@bananapus/nana-sdk-core 2.35.0 → 2.36.0

package/dist/cjs/review/writeHold.js

@@ -8,6 +8,18 @@ const messages_js_1 = require("./messages.js");
 const writeRecovery_js_1 = require("./writeRecovery.js");
 const untrusted_js_1 = require("../untrusted.js");
 const relayr_js_1 = require("./relayr.js");
+const tabState_js_1 = require("./tabState.js");
+/** `sent` is the transaction at `hash`, exactly `record`'s call, from its account, on its chain. */
+function sentIsCall(sent, hash, record) {
+    return (sent.hash?.toLowerCase() === hash.toLowerCase() &&
+        sent.from?.toLowerCase() === record.account &&
+        (sent.chainId === undefined || sent.chainId === record.chainId) &&
+        sent.to?.toLowerCase() === record.call.to &&
+        sent.input?.toLowerCase() === record.call.data &&
+        BigInt(sent.value) === BigInt(record.call.value));
+}
+/** The stop of every controller with a follower or tab listener running, for the test-only reset. */
+const liveHolds = (0, tabState_js_1.tabShared)(tabState_js_1.TAB.holds, () => new Set());
 /**
  * A state read without the chain (peek, a replay, another tab's change, a
  * send's progress): its status and line, never the exit. Only the gate in
@@ -67,6 +79,8 @@ const SAFE_EXECUTION_TOPICS = [
 ];
 /** A hash the network still hasn't seen this long after the wallet returned it was almost certainly never broadcast. */
 const UNSEEN_HASH_MS = 30 * 60_000;
+/** The longest one request to Safe's service may take inside the hold. */
+const SAFE_SERVICE_READ_MS = 8_000;
 /** The 30 minutes have passed since the wallet returned the hash, or since it was first read. A clock that couldn't be saved (NaN) never runs out. */
 function unseenTooLong(record) {
     return (Date.now() - Number(record.submittedAt ?? record.firstSeenAt) >=
@@ -183,6 +197,30 @@ function classify(record) {
  */
 function createWriteHold(options = {}) {
     const storage = options.storage ?? (0, writeRecovery_js_1.createHeldWriteStorage)();
+    /**
+     * Safe's service, every request and its body bounded together to
+     * {@link SAFE_SERVICE_READ_MS} whatever its fetch does with the signal: a read that times out is
+     * unknown, which never releases or settles, so a hung service can't hold
+     * a send or the call's lock.
+     */
+    const service = {
+        ...options.safeService,
+        fetch: (url, init) => {
+            const request = options.safeService?.fetch ?? globalThis.fetch;
+            let timer;
+            return Promise.race([
+                // The whole read, its body included, under the one deadline.
+                request(url, init).then(async (response) => new Response(await response.arrayBuffer(), {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
+                })),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error("Safe's service did not answer in time.")), SAFE_SERVICE_READ_MS);
+                }),
+            ]).finally(() => clearTimeout(timer));
+        },
+    };
     const interval = options.settle?.intervalMs ?? SETTLE_POLL_MS;
     const attempts = options.settle?.attempts ?? SETTLE_POLL_ATTEMPTS;
     const listeners = new Map();
@@ -226,11 +264,25 @@ function createWriteHold(options = {}) {
             }
         };
         globalThis.addEventListener("storage", onStorage);
+        liveHolds.add(dispose);
+    }
+    /** Stop every settle poll and the tab listener. */
+    function dispose() {
+        for (const timer of timers.values())
+            clearTimeout(timer);
+        timers.clear();
+        if (onStorage)
+            globalThis.removeEventListener?.("storage", onStorage);
+        onStorage = undefined;
+        liveHolds.delete(dispose);
     }
-    function openOne(call, hooks = {}) {
+    function openOne(call, hooks = {}, 
+    /** The key a found write was saved under, when it isn't its call's own. */
+    at) {
         const recovery = (0, writeRecovery_js_1.createBrowserWriteRecovery)(call, {
             storage,
             locks: options.locks,
+            at,
         });
         // The canonical recovery scope: a namespace and an exact call never share it.
         const key = recovery.scopeKey;
@@ -287,6 +339,7 @@ function createWriteHold(options = {}) {
         function follow(client, id, left = attempts) {
             if (timers.has(id) || left <= 0)
                 return;
+            liveHolds.add(dispose);
             timers.set(id, setTimeout(() => {
                 void state(client)
                     .catch(() => null)
@@ -328,10 +381,37 @@ function createWriteHold(options = {}) {
                 follow(client, record.id);
             return classify(recovery.read());
         }
+        /**
+         * Whether a previous deploy's `hash` may be this call's: a valid hash
+         * read on the call's chain that isn't shown to be another write. A
+         * transaction must be the exact call from the account; a Safe proposal,
+         * exactly this call. One that can't be read is unknown, not refused.
