decane-connect-kit 2.30.0 → 2.31.0

package/dist/index.d.cts

@@ -94,11 +94,8 @@ interface DecaneConnectConfig {
     chains: Chain[];
     authMethods: Array<'google' | 'email' | 'phone' | 'kingschat' | 'x'>;
     /**
-     * Scopes requested from KingsChat at sign-in. Defaults to
-     * `['send_chat_message']`, which is what KingsChat's own SDK asks for and is
-     * enough to establish identity. Widen only if the app actually calls
-     * KingsChat APIs on the user's behalf — the consent screen lists every scope,
-     * so asking for more than you use costs conversions.
+     * @deprecated Ignored since 2.31.0. KingsChat scopes are now set on the
+     * KingsChat project in its developer portal, not per login request.
      */
     kingsChatScopes?: string[];
     apiBaseUrl?: string;
@@ -765,9 +762,14 @@ declare class ApiClient {
         authorizationUrl: string;
     }>;
     /**
-     * Exchange a KingsChat access token for a Decane session. The backend spends
-     * the token against KingsChat's own API to establish the identity — it is
-     * never trusted on its face, and never stored.
+     * Exchange a KingsChat authorization code for a Decane session. The backend
+     * trades it with KingsChat for an access token, verifies that token (it must
+     * have been issued to this project's KingsChat app), and never stores it.
+     */
+    authKingsChatCode(code: string): Promise<AuthResult>;
+    /**
+     * Exchange a KingsChat access token the app already holds for a Decane
+     * session. Verified the same way as a code's token, and never stored.
      */
     authKingsChat(accessToken: string): Promise<AuthResult>;
     authEmailStart(email: string): Promise<void>;
@@ -989,8 +991,8 @@ interface SocialConfig {
     apiKey: string;
     authMethods?: ("google" | "email" | "phone" | "kingschat" | "x")[];
     /**
-     * Scopes requested from KingsChat. Defaults to `['send_chat_message']`, which
-     * is what KingsChat's own SDK asks for and is enough to establish identity.
+     * @deprecated Ignored since 2.31.0. KingsChat scopes are now set on the
+     * KingsChat project in its developer portal, not per login request.
      */
     kingsChatScopes?: string[];
     promptPin?: () => Promise<string>;
@@ -1194,19 +1196,18 @@ declare function startEmailAuth(api: ApiClient, email: string): Promise<void>;
  */
 declare function verifyEmailCode(api: ApiClient, email: string, code: string): Promise<AuthResult>;
 
+/** @deprecated KingsChat no longer issues tokens to a popup. */
 interface KingsChatTokens {
     accessToken: string;
     refreshToken?: string;
     expiresInMillis?: number;
 }
 /**
- * Open the KingsChat consent popup and resolve with the tokens it returns.
- *
- * Must be called synchronously from a user gesture (a click handler) — popup
- * blockers reject a window.open that happens after an await, which is why the
- * clientId is fetched by the caller *before* this runs.
+ * @deprecated Since 2.31.0. KingsChat retired the popup login; use
+ * `connectWithKingsChat()`, which redirects to KingsChat and finishes on the
+ * page registered as the KingsChat application's Redirect URL.
  */
-declare function loginWithKingsChatPopup(opts: {
+declare function loginWithKingsChatPopup(_opts?: {
     clientId: string;
     scopes?: string[];
     timeoutMs?: number;

package/dist/index.d.ts

@@ -94,11 +94,8 @@ interface DecaneConnectConfig {
     chains: Chain[];
     authMethods: Array<'google' | 'email' | 'phone' | 'kingschat' | 'x'>;
     /**
-     * Scopes requested from KingsChat at sign-in. Defaults to
-     * `['send_chat_message']`, which is what KingsChat's own SDK asks for and is
-     * enough to establish identity. Widen only if the app actually calls
-     * KingsChat APIs on the user's behalf — the consent screen lists every scope,
-     * so asking for more than you use costs conversions.
+     * @deprecated Ignored since 2.31.0. KingsChat scopes are now set on the
+     * KingsChat project in its developer portal, not per login request.
