decane-connect-kit 2.8.0 → 2.9.0

package/dist/index.cjs

@@ -3694,20 +3694,17 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
-    if (!isPasskeySupported()) return;
+  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    let credentialId;
-    let prfOutput;
-    try {
-      const result = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
-      credentialId = result.credentialId;
-      prfOutput = result.prfOutput;
-    } catch (e) {
-      console.warn("decane-connect-kit: passkey provisioning after recovery failed; user can set this up later.", e);
-      return;
-    }
-    if (!prfOutput) return;
+    const { credentialId, prfOutput } = await registerWebAuthnCredential({
+      api,
+      jwt,
+      rpId,
+      rpName,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3732,6 +3729,17 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) return;
+    try {
+      await registerPasskeyForDevice(userId, jwt, deviceShare);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: passkey provisioning failed; the user can set one up later with addPasskey().",
+        e
+      );
+    }
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4181,6 +4189,34 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    async hasPasskey() {
+      if (!auth) return false;
+      const stored = await storage.getShare(auth.userId);
+      return stored?.unlockMethod === "passkey";
+    },
+    async addPasskey() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      if (stored.unlockMethod === "passkey") return;
+      let deviceShare;
+      try {
+        deviceShare = await aesGcmDecrypt(
+          await getWrappingKey(stored),
+          stored.wrappedDeviceShare,
+          stored.iv
+        );
+      } catch (e) {
+        if (e instanceof DecaneConnectError) throw e;
+        throw new ShareCorruptedError();
+      }
+      try {
+        await registerPasskeyForDevice(auth.userId, auth.jwt, deviceShare);
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -6940,6 +6976,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.exportPortableBackup(opts);
   }, []);
+  const socialHasPasskey = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.hasPasskey();
+  }, []);
+  const socialAddPasskey = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.addPasskey();
+  }, []);
   const socialHasRecoveryShare = (0, import_react5.useCallback)(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -7001,6 +7047,8 @@ function DecaneKit({ config, children }) {
         socialRotateShares,
         socialExportPortableBackup,
         socialHasRecoveryShare,
+        socialHasPasskey,
+        socialAddPasskey,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7079,6 +7127,7 @@ function useSocialAuth() {
   const {
     socialAuth,
     connectWithGoogle,
+    connectWithKingsChat,
     connectWithEmail,
     verifyEmailCode: verifyEmailCode2,
     connectWithPhone,
@@ -7091,6 +7140,7 @@ function useSocialAuth() {
     socialDisconnect
   } = useDecaneContext();
   const [googleLoading, setGoogleLoading] = (0, import_react6.useState)(false);
+  const [kingschatLoading, setKingschatLoading] = (0, import_react6.useState)(false);
   const [emailLoading, setEmailLoading] = (0, import_react6.useState)(false);
   const [phoneLoading, setPhoneLoading] = (0, import_react6.useState)(false);
   const [tokenLoading, setTokenLoading] = (0, import_react6.useState)(false);
@@ -7106,6 +7156,18 @@ function useSocialAuth() {
       setGoogleLoading(false);
     }
   }, [connectWithGoogle]);
+  const signInWithKingsChat = (0, import_react6.useCallback)(async () => {
+    setKingschatLoading(true);
+    setError(null);
+    try {
+      await connectWithKingsChat();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    } finally {
+      setKingschatLoading(false);
+    }
+  }, [connectWithKingsChat]);
   const sendEmailCode = (0, import_react6.useCallback)(async (email) => {
     setEmailLoading(true);
     setError(null);
@@ -7225,6 +7287,7 @@ function useSocialAuth() {
     // this into a real reconnect (signInWithGoogle / sendEmailCode), not unlock().
     needsReconnect: socialAuth.needsReconnect,
     googleLoading,
+    kingschatLoading,
     emailLoading,
     phoneLoading,
     tokenLoading,
@@ -7233,6 +7296,7 @@ function useSocialAuth() {
     error,
     clearError: () => setError(null),
     signInWithGoogle,
+    signInWithKingsChat,
     sendEmailCode,
     confirmEmailCode,
     sendPhoneCode,
@@ -7264,6 +7328,8 @@ function useSocialWallet() {
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
+    socialHasPasskey,
+    socialAddPasskey,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7351,6 +7417,16 @@ function useSocialWallet() {
     (opts) => run(() => socialExportPortableBackup(opts)),
     [socialExportPortableBackup]
   );
+  const hasPasskey = (0, import_react6.useCallback)(() => run(() => socialHasPasskey()), [socialHasPasskey]);
+  const addPasskey = (0, import_react6.useCallback)(async () => {
+    setError(null);
+    try {
+      await socialAddPasskey();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialAddPasskey]);
   const hasRecoveryShare = (0, import_react6.useCallback)(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7404,6 +7480,9 @@ function useSocialWallet() {
     // The Decane JWT — authenticate the user to your own backend (bundler proxy,
     // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
     getAccessToken: socialGetAccessToken,
+    // Passkey management for THIS device
+    hasPasskey,
+    addPasskey,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,