@tronweb3/tronwallet-adapter-tokenpocket 1.1.0 → 1.2.0

package/lib/umd/index.js

@@ -519,13 +519,60 @@
 		function isPlainObject(value) {
 		    return typeof value === 'object' && value !== null && !Array.isArray(value);
 		}
+		/** Non-negative decimal integer, e.g. `1`, `728126428`. */
+		const DECIMAL_INTEGER = /^[0-9]+$/;
+		/** Non-negative hex integer, e.g. `0x2b6653dc`. `BigInt` accepts either prefix case. */
+		const HEX_INTEGER = /^0[xX][0-9a-fA-F]+$/;
+		/**
+		 * Convert a `domain.chainId` to the `number` wallets expect, refusing anything
+		 * that cannot survive the trip.
+		 *
+		 * EIP-712 declares `chainId` as `uint256`, but `Number()` maps that domain onto
+		 * IEEE-754 doubles and quietly accepts values that are not integers at all:
+		 * `Number('9007199254740993')` yields `9007199254740992`, and `'1.5'`, `'-1'`,
+		 * `'1e3'` and `''` all pass `Number.isFinite()`. Each of those makes the wallet
+		 * sign a domain that differs from what the caller supplied, so the signature no
+		 * longer corresponds to the original payload. Parsing through `BigInt` keeps the
+		 * value exact and lets the unrepresentable cases fail loudly instead.
+		 */
+		function toChainIdNumber(chainId) {
+		    // Reject anything that is not an integer literal before converting. `Number()`
+		    // happily turns `'1.5'`, `'-1'`, `'1e3'` and `''` into finite numbers, none of
+		    // which is a uint256.
+		    if (typeof chainId === 'string') {
+		        const value = chainId.trim();
+		        if (!DECIMAL_INTEGER.test(value) && !HEX_INTEGER.test(value)) {
+		            throw new errors_js_1.WalletSignTypedDataError(`Invalid domain.chainId: ${chainId}. Expected a non-negative decimal or 0x-prefixed hex integer.`);
+		        }
+		    }
+		    const parsed = Number(chainId);
+		    // Catches NaN, Infinity and fractions, which only a number/bigint input can
+		    // still be at this point — the string form was already gated by the regexes.
+		    if (!Number.isInteger(parsed)) {
+		        throw new errors_js_1.WalletSignTypedDataError(`Invalid domain.chainId: ${chainId}. Expected a non-negative integer.`);
+		    }
+		    if (parsed < 0) {
+		        throw new errors_js_1.WalletSignTypedDataError(`Invalid domain.chainId: ${chainId}. Expected a non-negative integer.`);
+		    }
+		    // With integrality established, `isSafeInteger` is an exact bound check rather
+		    // than an approximation: every integer up to MAX_SAFE_INTEGER converts
+		    // losslessly, and anything larger necessarily rounds to 2^53 or beyond, which is
+		    // never "safe". So a value that survives this equals what the caller supplied.
+		    if (!Number.isSafeInteger(parsed)) {
+		        throw new errors_js_1.WalletSignTypedDataError(`domain.chainId ${chainId} exceeds Number.MAX_SAFE_INTEGER (${Number.MAX_SAFE_INTEGER}) and cannot be represented as a number without losing precision.`);
+		    }
+		    return parsed;
+		}
 		/**
 		 * Validate a TypedData payload and return a normalized copy safe to pass to wallets.
 		 *
-		 * Current normalization: convert `domain.chainId` from string to number (some wallets,
-		 * e.g. TronLink, require a numeric chainId).
+		 * Current normalization: convert `domain.chainId` to a number (some wallets,
+		 * e.g. TronLink, require a numeric chainId). `null`/`undefined` are left alone
+		 * because `chainId` is optional, as are values of other types — a `BigNumber`
+		 * instance is a legitimate `BigNumberish` and is passed through untouched.
