@mega-yfue/eufy-sdk 0.3.0-beta.3 → 0.3.0-beta.4

package/dist/client/types.d.ts

@@ -377,8 +377,9 @@ export type EufyMegaEventMap = {
      * on `error`.
      *
      * The error carries the rate: `err.retryAfterMs` is how long the next session replacement is barred
-     * for, and `err.contended` says this session is being displaced by another client rather than expiring
-     * — which a re-login does not answer. A login made before that wait elapses extends it.
+     * for, and `err.contended` says the token was rejected again soon after being replaced, which is how
+     * displacement by another client looks and which a re-login does not answer. A login made before that
+     * wait elapses extends it.
      */
     sessionExpired: [err: SessionExpiredError];
     error: [err: Error];

package/dist/index.js

@@ -1102,8 +1102,9 @@ var SessionExpiredError = class extends Error {
   /**
    * Whether this rejection landed inside that bar — a token replaced recently and rejected again since.
    *
-   * It says the session is being DISPLACED rather than expiring: something else is signing in on this
-   * account, and replacing the token again only trades one login for another.
+   * That is the shape displacement by another client signed in on this account has, where replacing the
+   * token again only trades one login for another. It is not proof of one, since a cloud refusing to
+   * re-issue the session looks the same.
    */
   contended;
   constructor(message, opts = {}) {
@@ -1149,7 +1150,7 @@ var LoginStatus = {
 var REAUTH_HOLD_OFF_MS = 6e4;
 var REAUTH_HOLD_OFF_CAP_MS = 30 * 6e4;
 var REAUTH_STABLE_MS = 10 * 6e4;
-var CONTENDED_SESSION_HINT = "another client signed in on this account keeps displacing this session \u2014 the cloud holds about one session per account and device identity, so each login ends the other's; where the other client is another SDK install, give each its own openudid";
+var CONTENDED_SESSION_HINT = "the token was rejected again soon after it was last replaced; one possible cause is another client signed in with the same account and device identity, since the cloud holds about one session per pair and each login ends the other's (where that is another SDK install, give each its own openudid)";
 function tokenRejected(code, msg) {
   return code === EufyCloudErrorCode.SESSION_KICKED || /user_id is empty|invalid[^,]*\btoken\b|\btoken\b[^,]*(expired|error|not exist)|kicked|(?:\btoken\b|\bsession\b)[^,]*does not exist|unauthor/i.test(msg ?? "");
 }
@@ -1163,6 +1164,8 @@ var MegaHttpClient = class {
   sessionKey;
   /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
   sessionKeys = /* @__PURE__ */ new Map();
+  /** The in-flight key exchanges, by host and the token they carry — see {@link ensureSessionKey}. */
+  keyExchanges = /* @__PURE__ */ new Map();
   /**
    * The held credential. `userId` is the login reply's `ap_cloud_user_id` where it has one — the Anker
    * Passport cloud's id — while `accountUserId` is the eufy account's own `user_id`.
@@ -1384,6 +1387,20 @@ var MegaHttpClient = class {
         return cached2;
     }
     const host = isEufylife ? targetHost : this.bootstrapDomain ?? `app-openapi-${this.region}.eufy.com`;
+    const flight = `${host}
+${this.auth_?.authToken ?? ""}`;
+    const joining = this.keyExchanges.get(flight);
+    if (joining)
+      return joining;
+    const exchange = this.exchangeSessionKey(host, isEufylife).finally(() => {
+      if (this.keyExchanges.get(flight) === exchange)
+        this.keyExchanges.delete(flight);
+    });
+    this.keyExchanges.set(flight, exchange);
+    return exchange;
+  }
+  /** One key exchange against `host`, installed as that host's key. */
+  async exchangeSessionKey(host, isEufylife) {
     const kxPath = isEufylife ? "/v3/openapi/oauth/key/exchange" : "/openapi/oauth/key/exchange";
     const prep = prepareKeyExchange(isEufylife ? EUFYLIFE_LOCAL_KEY_HEX : void 0);
     const res = await this.httpPost(`https://${host}${kxPath}`, { client_public_key: prep.encryptedClientPublicKey }, {
@@ -1399,7 +1416,7 @@ var MegaHttpClient = class {
     }
     const entry = finishKeyExchange(prep, env.data.server_public_key);
     if (isEufylife)
-      this.sessionKeys.set(targetHost, entry);
+      this.sessionKeys.set(host, entry);
     else
       this.sessionKey = entry;
     return entry;
@@ -1470,9 +1487,10 @@ var MegaHttpClient = class {
     const identityError = authed && (last?.code === EufyCloudErrorCode.IDENTITY_KEY_STALE || /get identity error|identity error/i.test(last?.msg ?? ""));
     if (identityError && !retry.identity && this.auth_) {
       this.logger.debug("[mega] identity error \u2192 re-exchanging session key and retrying");
-      if (host.includes(".eufylife.com"))
-        this.sessionKeys.delete(host);
-      else
+      if (host.includes(".eufylife.com")) {
+        if (this.sessionKeys.get(host) === entry)
+          this.sessionKeys.delete(host);
+      } else if (this.sessionKey === entry)
         this.sessionKey = void 0;
       try {
         await this.ensureSessionKey(host);
@@ -1832,14 +1850,14 @@ var MegaHttpClient = class {
    * like the same device — and the cloud keeps one session per device. Each finds its token rejected, replaces
    * it, and evicts the other: an unbounded login war, silent, and repeated logins are exactly what makes an
    * account start demanding captchas. The first replacement is immediate, because a token displaced once is
-   * the ordinary case; a second one soon after is evidence of contention rather than expiry, so the wait grows
-   * and a caller is told the honest reason instead of being served a fight.
+   * the ordinary case; a second one soon after has the shape of contention rather than expiry, so the wait grows
+   * and a caller is told what was seen instead of being served a fight.
    */
   recoveryDue() {
     const remaining = this.holdOffRemainingMs();
     if (remaining === 0)
       return true;
-    this.logger.warn(`[mega] token rejected ${Math.round((Date.now() - this.lastRecoveryAt) / 1e3)}s after the last replacement \u2014 holding off ${Math.round(remaining / 1e3)}s more. ${CONTENDED_SESSION_HINT}`);
+    this.logger.warn(`[mega] holding off ${Math.round(remaining / 1e3)}s more before replacing the token again (last replaced ${Math.round((Date.now() - this.lastRecoveryAt) / 1e3)}s ago): ${CONTENDED_SESSION_HINT}`);
     return false;
   }
   /**