wireweave 0.3.27 → 0.3.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wireweave",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "nostr + webrtc voice + data SDK. networking layer for 247420 projects.",
   "type": "module",
   "main": "./src/index.js",

package/src/auth.js

@@ -1,3 +1,5 @@
+import { safeSetItem } from './safe-storage.js';
+
 const b2hex = (bytes) => Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
 const hex2b = (hex) => {
   const a = new Uint8Array(hex.length / 2);
@@ -39,9 +41,14 @@ export class NostrAuth extends EventTarget {
   }
 
   importKey(input) {
-    const sk = input.startsWith('nsec')
-      ? (() => { const d = this.NT.nip19.decode(input); if (d.type !== 'nsec') throw new Error('not nsec'); return d.data; })()
-      : hex2b(input);
+    const trimmed = (input || '').trim();
+    if (!trimmed) throw new Error('Enter a key');
+    const sk = trimmed.startsWith('nsec')
+      ? (() => { const d = this.NT.nip19.decode(trimmed); if (d.type !== 'nsec') throw new Error('not nsec'); return d.data; })()
+      : (() => {
+          if (!/^[0-9a-fA-F]{64}$/.test(trimmed)) throw new Error('Expected an nsec1… key or a 64-character hex secret key');
+          return hex2b(trimmed);
+        })();
     const pk = this.NT.getPublicKey(sk);
     this._persist(sk, pk);
     this._emit('login', { pubkey: pk });
@@ -87,8 +94,13 @@ export class NostrAuth extends EventTarget {
   _persist(sk, pk) {
     this.privkey = sk;
     this.pubkey = pk;
-    this.storage?.setItem('zn_sk', b2hex(sk));
-    this.storage?.setItem('zn_pk', pk);
+    if (!this.storage) return;
+    const okSk = safeSetItem(this.storage, this, 'zn_sk', b2hex(sk));
+    const okPk = safeSetItem(this.storage, this, 'zn_pk', pk);
+    if (!okSk || !okPk) {
+      try { this.storage.removeItem('zn_sk'); this.storage.removeItem('zn_pk'); } catch {}
+      this._emit('persist-failed', { pubkey: pk });
+    }
   }
 
   _emit(type, detail) { this.dispatchEvent(new CustomEvent(type, { detail })); }

package/src/channels.js

@@ -30,12 +30,14 @@ export class Channels extends EventTarget {
     this.pool.subscribe('channels-' + serverId,
       [{ kinds: [30078], authors: [ownerPubkey], '#d': [dTag] }],
       (event) => {
+        if (event.pubkey !== ownerPubkey) return;
         const hasTag = event.tags?.some(t => t[0] === 'd' && t[1] === dTag);
         if (!hasTag) return;
         try {
           const data = JSON.parse(event.content);
-          this.channels = data.channels || [];
-          this.categories = data.categories || [];
+          if (!data || typeof data !== 'object' || !Array.isArray(data.channels) || !Array.isArray(data.categories)) return;
+          this.channels = data.channels;
+          this.categories = data.categories;
           this._emit('updated', { channels: this.channels, categories: this.categories });
         } catch {}
       },

package/src/chat.js

@@ -12,6 +12,16 @@ export class Chat extends EventTarget {
     this.activeChannelId = null;
     this.messages = [];
     this.profiles = new Map(); this.fetching = new Set();
+    this._sendTimes = [];
+    this.rateLimitMax = 5;
+    this.rateLimitWindowMs = 10000;
+  }
+
+  rateLimitRetryAfterMs() {
+    const now = Date.now();
+    this._sendTimes = (this._sendTimes || []).filter(t => now - t < this.rateLimitWindowMs);
+    if (this._sendTimes.length < this.rateLimitMax) return 0;
+    return this._sendTimes[0] + this.rateLimitWindowMs - now;
   }
 
   async send(content, { announcement = false } = {}) {
@@ -19,6 +29,12 @@ export class Chat extends EventTarget {
     if (!this.auth.isLoggedIn() || !channelId) return;
     if (announcement && !this.isAdmin(serverId)) return;
     const trimmed = content.trim(); if (!trimmed) return;
+    const retryAfter = this.rateLimitRetryAfterMs();
+    if (retryAfter > 0) {
+      this._emit('rate-limited', { retryAfterMs: retryAfter });
+      return;
+    }
+    this._sendTimes.push(Date.now());
     const chanHex = await hexChannelId(channelId, serverId);
     const tags = [['e', chanHex, '', 'root']];
     if (announcement) tags.push(['t', 'announcement']);
@@ -71,7 +87,9 @@ export class Chat extends EventTarget {
 
