decane-connect-kit 2.29.3 → 2.31.0

package/dist/index.js

@@ -20,6 +20,7 @@ __export(errors_exports, {
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
+  LoginInUseError: () => LoginInUseError,
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
@@ -42,7 +43,7 @@ __export(errors_exports, {
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, LoginInUseError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -191,6 +192,11 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    LoginInUseError = class extends DecaneConnectError {
+      constructor(message = "That login already opens another account. It was not linked.") {
+        super("LOGIN_IN_USE", message);
+      }
+    };
     WalletExistsError = class extends DecaneConnectError {
       constructor() {
         super("WALLET_EXISTS", "This account already has a wallet; opening it instead.", true);
@@ -2031,7 +2037,9 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError,
   // A restorable wallet already exists: the client provisions instead of creating.
-  WALLET_EXISTS: WalletExistsError
+  WALLET_EXISTS: WalletExistsError,
+  // linkWithToken(): the login already opens another account.
+  LOGIN_IN_USE: LoginInUseError
 };
 var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
@@ -2098,9 +2106,19 @@ var ApiClient = class {
     return this._request("/auth/kingschat/config", { method: "GET" });
   }
   /**
-   * Exchange a KingsChat access token for a Decane session. The backend spends
-   * the token against KingsChat's own API to establish the identity — it is
-   * never trusted on its face, and never stored.
+   * Exchange a KingsChat authorization code for a Decane session. The backend
+   * trades it with KingsChat for an access token, verifies that token (it must
+   * have been issued to this project's KingsChat app), and never stores it.
+   */
+  async authKingsChatCode(code) {
+    return this._request("/auth/kingschat/code", {
+      method: "POST",
+      body: JSON.stringify({ code })
+    });
+  }
+  /**
+   * Exchange a KingsChat access token the app already holds for a Decane
+   * session. Verified the same way as a code's token, and never stored.
    */
   async authKingsChat(accessToken) {
     return this._request("/auth/kingschat", {
@@ -2200,6 +2218,23 @@ var ApiClient = class {
       body: JSON.stringify(providerId ? { token, providerId } : { token })
     });
   }
+  /** Attach a login from the project's own provider to the signed-in account. */
+  async linkExternal(jwt, token, providerId) {
+    return this._request("/auth/link/external", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` },
+      body: JSON.stringify(providerId ? { token, providerId } : { token })
+    });
+  }
+  async listLinkedLogins(jwt) {
+    return this._request("/auth/link/external", { method: "GET", headers: { Authorization: `Bearer ${jwt}` } });
+  }
+  async unlinkLogin(jwt, id) {
+    await this._request(`/auth/link/external/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   /**
    * Returns null when this user has no server-registered passkey, which is the
    * expected answer for wallets created before passkey sign-in existed or for
@@ -3263,75 +3298,47 @@ async function verifyPhoneCode(api, phone, code) {
 
 // src/social/auth/kingschat.ts
 init_errors();
-var KINGSCHAT_AUTH_ORIGIN = "https://accounts.kingsch.at";
-function readTokens(data) {
-  if (!data || typeof data !== "object") return null;
-  const d = data;
-  const accessToken = d.accessToken ?? d.access_token;
-  if (typeof accessToken !== "string" || !accessToken) return null;
-  const refreshToken = d.refreshToken ?? d.refresh_token;
-  const expires = d.expiresInMillis ?? d.expires_in_millis;
-  return {
-    accessToken,
-    refreshToken: typeof refreshToken === "string" ? refreshToken : void 0,
-    expiresInMillis: typeof expires === "number" ? expires : void 0
-  };
+var KINGSCHAT_LOGIN_URL = "https://accounts.kingschat.online/log-in";
+var STATE_KEY = "decane:kingschat_state";
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function storage2() {
+  try {
+    return window.sessionStorage ?? null;
+  } catch {
+    return null;
+  }
 }
-function buildAuthUrl(clientId, scopes) {
-  const url = new URL(KINGSCHAT_AUTH_ORIGIN);
