decane-connect-kit 2.18.0 → 2.19.0

package/dist/index.d.cts

@@ -592,7 +592,12 @@ declare class ApiClient {
         metadata?: Record<string, unknown>;
     }): Promise<TransactionRecord>;
     getTransactions(jwt: string, limit?: number): Promise<TransactionRecord[]>;
-    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * `label` is what the user's password manager will show for this passkey.
+     * Without one they see the account's opaque id. Sent, used, and forgotten —
+     * the backend echoes it into the options and stores nothing.
+     */
+    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string, label?: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
     /**
      * Exchange a token from the developer's own auth system for a Decane

package/dist/index.d.ts

@@ -592,7 +592,12 @@ declare class ApiClient {
         metadata?: Record<string, unknown>;
     }): Promise<TransactionRecord>;
     getTransactions(jwt: string, limit?: number): Promise<TransactionRecord[]>;
-    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * `label` is what the user's password manager will show for this passkey.
+     * Without one they see the account's opaque id. Sent, used, and forgotten —
+     * the backend echoes it into the options and stores nothing.
+     */
+    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string, label?: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
     /**
      * Exchange a token from the developer's own auth system for a Decane

package/dist/index.js

@@ -2085,8 +2085,14 @@ var ApiClient = class {
     return body.transactions;
   }
   // ── WebAuthn registration (additive to the PRF-only passkey flow) ─────────
-  async getWebAuthnRegisterOptions(jwt, rpId, rpName) {
-    return this._request(`/webauthn/register-options?rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}`, {
+  /**
+   * `label` is what the user's password manager will show for this passkey.
+   * Without one they see the account's opaque id. Sent, used, and forgotten —
+   * the backend echoes it into the options and stores nothing.
+   */
+  async getWebAuthnRegisterOptions(jwt, rpId, rpName, label) {
+    const query = `rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}` + (label ? `&label=${encodeURIComponent(label)}` : "");
+    return this._request(`/webauthn/register-options?${query}`, {
       headers: { Authorization: `Bearer ${jwt}` }
     });
   }
@@ -2970,7 +2976,12 @@ function bufFromBytes(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 async function registerWebAuthnCredential(opts) {
-  const baseOptions = await opts.api.getWebAuthnRegisterOptions(opts.jwt, opts.rpId, opts.rpName);
+  const baseOptions = await opts.api.getWebAuthnRegisterOptions(
+    opts.jwt,
+    opts.rpId,
+    opts.rpName,
+    opts.label
+  );
   if (opts.allowDuplicate) delete baseOptions.excludeCredentials;
   const optionsJSON = {
     ...baseOptions,
@@ -3776,12 +3787,14 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
+      const label = (await storage.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
         rpId,
         rpName,
         prfSalt,
+        ...label ? { label } : {},
         ...opts.allowDuplicate ? { allowDuplicate: true } : {}
       }));
     } catch (e) {