decane-connect-kit 2.24.1 → 2.26.0

package/dist/index.cjs

@@ -2276,6 +2276,17 @@ var ApiClient = class {
       headers: { Authorization: `Bearer ${jwt}` }
     });
   }
+  /**
+   * Trade a still-valid token for a fresh one, so an active user is never
+   * signed out mid-use. The backend caps the whole chain by session age, so
+   * this cannot renew forever; a 401 means "sign in again", not "retry".
+   */
+  async refreshAccessToken(jwt) {
+    return this._request("/auth/refresh", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   /** Redeem a decrypted unlock token for a session. */
   async exchangeUnlockToken(token) {
     return this._request("/auth/unlock-token/exchange", {
@@ -2416,6 +2427,54 @@ var import_browser = require("@simplewebauthn/browser");
 
 // src/social/attestation.ts
 var import_dcap_qvl = require("@phala/dcap-qvl");
+
+// src/social/collateralCache.ts
+var CACHE_PREFIX = "decane:collateral:v1:";
+var COLLATERAL_TTL_MS = 12 * 60 * 60 * 1e3;
+function storage() {
+  try {
+    return typeof localStorage !== "undefined" ? localStorage : null;
+  } catch {
+    return null;
+  }
+}
+function keyFor(teeUrl) {
+  return `${CACHE_PREFIX}${teeUrl}`;
+}
+function readCollateral(teeUrl) {
+  const store = storage();
+  if (!store) return null;
+  try {
+    const raw = store.getItem(keyFor(teeUrl));
+    if (!raw) return null;
+    const entry = JSON.parse(raw);
+    if (!entry?.at || Date.now() - entry.at > COLLATERAL_TTL_MS) {
+      store.removeItem(keyFor(teeUrl));
+      return null;
+    }
+    return entry.collateral ?? null;
+  } catch {
+    return null;
+  }
+}
+function writeCollateral(teeUrl, collateral) {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.setItem(keyFor(teeUrl), JSON.stringify({ at: Date.now(), collateral }));
+  } catch {
+  }
+}
+function dropCollateral(teeUrl) {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.removeItem(keyFor(teeUrl));
+  } catch {
+  }
+}
+
+// src/social/attestation.ts
 init_errors();
 
 // ../../infra/tee-measurement.json
@@ -2443,6 +2502,9 @@ function hexToBytes(hex) {
 function bytesToHex(bytes) {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
 async function verifyTeeAttestation(teeUrl, nonce) {
   const res = await fetch(`${teeUrl}/attestation`, {
     method: "POST",
@@ -2452,9 +2514,22 @@ async function verifyTeeAttestation(teeUrl, nonce) {
   if (!res.ok) throw new AttestationError("quote fetch failed");
   const { quote, measurement } = await res.json();
   let verified;
+  const cached = readCollateral(teeUrl);
   try {
-    verified = await (0, import_dcap_qvl.getCollateralAndVerify)(hexToBytes(quote));
-  } catch {
+    if (cached) {
+      try {
+        verified = await (0, import_dcap_qvl.verify)(hexToBytes(quote), cached, nowSeconds());
+      } catch {
+        dropCollateral(teeUrl);
+        verified = await (0, import_dcap_qvl.getCollateralAndVerify)(hexToBytes(quote));
+      }
+    } else {
+      const collateral = await (0, import_dcap_qvl.getCollateral)(import_dcap_qvl.PHALA_PCCS_URL, hexToBytes(quote));
+      verified = await (0, import_dcap_qvl.verify)(hexToBytes(quote), collateral, nowSeconds());
+      writeCollateral(teeUrl, collateral);
+    }
+  } catch (e) {
+    if (e instanceof AttestationError) throw e;
     throw new AttestationError("quote signature invalid");
   }
   if (verified.status === "Revoked") {
@@ -2496,14 +2571,51 @@ async function teeFetch(url, init) {
 }
 var ATTESTATION_TTL_MS = 10 * 6e4;
 var attestationCache = /* @__PURE__ */ new Map();
+var ATTESTATION_PERSIST_PREFIX = "decane:attested:v1:";
+function persistedAt(teeUrl) {
+  try {
+    if (typeof sessionStorage === "undefined") return null;
+    const raw = sessionStorage.getItem(ATTESTATION_PERSIST_PREFIX + teeUrl);
+    const at = raw ? Number(raw) : NaN;
+    return Number.isFinite(at) ? at : null;
+  } catch {
+    return null;
+  }
+}
+function rememberAttested(teeUrl, at) {
+  try {
+    if (typeof sessionStorage !== "undefined") {
+      sessionStorage.setItem(ATTESTATION_PERSIST_PREFIX + teeUrl, String(at));
+    }
+  } catch {
+  }
+}
+function forgetAttested(teeUrl) {
+  try {
+    if (typeof sessionStorage !== "undefined") {
+      sessionStorage.removeItem(ATTESTATION_PERSIST_PREFIX + teeUrl);
+    }
+  } catch {
+  }
+}
 function attestOnce(teeUrl, verify) {
   const hit = attestationCache.get(teeUrl);
   if (hit && Date.now() - hit.at < ATTESTATION_TTL_MS) return hit.promise;
-  const promise = verify().catch((e) => {
+  const at = persistedAt(teeUrl);
+  if (at && Date.now() - at < ATTESTATION_TTL_MS) {
+    const resolved = Promise.resolve();
+    attestationCache.set(teeUrl, { at, promise: resolved });
+    return resolved;
+  }
+  const startedAt = Date.now();
+  const promise = verify().then(() => {
+    rememberAttested(teeUrl, startedAt);
