@oxy.so/core 7.11.1 → 7.13.0

package/dist/types/i18n/locales/es-ES.d.ts

@@ -161,6 +161,9 @@ declare const dict: {
             requestExpired: string;
             secondFactorInvalid: string;
             originNotAllowed: string;
+            network: string;
+            invalidInput: string;
+            server: string;
             generic: string;
         };
         subtitleToApp: string;
@@ -223,6 +226,31 @@ declare const dict: {
             invalidDescription: string;
         };
     };
+    actionErrors: {
+        updateProfile: string;
+        uploadAvatar: string;
+        updateSettings: string;
+        updatePrivacy: string;
+        updateNotifications: string;
+        updatePreferences: string;
+        revokeConnectedApp: string;
+        switchSession: string;
+        logout: string;
+        logoutAll: string;
+        updateDeviceName: string;
+        removeDevice: string;
+    };
+    usernamePolicy: {
+        hint: string;
+        required: string;
+        tooShort: string;
+        tooLong: string;
+        noSpaces: string;
+        characters: string;
+        onlyNumbers: string;
+        reserved: string;
+        mustEndInBot: string;
+    };
     signup: {
         title: string;
         subtitle: string;
@@ -231,7 +259,6 @@ declare const dict: {
         username: {
             label: string;
             placeholder: string;
-            required: string;
             taken: string;
         };
         email: {
@@ -303,8 +330,6 @@ declare const dict: {
                 label: string;
                 placeholder: string;
                 choose: string;
-                required: string;
-                tooShort: string;
             };
             email: {
                 title: string;
@@ -893,7 +918,6 @@ declare const dict: {
             firstPlaceholder: string;
             lastLabel: string;
             lastPlaceholder: string;
-            saveFailed: string;
         };
         avatar: {
             title: string;
@@ -1828,9 +1852,6 @@ declare const dict: {
                 label: string;
                 available: string;
                 taken: string;
-                tooShort: string;
-                invalidChars: string;
-                mustEndInBot: string;
                 checkFailed: string;
             };
             accountCategory: {
@@ -1865,14 +1886,14 @@ declare const dict: {
                 transfer: string;
             };
             errors: {
-                identifierRequired: string;
+                emailRequired: string;
+                emailInvalid: string;
                 missingAccount: string;
                 noPermission: string;
-                userNotFound: string;
             };
             invite: {
                 title: string;
-                identifierLabel: string;
+                emailLabel: string;
                 roleLabel: string;
                 submit: string;
             };
@@ -1885,8 +1906,9 @@ declare const dict: {
                 description: string;
             };
             toasts: {
-                added: string;
-                addFailed: string;
+                invited: string;
+                inviteFailed: string;
+                invitationUpdateFailed: string;
                 removed: string;
                 removeFailed: string;
                 roleUpdated: string;
@@ -1948,6 +1970,7 @@ declare const dict: {
         title: string;
         warning: string;
         confirmLabel: string;
+        confirmMismatch: string;
         confirm: string;
         error: string;
         handoff: {
@@ -2300,6 +2323,7 @@ declare const dict: {
             newLabel: string;
             repeatLabel: string;
             tooShort: string;
+            tooLong: string;
             mismatch: string;
             signOutOthers: string;
             save: string;
@@ -2362,6 +2386,7 @@ declare const dict: {
             request: string;
             notYet: string;
             remove: string;
+            invalid: string;
         };
         remove: {
             title: string;

package/dist/types/index.d.ts

@@ -24,7 +24,9 @@ export { OxyServices, OXY_API_URL, OXY_CLOUD_URL } from './OxyServices';
 export type { OxyConfig, LinkedHttpClient } from './OxyServices';
 export { OxyApiError, OxyAuthenticationError, OxyAuthenticationTimeoutError, AssetUrlResolutionError, ServiceAssetMetadataError, } from './OxyServices.errors';
 export type { HttpMethod } from './client/context';
-export type { RequestOptions, ResponsePayload, ResponseRequest, ResponseTransport, AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler, } from './HttpService';
+export type { RequestOptions, ResponsePayload, ResponseRequest, ResponseTransport, AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler, CredentialGeneration, } from './HttpService';
+export { sameHolderIdentity } from './api/holderEvidence';
+export type { HolderEvidence, HolderEvidenceIdentity, HolderEvidenceResult, HolderEvidenceUnavailableReason, } from './api/holderEvidence';
 export type { SessionApi, DeviceCredentialProvider, SessionValidation } from './api/session';
 export type { AuthApi, ChallengeResponse, RegistrationRequest, ChallengeVerifyRequest, PublicKeyCheckResponse, OAuthUserInfoResponse, OAuthTokenExchangeResult, CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, SignInDeviceOptions, ClaimedSession, } from './api/auth';
 export type { UsersApi, ResolveExternalUserInput, DeleteAccountProof } from './api/users';