-  url.searchParams.set("client_id", clientId);
-  url.searchParams.set("scopes", JSON.stringify(scopes));
-  url.searchParams.set("redirect_uri", window.location.origin);
-  url.searchParams.set("post_message", "1");
+function beginKingsChatLogin(clientId, opts = {}) {
+  const store = storage2();
+  if (!store) throw new Error("KingsChat sign-in needs sessionStorage, which this browser is blocking");
+  const state = randomState();
+  store.setItem(STATE_KEY, state);
+  const url = new URL(KINGSCHAT_LOGIN_URL);
+  url.searchParams.set("clientId", clientId);
+  url.searchParams.set("origin", state);
+  if (opts.forceLogin) url.searchParams.set("forceLogin", "true");
   return url.toString();
 }
-function loginWithKingsChatPopup(opts) {
-  const scopes = opts.scopes ?? ["profile"];
-  const popup = window.open(
-    buildAuthUrl(opts.clientId, scopes),
-    "decane-kingschat",
-    "width=480,height=720,menubar=no,toolbar=no"
+function readKingsChatReturn(search) {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const origin = params.get("origin");
+  if (!code || !origin) return null;
+  const expected = storage2()?.getItem(STATE_KEY);
+  if (!expected || expected !== origin) return null;
+  return { code };
+}
+function clearKingsChatState() {
+  storage2()?.removeItem(STATE_KEY);
+}
+async function loginWithKingsChatPopup(_opts) {
+  throw new CallSequenceError(
+    "loginWithKingsChatPopup was removed in 2.31.0: KingsChat retired its popup login. Use connectWithKingsChat(), which redirects to KingsChat and finishes on your registered Redirect URL."
   );
-  if (!popup) {
-    throw new CallSequenceError(
-      "The KingsChat sign-in popup was blocked. Call connectWithKingsChat() directly from a click handler."
-    );
-  }
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const finish = (fn) => {
-      if (settled) return;
-      settled = true;
-      window.removeEventListener("message", onMessage);
-      clearInterval(closedPoll);
-      clearTimeout(timeout);
-      try {
-        popup.close();
-      } catch {
-      }
-      fn();
-    };
-    const onMessage = (event) => {
-      if (event.origin !== KINGSCHAT_AUTH_ORIGIN) return;
-      const data = event.data;
-      if (data && typeof data === "object" && data.error) {
-        finish(() => reject(new CallSequenceError(`KingsChat sign-in failed: ${String(data.error)}`)));
-        return;
-      }
-      const tokens2 = readTokens(event.data);
-      if (tokens2) finish(() => resolve(tokens2));
-    };
-    window.addEventListener("message", onMessage);
-    const closedPoll = setInterval(() => {
-      if (popup.closed) finish(() => reject(new UserCancelledError()));
-    }, 400);
-    const timeout = setTimeout(
-      () => finish(
-        () => reject(new CallSequenceError("KingsChat sign-in timed out before returning a token."))
-      ),
-      opts.timeoutMs ?? 5 * 6e4
-    );
-  });
 }
 
 // src/social/signers/evm.ts
@@ -3936,7 +3943,7 @@ async function createDecaneConnect(config) {
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
-  const storage2 = new Storage();
+  const storage3 = new Storage();
   const session = new SessionManager(
     events,
     durationMs,
@@ -4126,7 +4133,7 @@ async function createDecaneConnect(config) {
   }
   async function attachUnlockToken(userId, jwt, tokenKey) {
     try {
-      const stored = await storage2.getShare(userId);
+      const stored = await storage3.getShare(userId);
       if (!stored) return;
       const { token } = await api.issueUnlockToken(jwt);
       const unlockTokenIv = generateRandomBytes(12);
@@ -4135,13 +4142,13 @@ async function createDecaneConnect(config) {
         new TextEncoder().encode(token),
         unlockTokenIv
       );
-      await storage2.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+      await storage3.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
     } catch (e) {
       console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
     }
   }
   async function persistRotatedDeviceShare(userId, deviceShare) {
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     if (!stored) {
       throw new CallSequenceError(
         "Share set was rotated but this device has no stored share to update. Recover the wallet on this device before rotating."