      */
     kingsChatScopes?: string[];
     apiBaseUrl?: string;
@@ -765,9 +762,14 @@ declare class ApiClient {
         authorizationUrl: string;
     }>;
     /**
-     * Exchange a KingsChat access token for a Decane session. The backend spends
-     * the token against KingsChat's own API to establish the identity — it is
-     * never trusted on its face, and never stored.
+     * Exchange a KingsChat authorization code for a Decane session. The backend
+     * trades it with KingsChat for an access token, verifies that token (it must
+     * have been issued to this project's KingsChat app), and never stores it.
+     */
+    authKingsChatCode(code: string): Promise<AuthResult>;
+    /**
+     * Exchange a KingsChat access token the app already holds for a Decane
+     * session. Verified the same way as a code's token, and never stored.
      */
     authKingsChat(accessToken: string): Promise<AuthResult>;
     authEmailStart(email: string): Promise<void>;
@@ -989,8 +991,8 @@ interface SocialConfig {
     apiKey: string;
     authMethods?: ("google" | "email" | "phone" | "kingschat" | "x")[];
     /**
-     * Scopes requested from KingsChat. Defaults to `['send_chat_message']`, which
-     * is what KingsChat's own SDK asks for and is enough to establish identity.
+     * @deprecated Ignored since 2.31.0. KingsChat scopes are now set on the
+     * KingsChat project in its developer portal, not per login request.
      */
     kingsChatScopes?: string[];
     promptPin?: () => Promise<string>;
@@ -1194,19 +1196,18 @@ declare function startEmailAuth(api: ApiClient, email: string): Promise<void>;
  */
 declare function verifyEmailCode(api: ApiClient, email: string, code: string): Promise<AuthResult>;
 
+/** @deprecated KingsChat no longer issues tokens to a popup. */
 interface KingsChatTokens {
     accessToken: string;
     refreshToken?: string;
     expiresInMillis?: number;
 }
 /**
- * Open the KingsChat consent popup and resolve with the tokens it returns.
- *
- * Must be called synchronously from a user gesture (a click handler) — popup
- * blockers reject a window.open that happens after an await, which is why the
- * clientId is fetched by the caller *before* this runs.
+ * @deprecated Since 2.31.0. KingsChat retired the popup login; use
+ * `connectWithKingsChat()`, which redirects to KingsChat and finishes on the
+ * page registered as the KingsChat application's Redirect URL.
  */
-declare function loginWithKingsChatPopup(opts: {
+declare function loginWithKingsChatPopup(_opts?: {
     clientId: string;
     scopes?: string[];
     timeoutMs?: number;

package/dist/index.js

@@ -2106,9 +2106,19 @@ var ApiClient = class {
     return this._request("/auth/kingschat/config", { method: "GET" });
   }
   /**
-   * Exchange a KingsChat access token for a Decane session. The backend spends
-   * the token against KingsChat's own API to establish the identity — it is
-   * never trusted on its face, and never stored.
+   * Exchange a KingsChat authorization code for a Decane session. The backend
+   * trades it with KingsChat for an access token, verifies that token (it must
+   * have been issued to this project's KingsChat app), and never stores it.
+   */
+  async authKingsChatCode(code) {
+    return this._request("/auth/kingschat/code", {
+      method: "POST",
+      body: JSON.stringify({ code })
+    });
+  }
+  /**
+   * Exchange a KingsChat access token the app already holds for a Decane
+   * session. Verified the same way as a code's token, and never stored.
