@orangecheck/auth-client 2.5.1 → 2.6.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import * as React4 from 'react';
-import { jsxs, jsx } from 'react/jsx-runtime';
+import * as React3 from 'react';
+import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import { startRegistration, startAuthentication } from '@simplewebauthn/browser';
 
 // src/provider.tsx
@@ -21,7 +21,7 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
-var SessionContext = React4.createContext(null);
+var SessionContext = React3.createContext(null);
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -44,11 +44,11 @@ function OcSessionProvider({
   config,
   defaultReturnTo
 }) {
-  const cfg = React4.useMemo(() => resolveConfig(config), [config]);
-  const [account, setAccount] = React4.useState(null);
-  const [status, setStatus] = React4.useState("loading");
-  const [error, setError] = React4.useState(null);
-  const refresh = React4.useCallback(async () => {
+  const cfg = React3.useMemo(() => resolveConfig(config), [config]);
+  const [account, setAccount] = React3.useState(null);
+  const [status, setStatus] = React3.useState("loading");
+  const [error, setError] = React3.useState(null);
+  const refresh = React3.useCallback(async () => {
     if (typeof window === "undefined") return;
     try {
       const res = await fetch(cfg.mePath, {
@@ -77,10 +77,10 @@ function OcSessionProvider({
       setError(err instanceof Error ? err : new Error(String(err)));
     }
   }, [cfg.mePath]);
-  React4.useEffect(() => {
+  React3.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React4.useCallback(async () => {
+  const signOut = React3.useCallback(async () => {
     try {
       await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
         method: "POST",
@@ -91,7 +91,7 @@ function OcSessionProvider({
     setAccount(null);
     setStatus("anonymous");
   }, [cfg.authOrigin, cfg.logoutPath]);
-  const value = React4.useMemo(() => {
+  const value = React3.useMemo(() => {
     const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
     return {
       status,
@@ -105,7 +105,7 @@ function OcSessionProvider({
   return /* @__PURE__ */ jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
-  const ctx = React4.useContext(SessionContext);
+  const ctx = React3.useContext(SessionContext);
   if (!ctx) {
     throw new Error(
       "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
@@ -114,7 +114,7 @@ function useOcSession() {
   return ctx;
 }
 function useOptionalOcSession() {
-  return React4.useContext(SessionContext);
+  return React3.useContext(SessionContext);
 }
 function shortenAddress(addr) {
   if (addr.length <= 12) return addr;
@@ -129,7 +129,7 @@ function isPrefixOf(value, target) {
 }
 var listboxIdCounter = 0;
 function useUniqueId(prefix) {
-  const [id] = React4.useState(() => `${prefix}-${++listboxIdCounter}`);
+  const [id] = React3.useState(() => `${prefix}-${++listboxIdCounter}`);
   return id;
 }
 function OcAccountChip({
@@ -143,9 +143,9 @@ function OcAccountChip({
 }) {
   const { status, account, signInUrl: sessionSignInUrl, signOut } = useOcSession();
   const signInUrl = signInUrlOverride ?? sessionSignInUrl;
-  const [open, setOpen] = React4.useState(false);
-  const wrapRef = React4.useRef(null);
-  React4.useEffect(() => {
+  const [open, setOpen] = React3.useState(false);
+  const wrapRef = React3.useRef(null);
+  React3.useEffect(() => {
     if (!open) return;
     function handleClickOutside(e) {
       if (wrapRef.current && !wrapRef.current.contains(e.target)) {
@@ -468,9 +468,9 @@ function useOcAddressSuggestion(options) {
   } = options;
   const { status, account } = useOcSession();
   const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-  const [open, setOpen] = React4.useState(false);
-  const [highlighted, setHighlighted] = React4.useState(false);
-  const blurTimer = React4.useRef(null);
+  const [open, setOpen] = React3.useState(false);
+  const [highlighted, setHighlighted] = React3.useState(false);
+  const blurTimer = React3.useRef(null);
   const listboxId = useUniqueId("oc-addr-listbox");
   const optionId = `${listboxId}-opt`;
   const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -482,7 +482,7 @@ function useOcAddressSuggestion(options) {
     setOpen(false);
     setHighlighted(false);
   }
-  React4.useEffect(() => {
+  React3.useEffect(() => {
     return () => {
       if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
     };
@@ -585,7 +585,7 @@ function useOcAddressSuggestion(options) {