+         */
+        async function adoptable(hash, client) {
+            if (!(0, untrusted_js_1.isBytes32)(hash) ||
+                !client ||
+                (await client.getChainId().catch(() => null)) !== call.chainId)
+                return false;
+            const reviewed = {
+                account: call.account.toLowerCase(),
+                chainId: call.chainId,
+                call: {
+                    to: call.call.to.toLowerCase(),
+                    data: call.call.data.toLowerCase(),
+                    value: String(call.call.value ?? 0),
+                },
+            };
+            if (call.safe) {
+                const proposal = await (0, safeService_js_1.readSafeTransaction)(call.chainId, call.account, hash, service).catch(() => null);
+                return !proposal || (0, writeRecovery_js_1.safeProposalIsHeldCall)(proposal, call);
+            }
+            const sent = await client.getTransaction({ hash }).catch(() => null);
+            return !sent || sentIsCall(sent, hash, reviewed);
+        }
         /** The authenticated nonce of a Safe proposal, from Safe's service. */
         async function proposalNonceOf(record) {
             try {
-                const proposal = await (0, safeService_js_1.readSafeTransaction)(record.chainId, record.account, record.hash, options.safeService);
+                const proposal = await (0, safeService_js_1.readSafeTransaction)(record.chainId, record.account, record.hash, service);
                 return (0, safeService_js_1.safeTransactionMessage)(proposal).nonce;
             }
             catch {
@@ -536,13 +616,13 @@ function createWriteHold(options = {}) {
             }
             const end = (record.safeNonce !== undefined &&
                 (await (0, safeService_js_1.provenSafeProposalEnd)(client, record.account, hash, BigInt(record.safeNonce)))) ||
-                (await (0, safeService_js_1.lookAtSafeProposalEnd)(client, record.chainId, record.account, hash, options.safeService));
+                (await (0, safeService_js_1.lookAtSafeProposalEnd)(client, record.chainId, record.account, hash, service));
             // Another Safe transaction took its nonce, even after a saved execution
             // was reorganized away. It may have run the call too: the exit, never a release.
             if (end.look === "replaced")
                 return safeReplaced(recovery.replacedOnChain(record));
             if (end.look === "expired" && !record.executed) {
-                const expired = await (0, writeRecovery_js_1.verifyReviewedWriteExpiry)(client, record, options.safeService).catch(() => false);
+                const expired = await (0, writeRecovery_js_1.verifyReviewedWriteExpiry)(client, record, service).catch(() => false);
                 if (expired && release(record))
                     return clear({ result: "expired" }, record.id);
             }
@@ -673,9 +753,7 @@ function createWriteHold(options = {}) {
             }
             if (record.hash &&
                 record.sentNonce === undefined &&
-                (record.nonce === undefined ||
-                    record.fromBlock === undefined ||
-                    unseenTooLong(record)) &&
+                unseenTooLong(record) &&
                 (await client.getTransaction({ hash: record.hash }).then(() => false, (error) => error?.name === "TransactionNotFoundError")))
                 return unchecked(record);
             return classify(record);
@@ -687,7 +765,7 @@ function createWriteHold(options = {}) {
         async function state(client, checks = {}) {
             lastEffect = checks.effect;
             const result = await locked(() => inspect(client, checks.effect), false);
-            return shown(result ? result.value : peek());
+            return { ...shown(result ? result.value : peek()), checked: !!result };
         }
         return {
             state,
@@ -873,7 +951,10 @@ function createWriteHold(options = {}) {
                     // what the saved record says, with no exit.
                 }, false);
                 const ended = result?.value ?? { released: false, state: peek() };
-                return { ...ended, state: shown(ended.state) };
+                return {
+                    ...ended,
+                    state: { ...shown(ended.state), checked: !!result },
+                };
             },
             /**
              * A receipt for the held write: an ordinary write's own hash, or a Safe
@@ -917,6 +998,94 @@ function createWriteHold(options = {}) {
              * one lock, without releasing it. The hold then follows that hash: no
              * exit while it is pending, and its receipt settles it.
