decane-connect-kit 2.26.1 → 2.27.0

package/dist/index.cjs

@@ -36,6 +36,7 @@ __export(errors_exports, {
   AttestationError: () => AttestationError,
   CallSequenceError: () => CallSequenceError,
   DecaneConnectError: () => DecaneConnectError,
+  EnclaveHttpError: () => EnclaveHttpError,
   ExportNotAuthorizedError: () => ExportNotAuthorizedError,
   InvalidAccessTokenError: () => InvalidAccessTokenError,
   InvalidApiKeyError: () => InvalidApiKeyError,
@@ -46,6 +47,7 @@ __export(errors_exports, {
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPasswordNotConfiguredError: () => PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningRateLimitedError: () => ProvisioningRateLimitedError,
   ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
@@ -56,11 +58,12 @@ __export(errors_exports, {
   UnlockRequiredError: () => UnlockRequiredError,
   UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
+  WalletEnrolmentError: () => WalletEnrolmentError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -209,6 +212,31 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    WalletEnrolmentError = class extends DecaneConnectError {
+      constructor(cause) {
+        super(
+          "WALLET_ENROLMENT_FAILED",
+          "Your wallet could not be set up: the signing enclave did not accept it. Nothing was created \u2014 sign in again to try again.",
+          true
+        );
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    ProvisioningRateLimitedError = class extends DecaneConnectError {
+      constructor() {
+        super(
+          "PROVISIONING_RATE_LIMITED",
+          "This wallet has been opened on too many devices or tabs in the last hour. Wait a little and sign in again.",
+          true
+        );
+      }
+    };
+    EnclaveHttpError = class extends DecaneConnectError {
+      constructor(status, message) {
+        super("ENCLAVE_HTTP", message, status >= 500);
+        this.status = status;
+      }
+    };
   }
 });
 
@@ -226,6 +254,7 @@ __export(index_exports, {
   DecaneLogo: () => DecaneLogo,
   DecaneMark: () => DecaneMark,
   DecaneWordmark: () => DecaneWordmark,
+  EnclaveHttpError: () => EnclaveHttpError,
   ExportNotAuthorizedError: () => ExportNotAuthorizedError,
   InvalidAccessTokenError: () => InvalidAccessTokenError,
   InvalidApiKeyError: () => InvalidApiKeyError,
@@ -237,6 +266,7 @@ __export(index_exports, {
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPasswordNotConfiguredError: () => PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningRateLimitedError: () => ProvisioningRateLimitedError,
   ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
@@ -248,6 +278,7 @@ __export(index_exports, {
   UnlockRequiredError: () => UnlockRequiredError,
   UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
+  WalletEnrolmentError: () => WalletEnrolmentError,
   WalletSelector: () => WalletSelector,
   WeakPasswordError: () => WeakPasswordError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
@@ -2197,7 +2228,8 @@ var ApiClient = class {
         wrappedShareMeta: btoa(JSON.stringify(share.wrappedShareMeta)),
         evmAddress: share.evmAddress,
         solanaAddress: share.solanaAddress,
-        tronAddress: share.tronAddress
+        tronAddress: share.tronAddress,
+        ...share.pendingEnrolment === void 0 ? {} : { pendingEnrolment: share.pendingEnrolment }
       })
     });
   }
@@ -2776,7 +2808,8 @@ var TeeClient = class {
     });
     if (!res.ok) {
       const detail = await res.text().catch(() => "");
-      throw new Error(
+      throw new EnclaveHttpError(
+        res.status,
         `auth share enrolment failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
       );
     }
@@ -2797,9 +2830,11 @@ var TeeClient = class {
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
     });
     if (res.status === 409) return null;
+    if (res.status === 429) throw new ProvisioningRateLimitedError();
     if (!res.ok) {
       const detail = await res.text().catch(() => "");
-      throw new Error(
+      throw new EnclaveHttpError(
+        res.status,
         `device share provisioning failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
       );
     }
@@ -3014,6 +3049,35 @@ var SessionManager = class {
   }
 };
 
+// src/social/identityTier.ts
+function resolveProtectionTier(config) {
+  if (config.protection) return config.protection;
+  return config.deferDeviceProtection === true ? "identity" : "device";
+}
+function resumeAcrossTabsDefault(config, identityTier) {
+  return config.resumeSessionAcrossTabs ?? identityTier;
+}
+var ENROL_BACKOFF_MS = [0, 1e3, 3e3];
+function enrolmentRetryable(status) {
+  return status !== 429 && status !== 403;
+}
+function shouldTryProvisionFirst(identityTier, hasStoredShare) {