    */
   async authKingsChat(accessToken) {
     return this._request("/auth/kingschat", {
@@ -2463,15 +2473,16 @@ init_errors();
 
 // ../infra/tee-measurement.json
 var tee_measurement_default = {
-  signerVersion: "0.2.10",
+  signerVersion: "0.2.13",
   acceptedMrtd: [
+    '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","5538de3ba0930ae65c7c2b99346742a67dff7891545d91e8d74006d215fff256db91998eaff1c3dcca679a89df566700"]',
     '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
     '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]'
   ],
-  primaryMrtd: '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
-  capturedAt: "2026-09-07T07:19:30.544601Z",
+  primaryMrtd: '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","5538de3ba0930ae65c7c2b99346742a67dff7891545d91e8d74006d215fff256db91998eaff1c3dcca679a89df566700"]',
+  capturedAt: "2026-09-30T18:36:41Z",
   tcbStatus: "UpToDate",
-  _note: "Captured from the live CVM 786e714d-5042-4bf1-8060-0bc358f6a72f (app_4405742df08d\u2026) after the 2026-09-07 credential recovery. RTMR0 changed; RTMR1-3 did not \u2014 RTMR3 is the app-compose measurement, so the app's identity is unchanged and this is a platform/firmware move underneath the CVM (Phala node v0.6.0), not a change to what we deploy. Sealing was verified intact across it (/signer/sealing-status: sealingAvailable, roundTripOk, ready), so no auth_shares were lost. The previous measurement is retained above so a rollback still verifies. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching social/attestation.ts."
+  _note: "Captured from the live CVM app_4405742df08d after the 2026-09-30 restart that shipped signer 0.2.13 (Path A, compose byte-identical). RTMR3 changed; RTMR0-2 did not. The app-id and compose-hash events in RTMR3 are unchanged, so the move is in the platform-recorded events (instance, KMS or OS image) underneath the CVM, not in what we deploy. The quote verified against Intel (TCB UpToDate) and bound a fresh nonce before this was accepted, with the operator's approval. Sealing verified intact (/signer/sealing-status ready). Both previous measurements are retained so a rollback still verifies. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string."
 };
 
 // src/social/attestation.ts
@@ -3287,75 +3298,47 @@ async function verifyPhoneCode(api, phone, code) {
 
 // src/social/auth/kingschat.ts
 init_errors();
-var KINGSCHAT_AUTH_ORIGIN = "https://accounts.kingsch.at";
-function readTokens(data) {
-  if (!data || typeof data !== "object") return null;
-  const d = data;
-  const accessToken = d.accessToken ?? d.access_token;
-  if (typeof accessToken !== "string" || !accessToken) return null;
-  const refreshToken = d.refreshToken ?? d.refresh_token;
-  const expires = d.expiresInMillis ?? d.expires_in_millis;
-  return {
-    accessToken,
-    refreshToken: typeof refreshToken === "string" ? refreshToken : void 0,
-    expiresInMillis: typeof expires === "number" ? expires : void 0
-  };
+var KINGSCHAT_LOGIN_URL = "https://accounts.kingschat.online/log-in";
+var STATE_KEY = "decane:kingschat_state";
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function storage2() {
+  try {
+    return window.sessionStorage ?? null;
+  } catch {
+    return null;
+  }
 }
-function buildAuthUrl(clientId, scopes) {
-  const url = new URL(KINGSCHAT_AUTH_ORIGIN);
-  url.searchParams.set("client_id", clientId);
-  url.searchParams.set("scopes", JSON.stringify(scopes));
-  url.searchParams.set("redirect_uri", window.location.origin);
-  url.searchParams.set("post_message", "1");
+function beginKingsChatLogin(clientId, opts = {}) {
+  const store = storage2();
+  if (!store) throw new Error("KingsChat sign-in needs sessionStorage, which this browser is blocking");
+  const state = randomState();
+  store.setItem(STATE_KEY, state);
+  const url = new URL(KINGSCHAT_LOGIN_URL);
+  url.searchParams.set("clientId", clientId);
+  url.searchParams.set("origin", state);
+  if (opts.forceLogin) url.searchParams.set("forceLogin", "true");
   return url.toString();
 }
-function loginWithKingsChatPopup(opts) {
-  const scopes = opts.scopes ?? ["profile"];
-  const popup = window.open(
-    buildAuthUrl(opts.clientId, scopes),
-    "decane-kingschat",
-    "width=480,height=720,menubar=no,toolbar=no"
+function readKingsChatReturn(search) {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const origin = params.get("origin");
+  if (!code || !origin) return null;
+  const expected = storage2()?.getItem(STATE_KEY);
+  if (!expected || expected !== origin) return null;
+  return { code };
+}
+function clearKingsChatState() {
+  storage2()?.removeItem(STATE_KEY);
+}
+async function loginWithKingsChatPopup(_opts) {
+  throw new CallSequenceError(
+    "loginWithKingsChatPopup was removed in 2.31.0: KingsChat retired its popup login. Use connectWithKingsChat(), which redirects to KingsChat and finishes on your registered Redirect URL."
