decane-connect-kit 2.10.0 → 2.12.0

package/dist/index.cjs

@@ -43,6 +43,7 @@ __export(errors_exports, {
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
+  PromptPasswordNotConfiguredError: () => PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
   ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
@@ -52,11 +53,13 @@ __export(errors_exports, {
   ShareCorruptedError: () => ShareCorruptedError,
   StaleDeviceShareError: () => StaleDeviceShareError,
   UnlockRequiredError: () => UnlockRequiredError,
+  UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
-  WrongPasswordError: () => WrongPasswordError
+  WrongPasswordError: () => WrongPasswordError,
+  WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -151,6 +154,21 @@ var init_errors = __esm({
         super("PROMPT_PIN_NOT_CONFIGURED", "Passkey unavailable and no promptPin callback was provided in config");
       }
     };
+    PromptPasswordNotConfiguredError = class extends DecaneConnectError {
+      constructor() {
+        super("PROMPT_PASSWORD_NOT_CONFIGURED", "This device unlocks with a password and no promptUnlockPassword callback was provided in config");
+      }
+    };
+    WrongUnlockPasswordError = class extends DecaneConnectError {
+      constructor() {
+        super("WRONG_UNLOCK_PASSWORD", "That password did not unlock this device");
+      }
+    };
+    UnlockTokenRejectedError = class extends DecaneConnectError {
+      constructor() {
+        super("UNLOCK_TOKEN_REJECTED", "This device's unlock token is no longer valid \u2014 sign in normally to re-enable password unlock");
+      }
+    };
     AttestationError = class extends DecaneConnectError {
       constructor(msg) {
         super("ATTESTATION_FAILED", msg);
@@ -206,9 +224,11 @@ __export(index_exports, {
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
+  MIN_PASSWORD_LENGTH: () => MIN_PASSWORD_LENGTH,
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
+  PromptPasswordNotConfiguredError: () => PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
   ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
@@ -219,10 +239,13 @@ __export(index_exports, {
   SocialWalletModal: () => SocialWalletModal,
   StaleDeviceShareError: () => StaleDeviceShareError,
   UnlockRequiredError: () => UnlockRequiredError,
+  UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
   WalletSelector: () => WalletSelector,
+  WeakPasswordError: () => WeakPasswordError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError,
+  WrongUnlockPasswordError: () => WrongUnlockPasswordError,
   createDecane: () => createDecane,
   createDecaneConnect: () => createDecaneConnect,
   createEthereumProvider: () => createEthereumProvider,
@@ -238,6 +261,7 @@ __export(index_exports, {
   useSocialBalance: () => useSocialBalance,
   useSocialWallet: () => useSocialWallet,
   useWalletSelector: () => useWalletSelector,
+  validateUnlockPassword: () => validateUnlockPassword,
   verifyEmailCode: () => verifyEmailCode
 });
 module.exports = __toCommonJS(index_exports);
@@ -2184,6 +2208,32 @@ var ApiClient = class {
       body: JSON.stringify({ userId, response, origin })
     });
   }
+  // ── Device unlock token (the "unlock with your password" credential) ──────
+  /**
+   * Issue this device an unlock token. Returned in the clear once and never
+   * again — the backend stores only its hash — so the caller must encrypt and
+   * persist it before the value is dropped.