   ) : null;
   return { inputProps, popover };
 }
-var OcAddressInput = React4.forwardRef(
+var OcAddressInput = React3.forwardRef(
   function OcAddressInput2({
     value,
     onValueChange,
@@ -600,15 +600,15 @@ var OcAddressInput = React4.forwardRef(
   }, forwardedRef) {
     const { status, account } = useOcSession();
     const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-    const [open, setOpen] = React4.useState(false);
-    const [highlighted, setHighlighted] = React4.useState(false);
-    const innerRef = React4.useRef(null);
+    const [open, setOpen] = React3.useState(false);
+    const [highlighted, setHighlighted] = React3.useState(false);
+    const innerRef = React3.useRef(null);
     const setRef = (node) => {
       innerRef.current = node;
       if (typeof forwardedRef === "function") forwardedRef(node);
       else if (forwardedRef) forwardedRef.current = node;
     };
-    const blurTimer = React4.useRef(null);
+    const blurTimer = React3.useRef(null);
     const listboxId = useUniqueId("oc-addr-listbox");
     const optionId = `${listboxId}-opt`;
     const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -655,7 +655,7 @@ var OcAddressInput = React4.forwardRef(
       }
       onKeyDown?.(e);
     }
-    React4.useEffect(() => {
+    React3.useEffect(() => {
       return () => {
         if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
       };
@@ -748,6 +748,797 @@ var OcAddressInput = React4.forwardRef(
     );
   }
 );
+var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
+function OcLinkedIdentities({
+  authOrigin = DEFAULT_AUTH_ORIGIN,
+  className,
+  onChange
+}) {
+  const [resp, setResp] = React3.useState(null);
+  const [error, setError] = React3.useState(null);
+  const [showEmailLink, setShowEmailLink] = React3.useState(false);
+  const [showBtcLink, setShowBtcLink] = React3.useState(false);
+  const refresh = React3.useCallback(async () => {
+    setError(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/identities`, {
+        credentials: "include"
+      });
+      if (!r.ok) {
+        if (r.status === 401) {
+          setError("not signed in");
+          return;
+        }
+        throw new Error(`http_${r.status}`);
+      }
+      setResp(await r.json());
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "load failed");
+    }
+  }, [authOrigin]);
+  React3.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const afterChange = React3.useCallback(() => {
+    setShowEmailLink(false);
+    setShowBtcLink(false);
+    void refresh();
+    onChange?.();
+  }, [refresh, onChange]);
+  if (error) {
+    return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: panelStyle("warn"), role: "alert", children: [
+      /* @__PURE__ */ jsx(SectionLabel, { tone: "warn", children: "\xA7 identities \xB7 load deferred" }),
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Couldn't reach the auth host (",
+        error,
+        "). Linking is temporarily unavailable; your signed-in identity still works as normal."
+      ] }),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => void refresh(), style: ghostBtnStyle(false), children: "retry" })
+    ] });
+  }
+  if (!resp) {
+    return /* @__PURE__ */ jsx("div", { className, "data-oc-li": "", style: panelStyle(), children: /* @__PURE__ */ jsxs("span", { style: hintStyle, children: [
+      "> ",
+      "loading\u2026"
+    ] }) });
+  }
+  const linked = resp.linked ?? [];
+  const emailRows = linked.filter((i) => i.kind === "email");
+  const btcRows = linked.filter((i) => i.kind === "btc");
+  const hasEmail = emailRows.some((i) => i.value);
+  const hasBtc = btcRows.some((i) => i.value);
+  const mergedFrom = resp.merged_from ?? [];
+  return /* @__PURE__ */ jsxs("div", { className, "data-oc-li": "", style: { display: "grid", gap: 16 }, children: [
+    /* @__PURE__ */ jsxs("div", { style: panelStyle(), children: [
+      /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 what this is" }),
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Your public identity is the opaque ",
+        /* @__PURE__ */ jsx("code", { style: codeStyle, children: "did:oc:" }),
+        " DID. Below it sit your private linked identities \u2014 your email and your Bitcoin address. They never appear in dashboard chrome and never reach an integrator unless you grant the matching scope. Linking a second identity is also your account-recovery path: if you lose one, the other still signs you in."
