decane-connect-kit 2.5.0 → 2.6.1

package/dist/index.js

@@ -27,12 +27,13 @@ __export(errors_exports, {
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
   SessionExpiredError: () => SessionExpiredError,
   ShareCorruptedError: () => ShareCorruptedError,
+  StaleDeviceShareError: () => StaleDeviceShareError,
   UnlockRequiredError: () => UnlockRequiredError,
   UserCancelledError: () => UserCancelledError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -108,6 +109,15 @@ var init_errors = __esm({
         super("NEW_DEVICE", "No device share found. Re-authenticate to set up this device.");
       }
     };
+    StaleDeviceShareError = class extends DecaneConnectError {
+      constructor() {
+        super(
+          "STALE_DEVICE_SHARE",
+          "This device\u2019s wallet share is from a superseded share set (likely rotated from another device) and no longer matches this account. Reconnect to recover a fresh share.",
+          true
+        );
+      }
+    };
     PromptPinNotConfiguredError = class extends DecaneConnectError {
       constructor() {
         super("PROMPT_PIN_NOT_CONFIGURED", "Passkey unavailable and no promptPin callback was provided in config");
@@ -1957,6 +1967,32 @@ var ApiClient = class {
   async getGoogleInitUrl() {
     return this._request("/auth/google/init", { method: "GET" });
   }
+  /**
+   * Exchange a Google ID token the app already holds for a Decane session.
+   * Resolves to the SAME identity as the redirect flow, so one Google account
+   * means one wallet across web and mobile.
+   */
+  async authGoogleToken(idToken) {
+    return this._request("/auth/google/token", {
+      method: "POST",
+      body: JSON.stringify({ idToken })
+    });
+  }
+  /** The project's KingsChat clientId, so the dApp never has to hardcode it. */
+  async getKingsChatConfig() {
+    return this._request("/auth/kingschat/config", { method: "GET" });
+  }
+  /**
+   * Exchange a KingsChat access token for a Decane session. The backend spends
+   * the token against KingsChat's own API to establish the identity — it is
+   * never trusted on its face, and never stored.
+   */
+  async authKingsChat(accessToken) {
+    return this._request("/auth/kingschat", {
+      method: "POST",
+      body: JSON.stringify({ accessToken })
+    });
+  }
   async authEmailStart(email) {
     await this._request("/auth/email/start", {
       method: "POST",
@@ -2281,6 +2317,13 @@ var TeeClient = class {
         requireAssertionPerSignature
       })
     });
+    if (res.status === 403) {
+      const body2 = await res.json().catch(() => ({}));
+      if (body2?.error === "share_mismatch") {
+        const { StaleDeviceShareError: StaleDeviceShareError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new StaleDeviceShareError2();
+      }
+    }
     if (!res.ok) throw new Error("session open failed");
     const body = await res.json();
     this.handle = body.handle;
@@ -2340,6 +2383,45 @@ var TeeClient = class {
     }
     return { challengeId, assertion };
   }
+  /**
+   * Enrol this wallet for server-assisted provisioning by handing the enclave
+   * the recovery share to seal.
+   *
+   * After this, a new device gets a working share from login alone — no passkey
+   * sync, no recovery file. The enclave seals the share under a key only it can
+   * derive, so the backend stores ciphertext it cannot read; but the enclave
+   * then holds two of three shares and can reconstruct on its own. That is the
+   * trade this call makes, which is why it is opt-out rather than implicit.
+   */
+  async enrolAuthShare(jwt, recoveryShare) {
+    await this.ensureAttested();
+    const res = await fetch(`${this.teeUrl}/signer/auth-share`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ share: bytesToBase64(recoveryShare) })
+    });
+    if (!res.ok) throw new Error("auth share enrolment failed");
+  }
+  /**
+   * Ask the enclave for a fresh device share for this authenticated user.
+   * Returns null when the wallet was never enrolled — the signal to fall back
+   * to passkey sync or the recovery file rather than fail.
+   *
+   * Every successful call re-splits the set, so any share this device or any
+   * other held is now dead. Intentional: a leaked device share stops working the
+   * next time the user signs in anywhere.