   );
-  if (!popup) {
-    throw new CallSequenceError(
-      "The KingsChat sign-in popup was blocked. Call connectWithKingsChat() directly from a click handler."
-    );
-  }
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const finish = (fn) => {
-      if (settled) return;
-      settled = true;
-      window.removeEventListener("message", onMessage);
-      clearInterval(closedPoll);
-      clearTimeout(timeout);
-      try {
-        popup.close();
-      } catch {
-      }
-      fn();
-    };
-    const onMessage = (event) => {
-      if (event.origin !== KINGSCHAT_AUTH_ORIGIN) return;
-      const data = event.data;
-      if (data && typeof data === "object" && data.error) {
-        finish(() => reject(new CallSequenceError(`KingsChat sign-in failed: ${String(data.error)}`)));
-        return;
-      }
-      const tokens2 = readTokens(event.data);
-      if (tokens2) finish(() => resolve(tokens2));
-    };
-    window.addEventListener("message", onMessage);
-    const closedPoll = setInterval(() => {
-      if (popup.closed) finish(() => reject(new UserCancelledError()));
-    }, 400);
-    const timeout = setTimeout(
-      () => finish(
-        () => reject(new CallSequenceError("KingsChat sign-in timed out before returning a token."))
-      ),
-      opts.timeoutMs ?? 5 * 6e4
-    );
-  });
 }
 
 // src/social/signers/evm.ts
@@ -3960,7 +3943,7 @@ async function createDecaneConnect(config) {
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
-  const storage2 = new Storage();
+  const storage3 = new Storage();
   const session = new SessionManager(
     events,
     durationMs,
@@ -4150,7 +4133,7 @@ async function createDecaneConnect(config) {
   }
   async function attachUnlockToken(userId, jwt, tokenKey) {
     try {
-      const stored = await storage2.getShare(userId);
+      const stored = await storage3.getShare(userId);
       if (!stored) return;
       const { token } = await api.issueUnlockToken(jwt);
       const unlockTokenIv = generateRandomBytes(12);
@@ -4159,13 +4142,13 @@ async function createDecaneConnect(config) {
         new TextEncoder().encode(token),
         unlockTokenIv
       );
-      await storage2.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+      await storage3.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
     } catch (e) {
       console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
     }
   }
   async function persistRotatedDeviceShare(userId, deviceShare) {
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     if (!stored) {
       throw new CallSequenceError(
         "Share set was rotated but this device has no stored share to update. Recover the wallet on this device before rotating."
@@ -4174,21 +4157,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await getWrappingKey(stored);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage2.putShare({ ...stored, wrappedDeviceShare, iv });
+    await storage3.putShare({ ...stored, wrappedDeviceShare, iv });
   }
   function hasPasswordUnlock(stored) {
     return !!stored && stored.unlockMethod === "password" && !!stored.passwordSalt && !!stored.wrappedUnlockToken && !!stored.unlockTokenIv;
   }
   async function passwordDeviceCandidate() {
     if (persisted?.userId) {
-      const stored = await storage2.getShare(persisted.userId);
+      const stored = await storage3.getShare(persisted.userId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
     if (lastUserId) {
-      const stored = await storage2.getShare(lastUserId);
+      const stored = await storage3.getShare(lastUserId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
-    const candidates = (await storage2.listShares()).filter(hasPasswordUnlock);
+    const candidates = (await storage3.listShares()).filter(hasPasswordUnlock);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function getWrappingKey(stored) {
@@ -4216,7 +4199,7 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
-      const label = (await storage2.getShare(userId))?.profile?.email;
+      const label = (await storage3.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
@@ -4248,8 +4231,8 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    const existing = await storage2.getShare(userId);
-    await storage2.putShare({
+    const existing = await storage3.getShare(userId);
+    await storage3.putShare({
       ...existing,
       userId,
       wrappedDeviceShare,
@@ -4333,7 +4316,7 @@ async function createDecaneConnect(config) {
       const { wrappingKey, tokenKey, meta } = await passwordSetup();
       const iv = generateRandomBytes(12);
       const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-      await storage2.putShare({
+      await storage3.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4407,7 +4390,7 @@ async function createDecaneConnect(config) {
