@oxy.so/core 7.12.0 → 7.13.0

package/dist/cjs/api/apps.js

@@ -85,7 +85,7 @@ class ConnectedAppsApi {
      *   `ConnectedApp.applicationId`, NOT a credential/client id).
      */
     async revoke(applicationId) {
-        await this.ctx.request('DELETE', `/auth/grants/${applicationId}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/auth/grants/${enc(applicationId)}`, undefined, { cache: false });
         this.ctx.oxy.cache.delete('GET:/auth/grants');
     }
     /** Resource-bound external MCP connections for the active Oxy account. */

package/dist/cjs/api/auth.js

@@ -974,7 +974,7 @@ class AuthApi {
      */
     async checkUsername(username) {
         // Public availability lookup (pre-session) — skip the bearer preflight.
-        return this.ctx.request('GET', `/auth/check-username/${username}`, undefined, {
+        return this.ctx.request('GET', `/auth/check-username/${encodeURIComponent(username)}`, undefined, {
             cache: false,
             skipAuth: true,
         });

package/dist/cjs/api/billing.js

@@ -13,6 +13,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BillingApi = void 0;
 const client_1 = require("@oxy.so/contracts/client");
+const enc = encodeURIComponent;
 const SUBSCRIPTION_TTL = 2 * 60 * 1000;
 const WALLET_TTL = 60 * 1000;
 class BillingApi {
@@ -76,7 +77,7 @@ class BillingApi {
     /** A user's subscription (default: the signed-in user's). */
     async subscription(userId) {
         const id = this.resolveUserId(userId);
-        return this.ctx.request('GET', `/subscription/${id}`, undefined, {
+        return this.ctx.request('GET', `/subscription/${enc(id)}`, undefined, {
             cache: true,
             cacheTTL: SUBSCRIPTION_TTL,
         });
@@ -84,7 +85,7 @@ class BillingApi {
     /** A user's wallet (default: the signed-in user's). Cached briefly: the balance moves. */
     async wallet(userId) {
         const id = this.resolveUserId(userId);
-        return this.ctx.request('GET', `/wallet/${id}`, undefined, {
+        return this.ctx.request('GET', `/wallet/${enc(id)}`, undefined, {
             cache: true,
             cacheTTL: WALLET_TTL,
         });
@@ -97,7 +98,7 @@ class BillingApi {
             params.limit = options.limit;
         if (options.offset)
             params.offset = options.offset;
-        return this.ctx.request('GET', `/wallet/transactions/${id}`, params, {
+        return this.ctx.request('GET', `/wallet/transactions/${enc(id)}`, params, {
             cache: false,
         });
     }

package/dist/cjs/api/devices.js

@@ -4,6 +4,7 @@ exports.DevicesApi = exports.AccountNotOnDeviceError = void 0;
 const client_1 = require("@oxy.so/contracts/client");
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
+const enc = encodeURIComponent;
 /**
  * The server's `401 account_not_on_device` for a PINNED mint: the requested
  * `accountId` is not (or is no longer) a live account of this device session.
@@ -75,7 +76,7 @@ class DevicesApi {
      * @param deviceId - The device ID to remove
      */
     async remove(deviceId) {
-        await this.ctx.request('DELETE', `/devices/${deviceId}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/devices/${enc(deviceId)}`, undefined, { cache: false });
     }
     /**
      * Get device sessions for a given session ID
@@ -85,7 +86,7 @@ class DevicesApi {
      */
     async sessions(sessionId) {
         // Cache disabled by default to ensure fresh session data
-        return this.ctx.request('GET', `/session/device/sessions/${sessionId}`, undefined, {
+        return this.ctx.request('GET', `/session/device/sessions/${enc(sessionId)}`, undefined, {
             cache: false, // Don't cache sessions - always get fresh data
             deduplicate: true, // Deduplicate concurrent requests for same sessionId
         });
@@ -103,7 +104,7 @@ class DevicesApi {
             urlParams.deviceId = deviceId;
         if (excludeCurrent)
             urlParams.excludeCurrent = 'true';
-        return this.ctx.request('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
+        return this.ctx.request('POST', `/session/device/logout-all/${enc(sessionId)}`, urlParams, { cache: false });
     }
     /**
      * Update device name
@@ -112,7 +113,7 @@ class DevicesApi {
      * @returns Updated device object
      */
     async rename(sessionId, deviceName) {
-        return this.ctx.request('PUT', `/session/device/name/${sessionId}`, { deviceName }, { cache: false });
+        return this.ctx.request('PUT', `/session/device/name/${enc(sessionId)}`, { deviceName }, { cache: false });
     }
     /**
      * Get security information

