decane-connect-kit 2.25.0 → 2.26.1

package/dist/index.cjs

@@ -2276,6 +2276,17 @@ var ApiClient = class {
       headers: { Authorization: `Bearer ${jwt}` }
     });
   }
+  /**
+   * Trade a still-valid token for a fresh one, so an active user is never
+   * signed out mid-use. The backend caps the whole chain by session age, so
+   * this cannot renew forever; a 401 means "sign in again", not "retry".
+   */
+  async refreshAccessToken(jwt) {
+    return this._request("/auth/refresh", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   /** Redeem a decrypted unlock token for a session. */
   async exchangeUnlockToken(token) {
     return this._request("/auth/unlock-token/exchange", {
@@ -4030,6 +4041,7 @@ async function createDecaneConnect(config) {
     clearSessionPersist(SESSION_KEY);
   }
   let accessTokenExpiry = null;
+  let tokenRefresh = null;
   function scheduleAccessTokenExpiry(jwt, expiresAt) {
     if (accessTokenExpiry) clearTimeout(accessTokenExpiry);
     accessTokenExpiry = setTimeout(() => {
@@ -4039,6 +4051,40 @@ async function createDecaneConnect(config) {
       dropLiveSession();
       events.emit("session-expired");
     }, Math.max(0, expiresAt - Date.now()));
+    scheduleTokenRefresh(jwt, expiresAt);
+  }
+  function scheduleTokenRefresh(jwt, expiresAt) {
+    if (tokenRefresh) clearTimeout(tokenRefresh);
+    const lifetime = expiresAt - Date.now();
+    if (lifetime <= 0) return;
+    const at = Math.max(5e3, lifetime * 0.75);
+    tokenRefresh = setTimeout(() => {
+      tokenRefresh = null;
+      void renewAccessToken(jwt);
+    }, at);
+  }
+  async function renewAccessToken(expected) {
+    if (auth?.jwt !== expected) return;
+    if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+      const onVisible = () => {
+        document.removeEventListener("visibilitychange", onVisible);
+        if (auth?.jwt === expected) void renewAccessToken(expected);
+      };
+      document.addEventListener("visibilitychange", onVisible);
+      return;
+    }
+    try {
+      const { jwt: fresh } = await api.refreshAccessToken(expected);
+      if (auth?.jwt !== expected) return;
+      auth = { ...auth, jwt: fresh };
+      const freshExpiry = decodeAccessToken(fresh)?.expiresAt;
+      if (freshExpiry) {
+        scheduleAccessTokenExpiry(fresh, freshExpiry);
+        persistLiveSession();
+      }
+      events.emit("session-renewed");
+    } catch {
+    }
   }
   if (persistSession) {
     const saved = loadSession(SESSION_KEY) ?? (LEGACY_SESSION_KEY !== SESSION_KEY ? loadSession(LEGACY_SESSION_KEY) : null);
@@ -7621,6 +7667,7 @@ function DecaneKit({ config, children }) {
       rpcUrls,
       requireAssertionPerSignature,
       deferDeviceProtection,
+      resumeSessionAcrossTabs,
       // Recovery callbacks. Forwarding these is what makes recovery
       // configurable at all from <DecaneKit>; before, they were silently
       // dropped and the headless client was constructed without them.
@@ -7642,6 +7689,7 @@ function DecaneKit({ config, children }) {
       promptUnlockPassword,
       requireAssertionPerSignature,
       deferDeviceProtection,
+      resumeSessionAcrossTabs,
       offerRecoveryAtSignup,
       onRecoveryShareOffer,
       onRecoveryFileReady,