decane-connect-kit 2.9.0 → 2.10.0

package/dist/index.cjs

@@ -2271,6 +2271,15 @@ var Storage = class {
   async getShare(userId) {
     return (await this._db).get(STORE, userId) ?? null;
   }
+  /**
+   * Every share this browser holds. Needed because signing out clears the
+   * remembered identity while deliberately leaving the share behind, so the
+   * userId that keys it is no longer known and the share can only be found by
+   * enumeration. See passkeyDeviceCandidate().
+   */
+  async listShares() {
+    return (await this._db).getAll(STORE);
+  }
   async putShare(share) {
     await (await this._db).put(STORE, share);
   }
@@ -2291,14 +2300,15 @@ init_errors();
 
 // ../../infra/tee-measurement.json
 var tee_measurement_default = {
-  signerVersion: "0.1.3",
+  signerVersion: "0.2.10",
   acceptedMrtd: [
+    '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
     '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]'
   ],
-  primaryMrtd: '["68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
-  capturedAt: "2026-07-20T10:08:58.717Z",
+  primaryMrtd: '["fb14dc139f33d6fcf474bc8332cac001259fb31cfbcb6b34d4ceeb552a2c4466884a0cbde45ad98a05c5c060c23ad65a","07e6f51aa763abfe75c3ddfbf4f425fe3f0ceff66d807a75e049303dce9addf68e7218729bd419638af63a370f65878c","a2a58c9a959a4fa44bd6da0c97a2270c051faf12084cfe91ae900e4fdff6cdd4f69a82005e04ee920f231497894d677f","a76a81147b7f733cb400914c8791ec149bb3a31f3727b1c1e12ec22e9c1a183b6e617e78636dca37075f5a695afd46c2"]',
+  capturedAt: "2026-09-07T07:19:30.544601Z",
   tcbStatus: "UpToDate",
-  _note: "Captured from a live, signature-verified TDX quote (getCollateralAndVerify -> UpToDate) against decane-tee-signer v0.1.3 running on Phala Cloud CVM 786e714d-5042-4bf1-8060-0bc358f6a72f. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching the actual comparison logic in social/attestation.ts."
+  _note: "Captured from the live CVM 786e714d-5042-4bf1-8060-0bc358f6a72f (app_4405742df08d\u2026) after the 2026-09-07 credential recovery. RTMR0 changed; RTMR1-3 did not \u2014 RTMR3 is the app-compose measurement, so the app's identity is unchanged and this is a platform/firmware move underneath the CVM (Phala node v0.6.0), not a change to what we deploy. Sealing was verified intact across it (/signer/sealing-status: sealingAvailable, roundTripOk, ready), so no auth_shares were lost. The previous measurement is retained above so a rollback still verifies. measurement is the JSON.stringify(replayRtmrs()) output, compared as an opaque string (not parsed per-RTMR), matching social/attestation.ts."
 };
 
 // src/social/attestation.ts
@@ -4023,7 +4033,15 @@ async function createDecaneConnect(config) {
   }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
-    const stored = await storage.getShare(persisted.userId);
+    return usablePasskeyShare(await storage.getShare(persisted.userId));
+  }
+  async function passkeyDeviceCandidate() {
+    if (!isPasskeySupported()) return null;
+    if (persisted?.userId) return passkeyLoginCandidate();
+    const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
+    return candidates.length === 1 ? candidates[0] : null;
+  }
+  function usablePasskeyShare(stored) {
     if (!stored || stored.unlockMethod !== "passkey") return null;
     if (!stored.credentialId || !stored.prfSalt) return null;
     return stored;
@@ -4182,10 +4200,10 @@ async function createDecaneConnect(config) {
       return handleAuthResult(result);
     },
     async canSignInWithPasskey() {
-      return await passkeyLoginCandidate() !== null;
+      return await passkeyDeviceCandidate() !== null;
     },
     async signInWithPasskey() {
-      const candidate = await passkeyLoginCandidate();
+      const candidate = await passkeyDeviceCandidate();
       if (!candidate) throw new NewDeviceError();
       return passkeyLogin(candidate);
     },
@@ -6762,7 +6780,11 @@ function DecaneKit({ config, children }) {
         "session-expired",
         () => setSocialAuth((p) => ({ ...p, isUnlocked: false, sessionExpiresAt: null }))
       );
-      sdk.on("disconnected", () => setSocialAuth(DEFAULT_SOCIAL));
+      sdk.on("disconnected", () => {
+        setSocialAuth(DEFAULT_SOCIAL);
+        sdk.canSignInWithPasskey().then((can) => setSocialAuth((p) => ({ ...p, canUsePasskey: can }))).catch(() => {
+        });
+      });
       sdk.on("wallet-creating", () => setSocialAuth((p) => ({ ...p, phase: "creating" })));
       sdk.on("wallet-unlocking", () => setSocialAuth((p) => ({ ...p, phase: "unlocking" })));
       sdk.on("connected", () => setSocialAuth((p) => ({ ...p, phase: null })));