+  return identityTier || !hasStoredShare;
+}
+function routeAfterProvision(input) {
+  switch (input.outcome) {
+    case "share":
+      return "session";
+    case "rate-limited":
+      return "fail";
+    case "not-enrolled":
+      if (!input.identityTier) return "recover";
+      return input.hasStoredShare ? "migrate" : "new-device";
+    case "error":
+      return input.identityTier ? "fail" : "recover";
+  }
+}
+
 // src/social/crypto/shares.ts
 var import_secp256k1 = require("@noble/curves/secp256k1");
 var import_shamir_secret_sharing = require("shamir-secret-sharing");
@@ -3924,7 +3988,8 @@ function clearSessionPersist(key) {
 async function createDecaneConnect(config) {
   if (!config.appId) throw new Error("decane-connect-kit: appId is required");
   if (!config.apiKey) throw new Error("decane-connect-kit: apiKey is required");
-  useCrossTabSessionStore(config.resumeSessionAcrossTabs === true);
+  const identityTier = resolveProtectionTier(config) === "identity";
+  useCrossTabSessionStore(resumeAcrossTabsDefault(config, identityTier));
   if (!config.chains?.length)
     throw new Error("decane-connect-kit: at least one chain is required");
   if (config.rotateOnNewDeviceRecovery && !config.onRecoveryRotated) {
@@ -3962,7 +4027,6 @@ async function createDecaneConnect(config) {
   let lastUserId = loadLastUser(LAST_USER_KEY) ?? (LEGACY_LAST_USER_KEY !== LAST_USER_KEY ? loadLastUser(LEGACY_LAST_USER_KEY) : null);
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
-  const deferDeviceProtection = config.deferDeviceProtection === true;
   const serverAssistedRecovery = true;
   const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
   const selfHealAttempted = /* @__PURE__ */ new Set();
@@ -3983,22 +4047,27 @@ async function createDecaneConnect(config) {
       zeroize(share);
     }
   }
-  async function enrolInBackground(jwt, share) {
+  async function enrolBlocking(jwt, share, budgetMs) {
+    const startedAt = Date.now();
     try {
-      for (let attempt = 1; attempt <= 2; attempt++) {
+      let lastError;
+      for (const wait of ENROL_BACKOFF_MS) {
+        if (wait) await new Promise((r) => setTimeout(r, wait));
         try {
-          await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+          await withDeadline(
+            new TeeClient(teeUrl).enrolAuthShare(jwt, share),
+            budgetMs - (Date.now() - startedAt),
+            "enrolling your wallet"
+          );
           return;
         } catch (e) {
-          if (attempt === 2) {
-            events.emit("enrolment-failed");
-            console.warn(
-              "decane-connect-kit: could not enrol this wallet for server-assisted recovery. The wallet is fine and fully usable; it will be re-enrolled automatically on the next unlock. Until then a brand-new device would need a passkey backup or a recovery file.",
-              e
-            );
-          }
+          if (e instanceof AttestationError || e instanceof ProvisioningTimeoutError) throw e;
+          lastError = e;
+          if (!enrolmentRetryable(e.status)) break;
         }
       }
+      events.emit("enrolment-failed");
+      throw new WalletEnrolmentError(lastError);
     } finally {
       zeroize(share);
     }
@@ -4094,6 +4163,7 @@ async function createDecaneConnect(config) {
         else scheduleAccessTokenExpiry(saved.jwt, saved.expiresAt);
         auth = { jwt: saved.jwt, userId: saved.userId, addresses: saved.addresses };
         persisted = { userId: saved.userId, addresses: saved.addresses };
+        if (saved.handle) armTokenRefresh(saved.jwt);
       } catch {
         dropLiveSession();
       }
@@ -4103,6 +4173,13 @@ async function createDecaneConnect(config) {
     if (LEGACY_SESSION_KEY !== SESSION_KEY) clearSessionPersist(LEGACY_SESSION_KEY);
   }
   events.on("session-expired", () => dropLiveSession());
+  function armTokenRefresh(jwt) {
+    const expiresAt = decodeAccessToken(jwt)?.expiresAt;
+    if (expiresAt) scheduleTokenRefresh(jwt, expiresAt);
+  }
+  events.on("connected", () => {
+    if (auth) armTokenRefresh(auth.jwt);
+  });
   async function passwordSetup() {
     if (!config.promptUnlockPassword) throw new PromptPasswordNotConfiguredError();
     const password = await config.promptUnlockPassword({ kind: "set" });
@@ -4327,7 +4404,7 @@ async function createDecaneConnect(config) {
     let wrappingKey = null;
     let meta = {};
     let unlockTokenKey = null;
-    if (deferDeviceProtection) {
+    if (identityTier) {
     } else if (isPasskeySupported()) {
       const prfSalt = generateRandomBytes(32);
       try {
@@ -4399,14 +4476,29 @@ async function createDecaneConnect(config) {
       iv: serverIv,
       wrappedShareMeta: {
         // The server records this on the wallet_created event and nothing else.
