1 files changed, 35 insertions, 6 deletions

diff --git a/src/features/nostrlogin.js b/src/features/nostrlogin.js
index 306a12f..2023931 100644
--- a/src/features/nostrlogin.js
+++ b/src/features/nostrlogin.js
@@ -278,6 +278,16 @@ export function nostrLoginFeature(ctx) {
   // approval and the login finishes on its own. Deferred a beat so the boot
   // restore has decided whether this tab is even logged out.
   setTimeout(() => {
+    // the same, for a wallet that was reconnecting its own account (Amber
+    // moving to NIP-46 so messages can be read): back to that screen
+    const again = !nc && wallet.mnemonic && load().pubkey && nostrConnectPending();
+    if (again) {
+      ui.nostrReconnect = 'upgrade';
+      ui.nostrConnectOpen = true;
+      startNostrConnect(reconnectRun, again);
+      render();
+      return;
+    }
     const pending = !nc && !wallet.mnemonic && ui.screen === 'unlock' && nostrConnectPending();
     if (!pending) return;
     if (ui.onb && ['welcome', 'signin'].includes(ui.onb.step)) ui.onb = { step: 'signin' };
@@ -676,6 +686,11 @@ export function nostrLoginFeature(ctx) {
       linkSection());
   }
 
+  const reconnectRun = (makeSigner) => reconnectSigner(makeSigner).then(() => {
+    // an upgrade is done only once the new signer can decrypt
+    if (liveSigner() && !(ui.nostrReconnect === 'upgrade' && live.interactive)) { ui.nostrReconnect = null; ui.nostrConnectOpen = false; render(); }
+  });
+
   // The reconnect takeover: opened by any feature whose action just found
   // the signer missing (a reload dropped it; Amethyst and friends can't
   // reattach silently). Same guarded buttons as the settings card — an
@@ -683,15 +698,18 @@ export function nostrLoginFeature(ctx) {
   // refuses a different account.
   function reconnectScreen() {
     const st = load();
-    const run = (makeSigner) => reconnectSigner(makeSigner).then(() => {
-      if (liveSigner()) { ui.nostrReconnect = null; render(); }
-    });
+    // 'upgrade': Amber by intent is live but can't read messages — offer
+    // only its NIP-46 door (nostrconnect), same account enforced
+    const upgrade = ui.nostrReconnect === 'upgrade';
+    const run = reconnectRun;
+    // straight to the link: the screen exists for this one door
+    if (upgrade && ui.nostrUpgradeStart) { ui.nostrUpgradeStart = false; ui.nostrConnectOpen = true; startNostrConnect(run); }
     return h('div', { class: 'col', style: 'gap:16px' },
       ctx.brandHeader(false),
       h('div', { class: 'card col', style: 'gap:12px' },
-        h('h3', { style: 'margin:0' }, t('nlReconnectTitle')),
-        h('p', { class: 'small muted', style: 'margin:0' }, t('nlReconnectBody', { npub: (npubOf(st.pubkey) || '').slice(0, 12) })),
-        signerButtons(run, { reconnectVia: reconnectViaOf(st) }),
+        h('h3', { style: 'margin:0' }, t(upgrade ? 'nlAmberUpgradeTitle' : 'nlReconnectTitle')),
+        h('p', { class: 'small muted', style: 'margin:0' }, upgrade ? t('nlAmberUpgradeBody') : t('nlReconnectBody', { npub: (npubOf(st.pubkey) || '').slice(0, 12) })),
+        upgrade ? nostrConnectSection(run) : signerButtons(run, { reconnectVia: reconnectViaOf(st) }),
         ui.nostrLoginError ? h('div', { class: 'notice err' }, ui.nostrLoginError) : null),
       h('button', { class: 'btn-ghost btn-block', onClick: () => {
         stopNostrConnect();
@@ -710,6 +728,17 @@ export function nostrLoginFeature(ctx) {
     // An action needed the login signer and it isn't there: open the
     // reconnect screen (and try the silent extension reattach in the
     // background — it closes the screen by itself when it lands).
+    // Messages found an Amber-by-intent login that can't decrypt: offer to
+    // reconnect the same account over NIP-46.
+    nostrSignerUpgrade() {
+      const st = load();
+      if (!st.pubkey) return false;
+      ui.nostrReconnect = 'upgrade';
+      ui.nostrUpgradeStart = true;
+      ui.nostrLoginError = '';
+      render();
+      return true;
+    },
     nostrReconnectPrompt() {
       const st = load();
       if (!st.pubkey || liveSigner()) return false;