decane-connect-kit 2.7.2 → 2.7.4

package/dist/index.cjs

@@ -44,6 +44,7 @@ __export(errors_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -55,7 +56,7 @@ __export(errors_exports, {
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -126,6 +127,11 @@ var init_errors = __esm({
         super("SHARE_CORRUPTED", "Stored device share is corrupted");
       }
     };
+    ProvisioningTimeoutError = class extends DecaneConnectError {
+      constructor(step) {
+        super("PROVISIONING_TIMEOUT", `Wallet setup timed out while ${step}. Check your connection and try again.`, true);
+      }
+    };
     NewDeviceError = class extends DecaneConnectError {
       constructor() {
         super("NEW_DEVICE", "No device share found. Re-authenticate to set up this device.");
@@ -204,6 +210,7 @@ __export(index_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -2007,6 +2014,7 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError
 };
+var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
     this.baseUrl = baseUrl;
@@ -2015,9 +2023,12 @@ var ApiClient = class {
   }
   async _request(path, init) {
     let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
       res = await fetch(`${this.baseUrl}${path}`, {
         ...init,
+        signal: controller.signal,
         headers: {
           "Content-Type": "application/json",
           "X-API-Key": this.apiKey,
@@ -2027,6 +2038,8 @@ var ApiClient = class {
       });
     } catch {
       throw new NetworkError();
+    } finally {
+      clearTimeout(timer);
     }
     if (res.status === 404 && init?.allow404) return null;
     if (!res.ok) {
@@ -2329,6 +2342,36 @@ function bytesToBase64(b) {
 function base64ToBytes(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
+var TEE_TIMEOUT_MS = 3e4;
+async function teeFetch(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TEE_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var ATTESTATION_TTL_MS = 10 * 6e4;
+var attestationCache = /* @__PURE__ */ new Map();
+function attestOnce(teeUrl, verify) {
+  const hit = attestationCache.get(teeUrl);
+  if (hit && Date.now() - hit.at < ATTESTATION_TTL_MS) return hit.promise;
+  const promise = verify().catch((e) => {
+    attestationCache.delete(teeUrl);
+    throw e;
+  });
+  attestationCache.set(teeUrl, { at: Date.now(), promise });
+  return promise;
+}
+function prewarmAttestation(teeUrl) {
+  void attestOnce(teeUrl, async () => {
+    const nonce = crypto.getRandomValues(new Uint8Array(16));
+    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+    await verifyTeeAttestation(teeUrl, nonceHex);
+  }).catch(() => {
+  });
+}
 var TeeClient = class {
   constructor(teeUrl) {
     this.teeUrl = teeUrl;
@@ -2370,9 +2413,11 @@ var TeeClient = class {
   }
   async ensureAttested() {
     if (this.attested) return;
-    const nonce = crypto.getRandomValues(new Uint8Array(16));
-    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
-    await verifyTeeAttestation(this.teeUrl, nonceHex);
+    await attestOnce(this.teeUrl, async () => {
+      const nonce = crypto.getRandomValues(new Uint8Array(16));
+      const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+      await verifyTeeAttestation(this.teeUrl, nonceHex);
+    });
     this.attested = true;
   }
   /**
@@ -2384,7 +2429,7 @@ var TeeClient = class {
    */
   async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/session`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -2416,7 +2461,7 @@ var TeeClient = class {
    */
   async recoverWithShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/recover`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/recover`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ recoveryShare: bytesToBase64(recoveryShare) })
@@ -2441,7 +2486,7 @@ var TeeClient = class {
    * require proof of fresh authenticator possession, not just an active session.
    */
   async completeAssertion(jwt) {
-    const res = await fetch(`${this.teeUrl}/signer/assertion-challenge`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/assertion-challenge`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
@@ -2470,7 +2515,7 @@ var TeeClient = class {
    */
   async enrolAuthShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/auth-share`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/auth-share`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ share: bytesToBase64(recoveryShare) })
@@ -2493,7 +2538,7 @@ var TeeClient = class {
    */
   async provisionDeviceShare(jwt) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/provision`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/provision`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
     });
@@ -2511,7 +2556,7 @@ var TeeClient = class {
   async rotateShares(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/rotate`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/rotate`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2528,7 +2573,7 @@ var TeeClient = class {
   async exportPortableBackup(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/export-portable`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/export-portable`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2558,7 +2603,7 @@ var TeeClient = class {
       if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
       gate = await this.completeAssertion(jwt);
     }
-    const res = await fetch(`${this.teeUrl}/signer/sign`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -3499,6 +3544,64 @@ async function createDecaneConnect(config) {
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
   const serverAssistedRecovery = true;
+  const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
+  const selfHealAttempted = /* @__PURE__ */ new Set();
+  async function selfHealEnrolment(userId, jwt, share) {
+    try {
+      if (selfHealAttempted.has(userId)) return;
+      const status = await api.getRecoveryStatus(jwt);
+      if (status.enrolled !== false) return;
+      selfHealAttempted.add(userId);
+      await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+    } catch (e) {
+      events.emit("enrolment-failed");
+      console.warn(
