decane-connect-kit 2.7.2 → 2.7.4

package/dist/index.d.cts

@@ -256,6 +256,13 @@ declare class ApiClient {
         savedAt: string | null;
         nagged: boolean;
         shareSetVersion: number;
+        /**
+         * Whether this wallet is enrolled for server-assisted provisioning, i.e.
+         * whether a new device can be given a device share from login alone.
+         * Optional because backends older than this field simply omit it — treat
+         * `undefined` as "unknown", never as "not enrolled".
+         */
+        enrolled?: boolean;
     }>;
     dismissRecoveryNag(jwt: string): Promise<void>;
 }
@@ -410,7 +417,22 @@ interface DecaneConnectConfig {
      * page load (stricter, but the reload friction that motivated this returns).
      */
     persistSession?: boolean;
-    /** Offer to save a recovery-share file at signup. Default true. Never blocks onboarding. */
+    /**
+     * Offer to save a recovery-share file at signup. **Default false** since
+     * 2.7.4 — opt in explicitly with `true`.
+     *
+     * The offer existed because a new device could not otherwise get a device
+     * share. Server-assisted provisioning now covers that case: every wallet is
+     * enrolled at creation, un-enrolled wallets repair themselves on the next
+     * unlock, and a returning user is provisioned from their sign-in alone. For
+     * almost every app the dialog is now a password prompt during onboarding that
+     * buys nothing, so it is off unless asked for.
+     *
+     * Recovery files themselves are unchanged and still work — `rotateShares()`
+     * issues one on demand, and `promptForRecoveryFile` still accepts one during
+     * recovery. Turn this back on if you want users to hold an offline fallback
+     * that does not depend on Decane being reachable.
+     */
     offerRecoveryAtSignup?: boolean;
     /** Ask the user whether they want a recovery share and, if so, a password for it. */
     onRecoveryShareOffer?: (addresses: {
@@ -521,7 +543,16 @@ interface SignTypedDataRequest {
     message: Record<string, unknown>;
     primaryType?: string;
 }
-type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking';
+type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking'
+/**
+ * Emitted when this wallet could not be enrolled for server-assisted
+ * recovery. Not fatal — the wallet works — but until it is enrolled the user
+ * cannot get a device share from login alone, so a future new device will
+ * need a passkey backup or a recovery file. The SDK retries automatically on
+ * later unlocks; surface or report this if you want visibility rather than a
+ * console line.
+ */
+ | 'enrolment-failed';
 interface DecaneConnect {
     connect(): Promise<ConnectResult>;
     connectWithGoogle(): Promise<ConnectResult>;
@@ -808,6 +839,20 @@ declare class NetworkError extends DecaneConnectError {
 declare class ShareCorruptedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * Wallet creation exceeded its time budget.
+ *
+ * Provisioning is bounded so a stalled network or an unresponsive enclave
+ * surfaces as an error the app can act on, rather than a signup that appears to
+ * hang forever. The budget covers only the SDK's own work — key generation,
+ * share storage, opening the signer session — never time spent waiting on the
+ * user (a passkey prompt, choosing a PIN, the recovery-file dialog).
+ *
+ * Retryable: nothing is left half-created that a later sign-in cannot complete.
+ */
+declare class ProvisioningTimeoutError extends DecaneConnectError {
+    constructor(step: string);
+}
 declare class NewDeviceError extends DecaneConnectError {
     constructor();
 }
@@ -1238,4 +1283,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.d.ts

@@ -256,6 +256,13 @@ declare class ApiClient {
         savedAt: string | null;
         nagged: boolean;
         shareSetVersion: number;
+        /**
+         * Whether this wallet is enrolled for server-assisted provisioning, i.e.
+         * whether a new device can be given a device share from login alone.
+         * Optional because backends older than this field simply omit it — treat
+         * `undefined` as "unknown", never as "not enrolled".
+         */
+        enrolled?: boolean;
     }>;
     dismissRecoveryNag(jwt: string): Promise<void>;
 }
@@ -410,7 +417,22 @@ interface DecaneConnectConfig {
      * page load (stricter, but the reload friction that motivated this returns).