 		 *
-		 * Throws {@link WalletSignTypedDataError} if the payload is not a valid TypedData object.
+		 * Throws {@link WalletSignTypedDataError} if the payload is not a valid TypedData
+		 * object, or if `domain.chainId` cannot be represented exactly as a number.
 		 */
 		function normalizeAndValidateTypedData(typedData) {
 		    if (!isPlainObject(typedData)) {
@@ -541,10 +588,10 @@
 		        throw new errors_js_1.WalletSignTypedDataError('typedData.message must be an object.');
 		    }
 		    const { chainId } = typedData.domain;
-		    if (typeof chainId === 'string') {
-		        const parsed = Number(chainId);
-		        if (!Number.isFinite(parsed)) {
-		            throw new errors_js_1.WalletSignTypedDataError(`Invalid domain.chainId: ${chainId}.`);
+		    if (typeof chainId === 'string' || typeof chainId === 'number' || typeof chainId === 'bigint') {
+		        const parsed = toChainIdNumber(chainId);
+		        if (parsed === chainId) {
+		            return typedData;
 		        }
 		        return Object.assign(Object.assign({}, typedData), { domain: Object.assign(Object.assign({}, typedData.domain), { chainId: parsed }) });
 		    }
@@ -685,58 +732,135 @@
 	function requireUtils$2 () {
 		if (hasRequiredUtils$2) return utils$2;
 		hasRequiredUtils$2 = 1;
-		Object.defineProperty(utils$2, "__esModule", { value: true });
-		utils$2.isInBrowser = isInBrowser;
-		utils$2.checkAdapterState = checkAdapterState;
-		utils$2.isInMobileBrowser = isInMobileBrowser;
-		/**
-		 * check simply if current environment is browser or not
-		 * @returns boolean
-		 */
-		function isInBrowser() {
-		    return typeof window !== 'undefined' && typeof document !== 'undefined' && typeof navigator !== 'undefined';
-		}
-		/**
-		 *
-		 * @param {Function} check funcion to check if wallet is installed. return true if wallet is detected.
-		 * @returns
-		 */
-		function checkAdapterState(check) {
-		    if (!isInBrowser())
-		        return;
-		    const disposers = [];
-		    function dispose() {
-		        for (const dispose of disposers) {
-		            dispose();
-		        }
-		    }
-		    function checkAndDispose() {
-		        if (check()) {
-		            dispose();
-		        }
-		    }
-		    const interval = setInterval(checkAndDispose, 500);
-		    disposers.push(() => clearInterval(interval));
-		    if (document.readyState === 'loading') {
-		        document.addEventListener('DOMContentLoaded', checkAndDispose, { once: true });
-		        disposers.push(() => document.removeEventListener('DOMContentLoaded', checkAndDispose));
-		    }
-		    if (document.readyState !== 'complete') {
-		        window.addEventListener('load', checkAndDispose, { once: true });
-		        disposers.push(() => window.removeEventListener('load', checkAndDispose));
-		    }
-		    checkAndDispose();
-		    // stop all task after 1min
-		    setTimeout(dispose, 60 * 1000);
-		}
-		/**
-		 * Simplily detect mobile device
-		 */
-		function isInMobileBrowser() {
-		    return (typeof navigator !== 'undefined' &&
-		        navigator.userAgent.match(/Android|webOS|iPhone|iPad|iPod|BlackBerry|Windows Phone/i));
-		}
-		
+		(function (exports$1) {
+			Object.defineProperty(exports$1, "__esModule", { value: true });
+			exports$1.MAX_CHECK_TIMEOUT = void 0;
+			exports$1.validateCheckTimeout = validateCheckTimeout;
+			exports$1.omitUndefined = omitUndefined;
+			exports$1.assertConnectAddress = assertConnectAddress;
+			exports$1.isInBrowser = isInBrowser;
+			exports$1.checkAdapterState = checkAdapterState;
+			exports$1.isInMobileBrowser = isInMobileBrowser;
+			const errors_js_1 = requireErrors();
+			/**
+			 * Upper bound for `config.checkTimeout`, in milliseconds.