+   */
+  async provisionDeviceShare(jwt) {
+    await this.ensureAttested();
+    const res = await fetch(`${this.teeUrl}/signer/provision`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
+    });
+    if (res.status === 409) return null;
+    if (!res.ok) throw new Error("device share provisioning failed");
+    const body = await res.json();
+    return base64ToBytes(body.deviceShare);
+  }
   /** Voluntary rotation — e.g. after a suspected device compromise, or to invalidate an old recovery file. */
   async rotateShares(jwt) {
     if (!this.handle) throw new Error("no session");
@@ -2726,6 +2808,79 @@ async function verifyEmailCode(api, email, code) {
   return api.authEmailVerify(email, code);
 }
 
+// src/social/auth/kingschat.ts
+init_errors();
+var KINGSCHAT_AUTH_ORIGIN = "https://accounts.kingsch.at";
+function readTokens(data) {
+  if (!data || typeof data !== "object") return null;
+  const d = data;
+  const accessToken = d.accessToken ?? d.access_token;
+  if (typeof accessToken !== "string" || !accessToken) return null;
+  const refreshToken = d.refreshToken ?? d.refresh_token;
+  const expires = d.expiresInMillis ?? d.expires_in_millis;
+  return {
+    accessToken,
+    refreshToken: typeof refreshToken === "string" ? refreshToken : void 0,
+    expiresInMillis: typeof expires === "number" ? expires : void 0
+  };
+}
+function buildAuthUrl(clientId, scopes) {
+  const url = new URL(KINGSCHAT_AUTH_ORIGIN);
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("scopes", JSON.stringify(scopes));
+  url.searchParams.set("redirect_uri", window.location.origin);
+  url.searchParams.set("post_message", "1");
+  return url.toString();
+}
+function loginWithKingsChatPopup(opts) {
+  const scopes = opts.scopes ?? ["send_chat_message"];
+  const popup = window.open(
+    buildAuthUrl(opts.clientId, scopes),
+    "decane-kingschat",
+    "width=480,height=720,menubar=no,toolbar=no"
+  );
+  if (!popup) {
+    throw new CallSequenceError(
+      "The KingsChat sign-in popup was blocked. Call connectWithKingsChat() directly from a click handler."
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      window.removeEventListener("message", onMessage);
+      clearInterval(closedPoll);
+      clearTimeout(timeout);
+      try {
+        popup.close();
+      } catch {
+      }
+      fn();
+    };
+    const onMessage = (event) => {
+      if (event.origin !== KINGSCHAT_AUTH_ORIGIN) return;
+      const data = event.data;
+      if (data && typeof data === "object" && data.error) {
+        finish(() => reject(new CallSequenceError(`KingsChat sign-in failed: ${String(data.error)}`)));
+        return;
+      }
+      const tokens2 = readTokens(event.data);
+      if (tokens2) finish(() => resolve(tokens2));
+    };
+    window.addEventListener("message", onMessage);
+    const closedPoll = setInterval(() => {
+      if (popup.closed) finish(() => reject(new UserCancelledError()));
+    }, 400);
+    const timeout = setTimeout(
+      () => finish(
+        () => reject(new CallSequenceError("KingsChat sign-in timed out before returning a token."))
+      ),
+      opts.timeoutMs ?? 5 * 6e4
+    );
+  });
+}
+
 // src/social/signers/evm.ts
 import { keccak256, Transaction, resolveProperties } from "ethers";
 async function signEvmTransaction(tee, chain, tx, jwt) {
@@ -3088,7 +3243,7 @@ async function recoverDeviceShare(input) {
         prfSalt: backup.prfSalt,
         version: 1
       });
-      return deviceShare;
+      return { deviceShare, flow: "passkey-sync" };
     } catch (e) {
       input.onProgress?.({
         type: "passkey-failed",
@@ -3116,7 +3271,7 @@ async function recoverDeviceShare(input) {
   input.onProgress?.({ type: "rotated", shareSetVersion: result.shareSetVersion });
   await input.onNewRecoveryShare?.(result.recoveryShare, result.shareSetVersion);
   zeroize(result.recoveryShare);
-  return result.deviceShare;
+  return { deviceShare: result.deviceShare, flow: "recovery-file" };
 }
 
 // src/social/recovery/portableBackup.ts
@@ -3234,6 +3389,11 @@ async function createDecaneConnect(config) {
   if (!config.apiKey) throw new Error("decane-connect-kit: apiKey is required");
   if (!config.chains?.length)
     throw new Error("decane-connect-kit: at least one chain is required");
+  if (config.rotateOnNewDeviceRecovery && !config.onRecoveryRotated) {
+    throw new Error(
+      "decane-connect-kit: rotateOnNewDeviceRecovery requires an onRecoveryRotated callback \u2014 rotating on device join invalidates the user's existing recovery file, and the replacement must be saved."
