decane-connect-kit 2.23.0 → 2.24.1

package/dist/index.d.cts

@@ -358,6 +358,19 @@ interface DecaneConnect {
     connectWithToken(token: string, opts?: {
         providerId?: string;
     }): Promise<ConnectResult>;
+    /**
+     * Adopt a Decane access token another app of the same project handed over
+     * (in a URL, say): signed in at once, unlocked on the first signature.
+     *
+     * The token is the one every API call carries as a Bearer. The backend
+     * judges it — a revoked or foreign token is refused — and the session lasts
+     * as long as the token does, at most two hours; when it lapses the client
+     * emits `session-expired` and reads as signed out. No enclave session is
+     * opened: the first `unlock()` (or any signing call) provisions or unwraps
+     * the device share as an ordinary returning sign-in would, and with
+     * `deferDeviceProtection` prompts for nothing.
+     */
+    connectWithAccessToken(token: string): Promise<ConnectResult>;
     verifyEmailCode(email: string, code: string): Promise<ConnectResult>;
     /**
      * Send a 6-digit sign-in code by SMS (delivered via Termii).
@@ -1130,6 +1143,9 @@ declare class PromptPasswordNotConfiguredError extends DecaneConnectError {
 declare class WrongUnlockPasswordError extends DecaneConnectError {
     constructor();
 }
+declare class InvalidAccessTokenError extends DecaneConnectError {
+    constructor(reason: string);
+}
 declare class UnlockTokenRejectedError extends DecaneConnectError {
     constructor();
 }
@@ -1423,6 +1439,7 @@ declare function useSocialAuth(): {
     signInWithToken: (token: string, opts?: {
         providerId?: string;
     }) => Promise<void>;
+    signInWithAccessToken: (token: string) => Promise<void>;
     signInWithCustomAuth: (() => Promise<void>) | undefined;
     signInWithPasskey: () => Promise<void>;
     unlock: () => Promise<void>;
@@ -1598,4 +1615,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.d.ts

@@ -358,6 +358,19 @@ interface DecaneConnect {
     connectWithToken(token: string, opts?: {
         providerId?: string;
     }): Promise<ConnectResult>;
+    /**
+     * Adopt a Decane access token another app of the same project handed over
+     * (in a URL, say): signed in at once, unlocked on the first signature.
+     *
+     * The token is the one every API call carries as a Bearer. The backend
+     * judges it — a revoked or foreign token is refused — and the session lasts
+     * as long as the token does, at most two hours; when it lapses the client
+     * emits `session-expired` and reads as signed out. No enclave session is
+     * opened: the first `unlock()` (or any signing call) provisions or unwraps
+     * the device share as an ordinary returning sign-in would, and with
+     * `deferDeviceProtection` prompts for nothing.
+     */
+    connectWithAccessToken(token: string): Promise<ConnectResult>;
     verifyEmailCode(email: string, code: string): Promise<ConnectResult>;
     /**
      * Send a 6-digit sign-in code by SMS (delivered via Termii).
