@owney/sdk 0.3.2 → 0.3.4

package/README.md

@@ -749,3 +749,7 @@ The three convenience subclasses extend `OwneyError` and remain backwards-compat
 | `NotConnectedError`           | `NOT_CONNECTED`            | —                                        |
 | `AgentNotFoundError`          | `AGENT_NOT_FOUND`          | —                                        |
 | `AgentChainIncompatibleError` | `AGENT_CHAIN_INCOMPATIBLE` | `incompatibleAgents`, `connectedChainId` |
+
+## License
+
+ELv2

package/dist/index.cjs

@@ -333,6 +333,72 @@ function mapApyByStrategy(raw) {
   };
 }
 
+// src/agents/zyfai/zyfai.auth-cache.ts
+var KEY_PREFIX = "owney.zyfai.session";
+var storage = () => {
+  if (typeof window === "undefined")
+    return null;
+  try {
+    return window.localStorage;
+  } catch {
+    return null;
+  }
+};
+var buildKey = (address, chainId) => `${KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var isJwtExpired = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return false;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+    const claims = JSON.parse(decoded);
+    if (typeof claims.exp !== "number")
+      return false;
+    return Date.now() / 1e3 >= claims.exp - 30;
+  } catch {
+    return false;
+  }
+};
+var readSession = (address, chainId) => {
+  const store = storage();
+  if (!store)
+    return null;
+  const raw = store.getItem(buildKey(address, chainId));
+  if (!raw)
+    return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed.token || isJwtExpired(parsed.token)) {
+      store.removeItem(buildKey(address, chainId));
+      return null;
+    }
+    return parsed;
+  } catch {
+    store.removeItem(buildKey(address, chainId));
+    return null;
+  }
+};
+var writeSession = (address, chainId, session) => {
+  const store = storage();
+  if (!store)
+    return;
+  try {
+    store.setItem(buildKey(address, chainId), JSON.stringify(session));
+  } catch {
+  }
+};
+var clearSession = (address, chainId) => {
+  const store = storage();
+  if (!store)
+    return;
+  try {
+    store.removeItem(buildKey(address, chainId));
+  } catch {
+  }
+};
+
 // src/agents/zyfai/zyfai.agent.ts
 var DEFAULT_ZYFAI_RPC_URLS = {
   8453: "https://base-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
@@ -363,6 +429,49 @@ var ZyfaiAgent = class {
       apiKey,
       rpcUrls: rpcUrls ?? DEFAULT_ZYFAI_RPC_URLS
     });
+    this.installAuthCache();
+  }
+  /**
+   * Patches `sdk.authenticateUser` so a fresh page can reuse the JWT from a
+   * prior session instead of triggering a new SIWE prompt. Runs inside
+   * `connectAccount` AFTER wallet setup but BEFORE the real SIWE handshake
+   * (Zyfai dist line 1374). At that point `walletClient` + `currentChainId`
+   * are populated, so the cache lookup has both keys it needs.
+   *
+   * No-op on the server (no `window`) — the SDK is constructed during SSR
+   * for some apps and the patch only matters in the browser anyway.
+   */
+  installAuthCache() {
+    if (typeof window === "undefined")
+      return;
+    const internals = this.sdk;
+    const original = internals.authenticateUser.bind(internals);
+    internals.authenticateUser = async () => {
+      if (internals.authenticatedUserId !== null)
+        return;
