decane-connect-kit 2.18.0 → 2.19.0

package/dist/index.cjs

@@ -2167,8 +2167,14 @@ var ApiClient = class {
     return body.transactions;
   }
   // ── WebAuthn registration (additive to the PRF-only passkey flow) ─────────
-  async getWebAuthnRegisterOptions(jwt, rpId, rpName) {
-    return this._request(`/webauthn/register-options?rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}`, {
+  /**
+   * `label` is what the user's password manager will show for this passkey.
+   * Without one they see the account's opaque id. Sent, used, and forgotten —
+   * the backend echoes it into the options and stores nothing.
+   */
+  async getWebAuthnRegisterOptions(jwt, rpId, rpName, label) {
+    const query = `rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}` + (label ? `&label=${encodeURIComponent(label)}` : "");
+    return this._request(`/webauthn/register-options?${query}`, {
       headers: { Authorization: `Bearer ${jwt}` }
     });
   }
@@ -3052,7 +3058,12 @@ function bufFromBytes(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 async function registerWebAuthnCredential(opts) {
-  const baseOptions = await opts.api.getWebAuthnRegisterOptions(opts.jwt, opts.rpId, opts.rpName);
+  const baseOptions = await opts.api.getWebAuthnRegisterOptions(
+    opts.jwt,
+    opts.rpId,
+    opts.rpName,
+    opts.label
+  );
   if (opts.allowDuplicate) delete baseOptions.excludeCredentials;
   const optionsJSON = {
     ...baseOptions,
@@ -3858,12 +3869,14 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
+      const label = (await storage.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
         rpId,
         rpName,
         prfSalt,
+        ...label ? { label } : {},
         ...opts.allowDuplicate ? { allowDuplicate: true } : {}
       }));
     } catch (e) {