package/dist/cjs/api/follows.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FollowsApi = void 0;
 const apiUtils_1 = require("../utils/apiUtils");
+const enc = encodeURIComponent;
 const GRAPH_TTL = 2 * 60 * 1000;
 const STATUS_TTL = 60 * 1000;
 /**
@@ -16,7 +17,7 @@ class FollowsApi {
     // ── People ───────────────────────────────────────────────────────────────
     /** Follow a user. */
     async follow(userId) {
-        const result = await this.ctx.request('POST', `/users/${userId}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('POST', `/users/${enc(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -30,7 +31,7 @@ class FollowsApi {
     }
     /** Unfollow a user. */
     async unfollow(userId) {
-        const result = await this.ctx.request('DELETE', `/users/${userId}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('DELETE', `/users/${enc(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -44,7 +45,7 @@ class FollowsApi {
     }
     /** Whether the signed-in user follows `userId`. Cached 1 minute, busted by every write. */
     async status(userId) {
-        return this.ctx.request('GET', `/users/${userId}/follow-status`, undefined, {
+        return this.ctx.request('GET', `/users/${enc(userId)}/follow-status`, undefined, {
             cache: true,
             cacheTTL: STATUS_TTL,
         });
@@ -74,12 +75,12 @@ class FollowsApi {
      * `limit`/`offset`/`sort` combination is its own cache entry (2 minutes).
      */
     async followers(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/followers`, params);
+        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/followers`, params);
         return { followers: data, total, hasMore };
     }
     /** Who a user follows. `sort` as in `followers`. */
     async following(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/following`, params);
+        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/following`, params);
         return { following: data, total, hasMore };
     }
     /**
@@ -87,7 +88,7 @@ class FollowsApi {
      * `userId`.
      */
     async mutuals(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/mutuals`, params);
+        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/mutuals`, params);
         return { mutuals: data, total, hasMore };
     }
     /**
@@ -222,16 +223,16 @@ class FollowsApi {
         const keys = ['GET:/users/me/graph'];
         const prefixes = ['GET:/profiles/username/', 'GET:/profiles/resolve'];
         for (const id of targetUserIds) {
-            keys.push(`GET:/users/${id}/follow-status`);
+            keys.push(`GET:/users/${enc(id)}/follow-status`);
             // Profiles embed the viewer-relative `relationship`.
-            keys.push(`GET:/users/${id}`);
+            keys.push(`GET:/users/${enc(id)}`);
             // The target gained or lost a follower, and "followers you know" with it.
-            prefixes.push(`GET:/users/${id}/followers`, `GET:/users/${id}/mutuals`);
+            prefixes.push(`GET:/users/${enc(id)}/followers`, `GET:/users/${enc(id)}/mutuals`);
         }
         // The viewer's own following list changed.
         const viewerId = this.ctx.oxy.session.userId;
         if (viewerId)
-            prefixes.push(`GET:/users/${viewerId}/following`);
+            prefixes.push(`GET:/users/${enc(viewerId)}/following`);
         this.ctx.http.invalidateCache({ keys, prefixes });
     }
 }

