC,QAAI,YAAY;AACZ,iBAAW,KAAK;AAChB;AAAA,IACJ;AACA,QAAI,YAAY,QAAW;AACvB,iBAAW,QAAQ,OAAO,CAAC;AAC3B;AAAA,IACJ;AACA,eAAW,IAAI,gBAAgB,OAAO,SAAS,MAAM,EAAE,IAAI,KAAK,MAAM,GAAG;AAAA,EAC7E,GAAG,CAAC,SAAS,UAAU,CAAC;AAKxB,QAAM,CAAC,MAAM,OAAO,IAAU;AAAA,IAC1B,gBAAgB,iBAAiB,UAAU;AAAA,EAC/C;AAGA,QAAM,SAAe,YAAM;AAC3B,QAAM,WAAsC,iBACtC,CAAC,SAAS,QAAQ,IAClB,CAAC,UAAU,OAAO;AACxB,QAAM,UAAgB,aAAsE,CAAC,CAAC;AAC9F,QAAM,WAAW,CAAC,MAA8C;AAC5D,UAAM,IAAI,SAAS,QAAQ,IAAI;AAC/B,UAAM,OAAO,SAAS,SAAS;AAC/B,UAAM,KACF,EAAE,QAAQ,gBAAgB,IAAI,KAAK,SAAS,SAC1C,EAAE,QAAQ,eAAe,IAAI,QAAQ,SAAS,SAC9C,EAAE,QAAQ,SAAS,IACnB,EAAE,QAAQ,QAAQ,OAClB;AACN,QAAI,KAAK,EAAG;AACZ,MAAE,eAAe;AACjB,UAAM,OAAO,SAAS,EAAE;AACxB,YAAQ,IAAI;AACZ,YAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACjC;AAIA,QAAM,CAAC,UAAU,WAAW,IAAU,eAI5B,IAAI;AAEd,QAAM,CAAC,UAAU,WAAW,IAAU,eAAS,KAAK;AAIpD,QAAM,CAAC,YAAY,aAAa,IAAU,eAAwB,IAAI;AACtE,EAAM,gBAAU,MAAM;AAClB,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM,EAAE,IAAI,aAAa;AAC5E,QAAI,WAAW,KAAM;AACrB,kBAAc,MAAM;AAEpB,QAAI,yBAAyB,IAAI,MAAM,KAAK,aAAc,SAAQ,OAAO;AAAA,EAC7E,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,WAAiB;AAAA,IACnB,OAAO,YAAuB;AAC1B,UAAI,iBAAiB;AACjB,YAAI;AACA,gBAAM,WAAW,mBAAmB,MAAM,gBAAgB,OAAO,CAAC;AAClE,uBAAa,YAAY,cAAc;AACvC;AAAA,QACJ,QAAQ;AAAA,QAER;AAAA,MACJ;AACA,mBAAa,cAAc;AAAA,IAC/B;AAAA,IACA,CAAC,iBAAiB,cAAc;AAAA,EACpC;AAEA,QAAM,gBAAsB;AAAA,IACxB,OAAO,SAAoB,OAA2B,QAA4B;AAE9E,YAAM,UAAU,MAAM;AAGlB,wBAAgB;AAChB,YAAI,UAAW,WAAU,SAAS,KAAK;AAAA,YAClC,MAAK,SAAS,OAAO;AAAA,MAC9B;AAIA,UAAI,CAAC,cAAc,CAAC,UAAU;AAC1B,gBAAQ;AACR;AAAA,MACJ;AAKA,UAAI;AACA,cAAM,QAAQ,MAAM,MAAM,GAAG,UAAU,gBAAgB;AAAA,UACnD,aAAa;AAAA,UACb,SAAS,EAAE,QAAQ,mBAAmB;AAAA,QAC1C,CAAC;AACD,cAAM,KAAK,MAAM,KACT,MAAM,MAAM,KAAK,IACnB;AACN,cAAM,QAAQ,IAAI,SAAS;AAC3B,YAAI,OAAO;AACP,sBAAY;AAAA,YACR,QAAQ,QAAQ,UAAU,QAAQ;AAAA,YAClC;AAAA,YACA;AAAA,UACJ,CAAC;AACD;AAAA,QACJ;AAAA,MACJ,QAAQ;AAAA,MAER;AACA,cAAQ;AAAA,IACZ;AAAA,IACA,CAAC,WAAW,YAAY,UAAU,UAAU,UAAU;AAAA,EAC1D;AAEA,MAAI,CAAC,iBAAiB,CAAC,cAAc;AACjC,WACI;AAAA,MAAC;AAAA;AAAA,QACG;AAAA,QACA,kBAAe;AAAA,QACf,OAAO;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,UAAU,WAAW,EAAE;AAAA,QAC3B;AAAA,QACH;AAAA;AAAA,UACiC,oBAAC,UAAK,0BAAY;AAAA,UAAO;AAAA,UAAI;AAAA,UAC3D,oBAAC,UAAK,yBAAW;AAAA,UAAO;AAAA,UAAI,oBAAC,UAAK,kBAAI;AAAA;AAAA;AAAA,IAC1C;AAAA,EAER;AAEA,MAAI,UAAU;AACV,WACI,oBAAC,SAAI,WAAsB,kBAAe,IACtC;AAAA,MAAC;AAAA;AAAA,QACG,QAAQ,SAAS;AAAA,QACjB,OAAO,SAAS;AAAA,QAChB;AAAA,QACA,YAAY,SAAS;AAAA;AAAA,IACzB,GACJ;AAAA,EAER;AAEA,QAAM,aAAa,kBAAkB,SAAS,YAAY,CAAC;AAC3D,QAAM,YAAY,iBAAiB,SAAS,WAAW,CAAC;AACxD,QAAM,cAAc,iBAAiB;AAGrC,QAAM,eAAmC,CAAC,eACpC,WACA,CAAC,gBACC,UACA;AAER,SACI,qBAAC,SAAI,WAAsB,kBAAe,IACrC;AAAA,kBACG;AAAA,MAAC;AAAA;AAAA,QACG,8BAA2B;AAAA,QAC3B,OAAO;AAAA,UACH,cAAc;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,cAAc,aAAa,CAAC;AAAA,UAC5B,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,UAAU,eAAe,QAAQ,WAAW,EAAE,CAAC;AAAA,QACnD;AAAA,QAEC,yBAAe,UAAU;AAAA;AAAA,IAC9B;AAAA,IAEH,WACG;AAAA,MAAC;AAAA;AAAA,QACG,2BAAwB;AAAA,QACxB,OAAO;AAAA,UACH,cAAc;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,iBAAiB;AAAA,UACjB,cAAc,aAAa,CAAC;AAAA,UAC5B,YAAY;