+   */
+  async issueUnlockToken(jwt) {
+    return this._request("/auth/unlock-token", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
+  /** Redeem a decrypted unlock token for a session. */
+  async exchangeUnlockToken(token) {
+    return this._request("/auth/unlock-token/exchange", {
+      method: "POST",
+      body: JSON.stringify({ token })
+    });
+  }
+  /** Turn the password path off account-wide, so a lost device stops working. */
+  async revokeUnlockTokens(jwt) {
+    await this._request("/auth/unlock-token", {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   async revoke(jwt) {
     await this._request("/auth/revoke", {
       method: "POST",
@@ -2832,16 +2882,86 @@ async function aesGcmDecrypt(key, ciphertext, iv) {
   return new Uint8Array(pt);
 }
 
-// src/social/crypto/pin.ts
+// src/social/crypto/password.ts
 var PBKDF2_ITERATIONS = 6e5;
 function buf2(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
+var MIN_PASSWORD_LENGTH = 12;
+var TOO_PREDICTABLE = [
+  /^(.)\1+$/,
+  // one repeated character
+  /^0?123456789?0?1?2?$/,
+  // ascending runs
+  /^(?:password|passw0rd)/i,
+  /^(?:qwerty|azerty|asdfgh)/i,
+  /^(?:letmein|welcome|iloveyou|admin)/i
+];
+var WeakPasswordError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WeakPasswordError";
+  }
+};
+function validateUnlockPassword(password) {
+  if (typeof password !== "string" || password.length < MIN_PASSWORD_LENGTH) {
+    throw new WeakPasswordError(
+      `Password must be at least ${MIN_PASSWORD_LENGTH} characters`
+    );
+  }
+  if (/^\d+$/.test(password)) {
+    throw new WeakPasswordError("Password cannot be only digits \u2014 add letters or symbols");
+  }
+  if (/^\s|\s$/.test(password)) {
+    throw new WeakPasswordError("Password cannot start or end with a space");
+  }
+  if (TOO_PREDICTABLE.some((re) => re.test(password))) {
+    throw new WeakPasswordError("Password is too easy to guess \u2014 choose something less common");
+  }
+}
+async function derivePasswordKeys(password, salt) {
+  const base = await crypto.subtle.importKey(
+    "raw",
+    buf2(new TextEncoder().encode(password)),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const master = await crypto.subtle.deriveBits(
+    { name: "PBKDF2", salt: buf2(salt), iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    base,
+    256
+  );
+  const hkdfKey = await crypto.subtle.importKey("raw", master, "HKDF", false, ["deriveKey"]);
+  const expand = (label) => crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: buf2(salt),
+      info: buf2(new TextEncoder().encode(label))
+    },
+    hkdfKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+  const [shareKey, tokenKey] = await Promise.all([
+    expand("decane:unlock:share"),
+    expand("decane:unlock:token")
+  ]);
+  return { shareKey, tokenKey };
+}
+
+// src/social/crypto/pin.ts
+var PBKDF2_ITERATIONS2 = 6e5;
+function buf3(u) {
+  return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
+}
 async function deriveKeyFromPin(pin, salt) {
   const pinBytes = new TextEncoder().encode(pin);
-  const base = await crypto.subtle.importKey("raw", buf2(pinBytes), "PBKDF2", false, ["deriveKey"]);
+  const base = await crypto.subtle.importKey("raw", buf3(pinBytes), "PBKDF2", false, ["deriveKey"]);
   return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt: buf2(salt), iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    { name: "PBKDF2", salt: buf3(salt), iterations: PBKDF2_ITERATIONS2, hash: "SHA-256" },
     base,
     { name: "AES-GCM", length: 256 },
     false,
@@ -2858,7 +2978,7 @@ init_errors();
 function fromB64u(s) {
   return Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
 }
-function buf3(u) {
+function buf4(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 function isPasskeySupported() {
@@ -2889,7 +3009,7 @@ async function authenticateWithPasskey(opts) {
     ...opts.optionsJSON,
     extensions: {
       ...opts.optionsJSON.extensions,
-      prf: { eval: { first: buf3(opts.prfSalt) } }
+      prf: { eval: { first: buf4(opts.prfSalt) } }
     }
   };
   let response;
@@ -2913,11 +3033,11 @@ async function getPrfOutput(opts) {
   try {
     cred = await navigator.credentials.get({
       publicKey: {
-        challenge: buf3(challenge),
