decane-connect-kit 2.22.0 → 2.24.0

package/dist/index.cjs

@@ -37,6 +37,7 @@ __export(errors_exports, {
   CallSequenceError: () => CallSequenceError,
   DecaneConnectError: () => DecaneConnectError,
   ExportNotAuthorizedError: () => ExportNotAuthorizedError,
+  InvalidAccessTokenError: () => InvalidAccessTokenError,
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
@@ -59,7 +60,7 @@ __export(errors_exports, {
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -164,6 +165,11 @@ var init_errors = __esm({
         super("WRONG_UNLOCK_PASSWORD", "That password did not unlock this device");
       }
     };
+    InvalidAccessTokenError = class extends DecaneConnectError {
+      constructor(reason) {
+        super("INVALID_ACCESS_TOKEN", `That access token cannot open a session: ${reason}`);
+      }
+    };
     UnlockTokenRejectedError = class extends DecaneConnectError {
       constructor() {
         super("UNLOCK_TOKEN_REJECTED", "This device's unlock token is no longer valid \u2014 sign in normally to re-enable password unlock");
@@ -221,6 +227,7 @@ __export(index_exports, {
   DecaneMark: () => DecaneMark,
   DecaneWordmark: () => DecaneWordmark,
   ExportNotAuthorizedError: () => ExportNotAuthorizedError,
+  InvalidAccessTokenError: () => InvalidAccessTokenError,
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
@@ -2355,6 +2362,20 @@ function b64ToBytes(b644) {
   return Uint8Array.from(atob(b644), (c) => c.charCodeAt(0));
 }
 
+// src/social/accessToken.ts
+function decodeAccessToken(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    if (typeof json.uid !== "string" || json.uid === "") return null;
+    if (typeof json.exp !== "number" || !Number.isFinite(json.exp)) return null;
+    return { userId: json.uid, expiresAt: json.exp * 1e3 };
+  } catch {
+    return null;
+  }
+}
+
 // src/social/storage.ts
 var import_idb = require("idb");
 var DB_NAME = "decane-connect-kit";
@@ -3749,8 +3770,10 @@ async function createDecaneConnect(config) {
   const durationMs = (config.sessionDurationMinutes ?? DEFAULT_SESSION_MINUTES) * 6e4;
   const rpId = config.rpId ?? (typeof window !== "undefined" ? window.location.hostname : "localhost");
   const rpName = config.rpName ?? "Decane Connect";
-  const PERSIST_KEY = makePersistKey(config.apiKey);
-  const LAST_USER_KEY = makeLastUserKey(config.apiKey);
+  const PERSIST_KEY = makePersistKey(config.appId);
+  const LAST_USER_KEY = makeLastUserKey(config.appId);
+  const LEGACY_PERSIST_KEY = makePersistKey(config.apiKey);
+  const LEGACY_LAST_USER_KEY = makeLastUserKey(config.apiKey);
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
@@ -3763,9 +3786,17 @@ async function createDecaneConnect(config) {
   );
   let auth = null;
   let persisted = loadPersisted(PERSIST_KEY);
-  let lastUserId = loadLastUser(LAST_USER_KEY);
+  if (!persisted && LEGACY_PERSIST_KEY !== PERSIST_KEY) {
+    persisted = loadPersisted(LEGACY_PERSIST_KEY);
+    if (persisted) {
+      savePersisted(PERSIST_KEY, persisted);
+      clearPersisted(LEGACY_PERSIST_KEY);
+    }
+  }
+  let lastUserId = loadLastUser(LAST_USER_KEY) ?? (LEGACY_LAST_USER_KEY !== LAST_USER_KEY ? loadLastUser(LEGACY_LAST_USER_KEY) : null);
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
+  const deferDeviceProtection = config.deferDeviceProtection === true;
   const serverAssistedRecovery = true;
   const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
   const selfHealAttempted = /* @__PURE__ */ new Set();
@@ -3825,12 +3856,13 @@ async function createDecaneConnect(config) {
       })
     ]).finally(() => clearTimeout(timer));
   }
-  const SESSION_KEY = sessionPersistKey(config.apiKey);
+  const SESSION_KEY = sessionPersistKey(config.appId);
+  const LEGACY_SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
-    if (!persistSession) return;
+    if (!persistSession || !auth) return;
     const handle = session.getHandle();
-    const expiresAt = session.expiresAtTimestamp();
-    if (!handle || !auth || !expiresAt) return;
+    const expiresAt = handle ? session.expiresAtTimestamp() : decodeAccessToken(auth.jwt)?.expiresAt ?? null;
+    if (!expiresAt) return;