+      ] })
+    ] }),
+    mergedFrom.length > 0 && /* @__PURE__ */ jsx(ConsolidationPanel, { entries: mergedFrom }),
+    /* @__PURE__ */ jsxs("div", { style: panelStyle("plain"), "data-oc-li-rows": "", children: [
+      /* @__PURE__ */ jsx(
+        IdentityGroup,
+        {
+          kind: "email",
+          title: "email",
+          rows: emailRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasEmail ? null : "link an email",
+          onAdd: () => {
+            setShowEmailLink((v) => !v);
+            setShowBtcLink(false);
+          }
+        }
+      ),
+      /* @__PURE__ */ jsx("div", { style: { borderTop: `1px solid ${V.border}` } }),
+      /* @__PURE__ */ jsx(
+        IdentityGroup,
+        {
+          kind: "btc",
+          title: "bitcoin address",
+          rows: btcRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasBtc ? null : "link a Bitcoin address",
+          onAdd: () => {
+            setShowBtcLink((v) => !v);
+            setShowEmailLink(false);
+          }
+        }
+      )
+    ] }),
+    showEmailLink && /* @__PURE__ */ jsx(
+      EmailLinkForm,
+      {
+        authOrigin,
+        onDone: afterChange,
+        onCancel: () => setShowEmailLink(false)
+      }
+    ),
+    showBtcLink && /* @__PURE__ */ jsx(
+      BtcLinkForm,
+      {
+        authOrigin,
+        didOc: resp.did_oc ?? null,
+        onDone: afterChange,
+        onCancel: () => setShowBtcLink(false)
+      }
+    )
+  ] });
+}
+function IdentityGroup({
+  kind,
+  title,
+  rows,
+  authOrigin,
+  onChange,
+  addCta,
+  onAdd
+}) {
+  if (rows.length === 0) {
+    return /* @__PURE__ */ jsxs("div", { style: rowStyle, children: [
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsxs("div", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          title
+        ] }),
+        /* @__PURE__ */ jsx("div", { style: { ...bodyStyle, marginTop: 4 }, children: "none linked" })
+      ] }),
+      addCta && /* @__PURE__ */ jsxs("button", { type: "button", onClick: onAdd, style: primaryChipStyle, children: [
+        "+ ",
+        addCta
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children: rows.map((r) => /* @__PURE__ */ jsx(
+    IdentityRow,
+    {
+      row: r,
+      kind,
+      authOrigin,
+      onChange
+    },
+    r.id
+  )) });
+}
+function IdentityRow({
+  row,
+  kind,
+  authOrigin,
+  onChange
+}) {
+  const [shown, setShown] = React3.useState(false);
+  const [confirming, setConfirming] = React3.useState(false);
+  const [busy, setBusy] = React3.useState(false);
+  const [err, setErr] = React3.useState(null);
+  const masked = row.value ? mask(row.value, kind) : "\u2014 pending recovery \u2014";
+  const display = shown && row.value ? row.value : masked;
+  async function unlink() {
+    if (row.is_primary) return;
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/auth/identities?id=${encodeURIComponent(row.id)}`,
+        { method: "DELETE", credentials: "include" }
+      );
+      if (!r.ok) {
+        const j = await r.json().catch(() => ({}));
+        throw new Error(j.reason ?? `http_${r.status}`);
+      }
+      onChange();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "unlink failed");
+      setBusy(false);
+      setConfirming(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: rowStyle, "data-oc-li-row": kind, children: [
+    /* @__PURE__ */ jsxs("div", { style: { minWidth: 0, flex: 1 }, children: [
+      /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexWrap: "wrap", gap: "4px 12px" }, children: [
+        /* @__PURE__ */ jsxs("span", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          kind === "email" ? "email" : "bitcoin address"
+        ] }),
+        row.is_primary && /* @__PURE__ */ jsx("span", { style: { ...rowLabelStyle, color: V.primary }, children: "primary \xB7 signup-time" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "div",
+        {
+          style: {
+            marginTop: 4,
+            color: V.foreground,
+            fontFamily: MONO,
+            fontSize: 12,
+            wordBreak: "break-all"
+          },
+          children: display
+        }
+      ),
+      row.verified_at && /* @__PURE__ */ jsxs("div", { style: { ...hintStyle, marginTop: 4 }, children: [
+        "verified \xB7 ",
+        new Date(row.verified_at).toUTCString()
+      ] }),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err })
+    ] }),
+    /* @__PURE__ */ jsxs("div", { style: { display: "flex", flexShrink: 0, gap: 8, flexWrap: "wrap" }, children: [
+      row.value && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setShown((s) => !s),
+          style: ghostBtnStyle(false),
+          children: shown ? "hide" : "show"
+        }
+      ),
+      !row.is_primary && !confirming && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setConfirming(true),
+          style: dangerBtnStyle(false),
+          children: "unlink"
+        }
+      ),
+      !row.is_primary && confirming && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void unlink(),
+            disabled: busy,
+            style: dangerBtnStyle(busy),
+            children: busy ? "unlinking\u2026" : "confirm unlink"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setConfirming(false),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "cancel"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function ConsolidationPanel({ entries }) {
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("success"), "data-oc-li-consolidated": "", children: [
+    /* @__PURE__ */ jsxs(SectionLabel, { tone: "success", children: [
+      "\xA7 consolidated accounts \xB7 ",
+      entries.length
+    ] }),
+    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+      entries.length === 1 ? "A previous OC account" : "Previous OC accounts",
+      " you signed up with, folded into this one under dual proof of control. Historical activity is unioned into this account automatically;",
+      " ",
+      entries.length === 1 ? "it" : "they",
+      " can no longer sign in."
