decane-connect-kit 2.7.1 → 2.7.3

package/dist/index.d.cts

@@ -256,6 +256,13 @@ declare class ApiClient {
         savedAt: string | null;
         nagged: boolean;
         shareSetVersion: number;
+        /**
+         * Whether this wallet is enrolled for server-assisted provisioning, i.e.
+         * whether a new device can be given a device share from login alone.
+         * Optional because backends older than this field simply omit it — treat
+         * `undefined` as "unknown", never as "not enrolled".
+         */
+        enrolled?: boolean;
     }>;
     dismissRecoveryNag(jwt: string): Promise<void>;
 }
@@ -521,7 +528,16 @@ interface SignTypedDataRequest {
     message: Record<string, unknown>;
     primaryType?: string;
 }
-type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking';
+type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking'
+/**
+ * Emitted when this wallet could not be enrolled for server-assisted
+ * recovery. Not fatal — the wallet works — but until it is enrolled the user
+ * cannot get a device share from login alone, so a future new device will
+ * need a passkey backup or a recovery file. The SDK retries automatically on
+ * later unlocks; surface or report this if you want visibility rather than a
+ * console line.
+ */
+ | 'enrolment-failed';
 interface DecaneConnect {
     connect(): Promise<ConnectResult>;
     connectWithGoogle(): Promise<ConnectResult>;
@@ -808,6 +824,20 @@ declare class NetworkError extends DecaneConnectError {
 declare class ShareCorruptedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * Wallet creation exceeded its time budget.
+ *
+ * Provisioning is bounded so a stalled network or an unresponsive enclave
+ * surfaces as an error the app can act on, rather than a signup that appears to
+ * hang forever. The budget covers only the SDK's own work — key generation,
+ * share storage, opening the signer session — never time spent waiting on the
+ * user (a passkey prompt, choosing a PIN, the recovery-file dialog).
+ *
+ * Retryable: nothing is left half-created that a later sign-in cannot complete.
+ */
+declare class ProvisioningTimeoutError extends DecaneConnectError {
+    constructor(step: string);
+}
 declare class NewDeviceError extends DecaneConnectError {
     constructor();
 }
@@ -1238,4 +1268,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.d.ts

@@ -256,6 +256,13 @@ declare class ApiClient {
         savedAt: string | null;
         nagged: boolean;
         shareSetVersion: number;
+        /**
+         * Whether this wallet is enrolled for server-assisted provisioning, i.e.
+         * whether a new device can be given a device share from login alone.
+         * Optional because backends older than this field simply omit it — treat
+         * `undefined` as "unknown", never as "not enrolled".
+         */
+        enrolled?: boolean;
     }>;
     dismissRecoveryNag(jwt: string): Promise<void>;
 }
@@ -521,7 +528,16 @@ interface SignTypedDataRequest {
     message: Record<string, unknown>;
     primaryType?: string;
 }
-type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking';
+type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking'
+/**
+ * Emitted when this wallet could not be enrolled for server-assisted
+ * recovery. Not fatal — the wallet works — but until it is enrolled the user
+ * cannot get a device share from login alone, so a future new device will
+ * need a passkey backup or a recovery file. The SDK retries automatically on
+ * later unlocks; surface or report this if you want visibility rather than a
+ * console line.
+ */
+ | 'enrolment-failed';
 interface DecaneConnect {
     connect(): Promise<ConnectResult>;
     connectWithGoogle(): Promise<ConnectResult>;
@@ -808,6 +824,20 @@ declare class NetworkError extends DecaneConnectError {
 declare class ShareCorruptedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * Wallet creation exceeded its time budget.
+ *
+ * Provisioning is bounded so a stalled network or an unresponsive enclave
+ * surfaces as an error the app can act on, rather than a signup that appears to
+ * hang forever. The budget covers only the SDK's own work — key generation,
+ * share storage, opening the signer session — never time spent waiting on the
+ * user (a passkey prompt, choosing a PIN, the recovery-file dialog).
+ *
+ * Retryable: nothing is left half-created that a later sign-in cannot complete.
