decane-connect-kit 2.8.1 → 2.9.1

package/dist/index.d.cts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1284,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.d.ts

@@ -357,6 +357,26 @@ interface DecaneConnect {
      * yourself. Throws NewDeviceError when this device isn't eligible.
      */
     signInWithPasskey(): Promise<ConnectResult>;
+    /** Whether THIS device's share is wrapped by a passkey rather than a PIN. */
+    hasPasskey(): Promise<boolean>;
+    /**
+     * Add a passkey to this device after the fact, re-wrapping its device share
+     * under it.
+     *
+     * For the device that fell back to a PIN because no passkey was reachable at
+     * the time — a password manager that was not signed in, a browser without
+     * WebAuthn PRF, a prompt the user dismissed. Without this the fallback is
+     * permanent: once a PIN-wrapped share exists, nothing in the normal unlock
+     * path ever offers a passkey again, however available they later become.
+     *
+     * Prompts for the current PIN (through `promptPin`) to unwrap the share, then
+     * asks for the new credential. Idempotent when a passkey is already in place.
+     * Requires a live session; throws `WebAuthnNotSupportedError` where passkeys
+     * are unavailable, and `NewDeviceError` when this device holds no share yet
+     * (that case wants `connect()`, which provisions one and registers a passkey
+     * on the way).
+     */
+    addPasskey(): Promise<void>;
     sessionExpiresAt(): number | null;
     signMessage(req: SignMessageRequest): Promise<string>;
     sendTransaction(req: SendTransactionRequest): Promise<string>;
@@ -477,7 +497,8 @@ interface WrappedShareMeta {
  * after a page reload.
  *
  * Every field is optional because providers differ in what they release, and a
- * user can withhold most of it. Email sign-in returns an empty profile.
+ * user can withhold most of it. Email sign-in returns a profile carrying just
+ * the `email` the user signed in with; phone sign-in returns no profile.
  */
 interface AuthProfile {
     name?: string;
@@ -1284,6 +1305,8 @@ declare function useSocialWallet(): {
         chainId?: number;
     }) => Eip1193Provider;
     getAccessToken: () => string | null;
+    hasPasskey: () => Promise<boolean>;
+    addPasskey: () => Promise<void>;
     rotateShares: (opts: {
         password: string;
         passwordHint?: string;

package/dist/index.js

@@ -2215,14 +2215,15 @@ import { getCollateralAndVerify } from "@phala/dcap-qvl";
 
 // ../../infra/tee-measurement.json
 var tee_measurement_default = {
-  signerVersion: "0.1.3",
+  signerVersion: "0.2.10",
   acceptedMrtd: [
+    '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
     '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]'
   ],
-  primaryMrtd: '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
-  capturedAt: "2026-07-20T10:08:58.717Z",
+  primaryMrtd: '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
+  capturedAt: "2026-09-07T07:19:30.544601Z",
   tcbStatus: "UpToDate",
-  _note: "Captured from a live, signature-verified TDX quote (getCollateralAndVerify -> UpToDate) against decane-tee-signer v0.1.3 running on Phala Cloud CVM 786e714d-5042-4bf1-8060-0bc358f6a72f. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching the actual comparison logic in social/attestation.ts."
+  _note: "Captured from the live CVM 786e714d-5042-4bf1-8060-0bc358f6a72f (app_4405742df08d\u2026) after the 2026-09-07 credential recovery. RTMR0 changed; RTMR1-3 did not \u2014 RTMR3 is the app-compose measurement, so the app's identity is unchanged and this is a platform/firmware move underneath the CVM (Phala node v0.6.0), not a change to what we deploy. Sealing was verified intact across it (/signer/sealing-status: sealingAvailable, roundTripOk, ready), so no auth_shares were lost. The previous measurement is retained above so a rollback still verifies. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching social/attestation.ts."
 };
 