+    ] }),
+    /* @__PURE__ */ jsx("ul", { style: { listStyle: "none", margin: "12px 0 0", padding: 0 }, children: entries.map((e) => /* @__PURE__ */ jsxs(
+      "li",
+      {
+        style: {
+          display: "flex",
+          flexWrap: "wrap",
+          gap: 8,
+          padding: "8px 0",
+          borderTop: `1px solid ${V.border}`,
+          fontFamily: MONO,
+          fontSize: 11
+        },
+        children: [
+          /* @__PURE__ */ jsx("code", { style: { color: V.foreground, wordBreak: "break-all" }, children: e.did_oc }),
+          /* @__PURE__ */ jsxs("span", { style: { ...hintStyle, marginLeft: "auto" }, children: [
+            "created ",
+            new Date(e.created_at).toLocaleDateString()
+          ] })
+        ]
+      },
+      e.did_oc
+    )) })
+  ] });
+}
+function EmailLinkForm({
+  authOrigin,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React3.useState("email");
+  const [email, setEmail] = React3.useState("");
+  const [code, setCode] = React3.useState("");
+  const [token, setToken] = React3.useState("");
+  const [busy, setBusy] = React3.useState(false);
+  const [err, setErr] = React3.useState(null);
+  const [transfer, setTransfer] = React3.useState(false);
+  async function start() {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email.trim().toLowerCase() })
+      });
+      const j = await r.json();
+      if (!r.ok || !j.token) throw new Error(j.reason ?? `http_${r.status}`);
+      setToken(j.token);
+      setStep("code");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "could not send code");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function verify(confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/email`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          email: email.trim().toLowerCase(),
+          code: code.trim(),
+          token,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "email_linked_elsewhere") {
+        setTransfer(true);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "email", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link an email" }),
+    step === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "email",
+          autoComplete: "email",
+          value: email,
+          onChange: (e) => setEmail(e.target.value),
+          placeholder: "you@example.com",
+          style: inputStyle
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void start(),
+            disabled: busy || email.trim().length < 5,
+            style: primaryBtnStyle(busy || email.trim().length < 5),
+            children: busy ? "sending\u2026" : "send code"
+          }
+        ),
+        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : transfer ? /* @__PURE__ */ jsx(
+      TransferConfirm,
+      {
+        what: "email",
+        busy,
+        onConfirm: () => void verify(true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Enter the 6-digit code sent to ",
+        email,
+        "."
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          inputMode: "numeric",
+          autoComplete: "one-time-code",
+          maxLength: 6,
+          value: code,
+          onChange: (e) => setCode(e.target.value.replace(/\D/g, "").slice(0, 6)),
+          placeholder: "123456",
+          style: { ...inputStyle, letterSpacing: "0.3em" }
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void verify(false),
+            disabled: busy || code.length !== 6,
+            style: primaryBtnStyle(busy || code.length !== 6),
+            children: busy ? "linking\u2026" : "verify + link"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setStep("email"),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "back"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function BtcLinkForm({
+  authOrigin,
+  didOc,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React3.useState("request");
+  const [addr, setAddr] = React3.useState("");
+  const [challenge, setChallenge] = React3.useState("");
+  const [busy, setBusy] = React3.useState(false);
+  const [err, setErr] = React3.useState(null);
+  const [pendingSig, setPendingSig] = React3.useState(null);
+  async function getChallenge() {
+    if (!didOc) {
+      setErr("session not loaded yet \xB7 refresh and retry");
+      return;
+    }
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&purpose=link&audience=${encodeURIComponent(didOc)}`
+      );
+      const j = await r.json();
+      if (!r.ok || !j.message) throw new Error(j.reason ?? `http_${r.status}`);
+      setChallenge(j.message);
+      setStep("sign");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "challenge failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function postLink(sig, confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/btc`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          message: challenge,
+          signature: sig,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "address_linked_elsewhere") {
+        setPendingSig(sig);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "btc", children: [
+    /* @__PURE__ */ jsx(SectionLabel, { children: "\xA7 link a Bitcoin address" }),
+    step === "request" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("p", { style: bodyStyle, children: "Enter a Bitcoin address you control. We generate a challenge and your wallet signs it (BIP-322)." }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: addr,
+          onChange: (e) => setAddr(e.target.value.trim()),
+          placeholder: "bc1q\u2026",
+          autoCapitalize: "none",
+          spellCheck: false,
+          style: { ...inputStyle, fontFamily: MONO }
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void getChallenge(),
+            disabled: busy || addr.length < 14,
+            style: primaryBtnStyle(busy || addr.length < 14),
+            children: busy ? "requesting\u2026" : "get challenge"
+          }
+        ),
+        /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : pendingSig ? /* @__PURE__ */ jsx(
+      TransferConfirm,
+      {
+        what: "bitcoin address",
+        busy,
+        onConfirm: () => void postLink(pendingSig, true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+        "Sign the challenge with the wallet that controls",
+        " ",
+        /* @__PURE__ */ jsx("span", { style: { fontFamily: MONO, wordBreak: "break-all" }, children: addr }),
+        "."