+ */
+declare class ProvisioningTimeoutError extends DecaneConnectError {
+    constructor(step: string);
+}
 declare class NewDeviceError extends DecaneConnectError {
     constructor();
 }
@@ -1238,4 +1268,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.js

@@ -22,6 +22,7 @@ __export(errors_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -33,7 +34,7 @@ __export(errors_exports, {
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -104,6 +105,11 @@ var init_errors = __esm({
         super("SHARE_CORRUPTED", "Stored device share is corrupted");
       }
     };
+    ProvisioningTimeoutError = class extends DecaneConnectError {
+      constructor(step) {
+        super("PROVISIONING_TIMEOUT", `Wallet setup timed out while ${step}. Check your connection and try again.`, true);
+      }
+    };
     NewDeviceError = class extends DecaneConnectError {
       constructor() {
         super("NEW_DEVICE", "No device share found. Re-authenticate to set up this device.");
@@ -1932,6 +1938,7 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError
 };
+var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
     this.baseUrl = baseUrl;
@@ -1940,9 +1947,12 @@ var ApiClient = class {
   }
   async _request(path, init) {
     let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
       res = await fetch(`${this.baseUrl}${path}`, {
         ...init,
+        signal: controller.signal,
         headers: {
           "Content-Type": "application/json",
           "X-API-Key": this.apiKey,
@@ -1952,6 +1962,8 @@ var ApiClient = class {
       });
     } catch {
       throw new NetworkError();
+    } finally {
+      clearTimeout(timer);
     }
     if (res.status === 404 && init?.allow404) return null;
     if (!res.ok) {
@@ -2254,6 +2266,16 @@ function bytesToBase64(b) {
 function base64ToBytes(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
+var TEE_TIMEOUT_MS = 3e4;
+async function teeFetch(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TEE_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var TeeClient = class {
   constructor(teeUrl) {
     this.teeUrl = teeUrl;
@@ -2309,7 +2331,7 @@ var TeeClient = class {
    */
   async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/session`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -2341,7 +2363,7 @@ var TeeClient = class {
    */
   async recoverWithShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/recover`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/recover`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ recoveryShare: bytesToBase64(recoveryShare) })
@@ -2366,7 +2388,7 @@ var TeeClient = class {
    * require proof of fresh authenticator possession, not just an active session.
    */
   async completeAssertion(jwt) {
-    const res = await fetch(`${this.teeUrl}/signer/assertion-challenge`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/assertion-challenge`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
@@ -2395,12 +2417,17 @@ var TeeClient = class {
    */
   async enrolAuthShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/auth-share`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/auth-share`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ share: bytesToBase64(recoveryShare) })
     });
-    if (!res.ok) throw new Error("auth share enrolment failed");
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(
+        `auth share enrolment failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      );
+    }
   }
   /**
    * Ask the enclave for a fresh device share for this authenticated user.
@@ -2413,12 +2440,17 @@ var TeeClient = class {
    */
   async provisionDeviceShare(jwt) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/provision`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/provision`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
     });
     if (res.status === 409) return null;
-    if (!res.ok) throw new Error("device share provisioning failed");
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(
+        `device share provisioning failed (HTTP ${res.status})${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      );
+    }
     const body = await res.json();
     return base64ToBytes(body.deviceShare);
   }
@@ -2426,7 +2458,7 @@ var TeeClient = class {
   async rotateShares(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/rotate`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/rotate`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2443,7 +2475,7 @@ var TeeClient = class {
   async exportPortableBackup(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/export-portable`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/export-portable`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2473,7 +2505,7 @@ var TeeClient = class {
       if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
       gate = await this.completeAssertion(jwt);
     }
-    const res = await fetch(`${this.teeUrl}/signer/sign`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -3414,6 +3446,44 @@ async function createDecaneConnect(config) {
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
   const serverAssistedRecovery = true;
+  const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
+  const selfHealAttempted = /* @__PURE__ */ new Set();
+  async function selfHealEnrolment(userId, jwt, share) {
