@tchain/tcabci-read-js-client 2.7.11 → 2.7.13

package/errors.d.ts

@@ -13,12 +13,26 @@ export declare const ALREADY_CONNECTED: ErrMessage,
   TRANSACTION_NOT_BROADCAST: ErrMessage
 
 export declare class FetchError extends Error {
-  code: number
-  response: Record<string, any>
+  readonly code: number
+  status: number
+  response?: Record<string, any>
   originError?: Error
+
   constructor(message: string)
+
   setStatus(status: number): FetchError
+
   setCode(code: number): FetchError
+
   setResponse(data: Record<string, any>): FetchError
+
   setOriginError(error: Error): FetchError
 }
+
+export declare class CopiedError extends Error {
+  originName: string
+  originError: Error
+  originStack?: string
+
+  constructor(err: Error)
+}

package/errors.js

@@ -2,7 +2,7 @@ export const ALREADY_CONNECTED = 'Already connected',
   NOT_CONNECTED = 'Not connected',
   ERR_NETWORK = 'Network Error',
   INVALID_ARGUMENTS = 'Check your arguments',
-  INVALID_ARGUMENT_WITH_CS = val => {
+  INVALID_ARGUMENT_WITH_CS = (val) => {
     return INVALID_ARGUMENTS + ' ' + val
   },
   NOT_SUBSCRIBED = 'Not subscribed',
@@ -31,6 +31,10 @@ export class CopiedError extends Error {
 }
 
 export class FetchError extends Error {
+  get code() {
+    return this.status
+  }
+
   status = -1
   response
   originError

package/http.d.ts

@@ -1,9 +1,34 @@
-import { Request } from 'express'
+import { ClientOptions, JSONValue, RequestOptions } from './types.js'
+
+export type HTTPRequestInit = Omit<RequestInit, 'body'> & {
+  body?: string | ArrayBuffer | ArrayBufferView | null
+}
+
+export interface HTTPRequestOptions extends RequestOptions {
+  retry?: boolean
+}
 
 export declare class HTTP {
-  constructor(baseURL: string)
-  setBaseURL(baseURL: string): HTTP
-  request(uri: string, req: Request): Promise<Record<string, any>>
-  handleResponse(response: Response): Promise<any>
-  handleError(err: Error, custom: Record<string, any> | Error): Promise<any>
+  constructor(baseURL?: string | null, options?: ClientOptions)
+
+  setBaseURL(baseURL: string): this
+
+  abort(): void
+
+  request(
+    uri: string,
+    req?: HTTPRequestInit,
+    options?: HTTPRequestOptions
+  ): Promise<JSONValue>
+
+  handleResponse(
+    response: Response,
+    maxBytes?: number,
+    signal?: AbortSignal
+  ): Promise<JSONValue>
+
+  handleError(
+    err: Error & { status?: number; code?: number | string },
+    custom?: Record<string, Error> | Error | null
+  ): Promise<never>
 }

package/http.js

@@ -1,83 +1,317 @@
+import { SendThrow } from './util.js'
 import { ERR_NETWORK, FetchError, INVALID_ARGUMENTS } from './errors.js'
 import { Breaker } from './breaker.js'
-import { Debug } from '@streetbyters/js-debug'
+import {
+  CLIENT_VERSION,
+  endpoint,
+  positiveInteger,
+  cloneAndFreeze,
+  byteLength
+} from './validation.js'
 