+  }).catch((e) => {
     attestationCache.delete(teeUrl);
+    forgetAttested(teeUrl);
     throw e;
   });
-  attestationCache.set(teeUrl, { at: Date.now(), promise });
+  attestationCache.set(teeUrl, { at: startedAt, promise });
   return promise;
 }
 function prewarmAttestation(teeUrl) {
@@ -3775,29 +3887,44 @@ function clearLastUser(key) {
 function sessionPersistKey(apiKey) {
   return `decane:sess:${apiKey.slice(0, 20)}`;
 }
+var sessionStore = () => typeof sessionStorage !== "undefined" ? sessionStorage : null;
+function useCrossTabSessionStore(enabled) {
+  sessionStore = enabled ? () => typeof localStorage !== "undefined" ? localStorage : null : () => typeof sessionStorage !== "undefined" ? sessionStorage : null;
+}
 function loadSession(key) {
   try {
-    const raw = typeof sessionStorage !== "undefined" ? sessionStorage.getItem(key) : null;
-    return raw ? JSON.parse(raw) : null;
+    const raw = sessionStore()?.getItem(key) ?? (typeof sessionStorage !== "undefined" ? sessionStorage.getItem(key) : null) ?? (typeof localStorage !== "undefined" ? localStorage.getItem(key) : null);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (parsed?.expiresAt && parsed.expiresAt <= Date.now()) {
+      clearSessionPersist(key);
+      return null;
+    }
+    return parsed;
   } catch {
     return null;
   }
 }
 function saveSession(key, s) {
   try {
-    sessionStorage.setItem(key, JSON.stringify(s));
+    sessionStore()?.setItem(key, JSON.stringify(s));
   } catch {
   }
 }
 function clearSessionPersist(key) {
   try {
-    sessionStorage.removeItem(key);
+    if (typeof sessionStorage !== "undefined") sessionStorage.removeItem(key);
+  } catch {
+  }
+  try {
+    if (typeof localStorage !== "undefined") localStorage.removeItem(key);
   } catch {
   }
 }
 async function createDecaneConnect(config) {
   if (!config.appId) throw new Error("decane-connect-kit: appId is required");
   if (!config.apiKey) throw new Error("decane-connect-kit: apiKey is required");
+  useCrossTabSessionStore(config.resumeSessionAcrossTabs === true);
   if (!config.chains?.length)
     throw new Error("decane-connect-kit: at least one chain is required");
   if (config.rotateOnNewDeviceRecovery && !config.onRecoveryRotated) {
@@ -3816,7 +3943,7 @@ async function createDecaneConnect(config) {
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
-  const storage = new Storage();
+  const storage2 = new Storage();
   const session = new SessionManager(
     events,
     durationMs,
@@ -3914,6 +4041,7 @@ async function createDecaneConnect(config) {
     clearSessionPersist(SESSION_KEY);
   }
   let accessTokenExpiry = null;
+  let tokenRefresh = null;
   function scheduleAccessTokenExpiry(jwt, expiresAt) {
     if (accessTokenExpiry) clearTimeout(accessTokenExpiry);
     accessTokenExpiry = setTimeout(() => {
@@ -3923,6 +4051,40 @@ async function createDecaneConnect(config) {
       dropLiveSession();
       events.emit("session-expired");
     }, Math.max(0, expiresAt - Date.now()));
+    scheduleTokenRefresh(jwt, expiresAt);
+  }
+  function scheduleTokenRefresh(jwt, expiresAt) {
+    if (tokenRefresh) clearTimeout(tokenRefresh);
+    const lifetime = expiresAt - Date.now();
+    if (lifetime <= 0) return;
+    const at = Math.max(5e3, lifetime * 0.75);
+    tokenRefresh = setTimeout(() => {
+      tokenRefresh = null;
+      void renewAccessToken(jwt);
+    }, at);
+  }
+  async function renewAccessToken(expected) {
+    if (auth?.jwt !== expected) return;
+    if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+      const onVisible = () => {
+        document.removeEventListener("visibilitychange", onVisible);
+        if (auth?.jwt === expected) void renewAccessToken(expected);
+      };
+      document.addEventListener("visibilitychange", onVisible);
+      return;
+    }
+    try {
+      const { jwt: fresh } = await api.refreshAccessToken(expected);
+      if (auth?.jwt !== expected) return;
+      auth = { ...auth, jwt: fresh };
+      const freshExpiry = decodeAccessToken(fresh)?.expiresAt;
+      if (freshExpiry) {
+        scheduleAccessTokenExpiry(fresh, freshExpiry);
+        persistLiveSession();
+      }
+      events.emit("session-renewed");
+    } catch {
+    }
   }
   if (persistSession) {
     const saved = loadSession(SESSION_KEY) ?? (LEGACY_SESSION_KEY !== SESSION_KEY ? loadSession(LEGACY_SESSION_KEY) : null);
@@ -3959,7 +4121,7 @@ async function createDecaneConnect(config) {
   }
   async function attachUnlockToken(userId, jwt, tokenKey) {
     try {
-      const stored = await storage.getShare(userId);
+      const stored = await storage2.getShare(userId);
       if (!stored) return;
       const { token } = await api.issueUnlockToken(jwt);
       const unlockTokenIv = generateRandomBytes(12);
@@ -3968,13 +4130,13 @@ async function createDecaneConnect(config) {