+    );
+  }
   const baseUrl = config.apiBaseUrl ?? DEFAULT_API_BASE;
   const durationMs = (config.sessionDurationMinutes ?? DEFAULT_SESSION_MINUTES) * 6e4;
   const rpId = config.rpId ?? (typeof window !== "undefined" ? window.location.hostname : "localhost");
@@ -3253,6 +3413,7 @@ async function createDecaneConnect(config) {
   let persisted = loadPersisted(PERSIST_KEY);
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
+  const serverAssistedRecovery = true;
   const SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
     if (!persistSession) return;
@@ -3478,6 +3639,17 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
       }
     }
+    if (serverAssistedRecovery) {
+      try {
+        const tee = new TeeClient(teeUrl);
+        await tee.enrolAuthShare(jwt, shareSet.recovery);
+      } catch (e) {
+        console.warn(
+          "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device.",
+          e
+        );
+      }
+    }
     zeroize(shareSet.recovery);
     return addresses;
   }
@@ -3486,13 +3658,36 @@ async function createDecaneConnect(config) {
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
     const stored = await storage.getShare(userId);
     let deviceShare;
+    let joinedViaPasskeySync = false;
     if (!stored) {
+      if (serverAssistedRecovery) {
+        try {
+          const tee = new TeeClient(teeUrl);
+          const provisioned = await tee.provisionDeviceShare(jwt);
+          if (provisioned) {
+            await registerPasskeyAndBackup(userId, jwt, provisioned).catch(() => {
+            });
+            let addrs;
+            try {
+              addrs = await session.start(provisioned, jwt, recordedAddresses);
+            } finally {
+              zeroize(provisioned);
+            }
+            return addrs;
+          }
+        } catch (e) {
+          console.warn(
+            "decane-connect-kit: server-assisted provisioning unavailable; falling back to passkey/recovery-file recovery.",
+            e
+          );
+        }
+      }
       if (!config.onRecoveryRotated) {
         throw new CallSequenceError(
           "Recovery rotates the share set and issues a new recovery file, but no onRecoveryRotated callback is configured to save it. Configure onRecoveryRotated before allowing recovery."
         );
       }
-      deviceShare = await recoverDeviceShare({
+      const recovered = await recoverDeviceShare({
         userId,
         jwt,
         rpId,
@@ -3510,6 +3705,8 @@ async function createDecaneConnect(config) {
           await api.markRecoveryShareSaved(jwt);
         }
       });
+      deviceShare = recovered.deviceShare;
+      joinedViaPasskeySync = recovered.flow === "passkey-sync";
       if (!await storage.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
@@ -3525,15 +3722,66 @@ async function createDecaneConnect(config) {
         throw stored.unlockMethod === "pin" ? new InvalidPinError() : new ShareCorruptedError();
       }
     }
-    const addresses = await session.start(deviceShare, jwt, recordedAddresses);
+    let addresses;
+    try {
+      addresses = await session.start(deviceShare, jwt, recordedAddresses);
+    } catch (e) {
+      if (e instanceof StaleDeviceShareError) {
+        zeroize(deviceShare);
+        await storage.deleteShare(userId);
+        if (stored) return returningUserUnlock(userId, jwt);
+      } else {
+        zeroize(deviceShare);
+      }
+      throw e;
+    }
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
         `decane-connect-kit: recorded EVM address (${recordedAddresses.evm}) does not match the signing key (${addresses.evm}). Using the signing key's address; the record has been corrected.`
       );
     }
+    if (joinedViaPasskeySync && config.rotateOnNewDeviceRecovery) {
+      await rotateForNewDevice(userId, jwt);
+    }
     return addresses;
   }
+  async function rotateForNewDevice(userId, jwt) {
+    const tee = session.requireActive();
+    const result = await tee.rotateShares(jwt);