+      ] }),
+      /* @__PURE__ */ jsx(
+        LazyWalletButton,
+        {
+          address: addr,
+          message: challenge,
+          showManual: true,
+          layout: "list",
+          heading: null,
+          onSigned: (sig) => void postLink(sig, false),
+          onError: (e) => setErr(e?.message ?? "wallet rejected")
+        }
+      ),
+      err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsx(FormButtons, { children: /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => {
+            setStep("request");
+            setErr(null);
+          },
+          disabled: busy,
+          style: ghostBtnStyle(busy),
+          children: "back"
+        }
+      ) })
+    ] })
+  ] });
+}
+function TransferConfirm({
+  what,
+  busy,
+  onConfirm,
+  onCancel,
+  err
+}) {
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs("p", { style: bodyStyle, children: [
+      "This ",
+      what,
+      " is already linked to another OrangeCheck account. You've just proven control of it \u2014 you can transfer the link to this account under dual proof of control. The other account loses this sign-in path; its history stays verifiable. Continue?"
+    ] }),
+    err && /* @__PURE__ */ jsx(ErrorLine, { children: err }),
+    /* @__PURE__ */ jsxs(FormButtons, { children: [
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: onConfirm,
+          disabled: busy,
+          style: dangerBtnStyle(busy),
+          children: busy ? "transferring\u2026" : "transfer link here"
+        }
+      ),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: onCancel, disabled: busy, style: ghostBtnStyle(busy), children: "cancel" })
+    ] })
+  ] });
+}
+function LazyWalletButton(props) {
+  const [Comp, setComp] = React3.useState(null);
+  const [failed, setFailed] = React3.useState(false);
+  React3.useEffect(() => {
+    let alive = true;
+    import('@orangecheck/wallet-adapter/react').then((m) => {
+      if (alive) {
+        setComp(
+          () => m.OcWalletButton
+        );
+      }
+    }).catch(() => {
+      if (alive) setFailed(true);
+    });
+    return () => {
+      alive = false;
+    };
+  }, []);
+  if (failed) {
+    return /* @__PURE__ */ jsx(ErrorLine, { children: "@orangecheck/wallet-adapter not installed \xB7 add it to your site to link a wallet" });
+  }
+  if (!Comp) return /* @__PURE__ */ jsxs("span", { style: hintStyle, children: [
+    "> ",
+    "loading wallet options\u2026"
+  ] });
+  return /* @__PURE__ */ jsx(Comp, { ...props });
+}
+function mask(value, kind) {
+  if (kind === "email") {
+    const [user, host] = value.split("@");
+    if (!user || !host) return "\u2022\u2022\u2022\u2022";
+    const m = user.length <= 2 ? "\u2022".repeat(user.length) : user[0] + "\u2022".repeat(user.length - 2) + user.slice(-1);
+    return `${m}@${host}`;
+  }
+  if (value.length <= 12) return "\u2022".repeat(value.length);
+  return `${value.slice(0, 6)}\u2026${value.slice(-4)}`;
+}
+function SectionLabel({
+  children,
+  tone = "primary"
+}) {
+  const color = tone === "success" ? V.success : tone === "warn" ? V.warn : V.primary;
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      style: {
+        color,
+        fontFamily: MONO,
+        fontSize: 10,
+        letterSpacing: "0.18em",
+        textTransform: "uppercase",
+        marginBottom: 8
+      },
+      children
+    }
+  );
+}
+function ErrorLine({ children }) {
+  return /* @__PURE__ */ jsx(
+    "p",
+    {
+      role: "alert",
+      style: {
+        margin: "8px 0 0",
+        color: V.destructive,
+        fontFamily: MONO,
+        fontSize: 11
+      },
+      children
+    }
+  );
+}
+function FormButtons({ children }) {
+  return /* @__PURE__ */ jsx("div", { style: { display: "flex", flexWrap: "wrap", gap: 8, marginTop: 12 }, children });
+}
+var MONO = "ui-monospace, SFMono-Regular, monospace";
+var V = {
+  primary: "var(--primary, #f97316)",
+  foreground: "var(--foreground, #fafafa)",
+  muted: "var(--muted-foreground, #a1a1aa)",
+  background: "var(--background, #0a0a0a)",