 export class HTTP {
   _baseURL
-  _version = 'v2.7.1'
   _breaker = new Breaker()
-  constructor(baseURL = null) {
-    this._baseURL = baseURL
+  _controllers = new Set()
+
+  /**
+   * @param {string|null} [baseURL=null]
+   * @param {import('./types.js').ClientOptions} [options={}] Frozen config snapshot.
+   */
+  constructor(baseURL = null, options = {}) {
+    this._options = Object.freeze({
+      timeoutMs: options.timeoutMs ?? 30000,
+      maxResponseBytes: options.maxResponseBytes ?? 64 * 1024 * 1024,
+      maxRequestBytes: options.maxRequestBytes ?? 16 * 1024 * 1024,
+      maxConcurrentRequests: options.maxConcurrentRequests ?? 32,
+      allowInsecure: options.allowInsecure === true
+    })
+
+    for (const name of [
+      'timeoutMs',
+      'maxResponseBytes',
+      'maxRequestBytes',
+      'maxConcurrentRequests'
+    ])
+      positiveInteger(this._options[name], name)
+
+    if (baseURL !== null) this.setBaseURL(baseURL)
   }
+
   setBaseURL(baseURL) {
-    this._baseURL = baseURL
+    const url = endpoint(
+      baseURL,
+      ['https:', 'http:'],
+      this._options.allowInsecure
+    )
+
+    if (url.search) throw new TypeError('Endpoint query is not supported')
+
+    this._baseURL = url.href.replace(/\/$/, '')
+
     return this
   }
+
+  /**
+   * Abort all active requests without retaining caller abort reasons.
+   * @returns {void}
+   */
+  abort() {
+    for (const controller of this._controllers) controller.abort()
+  }
+
   /**
+   * Bounded JSON request with redirect rejection and a total deadline.
+   * Owns only encoded/copied body bytes; wipes them after fetch/retries settle.
+   * Fetch-owned response chunks and caller buffers are never mutated.
    * @param {string} uri
-   * @param {RequestInit} req
-   * @return {Promise<Record<string, any>>}
+   * @param {import('./http.js').HTTPRequestInit} [req={}]
+   * @param {import('./http.js').HTTPRequestOptions} [options={}]
+   * @returns {Promise<import('./types.js').JSONValue>} Deeply frozen, readonly JSON snapshot.
    */
-  async request(uri, req) {
-    req.cache = 'no-cache'
-    req.headers = {
-      Client: `tcabaci-read-js-client/${this._version}`
-    }
-    req.priority = 'high'
+  async request(uri, req = {}, options = {}) {
+    if (!this._baseURL) throw new TypeError('HTTP endpoint is not configured')
+
+    if (this._controllers.size >= this._options.maxConcurrentRequests)
+      throw new FetchError('Too many concurrent requests')
+
+    if (
+      typeof uri !== 'string' ||
+      !uri.startsWith('/') ||
+      uri.startsWith('//') ||
+      uri.includes('#')
+    )
+      throw new TypeError('Invalid request path')
+
+    const timeoutMs = positiveInteger(
+        options.timeoutMs ?? this._options.timeoutMs,
+        'timeoutMs'
+      ),
+      maxResponseBytes = positiveInteger(
+        options.maxResponseBytes ?? this._options.maxResponseBytes,
+        'maxResponseBytes'
+      ),
+      url = new URL(this._baseURL + uri)
+
+    if (url.origin !== new URL(this._baseURL).origin)
+      throw new TypeError('Invalid request origin')
+
+    const controller = new AbortController(),
+      callerSignal = options.signal ?? req.signal,
+      abort = () => controller.abort()
+    let timer, body, ownedBody
+
+    this._controllers.add(controller)
+
+    try {
+      const headers = new Headers(req.headers)
+
+      headers.set('Client', `tcabci-read-js-client/${CLIENT_VERSION}`)
+
+      if (callerSignal?.aborted) abort()
+      else callerSignal?.addEventListener('abort', abort, { once: true })
+
+      timer = setTimeout(abort, timeoutMs)
+      controller.signal.throwIfAborted()
+      body = req.body
+
+      if (typeof body === 'string') {
+        // The string belongs to the caller; only this encoded copy is ours.
+        if (byteLength(body) > this._options.maxRequestBytes)
+          SendThrow(new FetchError('Request body exceeds limit'))
+
+        ownedBody = new TextEncoder().encode(body)
+      } else if (ArrayBuffer.isView(body)) {
+        if (body.byteLength > this._options.maxRequestBytes)
+          SendThrow(new FetchError('Request body exceeds limit'))
+
+        ownedBody = new Uint8Array(
+          new Uint8Array(body.buffer, body.byteOffset, body.byteLength)
+        )
+      } else if (body instanceof ArrayBuffer) {
+        if (body.byteLength > this._options.maxRequestBytes)
+          SendThrow(new FetchError('Request body exceeds limit'))
+
+        ownedBody = new Uint8Array(body.slice(0))
+      } else if (body != null) {
+        SendThrow(new TypeError('Request body must be text or bytes'))
+      }
+
+      if (ownedBody) {
+        if (ownedBody.byteLength > this._options.maxRequestBytes)
+          SendThrow(new FetchError('Request body exceeds limit'))
+
+        body = ownedBody
+
+        if (!headers.has('Content-Type'))
+          headers.set('Content-Type', 'application/json')
+      }
+
+      const method = (req.method ?? 'GET').toUpperCase(),
+        execute = async () => {
+          controller.signal.throwIfAborted()
+
+          let response
+
+          try {
+            response = await fetch(url.href, {
+              ...req,
+              method,
+              body,
+              headers,
+              cache: 'no-store',
+              redirect: 'error',
+              signal: controller.signal
+            })
+          } catch {
+            if (controller.signal.aborted)
+              throw new FetchError('Request aborted')
+
+            throw new FetchError(ERR_NETWORK)
+          }
+
+          return this.handleResponse(
+            response,
+            maxResponseBytes,
+            controller.signal
+          )
+        }
+
+      return await this._breaker.execute(
+        execute,
+        controller.signal,
+        options.retry ?? ['GET', 'HEAD'].includes(method)
+      )
+    } catch (error) {
+      if (controller.signal.aborted) throw new FetchError('Request aborted')
+
+      if (error instanceof FetchError) throw error
 
