Foundry main

[Dargon789]

No description provided.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/dargon789-forge?upgradeToPro=build-rate-limit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sequence-js-docs	Canceled		Apr 20, 2026 10:32pm
sequence-js-web	Canceled		Apr 20, 2026 10:32pm
wagmi-project	Canceled		Apr 20, 2026 10:32pm

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sourcery-ai]

Sorry @Dargon789, your pull request is larger than the review limit of 150000 diff characters

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 1 day (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/dargon789-forge?upgradeToPro=build-rate-limit

[gemini-code-assist]

Code Review

This pull request introduces account federation, OIDC ID token login, and an Arweave-based state reader. Key updates include refactoring the session manager to support multiple implicit signers and separate usage increment calls, as well as adding bridge gas support to the relayer. Feedback focuses on hardening the Arweave integration by securing GraphQL query construction, implementing retry limits for rate-limited requests, and ensuring safe parsing of network responses. Additionally, there are recommendations to parallelize sequential network requests and refactor an async promise executor to improve error handling and performance.

I am having trouble creating individual review comments. Click here to see my feedback.

packages/wallet/core/src/state/arweave/arweave.ts (32)

The GraphQL query construction manually concatenates strings for tag names and values without escaping. If any of these strings contain double quotes, the resulting GraphQL query will be syntactically invalid. Using JSON.stringify is a safer way to ensure strings are properly quoted and escaped for the GraphQL query.

          '{ name: ' + JSON.stringify(namespace ? namespace + '-' + name : name) + ', values: ' + JSON.stringify(typeof values === 'string' ? [values] : values) + ' }',

packages/wallet/core/src/state/arweave/arweave.ts (62)

This loop implements an infinite retry mechanism for HTTP 429 (Too Many Requests) responses. If the Arweave gateway or GraphQL endpoint permanently rate-limits the client, this will cause the application to hang indefinitely. It is recommended to implement a maximum number of retries or a total timeout to prevent potential deadlocks.

packages/wallet/core/src/state/arweave/arweave.ts (78-80)

Destructuring the response from response.json() directly is unsafe. If the GraphQL server returns an error object (e.g., { "errors": [...] }) instead of data, or if the response structure differs from expectations, this will throw a TypeError. It's better to check for errors and validate the presence of the expected data fields.

    const json = await response.json()\n    if (json.errors) {\n      throw new Error('GraphQL errors: ' + JSON.stringify(json.errors))\n    }\n    const transactions = json.data ? json.data.transactions : null\n    if (!transactions) {\n      throw new Error('Invalid GraphQL response: missing transactions data')\n    }

packages/wallet/core/src/state/arweave/arweave.ts (105)

Similar to the GraphQL query loop, this retry logic for HTTP 429 responses in fetchItem lacks a maximum retry count or timeout. This could lead to the application hanging indefinitely if the Arweave gateway continues to rate-limit the requests.

packages/wallet/core/src/state/arweave/index.ts (707)

Performing await this.loadRecord<TRecord>(entry) inside a loop results in sequential network requests. Since findEntries can return many items (up to 100 by default), this can lead to significant performance issues. Consider parallelizing these requests using Promise.all to improve efficiency, while ensuring that duplicate wallets are filtered out before fetching.

packages/wallet/wdk/src/sequence/handlers/idtoken.ts (128-144)

Using an async function as a Promise executor is an anti-pattern. While the try/catch block inside handles errors, it's generally better to keep the executor synchronous and handle async operations within it or by returning a promise directly. This ensures that any synchronous errors in the setup are correctly handled by the promise chain.

    return new Promise((resolve, reject) => {\n      const respond: RespondFn = async (idToken) => {\n        try {\n          const [signer, metadata] = await this.completeAuth(idToken)\n          resolve({ signer, email: metadata.email || '' })\n        } catch (error) {\n          reject(error)\n        }\n      }\n\n      onPromptIdToken(this.signupKind, respond).catch(reject)\n    })