decane-connect-kit 2.29.1 → 2.30.0

package/dist/index.d.cts

@@ -431,6 +431,31 @@ interface DecaneConnect {
     connectWithToken(token: string, opts?: {
         providerId?: string;
     }): Promise<ConnectResult>;
+    /**
+     * Attach a login from your own auth system to the account that is signed in
+     * now, so that login opens this same wallet from then on. The usual case:
+     * someone signed up by email adds a phone number your backend verified, and
+     * can then sign in with either. Needs a signed-in session.
+     *
+     * The token must be fresh (it carries `exp` and `iat`, and was issued in the
+     * last ten minutes). A login that already opens a different account throws
+     * LoginInUseError: accounts are never merged. Linking one that is already
+     * on this account is a no-op (`alreadyLinked: true`). Since 2.30.0.
+     */
+    linkWithToken(token: string, opts?: {
+        providerId?: string;
+    }): Promise<{
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    /** The logins linked to the signed-in account with linkWithToken(). Since 2.30.0. */
+    listLinkedLogins(): Promise<LinkedLogin[]>;
+    /**
+     * Remove a linked login, for "change my number": sign in, unlink the old one,
+     * link the new one. The login the account was created with cannot be removed.
+     * Since 2.30.0.
+     */
+    unlinkLogin(id: string): Promise<void>;
     /**
      * Adopt a Decane access token another app of the same project handed over
      * (in a URL, say): signed in at once, unlocked on the first signature.
@@ -700,6 +725,16 @@ interface AuthResult {
      */
     providerSubject?: string;
 }
+/** A login attached to an account with linkWithToken(). */
+interface LinkedLogin {
+    id: string;
+    providerId: string | null;
+    /** The provider's name as set in the dashboard, e.g. "World Street phone". */
+    providerName: string | null;
+    /** Masked, for display: never the full identifier. */
+    identifier: string | null;
+    linkedAt: string;
+}
 
 declare class ApiClient {
     private readonly baseUrl;
@@ -782,6 +817,16 @@ declare class ApiClient {
      * provider configured.
      */
     authExternal(token: string, providerId?: string): Promise<AuthResult>;
+    /** Attach a login from the project's own provider to the signed-in account. */
+    linkExternal(jwt: string, token: string, providerId?: string): Promise<{
+        linked: true;
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    listLinkedLogins(jwt: string): Promise<{
+        logins: LinkedLogin[];
+    }>;
+    unlinkLogin(jwt: string, id: string): Promise<void>;
     /**
      * Returns null when this user has no server-registered passkey, which is the
      * expected answer for wallets created before passkey sign-in existed or for
@@ -1004,6 +1049,13 @@ interface SocialConfig {
      * read from one tab to the whole origin.
      */
     resumeSessionAcrossTabs?: boolean;
+    /**
+     * How long a wallet session lasts, in minutes. Default 480 (8 hours). The
+     * session is still capped by the access token's expiry and the signer's own
+     * limit, whichever comes first. It is also how long a saved session survives
+     * a reload, so a shorter value signs people out on refresh sooner.
+     */
+    sessionDurationMinutes?: number;
     /**
      * Offer to save a recovery-share file at signup. **Default false** since
      * 2.7.4 — opt in explicitly with `true`.
@@ -1285,6 +1337,14 @@ declare class ExportNotAuthorizedError extends DecaneConnectError {
  * The client discards what it generated and provisions instead; nothing for
  * the caller to do, which is why this never reaches them.
  */
+/**
+ * linkWithToken(): that login already opens a different account (someone signed
+ * up with that phone number on its own, say). Decane never merges two accounts,
+ * because each is its own key and its own addresses, so it was not linked.
+ */
+declare class LoginInUseError extends DecaneConnectError {
+    constructor(message?: string);
+}
 declare class WalletExistsError extends DecaneConnectError {
     constructor();
 }
@@ -1590,6 +1650,14 @@ declare function useSocialAuth(): {
         providerId?: string;
     }) => Promise<void>;
     signInWithAccessToken: (token: string) => Promise<void>;
+    linkWithToken: (token: string, opts?: {
+        providerId?: string;
+    }) => Promise<{
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    listLinkedLogins: () => Promise<LinkedLogin[]>;
+    unlinkLogin: (id: string) => Promise<void>;
     signInWithCustomAuth: (() => Promise<void>) | undefined;
     signInWithPasskey: () => Promise<void>;
     unlock: () => Promise<void>;
@@ -1765,4 +1833,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, type LinkedLogin, LoginInUseError, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.d.ts