-        unlockMethod: deferDeviceProtection ? "deferred" : unlockMethod
+        unlockMethod: identityTier ? "identity" : unlockMethod
         // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
       },
       evmAddress,
       solanaAddress,
-      tronAddress
+      tronAddress,
+      // Provisional until the enclave has sealed the auth share, just below. A
+      // backend that knows the flag keeps this row invisible to hasShare until
+      // then, so a creation that fails past this point leaves no wallet behind
+      // and the next sign-in simply creates again — with a new key, which is
+      // why the backend also replaces the recorded addresses outright.
+      pendingEnrolment: true
     }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
+    try {
+      await enrolBlocking(jwt, new Uint8Array(shareSet.recovery), remainingBudget());
+    } catch (e) {
+      zeroize(shareSet.device);
+      zeroize(shareSet.recovery);
+      if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+      });
+      throw e;
+    }
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt && wrappedDeviceShare && iv) {
       try {
@@ -4435,10 +4527,7 @@ async function createDecaneConnect(config) {
     addresses.evm = evmAddress = confirmed.evm;
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
-    if (serverAssistedRecovery) {
-      void enrolInBackground(jwt, new Uint8Array(shareSet.recovery));
-    }
-    if (config.offerRecoveryAtSignup === true && config.onRecoveryShareOffer) {
+    if (!identityTier && config.offerRecoveryAtSignup === true && config.onRecoveryShareOffer) {
       void offerRecoveryShare(
         jwt,
         new Uint8Array(shareSet.recovery),
@@ -4485,31 +4574,44 @@ async function createDecaneConnect(config) {
     const stored = await storage2.getShare(userId);
     let deviceShare;
     let joinedViaPasskeySync = false;
-    if (!stored) {
-      if (serverAssistedRecovery) {
+    let migrating = false;
+    if (serverAssistedRecovery && shouldTryProvisionFirst(identityTier, !!stored)) {
+      let provisioned = null;
+      let failure;
+      let outcome;
+      try {
+        provisioned = await new TeeClient(teeUrl).provisionDeviceShare(jwt);
+        outcome = provisioned ? "share" : "not-enrolled";
+      } catch (e) {
+        failure = e;
+        outcome = e instanceof ProvisioningRateLimitedError ? "rate-limited" : "error";
+      }
+      const route = routeAfterProvision({ identityTier, hasStoredShare: !!stored, outcome });
+      if (route === "session" && provisioned) {
+        if (!identityTier) await persistProvisionedShare(userId, jwt, provisioned);
+        let addrs;
         try {
-          const tee = new TeeClient(teeUrl);
-          const provisioned = await tee.provisionDeviceShare(jwt);
-          if (provisioned) {
-            if (!deferDeviceProtection) await persistProvisionedShare(userId, jwt, provisioned);
-            let addrs;
-            try {
-              addrs = await session.start(provisioned, jwt, recordedAddresses);
-            } finally {
-              zeroize(provisioned);
-            }
-            return addrs;
-          }
-          console.warn(
-            "decane-connect-kit: this wallet is not enrolled for server-assisted provisioning (/signer/provision returned 409 not_enrolled), so a device share cannot be issued from the JWT alone. Falling back to passkey sync, then the recovery file."
-          );
-        } catch (e) {
-          console.warn(
-            "decane-connect-kit: server-assisted provisioning unavailable; falling back to passkey/recovery-file recovery.",
-            e
-          );
+          addrs = await session.start(provisioned, jwt, recordedAddresses);
+        } finally {
+          zeroize(provisioned);
         }
+        return addrs;
+      }
+      if (route === "fail") throw failure;
+      if (route === "new-device") throw new NewDeviceError();
+      if (route === "migrate") migrating = true;
+      if (route === "recover" && outcome === "not-enrolled") {
+        console.warn(
+          "decane-connect-kit: this wallet is not enrolled for server-assisted provisioning (/signer/provision returned 409 not_enrolled), so a device share cannot be issued from the JWT alone. Falling back to passkey sync, then the recovery file."
+        );
+      } else if (route === "recover") {
+        console.warn(
+          "decane-connect-kit: server-assisted provisioning unavailable; falling back to passkey/recovery-file recovery.",
+          failure
+        );
       }
+    }
+    if (!stored) {
       if (!config.onRecoveryRotated) {
         throw new CallSequenceError(
           "Recovery rotates the share set and issues a new recovery file, but no onRecoveryRotated callback is configured to save it. Configure onRecoveryRotated before allowing recovery."