   _addMessage(msg) {
     if (this.messages.find(m => m.id === msg.id)) return;
-    this.messages = [...this.messages, msg];
+    let i = this.messages.length;
+    while (i > 0 && this.messages[i - 1].timestamp > msg.timestamp) i--;
+    this.messages = [...this.messages.slice(0, i), msg, ...this.messages.slice(i)];
     this._emit('message', { message: msg });
     this._emit('messages', { list: this.messages });
   }
@@ -87,9 +105,14 @@ export class Chat extends EventTarget {
     if (this.fetching.has(pubkey)) return;
     this.fetching.add(pubkey);
     this.pool.subscribe('profile-' + pubkey,
-      [{ kinds: [0], authors: [pubkey], limit: 1 }],
-      (event) => { try { this.profiles.set(pubkey, JSON.parse(event.content)); this._emit('profile', { pubkey, profile: this.profiles.get(pubkey) }); } catch {} },
-      () => { this.pool.unsubscribe('profile-' + pubkey); this.fetching.delete(pubkey); });
+      [{ kinds: [0], authors: [pubkey] }],
+      (event) => {
+        const known = this._profileEvents?.get(pubkey);
+        if (known && known >= event.created_at) return;
+        (this._profileEvents ||= new Map()).set(pubkey, event.created_at);
+        try { this.profiles.set(pubkey, JSON.parse(event.content)); this._emit('profile', { pubkey, profile: this.profiles.get(pubkey) }); } catch {}
+      },
+      () => { this.fetching.delete(pubkey); });
   }
 
   updateProfile(pubkey, profile) { this.profiles.set(pubkey, profile); this._emit('profile', { pubkey, profile }); }

package/src/relay-pool.js

@@ -14,6 +14,7 @@ const DEFAULT_RELAYS = [
 const SEEN_MAX = 10000;
 const PENDING_MAX = 500;
 const PENDING_TTL_MS = 120000;
+const CONNECT_TIMEOUT_MS = 10000;
 const jitter = (ms) => Math.round(ms * (0.75 + Math.random() * 0.5));
 
 const lruTouch = (map, key) => {
@@ -60,6 +61,7 @@ export class RelayPool extends EventTarget {
     for (const [, rec] of this._acks) { clearTimeout(rec.timer); rec.resolve(false); }
     this._acks.clear();
     for (const [, r] of this.relays) {
+      if (r._connectTimer) clearTimeout(r._connectTimer);
       if (r.ws) {
         r.ws.onclose = null; r.ws.onerror = null; r.ws.onopen = null; r.ws.onmessage = null;
         if (typeof r.ws.removeAllListeners === 'function') r.ws.removeAllListeners();
@@ -83,7 +85,13 @@ export class RelayPool extends EventTarget {
     try { ws = new this.WS(url); }
     catch (e) { relay.status = 'error'; this._emit('relay-status', { url, status: 'error' }); return; }
     relay.ws = ws;
+    const connectTimer = setTimeout(() => {
+      if (relay.ws !== ws || relay.status !== 'connecting') return;
+      try { ws.close(); } catch {}
+    }, CONNECT_TIMEOUT_MS);
+    relay._connectTimer = connectTimer;
     ws.onopen = () => {
+      clearTimeout(connectTimer);
       relay.status = 'connected';
       relay._openedAt = Date.now();
       this._emit('relay-status', { url, status: 'connected' });
@@ -92,7 +100,7 @@ export class RelayPool extends EventTarget {
         relay.subIds.add(subId);
         if (!relay._reqSentAt) relay._reqSentAt = Date.now();
       }
-      this._drainPending();
+      this._drainPending(url, ws);
     };
     ws.onmessage = (e) => {
       if (relay._reqSentAt && relay.latencyMs === null) {
@@ -101,8 +109,9 @@ export class RelayPool extends EventTarget {
       }
       try { this._handle(url, typeof e.data === 'string' ? e.data : e.data.toString()); } catch {}
     };
-    ws.onerror = () => { relay.status = 'error'; this._emit('relay-status', { url, status: 'error' }); };
+    ws.onerror = () => { clearTimeout(connectTimer); relay.status = 'error'; this._emit('relay-status', { url, status: 'error' }); };
     ws.onclose = () => {
+      clearTimeout(connectTimer);
       relay.status = 'closed';
       this._emit('relay-status', { url, status: 'closed' });
       const sustained = relay._openedAt && Date.now() - relay._openedAt > 5000;
@@ -171,24 +180,32 @@ export class RelayPool extends EventTarget {
 
