@orangecheck/auth-client 2.5.1 → 2.7.0

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var React4 = require('react');
+var React3 = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 var browser = require('@simplewebauthn/browser');
 
@@ -22,7 +22,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var React4__namespace = /*#__PURE__*/_interopNamespace(React4);
+var React3__namespace = /*#__PURE__*/_interopNamespace(React3);
 
 // src/provider.tsx
 
@@ -43,7 +43,7 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
-var SessionContext = React4__namespace.createContext(null);
+var SessionContext = React3__namespace.createContext(null);
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -66,11 +66,11 @@ function OcSessionProvider({
   config,
   defaultReturnTo
 }) {
-  const cfg = React4__namespace.useMemo(() => resolveConfig(config), [config]);
-  const [account, setAccount] = React4__namespace.useState(null);
-  const [status, setStatus] = React4__namespace.useState("loading");
-  const [error, setError] = React4__namespace.useState(null);
-  const refresh = React4__namespace.useCallback(async () => {
+  const cfg = React3__namespace.useMemo(() => resolveConfig(config), [config]);
+  const [account, setAccount] = React3__namespace.useState(null);
+  const [status, setStatus] = React3__namespace.useState("loading");
+  const [error, setError] = React3__namespace.useState(null);
+  const refresh = React3__namespace.useCallback(async () => {
     if (typeof window === "undefined") return;
     try {
       const res = await fetch(cfg.mePath, {
@@ -99,10 +99,10 @@ function OcSessionProvider({
       setError(err instanceof Error ? err : new Error(String(err)));
     }
   }, [cfg.mePath]);
-  React4__namespace.useEffect(() => {
+  React3__namespace.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React4__namespace.useCallback(async () => {
+  const signOut = React3__namespace.useCallback(async () => {
     try {
       await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
         method: "POST",
@@ -113,7 +113,7 @@ function OcSessionProvider({
     setAccount(null);
     setStatus("anonymous");
   }, [cfg.authOrigin, cfg.logoutPath]);
-  const value = React4__namespace.useMemo(() => {
+  const value = React3__namespace.useMemo(() => {
     const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
     return {
       status,
@@ -127,7 +127,7 @@ function OcSessionProvider({
   return /* @__PURE__ */ jsxRuntime.jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
-  const ctx = React4__namespace.useContext(SessionContext);
+  const ctx = React3__namespace.useContext(SessionContext);
   if (!ctx) {
     throw new Error(
       "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
@@ -136,7 +136,7 @@ function useOcSession() {
   return ctx;
 }
 function useOptionalOcSession() {
-  return React4__namespace.useContext(SessionContext);
+  return React3__namespace.useContext(SessionContext);
 }
 function shortenAddress(addr) {
   if (addr.length <= 12) return addr;
@@ -151,7 +151,7 @@ function isPrefixOf(value, target) {
 }
 var listboxIdCounter = 0;
 function useUniqueId(prefix) {
-  const [id] = React4__namespace.useState(() => `${prefix}-${++listboxIdCounter}`);
+  const [id] = React3__namespace.useState(() => `${prefix}-${++listboxIdCounter}`);
   return id;
 }
 function OcAccountChip({
@@ -165,9 +165,9 @@ function OcAccountChip({
 }) {
   const { status, account, signInUrl: sessionSignInUrl, signOut } = useOcSession();
   const signInUrl = signInUrlOverride ?? sessionSignInUrl;
-  const [open, setOpen] = React4__namespace.useState(false);
-  const wrapRef = React4__namespace.useRef(null);
-  React4__namespace.useEffect(() => {
+  const [open, setOpen] = React3__namespace.useState(false);
+  const wrapRef = React3__namespace.useRef(null);
+  React3__namespace.useEffect(() => {
     if (!open) return;
     function handleClickOutside(e) {
       if (wrapRef.current && !wrapRef.current.contains(e.target)) {
@@ -490,9 +490,9 @@ function useOcAddressSuggestion(options) {
   } = options;
   const { status, account } = useOcSession();
   const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-  const [open, setOpen] = React4__namespace.useState(false);
-  const [highlighted, setHighlighted] = React4__namespace.useState(false);
-  const blurTimer = React4__namespace.useRef(null);
+  const [open, setOpen] = React3__namespace.useState(false);
+  const [highlighted, setHighlighted] = React3__namespace.useState(false);
+  const blurTimer = React3__namespace.useRef(null);
   const listboxId = useUniqueId("oc-addr-listbox");
   const optionId = `${listboxId}-opt`;
   const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -504,7 +504,7 @@ function useOcAddressSuggestion(options) {
     setOpen(false);
     setHighlighted(false);
   }
-  React4__namespace.useEffect(() => {
+  React3__namespace.useEffect(() => {
     return () => {
       if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
     };
@@ -607,7 +607,7 @@ function useOcAddressSuggestion(options) {
   ) : null;
   return { inputProps, popover };
 }
-var OcAddressInput = React4__namespace.forwardRef(
+var OcAddressInput = React3__namespace.forwardRef(
   function OcAddressInput2({
     value,
     onValueChange,
@@ -622,15 +622,15 @@ var OcAddressInput = React4__namespace.forwardRef(
   }, forwardedRef) {
     const { status, account } = useOcSession();
     const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-    const [open, setOpen] = React4__namespace.useState(false);
-    const [highlighted, setHighlighted] = React4__namespace.useState(false);
-    const innerRef = React4__namespace.useRef(null);
+    const [open, setOpen] = React3__namespace.useState(false);
+    const [highlighted, setHighlighted] = React3__namespace.useState(false);
+    const innerRef = React3__namespace.useRef(null);
     const setRef = (node) => {
       innerRef.current = node;
       if (typeof forwardedRef === "function") forwardedRef(node);
       else if (forwardedRef) forwardedRef.current = node;
     };
-    const blurTimer = React4__namespace.useRef(null);
+    const blurTimer = React3__namespace.useRef(null);
     const listboxId = useUniqueId("oc-addr-listbox");
     const optionId = `${listboxId}-opt`;
     const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -677,7 +677,7 @@ var OcAddressInput = React4__namespace.forwardRef(
       }
       onKeyDown?.(e);
     }
-    React4__namespace.useEffect(() => {
+    React3__namespace.useEffect(() => {
       return () => {
         if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
       };
@@ -770,6 +770,977 @@ var OcAddressInput = React4__namespace.forwardRef(
     );
   }
 );
+var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
+function OcLinkedIdentities({
+  authOrigin = DEFAULT_AUTH_ORIGIN,
+  className,
+  onChange
+}) {
+  const [resp, setResp] = React3__namespace.useState(null);
+  const [error, setError] = React3__namespace.useState(null);
+  const [showEmailLink, setShowEmailLink] = React3__namespace.useState(false);
+  const [showBtcLink, setShowBtcLink] = React3__namespace.useState(false);
+  const refresh = React3__namespace.useCallback(async () => {
+    setError(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/identities`, {
+        credentials: "include"
+      });
+      if (!r.ok) {
+        if (r.status === 401) {
+          setError("not signed in");
+          return;
+        }
+        throw new Error(`http_${r.status}`);
+      }
+      setResp(await r.json());
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "load failed");
+    }
+  }, [authOrigin]);
+  React3__namespace.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const afterChange = React3__namespace.useCallback(() => {
+    setShowEmailLink(false);
+    setShowBtcLink(false);
+    void refresh();
+    onChange?.();
+  }, [refresh, onChange]);
+  if (error) {
+    return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, "data-oc-li": "", style: panelStyle("warn"), role: "alert", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { tone: "warn", children: "\xA7 identities \xB7 load deferred" }),
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Couldn't reach the auth host (",
+        error,
+        "). Linking is temporarily unavailable; your signed-in identity still works as normal."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: () => void refresh(), style: ghostBtnStyle(false), children: "retry" })
+    ] });
+  }
+  if (!resp) {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-oc-li": "", style: panelStyle(), children: /* @__PURE__ */ jsxRuntime.jsxs("span", { style: hintStyle, children: [
+      "> ",
+      "loading\u2026"
+    ] }) });
+  }
+  const linked = resp.linked ?? [];
+  const emailRows = linked.filter((i) => i.kind === "email");
+  const btcRows = linked.filter((i) => i.kind === "btc");
+  const hasEmail = emailRows.some((i) => i.value);
+  const hasBtc = btcRows.some((i) => i.value);
+  const mergedFrom = resp.merged_from ?? [];
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, "data-oc-li": "", style: { display: "grid", gap: 16 }, children: [
+    /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle(), children: [
+      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 what this is" }),
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Your public identity is the opaque ",
+        /* @__PURE__ */ jsxRuntime.jsx("code", { style: codeStyle, children: "did:oc:" }),
+        " DID. Below it sit your private linked identities \u2014 your email and your Bitcoin address. They never appear in dashboard chrome and never reach an integrator unless you grant the matching scope. Linking a second identity is also your account-recovery path: if you lose one, the other still signs you in."
+      ] })
+    ] }),
+    mergedFrom.length > 0 && /* @__PURE__ */ jsxRuntime.jsx(ConsolidationPanel, { entries: mergedFrom }),
+    /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("plain"), "data-oc-li-rows": "", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(
+        IdentityGroup,
+        {
+          kind: "email",
+          title: "email",
+          rows: emailRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasEmail ? null : "link an email",
+          onAdd: () => {
+            setShowEmailLink((v) => !v);
+            setShowBtcLink(false);
+          }
+        }
+      ),
+      /* @__PURE__ */ jsxRuntime.jsx("div", { style: { borderTop: `1px solid ${V.border}` } }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        IdentityGroup,
+        {
+          kind: "btc",
+          title: "bitcoin address",
+          rows: btcRows,
+          authOrigin,
+          onChange: afterChange,
+          addCta: hasBtc ? null : "link a Bitcoin address",
+          onAdd: () => {
+            setShowBtcLink((v) => !v);
+            setShowEmailLink(false);
+          }
+        }
+      )
+    ] }),
+    showEmailLink && /* @__PURE__ */ jsxRuntime.jsx(
+      EmailLinkForm,
+      {
+        authOrigin,
+        onDone: afterChange,
+        onCancel: () => setShowEmailLink(false)
+      }
+    ),
+    showBtcLink && /* @__PURE__ */ jsxRuntime.jsx(
+      BtcLinkForm,
+      {
+        authOrigin,
+        didOc: resp.did_oc ?? null,
+        onDone: afterChange,
+        onCancel: () => setShowBtcLink(false)
+      }
+    ),
+    hasBtc && resp.did_oc && /* @__PURE__ */ jsxRuntime.jsx(OcIdentityBond, { didOc: resp.did_oc, btc: btcRows.find((i) => !!i.value).value })
+  ] });
+}
+function IdentityGroup({
+  kind,
+  title,
+  rows,
+  authOrigin,
+  onChange,
+  addCta,
+  onAdd
+}) {
+  if (rows.length === 0) {
+    return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: rowStyle, children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          title
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { ...bodyStyle, marginTop: 4 }, children: "none linked" })
+      ] }),
+      addCta && /* @__PURE__ */ jsxRuntime.jsxs("button", { type: "button", onClick: onAdd, style: primaryChipStyle, children: [
+        "+ ",
+        addCta
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: rows.map((r) => /* @__PURE__ */ jsxRuntime.jsx(
+    IdentityRow,
+    {
+      row: r,
+      kind,
+      authOrigin,
+      onChange
+    },
+    r.id
+  )) });
+}
+function IdentityRow({
+  row,
+  kind,
+  authOrigin,
+  onChange
+}) {
+  const [shown, setShown] = React3__namespace.useState(false);