+    try {
+      await persistRotatedDeviceShare(userId, result.deviceShare);
+      const refreshed = await storage.getShare(userId);
+      if (refreshed?.unlockMethod === "passkey" && refreshed.credentialId && refreshed.prfSalt) {
+        await api.putRecoveryBackup(jwt, {
+          wrappedDeviceShare: refreshed.wrappedDeviceShare,
+          iv: refreshed.iv,
+          unlockMethod: "passkey",
+          credentialId: refreshed.credentialId,
+          prfSalt: refreshed.prfSalt
+        }).catch((e) => {
+          console.warn("decane-connect-kit: backup refresh after device rotation failed; the next new device will need the recovery file.", e);
+        });
+      }
+      const addrs = await deriveAddressesFromShares(result.deviceShare, result.recoveryShare);
+      const { password, passwordHint } = await config.onRecoveryRotated({
+        evmAddress: addrs.evm,
+        solanaAddress: addrs.solana
+      });
+      const file = await buildRecoveryShareFile(
+        result.recoveryShare,
+        password,
+        addrs,
+        result.shareSetVersion,
+        passwordHint
+      );
+      await config.onRecoveryFileReady?.(file, recoveryShareFileName(addrs.evm));
+      await api.markRecoveryShareSaved(jwt);
+    } finally {
+      zeroize(result.deviceShare);
+      zeroize(result.recoveryShare);
+    }
+  }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
     const stored = await storage.getShare(persisted.userId);
@@ -3608,6 +3856,7 @@ async function createDecaneConnect(config) {
       const method = config.authMethods[0];
       if (!method) throw new CallSequenceError("No authMethods configured");
       if (method === "google") return client.connectWithGoogle();
+      if (method === "kingschat") return client.connectWithKingsChat();
       if (method === "email")
         throw new CallSequenceError(
           "Use connectWithEmail(email) for email auth"
@@ -3637,6 +3886,25 @@ async function createDecaneConnect(config) {
       return new Promise(() => {
       });
     },
+    async connectWithGoogleToken(idToken) {
+      if (!idToken) throw new CallSequenceError("connectWithGoogleToken requires an ID token");
+      return handleAuthResult(await api.authGoogleToken(idToken));
+    },
+    async connectWithKingsChat() {
+      const { clientId } = await api.getKingsChatConfig();
+      const tokens2 = await loginWithKingsChatPopup({
+        clientId,
+        scopes: config.kingsChatScopes
+      });
+      return client.connectWithKingsChatToken(tokens2.accessToken);
+    },
+    async connectWithKingsChatToken(accessToken) {
+      if (!accessToken) {
+        throw new CallSequenceError("connectWithKingsChatToken requires an access token");
+      }
+      const result = await api.authKingsChat(accessToken);
+      return handleAuthResult(result);
+    },
     async connectWithToken(token, opts) {
       if (!token) throw new CallSequenceError("connectWithToken requires a token");
       const result = await api.authExternal(token, opts?.providerId);
@@ -4409,6 +4677,7 @@ function WalletSelector({
   mode = "wallets",
   socialAuthMethods = ["google", "email"],
   onGoogleSignIn,
+  onKingsChatSignIn,
   onEmailStart,
   onEmailVerify,
   customAuthLabel,
@@ -4486,6 +4755,18 @@ function WalletSelector({
       setSocialLoad(false);
     }
   }
+  async function handleKingsChatClick() {
+    if (!onKingsChatSignIn) return;
+    setSocialLoad(true);
+    setSocialErr("");
+    try {
+      await onKingsChatSignIn();
+    } catch (e) {
+      setSocialErr(e.message);
+    } finally {
+      setSocialLoad(false);
+    }
+  }
   async function handleCustomAuthClick() {
     if (!onCustomAuthSignIn) return;
     setSocialLoad(true);
@@ -4908,6 +5189,38 @@ function WalletSelector({
           },