      */
     persistSession?: boolean;
-    /** Offer to save a recovery-share file at signup. Default true. Never blocks onboarding. */
+    /**
+     * Offer to save a recovery-share file at signup. **Default false** since
+     * 2.7.4 — opt in explicitly with `true`.
+     *
+     * The offer existed because a new device could not otherwise get a device
+     * share. Server-assisted provisioning now covers that case: every wallet is
+     * enrolled at creation, un-enrolled wallets repair themselves on the next
+     * unlock, and a returning user is provisioned from their sign-in alone. For
+     * almost every app the dialog is now a password prompt during onboarding that
+     * buys nothing, so it is off unless asked for.
+     *
+     * Recovery files themselves are unchanged and still work — `rotateShares()`
+     * issues one on demand, and `promptForRecoveryFile` still accepts one during
+     * recovery. Turn this back on if you want users to hold an offline fallback
+     * that does not depend on Decane being reachable.
+     */
     offerRecoveryAtSignup?: boolean;
     /** Ask the user whether they want a recovery share and, if so, a password for it. */
     onRecoveryShareOffer?: (addresses: {
@@ -521,7 +543,16 @@ interface SignTypedDataRequest {
     message: Record<string, unknown>;
     primaryType?: string;
 }
-type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking';
+type SdkEvent = 'connected' | 'disconnected' | 'session-expired' | 'session-started' | 'wallet-creating' | 'wallet-unlocking'
+/**
+ * Emitted when this wallet could not be enrolled for server-assisted
+ * recovery. Not fatal — the wallet works — but until it is enrolled the user
+ * cannot get a device share from login alone, so a future new device will
+ * need a passkey backup or a recovery file. The SDK retries automatically on
+ * later unlocks; surface or report this if you want visibility rather than a
+ * console line.
+ */
+ | 'enrolment-failed';
 interface DecaneConnect {
     connect(): Promise<ConnectResult>;
     connectWithGoogle(): Promise<ConnectResult>;
@@ -808,6 +839,20 @@ declare class NetworkError extends DecaneConnectError {
 declare class ShareCorruptedError extends DecaneConnectError {
     constructor();
 }
+/**
+ * Wallet creation exceeded its time budget.
+ *
+ * Provisioning is bounded so a stalled network or an unresponsive enclave
+ * surfaces as an error the app can act on, rather than a signup that appears to
+ * hang forever. The budget covers only the SDK's own work — key generation,
+ * share storage, opening the signer session — never time spent waiting on the
+ * user (a passkey prompt, choosing a PIN, the recovery-file dialog).
+ *
+ * Retryable: nothing is left half-created that a later sign-in cannot complete.
+ */
+declare class ProvisioningTimeoutError extends DecaneConnectError {
+    constructor(step: string);
+}
 declare class NewDeviceError extends DecaneConnectError {
     constructor();
 }
@@ -1238,4 +1283,4 @@ declare function useSignTypedData(): {
     reset: () => void;
 };
 
-export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };
+export { type ActiveSession, AttestationError, type AuthProfile, type AuthResult, BUILT_IN_CHAINS, type BalanceResult, type CAIP25Method, type CAIP25SessionRequest, type CAIP25SessionResult, CHAINS, CallSequenceError, type Chain, type ChainDescriptor, type ChainId, type ChainScope, type ChainSupport, type ChainType, type ConnectMode, type ConnectResult, type DecaneConfig, type DecaneConnect, type DecaneConnectConfig, DecaneConnectError, DecaneError, DecaneErrorCode, DecaneKit, DecaneLogo, DecaneMark, type DecaneProvider, DecaneWordmark, type Eip1193Provider, type EthereumProviderOptions, ExportNotAuthorizedError, InvalidApiKeyError, InvalidPinError, InvalidRecoveryFileError, type KingsChatTokens, NetworkError, NewDeviceError, OriginNotAllowedError, type PortableBackup, PromptPinNotConfiguredError, ProvisioningTimeoutError, ReconnectRequiredError, type RecordTransactionInput, RecoveryFailedError, type RecoveryProgress, type RecoveryShareFile, RecoveryWalletMismatchError, type SdkEvent, type SendTransactionRequest, SessionExpiredError, ShareCorruptedError, type SignMessageRequest, type SignTypedDataRequest, type SignedAuthorization, type SocialAuthState, type SocialConfig, SocialWalletModal, StaleDeviceShareError, type Theme, type TransactionRecord, type TxParams, type UnifiedWalletAccount, UnlockRequiredError, UserCancelledError, WalletSelector, WebAuthnNotSupportedError, type WrappedShareMeta, WrongPasswordError, createDecane, createDecaneConnect, createEthereumProvider, loginWithKingsChatPopup, startEmailAuth, useChainSwitch, useDecane, useEthereumProvider, useSendTransaction, useSignMessage, useSignTypedData, useSocialAuth, useSocialBalance, useSocialWallet, useWalletSelector, verifyEmailCode };