         shareSet.device,
         iv
       );
-      await storage2.putShare({
+      await storage3.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4447,7 +4430,7 @@ async function createDecaneConnect(config) {
         zeroize(shareSet.server);
         zeroize(shareSet.device);
         zeroize(shareSet.recovery);
-        if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+        if (wrappingKey) await storage3.deleteShare(userId).catch(() => {
         });
         events.emit("wallet-unlocking");
         return returningUserUnlock(userId, jwt);
@@ -4460,7 +4443,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       zeroize(shareSet.device);
       zeroize(shareSet.recovery);
-      if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+      if (wrappingKey) await storage3.deleteShare(userId).catch(() => {
       });
       throw e;
     }
@@ -4536,7 +4519,7 @@ async function createDecaneConnect(config) {
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     let deviceShare;
     let joinedViaPasskeySync = false;
     let migrating = false;
@@ -4588,7 +4571,7 @@ async function createDecaneConnect(config) {
         rpId,
         teeUrl,
         api,
-        storage: storage2,
+        storage: storage3,
         onProgress: config.onRecoveryProgress,
         promptForRecoveryFile: config.promptForRecoveryFile,
         onNewRecoveryShare: async (recoveryShare, shareSetVersion) => {
@@ -4602,7 +4585,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!identityTier && !await storage2.getShare(userId) && isPasskeySupported()) {
+      if (!identityTier && !await storage3.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4631,7 +4614,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       if (e instanceof StaleDeviceShareError) {
         zeroize(deviceShare);
-        await storage2.deleteShare(userId);
+        await storage3.deleteShare(userId);
         if (stored) return returningUserUnlock(userId, jwt);
       } else {
         zeroize(deviceShare);
@@ -4659,7 +4642,7 @@ async function createDecaneConnect(config) {
     const result = await tee.rotateShares(jwt);
     try {
       await persistRotatedDeviceShare(userId, result.deviceShare);
-      const refreshed = await storage2.getShare(userId);
+      const refreshed = await storage3.getShare(userId);
       if (refreshed?.unlockMethod === "passkey" && refreshed.credentialId && refreshed.prfSalt) {
         await api.putRecoveryBackup(jwt, {
           wrappedDeviceShare: refreshed.wrappedDeviceShare,
@@ -4692,13 +4675,13 @@ async function createDecaneConnect(config) {
   }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
-    return usablePasskeyShare(await storage2.getShare(persisted.userId));
+    return usablePasskeyShare(await storage3.getShare(persisted.userId));
   }
   async function passkeyDeviceCandidate() {
     if (!isPasskeySupported()) return null;
     if (persisted?.userId) return passkeyLoginCandidate();
-    if (lastUserId) return usablePasskeyShare(await storage2.getShare(lastUserId));
-    const candidates = (await storage2.listShares()).map(usablePasskeyShare).filter(Boolean);
+    if (lastUserId) return usablePasskeyShare(await storage3.getShare(lastUserId));
+    const candidates = (await storage3.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function canOfferPasskey() {
@@ -4706,15 +4689,15 @@ async function createDecaneConnect(config) {
     if (await passkeyDeviceCandidate()) return true;
     const known = persisted?.userId ?? lastUserId;
     if (!known) return false;
-    return await storage2.getShare(known) == null;
+    return await storage3.getShare(known) == null;
   }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
     try {
-      const stored = await storage2.getShare(userId);
+      const stored = await storage3.getShare(userId);
       if (!stored) return;
-      await storage2.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
+      await storage3.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
     } catch {
     }
   }
@@ -4738,7 +4721,7 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
-    const stored = await storage2.getShare(userId);
+    const stored = await storage3.getShare(userId);
     return {
       addresses,
       isNewUser: false,
@@ -4798,6 +4781,11 @@ async function createDecaneConnect(config) {
     return new Promise(() => {
     });
   }
+  async function finishKingsChatReturn(code) {
+    clearKingsChatState();
+    window.history.replaceState({}, "", window.location.pathname);
+    return handleAuthResult(await api.authKingsChatCode(code));
+  }
   async function handleAuthResult(result) {
     let addresses;
     if (!result.hasShare) {
@@ -4860,6 +4848,8 @@ async function createDecaneConnect(config) {
      * this never starts a flow.