           /* @__PURE__ */ React2.createElement("svg", { width: "18", height: "18", viewBox: "0 0 18 18", fill: "none" }, /* @__PURE__ */ React2.createElement("path", { d: "M17.64 9.2c0-.637-.057-1.251-.164-1.84H9v3.481h4.844c-.209 1.125-.843 2.078-1.796 2.717v2.258h2.908c1.702-1.567 2.684-3.875 2.684-6.615z", fill: "#4285F4" }), /* @__PURE__ */ React2.createElement("path", { d: "M9 18c2.43 0 4.467-.806 5.956-2.18l-2.908-2.259c-.806.54-1.837.86-3.048.86-2.344 0-4.328-1.584-5.036-3.711H.957v2.332A8.997 8.997 0 0 0 9 18z", fill: "#34A853" }), /* @__PURE__ */ React2.createElement("path", { d: "M3.964 10.71A5.41 5.41 0 0 1 3.682 9c0-.593.102-1.17.282-1.71V4.958H.957A8.996 8.996 0 0 0 0 9c0 1.452.348 2.827.957 4.042l3.007-2.332z", fill: "#FBBC05" }), /* @__PURE__ */ React2.createElement("path", { d: "M9 3.58c1.321 0 2.508.454 3.44 1.345l2.582-2.58C13.463.891 11.426 0 9 0A8.997 8.997 0 0 0 .957 4.958L3.964 6.29C4.672 4.163 6.656 3.58 9 3.58z", fill: "#EA4335" })),
           socialLoad ? "Redirecting\u2026" : "Continue with Google"
+        ), !passkeyFirst && socialAuthMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React2.createElement(
+          "button",
+          {
+            onClick: handleKingsChatClick,
+            disabled: socialLoad,
+            style: {
+              display: "flex",
+              alignItems: "center",
+              justifyContent: "center",
+              gap: 10,
+              width: "100%",
+              padding: "11px 16px",
+              background: "var(--dc-surface)",
+              border: "1px solid var(--dc-border)",
+              borderRadius: 10,
+              cursor: socialLoad ? "not-allowed" : "pointer",
+              fontSize: 14,
+              fontWeight: 600,
+              color: "var(--dc-text)",
+              fontFamily: "inherit",
+              transition: "border-color 0.12s, background 0.12s",
+              opacity: socialLoad ? 0.6 : 1
+            },
+            onMouseEnter: (e) => {
+              if (!socialLoad) e.currentTarget.style.borderColor = "var(--dc-border-accent)";
+            },
+            onMouseLeave: (e) => {
+              e.currentTarget.style.borderColor = "var(--dc-border)";
+            }
+          },
+          /* @__PURE__ */ React2.createElement("svg", { width: "18", height: "18", viewBox: "0 0 18 18", fill: "none", "aria-hidden": "true" }, /* @__PURE__ */ React2.createElement("circle", { cx: "9", cy: "9", r: "9", fill: "var(--dc-accent)" }), /* @__PURE__ */ React2.createElement("path", { d: "M5.5 4.5h1.9v3.6l3.1-3.6h2.3l-3.3 3.8 3.5 5.2h-2.3l-2.5-3.8-.8.9v2.9H5.5V4.5z", fill: "var(--dc-accent-text)" })),
+          socialLoad ? "Waiting for KingsChat\u2026" : "Continue with KingsChat"
         ), !passkeyFirst && socialAuthMethods.includes("google") && socialAuthMethods.includes("email") && /* @__PURE__ */ React2.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10 } }, /* @__PURE__ */ React2.createElement("div", { style: { flex: 1, height: 1, background: "var(--dc-border)" } }), /* @__PURE__ */ React2.createElement("span", { style: { fontSize: 11, color: "var(--dc-text-muted)", whiteSpace: "nowrap" } }, "or continue with email"), /* @__PURE__ */ React2.createElement("div", { style: { flex: 1, height: 1, background: "var(--dc-border)" } })), !passkeyFirst && socialAuthMethods.includes("email") && (emailStep === "input" ? /* @__PURE__ */ React2.createElement("form", { onSubmit: handleEmailStart, style: { display: "flex", flexDirection: "column", gap: 8 } }, /* @__PURE__ */ React2.createElement(
           "input",
           {
@@ -5154,6 +5467,7 @@ function AddressRow({
 }
 function SignInView({
   onGoogleSignIn,
+  onKingsChatSignIn,
   onEmailStart,
   onEmailVerify,
   authMethods,
@@ -5165,6 +5479,7 @@ function SignInView({
   onPasskeySignIn
 }) {
   const [googleLoading, setGoogleLoading] = useState2(false);
+  const [kingsChatLoading, setKingsChatLoading] = useState2(false);
   const [email, setEmail] = useState2("");
   const [code, setCode] = useState2("");
   const [emailSent, setEmailSent] = useState2(false);
@@ -5199,6 +5514,18 @@ function SignInView({
       setGoogleLoading(false);
     }
   }
+  async function handleKingsChat() {
+    if (!onKingsChatSignIn) return;