AAAA,UACZ,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,UAAU,eAAe,QAAQ,WAAW,EAAE,CAAC;AAAA,UAC/C,YAAY;AAAA,QAChB;AAAA,QAEA;AAAA;AAAA,YAAC;AAAA;AAAA,cACG,OAAO;AAAA,gBACH,OAAO;AAAA,gBACP,eAAe,eAAe,QAAQ;AAAA,gBACtC,eAAe;AAAA,gBACf,UAAU,WAAW,EAAE;AAAA,gBACvB,SAAS;AAAA,gBACT,cAAc;AAAA,cAClB;AAAA,cACH;AAAA;AAAA,UAED;AAAA,UAAS;AAAA;AAAA;AAAA,IAIb;AAAA,IAKH,kBACG;AAAA,MAAC;AAAA;AAAA,QACG;AAAA,QACA,UAAU;AAAA,QACV,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAK;AAAA;AAAA,IACT;AAAA,IAEH,eACG;AAAA,MAAC;AAAA;AAAA,QACG,MAAK;AAAA,QACL,cAAW;AAAA,QACX,uBAAoB;AAAA,QACpB,OAAO;AAAA,UACH,SAAS;AAAA,UACT,KAAK;AAAA,UACL,cAAc;AAAA,UACd,cAAc;AAAA,QAClB;AAAA,QAIC,mBAAS,IAAI,CAAC,MACX;AAAA,UAAC;AAAA;AAAA,YAEG,IAAI,GAAG,MAAM,IAAI,CAAC;AAAA,YAClB,UAAU,GAAG,MAAM;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,SAAS,MAAM,QAAQ,CAAC;AAAA,YACxB,WAAW;AAAA,YACX,KAAK,CAAC,OAAO;AACT,sBAAQ,QAAQ,CAAC,IAAI;AAAA,YACzB;AAAA,YAEC,gBAAM,UAAU,UAAU;AAAA;AAAA,UAVtB;AAAA,QAWT,CACH;AAAA;AAAA,IACL;AAAA,IAGJ;AAAA,MAAC;AAAA;AAAA,QACG,wBAAqB;AAAA,QACpB,GAAI,cACC;AAAA,UACI,IAAI,GAAG,MAAM;AAAA,UACb,MAAM;AAAA,UACN,mBAAmB,GAAG,MAAM,IAAI,IAAI;AAAA,QACxC,IACA,CAAC;AAAA,QAEN;AAAA,wBACG;AAAA,YAAC;AAAA;AAAA,cACG;AAAA,cACA;AAAA,cACA,KAAK;AAAA,cACL;AAAA,cACA,WAAW,CAAC,GAAG,MAAM,KAAK,cAAc,GAAG,GAAG,QAAQ;AAAA;AAAA,UAC1D;AAAA,UAEH,aACG;AAAA,YAAC;AAAA;AAAA,cACG;AAAA,cACA,KAAK;AAAA,cACL;AAAA,cACA,WAAW,CAAC,GAAG,MAAM,KAAK,cAAc,GAAG,GAAG,OAAO;AAAA;AAAA,UACzD;AAAA;AAAA;AAAA,IAER;AAAA,IAEC,CAAC,kBACE;AAAA,MAAC;AAAA;AAAA,QACG;AAAA,QACA,UAAU;AAAA,QACV,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA;AAAA,IACJ;AAAA,IAGH,cACG,qBAAC,WAAM,2BAAwB,IAAG,OAAO,eACrC;AAAA;AAAA,QAAC;AAAA;AAAA,UACG,MAAK;AAAA,UACL,SAAS;AAAA,UACT,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,OAAO;AAAA,UAC7C,OAAO,EAAE,QAAQ,GAAG,aAAa,0BAA0B;AAAA;AAAA,MAC/D;AAAA,MACA,qBAAC,UAAK;AAAA;AAAA,QAC0B;AAAA,QAC3B,iBAAiB,UAAU,qBAAqB;AAAA,QAAY;AAAA,QAC7D,oBAAC,UAAK,kDAA+B;AAAA,SACzC;AAAA,OACJ;AAAA,KAER;AAER;AAIA,IAAM,YAAkB,iBAUtB,SAASA,WAAU,EAAE,IAAI,UAAU,QAAQ,SAAS,WAAW,SAAS,GAAG,KAAK;AAC9E,SACI;AAAA,IAAC;AAAA;AAAA,MACG;AAAA,MACA,MAAK;AAAA,MACL,MAAK;AAAA,MACL;AAAA,MACA,iBAAe;AAAA,MACf,iBAAe;AAAA,MACf,UAAU,SAAS,IAAI;AAAA,MACvB;AAAA,MACA;AAAA,MACA,sBAAoB,SAAS,WAAW;AAAA,MACxC,OAAO;AAAA,QACH,WAAW;AAAA,QACX,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,cAAc,SACR,sCACA;AAAA,QACN,OAAO,SACD,+BACA;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,eAAe,SAAS,WAAW,EAAE,CAAC;AAAA,QAChD,eAAe,eAAe,QAAQ;AAAA,QACtC,eAAe;AAAA,QACf,QAAQ;AAAA,QACR,cAAc;AAAA,MAClB;AAAA,MAEC;AAAA;AAAA,EACL;AAER,CAAC;AAiBD,SAAS,aAAa,EAAE,GAAG,GAA8C;AACrE,QAAM,SAAS;AAAA,IACX,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM;AAAA,IACN,eAAe;AAAA,IACf,OAAO,EAAE,MAAM,WAAW;AAAA,EAC9B;AACA,MAAI,OAAO,UAAU;AACjB,WACI,oBAAC,SAAK,GAAG,QACL,8BAAC,UAAK,GAAE,+VAA8V,GAC1W;AAAA,EAER;AACA,MAAI,OAAO,UAAU;AACjB,WACI,oBAAC,SAAK,GAAG,QACL,8BAAC,UAAK,GAAE,4sBAA2sB,GACvtB;AAAA,EAER;AACA,SAAO;AACX;AAcA,SAAS,eAAe;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACZ,GAgB8B;AAE1B,QAAM,CAAC,WAAW,YAAY,IAAU,eAAsC,IAAI;AAKlF,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAS,EAAE;AAE7C,QAAM,SAAS,cAAc,CAAC;AAE9B,EAAM,gBAAU,MAAM;AAClB,cAAU,OAAO,SAAS,MAAM;AAChC,QAAI,OAAQ;AACZ,QAAI,YAAY;AAChB,UAAM,GAAG,UAAU,uBAAuB,EAAE,YAAY,CAAC,EACpD,KAAK,CAAC,MAAO,EAAE,KAAM,EAAE,KAAK,IAAsD,IAAK,EACvF,KAAK,CAAC,SAAS;AACZ,UAAI,CAAC,UAAW,cAAa,MAAM,aAAa,CAAC,CAAC;AAAA,IACtD,CAAC,EACA,MAAM,MAAM;AAGT,UAAI,CAAC,UAAW,cAAa,CAAC,CAAC;AAAA,IACnC,CAAC;AACL,WAAO,MAAM;AACT,kBAAY;AAAA,IAChB;AAAA,EACJ,GAAG,CAAC,YAAY,aAAa,MAAM,CAAC;AAEpC,MAAI,OAAQ,QAAO;AACnB,MAAI,cAAc,QAAQ,UAAU,WAAW,EAAG,QAAO;AAMzD,QAAM,mBAAmB;AAAA,IACrB,SAAS,WAAW,GAAG,IAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,KAAK,WAAY;AAAA,EAC9E;AACA,QAAM,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,yBAAyB;AASxE,QAAM,YAAY;AAClB,QAAM,aAAa;AACnB,QAAM,UACF;AAAA,IAAC;AAAA;AAAA,MACG,OAAO;AAAA,QACH,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,KAAK;AAAA;AAAA;AAAA;AAAA,QAIL,QAAQ,QAAQ,GAAG,SAAS,SAAS,OAAO,SAAS;AAAA,QACrD,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,UAAU,eAAe,QAAQ,WAAW,EAAE,CAAC;AAAA,QAC/C,eAAe,eAAe,QAAQ;AAAA,QACtC,eAAe;AAAA,MACnB;AAAA,MAEA;AAAA,4BAAC,UAAK,OAAO,MAAM;AAAA,QAAE;AAAA,QAErB,oBAAC,UAAK,OAAO,MAAM;AAAA;AAAA;AAAA,EACvB;AAEJ,QAAM,cAAc,CAAC,OAAoC;AAAA,IACrD,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,KAAK;AAAA,IACL,WAAW;AAAA,IACX,OAAO;AAAA,IACP,WAAW;AAAA,IACX,WAAW,MAAM,IAAI,IAAI;AAAA,IACzB,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,UAAU,WAAW,EAAE;AAAA,IACvB,gBAAgB;AAAA,EACpB;AAIA,MAAI,cAAc,MAAM;AACpB,QAAI,CAAC,MAAO,QAAO;AACnB,WACI,qBAAC,SAAI,4BAAyB,IAAG,eAAY,QACxC;AAAA,OAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MACT,oBAAC,SAAY,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,YAAY,SAAS,GAAG,oBAAvD,CAEV,CACH;AAAA,MACA;AAAA,OACL;AAAA,EAER;AACA,QAAM,UAAU,UAAU,IAAI,CAAC,GAAG,MAC9B;AAAA,IAAC;AAAA;AAAA,MAEG,MACI,eACM,aAAa,EAAE,EAAE,IACjB,GAAG,UAAU,aAAa,EAAE,EAAE,oBAAoB;AAAA,QAC9C;AAAA,MACJ,CAAC,GAAG,MAAM,WAAW,EAAE;AAAA,MAEjC,2BAAyB,EAAE;AAAA,MAC3B,OAAO,YAAY,CAAC;AAAA,MAEpB;AAAA,4BAAC,gBAAa,IAAI,EAAE,IAAI;AAAA,QACxB,oBAAC,UAAM,YAAE,OAAM;AAAA;AAAA;AAAA,IAZV,EAAE;AAAA,EAaX,CACH;AAID,SACI;AAAA,IAAC;AAAA;AAAA,MACG,4BAAyB;AAAA,MACzB,OAAO,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,UAAU;AAAA,MAE3D,kBACG,iCACK;AAAA;AAAA,QACA;AAAA,SACL,IAEA,iCACK;AAAA;AAAA,QACA;AAAA,SACL;AAAA;AAAA,EAER;AAER;AAuBA,eAAe,cAAqC;AAMhD,SAAQ,MAAM,OAAO,6BAA6B;AACtD;AAIA,eAAe,uBAAkD;AAC7D,UAAQ,MAAM,YAAY,GACrB,cAAc,EACd,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,QAAQ,EAC7C,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE;AAChD;AAEA,SAAS,WAAW;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,GAAwC;AACpC,QAAM,MAAY,YAAM;AACxB,QAAM,MAAM;AAAA,IACR,SAAS,GAAG,GAAG;AAAA,IACf,QAAQ,GAAG,GAAG;AAAA,IACd,SAAS,GAAG,GAAG;AAAA,IACf,WAAW,GAAG,GAAG;AAAA,EACrB;AACA,QAAM,CAAC,SAAS,UAAU,IAAU,eAAS,EAAE;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAU,eAAS,KAAK;AAExD,QAAM,CAAC,SAAS,UAAU,IAAU,eAAkC,IAAI;AAC1E,QAAM,CAAC,UAAU,WAAW,IAAU,eAAwB,IAAI;AAIlE,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAoD,IAAI;AAC1F,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAS,EAAE;AAC7C,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAuC,MAAM;AAE/E,EAAM,gBAAU,MAAM;AAClB,QAAI,YAAY;AAChB,yBAAqB,EAChB,KAAK,CAAC,UAAU;AACb,UAAI,UAAW;AACf,iBAAW,KAAK;AAChB,kBAAY,MAAM,CAAC,GAAG,MAAM,IAAI;AAAA,IACpC,CAAC,EACA,MAAM,MAAM;AACT,UAAI,CAAC,UAAW,YAAW,CAAC,CAAC;AAAA,IACjC,CAAC;AACL,WAAO,MAAM;AACT,kBAAY;AAAA,IAChB;AAAA,EACJ,GAAG,CAAC,CAAC;AAEL,iBAAe,eAAe,MAA2D;AACrF,UAAM,MAAM,MAAM;AAAA,MACd,GAAG,UAAU,uBAAuB,mBAAmB,IAAI,CAAC,aAAa,mBAAmB,QAAQ,CAAC;AAAA,IACzG;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,IAAI,MAAM,CAAC,KAAK,WAAW,CAAC,KAAK,OAAO;AACzC,YAAM,IAAI,MAAM,KAAK,SAAS,kBAAkB;AAAA,IACpD;AACA,WAAO,EAAE,SAAS,KAAK,SAAS,OAAO,KAAK,MAAM;AAAA,EACtD;AAOA,iBAAe,gBACX,SACA,OACA,WACA,QACa;AAEb,UAAM,MAAM,MAAM,MAAM,GAAG,UAAU,oBAAoB;AAAA,MACrD,QAAQ;AAAA,MACR;AAAA,MACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACjB;AAAA,QACA;AAAA,QACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC3B,eAAe;AAAA,QACf,kBAAkB;AAAA,QAClB,iBAAiB;AAAA;AAAA;AAAA,QAGjB,GAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAC/B,CAAC;AAAA,IACL,CAAC;AACD,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,IAAI,MAAM,EAAE,QAAQ,SAAS,CAAC,KAAK,MAAM,CAAC,KAAK,SAAS;AACzD,YAAM,IAAI;AAAA,QACL,YAAY,QAAQ,KAAK,UACrB,WAAW,QAAQ,KAAK,SACzB;AAAA,MACR;AAAA,IACJ;AACA,cAAU,KAAK,SAAS,KAAK,KAAK;AAAA,EACtC;AAEA,iBAAe,OAAO,GAAmC;AACrD,MAAE,eAAe;AACjB,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,CAAC,MAAM;AACP,eAAS,6BAA6B;AACtC;AAAA,IACJ;AACA,QAAI,CAAC,wBAAwB,IAAI,GAAG;AAChC,eAAS,iBAAiB,eAAe,QAAQ,CAAC;AAClD;AAAA,IACJ;AACA,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI,OAA+B;AACnC,QAAI;AAGA,UAAI,KAAK;AACT,UAAI,YAAY,MAAM;AAClB,cAAM,QAAQ,MAAM,qBAAqB,EAAE,MAAM,MAAM,CAAC,CAAC;AACzD,mBAAW,KAAK;AAChB,aAAK,MAAM,CAAC,GAAG,MAAM;AACrB,oBAAY,EAAE;AAAA,MAClB;AACA,YAAM,YAAY,MAAM,eAAe,IAAI;AAC3C,UAAI,CAAC,IAAI;AACL,kBAAU,SAAS;AACnB,sBAAc,KAAK;AACnB;AAAA,MACJ;AACA,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI;AACJ,UAAI;AACA,oBAAY,MAAM,QAAQ,UAAU,IAAI,EAAE,SAAS,KAAK,CAAC,EAAE,UAAU,OAAO;AAAA,MAChF,SAAS,KAAK;AAEV,iBAAS,QAAQ,kBAAkB,GAAG,CAAC;AACvC,sBAAc,KAAK;AACnB;AAAA,MACJ;AACA,aAAO;AACP,YAAM,gBAAgB,UAAU,SAAS,UAAU,OAAO,WAAW,QAAQ;AAAA,IACjF,SAAS,KAAK;AACV,eAAS,eAAe,KAAK,UAAU,MAAM,UAAU,CAAC;AACxD,oBAAc,KAAK;AAAA,IACvB;AAAA,EACJ;AAEA,iBAAe,aAAa,GAAmC;AAC3D,MAAE,eAAe;AACjB,QAAI,CAAC,OAAQ;AACb,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,CAAC,KAAK;AACN,eAAS,2CAA2C;AACpD;AAAA,IACJ;AACA,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI;AACA,YAAM,gBAAgB,OAAO,SAAS,OAAO,OAAO,KAAK,MAAS;AAAA,IACtE,SAAS,KAAK;AACV,eAAS,eAAe,KAAK,UAAU,UAAU,UAAU,CAAC;AAC5D,oBAAc,KAAK;AAAA,IACvB;AAAA,EACJ;AAEA,iBAAe,cAA6B;AACxC,QAAI,CAAC,OAAQ;AACb,QAAI;AACA,YAAM,UAAU,UAAU,UAAU,OAAO,OAAO;AAClD,gBAAU,QAAQ;AAAA,IACtB,QAAQ;AACJ,gBAAU,QAAQ;AAAA,IACtB;AAAA,EACJ;AAEA,MAAI,QAAQ;AACR,WACI,qBAAC,UAAK,UAAU,cAAc,gCAA6B,IACvD;AAAA,2BAAC,cAAW;AAAA;AAAA,QAC2C,QAAQ,KAAK;AAAA,QAAE;AAAA,SAEtE;AAAA,MACA,oBAAC,SAAM,SAAS,IAAI,SAAS,6BAAe;AAAA,MAC5C;AAAA,QAAC;AAAA;AAAA,UACG,kBAAe;AAAA,UACf,IAAI,IAAI;AAAA,UACR,UAAQ;AAAA,UACR,OAAO,OAAO;AAAA,UACd,MAAM;AAAA,UACN,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO;AAAA,UACvC,OAAO,EAAE,GAAG,YAAY,QAAQ,WAAW;AAAA;AAAA,MAC/C;AAAA,MACA,oBAAC,YAAO,MAAK,UAAS,SAAS,MAAM,KAAK,YAAY,GAAG,OAAO,iBAC3D,qBAAW,WAAW,WAAW,gBACtC;AAAA,MACC,WAAW,YACR,oBAAC,QAAK,oEAA2D;AAAA,MAErE,qBAAC,SAAI,OAAO,EAAE,WAAW,GAAG,GACxB;AAAA,4BAAC,SAAM,SAAS,IAAI,WAAW,uBAAS;AAAA,QACxC;AAAA,UAAC;AAAA;AAAA,YACG,kBAAe;AAAA,YACf,IAAI,IAAI;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,MAAM;AACb,wBAAU,EAAE,OAAO,KAAK;AACxB,kBAAI,MAAO,UAAS,IAAI;AAAA,YAC5B;AAAA,YACA,MAAM;AAAA,YACN,aAAY;AAAA,YACZ,YAAY;AAAA,YACZ,WAAS;AAAA,YACT,gBAAc,QAAQ,OAAO;AAAA,YAC7B,OAAO,EAAE,GAAG,YAAY,QAAQ,WAAW;AAAA;AAAA,QAC/C;AAAA,SACJ;AAAA,MACC,SAAS,oBAAC,aAAW,iBAAM;AAAA,MAC5B;AAAA,QAAC;AAAA;AAAA,UACG,MAAK;AAAA,UACL,UAAU,cAAc,CAAC,OAAO,KAAK;AAAA,UACrC,OAAO,YAAY,cAAc,CAAC,OAAO,KAAK,CAAC;AAAA,UAE9C,uBAAa,mBAAc,oBAAC,UAAO,wBAAU;AAAA;AAAA,MAClD;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACG,MAAK;AAAA,UACL,SAAS,MAAM;AACX,sBAAU,IAAI;AACd,sBAAU,EAAE;AACZ,qBAAS,IAAI;AACb,sBAAU,MAAM;AAAA,UACpB;AAAA,UACA,OAAO;AAAA,UACV;AAAA;AAAA,MAED;AAAA,OACJ;AAAA,EAER;AAEA,QAAM,kBAAkB,YAAY,QAAQ,QAAQ,WAAW;AAC/D,SACI,qBAAC,UAAK,UAAU,QAAQ,yBAAsB,IAC1C;AAAA,wBAAC,cAAW,sNAIZ;AAAA,IACA,oBAAC,SAAM,SAAS,IAAI,SAAS,6BAAe;AAAA,IAC5C;AAAA,MAAC;AAAA;AAAA,QACG,kBAAe;AAAA,QACf,IAAI,IAAI;AAAA,QACR,MAAK;AAAA,QACL,OAAO;AAAA,QACP,UAAU,CAAC,MAAM;AACb,qBAAW,kBAAkB,EAAE,OAAO,KAAK,CAAC;AAC5C,cAAI,MAAO,UAAS,IAAI;AAAA,QAC5B;AAAA,QACA,aAAY;AAAA,QACZ,cAAa;AAAA,QACb,gBAAe;AAAA,QACf,YAAY;AAAA,QACZ,UAAQ;AAAA,QACR,gBAAc,QAAQ,OAAO;AAAA,QAC7B,OAAO;AAAA;AAAA,IACX;AAAA,IACC,WAAW,QAAQ,SAAS,KACzB,qBAAC,SAAI,OAAO,EAAE,WAAW,GAAG,GACxB;AAAA,0BAAC,SAAM,SAAS,IAAI,QAAQ,uBAAS;AAAA,MACrC;AAAA,QAAC;AAAA;AAAA,UACG,IAAI,IAAI;AAAA,UACR,OAAO,YAAY;AAAA,UACnB,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,UAC3C,OAAO;AAAA,UAEN,kBAAQ,IAAI,CAAC,MACV,oBAAC,YAAkB,OAAO,EAAE,IACvB,YAAE,QADM,EAAE,EAEf,CACH;AAAA;AAAA,MACL;AAAA,OACJ;AAAA,IAEH,SAAS,oBAAC,aAAW,iBAAM;AAAA,IAC5B;AAAA,MAAC;AAAA;AAAA,QACG,MAAK;AAAA,QACL,UAAU,cAAc,CAAC,QAAQ,KAAK;AAAA,QACtC,OAAO,YAAY,cAAc,CAAC,QAAQ,KAAK,CAAC;AAAA,QAE/C,uBACK,6BACA,kBACE,oBAAC,UAAO,qCAAuB,IAC/B,oBAAC,UAAO,iCAAmB;AAAA;AAAA,IACvC;AAAA,IACC,mBACG,oBAAC,QAAK,mFAAqE;AAAA,KAEnF;AAER;AAMA,SAAS,UAAU,EAAE,YAAY,KAAK,aAAa,UAAU,GAAkC;AAC3F,QAAM,MAAY,YAAM;AACxB,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAqB,OAAO;AAC5D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAS,EAAE;AAC3C,QAAM,CAAC,YAAY,aAAa,IAAU,eAAwB,IAAI;AACtE,QAAM,CAAC,MAAM,OAAO,IAAU,eAAS,EAAE;AACzC,QAAM,CAAC,WAAW,YAAY,IAAU,eAAwB,IAAI;AACpE,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAU,eAAS,KAAK;AACxD,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAS,KAAK;AAGhD,iBAAe,SAAS,SAAyC;AAC7D,QAAI;AACA,YAAM,MAAM,MAAM,MAAM,GAAG,UAAU,6BAA6B;AAAA,QAC9D,QAAQ;AAAA,QACR;AAAA,QACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC3C,CAAC;AACD,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAO,QAAO,iBAAiB,KAAK,UAAU,gBAAgB,OAAO;AAC1F,eAAS,KAAK,KAAK;AACnB,aAAO;AAAA,IACX,QAAQ;AACJ,aAAO,aAAa,UAAU;AAAA,IAClC;AAAA,EACJ;AAEA,iBAAe,MAAM,GAAmC;AACpD,MAAE,eAAe;AACjB,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,WAAW,CAAC,YAAY,KAAK,OAAO,GAAG;AACxC,oBAAc,iBAAiB,iBAAiB,OAAO,CAAC;AACxD;AAAA,IACJ;AACA,kBAAc,IAAI;AAClB,kBAAc,IAAI;AAClB,UAAM,MAAM,MAAM,SAAS,OAAO;AAClC,kBAAc,KAAK;AACnB,QAAI,KAAK;AACL,oBAAc,GAAG;AACjB;AAAA,IACJ;AACA,aAAS,OAAO;AAChB,aAAS,MAAM;AAAA,EACnB;AAEA,iBAAe,SAAwB;AACnC,iBAAa,IAAI;AACjB,cAAU,KAAK;AACf,kBAAc,IAAI;AAClB,UAAM,MAAM,MAAM,SAAS,KAAK;AAChC,kBAAc,KAAK;AACnB,YAAQ,EAAE;AACV,QAAI,IAAK,cAAa,GAAG;AAAA,QACpB,WAAU,IAAI;AAAA,EACvB;AAEA,iBAAe,OAAO,GAAmC;AACrD,MAAE,eAAe;AACjB,QAAI,CAAC,MAAO;AACZ,QAAI,KAAK,WAAW,GAAG;AACnB,mBAAa,uBAAuB;AACpC;AAAA,IACJ;AACA,iBAAa,IAAI;AACjB,kBAAc,IAAI;AAClB,QAAI;AACA,YAAM,MAAM,MAAM,MAAM,GAAG,UAAU,8BAA8B;AAAA,QAC/D,QAAQ;AAAA,QACR;AAAA,QACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA;AAAA,UAEA,GAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,QAC/B,CAAC;AAAA,MACL,CAAC;AACD,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAI,CAAC,IAAI,MAAM,EAAE,QAAQ,SAAS,CAAC,KAAK,MAAM,CAAC,KAAK,SAAS;AACzD,cAAM,IAAI;AAAA,UACL,YAAY,QAAQ,KAAK,UACrB,WAAW,QAAQ,KAAK,SACzB;AAAA,QACR;AAAA,MACJ;AACA,gBAAU,KAAK,SAAS,KAAK,KAAK;AAAA,IACtC,SAAS,KAAK;AACV,mBAAa,eAAe,KAAK,SAAS,UAAU,UAAU,CAAC;AAAA,IACnE,UAAE;AACE,oBAAc,KAAK;AAAA,IACvB;AAAA,EACJ;AAEA,MAAI,UAAU,SAAS;AACnB,WACI,qBAAC,UAAK,UAAU,OAAO,wBAAqB,IACxC;AAAA,0BAAC,cAAW,mJAGZ;AAAA,MACA,oBAAC,SAAM,SAAS,GAAG,GAAG,UAAU,mBAAK;AAAA,MACrC;AAAA,QAAC;AAAA;AAAA,UACG,kBAAe;AAAA,UACf,IAAI,GAAG,GAAG;AAAA,UACV,MAAK;AAAA,UACL,cAAa;AAAA,UACb,OAAO;AAAA,UACP,UAAU,CAAC,MAAM;AACb,qBAAS,EAAE,OAAO,KAAK;AACvB,gBAAI,WAAY,eAAc,IAAI;AAAA,UACtC;AAAA,UACA,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,gBAAc,aAAa,OAAO;AAAA,UAClC,OAAO;AAAA;AAAA,MACX;AAAA,MACC,cAAc,oBAAC,aAAW,sBAAW;AAAA,MACtC,oBAAC,YAAO,MAAK,UAAS,UAAU,YAAY,OAAO,YAAY,UAAU,GACpE,uBAAa,kBAAa,oBAAC,UAAO,gCAAkB,GACzD;AAAA,OACJ;AAAA,EAER;AAEA,SACI,qBAAC,UAAK,UAAU,QAAQ,+BAA4B,IAChD;AAAA,yBAAC,cACI;AAAA,eAAS,wBAAwB;AAAA,MAClC,oBAAC,UAAK,OAAO,EAAE,OAAO,6BAA6B,GAAI,iBAAM;AAAA,MAAO;AAAA,OAExE;AAAA,IACA,oBAAC,SAAM,SAAS,GAAG,GAAG,SAAS,2BAAa;AAAA,IAC5C;AAAA,MAAC;AAAA;AAAA,QACG,kBAAe;AAAA,QACf,IAAI,GAAG,GAAG;AAAA,QACV,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAQ;AAAA,QACR,WAAW;AAAA,QACX,cAAa;AAAA,QACb,OAAO;AAAA,QACP,UAAU,CAAC,MAAM;AACb,kBAAQ,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACrD,cAAI,UAAW,cAAa,IAAI;AAAA,QACpC;AAAA,QACA,aAAY;AAAA,QACZ,UAAQ;AAAA,QACR,WAAS;AAAA,QACT,gBAAc,YAAY,OAAO;AAAA,QACjC,OAAO,EAAE,GAAG,YAAY,eAAe,SAAS,UAAU,GAAG;AAAA;AAAA,IACjE;AAAA,IACC,aAAa,oBAAC,aAAW,qBAAU;AAAA,IACpC;AAAA,MAAC;AAAA;AAAA,QACG,MAAK;AAAA,QACL,UAAU,cAAc,KAAK,WAAW;AAAA,QACxC,OAAO,YAAY,cAAc,KAAK,WAAW,CAAC;AAAA,QAEjD,uBAAa,oBAAe,oBAAC,UAAO,oCAAmB;AAAA;AAAA,IAC5D;AAAA,IACA,qBAAC,SACG;AAAA;AAAA,QAAC;AAAA;AAAA,UACG,MAAK;AAAA,UACL,SAAS,MAAM,KAAK,OAAO;AAAA,UAC3B,UAAU;AAAA,UACV,OAAO;AAAA,UACV;AAAA;AAAA,MAED;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACG,MAAK;AAAA,UACL,SAAS,MAAM;AACX,qBAAS,OAAO;AAChB,oBAAQ,EAAE;AACV,qBAAS,IAAI;AACb,sBAAU,KAAK;AAAA,UACnB;AAAA,UACA,OAAO;AAAA,UACV;AAAA;AAAA,MAED;AAAA,OACJ;AAAA,KACJ;AAER;AAKA,SAAS,OAAO,EAAE,SAAS,GAA6C;AACpE,SACI,iCACK;AAAA;AAAA,IACD,oBAAC,UAAK,eAAY,QAAO,OAAO,EAAE,SAAS,aAAa,GACnD,qBACL;AAAA,KACJ;AAER;AAEA,SAAS,WAAW;AAAA,EAChB;AAAA,EACA;AACJ,GAIuB;AACnB,SACI,qBAAC,SAAI,OAAO,EAAE,cAAc,GAAG,GAC1B;AAAA,aACG;AAAA,MAAC;AAAA;AAAA,QACG,OAAO;AAAA,UACH,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,UAAU,WAAW,EAAE;AAAA,UACvB,eAAe,eAAe,QAAQ;AAAA,UACtC,eAAe;AAAA,UACf,cAAc;AAAA,QAClB;AAAA,QAEC;AAAA;AAAA,IACL;AAAA,IAEJ;AAAA,MAAC;AAAA;AAAA,QACG,OAAO;AAAA,UACH,OAAO;AAAA,UACP,UAAU,eAAe,QAAQ,MAAM;AAAA,UACvC,YAAY;AAAA,UACZ,QAAQ;AAAA,QACZ;AAAA,QAEC;AAAA;AAAA,IACL;AAAA,KACJ;AAER;AAEA,IAAM,kBAAuC;AAAA,EACzC,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,UAAU,eAAe,UAAU,WAAW,EAAE,CAAC;AAAA,EACjD,eAAe,eAAe,QAAQ;AAAA,EACtC,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,SAAS;AACb;AAEA,SAAS,MAAM;AAAA,EACX;AAAA,EACA;AACJ,GAGuB;AACnB,SACI;AAAA,IAAC;AAAA;AAAA,MACG;AAAA,MACA,OAAO;AAAA,QACH,SAAS;AAAA,QACT,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,UAAU,eAAe,SAAS,WAAW,EAAE,CAAC;AAAA,QAChD,eAAe,eAAe,QAAQ;AAAA,QACtC,eAAe;AAAA,QACf,cAAc;AAAA,MAClB;AAAA,MAEC;AAAA;AAAA,EACL;AAER;AAEA,IAAM,aAAkC;AAAA,EACpC,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAc,aAAa,CAAC;AAAA,EAC5B,YAAY;AAAA;AAAA;AAAA;AAAA,EAIZ,UAAU;AACd;AAEA,IAAM,gBAAqC;AAAA,EACvC,SAAS;AAAA,EACT,YAAY;AAAA;AAAA,EAEZ,WAAW;AAAA,EACX,KAAK;AAAA,EACL,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,UAAU,eAAe,QAAQ,WAAW,EAAE,CAAC;AAAA,EAC/C,YAAY;AAAA,EACZ,QAAQ;AACZ;AAEA,SAAS,YAAY,UAAwC;AACzD,SAAO;AAAA,IACH,WAAW;AAAA,IACX,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,UAAU,eAAe,UAAU,WAAW,EAAE,CAAC;AAAA,IACjD,eAAe,eAAe,QAAQ;AAAA,IACtC,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,QAAQ,WAAW,gBAAgB;AAAA,IACnC,SAAS,WAAW,MAAM;AAAA,IAC1B,OAAO;AAAA,EACX;AACJ;AAEA,SAAS,UAAU,EAAE,SAAS,GAAsD;AAChF,SACI;AAAA,IAAC;AAAA;AAAA,MACG,MAAK;AAAA,MACL,OAAO;AAAA,QACH,WAAW;AAAA,QACX,cAAc;AAAA,QACd,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,UAAU,eAAe,QAAQ,WAAW,EAAE,CAAC;AAAA,QAC/C,eAAe;AAAA,MACnB;AAAA,MAEC;AAAA;AAAA,EACL;AAER;AAEA,SAAS,KAAK,EAAE,SAAS,GAAsD;AAC3E,SACI;AAAA,IAAC;AAAA;AAAA,MACG,OAAO;AAAA,QACH,WAAW;AAAA,QACX,cAAc;AAAA,QACd,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,UAAU,eAAe,QAAQ,QAAQ;AAAA,QACzC,YAAY;AAAA,MAChB;AAAA,MAEC;AAAA;AAAA,EACL;AAER;","names":["SigninTab"]}
package/dist/index.js CHANGED
@@ -2,6 +2,7 @@
2
2
 
3
3
  var React4 = require('react');
4
4
  var jsxRuntime = require('react/jsx-runtime');
5
+ var bip322 = require('@orangecheck/bip322');
5
6
  var browser = require('@simplewebauthn/browser');
6
7
 
7
8
  function _interopNamespace(e) {
@@ -1294,6 +1295,9 @@ var OcAddressInput = React4__namespace.forwardRef(
1294
1295
  );
1295
1296
  }
1296
1297
  );
1298
+ function addressInputValue(raw) {
1299
+ return bip322.normalizeAddress(raw) ?? raw;
1300
+ }
1297
1301
 
1298
1302
  // src/sudo.tsx
1299
1303
  function redirectToSudo(args = {}) {
@@ -1935,7 +1939,7 @@ function BtcLinkForm({
1935
1939
  "data-oca-field": "",
1936
1940
  type: "text",
1937
1941
  value: addr,
1938
- onChange: (e) => setAddr(e.target.value.trim()),
1942
+ onChange: (e) => setAddr(addressInputValue(e.target.value.trim())),
1939
1943
  placeholder: "bc1q\u2026",
1940
1944
  autoCapitalize: "none",
1941
1945
  spellCheck: false,
@@ -2291,7 +2295,18 @@ var BECH32_ADDRESS = /^(bc1|tb1|bcrt1)[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{8,87}$/