         new TextEncoder().encode(token),
         unlockTokenIv
       );
-      await storage.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+      await storage2.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
     } catch (e) {
       console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
     }
   }
   async function persistRotatedDeviceShare(userId, deviceShare) {
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     if (!stored) {
       throw new CallSequenceError(
         "Share set was rotated but this device has no stored share to update. Recover the wallet on this device before rotating."
@@ -3983,21 +4145,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await getWrappingKey(stored);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage.putShare({ ...stored, wrappedDeviceShare, iv });
+    await storage2.putShare({ ...stored, wrappedDeviceShare, iv });
   }
   function hasPasswordUnlock(stored) {
     return !!stored && stored.unlockMethod === "password" && !!stored.passwordSalt && !!stored.wrappedUnlockToken && !!stored.unlockTokenIv;
   }
   async function passwordDeviceCandidate() {
     if (persisted?.userId) {
-      const stored = await storage.getShare(persisted.userId);
+      const stored = await storage2.getShare(persisted.userId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
     if (lastUserId) {
-      const stored = await storage.getShare(lastUserId);
+      const stored = await storage2.getShare(lastUserId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
-    const candidates = (await storage.listShares()).filter(hasPasswordUnlock);
+    const candidates = (await storage2.listShares()).filter(hasPasswordUnlock);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function getWrappingKey(stored) {
@@ -4025,7 +4187,7 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
-      const label = (await storage.getShare(userId))?.profile?.email;
+      const label = (await storage2.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
@@ -4057,8 +4219,8 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    const existing = await storage.getShare(userId);
-    await storage.putShare({
+    const existing = await storage2.getShare(userId);
+    await storage2.putShare({
       ...existing,
       userId,
       wrappedDeviceShare,
@@ -4142,7 +4304,7 @@ async function createDecaneConnect(config) {
       const { wrappingKey, tokenKey, meta } = await passwordSetup();
       const iv = generateRandomBytes(12);
       const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-      await storage.putShare({
+      await storage2.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4216,7 +4378,7 @@ async function createDecaneConnect(config) {
         shareSet.device,
         iv
       );
-      await storage.putShare({
+      await storage2.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4320,7 +4482,7 @@ async function createDecaneConnect(config) {
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     let deviceShare;
     let joinedViaPasskeySync = false;
     if (!stored) {
@@ -4359,7 +4521,7 @@ async function createDecaneConnect(config) {
         rpId,
         teeUrl,
         api,
-        storage,
+        storage: storage2,
         onProgress: config.onRecoveryProgress,
         promptForRecoveryFile: config.promptForRecoveryFile,
         onNewRecoveryShare: async (recoveryShare, shareSetVersion) => {
@@ -4373,7 +4535,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!deferDeviceProtection && !await storage.getShare(userId) && isPasskeySupported()) {
+      if (!deferDeviceProtection && !await storage2.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4394,7 +4556,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       if (e instanceof StaleDeviceShareError) {
         zeroize(deviceShare);
-        await storage.deleteShare(userId);
+        await storage2.deleteShare(userId);
         if (stored) return returningUserUnlock(userId, jwt);
       } else {
         zeroize(deviceShare);
@@ -4418,7 +4580,7 @@ async function createDecaneConnect(config) {
     const result = await tee.rotateShares(jwt);
     try {
       await persistRotatedDeviceShare(userId, result.deviceShare);
-      const refreshed = await storage.getShare(userId);
+      const refreshed = await storage2.getShare(userId);
       if (refreshed?.unlockMethod === "passkey" && refreshed.credentialId && refreshed.prfSalt) {
         await api.putRecoveryBackup(jwt, {
           wrappedDeviceShare: refreshed.wrappedDeviceShare,
@@ -4451,13 +4613,13 @@ async function createDecaneConnect(config) {
   }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
-    return usablePasskeyShare(await storage.getShare(persisted.userId));
+    return usablePasskeyShare(await storage2.getShare(persisted.userId));