@@ -431,6 +431,31 @@ interface DecaneConnect {
     connectWithToken(token: string, opts?: {
         providerId?: string;
     }): Promise<ConnectResult>;
+    /**
+     * Attach a login from your own auth system to the account that is signed in
+     * now, so that login opens this same wallet from then on. The usual case:
+     * someone signed up by email adds a phone number your backend verified, and
+     * can then sign in with either. Needs a signed-in session.
+     *
+     * The token must be fresh (it carries `exp` and `iat`, and was issued in the
+     * last ten minutes). A login that already opens a different account throws
+     * LoginInUseError: accounts are never merged. Linking one that is already
+     * on this account is a no-op (`alreadyLinked: true`). Since 2.30.0.
+     */
+    linkWithToken(token: string, opts?: {
+        providerId?: string;
+    }): Promise<{
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    /** The logins linked to the signed-in account with linkWithToken(). Since 2.30.0. */
+    listLinkedLogins(): Promise<LinkedLogin[]>;
+    /**
+     * Remove a linked login, for "change my number": sign in, unlink the old one,
+     * link the new one. The login the account was created with cannot be removed.
+     * Since 2.30.0.
+     */
+    unlinkLogin(id: string): Promise<void>;
     /**
      * Adopt a Decane access token another app of the same project handed over
      * (in a URL, say): signed in at once, unlocked on the first signature.
@@ -700,6 +725,16 @@ interface AuthResult {
      */
     providerSubject?: string;
 }
+/** A login attached to an account with linkWithToken(). */
+interface LinkedLogin {
+    id: string;
+    providerId: string | null;
+    /** The provider's name as set in the dashboard, e.g. "World Street phone". */
+    providerName: string | null;
+    /** Masked, for display: never the full identifier. */
+    identifier: string | null;
+    linkedAt: string;
+}
 
 declare class ApiClient {
     private readonly baseUrl;
@@ -782,6 +817,16 @@ declare class ApiClient {
      * provider configured.
      */
     authExternal(token: string, providerId?: string): Promise<AuthResult>;
+    /** Attach a login from the project's own provider to the signed-in account. */
+    linkExternal(jwt: string, token: string, providerId?: string): Promise<{
+        linked: true;
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    listLinkedLogins(jwt: string): Promise<{
+        logins: LinkedLogin[];
+    }>;
+    unlinkLogin(jwt: string, id: string): Promise<void>;
     /**
      * Returns null when this user has no server-registered passkey, which is the
      * expected answer for wallets created before passkey sign-in existed or for
@@ -1004,6 +1049,13 @@ interface SocialConfig {
      * read from one tab to the whole origin.
      */
     resumeSessionAcrossTabs?: boolean;
+    /**
+     * How long a wallet session lasts, in minutes. Default 480 (8 hours). The
+     * session is still capped by the access token's expiry and the signer's own
+     * limit, whichever comes first. It is also how long a saved session survives
+     * a reload, so a shorter value signs people out on refresh sooner.
+     */
+    sessionDurationMinutes?: number;
     /**
      * Offer to save a recovery-share file at signup. **Default false** since
      * 2.7.4 — opt in explicitly with `true`.
@@ -1285,6 +1337,14 @@ declare class ExportNotAuthorizedError extends DecaneConnectError {
  * The client discards what it generated and provisions instead; nothing for
  * the caller to do, which is why this never reaches them.
  */
+/**
+ * linkWithToken(): that login already opens a different account (someone signed
+ * up with that phone number on its own, say). Decane never merges two accounts,
+ * because each is its own key and its own addresses, so it was not linked.
+ */
+declare class LoginInUseError extends DecaneConnectError {
+    constructor(message?: string);
+}
 declare class WalletExistsError extends DecaneConnectError {
     constructor();
 }
@@ -1590,6 +1650,14 @@ declare function useSocialAuth(): {
         providerId?: string;
     }) => Promise<void>;
     signInWithAccessToken: (token: string) => Promise<void>;
+    linkWithToken: (token: string, opts?: {
+        providerId?: string;
+    }) => Promise<{
+        alreadyLinked: boolean;
+        id?: string;
+    }>;
+    listLinkedLogins: () => Promise<LinkedLogin[]>;
+    unlinkLogin: (id: string) => Promise<void>;
     signInWithCustomAuth: (() => Promise<void>) | undefined;
     signInWithPasskey: () => Promise<void>;
     unlock: () => Promise<void>;
@@ -1765,4 +1833,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, type LinkedLogin, LoginInUseError, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.js

