@oxyhq/core 15.0.1 → 16.0.0

package/dist/esm/OxyServices.errors.js

@@ -49,6 +49,37 @@ export class AssetUrlResolutionError extends Error {
         this.cause = cause;
     }
 }
+/**
+ * Thrown when one or more chunks of `getServiceAssetMetadataByIds` could not be
+ * resolved.
+ *
+ * Exists because for this endpoint a FAILED request and an ABSENT asset produce
+ * the same observable result. The server legitimately omits unknown/deleted ids,
+ * so callers are documented to map the response by `id` and treat a missing
+ * entry as "no such asset" — which means a chunk that 429s, times out or 5xxs
+ * reads as authoritative absence unless it is raised.
+ *
+ * That was not hypothetical: a metadata backfill counted every throttled asset
+ * as needing no update and exited 0, and the MTN signed-record builder embedded
+ * media with no content hash into records that are immutable once signed. Both
+ * paths reported success and wrote nothing.
+ *
+ * `unresolvedIds` carries every id in a failed chunk — not the subset the server
+ * would have omitted anyway, which is unknowable when the request never landed.
+ * A caller that wants best-effort passes `{ partial: true }` and never sees this.
+ */
+export class ServiceAssetMetadataError extends Error {
+    constructor(unresolvedIds, statuses, cause) {
+        const uniqueStatuses = Array.from(new Set(statuses)).sort((a, b) => a - b);
+        const statusSuffix = uniqueStatuses.length > 0 ? ` — status ${uniqueStatuses.join(', ')}` : '';
+        super(`Could not resolve asset metadata for ${unresolvedIds.length} id(s)${statusSuffix}. Treat this as unknown, not as absent; pass { partial: true } for best-effort.`);
+        this.code = 'SERVICE_ASSET_METADATA_UNRESOLVED';
+        this.name = 'ServiceAssetMetadataError';
+        this.unresolvedIds = unresolvedIds;
+        this.statuses = uniqueStatuses;
+        this.cause = cause;
+    }
+}
 export class OxyAuthenticationTimeoutError extends OxyAuthenticationError {
     constructor(operationName, timeoutMs) {
         super(`Authentication timeout (${timeoutMs}ms): ${operationName} requires user authentication. Please ensure the user is logged in before calling this method.`, 'AUTH_TIMEOUT', 408);

package/dist/esm/OxyServices.js

@@ -1,4 +1,4 @@
-import { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors.js';
+import { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError, ServiceAssetMetadataError } from './OxyServices.errors.js';
 // Import mixin composition helper
 import { composeOxyServices } from './mixins/index.js';
 /**
@@ -50,7 +50,7 @@ export class OxyServices extends OxyServicesComposed {
     }
 }
 // Re-export error classes for convenience
-export { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError };
+export { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError, ServiceAssetMetadataError };
 /**
  * Default Oxy Cloud URL — used when no `cloudURL` is provided to OxyServices.
  */

package/dist/esm/index.js

@@ -21,7 +21,7 @@ import './crypto/polyfill.js';
 // ---------------------------------------------------------------------------
 // API client
 // ---------------------------------------------------------------------------
-export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.js';
+export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError, ServiceAssetMetadataError } from './OxyServices.js';
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices.js';
 // ---------------------------------------------------------------------------
 // Authentication