@@ -4150,21 +4157,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await getWrappingKey(stored);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage2.putShare({ ...stored, wrappedDeviceShare, iv });
+    await storage3.putShare({ ...stored, wrappedDeviceShare, iv });
   }
   function hasPasswordUnlock(stored) {
     return !!stored && stored.unlockMethod === "password" && !!stored.passwordSalt && !!stored.wrappedUnlockToken && !!stored.unlockTokenIv;
   }
   async function passwordDeviceCandidate() {
     if (persisted?.userId) {
-      const stored = await storage2.getShare(persisted.userId);
+      const stored = await storage3.getShare(persisted.userId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
     if (lastUserId) {
-      const stored = await storage2.getShare(lastUserId);
+      const stored = await storage3.getShare(lastUserId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
-    const candidates = (await storage2.listShares()).filter(hasPasswordUnlock);
+    const candidates = (await storage3.listShares()).filter(hasPasswordUnlock);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function getWrappingKey(stored) {
@@ -4192,7 +4199,7 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
-      const label = (await storage2.getShare(userId))?.profile?.email;
+      const label = (await storage3.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
@@ -4224,8 +4231,8 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    const existing = await storage2.getShare(userId);
-    await storage2.putShare({
+    const existing = await storage3.getShare(userId);
+    await storage3.putShare({
       ...existing,
       userId,
       wrappedDeviceShare,
@@ -4309,7 +4316,7 @@ async function createDecaneConnect(config) {
       const { wrappingKey, tokenKey, meta } = await passwordSetup();
       const iv = generateRandomBytes(12);
       const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-      await storage2.putShare({
+      await storage3.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4383,7 +4390,7 @@ async function createDecaneConnect(config) {
         shareSet.device,
         iv
       );
-      await storage2.putShare({
+      await storage3.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4423,7 +4430,7 @@ async function createDecaneConnect(config) {
         zeroize(shareSet.server);
         zeroize(shareSet.device);
         zeroize(shareSet.recovery);
-        if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+        if (wrappingKey) await storage3.deleteShare(userId).catch(() => {
         });
         events.emit("wallet-unlocking");
         return returningUserUnlock(userId, jwt);
@@ -4436,7 +4443,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       zeroize(shareSet.device);
       zeroize(shareSet.recovery);
-      if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+      if (wrappingKey) await storage3.deleteShare(userId).catch(() => {
       });
       throw e;
     }
@@ -4512,7 +4519,7 @@ async function createDecaneConnect(config) {
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     let deviceShare;
     let joinedViaPasskeySync = false;
     let migrating = false;
@@ -4564,7 +4571,7 @@ async function createDecaneConnect(config) {
         rpId,
         teeUrl,
         api,
-        storage: storage2,
+        storage: storage3,
         onProgress: config.onRecoveryProgress,
         promptForRecoveryFile: config.promptForRecoveryFile,
         onNewRecoveryShare: async (recoveryShare, shareSetVersion) => {
@@ -4578,7 +4585,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!identityTier && !await storage2.getShare(userId) && isPasskeySupported()) {
+      if (!identityTier && !await storage3.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4607,7 +4614,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       if (e instanceof StaleDeviceShareError) {
         zeroize(deviceShare);
-        await storage2.deleteShare(userId);
+        await storage3.deleteShare(userId);
         if (stored) return returningUserUnlock(userId, jwt);
       } else {
         zeroize(deviceShare);
@@ -4635,7 +4642,7 @@ async function createDecaneConnect(config) {
     const result = await tee.rotateShares(jwt);
     try {
       await persistRotatedDeviceShare(userId, result.deviceShare);
-      const refreshed = await storage2.getShare(userId);
+      const refreshed = await storage3.getShare(userId);