package/dist/types/server/safety.d.ts

@@ -17,7 +17,7 @@ export declare class ServerSafetyApi extends SafetyApi {
     /** The original personal bearer, a verified MCP connection proof, or explicit anonymous access. */
     profileAccess(input: ProfileAccessInput, options?: SafetyRequester): Promise<{
         allowed: boolean;
-        reason: "blocked" | "private" | "public" | "owner" | "unavailable";
+        reason: "blocked" | "private" | "public" | "unavailable" | "owner";
         policyVersion: "1";
     }>;
     profileAccessBatch(input: ProfileAccessBatchInput, options: SafetyRequester): Promise<{
@@ -25,14 +25,14 @@ export declare class ServerSafetyApi extends SafetyApi {
             subjectAccountId: string;
             decision: {
                 allowed: boolean;
-                reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+                reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
                 policyVersion: "2";
             };
         }[];
     }>;
     messageAccess(input: MessageAccessInput, options: SafetyRequester): Promise<{
         allowed: boolean;
-        reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+        reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
         policyVersion: "2";
     }>;
     messageAccessBatch(input: MessageAccessBatchInput, options: SafetyRequester): Promise<{
@@ -40,7 +40,7 @@ export declare class ServerSafetyApi extends SafetyApi {
             resourceId: string;
             decision: {
                 allowed: boolean;
-                reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+                reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
                 policyVersion: "2";
             };
         }[];
@@ -60,7 +60,7 @@ export declare class ServerSafetyApi extends SafetyApi {
             resourceId: string;
             decision: {
                 allowed: boolean;
-                reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+                reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
                 policyVersion: "2";
             };
         }[];
@@ -70,7 +70,7 @@ export declare class ServerSafetyApi extends SafetyApi {
             targetAccountId: string;
             decision: {
                 allowed: boolean;
-                reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+                reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
                 policyVersion: "2";
             };
         }[];
@@ -96,7 +96,7 @@ export declare class ServerSafetyApi extends SafetyApi {
     }>;
     contentAccess(input: ContentAccessInput, options: SafetyRequester): Promise<{
         allowed: boolean;
-        reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+        reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
         policyVersion: "2";
     }>;
     contentAccessBatch(input: ContentAccessBatchInput, options: SafetyRequester): Promise<{
@@ -104,14 +104,14 @@ export declare class ServerSafetyApi extends SafetyApi {
             resourceId: string;
             decision: {
                 allowed: boolean;
-                reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+                reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
                 policyVersion: "2";
             };
         }[];
     }>;
     deliveryAccess(input: DeliveryAccessInput): Promise<{
         allowed: boolean;
-        reason: "blocked" | "private" | "public" | "owner" | "unavailable" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
+        reason: "blocked" | "private" | "public" | "unavailable" | "owner" | "allowed" | "unsupported_consumer" | "contact_not_approved" | "mature_content" | "unrated_content" | "approval_required";
         policyVersion: "2";
     }>;
     requestPurchaseApproval(input: PurchaseEffects, options: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.11.1",
+  "version": "7.13.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -181,7 +181,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "6.3.0",
+    "@oxy.so/contracts": "6.5.0",
     "@oxy.so/protocol": "^1.5.1",
     "@oxy.so/telemetry": "^2.1.0",
     "@scure/bip39": "^1.6.0",

package/src/HttpService.ts

@@ -56,6 +56,21 @@ export type AccessTokenProvider = () => string | null;
  */
 export type AnonymousAuthProvider = () => Promise<string | null>;
 