package/dist/index.js

@@ -22,6 +22,7 @@ __export(errors_exports, {
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
   PromptPinNotConfiguredError: () => PromptPinNotConfiguredError,
+  ProvisioningTimeoutError: () => ProvisioningTimeoutError,
   ReconnectRequiredError: () => ReconnectRequiredError,
   RecoveryFailedError: () => RecoveryFailedError,
   RecoveryWalletMismatchError: () => RecoveryWalletMismatchError,
@@ -33,7 +34,7 @@ __export(errors_exports, {
   WebAuthnNotSupportedError: () => WebAuthnNotSupportedError,
   WrongPasswordError: () => WrongPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -104,6 +105,11 @@ var init_errors = __esm({
         super("SHARE_CORRUPTED", "Stored device share is corrupted");
       }
     };
+    ProvisioningTimeoutError = class extends DecaneConnectError {
+      constructor(step) {
+        super("PROVISIONING_TIMEOUT", `Wallet setup timed out while ${step}. Check your connection and try again.`, true);
+      }
+    };
     NewDeviceError = class extends DecaneConnectError {
       constructor() {
         super("NEW_DEVICE", "No device share found. Re-authenticate to set up this device.");
@@ -1932,6 +1938,7 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError
 };
+var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
     this.baseUrl = baseUrl;
@@ -1940,9 +1947,12 @@ var ApiClient = class {
   }
   async _request(path, init) {
     let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
       res = await fetch(`${this.baseUrl}${path}`, {
         ...init,
+        signal: controller.signal,
         headers: {
           "Content-Type": "application/json",
           "X-API-Key": this.apiKey,
@@ -1952,6 +1962,8 @@ var ApiClient = class {
       });
     } catch {
       throw new NetworkError();
+    } finally {
+      clearTimeout(timer);
     }
     if (res.status === 404 && init?.allow404) return null;
     if (!res.ok) {
@@ -2254,6 +2266,36 @@ function bytesToBase64(b) {
 function base64ToBytes(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
+var TEE_TIMEOUT_MS = 3e4;
+async function teeFetch(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TEE_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var ATTESTATION_TTL_MS = 10 * 6e4;
+var attestationCache = /* @__PURE__ */ new Map();
+function attestOnce(teeUrl, verify) {
+  const hit = attestationCache.get(teeUrl);
+  if (hit && Date.now() - hit.at < ATTESTATION_TTL_MS) return hit.promise;
+  const promise = verify().catch((e) => {
+    attestationCache.delete(teeUrl);
+    throw e;
+  });
+  attestationCache.set(teeUrl, { at: Date.now(), promise });
+  return promise;
+}
+function prewarmAttestation(teeUrl) {
+  void attestOnce(teeUrl, async () => {
+    const nonce = crypto.getRandomValues(new Uint8Array(16));
+    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+    await verifyTeeAttestation(teeUrl, nonceHex);
+  }).catch(() => {
+  });
+}
 var TeeClient = class {
   constructor(teeUrl) {
     this.teeUrl = teeUrl;
@@ -2295,9 +2337,11 @@ var TeeClient = class {
   }
   async ensureAttested() {
     if (this.attested) return;
-    const nonce = crypto.getRandomValues(new Uint8Array(16));
-    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
-    await verifyTeeAttestation(this.teeUrl, nonceHex);
+    await attestOnce(this.teeUrl, async () => {
+      const nonce = crypto.getRandomValues(new Uint8Array(16));
+      const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+      await verifyTeeAttestation(this.teeUrl, nonceHex);
+    });
     this.attested = true;
   }
   /**
@@ -2309,7 +2353,7 @@ var TeeClient = class {
    */
   async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/session`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -2341,7 +2385,7 @@ var TeeClient = class {
    */
   async recoverWithShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/recover`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/recover`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ recoveryShare: bytesToBase64(recoveryShare) })
@@ -2366,7 +2410,7 @@ var TeeClient = class {
    * require proof of fresh authenticator possession, not just an active session.