+        challenge: buf4(challenge),
         rpId: opts.rpId,
-        allowCredentials: [{ id: buf3(opts.credentialId), type: "public-key" }],
+        allowCredentials: [{ id: buf4(opts.credentialId), type: "public-key" }],
         userVerification: "required",
-        extensions: { prf: { eval: { first: buf3(opts.prfSalt) } } }
+        extensions: { prf: { eval: { first: buf4(opts.prfSalt) } } }
       }
     });
   } catch (e) {
@@ -3284,7 +3404,7 @@ async function fetchWrappedShareBackup(api, jwt) {
 
 // src/social/recovery/recoveryShareFile.ts
 init_errors();
-var PBKDF2_ITERATIONS2 = 6e5;
+var PBKDF2_ITERATIONS3 = 6e5;
 var FILE_VERSION = 2;
 function b642(u) {
   let s = "";
@@ -3294,7 +3414,7 @@ function b642(u) {
 function unb642(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
-function buf4(u) {
+function buf5(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 async function deriveFileKey(password, salt, iterations) {
@@ -3306,7 +3426,7 @@ async function deriveFileKey(password, salt, iterations) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt: buf4(salt), iterations, hash: "SHA-256" },
+    { name: "PBKDF2", salt: buf5(salt), iterations, hash: "SHA-256" },
     base,
     { name: "AES-GCM", length: 256 },
     false,
@@ -3321,16 +3441,16 @@ async function buildRecoveryShareFile(share, password, addresses, shareSetVersio
   }
   const salt = crypto.getRandomValues(new Uint8Array(16));
   const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await deriveFileKey(password, salt, PBKDF2_ITERATIONS2);
+  const key = await deriveFileKey(password, salt, PBKDF2_ITERATIONS3);
   const ct = new Uint8Array(
-    await crypto.subtle.encrypt({ name: "AES-GCM", iv: buf4(iv) }, key, buf4(share))
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv: buf5(iv) }, key, buf5(share))
   );
   return {
     version: FILE_VERSION,
     type: "decane-recovery-share",
     shareSetVersion,
     kdf: "pbkdf2-sha256",
-    kdfParams: { iterations: PBKDF2_ITERATIONS2, salt: b642(salt) },
+    kdfParams: { iterations: PBKDF2_ITERATIONS3, salt: b642(salt) },
     cipher: "aes-256-gcm",
     iv: b642(iv),
     ciphertext: b642(ct),
@@ -3361,7 +3481,7 @@ async function decryptRecoveryShareFile(file, password) {
   let share;
   try {
     share = new Uint8Array(
-      await crypto.subtle.decrypt({ name: "AES-GCM", iv: buf4(iv) }, key, buf4(ct))
+      await crypto.subtle.decrypt({ name: "AES-GCM", iv: buf5(iv) }, key, buf5(ct))
     );
   } catch {
     throw new WrongPasswordError();
@@ -3436,14 +3556,14 @@ async function recoverDeviceShare(input) {
 
 // src/social/recovery/portableBackup.ts
 init_errors();
-var PBKDF2_ITERATIONS3 = 6e5;
+var PBKDF2_ITERATIONS4 = 6e5;
 var FILE_VERSION2 = 1;
 function b643(u) {
   let s = "";
   for (const b of u) s += String.fromCharCode(b);
   return btoa(s);
 }
-function buf5(u) {
+function buf6(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 async function deriveFileKey2(password, salt, iterations) {
@@ -3455,7 +3575,7 @@ async function deriveFileKey2(password, salt, iterations) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt: buf5(salt), iterations, hash: "SHA-256" },
+    { name: "PBKDF2", salt: buf6(salt), iterations, hash: "SHA-256" },
     base,
     { name: "AES-GCM", length: 256 },
     false,
@@ -3475,16 +3595,16 @@ async function buildPortableBackup(deviceShare, recoveryShare, password, address
   );
   const salt = crypto.getRandomValues(new Uint8Array(16));
   const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await deriveFileKey2(password, salt, PBKDF2_ITERATIONS3);
+  const key = await deriveFileKey2(password, salt, PBKDF2_ITERATIONS4);
   const ct = new Uint8Array(
-    await crypto.subtle.encrypt({ name: "AES-GCM", iv: buf5(iv) }, key, buf5(plaintext))
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv: buf6(iv) }, key, buf6(plaintext))
   );
   return {
     version: FILE_VERSION2,
     type: "decane-portable-backup",
     shareSetVersion,
     kdf: "pbkdf2-sha256",
-    kdfParams: { iterations: PBKDF2_ITERATIONS3, salt: b643(salt) },
+    kdfParams: { iterations: PBKDF2_ITERATIONS4, salt: b643(salt) },
     cipher: "aes-256-gcm",
     iv: b643(iv),
     ciphertext: b643(ct),
