decane-connect-kit 2.3.0 → 2.4.0

package/dist/index.d.cts

@@ -175,6 +175,7 @@ declare class ApiClient {
     getAddresses(jwt: string): Promise<{
         evm: string | null;
         solana: string | null;
+        tron: string | null;
     }>;
     putShare(jwt: string, share: {
         ciphertext: Uint8Array;
@@ -182,6 +183,7 @@ declare class ApiClient {
         wrappedShareMeta: WrappedShareMeta;
         evmAddress: string;
         solanaAddress: string;
+        tronAddress: string;
     }): Promise<void>;
     getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
@@ -316,19 +318,18 @@ interface EthereumProviderOptions {
  * `signAuthorization` (EIP-7702) is wired only when the client exposes it — that
  * requires the TEE signer to support the authorization signing path.
  */
-declare function createEthereumProvider(client: DecaneConnect & {
-    signAuthorization?: (req: {
-        chainId: number;
-        address: string;
-        nonce: number;
-    }) => Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
-}, opts?: EthereumProviderOptions): Eip1193Provider;
+declare function createEthereumProvider(client: DecaneConnect, opts?: EthereumProviderOptions): Eip1193Provider;
 
-type Chain = `evm:${number}` | `solana:${'mainnet' | 'devnet'}`;
+interface SignedAuthorization {
+    chainId: number;
+    address: string;
+    nonce: number;
+    yParity: number;
+    r: string;
+    s: string;
+}
+
+type Chain = `evm:${number}` | `solana:${'mainnet' | 'devnet'}` | `tron:${'mainnet' | 'shasta' | 'nile'}`;
 interface DecaneConnectConfig {
     /** Dashboard project ID (public). Sent with every request so the backend can
      *  confirm the API key below actually belongs to this project. */
@@ -406,6 +407,7 @@ interface ConnectResult {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     };
     isNewUser: boolean;
 }
@@ -490,25 +492,40 @@ interface DecaneConnect {
         chainId?: number;
     }): Eip1193Provider;
     /**
-     * Sign an EIP-7702 authorization, delegating this EOA to `address` on
-     * `chainId`. Enables account-abstraction / sponsored-gas flows: pair the
-     * returned {yParity, r, s} into a type-4 transaction's authorizationList.
-     * Requires a TEE signer that supports the 7702 path.
+     * Sign an EIP-7702 authorization, delegating this EOA to a smart-account
+     * implementation contract on `chainId`. Enables account-abstraction /
+     * sponsored-gas flows. Returns the full viem `SignedAuthorization` tuple, so
+     * it drops straight into a userOperation's `authorization` field or a type-4
+     * transaction's authorizationList. `address` and `contractAddress` are
+     * interchangeable (the latter matches Privy's/older viem's param name).
      */
     signAuthorization(req: {
         chainId: number;
-        address: string;
+        address?: string;
+        contractAddress?: string;
         nonce: number;
-    }): Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
+    }): Promise<SignedAuthorization>;
+    /**
+     * The current session's access token (the Decane JWT). Use it to authenticate
+     * the user to your own backend (e.g. a sponsored-bundler proxy); verify it
+     * server-side against backend.decane.app/.well-known/jwks.json. Null with no
+     * live session.
+     */
+    getAccessToken(): string | null;
     signSolanaTransaction(tx: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Sign a Tron transaction. Pass the transaction's `raw_data_hex` (the value
+     * TronWeb puts on a built transaction). The enclave computes the txID
+     * (sha256(raw_data)) and signs it with the same secp256k1 key as the EVM
+     * wallet; returns the 65-byte recoverable signature as 0x-hex. Attach it to
+     * the transaction's `signature` array and broadcast via TronWeb / a full node.
+     */
+    signTronTransaction(rawDataHex: string): Promise<string>;
     disconnect(): Promise<void>;
     getAddresses(): {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     /**
      * Native-token balance for a chain (defaults to the first configured EVM
@@ -775,6 +792,7 @@ interface SocialAuthState {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     isNewUser: boolean;
     isUnlocked: boolean;
@@ -859,6 +877,7 @@ declare function useSocialAuth(): {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     sessionExpiresAt: number | null;
     canUsePasskey: boolean;
@@ -892,6 +911,7 @@ declare function useSocialWallet(): {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     sessionExpiresAt: number | null;
     needsReconnect: boolean;
@@ -912,6 +932,7 @@ declare function useSocialWallet(): {
         gasPrice?: bigint;
     }) => Promise<string>;
     signSolanaTransaction: (tx: Uint8Array) => Promise<Uint8Array<ArrayBufferLike>>;
+    signTronTransaction: (rawDataHex: string) => Promise<string>;
     signTypedData: (req: {
         chain: string;
         domain: Record<string, unknown>;
@@ -926,16 +947,14 @@ declare function useSocialWallet(): {
     }[]>;
     signAuthorization: (req: {
         chainId: number;
-        address: string;
+        address?: string;
+        contractAddress?: string;
         nonce: number;
-    }) => Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
+    }) => Promise<SignedAuthorization>;
     getEthereumProvider: (opts?: {
         chainId?: number;
     }) => Eip1193Provider;
+    getAccessToken: () => string | null;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;
@@ -1032,4 +1051,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SocialAuthState, type SocialConfig, SocialWalletModal, type Theme, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, type Theme, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.d.ts

