decane-connect-kit 2.7.1 → 2.7.3

package/dist/index.cjs

@@ -44,6 +44,7 @@ __export(errors_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -55,7 +56,7 @@ __export(errors_exports, {
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -126,6 +127,11 @@ var init_errors = __esm({
         super("SHARE_CORRUPTED", "Stored device share is corrupted");
       }
     };
+    ProvisioningTimeoutError = class extends DecaneConnectError {
+      constructor(step) {
+        super("PROVISIONING_TIMEOUT", `Wallet setup timed out while ${step}. Check your connection and try again.`, true);
+      }
+    };
     NewDeviceError = class extends DecaneConnectError {
       constructor() {
         super("NEW_DEVICE", "No device share found. Re-authenticate to set up this device.");
@@ -204,6 +210,7 @@ __export(index_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -2007,6 +2014,7 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError
 };
+var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
     this.baseUrl = baseUrl;
@@ -2015,9 +2023,12 @@ var ApiClient = class {
   }
   async _request(path, init) {
     let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
       res = await fetch(`${this.baseUrl}${path}`, {
         ...init,
+        signal: controller.signal,
         headers: {
           "Content-Type": "application/json",
           "X-API-Key": this.apiKey,
@@ -2027,6 +2038,8 @@ var ApiClient = class {
       });
     } catch {
       throw new NetworkError();
+    } finally {
+      clearTimeout(timer);
     }
     if (res.status === 404 && init?.allow404) return null;
     if (!res.ok) {
@@ -2329,6 +2342,16 @@ function bytesToBase64(b) {
 function base64ToBytes(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
+var TEE_TIMEOUT_MS = 3e4;
+async function teeFetch(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TEE_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var TeeClient = class {
   constructor(teeUrl) {
     this.teeUrl = teeUrl;
@@ -2384,7 +2407,7 @@ var TeeClient = class {
    */
   async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/session`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -2416,7 +2439,7 @@ var TeeClient = class {
    */
   async recoverWithShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/recover`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/recover`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ recoveryShare: bytesToBase64(recoveryShare) })
@@ -2441,7 +2464,7 @@ var TeeClient = class {
    * require proof of fresh authenticator possession, not just an active session.
    */
   async completeAssertion(jwt) {
-    const res = await fetch(`${this.teeUrl}/signer/assertion-challenge`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/assertion-challenge`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
@@ -2470,12 +2493,17 @@ var TeeClient = class {
    */
   async enrolAuthShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/auth-share`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/auth-share`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ share: bytesToBase64(recoveryShare) })
     });
-    if (!res.ok) throw new Error("auth share enrolment failed");
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(
+        `auth share enrolment failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      );
+    }
   }
   /**
    * Ask the enclave for a fresh device share for this authenticated user.
@@ -2488,12 +2516,17 @@ var TeeClient = class {
    */
   async provisionDeviceShare(jwt) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/provision`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/provision`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
     });
     if (res.status === 409) return null;
-    if (!res.ok) throw new Error("device share provisioning failed");
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(
+        `device share provisioning failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      );
+    }
     const body = await res.json();
     return base64ToBytes(body.deviceShare);
   }
@@ -2501,7 +2534,7 @@ var TeeClient = class {
   async rotateShares(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/rotate`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/rotate`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2518,7 +2551,7 @@ var TeeClient = class {
   async exportPortableBackup(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/export-portable`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/export-portable`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2548,7 +2581,7 @@ var TeeClient = class {
       if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
       gate = await this.completeAssertion(jwt);
     }
-    const res = await fetch(`${this.teeUrl}/signer/sign`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -3489,6 +3522,44 @@ async function createDecaneConnect(config) {
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
   const serverAssistedRecovery = true;
+  const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
+  const selfHealAttempted = /* @__PURE__ */ new Set();
+  async function selfHealEnrolment(userId, jwt, share) {
+    try {
+      if (selfHealAttempted.has(userId)) return;