+    setError("");
+    setKingsChatLoading(true);
+    try {
+      await onKingsChatSignIn();
+    } catch (e) {
+      setError(e.message);
+    } finally {
+      setKingsChatLoading(false);
+    }
+  }
   async function handleEmailStart(e) {
     e.preventDefault();
     setError("");
@@ -5309,6 +5636,27 @@ function SignInView({
       }
     },
     googleLoading ? "Redirecting\u2026" : "Continue with Google"
+  ), !passkeyFirst && authMethods.includes("kingschat") && onKingsChatSignIn && /* @__PURE__ */ React3.createElement(
+    "button",
+    {
+      onClick: handleKingsChat,
+      disabled: kingsChatLoading,
+      style: {
+        width: "100%",
+        padding: "10px 0",
+        marginBottom: 10,
+        background: "var(--dc-surface)",
+        color: "var(--dc-text)",
+        border: "1px solid var(--dc-border)",
+        borderRadius: 10,
+        fontSize: 13,
+        fontWeight: 700,
+        cursor: kingsChatLoading ? "not-allowed" : "pointer",
+        opacity: kingsChatLoading ? 0.7 : 1,
+        fontFamily: "inherit"
+      }
+    },
+    kingsChatLoading ? "Waiting for KingsChat\u2026" : "Continue with KingsChat"
   ), !passkeyFirst && authMethods.includes("email") && /* @__PURE__ */ React3.createElement(React3.Fragment, null, authMethods.includes("google") && /* @__PURE__ */ React3.createElement("div", { style: { textAlign: "center", color: "var(--dc-text-muted)", fontSize: 12, margin: "10px 0" } }, "\u2014 or \u2014"), !emailSent ? /* @__PURE__ */ React3.createElement("form", { onSubmit: handleEmailStart, style: { display: "flex", gap: 8 } }, /* @__PURE__ */ React3.createElement(
     "input",
     {
@@ -5482,6 +5830,7 @@ function SocialWalletModal({
   onUnlock,
   onDisconnect,
   onGoogleSignIn,
+  onKingsChatSignIn,
   onEmailStart,
   onEmailVerify,
   authMethods = ["google", "email"],
@@ -5615,6 +5964,7 @@ function SocialWalletModal({
       SignInView,
       {
         onGoogleSignIn,
+        onKingsChatSignIn,
         onEmailStart,
         onEmailVerify,
         authMethods,
@@ -5943,6 +6293,12 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social sign-in not configured");
     await sdk.connectWithGoogle();
   }, []);
+  const connectWithKingsChat = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    const result = await sdk.connectWithKingsChat();
+    applyResult(result);
+  }, [applyResult]);
   const connectWithEmail = useCallback3(async (email) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social sign-in not configured");
@@ -6109,6 +6465,7 @@ function DecaneKit({ config, children }) {
         socialAuth,
         signInWithPasskey,
         connectWithGoogle,
+        connectWithKingsChat,
         connectWithEmail,
         verifyEmailCode: verifyEmailCode2,
         connectWithToken,
@@ -6151,6 +6508,7 @@ function DecaneKit({ config, children }) {
         mode,
         socialAuthMethods: config?.social?.authMethods ?? ["google", "email"],
         onGoogleSignIn: connectWithGoogle,
+        onKingsChatSignIn: connectWithKingsChat,
         onEmailStart: connectWithEmail,
         onEmailVerify: verifyEmailCode2,
         canUsePasskey: socialAuth.canUsePasskey,
@@ -6172,6 +6530,7 @@ function DecaneKit({ config, children }) {
         customAuthLabel: customAuthConfig?.label,
         onCustomAuthSignIn: customAuthConfig ? connectWithCustomAuth : void 0,
         onGoogleSignIn: connectWithGoogle,
+        onKingsChatSignIn: connectWithKingsChat,
         onEmailStart: connectWithEmail,
         onEmailVerify: verifyEmailCode2,
         authMethods: config?.social?.authMethods ?? ["google", "email"],
@@ -6815,6 +7174,7 @@ export {
   SessionExpiredError,
   ShareCorruptedError,
   SocialWalletModal,
+  StaleDeviceShareError,
   UnlockRequiredError,
   UserCancelledError,
   WalletSelector,
@@ -6823,6 +7183,7 @@ export {
   createDecane,
   createDecaneConnect,
   createEthereumProvider,
+  loginWithKingsChatPopup,
   startEmailAuth,
   useChainSwitch,
   useDecane,