decane-connect-kit 2.2.1 → 2.2.2

package/dist/index.js

@@ -1916,7 +1916,11 @@ var EventEmitter = class {
 init_errors();
 var ERROR_MAP = {
   INVALID_API_KEY: InvalidApiKeyError,
-  ORIGIN_NOT_ALLOWED: OriginNotAllowedError
+  ORIGIN_NOT_ALLOWED: OriginNotAllowedError,
+  // The backend's authMiddleware code for an expired/revoked JWT. Surfacing it
+  // as ReconnectRequiredError routes callers to the sign-in UI instead of a
+  // generic failure message.
+  UNAUTHORIZED: ReconnectRequiredError
 };
 var ApiClient = class {
   constructor(baseUrl, apiKey, appId) {
@@ -2202,11 +2206,22 @@ var TeeClient = class {
     this.attested = false;
     /** Mirrors what the signer confirmed for this session, not what we asked for. */
     this.assertionPerSignature = false;
+    /** The signer's authoritative remaining lifetime (seconds), null until a session opens. */
+    this.sessionExpiresInSec = null;
   }
   /** Whether this session actually got per-signature assertions. */
   requiresAssertionPerSignature() {
     return this.assertionPerSignature;
   }
+  /**
+   * The lifetime the signer granted this session, in seconds — which can be
+   * shorter than the client's configured duration when the JWT expires first.
+   * Null if the signer didn't report one (older build). Callers clamp their own
+   * countdown to this so it never promises time the handle doesn't have.
+   */
+  sessionExpiresIn() {
+    return this.sessionExpiresInSec;
+  }
   async ensureAttested() {
     if (this.attested) return;
     const nonce = crypto.getRandomValues(new Uint8Array(16));
@@ -2235,6 +2250,7 @@ var TeeClient = class {
     const body = await res.json();
     this.handle = body.handle;
     this.assertionPerSignature = body.requireAssertionPerSignature === true;
+    this.sessionExpiresInSec = typeof body.expiresIn === "number" ? body.expiresIn : null;
     return body.addresses ?? null;
   }
   /**
@@ -2277,6 +2293,7 @@ var TeeClient = class {
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({ rpId: window.location.hostname })
     });
+    if (res.status === 401) throw new ReconnectRequiredError();
     if (!res.ok) throw new ExportNotAuthorizedError();
     const { challengeId, options } = await res.json();
     let assertion;
@@ -2328,8 +2345,9 @@ var TeeClient = class {
   /**
    * `jwt` is only needed when this session requires per-signature assertions —
    * it authenticates the challenge request. Passed per call rather than cached
-   * on the instance deliberately: the backend's JWTs are shorter-lived than the
-   * TEE session TTL, so a stored copy would go stale mid-session.
+   * on the instance deliberately: JWT lifetime is configured independently of
+   * the TEE session TTL (they are aligned at 30min by default, but an operator
+   * can shorten JWT_EXPIRY_SECONDS), so a stored copy could go stale mid-session.
    */
   async sign(req, jwt) {
     if (!this.handle) throw new Error("no session");
@@ -2419,12 +2437,14 @@ var SessionManager = class {
     }
     this.evmAddress = addresses.evm;
     this.solanaAddress = addresses.solana;
-    this.expiresAt = Date.now() + this.durationMs;
+    const serverTtlMs = this.tee.sessionExpiresIn();
+    const effectiveMs = serverTtlMs != null ? Math.min(this.durationMs, serverTtlMs * 1e3) : this.durationMs;
+    this.expiresAt = Date.now() + effectiveMs;
     if (this.timeoutId) clearTimeout(this.timeoutId);
     this.timeoutId = setTimeout(() => {
       this.end();
       this.events.emit("session-expired");
-    }, this.durationMs);
+    }, effectiveMs);
     this.events.emit("session-started");
     return addresses;
   }