decane-connect-kit 2.8.1 → 2.9.0

package/dist/index.d.cts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1284,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.d.ts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1284,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.js

@@ -3618,20 +3618,17 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
-    if (!isPasskeySupported()) return;
+  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    let credentialId;
-    let prfOutput;
-    try {
-      const result = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
-      credentialId = result.credentialId;
-      prfOutput = result.prfOutput;
-    } catch (e) {
-      console.warn("decane-connect-kit: passkey provisioning after recovery failed; user can set this up later.", e);
-      return;
-    }
-    if (!prfOutput) return;
+    const { credentialId, prfOutput } = await registerWebAuthnCredential({
+      api,
+      jwt,
+      rpId,
+      rpName,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3656,6 +3653,17 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) return;
+    try {
+      await registerPasskeyForDevice(userId, jwt, deviceShare);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: passkey provisioning failed; the user can set one up later with addPasskey().",
+        e
+      );
+    }
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4105,6 +4113,34 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    async hasPasskey() {
+      if (!auth) return false;
+      const stored = await storage.getShare(auth.userId);
+      return stored?.unlockMethod === "passkey";
+    },
+    async addPasskey() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      if (stored.unlockMethod === "passkey") return;
+      let deviceShare;
+      try {
+        deviceShare = await aesGcmDecrypt(
+          await getWrappingKey(stored),
+          stored.wrappedDeviceShare,
+          stored.iv
+        );
+      } catch (e) {
+        if (e instanceof DecaneConnectError) throw e;
+        throw new ShareCorruptedError();
+      }
+      try {
+        await registerPasskeyForDevice(auth.userId, auth.jwt, deviceShare);
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -6871,6 +6907,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.exportPortableBackup(opts);
   }, []);
+  const socialHasPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.hasPasskey();
+  }, []);
+  const socialAddPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.addPasskey();
+  }, []);
   const socialHasRecoveryShare = useCallback3(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -6932,6 +6978,8 @@ function DecaneKit({ config, children }) {
         socialRotateShares,
         socialExportPortableBackup,
         socialHasRecoveryShare,
+        socialHasPasskey,
+        socialAddPasskey,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7211,6 +7259,8 @@ function useSocialWallet() {
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
+    socialHasPasskey,
+    socialAddPasskey,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7298,6 +7348,16 @@ function useSocialWallet() {
     (opts) => run(() => socialExportPortableBackup(opts)),
     [socialExportPortableBackup]
   );
+  const hasPasskey = useCallback4(() => run(() => socialHasPasskey()), [socialHasPasskey]);
+  const addPasskey = useCallback4(async () => {
+    setError(null);
+    try {
+      await socialAddPasskey();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialAddPasskey]);
   const hasRecoveryShare = useCallback4(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7351,6 +7411,9 @@ function useSocialWallet() {
     // The Decane JWT — authenticate the user to your own backend (bundler proxy,
     // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
     getAccessToken: socialGetAccessToken,
+    // Passkey management for THIS device
+    hasPasskey,
+    addPasskey,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,