@@ -175,6 +175,7 @@ declare class ApiClient {
     getAddresses(jwt: string): Promise<{
         evm: string | null;
         solana: string | null;
+        tron: string | null;
     }>;
     putShare(jwt: string, share: {
         ciphertext: Uint8Array;
@@ -182,6 +183,7 @@ declare class ApiClient {
         wrappedShareMeta: WrappedShareMeta;
         evmAddress: string;
         solanaAddress: string;
+        tronAddress: string;
     }): Promise<void>;
     getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
@@ -316,19 +318,18 @@ interface EthereumProviderOptions {
  * `signAuthorization` (EIP-7702) is wired only when the client exposes it — that
  * requires the TEE signer to support the authorization signing path.
  */
-declare function createEthereumProvider(client: DecaneConnect & {
-    signAuthorization?: (req: {
-        chainId: number;
-        address: string;
-        nonce: number;
-    }) => Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
-}, opts?: EthereumProviderOptions): Eip1193Provider;
+declare function createEthereumProvider(client: DecaneConnect, opts?: EthereumProviderOptions): Eip1193Provider;
 
-type Chain = `evm:${number}` | `solana:${'mainnet' | 'devnet'}`;
+interface SignedAuthorization {
+    chainId: number;
+    address: string;
+    nonce: number;
+    yParity: number;
+    r: string;
+    s: string;
+}
+
+type Chain = `evm:${number}` | `solana:${'mainnet' | 'devnet'}` | `tron:${'mainnet' | 'shasta' | 'nile'}`;
 interface DecaneConnectConfig {
     /** Dashboard project ID (public). Sent with every request so the backend can
      *  confirm the API key below actually belongs to this project. */
@@ -406,6 +407,7 @@ interface ConnectResult {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     };
     isNewUser: boolean;
 }
@@ -490,25 +492,40 @@ interface DecaneConnect {
         chainId?: number;
     }): Eip1193Provider;
     /**
-     * Sign an EIP-7702 authorization, delegating this EOA to `address` on
-     * `chainId`. Enables account-abstraction / sponsored-gas flows: pair the
-     * returned {yParity, r, s} into a type-4 transaction's authorizationList.
-     * Requires a TEE signer that supports the 7702 path.
+     * Sign an EIP-7702 authorization, delegating this EOA to a smart-account
+     * implementation contract on `chainId`. Enables account-abstraction /
+     * sponsored-gas flows. Returns the full viem `SignedAuthorization` tuple, so
+     * it drops straight into a userOperation's `authorization` field or a type-4
+     * transaction's authorizationList. `address` and `contractAddress` are
+     * interchangeable (the latter matches Privy's/older viem's param name).
      */
     signAuthorization(req: {
         chainId: number;
-        address: string;
+        address?: string;
+        contractAddress?: string;
         nonce: number;
-    }): Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
+    }): Promise<SignedAuthorization>;
+    /**
+     * The current session's access token (the Decane JWT). Use it to authenticate
+     * the user to your own backend (e.g. a sponsored-bundler proxy); verify it
+     * server-side against backend.decane.app/.well-known/jwks.json. Null with no
+     * live session.
+     */