     saveSession(SESSION_KEY, {
       handle,
       jwt: auth.jwt,
@@ -3842,11 +3874,23 @@ async function createDecaneConnect(config) {
   function dropLiveSession() {
     clearSessionPersist(SESSION_KEY);
   }
+  let accessTokenExpiry = null;
+  function scheduleAccessTokenExpiry(jwt, expiresAt) {
+    if (accessTokenExpiry) clearTimeout(accessTokenExpiry);
+    accessTokenExpiry = setTimeout(() => {
+      accessTokenExpiry = null;
+      if (auth?.jwt !== jwt || session.isActive()) return;
+      auth = null;
+      dropLiveSession();
+      events.emit("session-expired");
+    }, Math.max(0, expiresAt - Date.now()));
+  }
   if (persistSession) {
-    const saved = loadSession(SESSION_KEY);
-    if (saved?.handle && saved.expiresAt > Date.now() + 5e3) {
+    const saved = loadSession(SESSION_KEY) ?? (LEGACY_SESSION_KEY !== SESSION_KEY ? loadSession(LEGACY_SESSION_KEY) : null);
+    if (saved && saved.expiresAt > Date.now() + 5e3) {
       try {
-        session.resume(saved.handle, saved.addresses, saved.expiresAt);
+        if (saved.handle) session.resume(saved.handle, saved.addresses, saved.expiresAt);
+        else scheduleAccessTokenExpiry(saved.jwt, saved.expiresAt);
         auth = { jwt: saved.jwt, userId: saved.userId, addresses: saved.addresses };
         persisted = { userId: saved.userId, addresses: saved.addresses };
       } catch {
@@ -3855,6 +3899,7 @@ async function createDecaneConnect(config) {
     } else if (saved) {
       dropLiveSession();
     }
+    if (LEGACY_SESSION_KEY !== SESSION_KEY) clearSessionPersist(LEGACY_SESSION_KEY);
   }
   events.on("session-expired", () => dropLiveSession());
   async function passwordSetup() {
@@ -4077,11 +4122,12 @@ async function createDecaneConnect(config) {
   }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
-    let unlockMethod;
-    let wrappingKey;
+    let unlockMethod = "password";
+    let wrappingKey = null;
     let meta = {};
     let unlockTokenKey = null;
-    if (isPasskeySupported()) {
+    if (deferDeviceProtection) {
+    } else if (isPasskeySupported()) {
       const prfSalt = generateRandomBytes(32);
       try {
         const { credentialId, prfOutput } = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
@@ -4122,32 +4168,37 @@ async function createDecaneConnect(config) {
     } finally {
       zeroize(master);
     }
-    const iv = generateRandomBytes(12);
-    const wrappedDeviceShare = await aesGcmEncrypt(
-      wrappingKey,
-      shareSet.device,
-      iv
-    );
-    await storage.putShare({
-      userId,
-      wrappedDeviceShare,
-      iv,
-      unlockMethod,
-      credentialId: meta.credentialId ? b64uToBuffer(meta.credentialId) : void 0,
-      prfSalt: meta.prfSalt ? b64uToBuffer(meta.prfSalt) : void 0,
-      pinSalt: meta.pinSalt ? b64uToBuffer(meta.pinSalt) : void 0,
-      pinIterations: meta.pinIterations,
-      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
-      passwordIterations: meta.passwordIterations,
-      version: 1
-    });
-    if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
+    let wrappedDeviceShare = null;
+    let iv = null;
+    if (wrappingKey) {
+      iv = generateRandomBytes(12);
+      wrappedDeviceShare = await aesGcmEncrypt(
+        wrappingKey,
+        shareSet.device,
+        iv
+      );
+      await storage.putShare({
+        userId,
+        wrappedDeviceShare,
+        iv,
+        unlockMethod,
+        credentialId: meta.credentialId ? b64uToBuffer(meta.credentialId) : void 0,
+        prfSalt: meta.prfSalt ? b64uToBuffer(meta.prfSalt) : void 0,
+        pinSalt: meta.pinSalt ? b64uToBuffer(meta.pinSalt) : void 0,
+        pinIterations: meta.pinIterations,
+        passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+        passwordIterations: meta.passwordIterations,
+        version: 1
+      });
+      if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
+    }
     const serverIv = generateRandomBytes(12);
     await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
       iv: serverIv,
       wrappedShareMeta: {
-        unlockMethod
+        // The server records this on the wallet_created event and nothing else.