+  const [confirming, setConfirming] = React3__namespace.useState(false);
+  const [busy, setBusy] = React3__namespace.useState(false);
+  const [err, setErr] = React3__namespace.useState(null);
+  const masked = row.value ? mask(row.value, kind) : "\u2014 pending recovery \u2014";
+  const display = shown && row.value ? row.value : masked;
+  async function unlink() {
+    if (row.is_primary) return;
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/auth/identities?id=${encodeURIComponent(row.id)}`,
+        { method: "DELETE", credentials: "include" }
+      );
+      if (!r.ok) {
+        const j = await r.json().catch(() => ({}));
+        throw new Error(j.reason ?? `http_${r.status}`);
+      }
+      onChange();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "unlink failed");
+      setBusy(false);
+      setConfirming(false);
+    }
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: rowStyle, "data-oc-li-row": kind, children: [
+    /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { minWidth: 0, flex: 1 }, children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { display: "flex", flexWrap: "wrap", gap: "4px 12px" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsxs("span", { style: rowLabelStyle, children: [
+          "\xA7 ",
+          kind === "email" ? "email" : "bitcoin address"
+        ] }),
+        row.is_primary && /* @__PURE__ */ jsxRuntime.jsx("span", { style: { ...rowLabelStyle, color: V.primary }, children: "primary \xB7 signup-time" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "div",
+        {
+          style: {
+            marginTop: 4,
+            color: V.foreground,
+            fontFamily: MONO,
+            fontSize: 12,
+            wordBreak: "break-all"
+          },
+          children: display
+        }
+      ),
+      row.verified_at && /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...hintStyle, marginTop: 4 }, children: [
+        "verified \xB7 ",
+        new Date(row.verified_at).toUTCString()
+      ] }),
+      err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err })
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { display: "flex", flexShrink: 0, gap: 8, flexWrap: "wrap" }, children: [
+      row.value && /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setShown((s) => !s),
+          style: ghostBtnStyle(false),
+          children: shown ? "hide" : "show"
+        }
+      ),
+      !row.is_primary && !confirming && /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setConfirming(true),
+          style: dangerBtnStyle(false),
+          children: "unlink"
+        }
+      ),
+      !row.is_primary && confirming && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void unlink(),
+            disabled: busy,
+            style: dangerBtnStyle(busy),
+            children: busy ? "unlinking\u2026" : "confirm unlink"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setConfirming(false),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "cancel"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function ConsolidationPanel({ entries }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("success"), "data-oc-li-consolidated": "", children: [
+    /* @__PURE__ */ jsxRuntime.jsxs(SectionLabel, { tone: "success", children: [
+      "\xA7 consolidated accounts \xB7 ",
+      entries.length
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+      entries.length === 1 ? "A previous OC account" : "Previous OC accounts",
+      " you signed up with, folded into this one under dual proof of control. Historical activity is unioned into this account automatically;",
+      " ",
+      entries.length === 1 ? "it" : "they",
+      " can no longer sign in."
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsx("ul", { style: { listStyle: "none", margin: "12px 0 0", padding: 0 }, children: entries.map((e) => /* @__PURE__ */ jsxRuntime.jsxs(
+      "li",
+      {
+        style: {
+          display: "flex",
+          flexWrap: "wrap",
+          gap: 8,
+          padding: "8px 0",
+          borderTop: `1px solid ${V.border}`,
+          fontFamily: MONO,
+          fontSize: 11
+        },
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsx("code", { style: { color: V.foreground, wordBreak: "break-all" }, children: e.did_oc }),
+          /* @__PURE__ */ jsxRuntime.jsxs("span", { style: { ...hintStyle, marginLeft: "auto" }, children: [
+            "created ",
+            new Date(e.created_at).toLocaleDateString()
+          ] })
+        ]
+      },
+      e.did_oc
+    )) })
+  ] });
+}
+function EmailLinkForm({
+  authOrigin,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React3__namespace.useState("email");
+  const [email, setEmail] = React3__namespace.useState("");
+  const [code, setCode] = React3__namespace.useState("");
+  const [token, setToken] = React3__namespace.useState("");
+  const [busy, setBusy] = React3__namespace.useState(false);
+  const [err, setErr] = React3__namespace.useState(null);
+  const [transfer, setTransfer] = React3__namespace.useState(false);
+  async function start() {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/email-otp/start`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email.trim().toLowerCase() })
+      });
+      const j = await r.json();
+      if (!r.ok || !j.token) throw new Error(j.reason ?? `http_${r.status}`);
+      setToken(j.token);
+      setStep("code");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "could not send code");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function verify(confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/email`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          email: email.trim().toLowerCase(),
+          code: code.trim(),
+          token,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "email_linked_elsewhere") {
+        setTransfer(true);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "email", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 link an email" }),
+    step === "email" ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "input",
+        {
+          type: "email",
+          autoComplete: "email",
+          value: email,