+    getAccessToken(): string | null;
     signSolanaTransaction(tx: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Sign a Tron transaction. Pass the transaction's `raw_data_hex` (the value
+     * TronWeb puts on a built transaction). The enclave computes the txID
+     * (sha256(raw_data)) and signs it with the same secp256k1 key as the EVM
+     * wallet; returns the 65-byte recoverable signature as 0x-hex. Attach it to
+     * the transaction's `signature` array and broadcast via TronWeb / a full node.
+     */
+    signTronTransaction(rawDataHex: string): Promise<string>;
     disconnect(): Promise<void>;
     getAddresses(): {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     /**
      * Native-token balance for a chain (defaults to the first configured EVM
@@ -775,6 +792,7 @@ interface SocialAuthState {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     isNewUser: boolean;
     isUnlocked: boolean;
@@ -859,6 +877,7 @@ declare function useSocialAuth(): {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     sessionExpiresAt: number | null;
     canUsePasskey: boolean;
@@ -892,6 +911,7 @@ declare function useSocialWallet(): {
     addresses: {
         evm?: string;
         solana?: string;
+        tron?: string;
     } | null;
     sessionExpiresAt: number | null;
     needsReconnect: boolean;
@@ -912,6 +932,7 @@ declare function useSocialWallet(): {
         gasPrice?: bigint;
     }) => Promise<string>;
     signSolanaTransaction: (tx: Uint8Array) => Promise<Uint8Array<ArrayBufferLike>>;
+    signTronTransaction: (rawDataHex: string) => Promise<string>;
     signTypedData: (req: {
         chain: string;
         domain: Record<string, unknown>;
@@ -926,16 +947,14 @@ declare function useSocialWallet(): {
     }[]>;
     signAuthorization: (req: {
         chainId: number;
-        address: string;
+        address?: string;
+        contractAddress?: string;
         nonce: number;
-    }) => Promise<{
-        yParity: number;
-        r: string;
-        s: string;
-    }>;
+    }) => Promise<SignedAuthorization>;
     getEthereumProvider: (opts?: {
         chainId?: number;
     }) => Eip1193Provider;
+    getAccessToken: () => string | null;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;
@@ -1032,4 +1051,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SocialAuthState, type SocialConfig, SocialWalletModal, type Theme, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, type Theme, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.js

@@ -1892,7 +1892,7 @@ function createDecane(config) {
 
 // src/social/client.ts
 init_errors();
-import { Wallet } from "ethers";
+import { Wallet, sha256 as sha2562, encodeBase58 as encodeBase582 } from "ethers";
 import { Transaction as Transaction2, VersionedTransaction, Keypair } from "@solana/web3.js";
 
 // src/social/events.ts
@@ -1986,7 +1986,8 @@ var ApiClient = class {
         iv: bytesToB64(share.iv),
         wrappedShareMeta: btoa(JSON.stringify(share.wrappedShareMeta)),
         evmAddress: share.evmAddress,
-        solanaAddress: share.solanaAddress
+        solanaAddress: share.solanaAddress,
+        tronAddress: share.tronAddress
       })
     });
   }
@@ -2127,6 +2128,9 @@ var Storage = class {
   }
 };
 