@@ -1130,6 +1143,9 @@ declare class PromptPasswordNotConfiguredError extends DecaneConnectError {
 declare class WrongUnlockPasswordError extends DecaneConnectError {
     constructor();
 }
+declare class InvalidAccessTokenError extends DecaneConnectError {
+    constructor(reason: string);
+}
 declare class UnlockTokenRejectedError extends DecaneConnectError {
     constructor();
 }
@@ -1423,6 +1439,7 @@ declare function useSocialAuth(): {
     signInWithToken: (token: string, opts?: {
         providerId?: string;
     }) => Promise<void>;
+    signInWithAccessToken: (token: string) => Promise<void>;
     signInWithCustomAuth: (() => Promise<void>) | undefined;
     signInWithPasskey: () => Promise<void>;
     unlock: () => Promise<void>;
@@ -1598,4 +1615,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.js

@@ -15,6 +15,7 @@ __export(errors_exports, {
   CallSequenceError: () => CallSequenceError,
   DecaneConnectError: () => DecaneConnectError,
   ExportNotAuthorizedError: () => ExportNotAuthorizedError,
+  InvalidAccessTokenError: () => InvalidAccessTokenError,
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
@@ -37,7 +38,7 @@ __export(errors_exports, {
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -142,6 +143,11 @@ var init_errors = __esm({
         super("WRONG_UNLOCK_PASSWORD", "That password did not unlock this device");
       }
     };
+    InvalidAccessTokenError = class extends DecaneConnectError {
+      constructor(reason) {
+        super("INVALID_ACCESS_TOKEN", `That access token cannot open a session: ${reason}`);
+      }
+    };
     UnlockTokenRejectedError = class extends DecaneConnectError {
       constructor() {
         super("UNLOCK_TOKEN_REJECTED", "This device's unlock token is no longer valid \u2014 sign in normally to re-enable password unlock");
@@ -2273,6 +2279,20 @@ function b64ToBytes(b644) {
   return Uint8Array.from(atob(b644), (c) => c.charCodeAt(0));
 }
 
+// src/social/accessToken.ts
+function decodeAccessToken(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    if (typeof json.uid !== "string" || json.uid === "") return null;
+    if (typeof json.exp !== "number" || !Number.isFinite(json.exp)) return null;
+    return { userId: json.uid, expiresAt: json.exp * 1e3 };
+  } catch {
+    return null;
+  }
+}
+
 // src/social/storage.ts
 import { openDB } from "idb";
 var DB_NAME = "decane-connect-kit";
@@ -3128,7 +3148,9 @@ function loginWithKingsChatPopup(opts) {
 }
 
 // src/social/signers/evm.ts
+init_errors();
 import { keccak256, Transaction, resolveProperties } from "ethers";
+var DECODE = (bytes) => new TextDecoder().decode(bytes);
 async function signEvmTransaction(tee, chain, tx, jwt) {
   const resolved = await resolveProperties(tx);
   const unsigned = Transaction.from(resolved).unsignedSerialized;
@@ -3137,7 +3159,44 @@ async function signEvmTransaction(tee, chain, tx, jwt) {
   return tee.sign({ chain, kind: "transaction", payload, txHash }, jwt);
 }
 async function signEvmMessage(tee, chain, message, jwt) {
-  return tee.sign({ chain, kind: "message", payload: message }, jwt);
+  return tee.sign({ chain, kind: "message", payload: messageAsString(message) }, jwt);
+}
+function messageAsString(message) {
+  if (typeof message === "string") return message;
+  if (!isValidUtf8(message)) {
+    throw new CallSequenceError(
+      "signMessage: the message bytes are not valid UTF-8. The signer hashes text; pass a string, or UTF-8 bytes."
+    );
+  }
+  return DECODE(message);
+}
+function isValidUtf8(b) {
+  let i = 0;
+  while (i < b.length) {
+    const c = b[i];
+    let n = 0;
+    if (c < 128) n = 0;
+    else if (c >= 194 && c <= 223) n = 1;
+    else if (c >= 224 && c <= 239) n = 2;
+    else if (c >= 240 && c <= 244) n = 3;
+    else return false;
+    for (let k = 1; k <= n; k++) {
+      const t = b[i + k];
+      if (t === void 0 || (t & 192) !== 128) return false;
+    }
+    if (n === 2) {
+      const c1 = b[i + 1];
+      if (c === 224 && c1 < 160) return false;
+      if (c === 237 && c1 >= 160) return false;
+    }
+    if (n === 3) {
+      const c1 = b[i + 1];