      */
     async completeRedirectSignIn() {
+      const pending = readKingsChatReturn(window.location.search);
+      if (pending) return finishKingsChatReturn(pending.code);
       const outcome = readRedirectOutcome(window.location.search);
       if (outcome.kind === "none") {
         throw new CallSequenceError("No sign-in result in the URL to complete");
@@ -4878,12 +4868,12 @@ async function createDecaneConnect(config) {
       return handleAuthResult(await api.authGoogleToken(idToken));
     },
     async connectWithKingsChat() {
+      const pending = readKingsChatReturn(window.location.search);
+      if (pending) return finishKingsChatReturn(pending.code);
       const { clientId } = await api.getKingsChatConfig();
-      const tokens2 = await loginWithKingsChatPopup({
-        clientId,
-        scopes: config.kingsChatScopes
+      window.location.href = beginKingsChatLogin(clientId);
+      return new Promise(() => {
       });
-      return client.connectWithKingsChatToken(tokens2.accessToken);
     },
     async connectWithKingsChatToken(accessToken) {
       if (!accessToken) {
@@ -4925,7 +4915,7 @@ async function createDecaneConnect(config) {
       events.emit("connected");
       persistLiveSession();
       scheduleAccessTokenExpiry(token, claims.expiresAt);
-      const stored = await storage2.getShare(claims.userId);
+      const stored = await storage3.getShare(claims.userId);
       return {
         addresses,
         isNewUser: false,
@@ -4961,7 +4951,7 @@ async function createDecaneConnect(config) {
       const candidate = await passkeyDeviceCandidate();
       if (candidate) return passkeyLogin(candidate);
       const known = persisted?.userId ?? lastUserId;
-      if (isPasskeySupported() && known && await storage2.getShare(known) == null) {
+      if (isPasskeySupported() && known && await storage3.getShare(known) == null) {
         return passkeyLoginWithoutShare(known);
       }
       throw new NewDeviceError();
@@ -4980,7 +4970,7 @@ async function createDecaneConnect(config) {
     async setUnlockPassword(password) {
       if (!auth) throw new ReconnectRequiredError();
       validateUnlockPassword(password);
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (!stored) throw new NewDeviceError();
       const deviceShare = await aesGcmDecrypt(
         await getWrappingKey(stored),
@@ -4999,7 +4989,7 @@ async function createDecaneConnect(config) {
         );
         const iv = generateRandomBytes(12);
         const wrappedDeviceShare = await aesGcmEncrypt(shareKey, deviceShare, iv);
-        await storage2.putShare({
+        await storage3.putShare({
           ...stored,
           unlockMethod: "password",
           wrappedDeviceShare,
@@ -5079,9 +5069,9 @@ async function createDecaneConnect(config) {
     async removeUnlockPassword() {
       if (!auth) throw new ReconnectRequiredError();
       await api.revokeUnlockTokens(auth.jwt);
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (!stored || stored.unlockMethod !== "password") return;
-      await storage2.putShare({
+      await storage3.putShare({
         ...stored,
         wrappedUnlockToken: void 0,
         unlockTokenIv: void 0
@@ -5089,7 +5079,7 @@ async function createDecaneConnect(config) {
     },
     async hasPasskey() {
       if (!auth) return false;
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       return stored?.unlockMethod === "passkey";
     },
     async addPasskey() {
@@ -5100,7 +5090,7 @@ async function createDecaneConnect(config) {
       }
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
-      const stored = await storage2.getShare(auth.userId);
+      const stored = await storage3.getShare(auth.userId);
       if (stored?.unlockMethod === "passkey") return;
       if (!stored) {
         if (!serverAssistedRecovery) throw new NewDeviceError();
@@ -5133,12 +5123,12 @@ async function createDecaneConnect(config) {
     },
     async deviceProtected() {
       if (!auth) return false;
-      return await storage2.getShare(auth.userId) !== null;
