decane-connect-kit 2.1.0 → 2.2.1

package/dist/index.cjs

@@ -2267,6 +2267,12 @@ var TeeClient = class {
     this.teeUrl = teeUrl;
     this.handle = null;
     this.attested = false;
+    /** Mirrors what the signer confirmed for this session, not what we asked for. */
+    this.assertionPerSignature = false;
+  }
+  /** Whether this session actually got per-signature assertions. */
+  requiresAssertionPerSignature() {
+    return this.assertionPerSignature;
   }
   async ensureAttested() {
     if (this.attested) return;
@@ -2282,16 +2288,20 @@ var TeeClient = class {
    * couldn't derive them (older signer build, or a transient share-fetch
    * failure); callers fall back to the backend's addresses in that case.
    */
-  async openSession(deviceShare, jwt) {
+  async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
     const res = await fetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ deviceShare: bytesToBase64(deviceShare) })
+      body: JSON.stringify({
+        deviceShare: bytesToBase64(deviceShare),
+        requireAssertionPerSignature
+      })
     });
     if (!res.ok) throw new Error("session open failed");
     const body = await res.json();
     this.handle = body.handle;
+    this.assertionPerSignature = body.requireAssertionPerSignature === true;
     return body.addresses ?? null;
   }
   /**
@@ -2382,14 +2392,33 @@ var TeeClient = class {
   hasSession() {
     return this.handle !== null;
   }
-  async sign(req) {
+  /**
+   * `jwt` is only needed when this session requires per-signature assertions —
+   * it authenticates the challenge request. Passed per call rather than cached
+   * on the instance deliberately: the backend's JWTs are shorter-lived than the
+   * TEE session TTL, so a stored copy would go stale mid-session.
+   */
+  async sign(req, jwt) {
     if (!this.handle) throw new Error("no session");
+    let gate = null;
+    if (this.assertionPerSignature) {
+      if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
+      gate = await this.completeAssertion(jwt);
+    }
     const res = await fetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ handle: this.handle, ...req })
+      body: JSON.stringify({
+        handle: this.handle,
+        ...req,
+        ...gate ? { ...gate, origin: window.location.origin } : {}
+      })
     });
     if (res.status === 401) {
+      const body = await res.clone().json().catch(() => ({}));
+      if (body?.error === "assertion_required") {
+        throw new ExportNotAuthorizedError();
+      }
       this.handle = null;
       throw new SessionExpiredError();
     }
@@ -2412,10 +2441,11 @@ var TeeClient = class {
 // src/social/session.ts
 init_errors();
 var SessionManager = class {
-  constructor(events, durationMs, teeUrl) {
+  constructor(events, durationMs, teeUrl, requireAssertionPerSignature = false) {
     this.events = events;
     this.durationMs = durationMs;
     this.teeUrl = teeUrl;
+    this.requireAssertionPerSignature = requireAssertionPerSignature;
     this.tee = null;
     this.evmAddress = null;
     this.solanaAddress = null;
@@ -2435,7 +2465,18 @@ var SessionManager = class {
    */
   async start(deviceShare, jwt, fallback) {
     this.tee = new TeeClient(this.teeUrl);
-    const verified = await this.tee.openSession(deviceShare, jwt);
+    const verified = await this.tee.openSession(
+      deviceShare,
+      jwt,
+      this.requireAssertionPerSignature
+    );
+    if (this.requireAssertionPerSignature && !this.tee.requiresAssertionPerSignature()) {
+      void this.tee.closeSession();
+      this.tee = null;
+      throw new Error(
+        "requireAssertionPerSignature was requested but this signer does not support it \u2014 refusing to open a session with weaker authority than configured."
+      );
+    }
     const addresses = verified ?? fallback;
     if (!addresses) {
       this.tee = null;
@@ -2664,15 +2705,15 @@ async function verifyEmailCode(api, email, code) {
 
 // src/social/signers/evm.ts
 var import_ethers = require("ethers");
-async function signEvmTransaction(tee, chain, tx) {
+async function signEvmTransaction(tee, chain, tx, jwt) {
   const resolved = await (0, import_ethers.resolveProperties)(tx);
   const unsigned = import_ethers.Transaction.from(resolved).unsignedSerialized;
   const payload = unsigned.startsWith("0x") ? unsigned.slice(2) : unsigned;
   const txHash = (0, import_ethers.keccak256)("0x" + payload);
-  return tee.sign({ chain, kind: "transaction", payload, txHash });
+  return tee.sign({ chain, kind: "transaction", payload, txHash }, jwt);
 }
-async function signEvmMessage(tee, chain, message) {
-  return tee.sign({ chain, kind: "message", payload: message });
+async function signEvmMessage(tee, chain, message, jwt) {
+  return tee.sign({ chain, kind: "message", payload: message }, jwt);
 }
 
 // src/social/signers/solana.ts
@@ -2685,13 +2726,13 @@ function b64(bytes) {
 function unb64(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
-async function signSolanaTransaction(tee, chain, tx) {
+async function signSolanaTransaction(tee, chain, tx, jwt) {
   const bytes = tx instanceof import_web3.VersionedTransaction ? tx.serialize() : tx.serialize({ requireAllSignatures: false });
-  const signed = await tee.sign({ chain, kind: "transaction", payload: b64(bytes) });
+  const signed = await tee.sign({ chain, kind: "transaction", payload: b64(bytes) }, jwt);
   return unb64(signed);
 }
-async function signSolanaMessage(tee, chain, message) {
-  const sig = await tee.sign({ chain, kind: "message", payload: b64(message) });
+async function signSolanaMessage(tee, chain, message, jwt) {
+  const sig = await tee.sign({ chain, kind: "message", payload: b64(message) }, jwt);
   return unb64(sig);
 }
 
@@ -2964,7 +3005,12 @@ async function createDecaneConnect(config) {
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
   const storage = new Storage();
-  const session = new SessionManager(events, durationMs, teeUrl);
+  const session = new SessionManager(
+    events,
+    durationMs,
+    teeUrl,
+    config.requireAssertionPerSignature === true
+  );
   let auth = null;
   let persisted = loadPersisted(PERSIST_KEY);
   async function pinSetup() {
@@ -3363,11 +3409,11 @@ async function createDecaneConnect(config) {
     async signMessage(req) {
       const tee = session.requireActive();
       if (req.chain.startsWith("evm:")) {
-        return signEvmMessage(tee, req.chain, req.message);
+        return signEvmMessage(tee, req.chain, req.message, auth?.jwt);
       }
       if (req.chain.startsWith("solana:")) {
         const msg = typeof req.message === "string" ? new TextEncoder().encode(req.message) : req.message;
-        const sig = await signSolanaMessage(tee, req.chain, msg);
+        const sig = await signSolanaMessage(tee, req.chain, msg, auth?.jwt);
         return bufferToB64u(sig);
       }
       throw new CallSequenceError(`Unsupported chain: ${req.chain}`);
@@ -3415,7 +3461,7 @@ async function createDecaneConnect(config) {
           maxPriorityFeePerGas: feeData.maxPriorityFeePerGas ?? 0n
         } : { gasPrice: req.gasPrice ?? feeData.gasPrice ?? void 0 }
       };
-      const signedTx = await signEvmTransaction(tee, req.chain, tx);
+      const signedTx = await signEvmTransaction(tee, req.chain, tx, auth?.jwt);
       const txResponse = await provider.broadcastTransaction(signedTx);
       return txResponse.hash;
     },
@@ -3428,7 +3474,7 @@ async function createDecaneConnect(config) {
         tx = import_web32.Transaction.from(serializedTx);
       }
       const solChain = config.chains.find((c) => c.startsWith("solana:")) ?? "solana:mainnet";
-      return signSolanaTransaction(tee, solChain, tx);
+      return signSolanaTransaction(tee, solChain, tx, auth?.jwt);
     },
     async disconnect() {
       session.end();
@@ -5265,7 +5311,15 @@ function DecaneKit({ config, children }) {
   (0, import_react4.useEffect)(() => {
     if (!hasSocial(mode) || !config?.social || socialInitialized.current) return;
     socialInitialized.current = true;
-    const { apiKey, authMethods, promptPin, apiBaseUrl, chains, rpcUrls } = config.social;
+    const {
+      apiKey,
+      authMethods,
+      promptPin,
+      apiBaseUrl,
+      chains,
+      rpcUrls,
+      requireAssertionPerSignature
+    } = config.social;
     createDecaneConnect({
       appId: config.appId,
       apiKey,
@@ -5273,7 +5327,8 @@ function DecaneKit({ config, children }) {
       authMethods: authMethods ?? ["google", "email"],
       chains: chains ?? ["evm:1", "solana:mainnet"],
       rpcUrls,
-      promptPin
+      promptPin,
+      requireAssertionPerSignature
     }).then((sdk) => {
       socialRef.current = sdk;
       sdk.on(