+declare const credentialGenerationBrand: unique symbol;
+/**
+ * An opaque, immutable token for ONE installation of a bearer in a client.
+ *
+ * `TokenStore` swaps it on every write path (setter, refresh, account or actor
+ * switch, cross-tab or restored token, clear), so two installations of the same
+ * bytes (A, B, A) are different generations. It names a local sequence only: it
+ * is not evidence of an account, a scope or authorization.
+ */
+export type CredentialGeneration = { readonly [credentialGenerationBrand]: true };
+
+function newCredentialGeneration(): CredentialGeneration {
+  return Object.freeze({}) as CredentialGeneration;
+}
+
 /** Comparison only fences local async work; it never validates token authority. */
 function sameTokenSession(left: string | null, right: string | null): boolean {
   if (left === right) return true;
@@ -190,6 +205,13 @@ interface FormDataLike {
 }
 
 export interface RequestOptions {
+  /**
+   * Bind a write to ONE installation of the source's bearer. The transport
+   * rejects (`AUTH_SESSION_CHANGED`) when the generation was replaced before
+   * dispatch, after queueing, or before the result is returned. Implies no cache,
+   * deduplication or retry, and a 401 neither refreshes nor clears the session.
+   */
+  expectedCredentialGeneration?: CredentialGeneration;
   cache?: boolean;
   cacheTTL?: number;
   deduplicate?: boolean;
@@ -434,16 +456,29 @@ const CACHE_SIZE_WARNING_THROTTLE_MS = 60000;
  */
 class TokenStore {
   private accessToken: string | null = null;
+  private generation: CredentialGeneration = newCredentialGeneration();
 
   setTokens(accessToken: string): void {
+    this.generation = newCredentialGeneration();
     this.accessToken = accessToken;
   }
 
+  /** The identity of the bearer's current installation, never of its bytes. */
+  getGeneration(): CredentialGeneration {
+    return this.generation;
+  }
+
+  /** Retire the current generation without touching the bearer (provider swaps). */
+  invalidateGeneration(): void {
+    this.generation = newCredentialGeneration();
+  }
+
   getAccessToken(): string | null {
     return this.accessToken;
   }
 
   clearTokens(): void {
+    this.generation = newCredentialGeneration();
     this.accessToken = null;
   }
 
@@ -576,6 +611,7 @@ export class HttpService {
    * bearer — and through the token listeners, the account — back.
    */
   private sessionEpoch = 0;
+  private readonly credentialSource: HttpService | null;
   /** Preserve a known device across legacy rotations which omit the claim. */
   private sessionDeviceId: string | null = null;
   /** Preserve known actor and context hints across rotations without those claims. */
@@ -618,8 +654,9 @@ export class HttpService {
     averageResponseTime: 0,
   };
 
-  constructor(config: OxyConfig) {
+  constructor(config: OxyConfig, credentialSource: HttpService | null = null) {
     this.config = config;
+    this.credentialSource = credentialSource;
     this.baseURL = config.baseURL;
     this.tokenStore = new TokenStore();
 
@@ -760,6 +797,21 @@ export class HttpService {
    */
   async request<T = unknown>(config: RequestConfig): Promise<ResponsePayload<T>> {
     if (config.signal?.aborted) throw createCancelledError('Request cancelled before it was sent');
+    if (config.expectedCredentialGeneration) {
+      // The prototype is deliberately limited to writes; it does not
+      // yet define leases for cached/deduplicated reads or raw response paths.
+      if (
+        !['POST', 'PUT', 'PATCH', 'DELETE'].includes(config.method) ||
+        config.skipAuth ||
+        Object.keys(config.headers ?? {}).some((key) => key.toLowerCase() === 'authorization')
+      ) {
+        throw new Error('A credential generation requires an implicitly authenticated write');
+      }
+      (this.credentialSource ?? this).assertCredentialGeneration(
+        config.expectedCredentialGeneration,
+      );
+      config = { ...config, cache: false, deduplicate: false, retry: false };
+    }
     // The provider can change independently of the last request. Synchronize
     // before deriving the cache and deduplication identity, including hits.
     const explicitAuthorization = Object.keys(config.headers ?? {}).some(
@@ -878,6 +930,15 @@ export class HttpService {
     const authHeader = usesSessionAuth
       ? await awaitRequestSignal(this.getAuthHeader(), signal)
       : null;
+    const assertExpectedCredential = () => {
+      if (config.expectedCredentialGeneration) {
+        (this.credentialSource ?? this).assertCredentialGeneration(
+          config.expectedCredentialGeneration,
+          authHeader,
+        );
+      }
+    };
+    assertExpectedCredential();
     const isOriginalSession = () => {
       if (this.sessionEpoch !== contextEpoch) return false;
       const currentToken = this.syncAccessTokenFromProvider();
@@ -929,6 +990,7 @@ export class HttpService {
       if (usesSessionAuth && !isOriginalSession()) {
         throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
       }
+      assertExpectedCredential();
 
