decane-connect-kit 2.7.3 → 2.7.4

package/dist/index.d.cts

@@ -417,7 +417,22 @@ interface DecaneConnectConfig {
      * page load (stricter, but the reload friction that motivated this returns).
      */
     persistSession?: boolean;
-    /** Offer to save a recovery-share file at signup. Default true. Never blocks onboarding. */
+    /**
+     * Offer to save a recovery-share file at signup. **Default false** since
+     * 2.7.4 — opt in explicitly with `true`.
+     *
+     * The offer existed because a new device could not otherwise get a device
+     * share. Server-assisted provisioning now covers that case: every wallet is
+     * enrolled at creation, un-enrolled wallets repair themselves on the next
+     * unlock, and a returning user is provisioned from their sign-in alone. For
+     * almost every app the dialog is now a password prompt during onboarding that
+     * buys nothing, so it is off unless asked for.
+     *
+     * Recovery files themselves are unchanged and still work — `rotateShares()`
+     * issues one on demand, and `promptForRecoveryFile` still accepts one during
+     * recovery. Turn this back on if you want users to hold an offline fallback
+     * that does not depend on Decane being reachable.
+     */
     offerRecoveryAtSignup?: boolean;
     /** Ask the user whether they want a recovery share and, if so, a password for it. */
     onRecoveryShareOffer?: (addresses: {

package/dist/index.d.ts

@@ -417,7 +417,22 @@ interface DecaneConnectConfig {
      * page load (stricter, but the reload friction that motivated this returns).
      */
     persistSession?: boolean;
-    /** Offer to save a recovery-share file at signup. Default true. Never blocks onboarding. */
+    /**
+     * Offer to save a recovery-share file at signup. **Default false** since
+     * 2.7.4 — opt in explicitly with `true`.
+     *
+     * The offer existed because a new device could not otherwise get a device
+     * share. Server-assisted provisioning now covers that case: every wallet is
+     * enrolled at creation, un-enrolled wallets repair themselves on the next
+     * unlock, and a returning user is provisioned from their sign-in alone. For
+     * almost every app the dialog is now a password prompt during onboarding that
+     * buys nothing, so it is off unless asked for.
+     *
+     * Recovery files themselves are unchanged and still work — `rotateShares()`
+     * issues one on demand, and `promptForRecoveryFile` still accepts one during
+     * recovery. Turn this back on if you want users to hold an offline fallback
+     * that does not depend on Decane being reachable.
+     */
     offerRecoveryAtSignup?: boolean;
     /** Ask the user whether they want a recovery share and, if so, a password for it. */
     onRecoveryShareOffer?: (addresses: {