       if (refreshed?.unlockMethod === "passkey" && refreshed.credentialId && refreshed.prfSalt) {
         await api.putRecoveryBackup(jwt, {
           wrappedDeviceShare: refreshed.wrappedDeviceShare,
@@ -4668,13 +4675,13 @@ async function createDecaneConnect(config) {
   }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
-    return usablePasskeyShare(await storage2.getShare(persisted.userId));
+    return usablePasskeyShare(await storage3.getShare(persisted.userId));
   }
   async function passkeyDeviceCandidate() {
     if (!isPasskeySupported()) return null;
     if (persisted?.userId) return passkeyLoginCandidate();
-    if (lastUserId) return usablePasskeyShare(await storage2.getShare(lastUserId));
-    const candidates = (await storage2.listShares()).map(usablePasskeyShare).filter(Boolean);
+    if (lastUserId) return usablePasskeyShare(await storage3.getShare(lastUserId));
+    const candidates = (await storage3.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function canOfferPasskey() {
@@ -4682,15 +4689,15 @@ async function createDecaneConnect(config) {
     if (await passkeyDeviceCandidate()) return true;
     const known = persisted?.userId ?? lastUserId;
     if (!known) return false;
-    return await storage2.getShare(known) == null;
+    return await storage3.getShare(known) == null;
   }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
     try {
-      const stored = await storage2.getShare(userId);
+      const stored = await storage3.getShare(userId);
       if (!stored) return;
-      await storage2.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
+      await storage3.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
     } catch {
     }
   }
@@ -4714,7 +4721,7 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     return {
       addresses,
       isNewUser: false,
@@ -4774,6 +4781,11 @@ async function createDecaneConnect(config) {
     return new Promise(() => {
     });
   }
+  async function finishKingsChatReturn(code) {
+    clearKingsChatState();
+    window.history.replaceState({}, "", window.location.pathname);
+    return handleAuthResult(await api.authKingsChatCode(code));
+  }
   async function handleAuthResult(result) {
     let addresses;
     if (!result.hasShare) {
@@ -4836,6 +4848,8 @@ async function createDecaneConnect(config) {
      * this never starts a flow.
      */
     async completeRedirectSignIn() {
+      const pending = readKingsChatReturn(window.location.search);
+      if (pending) return finishKingsChatReturn(pending.code);
       const outcome = readRedirectOutcome(window.location.search);
       if (outcome.kind === "none") {
         throw new CallSequenceError("No sign-in result in the URL to complete");
@@ -4854,12 +4868,12 @@ async function createDecaneConnect(config) {
       return handleAuthResult(await api.authGoogleToken(idToken));
     },
     async connectWithKingsChat() {
+      const pending = readKingsChatReturn(window.location.search);
+      if (pending) return finishKingsChatReturn(pending.code);
       const { clientId } = await api.getKingsChatConfig();
-      const tokens2 = await loginWithKingsChatPopup({
-        clientId,
-        scopes: config.kingsChatScopes
+      window.location.href = beginKingsChatLogin(clientId);
+      return new Promise(() => {
       });
-      return client.connectWithKingsChatToken(tokens2.accessToken);
     },
     async connectWithKingsChatToken(accessToken) {
       if (!accessToken) {
@@ -4873,6 +4887,20 @@ async function createDecaneConnect(config) {
       const result = await api.authExternal(token, opts?.providerId);
       return handleAuthResult(result);
     },
+    async linkWithToken(token, opts) {
+      if (!token) throw new CallSequenceError("linkWithToken requires a token");
+      if (!auth) throw new ReconnectRequiredError();
+      const result = await api.linkExternal(auth.jwt, token, opts?.providerId);
+      return result.id ? { alreadyLinked: result.alreadyLinked, id: result.id } : { alreadyLinked: result.alreadyLinked };
+    },
+    async listLinkedLogins() {
+      if (!auth) throw new ReconnectRequiredError();
+      return (await api.listLinkedLogins(auth.jwt)).logins;
+    },
+    async unlinkLogin(id) {
+      if (!auth) throw new ReconnectRequiredError();
+      await api.unlinkLogin(auth.jwt, id);
+    },
     async connectWithAccessToken(token) {
       const claims = decodeAccessToken(token);