    */
   async completeAssertion(jwt) {
-    const res = await fetch(`${this.teeUrl}/signer/assertion-challenge`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/assertion-challenge`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
@@ -2395,7 +2439,7 @@ var TeeClient = class {
    */
   async enrolAuthShare(jwt, recoveryShare) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/auth-share`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/auth-share`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ share: bytesToBase64(recoveryShare) })
@@ -2418,7 +2462,7 @@ var TeeClient = class {
    */
   async provisionDeviceShare(jwt) {
     await this.ensureAttested();
-    const res = await fetch(`${this.teeUrl}/signer/provision`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/provision`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
     });
@@ -2436,7 +2480,7 @@ var TeeClient = class {
   async rotateShares(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/rotate`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/rotate`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2453,7 +2497,7 @@ var TeeClient = class {
   async exportPortableBackup(jwt) {
     if (!this.handle) throw new Error("no session");
     const { challengeId, assertion } = await this.completeAssertion(jwt);
-    const res = await fetch(`${this.teeUrl}/signer/export-portable`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/export-portable`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ handle: this.handle, challengeId, assertion, origin: window.location.origin })
@@ -2483,7 +2527,7 @@ var TeeClient = class {
       if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
       gate = await this.completeAssertion(jwt);
     }
-    const res = await fetch(`${this.teeUrl}/signer/sign`, {
+    const res = await teeFetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -3424,6 +3468,64 @@ async function createDecaneConnect(config) {
   let ethProvider = null;
   const persistSession = config.persistSession !== false;
   const serverAssistedRecovery = true;
+  const RECOVERY_OFFER_TIMEOUT_MS = 5 * 6e4;
+  const selfHealAttempted = /* @__PURE__ */ new Set();
+  async function selfHealEnrolment(userId, jwt, share) {
+    try {
+      if (selfHealAttempted.has(userId)) return;
+      const status = await api.getRecoveryStatus(jwt);
+      if (status.enrolled !== false) return;
+      selfHealAttempted.add(userId);
+      await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+    } catch (e) {
+      events.emit("enrolment-failed");
+      console.warn(
+        "decane-connect-kit: this wallet is not enrolled for server-assisted recovery and the automatic repair failed. It still works on this device, but a new device will need a passkey backup or a recovery file. The SDK will try again on the next unlock.",
+        e
+      );
+    } finally {
+      zeroize(share);
+    }
+  }
+  async function enrolInBackground(jwt, share) {
+    try {
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+          return;
+        } catch (e) {
+          if (attempt === 2) {
+            events.emit("enrolment-failed");
+            console.warn(
+              "decane-connect-kit: could not enrol this wallet for server-assisted recovery. The wallet is fine and fully usable; it will be re-enrolled automatically on the next unlock. Until then a brand-new device would need a passkey backup or a recovery file.",
+              e
+            );
+          }
+        }
+      }
+    } finally {
+      zeroize(share);
+    }
+  }
+  const PROVISIONING_BUDGET_MS = 9e4;
+  function withDeadline(promise, ms, step) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ProvisioningTimeoutError(step)), Math.max(0, ms));
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
+  function withTimeout(promise, ms) {
+    let timer;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+      })
+    ]).finally(() => clearTimeout(timer));
+  }
   const SESSION_KEY = sessionPersistKey(config.apiKey);
   function persistLiveSession() {
     if (!persistSession) return;
@@ -3535,6 +3637,7 @@ async function createDecaneConnect(config) {
     }
   }
   async function firstTimeSetup(userId, jwt) {
+    prewarmAttestation(teeUrl);
     let unlockMethod;
     let wrappingKey;
     let meta = {};
@@ -3564,6 +3667,8 @@ async function createDecaneConnect(config) {
       ({ wrappingKey, meta } = await pinSetup());
       unlockMethod = "pin";
     }
+    const provisioningStartedAt = Date.now();
+    const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
     const master = generateMaster();