+      return await storage3.getShare(auth.userId) !== null;
     },
     async protectDevice() {
       if (identityTier) return false;
       if (!auth) throw new ReconnectRequiredError();
-      if (await storage2.getShare(auth.userId)) return true;
+      if (await storage3.getShare(auth.userId)) return true;
       if (!serverAssistedRecovery) throw new NewDeviceError();
       const tee = new TeeClient(teeUrl);
       const provisioned = await tee.provisionDeviceShare(auth.jwt);
@@ -5148,7 +5138,7 @@ async function createDecaneConnect(config) {
       } finally {
         zeroize(provisioned);
       }
-      return await storage2.getShare(auth.userId) !== null;
+      return await storage3.getShare(auth.userId) !== null;
     },
     async unlock() {
       if (!auth) {
@@ -6111,7 +6101,6 @@ function SignInView({
       await onKingsChatSignIn();
     } catch (e) {
       setError(e.message);
-    } finally {
       setKingsChatLoading(false);
     }
   }
@@ -6247,7 +6236,7 @@ function SignInView({
       value: phone,
       onChange: (e) => setPhone(e.target.value)
     }
-  ), /* @__PURE__ */ React2.createElement("button", { type: "submit", className: "dcm-submit", disabled: busy || !phone.trim() }, phoneLoading ? "Sending\u2026" : "Submit")), authMethods.includes("x") && onXSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleX, disabled: busy }, /* @__PURE__ */ React2.createElement(XLogo, { size: 16 }), /* @__PURE__ */ React2.createElement("span", null, xLoading ? "Redirecting to X\u2026" : "X")), authMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleKingsChat, disabled: busy }, /* @__PURE__ */ React2.createElement(ChatIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, kingsChatLoading ? "Waiting for KingsChat\u2026" : "KingsChat")), customAuthLabel && onCustomAuthSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleCustomAuth, disabled: busy }, /* @__PURE__ */ React2.createElement(UserIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, customLoading ? "Connecting\u2026" : customAuthLabel))), extra, errorLine, canUsePasskey && onPasskeySignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-link", onClick: () => {
+  ), /* @__PURE__ */ React2.createElement("button", { type: "submit", className: "dcm-submit", disabled: busy || !phone.trim() }, phoneLoading ? "Sending\u2026" : "Submit")), authMethods.includes("x") && onXSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleX, disabled: busy }, /* @__PURE__ */ React2.createElement(XLogo, { size: 16 }), /* @__PURE__ */ React2.createElement("span", null, xLoading ? "Redirecting to X\u2026" : "X")), authMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleKingsChat, disabled: busy }, /* @__PURE__ */ React2.createElement(ChatIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, kingsChatLoading ? "Redirecting to KingsChat\u2026" : "KingsChat")), customAuthLabel && onCustomAuthSignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-method", onClick: handleCustomAuth, disabled: busy }, /* @__PURE__ */ React2.createElement(UserIcon, { size: 18 }), /* @__PURE__ */ React2.createElement("span", null, customLoading ? "Connecting\u2026" : customAuthLabel))), extra, errorLine, canUsePasskey && onPasskeySignIn && /* @__PURE__ */ React2.createElement("button", { type: "button", className: "dcm-link", onClick: () => {
     setError("");
     setShowOtherMethods(false);
   } }, "Use my passkey instead"), /* @__PURE__ */ React2.createElement(ProtectedBy, null));
@@ -6911,7 +6900,7 @@ function DecaneKit({ config, children }) {
       sdk.canSignInWithPasskey().then((can) => setSocialAuth((p) => ({ ...p, canUsePasskey: can }))).catch(() => {
       });
       const params = new URLSearchParams(window.location.search);
-      if (params.has("decane_jwt") || params.has("decane_error")) {
+      if (params.has("decane_jwt") || params.has("decane_error") || readKingsChatReturn(window.location.search)) {
         sdk.completeRedirectSignIn().then(applyResult).catch((e) => {
           setSocialAuth((p) => p.phase ? { ...p, phase: null } : p);
           console.error(e);