+          onChange: (e) => setEmail(e.target.value),
+          placeholder: "you@example.com",
+          style: inputStyle
+        }
+      ),
+      err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void start(),
+            disabled: busy || email.trim().length < 5,
+            style: primaryBtnStyle(busy || email.trim().length < 5),
+            children: busy ? "sending\u2026" : "send code"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : transfer ? /* @__PURE__ */ jsxRuntime.jsx(
+      TransferConfirm,
+      {
+        what: "email",
+        busy,
+        onConfirm: () => void verify(true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Enter the 6-digit code sent to ",
+        email,
+        "."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "input",
+        {
+          type: "text",
+          inputMode: "numeric",
+          autoComplete: "one-time-code",
+          maxLength: 6,
+          value: code,
+          onChange: (e) => setCode(e.target.value.replace(/\D/g, "").slice(0, 6)),
+          placeholder: "123456",
+          style: { ...inputStyle, letterSpacing: "0.3em" }
+        }
+      ),
+      err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void verify(false),
+            disabled: busy || code.length !== 6,
+            style: primaryBtnStyle(busy || code.length !== 6),
+            children: busy ? "linking\u2026" : "verify + link"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setStep("email"),
+            disabled: busy,
+            style: ghostBtnStyle(busy),
+            children: "back"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function BtcLinkForm({
+  authOrigin,
+  didOc,
+  onDone,
+  onCancel
+}) {
+  const [step, setStep] = React3__namespace.useState("request");
+  const [addr, setAddr] = React3__namespace.useState("");
+  const [challenge, setChallenge] = React3__namespace.useState("");
+  const [busy, setBusy] = React3__namespace.useState(false);
+  const [err, setErr] = React3__namespace.useState(null);
+  const [pendingSig, setPendingSig] = React3__namespace.useState(null);
+  async function getChallenge() {
+    if (!didOc) {
+      setErr("session not loaded yet \xB7 refresh and retry");
+      return;
+    }
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(
+        `${authOrigin}/api/challenge?addr=${encodeURIComponent(addr)}&purpose=link&audience=${encodeURIComponent(didOc)}`
+      );
+      const j = await r.json();
+      if (!r.ok || !j.message) throw new Error(j.reason ?? `http_${r.status}`);
+      setChallenge(j.message);
+      setStep("sign");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "challenge failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function postLink(sig, confirmTransfer) {
+    setBusy(true);
+    setErr(null);
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/link/btc`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          message: challenge,
+          signature: sig,
+          ...confirmTransfer ? { confirm_transfer: true } : {}
+        })
+      });
+      const j = await r.json();
+      if (r.status === 409 && j.reason === "address_linked_elsewhere") {
+        setPendingSig(sig);
+        setBusy(false);
+        return;
+      }
+      if (!r.ok || !j.ok) throw new Error(j.reason ?? `http_${r.status}`);
+      onDone();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "link failed");
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("accent"), "data-oc-li-form": "btc", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 link a Bitcoin address" }),
+    step === "request" ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "Enter a Bitcoin address you control. We generate a challenge and your wallet signs it (BIP-322)." }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "input",
+        {
+          type: "text",
+          value: addr,
+          onChange: (e) => setAddr(e.target.value.trim()),
+          placeholder: "bc1q\u2026",
+          autoCapitalize: "none",
+          spellCheck: false,
+          style: { ...inputStyle, fontFamily: MONO }
+        }
+      ),
+      err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void getChallenge(),
+            disabled: busy || addr.length < 14,
+            style: primaryBtnStyle(busy || addr.length < 14),
+            children: busy ? "requesting\u2026" : "get challenge"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: onCancel, style: ghostBtnStyle(busy), children: "cancel" })
+      ] })
+    ] }) : pendingSig ? /* @__PURE__ */ jsxRuntime.jsx(
+      TransferConfirm,
+      {
+        what: "bitcoin address",
+        busy,
+        onConfirm: () => void postLink(pendingSig, true),
+        onCancel,
+        err
+      }
+    ) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Sign the challenge with the wallet that controls",
+        " ",
+        /* @__PURE__ */ jsxRuntime.jsx("span", { style: { fontFamily: MONO, wordBreak: "break-all" }, children: addr }),
+        "."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        LazyWalletButton,
+        {
+          address: addr,
+          message: challenge,
+          showManual: true,
+          layout: "list",
+          heading: null,
+          onSigned: (sig) => void postLink(sig, false),
+          onError: (e) => setErr(e?.message ?? "wallet rejected")
+        }
+      ),
+      err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }),
+      /* @__PURE__ */ jsxRuntime.jsx(FormButtons, { children: /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => {
+            setStep("request");
+            setErr(null);
+          },
+          disabled: busy,
+          style: ghostBtnStyle(busy),
+          children: "back"
+        }
+      ) })
+    ] })
+  ] });
+}
+function TransferConfirm({
+  what,
+  busy,
+  onConfirm,
+  onCancel,
+  err
+}) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+    /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+      "This ",
+      what,
+      " is already linked to another OrangeCheck account. You've just proven control of it \u2014 you can transfer the link to this account under dual proof of control. The other account loses this sign-in path; its history stays verifiable. Continue?"