+  card: "var(--card, #111113)",
+  border: "var(--border, #27272a)",
+  destructive: "var(--destructive, #ef4444)",
+  success: "var(--success, #22c55e)",
+  warn: "var(--warning, #eab308)"
+};
+function panelStyle(tone = "default") {
+  const base = {
+    background: V.card,
+    border: `1px solid ${V.border}`,
+    padding: "1.25rem"
+  };
+  if (tone === "plain") return { ...base, padding: 0 };
+  if (tone === "accent") return { ...base, borderColor: V.primary, background: "var(--card, #111113)" };
+  if (tone === "success") return { ...base, borderColor: V.success };
+  if (tone === "warn") return { ...base, borderColor: V.warn };
+  return base;
+}
+var bodyStyle = {
+  color: V.muted,
+  fontSize: 13,
+  lineHeight: 1.55,
+  margin: "0 0 12px"
+};
+var hintStyle = {
+  color: V.muted,
+  fontFamily: MONO,
+  fontSize: 10.5,
+  opacity: 0.8
+};
+var codeStyle = {
+  fontFamily: MONO,
+  color: V.foreground
+};
+var rowStyle = {
+  display: "flex",
+  flexWrap: "wrap",
+  alignItems: "center",
+  justifyContent: "space-between",
+  gap: 12,
+  padding: "1rem"
+};
+var rowLabelStyle = {
+  color: V.foreground,
+  fontFamily: MONO,
+  fontSize: 10.5,
+  letterSpacing: "0.12em",
+  textTransform: "uppercase",
+  opacity: 0.8
+};
+var inputStyle = {
+  width: "100%",
+  padding: "0.55rem 0.75rem",
+  background: V.background,
+  color: V.foreground,
+  border: `1px solid ${V.border}`,
+  borderRadius: 6,
+  fontFamily: MONO,
+  // 16px — never lower · suppresses iOS Safari focus auto-zoom.
+  fontSize: 16,
+  outline: "none",
+  boxSizing: "border-box"
+};
+function btnBase(disabled) {
+  return {
+    padding: "0.5rem 0.875rem",
+    borderRadius: 6,
+    fontFamily: MONO,
+    fontSize: 10.5,
+    letterSpacing: "0.12em",
+    textTransform: "uppercase",
+    cursor: disabled ? "not-allowed" : "pointer",
+    opacity: disabled ? 0.5 : 1
+  };
+}
+function primaryBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.primary,
+    color: "var(--primary-foreground, #0a0a0a)",
+    border: `1px solid ${V.primary}`,
+    fontWeight: 600
+  };
+}
+function ghostBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.background,
+    color: V.foreground,
+    border: `1px solid ${V.border}`
+  };
+}
+function dangerBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: "transparent",
+    color: V.destructive,
+    border: `1px solid ${V.destructive}`
+  };
+}
+var primaryChipStyle = {
+  ...btnBase(false),
+  background: "transparent",
+  color: V.primary,
+  border: `1px solid ${V.primary}`
+};
 function safeReturnTo(input) {
   const candidate = input ?? "/";
   if (typeof candidate !== "string") return "/";
@@ -763,6 +1554,7 @@ function OcSignIn({
   returnTo,
   onSuccess,
   resolveReturnTo,
+  linkPrompt,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -771,24 +1563,34 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
-  const [path, setPath] = React4.useState(initialPath);
-  const handleSuccess = React4.useCallback(
-    async (account, token) => {
-      if (onSuccess) {
-        onSuccess(account, token);
-        return;
-      }
+  const [path, setPath] = React3.useState(initialPath);
+  const [signedIn, setSignedIn] = React3.useState(null);
+  const navigate = React3.useCallback(
+    async (account) => {
       if (resolveReturnTo) {
         try {
-          const target = await resolveReturnTo(account);
-          hardNavigate(safeReturnTo(target));
+          hardNavigate(safeReturnTo(await resolveReturnTo(account)));
           return;
         } catch {
         }
       }
       hardNavigate(safeReturn);
     },
-    [onSuccess, resolveReturnTo, safeReturn]
+    [resolveReturnTo, safeReturn]
+  );
+  const handleSuccess = React3.useCallback(
+    async (account, token) => {
+      if (onSuccess) {
+        onSuccess(account, token);
+        return;
+      }
+      if (linkPrompt) {
+        setSignedIn(account);
+        return;
+      }
+      await navigate(account);
+    },
+    [onSuccess, linkPrompt, navigate]
   );
   if (!walletEnabled && !emailEnabled) {
     return /* @__PURE__ */ jsxs(