+      const address = internals.walletClient?.account?.address;
+      const chainId = internals.currentChainId;
+      if (address && chainId) {
+        const cached = readSession(address, chainId);
+        if (cached) {
+          internals.httpClient.setAuthToken(cached.token);
+          internals.authenticatedUserId = cached.userId;
+          internals.hasActiveSessionKey = cached.hasActiveSessionKey;
+          return;
+        }
+      }
+      await original();
+      const newAddress = internals.walletClient?.account?.address;
+      const newChainId = internals.currentChainId;
+      const newToken = internals.httpClient.authToken;
+      if (newAddress && newChainId && newToken) {
+        writeSession(newAddress, newChainId, {
+          token: newToken,
+          userId: internals.authenticatedUserId,
+          hasActiveSessionKey: internals.hasActiveSessionKey
+        });
+      }
+    };
   }
   // --- Private helpers ---
   getAddress() {
@@ -387,7 +496,7 @@ var ZyfaiAgent = class {
       return;
     }
     this.connectAuthPromise = (async () => {
-      const address = await this.sdk.connectAccount(
+      const address = await this.connectAccountWithRetry(
         state.provider,
         validChainId
       );
@@ -400,6 +509,29 @@ var ZyfaiAgent = class {
       this.connectAuthPromise = null;
     }
   }
+  /**
+   * Wraps `sdk.connectAccount` with a one-shot retry on auth errors. If the
+   * cached JWT is rejected by the backend (revoked, signing-key rotated, etc.)
+   * we drop the cache and try again — the second attempt has no cache entry,
+   * so it falls through to a real SIWE prompt. Zyfai collapses every 4xx into
+   * an `"Unauthorized: Invalid API key"` error so we can't distinguish revoked
+   * JWT from a misconfigured API key; we retry once either way, and if the
+   * second attempt still fails the original error propagates.
+   */
+  async connectAccountWithRetry(provider, chainId) {
+    try {
+      return await this.sdk.connectAccount(provider, chainId);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!message.toLowerCase().includes("unauthorized"))
+        throw error;
+      const internals = this.sdk;
+      const address = internals.walletClient?.account?.address;
+      if (address)
+        clearSession(address, chainId);
+      return await this.sdk.connectAccount(provider, chainId);
+    }
+  }
   /** Full connect: SIWE auth + Safe deploy check + session key. */
   async connectFull(state, chainId) {
     await this.connectAuth(state, chainId);
@@ -434,6 +566,9 @@ var ZyfaiAgent = class {
   }
   // --- IAgent: Connection lifecycle ---
   async disconnect() {
+    if (this.connectedAddress && this.connectedChainId !== null) {
+      clearSession(this.connectedAddress, this.connectedChainId);
+    }
     await this.sdk.disconnectAccount();
     this.connectedAddress = null;
     this.connectedChainId = null;
@@ -1050,7 +1185,7 @@ var OwneySDK = class {
       const token = balance.tokens.find(
         (t) => t.chainId === chainId && t.asset.toLowerCase() === target
       );
-      return !!token && BigInt(token.amount) > 0n;
+      return !!token && Number(token.amount) > 0;
     } catch {
       return false;
     }