@@ -3691,7 +3811,24 @@ async function createDecaneConnect(config) {
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
     await storage.putShare({ ...stored, wrappedDeviceShare, iv });
   }
+  function hasPasswordUnlock(stored) {
+    return !!stored && stored.unlockMethod === "password" && !!stored.passwordSalt && !!stored.wrappedUnlockToken && !!stored.unlockTokenIv;
+  }
+  async function passwordDeviceCandidate() {
+    if (persisted?.userId) {
+      const stored = await storage.getShare(persisted.userId);
+      return hasPasswordUnlock(stored) ? stored : null;
+    }
+    const candidates = (await storage.listShares()).filter(hasPasswordUnlock);
+    return candidates.length === 1 ? candidates[0] : null;
+  }
   async function getWrappingKey(stored) {
+    if (stored.unlockMethod === "password") {
+      if (!config.promptUnlockPassword) throw new PromptPasswordNotConfiguredError();
+      const password = await config.promptUnlockPassword({ kind: "unlock" });
+      const { shareKey } = await derivePasswordKeys(password, stored.passwordSalt);
+      return shareKey;
+    }
     if (stored.unlockMethod === "passkey") {
       const prfOutput = await getPrfOutput({
         rpId,
@@ -4041,6 +4178,16 @@ async function createDecaneConnect(config) {
     const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
+  async function rememberProfile(userId, profile) {
+    const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
+    if (!Object.keys(incoming).length) return;
+    try {
+      const stored = await storage.getShare(userId);
+      if (!stored) return;
+      await storage.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
+    } catch {
+    }
+  }
   function usablePasskeyShare(stored) {
     if (!stored || stored.unlockMethod !== "passkey") return null;
     if (!stored.credentialId || !stored.prfSalt) return null;
@@ -4078,7 +4225,11 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
-    return { addresses, isNewUser: false };
+    return {
+      addresses,
+      isNewUser: false,
+      ...stored.profile ? { profile: stored.profile } : {}
+    };
   }
   async function handleAuthResult(result) {
     let addresses;
@@ -4094,6 +4245,7 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
+    if (result.profile) await rememberProfile(result.userId, result.profile);
     return {
       addresses,
       isNewUser: result.isNewUser,
@@ -4207,6 +4359,127 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    /**
+     * Turn on "unlock with your password" for this device.
+     *
+     * Re-wraps the device share under the password and stores an unlock token
+     * encrypted beside it, replacing whatever wrapping was there. Requires a
+     * live session, because issuing the token needs a JWT.
+     *
+     * The share is only overwritten once the new ciphertext is in hand, so a
+     * failure part-way leaves the device exactly as it was rather than holding
+     * a share nothing can open.
+     */
+    async setUnlockPassword(password) {
+      if (!auth) throw new ReconnectRequiredError();
+      validateUnlockPassword(password);
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      const deviceShare = await aesGcmDecrypt(
+        await getWrappingKey(stored),
+        stored.wrappedDeviceShare,
+        stored.iv
+      );
+      try {
+        const passwordSalt = generateRandomBytes(16);
+        const { shareKey, tokenKey } = await derivePasswordKeys(password, passwordSalt);
+        const { token } = await api.issueUnlockToken(auth.jwt);
+        const unlockTokenIv = generateRandomBytes(12);
+        const wrappedUnlockToken = await aesGcmEncrypt(
+          tokenKey,
+          new TextEncoder().encode(token),
+          unlockTokenIv
+        );
+        const iv = generateRandomBytes(12);
+        const wrappedDeviceShare = await aesGcmEncrypt(shareKey, deviceShare, iv);
+        await storage.putShare({
+          ...stored,
+          unlockMethod: "password",
+          wrappedDeviceShare,
+          iv,
+          passwordSalt,
+          passwordIterations: PBKDF2_ITERATIONS,
+          wrappedUnlockToken,
+          unlockTokenIv,
+          // The old wrapping's metadata would otherwise sit there describing a
+          // key that no longer opens anything.