+    try {
+      if (selfHealAttempted.has(userId)) return;
+      const status = await api.getRecoveryStatus(jwt);
+      if (status.enrolled !== false) return;
+      selfHealAttempted.add(userId);
+      await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+    } catch (e) {
+      events.emit("enrolment-failed");
+      console.warn(
+        "decane-connect-kit: this wallet is not enrolled for server-assisted recovery and the automatic repair failed. It still works on this device, but a new device will need a passkey backup or a recovery file. The SDK will try again on the next unlock.",
+        e
+      );
+    } finally {
+      zeroize(share);
+    }
+  }
+  const PROVISIONING_BUDGET_MS = 9e4;
+  function withDeadline(promise, ms, step) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ProvisioningTimeoutError(step)), Math.max(0, ms));
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
+  function withTimeout(promise, ms) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
   const SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
     if (!persistSession) return;
@@ -3554,6 +3624,8 @@ async function createDecaneConnect(config) {
       ({ wrappingKey, meta } = await pinSetup());
       unlockMethod = "pin";
     }
+    const provisioningStartedAt = Date.now();
+    const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
     const master = generateMaster();
     let shareSet;
     let evmAddress;
@@ -3585,7 +3657,7 @@ async function createDecaneConnect(config) {
       version: 1
     });
     const serverIv = generateRandomBytes(12);
-    await api.putShare(jwt, {
+    await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
       iv: serverIv,
       wrappedShareMeta: {
@@ -3595,7 +3667,7 @@ async function createDecaneConnect(config) {
       evmAddress,
       solanaAddress,
       tronAddress
-    });
+    }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
@@ -3611,7 +3683,11 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: wrapped share backup failed; user can retry from settings.", e);
       }
     }
-    const confirmed = await session.start(shareSet.device, jwt, addresses);
+    const confirmed = await withDeadline(
+      session.start(shareSet.device, jwt, addresses),
+      remainingBudget(),
+      "opening the signing session"
+    );
     zeroize(shareSet.device);
     if (confirmed.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -3621,10 +3697,33 @@ async function createDecaneConnect(config) {
     addresses.evm = evmAddress = confirmed.evm;
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
+    if (serverAssistedRecovery) {
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          const tee = new TeeClient(teeUrl);
+          await tee.enrolAuthShare(jwt, shareSet.recovery);
+          break;
+        } catch (e) {
+          if (attempt === 2) {
+            console.warn(
+              "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device. This wallet will get a 409 not_enrolled from /signer/provision until it is re-enrolled.",
+              e
+            );
+          }
+        }
+      }
+    }
     if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
       try {
-        const choice = await config.onRecoveryShareOffer({ evmAddress, solanaAddress });
-        if (choice.wants) {
+        const choice = await withTimeout(
+          config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
+          RECOVERY_OFFER_TIMEOUT_MS
+        );
+        if (!choice) {
+          console.warn(
+            `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so wallet creation continued without offering a recovery file. The wallet is fully created and enrolled; the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
+          );
+        } else if (choice.wants) {
           const file = await buildRecoveryShareFile(
             shareSet.recovery,
             choice.password,
@@ -3639,17 +3738,6 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
       }
     }
-    if (serverAssistedRecovery) {
-      try {
-        const tee = new TeeClient(teeUrl);
-        await tee.enrolAuthShare(jwt, shareSet.recovery);
-      } catch (e) {
-        console.warn(
-          "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device.",
-          e
-        );
-      }
-    }
     zeroize(shareSet.recovery);
     return addresses;
   }
@@ -3675,6 +3763,9 @@ async function createDecaneConnect(config) {
             }
             return addrs;
           }
+          console.warn(
+            "decane-connect-kit: this wallet is not enrolled for server-assisted provisioning (/signer/provision returned 409 not_enrolled), so a device share cannot be issued from the JWT alone. Falling back to passkey sync, then the recovery file."
+          );
         } catch (e) {
           console.warn(
             "decane-connect-kit: server-assisted provisioning unavailable; falling back to passkey/recovery-file recovery.",
@@ -3735,6 +3826,7 @@ async function createDecaneConnect(config) {
       }
       throw e;
     }
+    void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -7186,6 +7278,7 @@ export {
   NewDeviceError,
   OriginNotAllowedError,
   PromptPinNotConfiguredError,
+  ProvisioningTimeoutError,
   ReconnectRequiredError,
   RecoveryFailedError,
   RecoveryWalletMismatchError,