decane-connect-kit 2.27.0 → 2.28.0

package/dist/index.cjs

@@ -59,11 +59,12 @@ __export(errors_exports, {
   UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
   WalletEnrolmentError: () => WalletEnrolmentError,
+  WalletExistsError: () => WalletExistsError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -212,6 +213,11 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    WalletExistsError = class extends DecaneConnectError {
+      constructor() {
+        super("WALLET_EXISTS", "This account already has a wallet; opening it instead.", true);
+      }
+    };
     WalletEnrolmentError = class extends DecaneConnectError {
       constructor(cause) {
         super(
@@ -279,6 +285,7 @@ __export(index_exports, {
   UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
   WalletEnrolmentError: () => WalletEnrolmentError,
+  WalletExistsError: () => WalletExistsError,
   WalletSelector: () => WalletSelector,
   WeakPasswordError: () => WeakPasswordError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
@@ -2109,7 +2116,9 @@ var ERROR_MAP = {
   // The backend's authMiddleware code for an expired/revoked JWT. Surfacing it
   // as ReconnectRequiredError routes callers to the sign-in UI instead of a
   // generic failure message.
-  UNAUTHORIZED: ReconnectRequiredError
+  UNAUTHORIZED: ReconnectRequiredError,
+  // A restorable wallet already exists: the client provisions instead of creating.
+  WALLET_EXISTS: WalletExistsError
 };
 var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
@@ -2509,7 +2518,7 @@ function dropCollateral(teeUrl) {
 // src/social/attestation.ts
 init_errors();
 
-// ../../infra/tee-measurement.json
+// ../infra/tee-measurement.json
 var tee_measurement_default = {
   signerVersion: "0.2.10",
   acceptedMrtd: [
@@ -4471,24 +4480,37 @@ async function createDecaneConnect(config) {
       if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
     }
     const serverIv = generateRandomBytes(12);
-    await withDeadline(api.putShare(jwt, {
-      ciphertext: shareSet.server,
-      iv: serverIv,
-      wrappedShareMeta: {
-        // The server records this on the wallet_created event and nothing else.
-        unlockMethod: identityTier ? "identity" : unlockMethod
-        // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
-      },
-      evmAddress,
-      solanaAddress,
-      tronAddress,
-      // Provisional until the enclave has sealed the auth share, just below. A
-      // backend that knows the flag keeps this row invisible to hasShare until
-      // then, so a creation that fails past this point leaves no wallet behind
-      // and the next sign-in simply creates again — with a new key, which is
-      // why the backend also replaces the recorded addresses outright.
-      pendingEnrolment: true
-    }), remainingBudget(), "storing your wallet");
+    try {
+      await withDeadline(api.putShare(jwt, {
+        ciphertext: shareSet.server,
+        iv: serverIv,
+        wrappedShareMeta: {
+          // The server records this on the wallet_created event and nothing else.
+          unlockMethod: identityTier ? "identity" : unlockMethod
+          // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
+        },
+        evmAddress,
+        solanaAddress,
+        tronAddress,
+        // Provisional until the enclave has sealed the auth share, just below. A
+        // backend that knows the flag keeps this row invisible to hasShare until
+        // then, so a creation that fails past this point leaves no wallet behind
+        // and the next sign-in simply creates again — with a new key, which is
+        // why the backend also replaces the recorded addresses outright.
+        pendingEnrolment: true
+      }), remainingBudget(), "storing your wallet");
+    } catch (e) {
+      if (e instanceof WalletExistsError) {
+        zeroize(shareSet.server);
+        zeroize(shareSet.device);
+        zeroize(shareSet.recovery);
+        if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+        });
+        events.emit("wallet-unlocking");
+        return returningUserUnlock(userId, jwt);
+      }
+      throw e;
+    }
     zeroize(shareSet.server);
     try {
       await enrolBlocking(jwt, new Uint8Array(shareSet.recovery), remainingBudget());
@@ -9052,6 +9074,7 @@ function useSignTypedData() {
   UnlockTokenRejectedError,
   UserCancelledError,
   WalletEnrolmentError,
+  WalletExistsError,
   WalletSelector,
   WeakPasswordError,
   WebAuthnNotSupportedError,