@zeroxyz/sdk 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@zeroxyz/sdk` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — with the pre-1.0 caveat that minor versions may include breaking changes.
 
+## 0.2.0
+
+### Changed
+
+- The default per-leg fetch timeout is now **180s** (was 60s). It applies to each HTTP leg (the 402 probe and the paid retry), not as a wall-clock deadline. Sized from production: across 30 days of successful runs p50 is ~0.9s and p99 ~29s, but the slow tail is all legitimate generative media — Grok video (~95s), MiniMax music (~136s), Nano Banana / GPT-5 images (~80s) — which 60s false-timed-out _after_ payment had settled. 180s covers the full observed working range with headroom; it is nearly free because the timeout is a ceiling, not a wait (fast calls still return in ms). Override per-client via `timeout` or per-call via `FetchOptions.timeoutMs`. (#565)
+
+### Added
+
+- `client.fetch()` now records a failed run when a fetch leg times out. Previously a per-leg timeout threw `ZeroTimeoutError` with no trace, so a slow-but-broken capability accrued zero failure signal (and a paid leg that timed out after settlement left no row for the spend). Both the probe and paid-retry legs now record a status-null (→ `network`) run as a best-effort side-effect before re-throwing the original `ZeroTimeoutError` — the typed-error retry/cancel contract is unchanged. Note: the recorded row has `payment: null` (no txHash on a mid-flight timeout), so it restores the reliability signal, not a financial trail. No-op without a `capabilityId`/credentials. (#566)
+
+## 0.1.1
+
+### Fixed
+
+- `client.fetch()` now defaults the request `Content-Type` when a body is present and the caller set none — string bodies use `application/json`, byte bodies are sniffed (`{`/`[` ⇒ `application/json`, otherwise `application/octet-stream`). This mirrors the CLI's existing inference. Without it, strict providers (e.g. Locus MPP's `express.json()`) leave `req.body` undefined and crash reading a field off it (`Cannot read properties of undefined (reading '…')`), while lenient providers tolerate the omission — a confusing, provider-dependent failure. A caller-supplied `Content-Type` (any casing) always wins. (#560)
+
 ## 0.1.0
 
 Initial public release.

package/dist/{chunk-7STN754W.cjs → chunk-LHS7KBN7.cjs}

@@ -1100,7 +1100,7 @@ var Payments = class {
 
 // package.json
 var package_default = {
-  version: "0.1.0"};
+  version: "0.2.0"};
 
 // src/version.ts
 var SDK_VERSION = package_default.version;
@@ -1152,7 +1152,13 @@ var deviceStartResponseSchema = zod.z.object({
   expiresAt: zod.z.number()
 });
 var devicePollResponseSchema = zod.z.union([
-  zod.z.object({ error: zod.z.literal("authorization_pending") }),
+  // userCode + verificationUri are optional: older API deployments don't
+  // echo them on pending.
+  zod.z.object({
+    error: zod.z.literal("authorization_pending"),
+    userCode: zod.z.string().optional(),
+    verificationUri: zod.z.string().optional()
+  }),
   zod.z.object({ error: zod.z.literal("expired_token") }),
   zod.z.object({
     accessToken: zod.z.string(),
@@ -1426,7 +1432,11 @@ var AuthDevice = class {
       devicePollResponseSchema
     );
     if ("error" in parsed) {
-      return parsed.error === "authorization_pending" ? { status: "pending" } : { status: "expired" };
+      return parsed.error === "authorization_pending" ? {
+        status: "pending",
+        userCode: parsed.userCode,
+        verificationUri: parsed.verificationUri
+      } : { status: "expired" };
     }
     return {
       status: "ok",
@@ -2074,7 +2084,7 @@ var Wallet = class {
 
 // src/options.ts
 var DEFAULT_BASE_URL = "https://api.zero.xyz";
-var DEFAULT_TIMEOUT_MS = 6e4;
+var DEFAULT_TIMEOUT_MS = 18e4;
 var DEFAULT_MAX_RETRIES = 2;
 