@@ -815,6 +1617,15 @@ function OcSignIn({
       }
     );
   }
+  if (signedIn) {
+    return /* @__PURE__ */ jsx("div", { className, "data-oc-signin": "", children: /* @__PURE__ */ jsx(
+      LinkPromptStep,
+      {
+        authOrigin,
+        onContinue: () => void navigate(signedIn)
+      }
+    ) });
+  }
   const showWallet = walletEnabled && (path === "wallet" || !emailEnabled);
   const showEmail = emailEnabled && (path === "email" || !walletEnabled);
   const bothEnabled = walletEnabled && emailEnabled;
@@ -857,6 +1668,25 @@ function OcSignIn({
     ] })
   ] });
 }
+function LinkPromptStep({
+  authOrigin,
+  onContinue
+}) {
+  return /* @__PURE__ */ jsxs("div", { "data-oc-signin-linkprompt": "", children: [
+    /* @__PURE__ */ jsx(FlowHeader, { label: "\xA7 signed in \xB7 add a backup", children: "You're in. Linking a second way to sign in \u2014 your email or your Bitcoin wallet \u2014 is also your recovery path: lose one, the other still gets you in. Optional; skip with continue." }),
+    /* @__PURE__ */ jsx(OcLinkedIdentities, { authOrigin }),
+    /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        onClick: onContinue,
+        style: submitStyle(false),
+        "data-oc-signin-continue": "",
+        children: "continue \u2192"
+      }
+    )
+  ] });
+}
 function SigninTab({
   active,
   onClick,
@@ -888,10 +1718,10 @@ function SigninTab({
   );
 }
 function WalletFlow({ authOrigin, audience, onSuccess }) {
-  const [address, setAddress] = React4.useState("");
-  const [error, setError] = React4.useState(null);
-  const [submitting, setSubmitting] = React4.useState(false);
-  const [stage, setStage] = React4.useState("enter");
+  const [address, setAddress] = React3.useState("");
+  const [error, setError] = React3.useState(null);
+  const [submitting, setSubmitting] = React3.useState(false);
+  const [stage, setStage] = React3.useState("enter");
   async function signIn(e) {
     e.preventDefault();
     const addr = address.trim();
@@ -970,10 +1800,10 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
         spellCheck: false,
         required: true,
         "aria-invalid": error ? true : void 0,
-        style: inputStyle
+        style: inputStyle2
       }
     ),
-    error && /* @__PURE__ */ jsx(ErrorLine, { children: error }),
+    error && /* @__PURE__ */ jsx(ErrorLine2, { children: error }),
     /* @__PURE__ */ jsx(
       "button",
       {
@@ -987,13 +1817,13 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
   ] });
 }
 function EmailFlow({ authOrigin, onSuccess }) {
-  const [stage, setStage] = React4.useState("enter");
-  const [email, setEmail] = React4.useState("");
-  const [emailError, setEmailError] = React4.useState(null);
-  const [code, setCode] = React4.useState("");
-  const [codeError, setCodeError] = React4.useState(null);
-  const [token, setToken] = React4.useState(null);
-  const [submitting, setSubmitting] = React4.useState(false);
+  const [stage, setStage] = React3.useState("enter");
+  const [email, setEmail] = React3.useState("");
+  const [emailError, setEmailError] = React3.useState(null);
+  const [code, setCode] = React3.useState("");
+  const [codeError, setCodeError] = React3.useState(null);
+  const [token, setToken] = React3.useState(null);
+  const [submitting, setSubmitting] = React3.useState(false);
   async function start(e) {
     e.preventDefault();
     const trimmed = email.trim().toLowerCase();
@@ -1069,10 +1899,10 @@ function EmailFlow({ authOrigin, onSuccess }) {
           placeholder: "you@example.com",
           required: true,
           "aria-invalid": emailError ? true : void 0,
-          style: inputStyle
+          style: inputStyle2
         }
       ),
-      emailError && /* @__PURE__ */ jsx(ErrorLine, { children: emailError }),
+      emailError && /* @__PURE__ */ jsx(ErrorLine2, { children: emailError }),
       /* @__PURE__ */ jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "sending\u2026" : "send one-time code \u2192" }),