 // src/social/attestation.ts
@@ -3618,20 +3619,17 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
-    if (!isPasskeySupported()) return;
+  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    let credentialId;
-    let prfOutput;
-    try {
-      const result = await registerWebAuthnCredential({ api, jwt, rpId, rpName, prfSalt });
-      credentialId = result.credentialId;
-      prfOutput = result.prfOutput;
-    } catch (e) {
-      console.warn("decane-connect-kit: passkey provisioning after recovery failed; user can set this up later.", e);
-      return;
-    }
-    if (!prfOutput) return;
+    const { credentialId, prfOutput } = await registerWebAuthnCredential({
+      api,
+      jwt,
+      rpId,
+      rpName,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3656,6 +3654,17 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
+    if (!isPasskeySupported()) return;
+    try {
+      await registerPasskeyForDevice(userId, jwt, deviceShare);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: passkey provisioning failed; the user can set one up later with addPasskey().",
+        e
+      );
+    }
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4105,6 +4114,34 @@ async function createDecaneConnect(config) {
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
+    async hasPasskey() {
+      if (!auth) return false;
+      const stored = await storage.getShare(auth.userId);
+      return stored?.unlockMethod === "passkey";
+    },
+    async addPasskey() {
+      if (!auth) throw new ReconnectRequiredError();
+      if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
+      const stored = await storage.getShare(auth.userId);
+      if (!stored) throw new NewDeviceError();
+      if (stored.unlockMethod === "passkey") return;
+      let deviceShare;
+      try {
+        deviceShare = await aesGcmDecrypt(
+          await getWrappingKey(stored),
+          stored.wrappedDeviceShare,
+          stored.iv
+        );
+      } catch (e) {
+        if (e instanceof DecaneConnectError) throw e;
+        throw new ShareCorruptedError();
+      }
+      try {
+        await registerPasskeyForDevice(auth.userId, auth.jwt, deviceShare);
+      } finally {
+        zeroize(deviceShare);
+      }
+    },
     async unlock() {
       if (!auth) {
         const candidate = await passkeyLoginCandidate();
@@ -6871,6 +6908,16 @@ function DecaneKit({ config, children }) {
     if (!sdk) throw new Error("Social wallet not connected");
     return sdk.exportPortableBackup(opts);
   }, []);
+  const socialHasPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.hasPasskey();
+  }, []);
+  const socialAddPasskey = useCallback3(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social wallet not connected");
+    return sdk.addPasskey();
+  }, []);
   const socialHasRecoveryShare = useCallback3(async () => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social wallet not connected");
@@ -6932,6 +6979,8 @@ function DecaneKit({ config, children }) {
         socialRotateShares,
         socialExportPortableBackup,
         socialHasRecoveryShare,
+        socialHasPasskey,
+        socialAddPasskey,
         socialShouldPromptRecovery,
         socialDismissRecoveryPrompt,
         socialModalOpen,
@@ -7211,6 +7260,8 @@ function useSocialWallet() {
     socialRotateShares,
     socialExportPortableBackup,
     socialHasRecoveryShare,
+    socialHasPasskey,
+    socialAddPasskey,
     socialShouldPromptRecovery,
     socialDismissRecoveryPrompt,
     openSocialModal,
@@ -7298,6 +7349,16 @@ function useSocialWallet() {
     (opts) => run(() => socialExportPortableBackup(opts)),
     [socialExportPortableBackup]
   );
+  const hasPasskey = useCallback4(() => run(() => socialHasPasskey()), [socialHasPasskey]);
+  const addPasskey = useCallback4(async () => {
+    setError(null);
+    try {
+      await socialAddPasskey();
+    } catch (e) {
+      setError(e.message);
+      throw e;
+    }
+  }, [socialAddPasskey]);
   const hasRecoveryShare = useCallback4(
     () => run(() => socialHasRecoveryShare()),
     [socialHasRecoveryShare]
@@ -7351,6 +7412,9 @@ function useSocialWallet() {
     // The Decane JWT — authenticate the user to your own backend (bundler proxy,
     // etc.); verify server-side against backend.decane.app/.well-known/jwks.json.
     getAccessToken: socialGetAccessToken,
+    // Passkey management for THIS device
+    hasPasskey,
+    addPasskey,
     // Recovery (2-of-3 Shamir share set)
     rotateShares,
     exportPortableBackup,