+      const status = await api.getRecoveryStatus(jwt);
+      if (status.enrolled !== false) return;
+      selfHealAttempted.add(userId);
+      await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+    } catch (e) {
+      events.emit("enrolment-failed");
+      console.warn(
+        "decane-connect-kit: this wallet is not enrolled for server-assisted recovery and the automatic repair failed. It still works on this device, but a new device will need a passkey backup or a recovery file. The SDK will try again on the next unlock.",
+        e
+      );
+    } finally {
+      zeroize(share);
+    }
+  }
+  const PROVISIONING_BUDGET_MS = 9e4;
+  function withDeadline(promise, ms, step) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ProvisioningTimeoutError(step)), Math.max(0, ms));
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
+  function withTimeout(promise, ms) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
   const SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
     if (!persistSession) return;
@@ -3629,6 +3700,8 @@ async function createDecaneConnect(config) {
       ({ wrappingKey, meta } = await pinSetup());
       unlockMethod = "pin";
     }
+    const provisioningStartedAt = Date.now();
+    const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
     const master = generateMaster();
     let shareSet;
     let evmAddress;
@@ -3660,7 +3733,7 @@ async function createDecaneConnect(config) {
       version: 1
     });
     const serverIv = generateRandomBytes(12);
-    await api.putShare(jwt, {
+    await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
       iv: serverIv,
       wrappedShareMeta: {
@@ -3670,7 +3743,7 @@ async function createDecaneConnect(config) {
       evmAddress,
       solanaAddress,
       tronAddress
-    });
+    }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
@@ -3686,7 +3759,11 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: wrapped share backup failed; user can retry from settings.", e);
       }
     }
-    const confirmed = await session.start(shareSet.device, jwt, addresses);
+    const confirmed = await withDeadline(
+      session.start(shareSet.device, jwt, addresses),
+      remainingBudget(),
+      "opening the signing session"
+    );
     zeroize(shareSet.device);
     if (confirmed.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -3696,10 +3773,33 @@ async function createDecaneConnect(config) {
     addresses.evm = evmAddress = confirmed.evm;
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
+    if (serverAssistedRecovery) {
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          const tee = new TeeClient(teeUrl);
+          await tee.enrolAuthShare(jwt, shareSet.recovery);
+          break;
+        } catch (e) {
+          if (attempt === 2) {
+            console.warn(
+              "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device. This wallet will get a 409 not_enrolled from /signer/provision until it is re-enrolled.",
+              e
+            );
+          }
+        }
+      }
+    }
     if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
       try {
-        const choice = await config.onRecoveryShareOffer({ evmAddress, solanaAddress });
-        if (choice.wants) {
+        const choice = await withTimeout(
+          config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
+          RECOVERY_OFFER_TIMEOUT_MS
+        );
+        if (!choice) {
+          console.warn(
+            `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so wallet creation continued without offering a recovery file. The wallet is fully created and enrolled; the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
+          );
+        } else if (choice.wants) {
           const file = await buildRecoveryShareFile(
             shareSet.recovery,
             choice.password,
@@ -3714,17 +3814,6 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
       }
     }
-    if (serverAssistedRecovery) {
-      try {
-        const tee = new TeeClient(teeUrl);
-        await tee.enrolAuthShare(jwt, shareSet.recovery);
-      } catch (e) {
-        console.warn(
-          "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device.",
-          e
-        );
-      }
-    }
     zeroize(shareSet.recovery);
     return addresses;
   }
@@ -3750,6 +3839,9 @@ async function createDecaneConnect(config) {
             }
             return addrs;
           }
+          console.warn(
+            "decane-connect-kit: this wallet is not enrolled for server-assisted provisioning (/signer/provision returned 409 not_enrolled), so a device share cannot be issued from the JWT alone. Falling back to passkey sync, then the recovery file."
+          );
         } catch (e) {
           console.warn(
             "decane-connect-kit: server-assisted provisioning unavailable; falling back to passkey/recovery-file recovery.",
@@ -3810,6 +3902,7 @@ async function createDecaneConnect(config) {
       }
       throw e;
     }
+    void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -7255,6 +7348,7 @@ function useSignTypedData() {
   NewDeviceError,
   OriginNotAllowedError,
   PromptPinNotConfiguredError,
+  ProvisioningTimeoutError,
   ReconnectRequiredError,
   RecoveryFailedError,
   RecoveryWalletMismatchError,