package/dist/index.js

@@ -303,6 +303,72 @@ function mapApyByStrategy(raw) {
   };
 }
 
+// src/agents/zyfai/zyfai.auth-cache.ts
+var KEY_PREFIX = "owney.zyfai.session";
+var storage = () => {
+  if (typeof window === "undefined")
+    return null;
+  try {
+    return window.localStorage;
+  } catch {
+    return null;
+  }
+};
+var buildKey = (address, chainId) => `${KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var isJwtExpired = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return false;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+    const claims = JSON.parse(decoded);
+    if (typeof claims.exp !== "number")
+      return false;
+    return Date.now() / 1e3 >= claims.exp - 30;
+  } catch {
+    return false;
+  }
+};
+var readSession = (address, chainId) => {
+  const store = storage();
+  if (!store)
+    return null;
+  const raw = store.getItem(buildKey(address, chainId));
+  if (!raw)
+    return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed.token || isJwtExpired(parsed.token)) {
+      store.removeItem(buildKey(address, chainId));
+      return null;
+    }
+    return parsed;
+  } catch {
+    store.removeItem(buildKey(address, chainId));
+    return null;
+  }
+};
+var writeSession = (address, chainId, session) => {
+  const store = storage();
+  if (!store)
+    return;
+  try {
+    store.setItem(buildKey(address, chainId), JSON.stringify(session));
+  } catch {
+  }
+};
+var clearSession = (address, chainId) => {
+  const store = storage();
+  if (!store)
+    return;
+  try {
+    store.removeItem(buildKey(address, chainId));
+  } catch {
+  }
+};
+
 // src/agents/zyfai/zyfai.agent.ts
 var DEFAULT_ZYFAI_RPC_URLS = {
   8453: "https://base-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
@@ -333,6 +399,49 @@ var ZyfaiAgent = class {
       apiKey,
       rpcUrls: rpcUrls ?? DEFAULT_ZYFAI_RPC_URLS
     });
+    this.installAuthCache();
+  }
+  /**
+   * Patches `sdk.authenticateUser` so a fresh page can reuse the JWT from a
+   * prior session instead of triggering a new SIWE prompt. Runs inside
+   * `connectAccount` AFTER wallet setup but BEFORE the real SIWE handshake
+   * (Zyfai dist line 1374). At that point `walletClient` + `currentChainId`
+   * are populated, so the cache lookup has both keys it needs.
+   *
+   * No-op on the server (no `window`) — the SDK is constructed during SSR
+   * for some apps and the patch only matters in the browser anyway.
+   */
+  installAuthCache() {
+    if (typeof window === "undefined")
+      return;
+    const internals = this.sdk;
+    const original = internals.authenticateUser.bind(internals);
+    internals.authenticateUser = async () => {
+      if (internals.authenticatedUserId !== null)
+        return;
+      const address = internals.walletClient?.account?.address;
+      const chainId = internals.currentChainId;
+      if (address && chainId) {
+        const cached = readSession(address, chainId);
+        if (cached) {
+          internals.httpClient.setAuthToken(cached.token);
+          internals.authenticatedUserId = cached.userId;
+          internals.hasActiveSessionKey = cached.hasActiveSessionKey;
+          return;
+        }
+      }
+      await original();
+      const newAddress = internals.walletClient?.account?.address;
+      const newChainId = internals.currentChainId;
+      const newToken = internals.httpClient.authToken;
+      if (newAddress && newChainId && newToken) {
+        writeSession(newAddress, newChainId, {
+          token: newToken,
+          userId: internals.authenticatedUserId,
+          hasActiveSessionKey: internals.hasActiveSessionKey
+        });
+      }
+    };
   }
   // --- Private helpers ---
   getAddress() {
@@ -357,7 +466,7 @@ var ZyfaiAgent = class {
       return;
     }
     this.connectAuthPromise = (async () => {
-      const address = await this.sdk.connectAccount(
+      const address = await this.connectAccountWithRetry(
         state.provider,
         validChainId
       );
@@ -370,6 +479,29 @@ var ZyfaiAgent = class {
       this.connectAuthPromise = null;
     }
   }
+  /**
+   * Wraps `sdk.connectAccount` with a one-shot retry on auth errors. If the
+   * cached JWT is rejected by the backend (revoked, signing-key rotated, etc.)
+   * we drop the cache and try again — the second attempt has no cache entry,
+   * so it falls through to a real SIWE prompt. Zyfai collapses every 4xx into
+   * an `"Unauthorized: Invalid API key"` error so we can't distinguish revoked
+   * JWT from a misconfigured API key; we retry once either way, and if the
+   * second attempt still fails the original error propagates.
+   */
+  async connectAccountWithRetry(provider, chainId) {
+    try {
+      return await this.sdk.connectAccount(provider, chainId);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!message.toLowerCase().includes("unauthorized"))
+        throw error;
+      const internals = this.sdk;
+      const address = internals.walletClient?.account?.address;
+      if (address)
+        clearSession(address, chainId);
+      return await this.sdk.connectAccount(provider, chainId);
+    }
+  }
   /** Full connect: SIWE auth + Safe deploy check + session key. */
   async connectFull(state, chainId) {
     await this.connectAuth(state, chainId);
@@ -404,6 +536,9 @@ var ZyfaiAgent = class {
   }
   // --- IAgent: Connection lifecycle ---
   async disconnect() {
+    if (this.connectedAddress && this.connectedChainId !== null) {
+      clearSession(this.connectedAddress, this.connectedChainId);
+    }
     await this.sdk.disconnectAccount();
     this.connectedAddress = null;
     this.connectedChainId = null;
@@ -1020,7 +1155,7 @@ var OwneySDK = class {
       const token = balance.tokens.find(
         (t) => t.chainId === chainId && t.asset.toLowerCase() === target
       );
-      return !!token && BigInt(token.amount) > 0n;
+      return !!token && Number(token.amount) > 0;
     } catch {
       return false;
     }

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@owney/sdk",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
+  "license": "ELv2",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",