   publish(event) {
     let sent = false;
-    for (const [, relay] of this.relays) {
+    let anyDisconnected = false;
+    const sentTo = new Set();
+    for (const [url, relay] of this.relays) {
       if (relay.ws?.readyState === 1) {
         relay.ws.send(JSON.stringify(['EVENT', event]));
         sent = true;
+        sentTo.add(url);
+      } else {
+        anyDisconnected = true;
       }
     }
-    if (sent) {
-      if (event?.id) this._pendingIds.delete(event.id);
-    } else {
-      this._queuePending(event);
-    }
+    if (anyDisconnected || !sent) this._queuePending(event, sentTo);
+    else if (event?.id) this._pendingIds.delete(event.id);
     return sent;
   }
 
-  _queuePending(event) {
-    if (event?.id && this._pendingIds.has(event.id)) return;
+  // Tracks delivery per relay URL, not just "sent to at least one" — a relay
+  // mid-reconnect during a partial outage otherwise never gets the event.
+  _queuePending(event, sentTo) {
+    if (event?.id && this._pendingIds.has(event.id)) {
+      const existing = this.pending.find((p) => p.event?.id === event.id);
+      if (existing) { for (const url of sentTo) existing.sentTo.add(url); }
+      return;
+    }
     if (event?.id) this._pendingIds.add(event.id);
-    this.pending.push({ event, ts: Date.now() });
+    this.pending.push({ event, sentTo, ts: Date.now() });
     while (this.pending.length > PENDING_MAX) {
       const dropped = this.pending.shift();
       if (dropped.event?.id) this._pendingIds.delete(dropped.event.id);
@@ -218,11 +235,34 @@ export class RelayPool extends EventTarget {
     if (rec) rec.resolve(accepted);
   }
 
-  _drainPending() {
+  _drainPending(url, ws) {
     const cutoff = Date.now() - PENDING_TTL_MS;
-    const pending = this.pending.splice(0);
-    this._pendingIds.clear();
-    for (const p of pending) { if (p.ts >= cutoff) this.publish(p.event); }
+    this.pending = this.pending.filter((entry) => {
+      const alive = entry.ts >= cutoff;
+      if (!alive && entry.event?.id) this._pendingIds.delete(entry.event.id);
+      return alive;
+    });
+    if (ws) {
+      for (const entry of this.pending) {
+        if (!entry.sentTo) entry.sentTo = new Set();
+        if (entry.sentTo.has(url)) continue;
+        ws.send(JSON.stringify(['EVENT', entry.event]));
+        entry.sentTo.add(url);
+      }
+    }
+    this.pending = this.pending.filter((entry) => {
+      let anyConnected = false;
+      let allKnownSent = true;
+      for (const [u, r] of this.relays) {
+        if (r.ws?.readyState === 1) {
+          anyConnected = true;
+          if (!entry.sentTo?.has(u)) { allKnownSent = false; break; }
+        }
+      }
+      if (!anyConnected) allKnownSent = false;
+      if (allKnownSent && entry.event?.id) this._pendingIds.delete(entry.event.id);
+      return !allKnownSent;
+    });
   }
 
