decane-connect-kit 2.27.0 → 2.28.0

package/dist/index.d.cts

@@ -1276,6 +1276,18 @@ declare class RecoveryWalletMismatchError extends DecaneConnectError {
 declare class ExportNotAuthorizedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * POST /share answered 409: a wallet the enclave can restore already exists
+ * for this account, so the one this device just generated must not replace
+ * its server share (the sealed auth share matches the existing one, and
+ * writing over it would lose the key). Happens when the app's server created
+ * the wallet moments before this sign-in, or a stale tab raced a newer one.
+ * The client discards what it generated and provisions instead; nothing for
+ * the caller to do, which is why this never reaches them.
+ */
+declare class WalletExistsError extends DecaneConnectError {
+    constructor();
+}
 /**
  * Wallet creation stopped because the enclave did not seal the wallet's
  * recovery share (enrolment). Creation blocks on that step in every tier,
@@ -1753,4 +1765,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.d.ts

@@ -1276,6 +1276,18 @@ declare class RecoveryWalletMismatchError extends DecaneConnectError {
 declare class ExportNotAuthorizedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * POST /share answered 409: a wallet the enclave can restore already exists
+ * for this account, so the one this device just generated must not replace
+ * its server share (the sealed auth share matches the existing one, and
+ * writing over it would lose the key). Happens when the app's server created
+ * the wallet moments before this sign-in, or a stale tab raced a newer one.
+ * The client discards what it generated and provisions instead; nothing for
+ * the caller to do, which is why this never reaches them.
+ */
+declare class WalletExistsError extends DecaneConnectError {
+    constructor();
+}
 /**
  * Wallet creation stopped because the enclave did not seal the wallet's
  * recovery share (enrolment). Creation blocks on that step in every tier,
@@ -1753,4 +1765,4 @@ declare class WeakPasswordError extends Error {
  */
 declare function validateUnlockPassword(password: string): void;
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, EnclaveHttpError, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidAccessTokenError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, MIN_PASSWORD_LENGTH, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPasswordNotConfiguredError, PromptPinNotConfiguredError, ProvisioningRateLimitedError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UnlockTokenRejectedError, UserCancelledError, WalletEnrolmentError, WalletExistsError, WalletSelector, WeakPasswordError, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, WrongUnlockPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, validateUnlockPassword, verifyEmailCode };

package/dist/index.js

@@ -37,11 +37,12 @@ __export(errors_exports, {
   UnlockTokenRejectedError: () => UnlockTokenRejectedError,
   UserCancelledError: () => UserCancelledError,
   WalletEnrolmentError: () => WalletEnrolmentError,
+  WalletExistsError: () => WalletExistsError,
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -190,6 +191,11 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    WalletExistsError = class extends DecaneConnectError {
+      constructor() {
+        super("WALLET_EXISTS", "This account already has a wallet; opening it instead.", true);
+      }
+    };
     WalletEnrolmentError = class extends DecaneConnectError {
       constructor(cause) {
         super(
@@ -2023,7 +2029,9 @@ var ERROR_MAP = {
   // The backend's authMiddleware code for an expired/revoked JWT. Surfacing it
   // as ReconnectRequiredError routes callers to the sign-in UI instead of a
   // generic failure message.
-  UNAUTHORIZED: ReconnectRequiredError
+  UNAUTHORIZED: ReconnectRequiredError,
+  // A restorable wallet already exists: the client provisions instead of creating.
+  WALLET_EXISTS: WalletExistsError
 };
 var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
@@ -2428,7 +2436,7 @@ function dropCollateral(teeUrl) {
 // src/social/attestation.ts
 init_errors();
 
-// ../../infra/tee-measurement.json
+// ../infra/tee-measurement.json
 var tee_measurement_default = {
   signerVersion: "0.2.10",
   acceptedMrtd: [
@@ -4390,24 +4398,37 @@ async function createDecaneConnect(config) {
       if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
     }
     const serverIv = generateRandomBytes(12);
-    await withDeadline(api.putShare(jwt, {
-      ciphertext: shareSet.server,
-      iv: serverIv,
-      wrappedShareMeta: {
-        // The server records this on the wallet_created event and nothing else.
-        unlockMethod: identityTier ? "identity" : unlockMethod
-        // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
-      },
-      evmAddress,
-      solanaAddress,
-      tronAddress,
-      // Provisional until the enclave has sealed the auth share, just below. A
-      // backend that knows the flag keeps this row invisible to hasShare until
-      // then, so a creation that fails past this point leaves no wallet behind
-      // and the next sign-in simply creates again — with a new key, which is
-      // why the backend also replaces the recorded addresses outright.
-      pendingEnrolment: true
-    }), remainingBudget(), "storing your wallet");
+    try {
+      await withDeadline(api.putShare(jwt, {
+        ciphertext: shareSet.server,
+        iv: serverIv,
+        wrappedShareMeta: {
+          // The server records this on the wallet_created event and nothing else.
+          unlockMethod: identityTier ? "identity" : unlockMethod
+          // credential IDs, prfSalt, pinSalt stay on-device — never sent to server
+        },
+        evmAddress,
+        solanaAddress,
+        tronAddress,
+        // Provisional until the enclave has sealed the auth share, just below. A
+        // backend that knows the flag keeps this row invisible to hasShare until
+        // then, so a creation that fails past this point leaves no wallet behind
+        // and the next sign-in simply creates again — with a new key, which is
+        // why the backend also replaces the recorded addresses outright.
+        pendingEnrolment: true
+      }), remainingBudget(), "storing your wallet");
+    } catch (e) {
+      if (e instanceof WalletExistsError) {
+        zeroize(shareSet.server);
+        zeroize(shareSet.device);
+        zeroize(shareSet.recovery);
+        if (wrappingKey) await storage2.deleteShare(userId).catch(() => {
+        });
+        events.emit("wallet-unlocking");
+        return returningUserUnlock(userId, jwt);
+      }
+      throw e;
+    }
     zeroize(shareSet.server);
     try {
       await enrolBlocking(jwt, new Uint8Array(shareSet.recovery), remainingBudget());
@@ -8977,6 +8998,7 @@ export {
   UnlockTokenRejectedError,
   UserCancelledError,
   WalletEnrolmentError,
+  WalletExistsError,
   WalletSelector,
   WeakPasswordError,
   WebAuthnNotSupportedError,