+    ] }),
+    err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err }),
+    /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: onConfirm,
+          disabled: busy,
+          style: dangerBtnStyle(busy),
+          children: busy ? "transferring\u2026" : "transfer link here"
+        }
+      ),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: onCancel, disabled: busy, style: ghostBtnStyle(busy), children: "cancel" })
+    ] })
+  ] });
+}
+function OcIdentityBond({
+  didOc,
+  btc,
+  className
+}) {
+  const [stage, setStage] = React3__namespace.useState("idle");
+  const [message, setMessage] = React3__namespace.useState("");
+  const [err, setErr] = React3__namespace.useState(null);
+  const [result, setResult] = React3__namespace.useState(null);
+  function nip07() {
+    if (typeof window === "undefined") return null;
+    const w = window;
+    return w.nostr ?? null;
+  }
+  async function begin() {
+    setErr(null);
+    const nostr = nip07();
+    if (!nostr) {
+      setErr(
+        "no Nostr signer found \xB7 install a NIP-07 extension (Alby, nos2x) to counter-sign the bond"
+      );
+      return;
+    }
+    try {
+      const sdk = await loadSdk();
+      const pubkeyHex = (await nostr.getPublicKey()).toLowerCase();
+      const npub = sdk.xOnlyHexToNpub(pubkeyHex);
+      const msg = sdk.buildBindingMessage({
+        principal: didOc,
+        btc,
+        nostr: npub,
+        nonce: randomNonceHex(),
+        issued_at: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z")
+      });
+      setMessage(msg);
+      setStage("sign-btc");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "could not start the bond ceremony");
+    }
+  }
+  async function afterBtcSign(btcSignature) {
+    setErr(null);
+    setStage("sign-nostr");
+    try {
+      const nostr = nip07();
+      if (!nostr) throw new Error("Nostr extension went away \xB7 retry");
+      const sdk = await loadSdk();
+      const pubkeyHex = (await nostr.getPublicKey()).toLowerCase();
+      const template = sdk.buildBindingEventTemplate({
+        message,
+        btcSignature,
+        nostrPubkeyHex: pubkeyHex,
+        btc
+      });
+      const signedEvent = await nostr.signEvent(template);
+      const envelope = sdk.assembleBindingEnvelope({
+        message,
+        btcSignature,
+        btcScheme: "bip322",
+        nostrEvent: signedEvent
+      });
+      const check = sdk.verifyBinding(envelope);
+      if (!check.valid) {
+        throw new Error(`assembled bond failed local verification (${check.status})`);
+      }
+      setStage("publishing");
+      const { publishEvent } = await loadNostrCore();
+      const results = await publishEvent(signedEvent);
+      const ok = results.filter((r) => r.ok).length;
+      if (ok === 0) {
+        throw new Error("no relay accepted the bond \xB7 check your connection and retry");
+      }
+      setResult({
+        bindingId: check.valid ? check.binding_id : sdk.bindingId(message),
+        relays: ok,
+        relaysTotal: results.length
+      });
+      setStage("done");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "bond publish failed");
+      setStage("sign-btc");
+    }
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, style: panelStyle("accent"), "data-oc-identity-bond": "", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 identity bond \xB7 publish to nostr" }),
+    stage === "idle" && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Publish a ",
+        /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Binding Attestation" }),
+        " \u2014 a Bitcoin-signed, Nostr-signed proof that this address and your Nostr key are one identity. It lives on Nostr, verifies with zero trust in OrangeCheck, and means your identity survives even if OC's database does not. Two signatures: your Bitcoin wallet, then your Nostr extension."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(FormButtons, { children: /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => void begin(),
+          style: primaryBtnStyle(false),
+          children: "create & publish bond"
+        }
+      ) })
+    ] }),
+    stage === "sign-btc" && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Step 1 of 2 \u2014 sign the binding message with the Bitcoin wallet that controls ",
+        /* @__PURE__ */ jsxRuntime.jsx("span", { style: { fontFamily: MONO, wordBreak: "break-all" }, children: btc }),
+        "."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        LazyWalletButton,
+        {
+          address: btc,
+          message,
+          showManual: true,
+          layout: "list",
+          heading: null,
+          onSigned: (sig) => void afterBtcSign(sig),
+          onError: (e) => setErr(e?.message ?? "wallet rejected the signature")
+        }
+      )
+    ] }),
+    (stage === "sign-nostr" || stage === "publishing") && /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: stage === "sign-nostr" ? "Step 2 of 2 \u2014 approve the signature in your Nostr extension\u2026" : "Publishing the bond to Nostr\u2026" }),
+    stage === "done" && result && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { tone: "success", children: "\xA7 bond published" }),
+      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
+        "Your identity bond is live on ",
+        result.relays,
+        "/",
