decane-connect-kit 2.15.0 → 2.16.0

package/dist/index.cjs

@@ -3865,8 +3865,19 @@ async function createDecaneConnect(config) {
       rpName,
       prfSalt
     });
-    if (!prfOutput) throw new WebAuthnNotSupportedError();
-    const wrappingKey = await importAesKey(prfOutput);
+    let key = prfOutput;
+    if (!key) {
+      try {
+        key = await getPrfOutput({ rpId, credentialId, prfSalt });
+      } catch (e) {
+        console.warn(
+          "decane-connect-kit: the new credential did not return a PRF output; it cannot wrap the share.",
+          e
+        );
+      }
+    }
+    if (!key) throw new WebAuthnNotSupportedError();
+    const wrappingKey = await importAesKey(key);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
     const existing = await storage.getShare(userId);
@@ -4577,8 +4588,19 @@ async function createDecaneConnect(config) {
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
       const stored = await storage.getShare(auth.userId);
-      if (!stored) throw new NewDeviceError();
-      if (stored.unlockMethod === "passkey") return;
+      if (stored?.unlockMethod === "passkey") return;
+      if (!stored) {
+        if (!serverAssistedRecovery) throw new NewDeviceError();
+        const tee = new TeeClient(teeUrl);
+        const provisioned = await tee.provisionDeviceShare(auth.jwt);
+        if (!provisioned) throw new NewDeviceError();
+        try {
+          await registerPasskeyForDevice(auth.userId, auth.jwt, provisioned);
+        } finally {
+          zeroize(provisioned);
+        }
+        return;
+      }
       let deviceShare;
       try {
         deviceShare = await aesGcmDecrypt(