@@ -4535,7 +4637,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!deferDeviceProtection && !await storage2.getShare(userId) && isPasskeySupported()) {
+      if (!identityTier && !await storage2.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4549,6 +4651,14 @@ async function createDecaneConnect(config) {
       } catch {
         throw stored.unlockMethod === "pin" ? new InvalidPinError() : new ShareCorruptedError();
       }
+      if (migrating) {
+        try {
+          await enrolBlocking(jwt, new Uint8Array(deviceShare), PROVISIONING_BUDGET_MS);
+        } catch (e) {
+          zeroize(deviceShare);
+          throw e;
+        }
+      }
     }
     let addresses;
     try {
@@ -4563,7 +4673,11 @@ async function createDecaneConnect(config) {
       }
       throw e;
     }
-    void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
+    if (migrating) {
+      events.emit("migrated-to-identity");
+    } else if (!identityTier) {
+      void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
+    }
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -4746,7 +4860,7 @@ async function createDecaneConnect(config) {
       if (auth && session.isActive()) {
         return { addresses: auth.addresses, isNewUser: false };
       }
-      const candidate = await passkeyLoginCandidate();
+      const candidate = identityTier ? null : await passkeyLoginCandidate();
       if (candidate) {
         try {
           return await passkeyLogin(candidate);
@@ -4856,9 +4970,15 @@ async function createDecaneConnect(config) {
       return handleAuthResult(result);
     },
     async canSignInWithPasskey() {
+      if (identityTier) return false;
       return canOfferPasskey();
     },
     async signInWithPasskey() {
+      if (identityTier) {
+        throw new CallSequenceError(
+          "signInWithPasskey() is not available in the identity tier (protection: 'identity'); use connect()."
+        );
+      }
       const candidate = await passkeyDeviceCandidate();
       if (candidate) return passkeyLogin(candidate);
       const known = persisted?.userId ?? lastUserId;
@@ -4994,6 +5114,11 @@ async function createDecaneConnect(config) {
       return stored?.unlockMethod === "passkey";
     },
     async addPasskey() {
+      if (identityTier) {
+        throw new CallSequenceError(
+          "addPasskey() is not available in the identity tier (protection: 'identity'): nothing is stored on the device for a passkey to protect."
+        );
+      }
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
       const stored = await storage2.getShare(auth.userId);
@@ -5032,6 +5157,7 @@ async function createDecaneConnect(config) {
       return await storage2.getShare(auth.userId) !== null;
     },
     async protectDevice() {
+      if (identityTier) return false;
       if (!auth) throw new ReconnectRequiredError();
       if (await storage2.getShare(auth.userId)) return true;
       if (!serverAssistedRecovery) throw new NewDeviceError();
@@ -5047,7 +5173,7 @@ async function createDecaneConnect(config) {
     },
     async unlock() {
       if (!auth) {
-        const candidate = await passkeyLoginCandidate();
+        const candidate = identityTier ? null : await passkeyLoginCandidate();
         if (candidate) {
           await passkeyLogin(candidate);
           return;
@@ -5216,6 +5342,8 @@ async function createDecaneConnect(config) {
     },
     async disconnect() {
       session.end();
+      if (tokenRefresh) clearTimeout(tokenRefresh);
+      tokenRefresh = null;
       if (auth?.jwt) {
         await api.revoke(auth.jwt).catch(() => {
         });
@@ -7666,6 +7794,7 @@ function DecaneKit({ config, children }) {
       chains,
       rpcUrls,
       requireAssertionPerSignature,
+      protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
       // Recovery callbacks. Forwarding these is what makes recovery
@@ -7688,6 +7817,7 @@ function DecaneKit({ config, children }) {
       promptPin,
       promptUnlockPassword,
       requireAssertionPerSignature,
+      protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
       offerRecoveryAtSignup,
@@ -8897,6 +9027,7 @@ function useSignTypedData() {
   DecaneLogo,
   DecaneMark,
   DecaneWordmark,
+  EnclaveHttpError,
   ExportNotAuthorizedError,
   InvalidAccessTokenError,
   InvalidApiKeyError,
@@ -8908,6 +9039,7 @@ function useSignTypedData() {
   OriginNotAllowedError,
   PromptPasswordNotConfiguredError,
   PromptPinNotConfiguredError,
+  ProvisioningRateLimitedError,
   ProvisioningTimeoutError,
   ReconnectRequiredError,
   RecoveryFailedError,
@@ -8919,6 +9051,7 @@ function useSignTypedData() {
   UnlockRequiredError,
   UnlockTokenRejectedError,
   UserCancelledError,
+  WalletEnrolmentError,
   WalletSelector,
   WeakPasswordError,
   WebAuthnNotSupportedError,