fix(sdk): add configurable timeout/retry and document SIGNET_SESSIONS_VALID_AFTER

[samuelelijah585]

Overview

This PR addresses two issues affecting the Signet SDK and operator documentation:

• SDK Timeout & Retry — fetch calls no longer hang indefinitely on a stalled network. The SignetClient now supports configurable timeout via AbortController and bounded retries on 5xx / network errors with exponential backoff.
• Session Revocation Docs — SIGNET_SESSIONS_VALID_AFTER (the env var that invalidates issued sessions) is now documented in SECURITY.md with a copy-pasteable command.

Related Issues

Closes #61
Closes #68

Changes

SDK Timeout and Retry (packages/sdk/src/client.ts)

• [ADD] SignetClientOptions.timeoutMs (default 10_000) — request aborts after this many ms via AbortController.
• [ADD] SignetClientOptions.maxRetries (default 2) — retries on 5xx responses and network/timeout errors.
• [ADD] Exponential backoff between retries (200ms → 400ms → 800ms …, capped at 5s).
• [ADD] isRetryableError() helper — retries on AbortError (timeout) and TypeError (network failure).
• [ADD] 4 new tests in client.test.ts — retry-on-5xx success, retry exhaustion, timeout handling, and option verification.

Session Revocation Docs (SECURITY.md)

• [ADD] Dedicated section explaining SIGNET_SESSIONS_VALID_AFTER under "Hardening notes for operators":
  • How it works (compares iat claim against the timestamp).
  • Copy-pasteable bash command to revoke all sessions created before now.
  • Guidance to set it at the same moment as rotating SIGNET_AUTH_SECRET.

Verification Results

npm test -- packages/sdk/src/client.test.ts
ℹ tests 8
ℹ pass 8
ℹ fail 0

Acceptance Criteria	Status
SDK timeout prevents indefinite hangs on stalled network	✅ AbortController aborts after timeoutMs
SDK retries on 5xx responses with backoff	✅ Exponential backoff, configurable via maxRetries
Timeout and retry defaults are documented	✅ JSDoc on all new options with defaults
Tests cover retry, timeout, and exhaustion paths	✅ 4 new tests, all passing
SIGNET_SESSIONS_VALID_AFTER is documented	✅ Copy-pasteable date command in SECURITY.md

[netlify]

✅ Deploy Preview for stellar-signet ready!

Name	Link
🔨 Latest commit	395f839
🔍 Latest deploy log	https://app.netlify.com/projects/stellar-signet/deploys/6a693dfc7d91aa00080d591c
😎 Deploy Preview	https://deploy-preview-104--stellar-signet.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[vercel]

@samuelelijah585 is attempting to deploy a commit to the blockchainmaxis-8449's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@samuelelijah585 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits