decane-connect-kit 2.8.0 → 2.9.0

package/dist/index.d.cts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1205,6 +1226,7 @@ declare function useSocialAuth(): {
     isCreatingWallet: boolean;
     needsReconnect: boolean;
     googleLoading: boolean;
+    kingschatLoading: boolean;
     emailLoading: boolean;
     phoneLoading: boolean;
     tokenLoading: boolean;
@@ -1213,6 +1235,7 @@ declare function useSocialAuth(): {
     error: string | null;
     clearError: () => void;
     signInWithGoogle: () => Promise<void>;
+    signInWithKingsChat: () => Promise<void>;
     sendEmailCode: (email: string) => Promise<{
         codeRequired: true;
     }>;
@@ -1282,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.d.ts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1205,6 +1226,7 @@ declare function useSocialAuth(): {
     isCreatingWallet: boolean;
     needsReconnect: boolean;
     googleLoading: boolean;
+    kingschatLoading: boolean;
     emailLoading: boolean;
     phoneLoading: boolean;
     tokenLoading: boolean;
@@ -1213,6 +1235,7 @@ declare function useSocialAuth(): {
     error: string | null;
     clearError: () => void;
     signInWithGoogle: () => Promise<void>;
+    signInWithKingsChat: () => Promise<void>;
     sendEmailCode: (email: string) => Promise<{
         codeRequired: true;
     }>;
@@ -1282,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.js

@@ -3618,20 +3618,17 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
-    if (!isPasskeySupported()) return;
+  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    let credentialId;
-    let prfOutput;
-    try {
-      const result = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
-      credentialId = result.credentialId;
-      prfOutput = result.prfOutput;
-    } catch (e) {
-      console.warn("decane-connect-kit: passkey provisioning after recovery failed; user can set this up later.", e);
-      return;
-    }
-    if (!prfOutput) return;
+    const { credentialId, prfOutput } = await registerWebAuthnCredential({
+      api,
+      jwt,
+      rpId,
+      rpName,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3656,6 +3653,17 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) return;
+    try {
+      await registerPasskeyForDevice(userId, jwt, deviceShare);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: passkey provisioning failed; the user can set one up later with addPasskey().",
+        e
+      );
+    }
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4105,6 +4113,34 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    async hasPasskey() {
+      if (!auth) return false;
+      const stored = await storage.getShare(auth.userId);
+      return stored?.unlockMethod === "passkey";
+    },
+    async addPasskey() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      if (stored.unlockMethod === "passkey") return;
+      let deviceShare;
+      try {
+        deviceShare = await aesGcmDecrypt(
+          await getWrappingKey(stored),
+          stored.wrappedDeviceShare,
+          stored.iv
+        );
+      } catch (e) {
+        if (e instanceof DecaneConnectError) throw e;
+        throw new ShareCorruptedError();
+      }
+      try {
+        await registerPasskeyForDevice(auth.userId, auth.jwt, deviceShare);
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -6871,6 +6907,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.exportPortableBackup(opts);
   }, []);
+  const socialHasPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.hasPasskey();
+  }, []);
+  const socialAddPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.addPasskey();
+  }, []);
   const socialHasRecoveryShare = useCallback3(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -6932,6 +6978,8 @@ function DecaneKit({ config, children }) {
         socialRotateShares,
         socialExportPortableBackup,
         socialHasRecoveryShare,
+        socialHasPasskey,
+        socialAddPasskey,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7010,6 +7058,7 @@ function useSocialAuth() {
   const {
     socialAuth,
     connectWithGoogle,
+    connectWithKingsChat,
     connectWithEmail,
     verifyEmailCode: verifyEmailCode2,
     connectWithPhone,
@@ -7022,6 +7071,7 @@ function useSocialAuth() {
     socialDisconnect
   } = useDecaneContext();
   const [googleLoading, setGoogleLoading] = useState4(false);
+  const [kingschatLoading, setKingschatLoading] = useState4(false);
   const [emailLoading, setEmailLoading] = useState4(false);
   const [phoneLoading, setPhoneLoading] = useState4(false);
   const [tokenLoading, setTokenLoading] = useState4(false);
@@ -7037,6 +7087,18 @@ function useSocialAuth() {
       setGoogleLoading(false);
     }
   }, [connectWithGoogle]);
+  const signInWithKingsChat = useCallback4(async () => {
+    setKingschatLoading(true);
+    setError(null);
+    try {
+      await connectWithKingsChat();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    } finally {
+      setKingschatLoading(false);
+    }
+  }, [connectWithKingsChat]);
   const sendEmailCode = useCallback4(async (email) => {
     setEmailLoading(true);
     setError(null);
@@ -7156,6 +7218,7 @@ function useSocialAuth() {
     // this into a real reconnect (signInWithGoogle / sendEmailCode), not unlock().
     needsReconnect: socialAuth.needsReconnect,
     googleLoading,
+    kingschatLoading,
     emailLoading,
     phoneLoading,
     tokenLoading,
@@ -7164,6 +7227,7 @@ function useSocialAuth() {
     error,
     clearError: () => setError(null),
     signInWithGoogle,
+    signInWithKingsChat,
     sendEmailCode,
     confirmEmailCode,
     sendPhoneCode,
@@ -7195,6 +7259,8 @@ function useSocialWallet() {
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
+    socialHasPasskey,
+    socialAddPasskey,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7282,6 +7348,16 @@ function useSocialWallet() {
     (opts) => run(() => socialExportPortableBackup(opts)),
     [socialExportPortableBackup]
   );
+  const hasPasskey = useCallback4(() => run(() => socialHasPasskey()), [socialHasPasskey]);
+  const addPasskey = useCallback4(async () => {
+    setError(null);
+    try {
+      await socialAddPasskey();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialAddPasskey]);
   const hasRecoveryShare = useCallback4(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7335,6 +7411,9 @@ function useSocialWallet() {
     // The Decane JWT — authenticate the user to your own backend (bundler proxy,
     // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
     getAccessToken: socialGetAccessToken,
+    // Passkey management for THIS device
+    hasPasskey,
+    addPasskey,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,