2291
2295
  var BASE58_ADDRESS = /^[123mn][1-9A-HJ-NP-Za-km-z]{25,34}$/;
2292
2296
  function looksLikeBitcoinAddress(input) {
2293
2297
  const s = input.trim();
2294
- return BECH32_ADDRESS.test(s) || BASE58_ADDRESS.test(s);
2298
+ if (BECH32_ADDRESS.test(s)) return s === s.toLowerCase() || s === s.toUpperCase();
2299
+ return BASE58_ADDRESS.test(s);
2300
+ }
2301
+ var OAUTH_EMAIL_CODE_REASONS = /* @__PURE__ */ new Set(["email_code_required", "account_mismatch"]);
2302
+ function oauthErrorText(reason) {
2303
+ if (reason === "email_code_required") {
2304
+ return "This email already has an orangecheck account. Sign in to it with an email code below.";
2305
+ }
2306
+ if (reason === "account_mismatch") {
2307
+ return "A different Google or GitHub account is already linked to this email. Use that one, or sign in with an email code below.";
2308
+ }
2309
+ return "That sign-in didn't finish. Try again, or use another way below.";
2295
2310
  }
2296
2311
  function OcSignIn({
2297
2312
  audience,
@@ -2358,13 +2373,14 @@ function OcSignIn({
2358
2373
  };
2359
2374
  const [signedIn, setSignedIn] = React4__namespace.useState(null);
2360
2375
  const [linkAlso, setLinkAlso] = React4__namespace.useState(false);
2361
- const [oauthError, setOauthError] = React4__namespace.useState(false);
2376
+ const [oauthError, setOauthError] = React4__namespace.useState(null);
2362
2377
  React4__namespace.useEffect(() => {
2363
2378
  if (typeof window === "undefined") return;
2364
- if (new URLSearchParams(window.location.search).has("oauth_error")) {
2365
- setOauthError(true);
2366
- }
2367
- }, []);
2379
+ const reason = new URLSearchParams(window.location.search).get("oauth_error");
2380
+ if (reason === null) return;
2381
+ setOauthError(reason);
2382
+ if (OAUTH_EMAIL_CODE_REASONS.has(reason) && emailEnabled) setPath("email");
2383
+ }, [emailEnabled]);
2368
2384
  const navigate = React4__namespace.useCallback(
2369
2385
  async (account) => {
2370
2386
  if (resolveReturnTo) {
@@ -2465,7 +2481,7 @@ function OcSignIn({
2465
2481
  fontFamily: SIGNIN_FONT,
2466
2482
  fontSize: signinRoleSize("text", signinSize(11))
2467
2483
  },
2468
- children: "That sign-in didn't finish. Try again, or use another way below."
2484
+ children: oauthErrorText(oauthError)
2469
2485
  }
2470
2486
  ),
2471
2487
  addMode && /* @__PURE__ */ jsxRuntime.jsxs(
@@ -2995,7 +3011,7 @@ function WalletFlow({
2995
3011
  type: "text",
2996
3012
  value: address,
2997
3013
  onChange: (e) => {
2998
- setAddress(e.target.value);
3014
+ setAddress(addressInputValue(e.target.value));
2999
3015
  if (error) setError(null);
3000
3016
  },
3001
3017
  placeholder: "bc1q\u2026 \xB7 3\u2026 \xB7 1\u2026",
@@ -3799,7 +3815,7 @@ function BondForm({
3799
3815
  "aria-describedby": `${id}-advice`,
3800
3816
  style: inputStyle,
3801
3817
  value: address,
3802
- onChange: (e) => setAddress(e.target.value),
3818
+ onChange: (e) => setAddress(addressInputValue(e.target.value)),
3803
3819
  placeholder: "bc1q\u2026",
3804
3820
  spellCheck: false,
3805
3821
  autoComplete: "off",