       if (!claims) throw new InvalidAccessTokenError("not a Decane access token");
@@ -4887,7 +4915,7 @@ async function createDecaneConnect(config) {
       events.emit("connected");
       persistLiveSession();
       scheduleAccessTokenExpiry(token, claims.expiresAt);
-      const stored = await storage2.getShare(claims.userId);
+      const stored = await storage3.getShare(claims.userId);
       return {
         addresses,
         isNewUser: false,
@@ -4923,7 +4951,7 @@ async function createDecaneConnect(config) {
       const candidate = await passkeyDeviceCandidate();
       if (candidate) return passkeyLogin(candidate);
       const known = persisted?.userId ?? lastUserId;
-      if (isPasskeySupported() && known && await storage2.getShare(known) == null) {
+      if (isPasskeySupported() && known && await storage3.getShare(known) == null) {
         return passkeyLoginWithoutShare(known);
       }
       throw new NewDeviceError();
@@ -4942,7 +4970,7 @@ async function createDecaneConnect(config) {
     async setUnlockPassword(password) {
       if (!auth) throw new ReconnectRequiredError();
       validateUnlockPassword(password);
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (!stored) throw new NewDeviceError();
       const deviceShare = await aesGcmDecrypt(
         await getWrappingKey(stored),
@@ -4961,7 +4989,7 @@ async function createDecaneConnect(config) {
         );
         const iv = generateRandomBytes(12);
         const wrappedDeviceShare = await aesGcmEncrypt(shareKey, deviceShare, iv);
-        await storage2.putShare({
+        await storage3.putShare({
           ...stored,
           unlockMethod: "password",
           wrappedDeviceShare,
@@ -5041,9 +5069,9 @@ async function createDecaneConnect(config) {
     async removeUnlockPassword() {
       if (!auth) throw new ReconnectRequiredError();
       await api.revokeUnlockTokens(auth.jwt);
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (!stored || stored.unlockMethod !== "password") return;
-      await storage2.putShare({
+      await storage3.putShare({
         ...stored,
         wrappedUnlockToken: void 0,
         unlockTokenIv: void 0
@@ -5051,7 +5079,7 @@ async function createDecaneConnect(config) {
     },
     async hasPasskey() {
       if (!auth) return false;
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       return stored?.unlockMethod === "passkey";
     },
     async addPasskey() {
@@ -5062,7 +5090,7 @@ async function createDecaneConnect(config) {
       }
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (stored?.unlockMethod === "passkey") return;
       if (!stored) {
         if (!serverAssistedRecovery) throw new NewDeviceError();
@@ -5095,12 +5123,12 @@ async function createDecaneConnect(config) {
     },
     async deviceProtected() {
       if (!auth) return false;
-      return await storage2.getShare(auth.userId) !== null;
+      return await storage3.getShare(auth.userId) !== null;
     },
     async protectDevice() {
       if (identityTier) return false;
       if (!auth) throw new ReconnectRequiredError();
-      if (await storage2.getShare(auth.userId)) return true;
+      if (await storage3.getShare(auth.userId)) return true;
       if (!serverAssistedRecovery) throw new NewDeviceError();
       const tee = new TeeClient(teeUrl);
       const provisioned = await tee.provisionDeviceShare(auth.jwt);
@@ -5110,7 +5138,7 @@ async function createDecaneConnect(config) {
       } finally {
         zeroize(provisioned);
       }
-      return await storage2.getShare(auth.userId) !== null;
+      return await storage3.getShare(auth.userId) !== null;
     },
     async unlock() {
       if (!auth) {
@@ -6073,7 +6101,6 @@ function SignInView({
       await onKingsChatSignIn();
     } catch (e) {
       setError(e.message);
-    } finally {
       setKingsChatLoading(false);
     }
   }
@@ -6209,7 +6236,7 @@ function SignInView({
       value: phone,
       onChange: (e) => setPhone(e.target.value)
     }