              */
+            /**
+             * Move a write a previous deploy kept (outside these holds) into this
+             * hold. `snapshot` is the state the app read before deciding. Under
+             * the call's lock, it reserves a held record with `evidence` (the
+             * account's next nonce, or the nonce it was sent at, with the block it
+             * was read at; when it was sent; and its `hash`, or for a Safe write
+             * `safe.safeTxHash`) only while nothing is held and no reservation
+             * came since `snapshot`: another tab's hold or settlement wins, and
+             * the current state is returned unchanged. A hash is checked first
+             * with `client`: a transaction that is another call, from another
+             * account or on another chain (or a Safe proposal of another call) is
+             * refused, adopting nothing. One the chain can't show is held, with
+             * the warned exit 30 minutes after it was sent (or adopted). Then the
+             * gate reads it: a mined one settles on its verified receipt. It never
+             * sends or releases; adopting twice holds once.
+             */
+            async adopt(snapshot, evidence = {}, client) {
+                const nonce = evidence.nonce ?? evidence.sentNonce;
+                const hash = (call.safe ? evidence.safe?.safeTxHash : evidence.hash)?.toLowerCase();
+                /** Nothing held, and no reservation since the app's read. */
+                const free = () => snapshot.status === "clear" &&
+                    !recovery.read() &&
+                    recovery.latestReservation() === snapshot.reservation;
+                const reserve = () => recovery.reserve(undefined, nonce !== undefined && evidence.fromBlock !== undefined
+                    ? { nonce, blockNumber: evidence.fromBlock }
+                    : undefined, {
+                    hash,
+                    submittedAt: evidence.submittedAt === undefined
+                        ? undefined
+                        : String(evidence.submittedAt),
+                });
+                if (hooks.across) {
+                    // Under an intent: the same atomic reserve as a send, under every
+                    // legacy key's lock, mirrored at each so older versions see it.
+                    if (!free() ||
+                        (hash !== undefined && !(await adoptable(hash, client))))
+                        return shown(peek());
+                    let adopted = false;
+                    try {
+                        const { released } = await hooks.across((work) => recovery.withLock(work), () => {
+                            if (!free())
+                                throw new Error("Held since the app's read.");
+                            reserve();
+                            adopted = true;
+                        }, recovery.rejected, Promise.resolve(), hooks.generations());
+                        await released;
+                    }
+                    catch {
+                        /* Held elsewhere, busy, or no longer free: nothing adopted. */
+                    }
+                    // A mined hash settles on its verified receipt, through the gate.
+                    return adopted && hash && client ? state(client) : shown(peek());
+                }
+                const result = await locked(async () => {
+                    if (!free())
+                        return peek();
+                    if (hash !== undefined && !(await adoptable(hash, client)))
+                        return peek();
+                    reserve();
+                    return hash && client ? inspect(client) : peek();
+                }, true);
+                return shown(result?.value ?? peek());
+            },
+            /**
+             * Save the Safe nonce of a held Safe proposal adopted before it was
+             * known, so a replacement can be proven later. Under the call's lock,
+             * only while the held proposal is `safeTxHash` with no nonce yet, and
+             * only when the call's proposal at `nonce` hashes to it: the hash is
+             * the proof. Then the gate reads it. Never sends or releases.
+             */
+            async attachSafeNonce(client, { safeTxHash, nonce }) {
+                const result = await locked(async () => {
+                    const record = recovery.read();
+                    if (record?.safe &&
+                        !record.mirrorOf &&
+                        record.safeNonce === undefined &&
+                        record.hash === safeTxHash.toLowerCase())
+                        try {
+                            (0, safeService_js_1.canonicalSafeTxHash)(call.chainId, call.account, (0, writeRecovery_js_1.heldSafeProposal)(call, nonce), safeTxHash);
+                            recovery.proposalNonce(record, BigInt(nonce));
+                        }
+                        catch {
+                            /* Not this proposal at that nonce: nothing saved. */
+                        }
+                    return inspect(client);
+                }, true);
+                return shown(result?.value ?? peek());
+            },
             async attachHash(client, hash) {
                 const result = await locked(async () => {
                     const record = recovery.read();
@@ -929,12 +1098,8 @@ function createWriteHold(options = {}) {
                         const sent = await client
                             .getTransaction({ hash })
                             .catch(() => null);
-                        if (sent?.hash?.toLowerCase() === hash.toLowerCase() &&
-                            sent.from?.toLowerCase() === record.account &&
-                            (sent.chainId === undefined || sent.chainId === record.chainId) &&
-                            sent.to?.toLowerCase() === record.call.to &&
-                            sent.input?.toLowerCase() === record.call.data &&
-                            BigInt(sent.value) === BigInt(record.call.value) &&
+                        if (sent &&
+                            sentIsCall(sent, hash, record) &&
                             // This attempt, not an earlier identical call: never below the
                             // account's next nonce or mined before it was reserved.