+// src/social/session.ts
+import { sha256, encodeBase58 } from "ethers";
+
 // src/social/teeClient.ts
 import { startAuthentication } from "@simplewebauthn/browser";
 
@@ -2407,6 +2411,11 @@ var TeeClient = class {
 
 // src/social/session.ts
 init_errors();
+function evmToTronAddress(evmAddress) {
+  const hex41 = "41" + evmAddress.toLowerCase().replace(/^0x/, "");
+  const checksum = sha256(sha256("0x" + hex41)).slice(2, 10);
+  return encodeBase58("0x" + hex41 + checksum);
+}
 var SessionManager = class {
   constructor(events, durationMs, teeUrl, requireAssertionPerSignature = false) {
     this.events = events;
@@ -2416,6 +2425,7 @@ var SessionManager = class {
     this.tee = null;
     this.evmAddress = null;
     this.solanaAddress = null;
+    this.tronAddress = null;
     this.expiresAt = null;
     this.timeoutId = null;
   }
@@ -2442,6 +2452,7 @@ var SessionManager = class {
     this.tee.adoptHandle(handle, this.requireAssertionPerSignature);
     this.evmAddress = addresses.evm;
     this.solanaAddress = addresses.solana;
+    this.tronAddress = addresses.tron ?? evmToTronAddress(addresses.evm);
     this.expiresAt = expiresAtMs;
     this.setExpiryTimer(expiresAtMs - Date.now());
     this.events.emit("session-started");
@@ -2468,15 +2479,17 @@ var SessionManager = class {
         "requireAssertionPerSignature was requested but this signer does not support it \u2014 refusing to open a session with weaker authority than configured."
       );
     }
-    const addresses = verified ?? fallback;
-    if (!addresses) {
+    const resolved = verified ?? fallback;
+    if (!resolved) {
       this.tee = null;
       throw new Error(
         "No addresses available for this wallet \u2014 the signer could not derive them and none are recorded"
       );
     }
+    const addresses = { evm: resolved.evm, solana: resolved.solana, tron: resolved.tron ?? evmToTronAddress(resolved.evm) };
     this.evmAddress = addresses.evm;
     this.solanaAddress = addresses.solana;
+    this.tronAddress = addresses.tron;
     const serverTtlMs = this.tee.sessionExpiresIn();
     const effectiveMs = serverTtlMs != null ? Math.min(this.durationMs, serverTtlMs * 1e3) : this.durationMs;
     this.expiresAt = Date.now() + effectiveMs;
@@ -2493,6 +2506,7 @@ var SessionManager = class {
     this.tee = null;
     this.evmAddress = null;
     this.solanaAddress = null;
+    this.tronAddress = null;
     this.expiresAt = null;
     if (this.timeoutId) {
       clearTimeout(this.timeoutId);
@@ -2511,7 +2525,11 @@ var SessionManager = class {
   }
   addresses() {
     if (!this.evmAddress || !this.solanaAddress) return null;
-    return { evm: this.evmAddress, solana: this.solanaAddress };
+    return {
+      evm: this.evmAddress,
+      solana: this.solanaAddress,
+      tron: this.tronAddress ?? evmToTronAddress(this.evmAddress)
+    };
   }
 };
 