package/dist/esm/mixins/OxyServices.assets.js

@@ -1,6 +1,6 @@
 import { isReactNative } from '@oxyhq/protocol';
 import { logger } from '../logger/index.js';
-import { AssetUrlResolutionError } from '../OxyServices.errors.js';
+import { AssetUrlResolutionError, ServiceAssetMetadataError } from '../OxyServices.errors.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
  * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
@@ -300,15 +300,25 @@ export function OxyServicesAssetsMixin(Base) {
          * throws because no credentials are available. A plain user-session request
          * is rejected by the route's service-auth guard.
          *
-         * Resilience: chunks are independent. A failed chunk is logged and skipped —
-         * the method returns every entry that resolved successfully rather than
-         * discarding the whole call on one chunk's failure. An empty/whitespace-only
-         * input resolves immediately with `[]` and performs no network call.
+         * FAILURE IS NOT ABSENCE. The server legitimately omits unknown/deleted ids,
+         * so a short result is normal — which means a chunk that FAILED (a 429, a
+         * timeout, a 5xx) is indistinguishable from "those assets don't exist" if it
+         * simply contributes nothing. This method used to swallow a failed chunk and
+         * return the rest, so every caller silently read a throttled request as "no
+         * metadata": a backfill counted the asset as needing no update, and the
+         * signed-record builder embedded a media item with no hash. Both reported
+         * success while writing nothing, and the MTN chain's records are immutable.
+         *
+         * So a failed chunk THROWS {@link ServiceAssetMetadataError} by default,
+         * carrying the ids it could not resolve. A caller that genuinely wants
+         * best-effort opts in with `{ partial: true }` and gets the old behaviour
+         * explicitly. An empty/whitespace-only input resolves immediately with `[]`
+         * and performs no network call.
          *
          * Not cached at the SDK layer: it's a POST keyed on a multi-id body (low hit
          * rate), mirroring the sibling service/POST methods which never cache.
          */
-        async getServiceAssetMetadataByIds(ids) {
+        async getServiceAssetMetadataByIds(ids, options = {}) {
             const uniqueIds = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim().length > 0)));
             if (uniqueIds.length === 0) {
                 return [];
@@ -317,22 +327,35 @@ export function OxyServicesAssetsMixin(Base) {
             for (let i = 0; i < uniqueIds.length; i += SERVICE_ASSET_METADATA_CHUNK_SIZE) {
                 chunks.push(uniqueIds.slice(i, i + SERVICE_ASSET_METADATA_CHUNK_SIZE));
             }
-            // Run chunks concurrently; a single chunk failure must not sink the rest.
+            // Chunks stay independent so one failure never cancels work already in
+            // flight; the failures are collected and re-raised together below.
+            const unresolvedIds = [];
+            const statuses = [];
+            let firstError;
             const settled = await Promise.all(chunks.map(async (chunk) => {
                 try {
                     const entries = await this.makeServiceRequest('POST', '/assets/service/by-ids', { ids: chunk });
                     return Array.isArray(entries) ? entries : [];
                 }
                 catch (error) {
-                    logger.warn('getServiceAssetMetadataByIds: chunk failed, continuing with remaining chunks', {
+                    const status = extractErrorStatus(error);
+                    logger.warn('getServiceAssetMetadataByIds: chunk failed', {
                         method: 'getServiceAssetMetadataByIds',
                         chunkSize: chunk.length,
-                        status: extractErrorStatus(error),
+                        status,
+                        partial: options.partial === true,
                         error: error instanceof Error ? error.message : String(error),
                     });
+                    unresolvedIds.push(...chunk);
+                    if (typeof status === 'number')
+                        statuses.push(status);
+                    firstError ?? (firstError = error);
                     return [];
                 }
             }));
+            if (unresolvedIds.length > 0 && options.partial !== true) {
+                throw new ServiceAssetMetadataError(unresolvedIds, statuses, firstError);
+            }
             return settled.flat();
         }
         /**

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -151,11 +151,11 @@ export function OxyServicesDeviceBootMixin(Base) {
          *
          * That paragraph is LOAD-BEARING, not belt-and-braces: the route sits above
          * oxy-api's router-wide origin guard (deliberately, so a native client with
-         * no `Origin` is not rejected), so as of this writing NOTHING server-side
-         * refuses a browser caller that presents a valid bearer. Until a server-side
-         * check lands, caller discipline is the only control — which is also why a
-         * doc note cannot be the whole answer to browser XSS minting a long-lived
-         * credential with the victim's bearer.
+         * no `Origin` is not rejected). oxy-api additionally refuses callers that
+         * carry browser context signals (`Origin` or `Sec-Fetch-Site`) with
+         * `403 browser_not_allowed` — native HTTP clients send neither. Gate the
+         * caller by platform on the client as well; do not widen the 404 degrade to
+         * 403, which would also swallow a genuine origin misconfiguration.
          *
          * @returns the provisioned credential, or `null` when the endpoint is absent
          * (404). The API deploy leads the SDK release, so a client on a newer SDK

package/dist/esm/utils/accountUtils.js

@@ -3,6 +3,7 @@
  * Used by the @oxyhq/services account stores (Expo/RN and RN-Web).
  */
 import { translate } from '../i18n/index.js';
+import { getNormalizedUserHandle } from './userHandle.js';
 /**
  * Truncate a long public key for display, e.g. `0x12345678…`.
  * Falls back to the raw key if it's too short to truncate.
@@ -96,7 +97,11 @@ export const buildAccountsArray = (accounts, order) => {
  * @param getFileDownloadUrl - Function to generate avatar download URL from file ID
  */
 export const createQuickAccount = (sessionId, userData, existingAccount, getFileDownloadUrl) => {
-    const displayName = getAccountDisplayName(userData);
+    const nameObj = userData.name && typeof userData.name === 'object' ? userData.name : undefined;
+    const apiDisplayName = typeof nameObj?.displayName === 'string' ? nameObj.displayName.trim() : '';
+    const displayName = apiDisplayName ||
+        getNormalizedUserHandle(userData) ||
+        getAccountDisplayName(null);
     const userId = userData.id || (typeof userData._id === 'string' ? userData._id : userData._id?.toString());
     // Preserve existing avatarUrl if avatar hasn't changed (prevents image reload)
     let avatarUrl;