decane-connect-kit 2.12.0 → 2.13.0

package/dist/index.d.cts

@@ -506,11 +506,13 @@ interface DecaneConnect {
     off(event: SdkEvent, handler: (...args: unknown[]) => void): void;
 }
 interface WrappedShareMeta {
-    unlockMethod: 'passkey' | 'pin';
+    unlockMethod: 'passkey' | 'pin' | 'password';
     credentialId?: string;
     prfSalt?: string;
     pinSalt?: string;
     pinIterations?: number;
+    passwordSalt?: string;
+    passwordIterations?: number;
 }
 /**
  * Who the user is, as the identity provider just described them.
@@ -755,6 +757,17 @@ interface SocialConfig {
      */
     kingsChatScopes?: string[];
     promptPin?: () => Promise<string>;
+    /**
+     * Called when the SDK needs the device unlock password — to choose one
+     * (`kind: 'set'`, ask twice) or to enter it (`kind: 'unlock'`).
+     *
+     * Required on any device using "unlock with your password". Unlike promptPin,
+     * this secret can open a session on its own, so never log or persist it and
+     * let a password manager fill it.
+     */
+    promptUnlockPassword?: (ctx: {
+        kind: 'set' | 'unlock';
+    }) => Promise<string>;
     apiBaseUrl?: string;
     chains?: string[];
     rpcUrls?: Record<string, string>;

package/dist/index.d.ts

@@ -506,11 +506,13 @@ interface DecaneConnect {
     off(event: SdkEvent, handler: (...args: unknown[]) => void): void;
 }
 interface WrappedShareMeta {
-    unlockMethod: 'passkey' | 'pin';
+    unlockMethod: 'passkey' | 'pin' | 'password';
     credentialId?: string;
     prfSalt?: string;
     pinSalt?: string;
     pinIterations?: number;
+    passwordSalt?: string;
+    passwordIterations?: number;
 }
 /**
  * Who the user is, as the identity provider just described them.
@@ -755,6 +757,17 @@ interface SocialConfig {
      */
     kingsChatScopes?: string[];
     promptPin?: () => Promise<string>;
+    /**
+     * Called when the SDK needs the device unlock password — to choose one
+     * (`kind: 'set'`, ask twice) or to enter it (`kind: 'unlock'`).
+     *
+     * Required on any device using "unlock with your password". Unlike promptPin,
+     * this secret can open a session on its own, so never log or persist it and
+     * let a password manager fill it.
+     */
+    promptUnlockPassword?: (ctx: {
+        kind: 'set' | 'unlock';
+    }) => Promise<string>;
     apiBaseUrl?: string;
     chains?: string[];
     rpcUrls?: Record<string, string>;

package/dist/index.js

@@ -2886,9 +2886,6 @@ async function deriveKeyFromPin(pin, salt) {
     ["encrypt", "decrypt"]
   );
 }
-function validatePin(pin) {
-  if (!/^\d{4,8}$/.test(pin)) throw new Error("PIN must be 4\u20138 digits");
-}
 
 // src/social/crypto/passkey.ts
 init_errors();
@@ -3702,21 +3699,38 @@ async function createDecaneConnect(config) {
     }
   }
   events.on("session-expired", () => dropLiveSession());
-  async function pinSetup() {
-    if (!config.promptPin) throw new PromptPinNotConfiguredError();
-    const pin = await config.promptPin();
-    validatePin(pin);
-    const pinSalt = generateRandomBytes(32);
-    const wrappingKey = await deriveKeyFromPin(pin, pinSalt);
+  async function passwordSetup() {
+    if (!config.promptUnlockPassword) throw new PromptPasswordNotConfiguredError();
+    const password = await config.promptUnlockPassword({ kind: "set" });
+    validateUnlockPassword(password);
+    const passwordSalt = generateRandomBytes(32);
+    const { shareKey, tokenKey } = await derivePasswordKeys(password, passwordSalt);
     return {
-      wrappingKey,
+      wrappingKey: shareKey,
+      tokenKey,
       meta: {
-        unlockMethod: "pin",
-        pinSalt: bufferToB64u(pinSalt),
-        pinIterations: 6e5
+        unlockMethod: "password",
+        passwordSalt: bufferToB64u(passwordSalt),
+        passwordIterations: PBKDF2_ITERATIONS
       }
     };
   }
+  async function attachUnlockToken(userId, jwt, tokenKey) {
+    try {
+      const stored = await storage.getShare(userId);
+      if (!stored) return;
+      const { token } = await api.issueUnlockToken(jwt);
+      const unlockTokenIv = generateRandomBytes(12);
+      const wrappedUnlockToken = await aesGcmEncrypt(
+        tokenKey,
+        new TextEncoder().encode(token),
+        unlockTokenIv
+      );
+      await storage.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+    } catch (e) {
+      console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
+    }
+  }
   async function persistRotatedDeviceShare(userId, deviceShare) {
     const stored = await storage.getShare(userId);
     if (!stored) {
@@ -3810,6 +3824,7 @@ async function createDecaneConnect(config) {
     let unlockMethod;
     let wrappingKey;
     let meta = {};
+    let unlockTokenKey = null;
     if (isPasskeySupported()) {
       const prfSalt = generateRandomBytes(32);
       try {
@@ -3823,18 +3838,18 @@ async function createDecaneConnect(config) {
             prfSalt: bufferToB64u(prfSalt)
           };
         } else {
-          ({ wrappingKey, meta } = await pinSetup());
-          unlockMethod = "pin";
+          ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+          unlockMethod = "password";
         }
       } catch (e) {
         if (e.name === "UserCancelledError")
           throw new UserCancelledError();
-        ({ wrappingKey, meta } = await pinSetup());
-        unlockMethod = "pin";
+        ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+        unlockMethod = "password";
       }
     } else {
-      ({ wrappingKey, meta } = await pinSetup());
-      unlockMethod = "pin";
+      ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+      unlockMethod = "password";
     }
     const provisioningStartedAt = Date.now();
     const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
@@ -3866,8 +3881,11 @@ async function createDecaneConnect(config) {
       prfSalt: meta.prfSalt ? b64uToBuffer(meta.prfSalt) : void 0,
       pinSalt: meta.pinSalt ? b64uToBuffer(meta.pinSalt) : void 0,
       pinIterations: meta.pinIterations,
+      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+      passwordIterations: meta.passwordIterations,
       version: 1
     });
+    if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
     const serverIv = generateRandomBytes(12);
     await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
@@ -6943,6 +6961,7 @@ function DecaneKit({ config, children }) {
       apiKey,
       authMethods,
       promptPin,
+      promptUnlockPassword,
       apiBaseUrl,
       chains,
       rpcUrls,
@@ -6965,6 +6984,7 @@ function DecaneKit({ config, children }) {
       chains: chains ?? ["evm:1", "solana:mainnet"],
       rpcUrls,
       promptPin,
+      promptUnlockPassword,
       requireAssertionPerSignature,
       offerRecoveryAtSignup,
       onRecoveryShareOffer,