+        unlockMethod: deferDeviceProtection ? "deferred" : unlockMethod
         // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
       },
       evmAddress,
@@ -4156,7 +4207,7 @@ async function createDecaneConnect(config) {
     }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
-    if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
+    if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt && wrappedDeviceShare && iv) {
       try {
         await api.putRecoveryBackup(jwt, {
           wrappedDeviceShare,
@@ -4239,7 +4290,7 @@ async function createDecaneConnect(config) {
           const tee = new TeeClient(teeUrl);
           const provisioned = await tee.provisionDeviceShare(jwt);
           if (provisioned) {
-            await persistProvisionedShare(userId, jwt, provisioned);
+            if (!deferDeviceProtection) await persistProvisionedShare(userId, jwt, provisioned);
             let addrs;
             try {
               addrs = await session.start(provisioned, jwt, recordedAddresses);
@@ -4283,7 +4334,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!await storage.getShare(userId) && isPasskeySupported()) {
+      if (!deferDeviceProtection && !await storage.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4566,6 +4617,27 @@ async function createDecaneConnect(config) {
       const result = await api.authExternal(token, opts?.providerId);
       return handleAuthResult(result);
     },
+    async connectWithAccessToken(token) {
+      const claims = decodeAccessToken(token);
+      if (!claims) throw new InvalidAccessTokenError("not a Decane access token");
+      if (claims.expiresAt <= Date.now() + 5e3) throw new InvalidAccessTokenError("it has expired");
+      const raw = await api.getAddresses(token);
+      if (!raw.evm || !raw.solana) throw new InvalidAccessTokenError("this account holds no wallet yet");
+      const addresses = { evm: raw.evm, solana: raw.solana, tron: raw.tron ?? evmToTronAddress2(raw.evm) };
+      if (session.isActive()) session.end();
+      auth = { jwt: token, userId: claims.userId, addresses };
+      persisted = { userId: claims.userId, addresses };
+      savePersisted(PERSIST_KEY, persisted);
+      events.emit("connected");
+      persistLiveSession();
+      scheduleAccessTokenExpiry(token, claims.expiresAt);
+      const stored = await storage.getShare(claims.userId);
+      return {
+        addresses,
+        isNewUser: false,
+        ...stored?.profile ? { profile: stored.profile } : {}
+      };
+    },
     async connectWithEmail(email) {
       await startEmailAuth(api, email);
       return { codeRequired: true };
@@ -4754,6 +4826,24 @@ async function createDecaneConnect(config) {
         zeroize(deviceShare);
       }
     },
+    async deviceProtected() {
+      if (!auth) return false;
+      return await storage.getShare(auth.userId) !== null;
+    },
+    async protectDevice() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (await storage.getShare(auth.userId)) return true;
+      if (!serverAssistedRecovery) throw new NewDeviceError();
+      const tee = new TeeClient(teeUrl);
+      const provisioned = await tee.provisionDeviceShare(auth.jwt);
+      if (!provisioned) throw new NewDeviceError();
+      try {
+        await persistProvisionedShare(auth.userId, auth.jwt, provisioned);
+      } finally {
+        zeroize(provisioned);
+      }
+      return await storage.getShare(auth.userId) !== null;
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -7376,6 +7466,7 @@ function DecaneKit({ config, children }) {
       chains,
       rpcUrls,
       requireAssertionPerSignature,
+      deferDeviceProtection,
       // Recovery callbacks. Forwarding these is what makes recovery
       // configurable at all from <DecaneKit>; before, they were silently
       // dropped and the headless client was constructed without them.
@@ -7396,6 +7487,7 @@ function DecaneKit({ config, children }) {
       promptPin,
       promptUnlockPassword,
       requireAssertionPerSignature,
+      deferDeviceProtection,
       offerRecoveryAtSignup,
       onRecoveryShareOffer,
       onRecoveryFileReady,
@@ -7531,6 +7623,18 @@ function DecaneKit({ config, children }) {
       throw e;
     }
   }, [clearPhase]);
+  const connectWithAccessToken = (0, import_react5.useCallback)(async (token) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    try {
+      const result = await sdk.connectWithAccessToken(token);
+      applyResult(result);
+      setSelectorOpen(false);
+    } catch (e) {
+      clearPhase();
+      throw e;
+    }
+  }, [clearPhase]);
   const customAuthConfig = config?.social?.customAuth;
   const connectWithCustomAuth = (0, import_react5.useCallback)(async () => {
     if (!customAuthConfig) throw new Error("Custom auth not configured");
@@ -7642,6 +7746,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.addPasskey();
   }, []);
+  const socialDeviceProtected = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) return false;
+    return sdk.deviceProtected();
+  }, []);
+  const socialProtectDevice = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.protectDevice();
+  }, []);
   const socialSetUnlockPassword = (0, import_react5.useCallback)(async (password) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -7713,6 +7827,7 @@ function DecaneKit({ config, children }) {
         connectWithPhone,
         verifyPhoneCode: verifyPhoneCode2,
         connectWithToken,
+        connectWithAccessToken,
         customAuthLabel: customAuthConfig?.label,
         connectWithCustomAuth: customAuthConfig ? connectWithCustomAuth : void 0,
         socialUnlock,
@@ -7734,6 +7849,8 @@ function DecaneKit({ config, children }) {
         socialHasRecoveryShare,
         socialHasPasskey,
         socialAddPasskey,
+        socialDeviceProtected,
+        socialProtectDevice,
         socialSetUnlockPassword,
         socialCanUnlockWithPassword,
         socialForgetLastUser,
@@ -7826,6 +7943,7 @@ function useSocialAuth() {
     connectWithPhone,
     verifyPhoneCode: verifyPhoneCode2,
     connectWithToken,
+    connectWithAccessToken,
     customAuthLabel,
     connectWithCustomAuth,
     signInWithPasskey: ctxSignInWithPasskey,
@@ -7934,6 +8052,18 @@ function useSocialAuth() {
       setTokenLoading(false);
     }
   }, [connectWithToken]);
+  const signInWithAccessToken = (0, import_react6.useCallback)(async (token) => {
+    setTokenLoading(true);
+    setError(null);
+    try {
+      await connectWithAccessToken(token);
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    } finally {
+      setTokenLoading(false);
+    }
+  }, [connectWithAccessToken]);
   const signInWithCustomAuth = (0, import_react6.useCallback)(async () => {
     if (!connectWithCustomAuth) throw new Error("Custom auth not configured");
     setCustomLoading(true);
@@ -8016,6 +8146,7 @@ function useSocialAuth() {
     sendPhoneCode,
     confirmPhoneCode,
     signInWithToken,
+    signInWithAccessToken,
     signInWithCustomAuth: connectWithCustomAuth ? signInWithCustomAuth : void 0,
     signInWithPasskey,
     unlock,
@@ -8044,6 +8175,8 @@ function useSocialWallet() {
     socialHasRecoveryShare,
     socialHasPasskey,
     socialAddPasskey,
+    socialDeviceProtected,
+    socialProtectDevice,
     socialSetUnlockPassword,
     socialCanUnlockWithPassword,
     socialForgetLastUser,
@@ -8146,6 +8279,16 @@ function useSocialWallet() {
       throw e;
     }
   }, [socialAddPasskey]);
+  const deviceProtected = (0, import_react6.useCallback)(() => run(() => socialDeviceProtected()), [socialDeviceProtected]);
+  const protectDevice = (0, import_react6.useCallback)(async () => {
+    setError(null);
+    try {
+      return await socialProtectDevice();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialProtectDevice]);
   const setUnlockPassword = (0, import_react6.useCallback)(async (password) => {
     setError(null);
     try {
@@ -8234,6 +8377,10 @@ function useSocialWallet() {
     // Passkey management for THIS device
     hasPasskey,
     addPasskey,
+    // Deferred protection (deferDeviceProtection): whether this device holds
+    // a wrapped share, and the call that stores one — passkey or password.
+    deviceProtected,
+    protectDevice,
     // "Unlock with your password": setUnlockPassword needs a live session;
     // canUnlockWithPassword and unlockWithPassword are the signed-out pair that
     // open one without an identity provider or a passkey.
@@ -8549,6 +8696,7 @@ function useSignTypedData() {
   DecaneMark,
   DecaneWordmark,
   ExportNotAuthorizedError,
+  InvalidAccessTokenError,
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,