   isConnected() {

package/src/safe-storage.js

@@ -0,0 +1,17 @@
+const isQuotaError = (err) =>
+  err && (err.name === 'QuotaExceededError' || err.name === 'NS_ERROR_DOM_QUOTA_REACHED' || err.code === 22 || err.code === 1014);
+
+export function safeSetItem(storage, target, key, value) {
+  if (!storage) return false;
+  try {
+    storage.setItem(key, value);
+    return true;
+  } catch (err) {
+    if (isQuotaError(err)) {
+      target?.dispatchEvent?.(new CustomEvent('storage-error', { detail: { key, reason: 'quota', message: 'Storage full — some data may not be saved' } }));
+    } else {
+      target?.dispatchEvent?.(new CustomEvent('storage-error', { detail: { key, reason: 'unknown', message: err?.message || String(err) } }));
+    }
+    return false;
+  }
+}

package/src/servers.js

@@ -1,3 +1,5 @@
+import { safeSetItem } from './safe-storage.js';
+
 export class Servers extends EventTarget {
   constructor({ relayPool, auth, storage, onSwitch = null }) {
     super();
@@ -63,7 +65,7 @@ export class Servers extends EventTarget {
   async join(serverId) {
     try {
       const joined = JSON.parse(this.storage.getItem('zn_joined_servers') || '[]');
-      if (!joined.includes(serverId)) { joined.push(serverId); this.storage.setItem('zn_joined_servers', JSON.stringify(joined)); }
+      if (!joined.includes(serverId)) { joined.push(serverId); safeSetItem(this.storage, this, 'zn_joined_servers', JSON.stringify(joined)); }
     } catch {}
     if (!this.servers.find(s => s.id === serverId)) { this.servers = [...this.servers, { id: serverId, name: serverId.slice(0, 8), iconColor: '#5865F2' }]; this._persist(); }
     await this.switchTo(serverId);
@@ -74,7 +76,7 @@ export class Servers extends EventTarget {
     this._persist();
     try {
       const joined = JSON.parse(this.storage.getItem('zn_joined_servers') || '[]');
-      this.storage.setItem('zn_joined_servers', JSON.stringify(joined.filter(id => id !== serverId)));
+      safeSetItem(this.storage, this, 'zn_joined_servers', JSON.stringify(joined.filter(id => id !== serverId)));
     } catch {}
     if (this.currentServerId === serverId) await this.switchTo(null);
     else this._emit('updated', { servers: this.servers });
@@ -84,7 +86,7 @@ export class Servers extends EventTarget {
 
   async switchTo(serverId) {
     this.currentServerId = serverId;
-    if (serverId) this.storage.setItem('zn_lastServer', serverId); else this.storage.removeItem('zn_lastServer');
+    if (serverId) safeSetItem(this.storage, this, 'zn_lastServer', serverId); else this.storage.removeItem('zn_lastServer');
     this._emit('switched', { serverId });
     await this.onSwitch?.(serverId);
   }
@@ -97,7 +99,7 @@ export class Servers extends EventTarget {
   }
 
   getOrder() { try { return JSON.parse(this.storage.getItem('zn_serverOrder') || '[]'); } catch { return []; } }
-  saveOrder(ids) { this.storage.setItem('zn_serverOrder', JSON.stringify(ids)); this._emit('updated', { servers: this.servers }); }
+  saveOrder(ids) { safeSetItem(this.storage, this, 'zn_serverOrder', JSON.stringify(ids)); this._emit('updated', { servers: this.servers }); }
   sorted() {
     const order = this.getOrder();
     if (!order.length) return this.servers;
@@ -105,7 +107,7 @@ export class Servers extends EventTarget {
     return this.servers.slice().sort((a, b) => (idx[a.id] ?? Infinity) - (idx[b.id] ?? Infinity));
   }
 