+			 *
+			 * Wallet detection polls on a fixed interval and gives up after
+			 * `checkTimeout / interval` ticks. An unbounded value makes that loop
+			 * indistinguishable from one that never stops, so it is capped. Ten minutes is
+			 * far beyond any realistic detection window.
+			 */
+			exports$1.MAX_CHECK_TIMEOUT = 10 * 60 * 1000;
+			/**
+			 * Validate `config.checkTimeout` and throw when it cannot produce a terminating
+			 * detection loop.
+			 *
+			 * `typeof value === 'number'` is not enough on its own: `NaN` and `Infinity` are
+			 * numbers, and adapters derive their polling bound from
+			 * `Math.floor(checkTimeout / interval)`. With `NaN` that bound is `NaN`, so
+			 * `times > maxTimes` is never true — the interval is never cleared and the
+			 * detection promise never settles, hanging `connect()` for the life of the page.
+			 * TypeScript cannot prevent this because adapters are also constructed from
+			 * plain JavaScript, JSON config and `as any`.
+			 *
+			 * @param value the raw value taken from the adapter config
+			 * @param prefix prefix used in the thrown message, e.g. `[TronLinkAdapter]`
+			 */
+			function validateCheckTimeout(value, prefix = '[WalletAdapter]') {
+			    if (typeof value !== 'number') {
+			        throw new Error(`${prefix} config.checkTimeout should be a number`);
+			    }
+			    if (!Number.isFinite(value) || value < 0 || value > exports$1.MAX_CHECK_TIMEOUT) {
+			        throw new Error(`${prefix} config.checkTimeout should be a finite number between 0 and ${exports$1.MAX_CHECK_TIMEOUT}, but got ${value}`);
+			    }
+			}
+			/**
+			 * Copy an object without the keys whose value is exactly `undefined`.
+			 *
+			 * Spreading a caller's config over a set of defaults is only safe when explicit
+			 * `undefined`s have been dropped first: `{ ...defaults, ...{ checkTimeout: undefined } }`
+			 * yields `checkTimeout: undefined`, which defeats the default and every validation
+			 * that ran against it. Callers routinely produce such objects by spreading their own
+			 * optional config, so adapters must sanitise before merging rather than trusting the
+			 * `Required<...>` type on the resulting field.
+			 *
+			 * @param params the raw config object, possibly `undefined`
+			 * @returns a shallow copy containing only the keys that were actually set
+			 */
+			function omitUndefined(params) {
+			    return Object.fromEntries(Object.entries(params !== null && params !== void 0 ? params : {}).filter(([, value]) => value !== undefined));
+			}
+			/**
+			 * Guard the transition into `AdapterState.Connected`.
+			 *
+			 * A resolved account request is not the same thing as a connection. Wallets
+			 * answer `tron_requestAccounts`/`eth_requestAccounts` with a success code while
+			 * still returning an empty account list, and injected `tronWeb.defaultAddress`
+			 * is frequently not populated yet at the moment the request resolves. Treating
+			 * either as "connected" leaves the adapter reporting `connected === true` with
+			 * no address, and emits `connect('')` to the dapp; every later signMessage or
+			 * signTransaction then passes the state guard only to fail inside the provider.
+			 *
+			 * @param address the address the adapter is about to store. `false` is accepted
+			 * because tronweb types `tronWeb.defaultAddress.base58` as `string | false`.
