decane-connect-kit 2.8.1 → 2.9.1

package/dist/index.cjs

@@ -2291,14 +2291,15 @@ init_errors();
 
 // ../../infra/tee-measurement.json
 var tee_measurement_default = {
-  signerVersion: "0.1.3",
+  signerVersion: "0.2.10",
   acceptedMrtd: [
+    '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
     '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]'
   ],
-  primaryMrtd: '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
-  capturedAt: "2026-07-20T10:08:58.717Z",
+  primaryMrtd: '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
+  capturedAt: "2026-09-07T07:19:30.544601Z",
   tcbStatus: "UpToDate",
-  _note: "Captured from a live, signature-verified TDX quote (getCollateralAndVerify -> UpToDate) against decane-tee-signer v0.1.3 running on Phala Cloud CVM 786e714d-5042-4bf1-8060-0bc358f6a72f. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching the actual comparison logic in social/attestation.ts."
+  _note: "Captured from the live CVM 786e714d-5042-4bf1-8060-0bc358f6a72f (app_4405742df08d\u2026) after the 2026-09-07 credential recovery. RTMR0 changed; RTMR1-3 did not \u2014 RTMR3 is the app-compose measurement, so the app's identity is unchanged and this is a platform/firmware move underneath the CVM (Phala node v0.6.0), not a change to what we deploy. Sealing was verified intact across it (/signer/sealing-status: sealingAvailable, roundTripOk, ready), so no auth_shares were lost. The previous measurement is retained above so a rollback still verifies. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching social/attestation.ts."
 };
 
 // src/social/attestation.ts
@@ -3694,20 +3695,17 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
-    if (!isPasskeySupported()) return;
+  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    let credentialId;
-    let prfOutput;
-    try {
-      const result = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
-      credentialId = result.credentialId;
-      prfOutput = result.prfOutput;
-    } catch (e) {
-      console.warn("decane-connect-kit: passkey provisioning after recovery failed; user can set this up later.", e);
-      return;
-    }
-    if (!prfOutput) return;
+    const { credentialId, prfOutput } = await registerWebAuthnCredential({
+      api,
+      jwt,
+      rpId,
+      rpName,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3732,6 +3730,17 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) return;
+    try {
+      await registerPasskeyForDevice(userId, jwt, deviceShare);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: passkey provisioning failed; the user can set one up later with addPasskey().",
+        e
+      );
+    }
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4181,6 +4190,34 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    async hasPasskey() {
+      if (!auth) return false;
+      const stored = await storage.getShare(auth.userId);
+      return stored?.unlockMethod === "passkey";
+    },
+    async addPasskey() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      if (stored.unlockMethod === "passkey") return;
+      let deviceShare;
+      try {
+        deviceShare = await aesGcmDecrypt(
+          await getWrappingKey(stored),
+          stored.wrappedDeviceShare,
+          stored.iv
+        );
+      } catch (e) {
+        if (e instanceof DecaneConnectError) throw e;
+        throw new ShareCorruptedError();
+      }
+      try {
+        await registerPasskeyForDevice(auth.userId, auth.jwt, deviceShare);
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -6940,6 +6977,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.exportPortableBackup(opts);
   }, []);
+  const socialHasPasskey = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.hasPasskey();
+  }, []);
+  const socialAddPasskey = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.addPasskey();
+  }, []);
   const socialHasRecoveryShare = (0, import_react5.useCallback)(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -7001,6 +7048,8 @@ function DecaneKit({ config, children }) {
         socialRotateShares,
         socialExportPortableBackup,
         socialHasRecoveryShare,
+        socialHasPasskey,
+        socialAddPasskey,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7280,6 +7329,8 @@ function useSocialWallet() {
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
+    socialHasPasskey,
+    socialAddPasskey,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7367,6 +7418,16 @@ function useSocialWallet() {
     (opts) => run(() => socialExportPortableBackup(opts)),
     [socialExportPortableBackup]
   );
+  const hasPasskey = (0, import_react6.useCallback)(() => run(() => socialHasPasskey()), [socialHasPasskey]);
+  const addPasskey = (0, import_react6.useCallback)(async () => {
+    setError(null);
+    try {
+      await socialAddPasskey();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialAddPasskey]);
   const hasRecoveryShare = (0, import_react6.useCallback)(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7420,6 +7481,9 @@ function useSocialWallet() {
     // The Decane JWT — authenticate the user to your own backend (bundler proxy,
     // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
     getAccessToken: socialGetAccessToken,
+    // Passkey management for THIS device
+    hasPasskey,
+    addPasskey,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,