     let shareSet;
     let evmAddress;
@@ -3595,7 +3700,7 @@ async function createDecaneConnect(config) {
       version: 1
     });
     const serverIv = generateRandomBytes(12);
-    await api.putShare(jwt, {
+    await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
       iv: serverIv,
       wrappedShareMeta: {
@@ -3605,7 +3710,7 @@ async function createDecaneConnect(config) {
       evmAddress,
       solanaAddress,
       tronAddress
-    });
+    }), remainingBudget(), "storing your wallet");
     zeroize(shareSet.server);
     const addresses = { evm: evmAddress, solana: solanaAddress, tron: tronAddress };
     if (unlockMethod === "passkey" && meta.credentialId && meta.prfSalt) {
@@ -3621,7 +3726,11 @@ async function createDecaneConnect(config) {
         console.warn("decane-connect-kit: wrapped share backup failed; user can retry from settings.", e);
       }
     }
-    const confirmed = await session.start(shareSet.device, jwt, addresses);
+    const confirmed = await withDeadline(
+      session.start(shareSet.device, jwt, addresses),
+      remainingBudget(),
+      "opening the signing session"
+    );
     zeroize(shareSet.device);
     if (confirmed.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -3632,42 +3741,49 @@ async function createDecaneConnect(config) {
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
     if (serverAssistedRecovery) {
-      for (let attempt = 1; attempt <= 2; attempt++) {
-        try {
-          const tee = new TeeClient(teeUrl);
-          await tee.enrolAuthShare(jwt, shareSet.recovery);
-          break;
-        } catch (e) {
-          if (attempt === 2) {
-            console.warn(
-              "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device. This wallet will get a 409 not_enrolled from /signer/provision until it is re-enrolled.",
-              e
-            );
-          }
-        }
-      }
+      void enrolInBackground(jwt, new Uint8Array(shareSet.recovery));
     }
-    if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
-      try {
-        const choice = await config.onRecoveryShareOffer({ evmAddress, solanaAddress });
-        if (choice.wants) {
-          const file = await buildRecoveryShareFile(
-            shareSet.recovery,
-            choice.password,
-            addresses,
-            shareSet.version,
-            choice.passwordHint
-          );
-          await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
-          await api.markRecoveryShareSaved(jwt);
-        }
-      } catch (e) {
-        console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
-      }
+    if (config.offerRecoveryAtSignup === true && config.onRecoveryShareOffer) {
+      void offerRecoveryShare(
+        jwt,
+        new Uint8Array(shareSet.recovery),
+        { ...addresses },
+        shareSet.version,
+        evmAddress,
+        solanaAddress
+      );
     }
     zeroize(shareSet.recovery);
     return addresses;
   }
+  async function offerRecoveryShare(jwt, recoveryShare, addresses, shareSetVersion, evmAddress, solanaAddress) {
+    try {
+      const choice = await withTimeout(
+        config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
+        RECOVERY_OFFER_TIMEOUT_MS
+      );
+      if (!choice) {
+        console.warn(
+          `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so no recovery file was offered. The wallet is unaffected \u2014 it was already created and enrolled \u2014 and the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
+        );
+        return;
+      }
+      if (!choice.wants) return;
+      const file = await buildRecoveryShareFile(
+        recoveryShare,
+        choice.password,
+        addresses,
+        shareSetVersion,
+        choice.passwordHint
+      );
+      await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
+      await api.markRecoveryShareSaved(jwt);
+    } catch (e) {
+      console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
+    } finally {
+      zeroize(recoveryShare);
+    }
+  }
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
@@ -3753,6 +3869,7 @@ async function createDecaneConnect(config) {
       }
       throw e;
     }
+    void selfHealEnrolment(userId, jwt, new Uint8Array(deviceShare));
     zeroize(deviceShare);
     if (recordedAddresses && recordedAddresses.evm.toLowerCase() !== addresses.evm.toLowerCase()) {
       console.warn(
@@ -7204,6 +7321,7 @@ export {
   NewDeviceError,
   OriginNotAllowedError,
   PromptPinNotConfiguredError,
+  ProvisioningTimeoutError,
   ReconnectRequiredError,
   RecoveryFailedError,
   RecoveryWalletMismatchError,