                             // With no such evidence, an identical earlier call can't be
@@ -990,7 +1155,13 @@ function createWriteHold(options = {}) {
     /**
      * `legacy`: for a write held under an intent namespace, the keys an earlier
      * version held it under (an old namespace, or `{ call }` for an exact
-     * call); the current exact call is always checked. While any of them holds
+     * call); the current exact call is always checked. `{ match: { to,
+     * selector } }` finds them instead: every exact-call write this account
+     * saved on this chain to `to` with that 4-byte selector, for a hold saved
+     * before the intent key existed under calldata the retry can't rebuild (an
+     * old minimum, expiration or deadline). Pass one only for a write whose
+     * calldata is volatile: it holds every such call. It is found when the
+     * handle opens, and again right before a send reserves. While any of them holds
      * an unresolved write, the intent handle *is* that hold: its state, its
      * refusal and its own exit, in place. Each is checked alone, under its own
      * lock only, never two at once. Only when all are clear does the intent's
@@ -1000,6 +1171,9 @@ function createWriteHold(options = {}) {
     function open(call, { legacy = [], } = {}) {
         if (call.namespace === undefined)
             return openExact(call);
+        const matches = legacy.flatMap((source) => typeof source === "object" && "match" in source ? [source.match] : []);
+        /** Every exact-call write the matches find in storage now. */
+        const matched = () => matches.flatMap((match) => (0, writeRecovery_js_1.findReviewedWrites)({ chainId: call.chainId, account: call.account, ...match }, { storage }));
         const namespace = call.namespace;
         const own = openOne(call, {
             across: reserveAcross,
@@ -1011,19 +1185,54 @@ function createWriteHold(options = {}) {
         const { namespace: _, ...exact } = call;
         const scopeOf = (input) => (0, writeRecovery_js_1.createBrowserWriteRecovery)(input, { storage }).scopeKey;
         const scopes = new Set([scopeOf(call)]);
-        const inputs = [{ call: call.call }, ...legacy]
-            .map((source) => typeof source === "string"
-            ? { ...call, namespace: source }
-            : { ...exact, call: source.call })
-            .filter((input) => {
-            const scope = scopeOf(input);
-            return !scopes.has(scope) && !!scopes.add(scope);
-        })
-            // One canonical order, by scope, for every writer's locks.
-            .sort((a, b) => Number(scopeOf(a) > scopeOf(b)) - Number(scopeOf(a) < scopeOf(b)));
         // Mirror-aware: evidence and exits always act on the source attempt.
-        const delegates = inputs.map((input) => openExact(input));
-        const journals = inputs.map((input) => (0, writeRecovery_js_1.createBrowserWriteRecovery)(input, { storage, locks: options.locks }));
+        const delegates = [];
+        const journals = [];
+        /** Hold `inputs` too, each once, in one canonical order by scope for every writer's locks. */
+        function include(inputs) {
+            const added = inputs.filter(({ input, at }) => {
+                const scope = at ?? scopeOf(input);
+                return !scopes.has(scope) && !!scopes.add(scope);
+            });
+            if (!added.length)
+                return;
+            const keyed = [
+                ...delegates.map((delegate, index) => ({
+                    delegate,
+                    journal: journals[index],
+                })),
+                ...added.map(({ input, at }) => ({
+                    delegate: openExact(input, at),
+                    journal: (0, writeRecovery_js_1.createBrowserWriteRecovery)(input, {
+                        storage,
+                        locks: options.locks,
+                        at,
+                    }),
+                })),
+            ].sort((a, b) => Number(a.journal.scopeKey > b.journal.scopeKey) -
+                Number(a.journal.scopeKey < b.journal.scopeKey));
+            delegates.splice(0, delegates.length, ...keyed.map((k) => k.delegate));
+            journals.splice(0, journals.length, ...keyed.map((k) => k.journal));
+        }
+        /**
+         * Look for matching writes again (on every state(), send() and exit());
+         * those found since are held too, each at the exact key it was found
+         * under, with its own Safe flag. Returns the ones that are new.