-  _persist() { this.storage.setItem('zn_servers', JSON.stringify(this.servers)); }
+  _persist() { safeSetItem(this.storage, this, 'zn_servers', JSON.stringify(this.servers)); }
   _emit(t, d) { this.dispatchEvent(new CustomEvent(t, { detail: d })); }
 }
 

package/src/voice.js

@@ -56,6 +56,7 @@ export class VoiceSession extends EventTarget {
     this.muted = false; this.deafened = false;
     this.sfu = { mode: 'mesh', hub: null, hubLostAt: null, rttMatrix: new Map(), electionTimer: null, statsInterval: null, actor: null };
     this.retrySchedule = {};
+    this._epoch = 0;
   }
 
   _initActor() {
@@ -64,16 +65,31 @@ export class VoiceSession extends EventTarget {
     this.actor.start();
   }
 
+  // Reentrancy guard: connect()/disconnect() are async and mutate shared
+  // instance state (peers, participants, localStream, roomId) across several
+  // await points. Rapid join→leave→rejoin (or a double-click join) used to
+  // interleave two in-flight calls: a stale connect() resuming after a newer
+  // disconnect() had already torn everything down would re-populate roomId/
+  // participants and re-send 'connected' into an actor the fresh call had
+  // already returned to idle, leaking the stale heartbeat/presence
+  // subscriptions and getUserMedia stream. Every call captures the epoch at
+  // entry and re-checks it after each await; a superseded call unwinds
+  // whatever it acquired instead of mutating shared state.
   async connect(channelName, { displayName = 'Guest' } = {}) {
     if (!this.actor) this._initActor();
     if (!this.actor.getSnapshot().can({ type: 'connect' })) await this.disconnect();
+    const epoch = ++this._epoch;
     this.actor.send({ type: 'connect' });
     this.channelName = channelName;
     this.joinTs = Math.floor(Date.now() / 1000);
     this.displayName = displayName;
     try {
-      this.roomId = await deriveRoomId(this.serverId, channelName);
-      this.localStream = await this.md.getUserMedia({ audio: { echoCancellation: true, noiseSuppression: true, autoGainControl: true } });
+      const roomId = await deriveRoomId(this.serverId, channelName);
+      if (epoch !== this._epoch) return;
+      const stream = await this.md.getUserMedia({ audio: { echoCancellation: true, noiseSuppression: true, autoGainControl: true } });
+      if (epoch !== this._epoch) { stream.getTracks().forEach(t => t.stop()); return; }
+      this.roomId = roomId;
+      this.localStream = stream;
       // PTT default: gate closed at join. Apps that want always-on call setMuted(false).
       this.muted = true;
       this.localStream.getAudioTracks().forEach(t => t.enabled = false);
@@ -84,10 +100,12 @@ export class VoiceSession extends EventTarget {
       this._subscribeSignals();
       this._subscribePresence();
       await this._publishPresence('join');
+      if (epoch !== this._epoch) return;
       this._startHeartbeat();
       this._sfuStart();
       this._emit('connected', { roomId: this.roomId, channelName });
     } catch (e) {
+      if (epoch !== this._epoch) return;
       this.actor.send({ type: 'fail' });
       this._emit('error', { message: 'connect failed: ' + e.message });
       throw e;
@@ -97,6 +115,7 @@ export class VoiceSession extends EventTarget {
   async disconnect() {
     if (!this.actor || this.actor.getSnapshot().matches('idle')) return;
     if (!this.actor.getSnapshot().can({ type: 'disconnect' })) return;
+    ++this._epoch;
     this.actor.send({ type: 'disconnect' });
     await this._publishPresence('leave');
     this._stopHeartbeat();
@@ -659,6 +678,7 @@ export class VoiceSession extends EventTarget {
     try { peer.dc?.close(); } catch {}
     try { peer.pc?.close(); } catch {}
     if (peer.audioEl) { peer.audioEl.srcObject = null; peer.audioEl.remove(); }
+    try { peer.fsm?.stop?.(); } catch {}
     this._detachAnalyzer(peerPubkey);
     this.peers.delete(peerPubkey);
     this._emit('peer-closed', { peerPubkey });