+        result.relaysTotal,
+        " ",
+        "relay",
+        result.relays === 1 ? "" : "s",
+        ". Anyone can now verify the BTC \u21C4 Nostr binding offline."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(
+        "div",
+        {
+          style: {
+            fontFamily: MONO,
+            fontSize: 11,
+            color: V.muted,
+            wordBreak: "break-all"
+          },
+          children: [
+            "binding_id: ",
+            result.bindingId
+          ]
+        }
+      )
+    ] }),
+    err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err })
+  ] });
+}
+function randomNonceHex() {
+  const b = new Uint8Array(16);
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+    crypto.getRandomValues(b);
+  } else {
+    for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);
+  }
+  let out = "";
+  for (const x of b) out += x.toString(16).padStart(2, "0");
+  return out;
+}
+async function loadSdk() {
+  try {
+    return await import('@orangecheck/sdk');
+  } catch {
+    throw new Error("@orangecheck/sdk not installed \xB7 add it to your site to publish bonds");
+  }
+}
+async function loadNostrCore() {
+  try {
+    return await import('@orangecheck/nostr-core');
+  } catch {
+    throw new Error(
+      "@orangecheck/nostr-core not installed \xB7 add it to your site to publish bonds"
+    );
+  }
+}
+function LazyWalletButton(props) {
+  const [Comp, setComp] = React3__namespace.useState(null);
+  const [failed, setFailed] = React3__namespace.useState(false);
+  React3__namespace.useEffect(() => {
+    let alive = true;
+    import('@orangecheck/wallet-adapter/react').then((m) => {
+      if (alive) {
+        setComp(
+          () => m.OcWalletButton
+        );
+      }
+    }).catch(() => {
+      if (alive) setFailed(true);
+    });
+    return () => {
+      alive = false;
+    };
+  }, []);
+  if (failed) {
+    return /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: "@orangecheck/wallet-adapter not installed \xB7 add it to your site to link a wallet" });
+  }
+  if (!Comp) return /* @__PURE__ */ jsxRuntime.jsxs("span", { style: hintStyle, children: [
+    "> ",
+    "loading wallet options\u2026"
+  ] });
+  return /* @__PURE__ */ jsxRuntime.jsx(Comp, { ...props });
+}
+function mask(value, kind) {
+  if (kind === "email") {
+    const [user, host] = value.split("@");
+    if (!user || !host) return "\u2022\u2022\u2022\u2022";
+    const m = user.length <= 2 ? "\u2022".repeat(user.length) : user[0] + "\u2022".repeat(user.length - 2) + user.slice(-1);
+    return `${m}@${host}`;
+  }
+  if (value.length <= 12) return "\u2022".repeat(value.length);
+  return `${value.slice(0, 6)}\u2026${value.slice(-4)}`;
+}
+function SectionLabel({
+  children,
+  tone = "primary"
+}) {
+  const color = tone === "success" ? V.success : tone === "warn" ? V.warn : V.primary;
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "div",
+    {
+      style: {
+        color,
+        fontFamily: MONO,
+        fontSize: 10,
+        letterSpacing: "0.18em",
+        textTransform: "uppercase",
+        marginBottom: 8
+      },
+      children
+    }
+  );
+}
+function ErrorLine({ children }) {
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "p",
+    {
+      role: "alert",
+      style: {
+        margin: "8px 0 0",
+        color: V.destructive,
+        fontFamily: MONO,
+        fontSize: 11
+      },
+      children
+    }
+  );
+}
+function FormButtons({ children }) {
+  return /* @__PURE__ */ jsxRuntime.jsx("div", { style: { display: "flex", flexWrap: "wrap", gap: 8, marginTop: 12 }, children });
+}
+var MONO = "ui-monospace, SFMono-Regular, monospace";
+var V = {
+  primary: "var(--primary, #f97316)",
+  foreground: "var(--foreground, #fafafa)",
+  muted: "var(--muted-foreground, #a1a1aa)",
+  background: "var(--background, #0a0a0a)",
+  card: "var(--card, #111113)",
+  border: "var(--border, #27272a)",
+  destructive: "var(--destructive, #ef4444)",
+  success: "var(--success, #22c55e)",
+  warn: "var(--warning, #eab308)"
+};
+function panelStyle(tone = "default") {
+  const base = {
+    background: V.card,
+    border: `1px solid ${V.border}`,
+    padding: "1.25rem"
+  };
+  if (tone === "plain") return { ...base, padding: 0 };
+  if (tone === "accent") return { ...base, borderColor: V.primary, background: "var(--card, #111113)" };
+  if (tone === "success") return { ...base, borderColor: V.success };
+  if (tone === "warn") return { ...base, borderColor: V.warn };
+  return base;
+}
+var bodyStyle = {
+  color: V.muted,
+  fontSize: 13,
+  lineHeight: 1.55,
+  margin: "0 0 12px"
+};
+var hintStyle = {
+  color: V.muted,
+  fontFamily: MONO,
+  fontSize: 10.5,
+  opacity: 0.8
+};
+var codeStyle = {
+  fontFamily: MONO,
+  color: V.foreground
+};
+var rowStyle = {
+  display: "flex",
+  flexWrap: "wrap",
+  alignItems: "center",
+  justifyContent: "space-between",
+  gap: 12,
+  padding: "1rem"
+};
+var rowLabelStyle = {
+  color: V.foreground,
+  fontFamily: MONO,
+  fontSize: 10.5,
+  letterSpacing: "0.12em",
+  textTransform: "uppercase",
+  opacity: 0.8
+};
+var inputStyle = {
+  width: "100%",
+  padding: "0.55rem 0.75rem",
+  background: V.background,
+  color: V.foreground,
+  border: `1px solid ${V.border}`,
+  borderRadius: 6,
+  fontFamily: MONO,
+  // 16px — never lower · suppresses iOS Safari focus auto-zoom.
