@oxy.so/core 4.5.0-oxy-one.0 → 4.5.0-oxy-one.1

package/dist/cjs/api/assets.js

@@ -38,6 +38,12 @@ const ASSET_URL_CACHE_LIFETIME_FRACTION = 0.5;
 /** Assumed URL lifetime (seconds) when no `expiresIn` is asked for; the API default. */
 const DEFAULT_ASSET_URL_EXPIRES_IN_SECONDS = 3600;
 const ASSET_TTL = 5 * 60 * 1000;
+/**
+ * Default bound on one `POST /assets/upload`, in ms. The client's per-request
+ * default (5s) is sized for JSON calls; a video sent over a phone connection
+ * needs minutes, and timing it out at 5s failed every upload past a few MB.
+ */
+const ASSET_UPLOAD_TIMEOUT_MS = 10 * 60 * 1000;
 /**
  * How long a resolved asset URL may stay in the SDK's GET cache, in ms: never
  * longer than the media token's lifetime, and discounted below it.
@@ -114,7 +120,10 @@ class AssetsApi {
         if (options.metadata)
             formData.append('metadata', JSON.stringify(options.metadata));
         try {
-            const response = await this.ctx.request('POST', '/assets/upload', formData, { cache: false });
+            const response = await this.ctx.request('POST', '/assets/upload', formData, {
+                cache: false,
+                timeout: options.timeout ?? ASSET_UPLOAD_TIMEOUT_MS,
+            });
             options.onProgress?.(100);
             return response;
         }

package/dist/cjs/api/auth.js

@@ -714,14 +714,19 @@ class AuthApi {
         this.agent = new AuthAgentApi(ctx);
     }
     /**
-     * Register a new identity with public key authentication
-     * Identity is purely cryptographic - username and profile data are optional
+     * Register a new account for a public key, together with its username.
+     *
+     * The username is required: the server writes it in the same insert as the
+     * key, so an account never exists without one. A taken username is a 409
+     * (`Username already taken`), as is a key that is already registered
+     * (`Identity already registered`).
      *
      * @param publicKey - The user's ECDSA public key (hex)
      * @param signature - Signature of the registration request
      * @param timestamp - Timestamp when the signature was created
+     * @param username - The account's username
      */
-    async registerKey(publicKey, signature, timestamp) {
+    async registerKey(publicKey, signature, timestamp, username) {
         // Advisory for now (server soft-enforces — see
         // `SessionController.register`), but solved unconditionally so every
         // client is already sending it once the server starts requiring it.
@@ -731,6 +736,7 @@ class AuthApi {
             publicKey,
             signature,
             timestamp,
+            username,
             powNonce,
         }, { cache: false, skipAuth: true });
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {

package/dist/esm/api/assets.js

@@ -34,6 +34,12 @@ const ASSET_URL_CACHE_LIFETIME_FRACTION = 0.5;
 /** Assumed URL lifetime (seconds) when no `expiresIn` is asked for; the API default. */
 const DEFAULT_ASSET_URL_EXPIRES_IN_SECONDS = 3600;
 const ASSET_TTL = 5 * 60 * 1000;
+/**
+ * Default bound on one `POST /assets/upload`, in ms. The client's per-request
+ * default (5s) is sized for JSON calls; a video sent over a phone connection
+ * needs minutes, and timing it out at 5s failed every upload past a few MB.
+ */
+const ASSET_UPLOAD_TIMEOUT_MS = 10 * 60 * 1000;
 /**
  * How long a resolved asset URL may stay in the SDK's GET cache, in ms: never
  * longer than the media token's lifetime, and discounted below it.
@@ -110,7 +116,10 @@ export class AssetsApi {
         if (options.metadata)
             formData.append('metadata', JSON.stringify(options.metadata));
         try {
-            const response = await this.ctx.request('POST', '/assets/upload', formData, { cache: false });
+            const response = await this.ctx.request('POST', '/assets/upload', formData, {
+                cache: false,
+                timeout: options.timeout ?? ASSET_UPLOAD_TIMEOUT_MS,
+            });
             options.onProgress?.(100);
             return response;
         }

package/dist/esm/api/auth.js

@@ -672,14 +672,19 @@ export class AuthApi {
         this.agent = new AuthAgentApi(ctx);
     }
     /**
-     * Register a new identity with public key authentication
-     * Identity is purely cryptographic - username and profile data are optional
+     * Register a new account for a public key, together with its username.
+     *
+     * The username is required: the server writes it in the same insert as the
+     * key, so an account never exists without one. A taken username is a 409
+     * (`Username already taken`), as is a key that is already registered
+     * (`Identity already registered`).
      *
      * @param publicKey - The user's ECDSA public key (hex)
      * @param signature - Signature of the registration request
      * @param timestamp - Timestamp when the signature was created
+     * @param username - The account's username
      */
-    async registerKey(publicKey, signature, timestamp) {
+    async registerKey(publicKey, signature, timestamp, username) {
         // Advisory for now (server soft-enforces — see
         // `SessionController.register`), but solved unconditionally so every
         // client is already sending it once the server starts requiring it.
@@ -689,6 +694,7 @@ export class AuthApi {
             publicKey,
             signature,
             timestamp,
+            username,
             powNonce,
         }, { cache: false, skipAuth: true });
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {

package/dist/types/api/assets.d.ts

@@ -27,6 +27,8 @@ export interface AssetUploadOptions {
     metadata?: AssetMetadata;
     /** Called with `100` once the upload completes. */
     onProgress?: (progress: number) => void;
+    /** Bound on the whole upload, in ms. Default {@link ASSET_UPLOAD_TIMEOUT_MS}. */
+    timeout?: number;
 }
 export interface AssetLinkTarget {
     app: string;

package/dist/types/api/auth.d.ts

@@ -633,14 +633,19 @@ export declare class AuthApi {
     readonly agent: AuthAgentApi;
     constructor(ctx: OxyContext);
     /**
-     * Register a new identity with public key authentication
-     * Identity is purely cryptographic - username and profile data are optional
+     * Register a new account for a public key, together with its username.
+     *
+     * The username is required: the server writes it in the same insert as the
+     * key, so an account never exists without one. A taken username is a 409
+     * (`Username already taken`), as is a key that is already registered
+     * (`Identity already registered`).
      *
      * @param publicKey - The user's ECDSA public key (hex)
      * @param signature - Signature of the registration request
      * @param timestamp - Timestamp when the signature was created
+     * @param username - The account's username
      */
-    registerKey(publicKey: string, signature: string, timestamp: number): Promise<{
+    registerKey(publicKey: string, signature: string, timestamp: number, username: string): Promise<{
         message: string;
         user: User;
     }>;

package/dist/types/server/requesterAssertion.d.ts

@@ -36,8 +36,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     /** The one native agent this requester may reach with it. */
     agentId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    sub: string;
     exp: number;
+    sub: string;
     aud: string;
     iss: string;
     jti: string;
@@ -46,8 +46,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     cid: string;
     agentId: string;
 }, {
-    sub: string;
     exp: number;
+    sub: string;
     aud: string;
     iss: string;
     jti: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.5.0-oxy-one.0",
+  "version": "4.5.0-oxy-one.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/api/assets.ts

@@ -52,6 +52,13 @@ const DEFAULT_ASSET_URL_EXPIRES_IN_SECONDS = 3600;
 
 const ASSET_TTL = 5 * 60 * 1000;
 
+/**
+ * Default bound on one `POST /assets/upload`, in ms. The client's per-request
+ * default (5s) is sized for JSON calls; a video sent over a phone connection
+ * needs minutes, and timing it out at 5s failed every upload past a few MB.
+ */
+const ASSET_UPLOAD_TIMEOUT_MS = 10 * 60 * 1000;
+
 /**
  * How long a resolved asset URL may stay in the SDK's GET cache, in ms: never
  * longer than the media token's lifetime, and discounted below it.
@@ -85,6 +92,8 @@ export interface AssetUploadOptions {
   metadata?: AssetMetadata;
   /** Called with `100` once the upload completes. */
   onProgress?: (progress: number) => void;
+  /** Bound on the whole upload, in ms. Default {@link ASSET_UPLOAD_TIMEOUT_MS}. */
+  timeout?: number;
 }
 
 export interface AssetLinkTarget {
@@ -160,7 +169,10 @@ export class AssetsApi {
     if (options.metadata) formData.append('metadata', JSON.stringify(options.metadata));
 
     try {
-      const response = await this.ctx.request<{ file: UploadedAsset }>('POST', '/assets/upload', formData, { cache: false });
+      const response = await this.ctx.request<{ file: UploadedAsset }>('POST', '/assets/upload', formData, {
+        cache: false,
+        timeout: options.timeout ?? ASSET_UPLOAD_TIMEOUT_MS,
+      });
       options.onProgress?.(100);
       return response;
     } catch (error) {

package/src/api/auth.ts

@@ -1208,17 +1208,23 @@ export class AuthApi {
   }
 
   /**
-   * Register a new identity with public key authentication
-   * Identity is purely cryptographic - username and profile data are optional
-   * 
+   * Register a new account for a public key, together with its username.
+   *
+   * The username is required: the server writes it in the same insert as the
+   * key, so an account never exists without one. A taken username is a 409
+   * (`Username already taken`), as is a key that is already registered
+   * (`Identity already registered`).
+   *
    * @param publicKey - The user's ECDSA public key (hex)
    * @param signature - Signature of the registration request
    * @param timestamp - Timestamp when the signature was created
+   * @param username - The account's username
    */
   async registerKey(
     publicKey: string,
     signature: string,
-    timestamp: number
+    timestamp: number,
+    username: string
   ): Promise<{ message: string; user: User }> {
     // Advisory for now (server soft-enforces — see
     // `SessionController.register`), but solved unconditionally so every
@@ -1230,6 +1236,7 @@ export class AuthApi {
       publicKey,
       signature,
       timestamp,
+      username,
       powNonce,
     }, { cache: false, skipAuth: true });