+      if (c === 240 && c1 < 144) return false;
+      if (c === 244 && c1 >= 144) return false;
+    }
+    i += n + 1;
+  }
+  return true;
 }
 async function signEvmAuthorization(tee, chainId, address, nonce, jwt) {
   const serialized = await tee.sign(
@@ -3667,8 +3726,10 @@ async function createDecaneConnect(config) {
   const durationMs = (config.sessionDurationMinutes ?? DEFAULT_SESSION_MINUTES) * 6e4;
   const rpId = config.rpId ?? (typeof window !== "undefined" ? window.location.hostname : "localhost");
   const rpName = config.rpName ?? "Decane Connect";
-  const PERSIST_KEY = makePersistKey(config.apiKey);
-  const LAST_USER_KEY = makeLastUserKey(config.apiKey);
+  const PERSIST_KEY = makePersistKey(config.appId);
+  const LAST_USER_KEY = makeLastUserKey(config.appId);
+  const LEGACY_PERSIST_KEY = makePersistKey(config.apiKey);
+  const LEGACY_LAST_USER_KEY = makeLastUserKey(config.apiKey);
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
@@ -3681,7 +3742,14 @@ async function createDecaneConnect(config) {
   );
   let auth = null;
   let persisted = loadPersisted(PERSIST_KEY);
-  let lastUserId = loadLastUser(LAST_USER_KEY);
+  if (!persisted && LEGACY_PERSIST_KEY !== PERSIST_KEY) {
+    persisted = loadPersisted(LEGACY_PERSIST_KEY);
+    if (persisted) {
+      savePersisted(PERSIST_KEY, persisted);
+      clearPersisted(LEGACY_PERSIST_KEY);
+    }
+  }
+  let lastUserId = loadLastUser(LAST_USER_KEY) ?? (LEGACY_LAST_USER_KEY !== LAST_USER_KEY ? loadLastUser(LEGACY_LAST_USER_KEY) : null);
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
   const deferDeviceProtection = config.deferDeviceProtection === true;
@@ -3744,12 +3812,13 @@ async function createDecaneConnect(config) {
       })
     ]).finally(() => clearTimeout(timer));
   }
-  const SESSION_KEY = sessionPersistKey(config.apiKey);
+  const SESSION_KEY = sessionPersistKey(config.appId);
+  const LEGACY_SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
-    if (!persistSession) return;
+    if (!persistSession || !auth) return;
     const handle = session.getHandle();
-    const expiresAt = session.expiresAtTimestamp();
-    if (!handle || !auth || !expiresAt) return;
+    const expiresAt = handle ? session.expiresAtTimestamp() : decodeAccessToken(auth.jwt)?.expiresAt ?? null;
+    if (!expiresAt) return;
     saveSession(SESSION_KEY, {
       handle,
       jwt: auth.jwt,
@@ -3761,11 +3830,23 @@ async function createDecaneConnect(config) {
   function dropLiveSession() {
     clearSessionPersist(SESSION_KEY);
   }
+  let accessTokenExpiry = null;
+  function scheduleAccessTokenExpiry(jwt, expiresAt) {
+    if (accessTokenExpiry) clearTimeout(accessTokenExpiry);
+    accessTokenExpiry = setTimeout(() => {
+      accessTokenExpiry = null;
+      if (auth?.jwt !== jwt || session.isActive()) return;
+      auth = null;
+      dropLiveSession();
+      events.emit("session-expired");
+    }, Math.max(0, expiresAt - Date.now()));
+  }
   if (persistSession) {
-    const saved = loadSession(SESSION_KEY);
-    if (saved?.handle && saved.expiresAt > Date.now() + 5e3) {
+    const saved = loadSession(SESSION_KEY) ?? (LEGACY_SESSION_KEY !== SESSION_KEY ? loadSession(LEGACY_SESSION_KEY) : null);
+    if (saved && saved.expiresAt > Date.now() + 5e3) {
       try {
-        session.resume(saved.handle, saved.addresses, saved.expiresAt);
+        if (saved.handle) session.resume(saved.handle, saved.addresses, saved.expiresAt);
+        else scheduleAccessTokenExpiry(saved.jwt, saved.expiresAt);
         auth = { jwt: saved.jwt, userId: saved.userId, addresses: saved.addresses };
         persisted = { userId: saved.userId, addresses: saved.addresses };
       } catch {
@@ -3774,6 +3855,7 @@ async function createDecaneConnect(config) {
     } else if (saved) {
       dropLiveSession();
     }
+    if (LEGACY_SESSION_KEY !== SESSION_KEY) clearSessionPersist(LEGACY_SESSION_KEY);
   }
   events.on("session-expired", () => dropLiveSession());
   async function passwordSetup() {
@@ -4491,6 +4573,27 @@ async function createDecaneConnect(config) {