   }
   async function passkeyDeviceCandidate() {
     if (!isPasskeySupported()) return null;
     if (persisted?.userId) return passkeyLoginCandidate();
-    if (lastUserId) return usablePasskeyShare(await storage.getShare(lastUserId));
-    const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
+    if (lastUserId) return usablePasskeyShare(await storage2.getShare(lastUserId));
+    const candidates = (await storage2.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function canOfferPasskey() {
@@ -4465,15 +4627,15 @@ async function createDecaneConnect(config) {
     if (await passkeyDeviceCandidate()) return true;
     const known = persisted?.userId ?? lastUserId;
     if (!known) return false;
-    return await storage.getShare(known) == null;
+    return await storage2.getShare(known) == null;
   }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
     try {
-      const stored = await storage.getShare(userId);
+      const stored = await storage2.getShare(userId);
       if (!stored) return;
-      await storage.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
+      await storage2.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
     } catch {
     }
   }
@@ -4497,7 +4659,7 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     return {
       addresses,
       isNewUser: false,
@@ -4670,7 +4832,7 @@ async function createDecaneConnect(config) {
       events.emit("connected");
       persistLiveSession();
       scheduleAccessTokenExpiry(token, claims.expiresAt);
-      const stored = await storage.getShare(claims.userId);
+      const stored = await storage2.getShare(claims.userId);
       return {
         addresses,
         isNewUser: false,
@@ -4700,7 +4862,7 @@ async function createDecaneConnect(config) {
       const candidate = await passkeyDeviceCandidate();
       if (candidate) return passkeyLogin(candidate);
       const known = persisted?.userId ?? lastUserId;
-      if (isPasskeySupported() && known && await storage.getShare(known) == null) {
+      if (isPasskeySupported() && known && await storage2.getShare(known) == null) {
         return passkeyLoginWithoutShare(known);
       }
       throw new NewDeviceError();
@@ -4719,7 +4881,7 @@ async function createDecaneConnect(config) {
     async setUnlockPassword(password) {
       if (!auth) throw new ReconnectRequiredError();
       validateUnlockPassword(password);
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (!stored) throw new NewDeviceError();
       const deviceShare = await aesGcmDecrypt(
         await getWrappingKey(stored),
@@ -4738,7 +4900,7 @@ async function createDecaneConnect(config) {
         );
         const iv = generateRandomBytes(12);
         const wrappedDeviceShare = await aesGcmEncrypt(shareKey, deviceShare, iv);
-        await storage.putShare({
+        await storage2.putShare({
           ...stored,
           unlockMethod: "password",
           wrappedDeviceShare,
@@ -4818,9 +4980,9 @@ async function createDecaneConnect(config) {
     async removeUnlockPassword() {
       if (!auth) throw new ReconnectRequiredError();
       await api.revokeUnlockTokens(auth.jwt);
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (!stored || stored.unlockMethod !== "password") return;
-      await storage.putShare({
+      await storage2.putShare({
         ...stored,
         wrappedUnlockToken: void 0,
         unlockTokenIv: void 0
@@ -4828,13 +4990,13 @@ async function createDecaneConnect(config) {
     },
     async hasPasskey() {
       if (!auth) return false;
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       return stored?.unlockMethod === "passkey";
     },
     async addPasskey() {
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (stored?.unlockMethod === "passkey") return;
       if (!stored) {
         if (!serverAssistedRecovery) throw new NewDeviceError();
@@ -4867,11 +5029,11 @@ async function createDecaneConnect(config) {
     },
     async deviceProtected() {
       if (!auth) return false;
-      return await storage.getShare(auth.userId) !== null;
+      return await storage2.getShare(auth.userId) !== null;
     },
     async protectDevice() {
       if (!auth) throw new ReconnectRequiredError();
-      if (await storage.getShare(auth.userId)) return true;
+      if (await storage2.getShare(auth.userId)) return true;
       if (!serverAssistedRecovery) throw new NewDeviceError();
       const tee = new TeeClient(teeUrl);
       const provisioned = await tee.provisionDeviceShare(auth.jwt);
@@ -4881,7 +5043,7 @@ async function createDecaneConnect(config) {
       } finally {
         zeroize(provisioned);
       }
-      return await storage.getShare(auth.userId) !== null;
+      return await storage2.getShare(auth.userId) !== null;
     },
     async unlock() {
       if (!auth) {