+          credentialId: void 0,
+          prfSalt: void 0,
+          pinSalt: void 0,
+          pinIterations: void 0
+        });
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
+    /** True when this device can open a session from a password alone. */
+    async canUnlockWithPassword() {
+      return await passwordDeviceCandidate() !== null;
+    },
+    /**
+     * Open a session from the password alone — no identity provider, no passkey.
+     *
+     * The password decrypts the unlock token, the token buys a JWT, and the
+     * same password unwraps the device share. Both halves come from one
+     * derivation, so one prompt does the whole job.
+     */
+    async unlockWithPassword(password) {
+      const stored = await passwordDeviceCandidate();
+      if (!stored) throw new NewDeviceError();
+      events.emit("wallet-unlocking");
+      const { shareKey, tokenKey } = await derivePasswordKeys(password, stored.passwordSalt);
+      let token;
+      try {
+        token = new TextDecoder().decode(
+          await aesGcmDecrypt(tokenKey, stored.wrappedUnlockToken, stored.unlockTokenIv)
+        );
+      } catch {
+        throw new WrongUnlockPasswordError();
+      }
+      let jwt;
+      try {
+        ({ jwt } = await api.exchangeUnlockToken(token));
+      } catch (e) {
+        if (e instanceof DecaneConnectError && e.code === "NETWORK") throw e;
+        throw new UnlockTokenRejectedError();
+      }
+      const deviceShare = await aesGcmDecrypt(shareKey, stored.wrappedDeviceShare, stored.iv);
+      const rawAddresses = await api.getAddresses(jwt);
+      const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? {
+        evm: rawAddresses.evm,
+        solana: rawAddresses.solana,
+        tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm)
+      } : null;
+      const addresses = await session.start(deviceShare, jwt, recordedAddresses);
+      zeroize(deviceShare);
+      auth = { jwt, userId: stored.userId, addresses };
+      persisted = { userId: stored.userId, addresses };
+      savePersisted(PERSIST_KEY, persisted);
+      events.emit("connected");
+      persistLiveSession();
+      return {
+        addresses,
+        isNewUser: false,
+        ...stored.profile ? { profile: stored.profile } : {}
+      };
+    },
+    /**
+     * Turn the password path off.
+     *
+     * Revokes the token account-wide first — that is what makes a lost device
+     * safe, and it must happen even if this device's local cleanup fails.
+     */
+    async removeUnlockPassword() {
+      if (!auth) throw new ReconnectRequiredError();
+      await api.revokeUnlockTokens(auth.jwt);
+      const stored = await storage.getShare(auth.userId);
+      if (!stored || stored.unlockMethod !== "password") return;
+      await storage.putShare({
+        ...stored,
+        wrappedUnlockToken: void 0,
+        unlockTokenIv: void 0
+      });
+    },
     async hasPasskey() {
       if (!auth) return false;
       const stored = await storage.getShare(auth.userId);
@@ -4550,8 +4823,8 @@ async function createDecaneConnect(config) {
   };
   return client;
 }
-function bufferToB64u(buf6) {
-  return btoa(String.fromCharCode(...buf6)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function bufferToB64u(buf7) {
+  return btoa(String.fromCharCode(...buf7)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function b64uToBuffer(b64u) {
   const b644 = b64u.replace(/-/g, "+").replace(/_/g, "/");
@@ -7008,6 +7281,26 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.addPasskey();
   }, []);
+  const socialSetUnlockPassword = (0, import_react5.useCallback)(async (password) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.setUnlockPassword(password);
+  }, []);
+  const socialCanUnlockWithPassword = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) return false;
+    return sdk.canUnlockWithPassword();
+  }, []);
+  const socialUnlockWithPassword = (0, import_react5.useCallback)(async (password) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    applyResult(await sdk.unlockWithPassword(password));
+  }, []);
+  const socialRemoveUnlockPassword = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.removeUnlockPassword();
+  }, []);
   const socialHasRecoveryShare = (0, import_react5.useCallback)(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -7071,6 +7364,10 @@ function DecaneKit({ config, children }) {
         socialHasRecoveryShare,
         socialHasPasskey,
         socialAddPasskey,
+        socialSetUnlockPassword,
+        socialCanUnlockWithPassword,
+        socialUnlockWithPassword,
+        socialRemoveUnlockPassword,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7300,6 +7597,11 @@ function useSocialAuth() {
     sessionExpiresAt: socialAuth.sessionExpiresAt,
     // True when this device can skip the full sign-in and resume with a passkey.