       /* @__PURE__ */ jsx(Hint, { children: "OTP delivered by the auth host. Codes expire in 10 minutes and are single-use. Rate-limited 5 starts/hour/IP." })
     ] });
@@ -1101,10 +1931,10 @@ function EmailFlow({ authOrigin, onSuccess }) {
         required: true,
         autoFocus: true,
         "aria-invalid": codeError ? true : void 0,
-        style: { ...inputStyle, letterSpacing: "0.4em", fontSize: 16 }
+        style: { ...inputStyle2, letterSpacing: "0.4em", fontSize: 16 }
       }
     ),
-    codeError && /* @__PURE__ */ jsx(ErrorLine, { children: codeError }),
+    codeError && /* @__PURE__ */ jsx(ErrorLine2, { children: codeError }),
     /* @__PURE__ */ jsx(
       "button",
       {
@@ -1191,7 +2021,7 @@ function Label({ children }) {
     }
   );
 }
-var inputStyle = {
+var inputStyle2 = {
   width: "100%",
   padding: "0.55rem 0.75rem",
   background: "var(--background, #0a0a0a)",
@@ -1223,7 +2053,7 @@ function submitStyle(disabled) {
     width: "100%"
   };
 }
-function ErrorLine({ children }) {
+function ErrorLine2({ children }) {
   return /* @__PURE__ */ jsx(
     "p",
     {
@@ -1270,13 +2100,13 @@ function isAbortError(err) {
 }
 function useWebAuthnRegister(opts) {
   const authOrigin = resolveAuthOrigin(opts);
-  const [status, setStatus] = React4.useState("idle");
-  const [error, setError] = React4.useState(null);
-  const reset = React4.useCallback(() => {
+  const [status, setStatus] = React3.useState("idle");
+  const [error, setError] = React3.useState(null);
+  const reset = React3.useCallback(() => {
     setStatus("idle");
     setError(null);
   }, []);
-  const register = React4.useCallback(
+  const register = React3.useCallback(
     async (args) => {
       setError(null);
       setStatus("requesting-options");
@@ -1338,10 +2168,10 @@ function useWebAuthnRegister(opts) {
 function useWebAuthnList(opts) {
   const authOrigin = resolveAuthOrigin(opts);
   const { status: sessionStatus } = useOcSession();
-  const [credentials, setCredentials] = React4.useState([]);
-  const [status, setStatus] = React4.useState("loading");
-  const [error, setError] = React4.useState(null);
-  const refetch = React4.useCallback(async () => {
+  const [credentials, setCredentials] = React3.useState([]);
+  const [status, setStatus] = React3.useState("loading");
+  const [error, setError] = React3.useState(null);
+  const refetch = React3.useCallback(async () => {
     setError(null);
     if (sessionStatus !== "authenticated") {
       setCredentials([]);
@@ -1369,10 +2199,10 @@ function useWebAuthnList(opts) {
       setStatus("error");
     }
   }, [authOrigin, sessionStatus]);
-  React4.useEffect(() => {
+  React3.useEffect(() => {
     void refetch();
   }, [refetch]);
-  const rename = React4.useCallback(
+  const rename = React3.useCallback(
     async (id, label) => {
       try {
         const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
@@ -1397,7 +2227,7 @@ function useWebAuthnList(opts) {
     },
     [authOrigin, refetch]
   );
-  const remove = React4.useCallback(
+  const remove = React3.useCallback(
     async (id) => {
       try {
         const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
@@ -1425,13 +2255,13 @@ function useWebAuthnList(opts) {
 function useStepUpAuth(opts) {
   const authOrigin = resolveAuthOrigin(opts);
   const { refresh } = useOcSession();
-  const [status, setStatus] = React4.useState("idle");
-  const [error, setError] = React4.useState(null);
-  const reset = React4.useCallback(() => {
+  const [status, setStatus] = React3.useState("idle");
+  const [error, setError] = React3.useState(null);
+  const reset = React3.useCallback(() => {
     setStatus("idle");
     setError(null);
   }, []);
-  const stepUp = React4.useCallback(
+  const stepUp = React3.useCallback(
     async (args) => {
       setError(null);
       setStatus("requesting-options");
@@ -1516,6 +2346,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, OcAccountChip, OcAccountPill, OcAddressInput, OcSessionProvider, OcSignIn, OcSignInButton, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map