-    return this._breaker
-      .execute(() => {
-        return fetch(this._baseURL + uri, req)
-      })
-      .then(response => this.handleResponse(response))
+      // Do not preserve input, URLs, AbortSignal.reason or transport causes.
+      throw new FetchError('Request failed')
+    } finally {
+      clearTimeout(timer)
+      callerSignal?.removeEventListener('abort', abort)
+      this._controllers.delete(controller)
+      ownedBody?.fill(0)
+      body = undefined
+    }
   }
 
   /**
+   * Read a bounded response, wipe owned byte copies, redact parsing failures.
+   * Returned JSON strings and engine/native copies cannot be reliably erased.
    * @param {Response} response
-   * @return {Promise<*>}
+   * @param {number} [maxBytes]
+   * @param {AbortSignal} [signal]
+   * @returns {Promise<import('./types.js').JSONValue>} Deeply frozen, readonly JSON snapshot.
    */
-  async handleResponse(response) {
-    if (response.status >= 200 && response.status < 400) {
-      return response.json()
+  async handleResponse(
+    response,
+    maxBytes = this._options.maxResponseBytes,
+    signal
+  ) {
+    if (response.status < 200 || response.status >= 300) {
+      await response.body?.cancel().catch(() => {})
+
+      throw new FetchError('HTTP request failed').setStatus(response.status)
     }
 
-    try {
-      const data = JSON.parse(await response.text())
+    if (response.status === 204 || response.status === 205) return null
 
-      return Promise.reject(
-        new FetchError(data.message)
-          .setStatus(response.status)
-          .setResponse(data)
+    const declared = Number(response.headers.get('content-length'))
+
+    if (declared > maxBytes) {
+      await response.body?.cancel().catch(() => {})
+
+      throw new FetchError('Response body exceeds limit').setStatus(
+        response.status
       )
-    } catch (e) {
-      Debug.error(e)
-      return Promise.reject(
-        new FetchError(response.statusText).setOriginError(e)
+    }
+
+    const reader = response.body?.getReader()
+
+    if (!reader)
+      throw new FetchError('Invalid JSON response').setStatus(response.status)
+
+    const chunks = []
+    let size = 0,
+      bytes,
+      completed = false
+    const abort = () => {
+      reader.cancel().catch(() => {})
+    }
+
+    signal?.addEventListener('abort', abort, { once: true })
+
+    try {
+      signal?.throwIfAborted()
+
+      while (true) {
+        const { value, done } = await reader.read()
+
+        signal?.throwIfAborted()
+
+        if (done) {
+          completed = true
+          break
+        }
+
+        size += value.byteLength
+
+        if (size > maxBytes)
+          SendThrow(new FetchError('Response body exceeds limit'))
+
+        // Fetch owns its chunks. Copy before retaining; never wipe shared input.
+        if (chunks.length >= 65536)
+          SendThrow(new FetchError('Response chunk limit exceeded'))
+
+        chunks.push(new Uint8Array(value))
+      }
+
+      bytes = new Uint8Array(size)
+
+      let offset = 0
+
+      for (const chunk of chunks) {
+        bytes.set(chunk, offset)
+        offset += chunk.length
+      }
+
+      return cloneAndFreeze(
+        JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))
       )
+    } catch (error) {
+      if (signal?.aborted) throw new FetchError('Request aborted')
+
+      if (error instanceof FetchError) throw error.setStatus(response.status)
+
+      throw new FetchError('Invalid JSON response').setStatus(response.status)
+    } finally {
+      signal?.removeEventListener('abort', abort)
+
+      if (!completed) await reader.cancel().catch(() => {})
+
+      reader.releaseLock()
+
+      for (const chunk of chunks) chunk.fill(0)
+
+      chunks.length = 0
+      bytes?.fill(0)
     }
   }
 