+         */
+        function rescan() {
+            const found = matched().filter(({ key }) => !scopes.has(key));
+            include(found.map(({ key, record }) => ({
+                input: { ...exact, safe: record.safe, call: record.call },
+                at: key,
+            })));
+            return found.map(({ record }) => record);
+        }
+        include([{ call: call.call }, ...legacy].flatMap((source) => typeof source === "string"
+            ? [{ input: { ...call, namespace: source } }]
+            : "call" in source
+                ? [{ input: { ...exact, call: source.call } }]
+                : []));
+        rescan();
         /** A legacy key holding anything but this intent's own mirror. */
         const foreign = (index) => journals[index].read()?.mirrorOf !== namespace &&
             delegates[index].peek().status !== "clear";
@@ -1031,6 +1240,7 @@ function createWriteHold(options = {}) {
         const active = () => delegates.find((_, index) => foreign(index));
         /** The first legacy key holding an unresolved write, through its own gate. */
         async function delegated(client) {
+            rescan();
             for (const [index, handle] of delegates.entries()) {
                 if (!foreign(index))
                     continue;
@@ -1066,14 +1276,20 @@ function createWriteHold(options = {}) {
                             entered += 1;
                             return acquire(index + 1);
                         });
+                    const refuse = (held) => new WriteHeldError(noticed({
+                        ...ungated(classify(held)),
+                        reservation: held.id,
+                    }));
                     for (const journal of journals) {
                         const held = journal.read();
                         if (held && held.mirrorOf !== namespace)
-                            throw new WriteHeldError(noticed({
-                                ...ungated(classify(held)),
-                                reservation: held.id,
-                            }));
+                            throw refuse(held);
                     }
+                    // A matching write saved since the last look holds it too, and
+                    // its own state() and exit() are reached from now on.
+                    const [late] = rescan();
+                    if (late)
+                        throw refuse(late);
                     // Another attempt since this review opened: review it again.
                     if (generations() !== reviewed)
                         throw new WriteHoldStaleReviewError(ownJournal.settled());
@@ -1161,6 +1377,7 @@ function createWriteHold(options = {}) {
                 return own.send(client, run);
             },
             async exit(snapshot, acknowledgement, client) {
+                rescan();
                 const owner = snapshot.status === "clear"
                     ? undefined
                     : delegates.find((handle, index) => {
@@ -1182,6 +1399,10 @@ function createWriteHold(options = {}) {
             onUnproven: async (...args) => active()?.onUnproven(...args) ?? after(await own.onUnproven(...args)),
             onExecuted: async (...args) => active()?.onExecuted(...args) ?? after(await own.onExecuted(...args)),
             attachHash: async (...args) => active()?.attachHash(...args) ?? after(await own.attachHash(...args)),
+            attachSafeNonce: async (...args) => active()?.attachSafeNonce(...args) ??
+                after(await own.attachSafeNonce(...args)),
+            // A legacy hold already holds it: nothing is adopted.
+            adopt: async (...args) => active()?.peek() ?? after(await own.adopt(...args)),
         };
     }
     /**
@@ -1189,11 +1410,12 @@ function createWriteHold(options = {}) {
      * it is that intent's hold: it never sends or releases on its own, and its
      * exit is the intent's. A mirror left after the intent ended is removed.
      */
-    function openExact(call) {
-        const own = openOne(call);
+    function openExact(call, at) {
+        const own = openOne(call, {}, at);
         const journal = (0, writeRecovery_js_1.createBrowserWriteRecovery)(call, {
             storage,
             locks: options.locks,
+            at,
         });
         /** The intent this key mirrors, from storage alone. */
         const mirrored = () => {
@@ -1257,6 +1479,9 @@ function createWriteHold(options = {}) {
             onUnproven: (...args) => (route() ?? own).onUnproven(...args),
             onExecuted: (...args) => (route() ?? own).onExecuted(...args),
             attachHash: (...args) => (route() ?? own).attachHash(...args),
+            attachSafeNonce: (...args) => (route() ?? own).attachSafeNonce(...args),
+            // An intent's mirror already holds it: nothing is adopted.
+            adopt: async (...args) => route()?.peek() ?? own.adopt(...args),
         };
     }
     return {
@@ -1266,14 +1491,7 @@ function createWriteHold(options = {}) {
         /** The review's line while holds last only in this tab, or null. */
         reviewLine: () => (storage.durable() ? null : messages_js_1.WRITE_HOLD_IN_TAB_LINE),
         /** Stop every settle poll and the tab listener (tests, teardown). */
-        dispose() {
-            for (const timer of timers.values())
-                clearTimeout(timer);
-            timers.clear();
-            if (onStorage)
-                globalThis.removeEventListener?.("storage", onStorage);
-            onStorage = undefined;
-        },
+        dispose,
     };
 }
 //# sourceMappingURL=writeHold.js.map