@@ -2714,7 +2732,7 @@ async function signEvmAuthorization(tee, chainId, address, nonce, jwt) {
   const r = "0x" + hex.slice(0, 64);
   const s = "0x" + hex.slice(64, 128);
   const v = parseInt(hex.slice(128, 130), 16);
-  return { yParity: v >= 27 ? v - 27 : v, r, s };
+  return { chainId, address, nonce, yParity: v >= 27 ? v - 27 : v, r, s };
 }
 async function signEvmTypedData(tee, chain, typedData, jwt) {
   const payload = JSON.stringify(
@@ -2875,9 +2893,6 @@ function createEthereumProvider(client, opts = {}) {
       }
       case "eth_signAuthorization":
       case "wallet_sign7702Authorization": {
-        if (!client.signAuthorization) {
-          throw Object.assign(new Error("EIP-7702 is not supported by the connected signer."), { code: 4200 });
-        }
         const p = params[0];
         const cid = p.chainId != null ? Number(asBigInt(p.chainId)) : chainId;
         const address = p.address ?? p.contractAddress;
@@ -3367,9 +3382,11 @@ async function createDecaneConnect(config) {
     let shareSet;
     let evmAddress;
     let solanaAddress;
+    let tronAddress;
     try {
       evmAddress = new Wallet(toHex2(master)).address;
       solanaAddress = Keypair.fromSeed(master).publicKey.toBase58();
+      tronAddress = evmToTronAddress2(evmAddress);
       shareSet = await splitMaster(master, 1);
     } finally {
       zeroize(master);
@@ -3400,10 +3417,11 @@ async function createDecaneConnect(config) {
         // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
       },
       evmAddress,
-      solanaAddress
+      solanaAddress,
+      tronAddress
     });
     zeroize(shareSet.server);
-    const addresses = { evm: evmAddress, solana: solanaAddress };
+    const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
       try {
         await api.putRecoveryBackup(jwt, {
@@ -3426,6 +3444,7 @@ async function createDecaneConnect(config) {
     }
     addresses.evm = evmAddress = confirmed.evm;
     addresses.solana = solanaAddress = confirmed.solana;
+    addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
     if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
       try {
         const choice = await config.onRecoveryShareOffer({ evmAddress, solanaAddress });
@@ -3449,7 +3468,7 @@ async function createDecaneConnect(config) {
   }
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
-    const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana } : null;
+    const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
     const stored = await storage.getShare(userId);
     let deviceShare;
     if (!stored) {
@@ -3531,7 +3550,7 @@ async function createDecaneConnect(config) {
       throw new ShareCorruptedError();
     }
     const rawAddresses = await api.getAddresses(result.jwt);
-    const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana } : null;
+    const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
     const addresses = await session.start(deviceShare, result.jwt, recordedAddresses);
     zeroize(deviceShare);
     auth = { jwt: result.jwt, userId, addresses };
@@ -3663,6 +3682,10 @@ async function createDecaneConnect(config) {
         const sig = await signSolanaMessage(tee, req.chain, msg, auth?.jwt);
         return bufferToB64u(sig);
       }
+      if (req.chain.startsWith("tron:")) {
+        const msg = typeof req.message === "string" ? req.message : new TextDecoder().decode(req.message);
+        return tee.sign({ chain: req.chain, kind: "message", payload: msg }, auth?.jwt);
+      }
       throw new CallSequenceError(`Unsupported chain: ${req.chain}`);
     },
     async sendTransaction(req) {
@@ -3731,7 +3754,16 @@ async function createDecaneConnect(config) {
     },
     async signAuthorization(req) {
       const tee = session.requireActive();
-      return signEvmAuthorization(tee, req.chainId, req.address, req.nonce, auth?.jwt);
+      const delegate = req.address ?? req.contractAddress;
+      if (!delegate) throw new CallSequenceError("signAuthorization requires `address` (the delegate contract).");
+      return signEvmAuthorization(tee, req.chainId, delegate, req.nonce, auth?.jwt);
+    },
+    // The current session's access token (the Decane JWT), for authenticating
+    // the user to your own backend — e.g. a sponsored-bundler proxy. Verify it
+    // server-side against https://backend.decane.app/.well-known/jwks.json.
+    // Null when there is no live session.
+    getAccessToken() {
+      return auth?.jwt ?? null;
     },
     getEthereumProvider(opts) {
       if (!ethProvider) {
@@ -3755,6 +3787,14 @@ async function createDecaneConnect(config) {
       const solChain = config.chains.find((c) => c.startsWith("solana:")) ?? "solana:mainnet";
       return signSolanaTransaction(tee, solChain, tx, auth?.jwt);
     },
+    async signTronTransaction(rawDataHex) {
+      const tee = session.requireActive();
+      const tronChain = config.chains.find((c) => c.startsWith("tron:")) ?? "tron:mainnet";
+      return tee.sign(
+        { chain: tronChain, kind: "transaction", payload: rawDataHex.replace(/^0x/, "") },
+        auth?.jwt
+      );
+    },
     async disconnect() {
       session.end();
       if (auth?.jwt) {
@@ -3910,12 +3950,19 @@ function b64uToBuffer(b64u) {
 function toHex2(bytes) {
   return "0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function evmToTronAddress2(evmAddress) {
+  const hex41 = "41" + evmAddress.toLowerCase().replace(/^0x/, "");
+  const checksum = sha2562(sha2562("0x" + hex41)).slice(2, 10);
+  return encodeBase582("0x" + hex41 + checksum);
+}
 async function deriveAddressesFromShares(a, b) {
   const master = await combineShares(a, b);
   try {
+    const evm = new Wallet(toHex2(master)).address;
     return {
-      evm: new Wallet(toHex2(master)).address,
-      solana: Keypair.fromSeed(master).publicKey.toBase58()
+      evm,
+      solana: Keypair.fromSeed(master).publicKey.toBase58(),
+      tron: evmToTronAddress2(evm)
     };
   } finally {
     zeroize(master);
@@ -5937,6 +5984,11 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.signSolanaTransaction(tx);
   }, []);
+  const socialSignTronTransaction = useCallback3(async (rawDataHex) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.signTronTransaction(rawDataHex);
+  }, []);
   const socialSignTypedData = useCallback3(async (req) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -5960,6 +6012,9 @@ function DecaneKit({ config, children }) {
     },
     []
   );
+  const socialGetAccessToken = useCallback3(() => {
+    return socialRef.current?.getAccessToken() ?? null;
+  }, []);
   const socialGetBalances = useCallback3(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -6024,6 +6079,8 @@ function DecaneKit({ config, children }) {
         socialGetBalances,
         socialGetEthereumProvider,
         socialSignAuthorization,
+        socialSignTronTransaction,
+        socialGetAccessToken,
         socialSignSolanaTransaction,
         socialSignTypedData,
         socialRotateShares,
@@ -6243,11 +6300,13 @@ function useSocialWallet() {
     socialSignMessage,
     socialSendTransaction,
     socialSignSolanaTransaction,
+    socialSignTronTransaction,
     socialSignTypedData,
     socialGetBalance,
     socialGetBalances,
     socialGetEthereumProvider,
     socialSignAuthorization,
+    socialGetAccessToken,
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
@@ -6284,6 +6343,10 @@ function useSocialWallet() {
     (tx) => run(() => socialSignSolanaTransaction(tx)),
     [socialSignSolanaTransaction]
   );
+  const signTronTransaction = useCallback4(
+    (rawDataHex) => run(() => socialSignTronTransaction(rawDataHex)),
+    [socialSignTronTransaction]
+  );
   const signTypedData = useCallback4(
     (req) => run(() => socialSignTypedData(req)),
     [socialSignTypedData]
@@ -6365,6 +6428,7 @@ function useSocialWallet() {
     signMessage,
     sendTransaction,
     signSolanaTransaction: signSolanaTransaction2,
+    signTronTransaction,
     signTypedData,
     // Balances (native token; read-only, works while locked)
     getBalance,
@@ -6373,6 +6437,9 @@ function useSocialWallet() {
     signAuthorization,
     // An EIP-1193 provider for viem/wagmi/ethers (memoized).
     getEthereumProvider: socialGetEthereumProvider,
+    // The Decane JWT — authenticate the user to your own backend (bundler proxy,
+    // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
+    getAccessToken: socialGetAccessToken,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,