       /**
        * Whether OUR timer fired, so a timeout can be told apart from a
@@ -1042,6 +1104,9 @@ export class HttpService {
           throw new Error('Requester proofs require a transport that rejects redirects');
         }
 
+        // Header and source generation are checked together in this synchronous
+        // dispatch segment, after the preflight and any queue wait.
+        assertExpectedCredential();
         const response = useXhrForUpload
           ? await this.uploadViaXHR(
               fullUrl,
@@ -1065,6 +1130,13 @@ export class HttpService {
         // it, including on every throw between here and there.
         if (timeoutId) clearTimeout(timeoutId);
 
+        try {
+          assertExpectedCredential();
+        } catch (error) {
+          void discardResponseBody(response);
+          throw error;
+        }
+
         if (usesSessionAuth && !isOriginalSession()) {
           void discardResponseBody(response);
           throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
@@ -1077,6 +1149,7 @@ export class HttpService {
           // session routes; the refresh handler owns session rotation.
           if (
             response.status === 401 &&
+            !config.expectedCredentialGeneration &&
             !config._isAuthRetry &&
             usesSessionAuth &&
             isOriginalSession()
@@ -1218,12 +1291,14 @@ export class HttpService {
         if (usesSessionAuth && !isOriginalSession()) {
           throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
         }
+        assertExpectedCredential();
         const duration = Date.now() - startTime;
         this.updateMetrics(true, duration);
         this.config.onRequestEnd?.(url, method, duration, true);
 
         return responseData as T;
       } catch (error: unknown) {
+        assertExpectedCredential();
         const duration = Date.now() - startTime;
         this.updateMetrics(false, duration);
         // A body reader can reject or finish parsing an error after the viewer
@@ -1348,6 +1423,7 @@ export class HttpService {
     if (usesSessionAuth && !isOriginalSession()) {
       throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
     }
+    assertExpectedCredential();
 
     // Cache the result if caching is enabled
     if (cache && cacheKey && lease.valid && result) {
@@ -2192,6 +2268,36 @@ export class HttpService {
     return this.sessionEpoch;
   }
 
+  /** Capture only the local generation; the caller must separately bind authority. */
+  captureCredentialGeneration(): CredentialGeneration | null {
+    // A pull-only provider can change A→B→A between reads without notifying us.
+    if (this.accessTokenProvider) return null;
+    return this.tokenStore.getAccessToken() ? this.tokenStore.getGeneration() : null;
+  }
+
+  isCredentialGenerationCurrent(generation: CredentialGeneration): boolean {
+    return (
+      !this.accessTokenProvider &&
+      this.tokenStore.getAccessToken() !== null &&
+      generation === this.tokenStore.getGeneration()
+    );
+  }
+
+  private assertCredentialGeneration(
+    generation: CredentialGeneration,
+    selectedHeader?: string | null,
+  ): void {
+    const token = this.tokenStore.getAccessToken();
+    if (
+      this.accessTokenProvider ||
+      !token ||
+      generation !== this.tokenStore.getGeneration() ||
+      (selectedHeader !== undefined && selectedHeader !== `Bearer ${token}`)
+    ) {
+      throw new OxyAuthenticationError('The request credential changed', 'AUTH_SESSION_CHANGED');
+    }
+  }
+
   /** Whether {@link endSession} ran and no token has been planted since. */
   hasSessionEnded(): boolean {
     return this.sessionEnded;
@@ -2202,6 +2308,7 @@ export class HttpService {
   }
 
   setAccessTokenProvider(provider: AccessTokenProvider | null): void {
+    this.tokenStore.invalidateGeneration();
     this.accessTokenProvider = provider;
   }
 

package/src/OxyServices.ts

@@ -159,7 +159,10 @@ export class OxyServices {
    * Query). Pass `enableCache: true` to opt in.
    */
   createLinkedClient(config: OxyConfig): LinkedHttpClient {
-    const client = new HttpService({ ...config, enableCache: config.enableCache ?? false });
+    const client = new HttpService(
+      { ...config, enableCache: config.enableCache ?? false },
+      this.http,
+    );
 
     const syncToken = (accessToken: string | null): void => {
       const current = client.getAccessToken();

package/src/api/apps.ts

@@ -494,7 +494,7 @@ export class ConnectedAppsApi {
   async revoke(applicationId: string): Promise<void> {
     await this.ctx.request<{ revoked: boolean }>(
       'DELETE',
-      `/auth/grants/${applicationId}`,
+      `/auth/grants/${enc(applicationId)}`,
       undefined,
       { cache: false },
     );

package/src/api/auth.ts

@@ -1622,10 +1622,15 @@ export class AuthApi {
    */
   async checkUsername(username: string): Promise<{ available: boolean; message: string }> {
     // Public availability lookup (pre-session) — skip the bearer preflight.
-    return this.ctx.request('GET', `/auth/check-username/${username}`, undefined, {
-      cache: false,
-      skipAuth: true,
-    });
+    return this.ctx.request(
+      'GET',
+      `/auth/check-username/${encodeURIComponent(username)}`,
+      undefined,
+      {
+        cache: false,
+        skipAuth: true,
+      },
+    );
   }
 