+			 * @returns the same address, narrowed to a non-empty string
+			 * @throws {WalletConnectionError} when no usable address was obtained
+			 */
+			function assertConnectAddress(address) {
+			    if (!address) {
+			        throw new errors_js_1.WalletConnectionError('Request connect error.');
+			    }
+			    return address;
+			}
+			/**
+			 * check simply if current environment is browser or not
+			 * @returns boolean
+			 */
+			function isInBrowser() {
+			    return typeof window !== 'undefined' && typeof document !== 'undefined' && typeof navigator !== 'undefined';
+			}
+			/**
+			 *
+			 * @param {Function} check funcion to check if wallet is installed. return true if wallet is detected.
+			 * @returns
+			 */
+			function checkAdapterState(check) {
+			    if (!isInBrowser())
+			        return;
+			    const disposers = [];
+			    function dispose() {
+			        for (const dispose of disposers) {
+			            dispose();
+			        }
+			    }
+			    function checkAndDispose() {
+			        if (check()) {
+			            dispose();
+			        }
+			    }
+			    const interval = setInterval(checkAndDispose, 500);
+			    disposers.push(() => clearInterval(interval));
+			    if (document.readyState === 'loading') {
+			        document.addEventListener('DOMContentLoaded', checkAndDispose, { once: true });
+			        disposers.push(() => document.removeEventListener('DOMContentLoaded', checkAndDispose));
+			    }
+			    if (document.readyState !== 'complete') {
+			        window.addEventListener('load', checkAndDispose, { once: true });
+			        disposers.push(() => window.removeEventListener('load', checkAndDispose));
+			    }
+			    checkAndDispose();
+			    // stop all task after 1min
+			    setTimeout(dispose, 60 * 1000);
+			}
+			/**
+			 * Simplily detect mobile device
+			 */
+			function isInMobileBrowser() {
+			    return (typeof navigator !== 'undefined' &&
+			        navigator.userAgent.match(/Android|webOS|iPhone|iPad|iPod|BlackBerry|Windows Phone/i));
+			}
+			
+		} (utils$2));
 		return utils$2;
 	}
 
@@ -761,6 +885,7 @@
 			};
 			Object.defineProperty(exports$1, "__esModule", { value: true });
 			exports$1.defaultSecurityOptions = void 0;
+			exports$1.validateSecurityOptions = validateSecurityOptions;
 			exports$1.clearCache = clearCache;
 			exports$1.fetchJsonWithCache = fetchJsonWithCache;
 			exports$1.defaultSecurityOptions = {
@@ -773,6 +898,83 @@
 			    retries: 0,
 			    cacheTTL: 10 * 60 * 1000,
 			};
+			/** A config fetch that takes longer than this is never worth waiting for. */
+			const MAX_SECURITY_TIMEOUT = 60 * 1000;
+			/** `retries` multiplies the time `connect()` can block, so it is capped. */
+			const MAX_SECURITY_RETRIES = 10;
+			function assertFiniteNumber(value, field, min, max) {
+			    if (typeof value !== 'number' || !Number.isFinite(value) || value < min || value > max) {
+			        throw new Error(`[WalletAdapter] config.securityOptions.${field} should be a finite number between ${min} and ${max}, but got ${String(value)}`);
+			    }
+			}
+			function parseAbsoluteUrl(url) {
+			    try {
+			        return new URL(url);
+			    }
+			    catch (_a) {
+			        // Not absolute — a relative path, which `fetch` resolves against the page.
+			        return null;
+			    }
+			}
+			function validateConfigUrls(configUrls) {
+			    if (!Array.isArray(configUrls)) {
+			        throw new Error(`[WalletAdapter] config.securityOptions.configUrls should be an array of URLs, but got ${typeof configUrls}`);
+			    }
+			    for (const url of configUrls) {
+			        if (typeof url !== 'string' || url.trim() === '') {
+			            throw new Error(`[WalletAdapter] config.securityOptions.configUrls should only contain non-empty URL strings, but got ${String(url)}`);
+			        }
+			        // Relative paths are legitimate — they resolve against the page and `new URL`
+			        // rejects them — so only values that parse as an absolute URL are checked,
+			        // and then only for the scheme `fetch` can actually retrieve.