package/dist/index.js

@@ -2276,6 +2276,26 @@ async function teeFetch(url, init) {
     clearTimeout(timer);
   }
 }
+var ATTESTATION_TTL_MS = 10 * 6e4;
+var attestationCache = /* @__PURE__ */ new Map();
+function attestOnce(teeUrl, verify) {
+  const hit = attestationCache.get(teeUrl);
+  if (hit && Date.now() - hit.at < ATTESTATION_TTL_MS) return hit.promise;
+  const promise = verify().catch((e) => {
+    attestationCache.delete(teeUrl);
+    throw e;
+  });
+  attestationCache.set(teeUrl, { at: Date.now(), promise });
+  return promise;
+}
+function prewarmAttestation(teeUrl) {
+  void attestOnce(teeUrl, async () => {
+    const nonce = crypto.getRandomValues(new Uint8Array(16));
+    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+    await verifyTeeAttestation(teeUrl, nonceHex);
+  }).catch(() => {
+  });
+}
 var TeeClient = class {
   constructor(teeUrl) {
     this.teeUrl = teeUrl;
@@ -2317,9 +2337,11 @@ var TeeClient = class {
   }
   async ensureAttested() {
     if (this.attested) return;
-    const nonce = crypto.getRandomValues(new Uint8Array(16));
-    const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
-    await verifyTeeAttestation(this.teeUrl, nonceHex);
+    await attestOnce(this.teeUrl, async () => {
+      const nonce = crypto.getRandomValues(new Uint8Array(16));
+      const nonceHex = Array.from(nonce).map((b) => b.toString(16).padStart(2, "0")).join("");
+      await verifyTeeAttestation(this.teeUrl, nonceHex);
+    });
     this.attested = true;
   }
   /**
@@ -3465,6 +3487,26 @@ async function createDecaneConnect(config) {
       zeroize(share);
     }
   }
+  async function enrolInBackground(jwt, share) {
+    try {
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          await new TeeClient(teeUrl).enrolAuthShare(jwt, share);
+          return;
+        } catch (e) {
+          if (attempt === 2) {
+            events.emit("enrolment-failed");
+            console.warn(
+              "decane-connect-kit: could not enrol this wallet for server-assisted recovery. The wallet is fine and fully usable; it will be re-enrolled automatically on the next unlock. Until then a brand-new device would need a passkey backup or a recovery file.",
+              e
+            );
+          }
+        }
+      }
+    } finally {
+      zeroize(share);
+    }
+  }
   const PROVISIONING_BUDGET_MS = 9e4;
   function withDeadline(promise, ms, step) {
     let timer;
@@ -3595,6 +3637,7 @@ async function createDecaneConnect(config) {
     }
   }
   async function firstTimeSetup(userId, jwt) {
+    prewarmAttestation(teeUrl);
     let unlockMethod;
     let wrappingKey;
     let meta = {};
@@ -3698,49 +3741,49 @@ async function createDecaneConnect(config) {
     addresses.solana = solanaAddress = confirmed.solana;
     addresses.tron = tronAddress = confirmed.tron ?? evmToTronAddress2(confirmed.evm);
     if (serverAssistedRecovery) {
-      for (let attempt = 1; attempt <= 2; attempt++) {
-        try {
-          const tee = new TeeClient(teeUrl);
-          await tee.enrolAuthShare(jwt, shareSet.recovery);
-          break;
-        } catch (e) {
-          if (attempt === 2) {
-            console.warn(
-              "decane-connect-kit: could not enrol this wallet for server-assisted recovery; a recovery file will be required on a new device. This wallet will get a 409 not_enrolled from /signer/provision until it is re-enrolled.",
-              e
-            );
-          }
-        }
-      }
+      void enrolInBackground(jwt, new Uint8Array(shareSet.recovery));
     }
-    if (config.offerRecoveryAtSignup !== false && config.onRecoveryShareOffer) {
-      try {
-        const choice = await withTimeout(
-          config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
-          RECOVERY_OFFER_TIMEOUT_MS
-        );
-        if (!choice) {
-          console.warn(
-            `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so wallet creation continued without offering a recovery file. The wallet is fully created and enrolled; the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
-          );
-        } else if (choice.wants) {
-          const file = await buildRecoveryShareFile(
-            shareSet.recovery,
-            choice.password,
-            addresses,
-            shareSet.version,
-            choice.passwordHint
-          );
-          await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
-          await api.markRecoveryShareSaved(jwt);
-        }
-      } catch (e) {
-        console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
-      }
+    if (config.offerRecoveryAtSignup === true && config.onRecoveryShareOffer) {
+      void offerRecoveryShare(
+        jwt,
+        new Uint8Array(shareSet.recovery),
+        { ...addresses },
+        shareSet.version,
+        evmAddress,
+        solanaAddress
+      );
     }
     zeroize(shareSet.recovery);
     return addresses;
   }
+  async function offerRecoveryShare(jwt, recoveryShare, addresses, shareSetVersion, evmAddress, solanaAddress) {
+    try {
+      const choice = await withTimeout(
+        config.onRecoveryShareOffer({ evmAddress, solanaAddress }),
+        RECOVERY_OFFER_TIMEOUT_MS
+      );
+      if (!choice) {
+        console.warn(
+          `decane-connect-kit: onRecoveryShareOffer did not settle within ${RECOVERY_OFFER_TIMEOUT_MS / 6e4} minutes, so no recovery file was offered. The wallet is unaffected \u2014 it was already created and enrolled \u2014 and the user can generate a recovery share later via rotateShares(). Check that your handler always resolves or rejects.`
+        );
+        return;
+      }
+      if (!choice.wants) return;
+      const file = await buildRecoveryShareFile(
+        recoveryShare,
+        choice.password,
+        addresses,
+        shareSetVersion,
+        choice.passwordHint
+      );
+      await config.onRecoveryFileReady?.(file, recoveryShareFileName(evmAddress));
+      await api.markRecoveryShareSaved(jwt);
+    } catch (e) {
+      console.warn("decane-connect-kit: recovery share offer failed or was skipped.", e);
+    } finally {
+      zeroize(recoveryShare);
+    }
+  }
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;