+        "decane-connect-kit: this wallet is not enrolled for server-assisted recovery and the automatic repair failed. It still works on this device, but a new device will need a passkey backup or a recovery file. The SDK will try again on the next unlock.",
+        e
+      );
+    } finally {
+      zeroize(share);
+    }
+  }
+  async function enrolInBackground(jwt, share) {
+    try {
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+          return;
+        } catch (e) {
+          if (attempt === 2) {
+            events.emit("enrolment-failed");
+            console.warn(
+              "decane-connect-kit: could not enrol this wallet for server-assisted recovery. The wallet is fine and fully usable; it will be re-enrolled automatically on the next unlock. Until then a brand-new device would need a passkey backup or a recovery file.",
+              e
+            );
+          }
+        }
+      }
+    } finally {
+      zeroize(share);
+    }
+  }
+  const PROVISIONING_BUDGET_MS = 9e4;
+  function withDeadline(promise, ms, step) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ProvisioningTimeoutError(step)), Math.max(0, ms));
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
+  function withTimeout(promise, ms) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
   const SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
     if (!persistSession) return;
@@ -3610,6 +3713,7 @@ async function createDecaneConnect(config) {
     }
   }
   async function firstTimeSetup(userId, jwt) {
+    prewarmAttestation(teeUrl);
     let unlockMethod;
     let wrappingKey;
     let meta = {};
@@ -3639,6 +3743,8 @@ async function createDecaneConnect(config) {
       ({ wrappingKey, meta } = await pinSetup());
       unlockMethod = "pin";
     }
+    const provisioningStartedAt = Date.now();
+    const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
     const master = generateMaster();
     let shareSet;
     let evmAddress;
@@ -3670,7 +3776,7 @@ async function createDecaneConnect(config) {
       version: 1
     });
     const serverIv = generateRandomBytes(12);
-    await api.putShare(jwt, {
+    await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
       iv: serverIv,
       wrappedShareMeta: {
@@ -3680,7 +3786,7 @@ async function createDecaneConnect(config) {
       evmAddress,
       solanaAddress,
       tronAddress
-    });
+    }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
@@ -3696,7 +3802,11 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: wrapped share backup failed; user can retry from settings.", e);
       }
     }
-    const confirmed = await session.start(shareSet.device, jwt, addresses);
+    const confirmed = await withDeadline(
+      session.start(shareSet.device, jwt, addresses),
+      remainingBudget(),
+      "opening the signing session"
+    );
     zeroize(shareSet.device);
     if (confirmed.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -3707,42 +3817,49 @@ async function createDecaneConnect(config) {
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
     if (serverAssistedRecovery) {
-      for (let attempt = 1; attempt <= 2; attempt++) {
-        try {
-          const tee = new TeeClient(teeUrl);
-          await tee.enrolAuthShare(jwt, shareSet.recovery);
-          break;
-        } catch (e) {
-          if (attempt === 2) {
-            console.warn(
-              "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device. This wallet will get a 409 not_enrolled from /signer/provision until it is re-enrolled.",
-              e
-            );
-          }
-        }
-      }
+      void enrolInBackground(jwt, new Uint8Array(shareSet.recovery));
     }
-    if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
-      try {
-        const choice = await config.onRecoveryShareOffer({ evmAddress, solanaAddress });
-        if (choice.wants) {
-          const file = await buildRecoveryShareFile(
-            shareSet.recovery,
-            choice.password,
-            addresses,
-            shareSet.version,
-            choice.passwordHint
-          );
-          await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
-          await api.markRecoveryShareSaved(jwt);
-        }
-      } catch (e) {
-        console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
-      }
+    if (config.offerRecoveryAtSignup === true && config.onRecoveryShareOffer) {
+      void offerRecoveryShare(
+        jwt,
+        new Uint8Array(shareSet.recovery),
+        { ...addresses },
+        shareSet.version,
+        evmAddress,
+        solanaAddress
+      );
     }
     zeroize(shareSet.recovery);
     return addresses;
   }
+  async function offerRecoveryShare(jwt, recoveryShare, addresses, shareSetVersion, evmAddress, solanaAddress) {
+    try {
+      const choice = await withTimeout(
+        config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
+        RECOVERY_OFFER_TIMEOUT_MS
+      );
+      if (!choice) {
+        console.warn(
+          `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so no recovery file was offered. The wallet is unaffected \u2014 it was already created and enrolled \u2014 and the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
+        );
+        return;
+      }
+      if (!choice.wants) return;
+      const file = await buildRecoveryShareFile(
+        recoveryShare,
+        choice.password,
+        addresses,
+        shareSetVersion,
+        choice.passwordHint
+      );
+      await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
+      await api.markRecoveryShareSaved(jwt);
+    } catch (e) {
+      console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
+    } finally {
+      zeroize(recoveryShare);
+    }
+  }
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
@@ -3828,6 +3945,7 @@ async function createDecaneConnect(config) {
       }
       throw e;
     }
+    void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -7273,6 +7391,7 @@ function useSignTypedData() {
   NewDeviceError,
   OriginNotAllowedError,
   PromptPinNotConfiguredError,
+  ProvisioningTimeoutError,
   ReconnectRequiredError,
   RecoveryFailedError,
   RecoveryWalletMismatchError,