+			        const parsed = parseAbsoluteUrl(url);
+			        if (parsed && parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+			            throw new Error(`[WalletAdapter] config.securityOptions.configUrls only supports http(s) URLs, but got ${url}`);
+			        }
+			    }
+			}
+			/**
+			 * Validate `config.securityOptions` at construction time.
+			 *
+			 * Every field here is consumed much later, inside `connect()` — a `configUrls`
+			 * string instead of an array only fails when `fetchJsonWithCache` calls `.map`
+			 * on it, and a `NaN` timeout or a negative `retries` silently changes the fetch
+			 * behaviour rather than reporting anything. Failing fast in the constructor puts
+			 * the error where the caller can act on it.
+			 */
+			function validateSecurityOptions(securityOptions) {
+			    const { enabled, configUrls, timeout, retries, cacheTTL, onRiskDetected, onConfigFallback } = securityOptions;
+			    // `enabled` is read as a plain truthy value in `checkSecurity()` and again just
+			    // below, so a non-boolean silently resolves to the opposite of what it reads like:
+			    // `'false'` is truthy and turns the check on. Check it before the `configUrls`
+			    // requirement below, or `{ enabled: 'false' }` reports a missing `configUrls`
+			    // "when enabled is true" — for a caller who wrote `false`.
+			    if (enabled !== undefined && typeof enabled !== 'boolean') {
+			        throw new Error(`[WalletAdapter] config.securityOptions.enabled should be a boolean, but got ${typeof enabled}`);
+			    }
+			    if (configUrls !== undefined) {
+			        validateConfigUrls(configUrls);
+			    }
+			    if (enabled && (!configUrls || configUrls.length === 0)) {
+			        throw new Error(`[WalletAdapter] config.securityOptions.configUrls is required when securityOptions.enabled is true`);
+			    }
+			    if (timeout !== undefined) {
+			        assertFiniteNumber(timeout, 'timeout', 1, MAX_SECURITY_TIMEOUT);
+			    }
+			    if (cacheTTL !== undefined) {
+			        // No upper bound: caching the risk config for a long time is a valid choice.
+			        assertFiniteNumber(cacheTTL, 'cacheTTL', 0, Number.MAX_SAFE_INTEGER);
+			    }
+			    if (retries !== undefined && (!Number.isInteger(retries) || retries < 0 || retries > MAX_SECURITY_RETRIES)) {
+			        throw new Error(`[WalletAdapter] config.securityOptions.retries should be an integer between 0 and ${MAX_SECURITY_RETRIES}, but got ${String(retries)}`);
+			    }
+			    if (onRiskDetected !== undefined && typeof onRiskDetected !== 'function') {
+			        throw new Error(`[WalletAdapter] config.securityOptions.onRiskDetected should be a function, but got ${typeof onRiskDetected}`);
+			    }
+			    if (onConfigFallback !== undefined && typeof onConfigFallback !== 'function') {
+			        throw new Error(`[WalletAdapter] config.securityOptions.onConfigFallback should be a function, but got ${typeof onConfigFallback}`);
+			    }
+			}
 			function isValidRisk(risk) {
 			    return (!!risk &&
 			        typeof risk === 'object' &&
@@ -944,18 +1146,16 @@
 		            openUrlWhenWalletNotFound: true,
 		            securityOptions: security_js_1.defaultSecurityOptions,
 		        };
+		        this._connectPromise = null;
 		        this._securityCheckCache = null;
-		        this.commonConfig = Object.assign(Object.assign({}, this.commonConfig), params);
-		        if (typeof this.commonConfig.checkTimeout !== 'number') {
-		            throw new Error(`[WalletAdapter] config.checkTimeout should be a number`);
-		        }
-		        AddonAdapter._validateSecurityOptions(this.commonConfig.securityOptions);
-		    }
-		    static _validateSecurityOptions(securityOptions) {
-		        const { enabled, configUrls } = securityOptions;
-		        if (enabled && (!configUrls || configUrls.length === 0)) {
-		            throw new Error(`[WalletAdapter] config.securityOptions.configUrls is required when securityOptions.enabled is true`);
-		        }
+		        // Drop explicit `undefined`s before merging: spreading them would overwrite
+		        // the defaults with `undefined` and make `Required<BaseAdapterConfig>` a lie,
+		        // which matters because callers routinely spread optional config objects.