+  fontSize: 16,
+  outline: "none",
+  boxSizing: "border-box"
+};
+function btnBase(disabled) {
+  return {
+    padding: "0.5rem 0.875rem",
+    borderRadius: 6,
+    fontFamily: MONO,
+    fontSize: 10.5,
+    letterSpacing: "0.12em",
+    textTransform: "uppercase",
+    cursor: disabled ? "not-allowed" : "pointer",
+    opacity: disabled ? 0.5 : 1
+  };
+}
+function primaryBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.primary,
+    color: "var(--primary-foreground, #0a0a0a)",
+    border: `1px solid ${V.primary}`,
+    fontWeight: 600
+  };
+}
+function ghostBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: V.background,
+    color: V.foreground,
+    border: `1px solid ${V.border}`
+  };
+}
+function dangerBtnStyle(disabled) {
+  return {
+    ...btnBase(disabled),
+    background: "transparent",
+    color: V.destructive,
+    border: `1px solid ${V.destructive}`
+  };
+}
+var primaryChipStyle = {
+  ...btnBase(false),
+  background: "transparent",
+  color: V.primary,
+  border: `1px solid ${V.primary}`
+};
 function safeReturnTo(input) {
   const candidate = input ?? "/";
   if (typeof candidate !== "string") return "/";
@@ -785,6 +1756,7 @@ function OcSignIn({
   returnTo,
   onSuccess,
   resolveReturnTo,
+  linkPrompt,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -793,24 +1765,34 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
-  const [path, setPath] = React4__namespace.useState(initialPath);
-  const handleSuccess = React4__namespace.useCallback(
-    async (account, token) => {
-      if (onSuccess) {
-        onSuccess(account, token);
-        return;
-      }
+  const [path, setPath] = React3__namespace.useState(initialPath);
+  const [signedIn, setSignedIn] = React3__namespace.useState(null);
+  const navigate = React3__namespace.useCallback(
+    async (account) => {
       if (resolveReturnTo) {
         try {
-          const target = await resolveReturnTo(account);
-          hardNavigate(safeReturnTo(target));
+          hardNavigate(safeReturnTo(await resolveReturnTo(account)));
           return;
         } catch {
         }
       }
       hardNavigate(safeReturn);
     },
-    [onSuccess, resolveReturnTo, safeReturn]
+    [resolveReturnTo, safeReturn]
+  );
+  const handleSuccess = React3__namespace.useCallback(
+    async (account, token) => {
+      if (onSuccess) {
+        onSuccess(account, token);
+        return;
+      }
+      if (linkPrompt) {
+        setSignedIn(account);
+        return;
+      }
+      await navigate(account);
+    },
+    [onSuccess, linkPrompt, navigate]
   );
   if (!walletEnabled && !emailEnabled) {
     return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -837,6 +1819,15 @@ function OcSignIn({
       }
     );
   }
+  if (signedIn) {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-oc-signin": "", children: /* @__PURE__ */ jsxRuntime.jsx(
+      LinkPromptStep,
+      {
+        authOrigin,
+        onContinue: () => void navigate(signedIn)
+      }
+    ) });
+  }
   const showWallet = walletEnabled && (path === "wallet" || !emailEnabled);
   const showEmail = emailEnabled && (path === "email" || !walletEnabled);
   const bothEnabled = walletEnabled && emailEnabled;
@@ -879,6 +1870,25 @@ function OcSignIn({
     ] })
   ] });
 }
+function LinkPromptStep({
+  authOrigin,
+  onContinue
+}) {
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { "data-oc-signin-linkprompt": "", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { label: "\xA7 signed in \xB7 add a backup", children: "You're in. Linking a second way to sign in \u2014 your email or your Bitcoin wallet \u2014 is also your recovery path: lose one, the other still gets you in. Optional; skip with continue." }),
+    /* @__PURE__ */ jsxRuntime.jsx(OcLinkedIdentities, { authOrigin }),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      "button",
+      {
+        type: "button",
+        onClick: onContinue,
+        style: submitStyle(false),
+        "data-oc-signin-continue": "",
+        children: "continue \u2192"
+      }
+    )
+  ] });
+}
 function SigninTab({
   active,
   onClick,
@@ -910,10 +1920,10 @@ function SigninTab({
   );
 }
 function WalletFlow({ authOrigin, audience, onSuccess }) {
-  const [address, setAddress] = React4__namespace.useState("");
-  const [error, setError] = React4__namespace.useState(null);
-  const [submitting, setSubmitting] = React4__namespace.useState(false);
-  const [stage, setStage] = React4__namespace.useState("enter");
+  const [address, setAddress] = React3__namespace.useState("");
+  const [error, setError] = React3__namespace.useState(null);
+  const [submitting, setSubmitting] = React3__namespace.useState(false);
+  const [stage, setStage] = React3__namespace.useState("enter");
   async function signIn(e) {
     e.preventDefault();
     const addr = address.trim();
@@ -992,10 +2002,10 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
         spellCheck: false,
         required: true,
         "aria-invalid": error ? true : void 0,
-        style: inputStyle
+        style: inputStyle2
       }
     ),
-    error && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: error }),
+    error && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine2, { children: error }),
     /* @__PURE__ */ jsxRuntime.jsx(
       "button",
       {
@@ -1009,13 +2019,13 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
   ] });
 }
 function EmailFlow({ authOrigin, onSuccess }) {
-  const [stage, setStage] = React4__namespace.useState("enter");
-  const [email, setEmail] = React4__namespace.useState("");
-  const [emailError, setEmailError] = React4__namespace.useState(null);
-  const [code, setCode] = React4__namespace.useState("");
-  const [codeError, setCodeError] = React4__namespace.useState(null);
-  const [token, setToken] = React4__namespace.useState(null);
