decane-connect-kit 2.2.0 → 2.2.2

package/dist/index.cjs

@@ -1983,7 +1983,11 @@ var EventEmitter = class {
 init_errors();
 var ERROR_MAP = {
   INVALID_API_KEY: InvalidApiKeyError,
-  ORIGIN_NOT_ALLOWED: OriginNotAllowedError
+  ORIGIN_NOT_ALLOWED: OriginNotAllowedError,
+  // The backend's authMiddleware code for an expired/revoked JWT. Surfacing it
+  // as ReconnectRequiredError routes callers to the sign-in UI instead of a
+  // generic failure message.
+  UNAUTHORIZED: ReconnectRequiredError
 };
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
@@ -2269,11 +2273,22 @@ var TeeClient = class {
     this.attested = false;
     /** Mirrors what the signer confirmed for this session, not what we asked for. */
     this.assertionPerSignature = false;
+    /** The signer's authoritative remaining lifetime (seconds), null until a session opens. */
+    this.sessionExpiresInSec = null;
   }
   /** Whether this session actually got per-signature assertions. */
   requiresAssertionPerSignature() {
     return this.assertionPerSignature;
   }
+  /**
+   * The lifetime the signer granted this session, in seconds — which can be
+   * shorter than the client's configured duration when the JWT expires first.
+   * Null if the signer didn't report one (older build). Callers clamp their own
+   * countdown to this so it never promises time the handle doesn't have.
+   */
+  sessionExpiresIn() {
+    return this.sessionExpiresInSec;
+  }
   async ensureAttested() {
     if (this.attested) return;
     const nonce = crypto.getRandomValues(new Uint8Array(16));
@@ -2302,6 +2317,7 @@ var TeeClient = class {
     const body = await res.json();
     this.handle = body.handle;
     this.assertionPerSignature = body.requireAssertionPerSignature === true;
+    this.sessionExpiresInSec = typeof body.expiresIn === "number" ? body.expiresIn : null;
     return body.addresses ?? null;
   }
   /**
@@ -2344,6 +2360,7 @@ var TeeClient = class {
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
     });
+    if (res.status === 401) throw new ReconnectRequiredError();
     if (!res.ok) throw new ExportNotAuthorizedError();
     const { challengeId, options } = await res.json();
     let assertion;
@@ -2395,8 +2412,9 @@ var TeeClient = class {
   /**
    * `jwt` is only needed when this session requires per-signature assertions —
    * it authenticates the challenge request. Passed per call rather than cached
-   * on the instance deliberately: the backend's JWTs are shorter-lived than the
-   * TEE session TTL, so a stored copy would go stale mid-session.
+   * on the instance deliberately: JWT lifetime is configured independently of
+   * the TEE session TTL (they are aligned at 30min by default, but an operator
+   * can shorten JWT_EXPIRY_SECONDS), so a stored copy could go stale mid-session.
    */
   async sign(req, jwt) {
     if (!this.handle) throw new Error("no session");
@@ -2486,12 +2504,14 @@ var SessionManager = class {
     }
     this.evmAddress = addresses.evm;
     this.solanaAddress = addresses.solana;
-    this.expiresAt = Date.now() + this.durationMs;
+    const serverTtlMs = this.tee.sessionExpiresIn();
+    const effectiveMs = serverTtlMs != null ? Math.min(this.durationMs, serverTtlMs * 1e3) : this.durationMs;
+    this.expiresAt = Date.now() + effectiveMs;
     if (this.timeoutId) clearTimeout(this.timeoutId);
     this.timeoutId = setTimeout(() => {
       this.end();
       this.events.emit("session-expired");
-    }, this.durationMs);
+    }, effectiveMs);
     this.events.emit("session-started");
     return addresses;
   }
@@ -5311,7 +5331,15 @@ function DecaneKit({ config, children }) {
   (0, import_react4.useEffect)(() => {
     if (!hasSocial(mode) || !config?.social || socialInitialized.current) return;
     socialInitialized.current = true;
-    const { apiKey, authMethods, promptPin, apiBaseUrl, chains, rpcUrls } = config.social;
+    const {
+      apiKey,
+      authMethods,
+      promptPin,
+      apiBaseUrl,
+      chains,
+      rpcUrls,
+      requireAssertionPerSignature
+    } = config.social;
     createDecaneConnect({
       appId: config.appId,
       apiKey,
@@ -5319,7 +5347,8 @@ function DecaneKit({ config, children }) {
       authMethods: authMethods ?? ["google", "email"],
       chains: chains ?? ["evm:1", "solana:mainnet"],
       rpcUrls,
-      promptPin
+      promptPin,
+      requireAssertionPerSignature
     }).then((sdk) => {
       socialRef.current = sdk;
       sdk.on(