   /**

package/src/api/billing.ts

@@ -40,6 +40,8 @@ import {
 } from '@oxy.so/contracts/client';
 import type { OxyContext } from '../client/context';
 
+const enc = encodeURIComponent;
+
 const SUBSCRIPTION_TTL = 2 * 60 * 1000;
 const WALLET_TTL = 60 * 1000;
 
@@ -282,7 +284,7 @@ export class BillingApi {
   /** A user's subscription (default: the signed-in user's). */
   async subscription(userId?: string): Promise<Subscription> {
     const id = this.resolveUserId(userId);
-    return this.ctx.request<Subscription>('GET', `/subscription/${id}`, undefined, {
+    return this.ctx.request<Subscription>('GET', `/subscription/${enc(id)}`, undefined, {
       cache: true,
       cacheTTL: SUBSCRIPTION_TTL,
     });
@@ -291,7 +293,7 @@ export class BillingApi {
   /** A user's wallet (default: the signed-in user's). Cached briefly: the balance moves. */
   async wallet(userId?: string): Promise<Wallet> {
     const id = this.resolveUserId(userId);
-    return this.ctx.request<Wallet>('GET', `/wallet/${id}`, undefined, {
+    return this.ctx.request<Wallet>('GET', `/wallet/${enc(id)}`, undefined, {
       cache: true,
       cacheTTL: WALLET_TTL,
     });
@@ -305,9 +307,14 @@ export class BillingApi {
     const params: Record<string, number> = {};
     if (options.limit) params.limit = options.limit;
     if (options.offset) params.offset = options.offset;
-    return this.ctx.request<WalletTransactionsPage>('GET', `/wallet/transactions/${id}`, params, {
-      cache: false,
-    });
+    return this.ctx.request<WalletTransactionsPage>(
+      'GET',
+      `/wallet/transactions/${enc(id)}`,
+      params,
+      {
+        cache: false,
+      },
+    );
   }
 
   private resolveUserId(userId?: string): string {

package/src/api/devices.ts

@@ -40,6 +40,8 @@ import type {
 import { logger } from '../logger';
 import { extractErrorStatus } from '../utils/errorUtils';
 
+const enc = encodeURIComponent;
+
 /** One of the signed-in user's devices (`GET /devices`). */
 export interface UserDevice {
   id: string;
@@ -139,7 +141,7 @@ export class DevicesApi {
    * @param deviceId - The device ID to remove
    */
   async remove(deviceId: string): Promise<void> {
-    await this.ctx.request('DELETE', `/devices/${deviceId}`, undefined, { cache: false });
+    await this.ctx.request('DELETE', `/devices/${enc(deviceId)}`, undefined, { cache: false });
   }
 
   /**
@@ -152,7 +154,7 @@ export class DevicesApi {
     // Cache disabled by default to ensure fresh session data
     return this.ctx.request<DeviceLinkedSession[]>(
       'GET',
-      `/session/device/sessions/${sessionId}`,
+      `/session/device/sessions/${enc(sessionId)}`,
       undefined,
       {
         cache: false, // Don't cache sessions - always get fresh data
@@ -178,7 +180,7 @@ export class DevicesApi {
     if (excludeCurrent) urlParams.excludeCurrent = 'true';
     return this.ctx.request<DeviceLinkedSessionLogoutResponse>(
       'POST',
-      `/session/device/logout-all/${sessionId}`,
+      `/session/device/logout-all/${enc(sessionId)}`,
       urlParams,
       { cache: false },
     );
@@ -196,7 +198,7 @@ export class DevicesApi {
   ): Promise<{ success: boolean; message: string; deviceName: string }> {
     return this.ctx.request(
       'PUT',
-      `/session/device/name/${sessionId}`,
+      `/session/device/name/${enc(sessionId)}`,
       { deviceName },
       { cache: false },
     );