-  const [submitting, setSubmitting] = React4__namespace.useState(false);
+  const [stage, setStage] = React3__namespace.useState("enter");
+  const [email, setEmail] = React3__namespace.useState("");
+  const [emailError, setEmailError] = React3__namespace.useState(null);
+  const [code, setCode] = React3__namespace.useState("");
+  const [codeError, setCodeError] = React3__namespace.useState(null);
+  const [token, setToken] = React3__namespace.useState(null);
+  const [submitting, setSubmitting] = React3__namespace.useState(false);
   async function start(e) {
     e.preventDefault();
     const trimmed = email.trim().toLowerCase();
@@ -1091,10 +2101,10 @@ function EmailFlow({ authOrigin, onSuccess }) {
           placeholder: "you@example.com",
           required: true,
           "aria-invalid": emailError ? true : void 0,
-          style: inputStyle
+          style: inputStyle2
         }
       ),
-      emailError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: emailError }),
+      emailError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine2, { children: emailError }),
       /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "sending\u2026" : "send one-time code \u2192" }),
       /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "OTP delivered by the auth host. Codes expire in 10 minutes and are single-use. Rate-limited 5 starts/hour/IP." })
     ] });
@@ -1123,10 +2133,10 @@ function EmailFlow({ authOrigin, onSuccess }) {
         required: true,
         autoFocus: true,
         "aria-invalid": codeError ? true : void 0,
-        style: { ...inputStyle, letterSpacing: "0.4em", fontSize: 16 }
+        style: { ...inputStyle2, letterSpacing: "0.4em", fontSize: 16 }
       }
     ),
-    codeError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: codeError }),
+    codeError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine2, { children: codeError }),
     /* @__PURE__ */ jsxRuntime.jsx(
       "button",
       {
@@ -1213,7 +2223,7 @@ function Label({ children }) {
     }
   );
 }
-var inputStyle = {
+var inputStyle2 = {
   width: "100%",
   padding: "0.55rem 0.75rem",
   background: "var(--background, #0a0a0a)",
@@ -1245,7 +2255,7 @@ function submitStyle(disabled) {
     width: "100%"
   };
 }
-function ErrorLine({ children }) {
+function ErrorLine2({ children }) {
   return /* @__PURE__ */ jsxRuntime.jsx(
     "p",
     {
@@ -1292,13 +2302,13 @@ function isAbortError(err) {
 }
 function useWebAuthnRegister(opts) {
   const authOrigin = resolveAuthOrigin(opts);
-  const [status, setStatus] = React4__namespace.useState("idle");
-  const [error, setError] = React4__namespace.useState(null);
-  const reset = React4__namespace.useCallback(() => {
+  const [status, setStatus] = React3__namespace.useState("idle");
+  const [error, setError] = React3__namespace.useState(null);
+  const reset = React3__namespace.useCallback(() => {
     setStatus("idle");
     setError(null);
   }, []);
-  const register = React4__namespace.useCallback(
+  const register = React3__namespace.useCallback(
     async (args) => {
       setError(null);
       setStatus("requesting-options");
@@ -1360,10 +2370,10 @@ function useWebAuthnRegister(opts) {
 function useWebAuthnList(opts) {
   const authOrigin = resolveAuthOrigin(opts);
   const { status: sessionStatus } = useOcSession();
-  const [credentials, setCredentials] = React4__namespace.useState([]);
-  const [status, setStatus] = React4__namespace.useState("loading");
-  const [error, setError] = React4__namespace.useState(null);
-  const refetch = React4__namespace.useCallback(async () => {
+  const [credentials, setCredentials] = React3__namespace.useState([]);
+  const [status, setStatus] = React3__namespace.useState("loading");
+  const [error, setError] = React3__namespace.useState(null);
+  const refetch = React3__namespace.useCallback(async () => {
     setError(null);
     if (sessionStatus !== "authenticated") {
       setCredentials([]);
@@ -1391,10 +2401,10 @@ function useWebAuthnList(opts) {
       setStatus("error");
     }
   }, [authOrigin, sessionStatus]);
-  React4__namespace.useEffect(() => {
+  React3__namespace.useEffect(() => {
     void refetch();
   }, [refetch]);
-  const rename = React4__namespace.useCallback(
+  const rename = React3__namespace.useCallback(
     async (id, label) => {
       try {
         const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
@@ -1419,7 +2429,7 @@ function useWebAuthnList(opts) {
     },
     [authOrigin, refetch]
   );
-  const remove = React4__namespace.useCallback(
+  const remove = React3__namespace.useCallback(
     async (id) => {
       try {
         const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
@@ -1447,13 +2457,13 @@ function useWebAuthnList(opts) {
 function useStepUpAuth(opts) {
   const authOrigin = resolveAuthOrigin(opts);
   const { refresh } = useOcSession();
-  const [status, setStatus] = React4__namespace.useState("idle");
-  const [error, setError] = React4__namespace.useState(null);
-  const reset = React4__namespace.useCallback(() => {
+  const [status, setStatus] = React3__namespace.useState("idle");
+  const [error, setError] = React3__namespace.useState(null);
+  const reset = React3__namespace.useCallback(() => {
     setStatus("idle");
     setError(null);
   }, []);
-  const stepUp = React4__namespace.useCallback(
+  const stepUp = React3__namespace.useCallback(
     async (args) => {
       setError(null);
       setStatus("requesting-options");
@@ -1542,6 +2552,8 @@ exports.DEFAULT_CONFIG = DEFAULT_CONFIG;
 exports.OcAccountChip = OcAccountChip;
 exports.OcAccountPill = OcAccountPill;
 exports.OcAddressInput = OcAddressInput;
+exports.OcIdentityBond = OcIdentityBond;
+exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;
 exports.OcSignInButton = OcSignInButton;