+		        // Subclasses that re-merge their own config on top of `commonConfig` must
+		        // sanitise it the same way — see `omitUndefined`.
+		        this.commonConfig = Object.assign(Object.assign({}, this.commonConfig), (0, utils_js_1.omitUndefined)(params));
+		        (0, utils_js_1.validateCheckTimeout)(this.commonConfig.checkTimeout);
+		        (0, security_js_1.validateSecurityOptions)(this.commonConfig.securityOptions);
 		    }
 		    /**
 		     * Update the security options at runtime. The given options are merged into
@@ -964,10 +1164,41 @@
 		     */
 		    updateSecurityOptions(securityOptions) {
 		        const merged = Object.assign(Object.assign({}, this.commonConfig.securityOptions), securityOptions);
-		        AddonAdapter._validateSecurityOptions(merged);
+		        (0, security_js_1.validateSecurityOptions)(merged);
 		        this.commonConfig.securityOptions = merged;
 		        this._securityCheckCache = null;
 		    }
+		    /**
+		     * Serialise `connect()` so that concurrent callers cannot each reach the wallet.
+		     *
+		     * The `connecting` flag alone cannot do this. Subclasses only raise it *after*
+		     * `await this._beforeConnect()` resolves, and `_beforeConnect()` itself awaits
+		     * wallet discovery and the security check — so two calls made in the same tick
+		     * both pass the guard while it is still `false`, and both go on to call
+		     * `tron_requestAccounts`. That produces a second authorisation popup, a `4000`
+		     * "pending request" error from the provider, and duplicated connect events.
+		     *
+		     * Claiming the in-flight promise here is synchronous — there is no `await`
+		     * between the check and the assignment — so a second caller always observes it
+		     * and simply shares the first call's result. Because the whole subclass
+		     * `_connect()` runs inside it, discovery, the security check and the provider
+		     * request are all in the same critical section.
+		     */
+		    connect(options) {
+		        if (this._connectPromise) {
+		            return this._connectPromise;
+		        }
+		        // Deliberately not `async`: that would wrap the shared promise in a fresh one
+		        // per caller. The IIFE still turns a synchronous throw from `_connect()` into
+		        // a rejection, so callers never see one thrown at them directly.
+		        const promise = (() => __awaiter(this, void 0, void 0, function* () { return this._connect(options); }))().finally(() => {
+		            if (this._connectPromise === promise) {
+		                this._connectPromise = null;
+		            }
+		        });
+		        this._connectPromise = promise;
+		        return promise;
+		    }
 		    /**
 		     * Run the pre-connect pipeline (wallet discovery, deeplink/url fallback,
 		     * security check).
@@ -1238,8 +1469,8 @@
 			        this._updateWallet = () => __awaiter(this, void 0, void 0, function* () {
 			            var _a, _b, _c, _d, _e, _f, _g, _h;
 			            this._supportNewTronProtocol = false;
-			            let state = this.state;
-			            let address = this.address;
+			            let state;
+			            let address;
 			            if ((0, tronwallet_abstract_adapter_1.isInMobileBrowser)()) {
 			                if (window.tronLink) {
 			                    this._wallet = window.tronLink;
@@ -1278,8 +1509,6 @@
 			                }
 			                catch (e) {
 			                    console.error('Unknown error: ' + e, ' Please install TronLink extension wallet.');
-			                    address = null;
-			                    state = tronwallet_abstract_adapter_1.AdapterState.Disconnect;
 			                    this._readyState = tronwallet_abstract_adapter_1.WalletReadyState.NotFound;
 			                    this.emit('readyStateChanged', this.readyState);
 			                    return;
@@ -1384,7 +1613,7 @@
 			            }
 			        });
 			    }
-			    connect() {
+			    _connect() {
 			        return __awaiter(this, void 0, void 0, function* () {
 			            var _a, _b;
 			            try {
@@ -1398,7 +1627,7 @@
 			                    const wallet = this._wallet;
 			                    try {
 			                        const res = yield wallet.request({ method: 'eth_requestAccounts' });
-			                        const address = res[0];
+			                        const address = (0, tronwallet_abstract_adapter_1.assertConnectAddress)(res === null || res === void 0 ? void 0 : res[0]);
 			                        this.setAddress(address);
 			                        this.setState(tronwallet_abstract_adapter_1.AdapterState.Connected);
 			                        this._listenTronEvent();
@@ -1432,13 +1661,13 @@
 			                    if (res.code === 4001) {
 			                        throw new tronwallet_abstract_adapter_1.WalletConnectionError('The user rejected connection.');
 			                    }
-			                    const address = ((_a = wallet.tronWeb.defaultAddress) === null || _a === void 0 ? void 0 : _a.base58) || '';
+			                    const address = (0, tronwallet_abstract_adapter_1.assertConnectAddress)((_a = wallet.tronWeb.defaultAddress) === null || _a === void 0 ? void 0 : _a.base58);
 			                    this.setAddress(address);
 			                    this.setState(tronwallet_abstract_adapter_1.AdapterState.Connected);
 			                }
 			                else if (window.tronWeb) {
 			                    const wallet = this._wallet;
-			                    const address = ((_b = wallet.tronWeb.defaultAddress) === null || _b === void 0 ? void 0 : _b.base58) || '';
+			                    const address = (0, tronwallet_abstract_adapter_1.assertConnectAddress)((_b = wallet.tronWeb.defaultAddress) === null || _b === void 0 ? void 0 : _b.base58);
 			                    this.setAddress(address);
 			                    this.setState(tronwallet_abstract_adapter_1.AdapterState.Connected);
 			                }
@@ -1615,7 +1844,7 @@
 			        }
 			        if ((0, tronwallet_abstract_adapter_1.isInBrowser)() && !(0, tronwallet_abstract_adapter_1.isInMobileBrowser)()) {
 			            // Desktop: use TIP-6963 event-based discovery with fallback
-			            this._checkPromise = new Promise((resolve) => {
+			            const detection = new Promise((resolve) => {
 			                let handled = false;
 			                let timer = null;
 			                let handler = null;
@@ -1682,13 +1911,23 @@
 			                window.addEventListener(tronwallet_abstract_adapter_1.TIP6963AnnounceProviderEventName, handler);
 			                window.dispatchEvent(new Event(tronwallet_abstract_adapter_1.TIP6963RequestProviderEventName));
 			            });
-			            return this._checkPromise;
+			            this._checkPromise = detection;
+			            // Never cache a failed detection: the wallet may inject late or be enabled at
+			            // runtime. Unlike the polling adapters this keeps the full detection window on a
+			            // retry, because the TIP-6963 announce is asynchronous and a shortened window
+			            // would race it.
+			            void detection.then((found) => {
+			                if (!found && this._checkPromise === detection) {
+			                    this._checkPromise = null;
+			                }
+			            });
+			            return detection;
 			        }
 			        // Mobile: use legacy polling detection
 			        const interval = 100;
 			        const maxTimes = Math.floor(this.config.checkTimeout / interval);
 			        let times = 0, timer;
-			        this._checkPromise = new Promise((resolve) => {
+			        const detection = new Promise((resolve) => {
 			            const check = () => {
 			                times++;
 			                this._updateWallet();
@@ -1703,7 +1942,17 @@
 			            timer = setInterval(check, interval);
 			            check();
 			        });
-			        return this._checkPromise;
+			        this._checkPromise = detection;
+			        // Never cache a failed detection: the wallet may inject late or be enabled at
+			        // runtime. Unlike the polling adapters this keeps the full detection window on a
+			        // retry, because the TIP-6963 announce is asynchronous and a shortened window
+			        // would race it.