-  /**
-   * @param {Error} err
-   * @param {?Object|Error} custom
-   * @return {Promise<Error>}
-   */
   async handleError(err, custom = null) {
-    const code = err.code
+    const code = err.status ?? err.code
 
-    if (custom && typeof custom === 'object' && custom[code]) {
-      return Promise.reject(custom[code])
-    } else if (custom instanceof Error) {
-      return Promise.reject(custom)
-    }
+    if (custom instanceof Error) throw custom
 
-    switch (code) {
-      case 400:
-        return Promise.reject(new Error(INVALID_ARGUMENTS))
-      case 'ERR_NETWORK':
-        return Promise.reject(new Error(ERR_NETWORK))
-      default:
-        return Promise.reject(err)
-    }
+    if (custom && Object.hasOwn(custom, code)) throw custom[code]
+
+    if (code === 400) throw new Error(INVALID_ARGUMENTS)
+
+    if (code === 'ERR_NETWORK') throw new Error(ERR_NETWORK)
+
+    throw err
   }
 }

package/message.d.ts

@@ -1,48 +1,51 @@
-import { TXType } from './transaction'
-
-export declare type MessageType = string
-
-export declare const SUBSCRIBEMessage: MessageType,
-  UNSUBSCRIBEMessage: MessageType
-
-export declare type MType = number
-
-export declare const Block: MessageType,
-  Transaction: MessageType,
-  Subscription: MessageType,
-  Listen: MessageType,
-  MSG: MessageType
-
-export declare type MState = number
-
-export declare const OK: MState, FAIL: MState
-
-export declare class Message {
-  constructor({
-    isWeb,
-    type,
-    addrs,
-    signedData,
-    txTypes
-  }?: {
-    isWeb: boolean
-    type: MessageType
-    addrs: string[]
-    signedData?: Record<string, string>
-    txTypes?: TXType[]
+import { TXType } from './transaction.js'
+import { JSONValue, ParseResult } from './types.js'
+
+export type MessageType = 'subscribe' | 'unsubscribe' | 0 | 1 | 2 | 3 | 4
+
+export type MType = 0 | 1 | 2 | 3 | 4
+
+export type MState = 1 | 2
+
+export declare const SUBSCRIBEMessage: 'subscribe',
+  UNSUBSCRIBEMessage: 'unsubscribe',
+  Block: 0,
+  Transaction: 1,
+  Subscription: 2,
+  Listen: 3,
+  MSG: 4,
+  OK: 1,
+  FAIL: 2
+
+export default class Message {
+  constructor(options?: {
+    isWeb?: boolean
+    type?: MessageType
+    addrs?: readonly string[]
+    signedData?: Readonly<Record<string, string>> | null
+    txTypes?: readonly TXType[] | null
+    data?: JSONValue
   })
-  get IsWeb(): boolean
-  get Type(): MessageType
-  get Addresses(): string[] | null
-  get SignedAddresses(): Record<string, string> | null
-  get TXTypes(): TXType[] | null
-  get Data(): any | null
-  get State(): MState | null
-
-  static FromJSON(value: string): { message?: Message; error?: Error }
-  static FromObject(obj: Record<string, any>): {
-    message?: Message
-    error?: Error
-  }
+
+  get IsWeb(): boolean | undefined
+
+  get Type(): MessageType | undefined
+
+  get Addresses(): readonly string[] | undefined
+
+  get SignedAddresses(): Readonly<Record<string, string>> | undefined
+
+  get TXTypes(): readonly TXType[] | undefined
+
+  get Data(): JSONValue | undefined
+
+  get State(): MState | undefined
+
+  static FromJSON(value: string): ParseResult<'message', Readonly<Message>>
+
+  static FromObject(
+    obj: Record<string, unknown>
+  ): ParseResult<'message', Readonly<Message>>
+
   ToJSON(): string
 }