     canUsePasskey: socialAuth.canUsePasskey,
+    // Who the provider said the user is — { name?, email?, picture? }, or null.
+    // A passkey sign-in returns the profile recorded on this device when the
+    // user first signed in, so it carries the same name and email a Google
+    // sign-in does rather than coming back anonymous.
+    profile: socialAuth.profile,
     // Long-running work in progress, for driving your own status UI.
     phase: socialAuth.phase,
     isCreatingWallet: socialAuth.phase === "creating",
@@ -7352,6 +7654,10 @@ function useSocialWallet() {
     socialHasRecoveryShare,
     socialHasPasskey,
     socialAddPasskey,
+    socialSetUnlockPassword,
+    socialCanUnlockWithPassword,
+    socialUnlockWithPassword,
+    socialRemoveUnlockPassword,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7449,6 +7755,37 @@ function useSocialWallet() {
       throw e;
     }
   }, [socialAddPasskey]);
+  const setUnlockPassword = (0, import_react6.useCallback)(async (password) => {
+    setError(null);
+    try {
+      await socialSetUnlockPassword(password);
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialSetUnlockPassword]);
+  const canUnlockWithPassword = (0, import_react6.useCallback)(
+    () => socialCanUnlockWithPassword(),
+    [socialCanUnlockWithPassword]
+  );
+  const unlockWithPassword = (0, import_react6.useCallback)(async (password) => {
+    setError(null);
+    try {
+      await socialUnlockWithPassword(password);
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialUnlockWithPassword]);
+  const removeUnlockPassword = (0, import_react6.useCallback)(async () => {
+    setError(null);
+    try {
+      await socialRemoveUnlockPassword();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialRemoveUnlockPassword]);
   const hasRecoveryShare = (0, import_react6.useCallback)(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7505,6 +7842,13 @@ function useSocialWallet() {
     // Passkey management for THIS device
     hasPasskey,
     addPasskey,
+    // "Unlock with your password": setUnlockPassword needs a live session;
+    // canUnlockWithPassword and unlockWithPassword are the signed-out pair that
+    // open one without an identity provider or a passkey.
+    setUnlockPassword,
+    canUnlockWithPassword,
+    unlockWithPassword,
+    removeUnlockPassword,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,
@@ -7814,9 +8158,11 @@ function useSignTypedData() {
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,
+  MIN_PASSWORD_LENGTH,
   NetworkError,
   NewDeviceError,
   OriginNotAllowedError,
+  PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError,
   ProvisioningTimeoutError,
   ReconnectRequiredError,
@@ -7827,10 +8173,13 @@ function useSignTypedData() {
   SocialWalletModal,
   StaleDeviceShareError,
   UnlockRequiredError,
+  UnlockTokenRejectedError,
   UserCancelledError,
   WalletSelector,
+  WeakPasswordError,
   WebAuthnNotSupportedError,
   WrongPasswordError,
+  WrongUnlockPasswordError,
   createDecane,
   createDecaneConnect,
   createEthereumProvider,
@@ -7846,6 +8195,7 @@ function useSignTypedData() {
   useSocialBalance,
   useSocialWallet,
   useWalletSelector,
+  validateUnlockPassword,
   verifyEmailCode
 });
 //# sourceMappingURL=index.cjs.map