@@ -20,6 +20,7 @@ __export(errors_exports, {
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
+  LoginInUseError: () => LoginInUseError,
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
@@ -42,7 +43,7 @@ __export(errors_exports, {
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, LoginInUseError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -191,6 +192,11 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    LoginInUseError = class extends DecaneConnectError {
+      constructor(message = "That login already opens another account. It was not linked.") {
+        super("LOGIN_IN_USE", message);
+      }
+    };
     WalletExistsError = class extends DecaneConnectError {
       constructor() {
         super("WALLET_EXISTS", "This account already has a wallet; opening it instead.", true);
@@ -2031,7 +2037,9 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError,
   // A restorable wallet already exists: the client provisions instead of creating.
-  WALLET_EXISTS: WalletExistsError
+  WALLET_EXISTS: WalletExistsError,
+  // linkWithToken(): the login already opens another account.
+  LOGIN_IN_USE: LoginInUseError
 };
 var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
@@ -2200,6 +2208,23 @@ var ApiClient = class {
       body: JSON.stringify(providerId ? { token, providerId } : { token })
     });
   }
+  /** Attach a login from the project's own provider to the signed-in account. */
+  async linkExternal(jwt, token, providerId) {
+    return this._request("/auth/link/external", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` },
+      body: JSON.stringify(providerId ? { token, providerId } : { token })
+    });
+  }
+  async listLinkedLogins(jwt) {
+    return this._request("/auth/link/external", { method: "GET", headers: { Authorization: `Bearer ${jwt}` } });
+  }
+  async unlinkLogin(jwt, id) {
+    await this._request(`/auth/link/external/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   /**
    * Returns null when this user has no server-registered passkey, which is the
    * expected answer for wallets created before passkey sign-in existed or for
@@ -3828,7 +3853,7 @@ async function buildPortableBackup(deviceShare, recoveryShare, password, address
 // src/social/client.ts
 var DEFAULT_API_BASE = "https://backend.decane.app";
 var DEFAULT_TEE_URL = "https://4405742df08d19abc549a05ade2a7154d98bd87f-8443.dstack-pha-prod9.phala.network";
-var DEFAULT_SESSION_MINUTES = 120;
+var DEFAULT_SESSION_MINUTES = 480;
 function makePersistKey(apiKey) {
   return `decane:social:${apiKey.slice(0, 20)}`;
 }
@@ -4872,6 +4897,20 @@ async function createDecaneConnect(config) {
       const result = await api.authExternal(token, opts?.providerId);
       return handleAuthResult(result);
     },
+    async linkWithToken(token, opts) {
+      if (!token) throw new CallSequenceError("linkWithToken requires a token");
+      if (!auth) throw new ReconnectRequiredError();
+      const result = await api.linkExternal(auth.jwt, token, opts?.providerId);
+      return result.id ? { alreadyLinked: result.alreadyLinked, id: result.id } : { alreadyLinked: result.alreadyLinked };
+    },
+    async listLinkedLogins() {
+      if (!auth) throw new ReconnectRequiredError();
+      return (await api.listLinkedLogins(auth.jwt)).logins;
+    },
+    async unlinkLogin(id) {
+      if (!auth) throw new ReconnectRequiredError();
+      await api.unlinkLogin(auth.jwt, id);
+    },
     async connectWithAccessToken(token) {
       const claims = decodeAccessToken(token);
       if (!claims) throw new InvalidAccessTokenError("not a Decane access token");
@@ -6812,6 +6851,7 @@ function DecaneKit({ config, children }) {
       protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
+      sessionDurationMinutes,
       // Recovery callbacks. Forwarding these is what makes recovery
       // configurable at all from <DecaneKit>; before, they were silently
       // dropped and the headless client was constructed without them.
@@ -6835,6 +6875,7 @@ function DecaneKit({ config, children }) {
       protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
+      sessionDurationMinutes,
       offerRecoveryAtSignup,
       onRecoveryShareOffer,
       onRecoveryFileReady,
@@ -6958,6 +6999,21 @@ function DecaneKit({ config, children }) {
       throw e;
     }
   }, [clearPhase]);
+  const linkWithToken = useCallback3(async (token, opts) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.linkWithToken(token, opts);
+  }, []);
+  const listLinkedLogins = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.listLinkedLogins();
+  }, []);
+  const unlinkLogin = useCallback3(async (id) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    await sdk.unlinkLogin(id);
+  }, []);
   const connectWithToken = useCallback3(async (token, opts) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social sign-in not configured");
@@ -7175,6 +7231,9 @@ function DecaneKit({ config, children }) {
         verifyPhoneCode: verifyPhoneCode2,
         connectWithToken,
         connectWithAccessToken,
+        linkWithToken,
+        listLinkedLogins,
+        unlinkLogin,
         customAuthLabel: customAuthConfig?.label,
         connectWithCustomAuth: customAuthConfig ? connectWithCustomAuth : void 0,
         socialUnlock,
@@ -7291,6 +7350,9 @@ function useSocialAuth() {
     verifyPhoneCode: verifyPhoneCode2,
     connectWithToken,
     connectWithAccessToken,
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     customAuthLabel,
     connectWithCustomAuth,
     signInWithPasskey: ctxSignInWithPasskey,
@@ -7494,6 +7556,11 @@ function useSocialAuth() {
     confirmPhoneCode,
     signInWithToken,
     signInWithAccessToken,
+    // Linked logins: while signed in, attach a login from your own auth (a
+    // phone number your backend verified, say) so it opens this same wallet.
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     signInWithCustomAuth: connectWithCustomAuth ? signInWithCustomAuth : void 0,
     signInWithPasskey,
     unlock,
@@ -8047,6 +8114,7 @@ export {
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,
+  LoginInUseError,
   MIN_PASSWORD_LENGTH,
   NetworkError,
   NewDeviceError,