 // src/auth/credentials.ts
@@ -2360,11 +2370,44 @@ var recordErrorFetchRun = async (client, opts, result) => {
   } catch {
   }
 };
+var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested) => {
+  const result = errorFetchResult(
+    startedAt,
+    err.message,
+    "timeout",
+    capabilityIdRequested,
+    "network_error"
+  );
+  await recordErrorFetchRun(client, opts, result);
+};
+var sniffJsonShapeBytes = (buf) => {
+  let i = 0;
+  if (buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191) {
+    i = 3;
+  }
+  while (i < buf.length && (buf[i] === 32 || buf[i] === 9 || buf[i] === 10 || buf[i] === 13)) {
+    i++;
+  }
+  if (i >= buf.length) return false;
+  return buf[i] === 123 || buf[i] === 91;
+};
+var withDefaultContentType = (headers, body) => {
+  if (!headers && body === void 0) return void 0;
+  const next = headers ? { ...headers } : {};
+  if (body === void 0) return next;
+  const hasContentType = Object.keys(next).some(
+    (k) => k.toLowerCase() === "content-type"
+  );
+  if (!hasContentType) {
+    next["content-type"] = typeof body === "string" || sniffJsonShapeBytes(body) ? "application/json" : "application/octet-stream";
+  }
+  return next;
+};
 var clientFetch = async (client, url, opts = {}) => {
   const startedAt = Date.now();
   const capabilityIdRequested = opts.capabilityId !== void 0;
   const method = opts.method ?? (opts.body !== void 0 ? "POST" : "GET");
-  const probeHeaders = opts.headers ? { ...opts.headers } : void 0;
+  const probeHeaders = withDefaultContentType(opts.headers, opts.body);
   const requestInit = {
     method,
     headers: probeHeaders,
@@ -2381,6 +2424,16 @@ var clientFetch = async (client, url, opts = {}) => {
   try {
     response = await configuredFetch(url, requestInit);
   } catch (err) {
+    if (err instanceof ZeroTimeoutError) {
+      await recordTimeoutRun(
+        client,
+        opts,
+        err,
+        startedAt,
+        capabilityIdRequested
+      );
+      throw err;
+    }
     if (err instanceof ZeroError) throw err;
     const errMessage = err instanceof Error ? err.message : String(err);
     const result2 = errorFetchResult(
@@ -2402,8 +2455,9 @@ var clientFetch = async (client, url, opts = {}) => {
           url,
           method,
           // Fresh clone for the paid retry — same rationale as
-          // the probe-side clone above.
-          headers: opts.headers ? { ...opts.headers } : void 0,
+          // the probe-side clone above. Re-derives the default
+          // Content-Type so the paid leg matches the probe.
+          headers: withDefaultContentType(opts.headers, opts.body),
           body: opts.body,
           maxPay: opts.maxPay,
           account: opts.account,
@@ -2439,6 +2493,15 @@ var clientFetch = async (client, url, opts = {}) => {
           );
           await recordErrorFetchRun(client, opts, result2);
           return result2;
+        } else if (err instanceof ZeroTimeoutError) {
+          await recordTimeoutRun(
+            client,
+            opts,
+            err,
+            startedAt,
+            capabilityIdRequested
+          );
+          throw err;
         } else {
           throw err;
         }
@@ -3044,5 +3107,5 @@ exports.coerceTempoChainId = coerceTempoChainId;
 exports.createManagedAccount = createManagedAccount;
 exports.paymentHasAnchor = paymentHasAnchor;
 exports.tempoChainLabelFromId = tempoChainLabelFromId;
-//# sourceMappingURL=chunk-7STN754W.cjs.map
-//# sourceMappingURL=chunk-7STN754W.cjs.map
+//# sourceMappingURL=chunk-LHS7KBN7.cjs.map
+//# sourceMappingURL=chunk-LHS7KBN7.cjs.map