-  ), /* @__PURE__ */ React2.createElement("button", { type: "submit", className: "dcm-submit", disabled: busy || !phone.trim() }, phoneLoading ? "Sending\u2026" : "Submit")), authMethods.includes("x") && onXSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleX, disabled: busy }, /* @__PURE__ */ React2.createElement(XLogo, { size: 16 }), /* @__PURE__ */ React2.createElement("span", null, xLoading ? "Redirecting to X\u2026" : "X")), authMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleKingsChat, disabled: busy }, /* @__PURE__ */ React2.createElement(ChatIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, kingsChatLoading ? "Waiting for KingsChat\u2026" : "KingsChat")), customAuthLabel && onCustomAuthSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleCustomAuth, disabled: busy }, /* @__PURE__ */ React2.createElement(UserIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, customLoading ? "Connecting\u2026" : customAuthLabel))), extra, errorLine, canUsePasskey && onPasskeySignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-link", onClick: () => {
+  ), /* @__PURE__ */ React2.createElement("button", { type: "submit", className: "dcm-submit", disabled: busy || !phone.trim() }, phoneLoading ? "Sending\u2026" : "Submit")), authMethods.includes("x") && onXSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleX, disabled: busy }, /* @__PURE__ */ React2.createElement(XLogo, { size: 16 }), /* @__PURE__ */ React2.createElement("span", null, xLoading ? "Redirecting to X\u2026" : "X")), authMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleKingsChat, disabled: busy }, /* @__PURE__ */ React2.createElement(ChatIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, kingsChatLoading ? "Redirecting to KingsChat\u2026" : "KingsChat")), customAuthLabel && onCustomAuthSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleCustomAuth, disabled: busy }, /* @__PURE__ */ React2.createElement(UserIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, customLoading ? "Connecting\u2026" : customAuthLabel))), extra, errorLine, canUsePasskey && onPasskeySignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-link", onClick: () => {
     setError("");
     setShowOtherMethods(false);
   } }, "Use my passkey instead"), /* @__PURE__ */ React2.createElement(ProtectedBy, null));
@@ -6873,7 +6900,7 @@ function DecaneKit({ config, children }) {
       sdk.canSignInWithPasskey().then((can) => setSocialAuth((p) => ({ ...p, canUsePasskey: can }))).catch(() => {
       });
       const params = new URLSearchParams(window.location.search);
-      if (params.has("decane_jwt") || params.has("decane_error")) {
+      if (params.has("decane_jwt") || params.has("decane_error") || readKingsChatReturn(window.location.search)) {
         sdk.completeRedirectSignIn().then(applyResult).catch((e) => {
           setSocialAuth((p) => p.phase ? { ...p, phase: null } : p);
           console.error(e);
@@ -6961,6 +6988,21 @@ function DecaneKit({ config, children }) {
       throw e;
     }
   }, [clearPhase]);
+  const linkWithToken = useCallback3(async (token, opts) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.linkWithToken(token, opts);
+  }, []);
+  const listLinkedLogins = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.listLinkedLogins();
+  }, []);
+  const unlinkLogin = useCallback3(async (id) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    await sdk.unlinkLogin(id);
+  }, []);
   const connectWithToken = useCallback3(async (token, opts) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social sign-in not configured");
@@ -7178,6 +7220,9 @@ function DecaneKit({ config, children }) {
         verifyPhoneCode: verifyPhoneCode2,
         connectWithToken,
         connectWithAccessToken,
+        linkWithToken,
+        listLinkedLogins,
+        unlinkLogin,
         customAuthLabel: customAuthConfig?.label,
         connectWithCustomAuth: customAuthConfig ? connectWithCustomAuth : void 0,
         socialUnlock,
@@ -7294,6 +7339,9 @@ function useSocialAuth() {
     verifyPhoneCode: verifyPhoneCode2,
     connectWithToken,
     connectWithAccessToken,
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     customAuthLabel,
     connectWithCustomAuth,
     signInWithPasskey: ctxSignInWithPasskey,
@@ -7497,6 +7545,11 @@ function useSocialAuth() {
     confirmPhoneCode,
     signInWithToken,
     signInWithAccessToken,
+    // Linked logins: while signed in, attach a login from your own auth (a
+    // phone number your backend verified, say) so it opens this same wallet.
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     signInWithCustomAuth: connectWithCustomAuth ? signInWithCustomAuth : void 0,
     signInWithPasskey,
     unlock,
@@ -8050,6 +8103,7 @@ export {
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,
+  LoginInUseError,
   MIN_PASSWORD_LENGTH,
   NetworkError,
   NewDeviceError,