       const result = await api.authExternal(token, opts?.providerId);
       return handleAuthResult(result);
     },
+    async connectWithAccessToken(token) {
+      const claims = decodeAccessToken(token);
+      if (!claims) throw new InvalidAccessTokenError("not a Decane access token");
+      if (claims.expiresAt <= Date.now() + 5e3) throw new InvalidAccessTokenError("it has expired");
+      const raw = await api.getAddresses(token);
+      if (!raw.evm || !raw.solana) throw new InvalidAccessTokenError("this account holds no wallet yet");
+      const addresses = { evm: raw.evm, solana: raw.solana, tron: raw.tron ?? evmToTronAddress2(raw.evm) };
+      if (session.isActive()) session.end();
+      auth = { jwt: token, userId: claims.userId, addresses };
+      persisted = { userId: claims.userId, addresses };
+      savePersisted(PERSIST_KEY, persisted);
+      events.emit("connected");
+      persistLiveSession();
+      scheduleAccessTokenExpiry(token, claims.expiresAt);
+      const stored = await storage.getShare(claims.userId);
+      return {
+        addresses,
+        isNewUser: false,
+        ...stored?.profile ? { profile: stored.profile } : {}
+      };
+    },
     async connectWithEmail(email) {
       await startEmailAuth(api, email);
       return { codeRequired: true };
@@ -4737,8 +4840,7 @@ async function createDecaneConnect(config) {
         return bufferToB64u(sig);
       }
       if (req.chain.startsWith("tron:")) {
-        const msg = typeof req.message === "string" ? req.message : new TextDecoder().decode(req.message);
-        return tee.sign({ chain: req.chain, kind: "message", payload: msg }, auth?.jwt);
+        return tee.sign({ chain: req.chain, kind: "message", payload: messageAsString(req.message) }, auth?.jwt);
       }
       throw new CallSequenceError(`Unsupported chain: ${req.chain}`);
     },
@@ -7483,6 +7585,18 @@ function DecaneKit({ config, children }) {
       throw e;
     }
   }, [clearPhase]);
+  const connectWithAccessToken = useCallback3(async (token) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    try {
+      const result = await sdk.connectWithAccessToken(token);
+      applyResult(result);
+      setSelectorOpen(false);
+    } catch (e) {
+      clearPhase();
+      throw e;
+    }
+  }, [clearPhase]);
   const customAuthConfig = config?.social?.customAuth;
   const connectWithCustomAuth = useCallback3(async () => {
     if (!customAuthConfig) throw new Error("Custom auth not configured");
@@ -7675,6 +7789,7 @@ function DecaneKit({ config, children }) {
         connectWithPhone,
         verifyPhoneCode: verifyPhoneCode2,
         connectWithToken,
+        connectWithAccessToken,
         customAuthLabel: customAuthConfig?.label,
         connectWithCustomAuth: customAuthConfig ? connectWithCustomAuth : void 0,
         socialUnlock,
@@ -7790,6 +7905,7 @@ function useSocialAuth() {
     connectWithPhone,
     verifyPhoneCode: verifyPhoneCode2,
     connectWithToken,
+    connectWithAccessToken,
     customAuthLabel,
     connectWithCustomAuth,
     signInWithPasskey: ctxSignInWithPasskey,
@@ -7898,6 +8014,18 @@ function useSocialAuth() {
       setTokenLoading(false);
     }
   }, [connectWithToken]);
+  const signInWithAccessToken = useCallback4(async (token) => {
+    setTokenLoading(true);
+    setError(null);
+    try {
+      await connectWithAccessToken(token);
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    } finally {
+      setTokenLoading(false);
+    }
+  }, [connectWithAccessToken]);
   const signInWithCustomAuth = useCallback4(async () => {
     if (!connectWithCustomAuth) throw new Error("Custom auth not configured");
     setCustomLoading(true);
@@ -7980,6 +8108,7 @@ function useSocialAuth() {
     sendPhoneCode,
     confirmPhoneCode,
     signInWithToken,
+    signInWithAccessToken,
     signInWithCustomAuth: connectWithCustomAuth ? signInWithCustomAuth : void 0,
     signInWithPasskey,
     unlock,
@@ -8528,6 +8657,7 @@ export {
   DecaneMark,
   DecaneWordmark,
   ExportNotAuthorizedError,
+  InvalidAccessTokenError,
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,