+			        void detection.then((found) => {
+			            if (!found && this._checkPromise === detection) {
+			                this._checkPromise = null;
+			            }
+			        });
+			        return detection;
 			    }
 			    checkForWalletReadyForApp() {
 			        if (this.checkReadyInterval) {
@@ -1895,8 +2144,8 @@
 			        this._checkPromise = null;
 			        this._updateWallet = () => __awaiter(this, void 0, void 0, function* () {
 			            var _a, _b, _c, _d, _e;
-			            let state = this.state;
-			            let address = this.address;
+			            let state;
+			            let address;
 			            if ((0, utils_js_1.supportTokenPocket)()) {
 			                try {
 			                    yield this.checkSecurity();
@@ -1993,7 +2242,7 @@
 			            }
 			        });
 			    }
-			    connect() {
+			    _connect() {
 			        return __awaiter(this, void 0, void 0, function* () {
 			            try {
 			                if (!(yield this._beforeConnect()))
@@ -2199,7 +2448,7 @@
 			            return this._checkPromise;
 			        }
 			        if ((0, tronwallet_abstract_adapter_1.isInBrowser)() && !(0, tronwallet_abstract_adapter_1.isInMobileBrowser)()) {
-			            this._checkPromise = new Promise((resolve) => {
+			            const detection = new Promise((resolve) => {
 			                const timer = setTimeout(() => {
 			                    window.removeEventListener(tronwallet_abstract_adapter_2.TIP6963AnnounceProviderEventName, handler);
 			                    this._updateWallet();
@@ -2253,13 +2502,23 @@
 			                window.addEventListener(tronwallet_abstract_adapter_2.TIP6963AnnounceProviderEventName, handler);
 			                window.dispatchEvent(new Event(tronwallet_abstract_adapter_2.TIP6963RequestProviderEventName));
 			            });
-			            return this._checkPromise;
+			            this._checkPromise = detection;
+			            // Never cache a failed detection: the wallet may inject late or be enabled at
+			            // runtime. Unlike the polling adapters this keeps the full detection window on a
+			            // retry, because the TIP-6963 announce is asynchronous and a shortened window
+			            // would race it.
+			            void detection.then((found) => {
+			                if (!found && this._checkPromise === detection) {
+			                    this._checkPromise = null;
+			                }
+			            });
+			            return detection;
 			        }
 			        // Support TIP-6963 with wallet extension
 			        const interval = 100;
 			        const maxTimes = Math.floor(this.config.checkTimeout / interval);
 			        let times = 0, timer;
-			        this._checkPromise = new Promise((resolve) => {
+			        const detection = new Promise((resolve) => {
 			            const check = () => {
 			                times++;
 			                const isSupport = (0, utils_js_1.supportTokenPocket)();
@@ -2274,7 +2533,17 @@
 			            timer = setInterval(check, interval);
 			            check();
 			        });
-			        return this._checkPromise;
+			        this._checkPromise = detection;
+			        // Never cache a failed detection: the wallet may inject late or be enabled at
+			        // runtime. Unlike the polling adapters this keeps the full detection window on a
+			        // retry, because the TIP-6963 announce is asynchronous and a shortened window
+			        // would race it.
+			        void detection.then((found) => {
+			            if (!found && this._checkPromise === detection) {
+			                this._checkPromise = null;
+			            }
+			        });
+			        return detection;
 			    }
 			    setAddress(address) {
 			        this._address = address;