package/dist/cjs/api/privacy.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrivacyApi = void 0;
 const identityCacheSweep_1 = require("../utils/identityCacheSweep");
+const enc = encodeURIComponent;
 const LIST_TTL = 60 * 1000;
 const SETTINGS_TTL = 2 * 60 * 1000;
 const refId = (ref) => (typeof ref === 'string' ? ref : ref._id);
@@ -13,7 +14,7 @@ class PrivacyApi {
     /** A user's privacy settings (default: the signed-in user's). */
     async settings(userId) {
         const id = await this.resolveUserId(userId);
-        return this.ctx.request('GET', `/privacy/${id}/privacy`, undefined, {
+        return this.ctx.request('GET', `/privacy/${enc(id)}/privacy`, undefined, {
             cache: true,
             cacheTTL: SETTINGS_TTL,
         });
@@ -21,10 +22,10 @@ class PrivacyApi {
     /** Update privacy settings (default: the signed-in user's). */
     async updateSettings(settings, userId) {
         const id = await this.resolveUserId(userId);
-        const res = await this.ctx.request('PATCH', `/privacy/${id}/privacy`, settings, { cache: false });
+        const res = await this.ctx.request('PATCH', `/privacy/${enc(id)}/privacy`, settings, { cache: false });
         // Privacy settings ride the user DTO, so every identity read goes stale too.
         (0, identityCacheSweep_1.evictOxyIdentityCache)(this.ctx.http, id);
-        this.ctx.oxy.cache.delete(`GET:/privacy/${id}/privacy`);
+        this.ctx.oxy.cache.delete(`GET:/privacy/${enc(id)}/privacy`);
         return res;
     }
     // ── Blocked ──────────────────────────────────────────────────────────────
@@ -38,14 +39,14 @@ class PrivacyApi {
     /** Block a user. */
     async block(userId) {
         requireId(userId);
-        const res = await this.ctx.request('POST', `/privacy/blocked/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('POST', `/privacy/blocked/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/blocked');
         return res;
     }
     /** Unblock a user. */
     async unblock(userId) {
         requireId(userId);
-        const res = await this.ctx.request('DELETE', `/privacy/blocked/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('DELETE', `/privacy/blocked/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/blocked');
         return res;
     }
@@ -71,14 +72,14 @@ class PrivacyApi {
     /** Restrict a user: limit their interactions without blocking them. */
     async restrict(userId) {
         requireId(userId);
-        const res = await this.ctx.request('POST', `/privacy/restricted/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('POST', `/privacy/restricted/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/restricted');
         return res;
     }
     /** Lift a restriction. */
     async unrestrict(userId) {
         requireId(userId);
-        const res = await this.ctx.request('DELETE', `/privacy/restricted/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('DELETE', `/privacy/restricted/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/restricted');
         return res;
     }

package/dist/cjs/api/session.js

@@ -12,6 +12,7 @@ const jwt_decode_1 = require("jwt-decode");
 const userIdentity_1 = require("../utils/userIdentity");
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const client_1 = require("@oxy.so/contracts/client");
+const enc = encodeURIComponent;
 /** How long a refusal (disabled, rate limited, unreachable) is remembered per installation. */
 const EVIDENCE_REFUSAL_MS = 5000;
 const unavailable = (reason) => ({
@@ -293,7 +294,7 @@ class SessionApi {
                             : {}),
                     },
                 })
-                : await this.ctx.request('GET', `/session/validate/${sessionId}`, {
+                : await this.ctx.request('GET', `/session/validate/${enc(sessionId)}`, {
                     ...(options.deviceFingerprint
                         ? { deviceFingerprint: options.deviceFingerprint }
                         : {}),
@@ -320,7 +321,7 @@ class SessionApi {
                 const invalid = candidate?.status === 401 && candidate.code === 'OXY_LIVE_SESSION_INVALID_V1';
                 const denied = candidate?.status === 403 && candidate.code === 'OXY_LIVE_SESSION_POLICY_V1';
                 if (invalid)
-                    this.ctx.oxy.cache.delete(`GET:/session/user/${sessionId}`);
+                    this.ctx.oxy.cache.delete(`GET:/session/user/${enc(sessionId)}`);
                 if (invalid || denied)
                     throw error;
                 throw new OxyServices_errors_1.OxyApiError('Live session authority is unavailable', {
@@ -330,26 +331,28 @@ class SessionApi {
                 });
             }
             // The session is gone: drop any user cached for it (#196).
-            this.ctx.oxy.cache.delete(`GET:/session/user/${sessionId}`);
+            this.ctx.oxy.cache.delete(`GET:/session/user/${enc(sessionId)}`);
             throw error;
         }
     }
     /** The sessions that belong with `sessionId` (same account set). */
     async list(sessionId) {
-        return this.ctx.request('GET', `/session/sessions/${sessionId}`, undefined, {
+        return this.ctx.request('GET', `/session/sessions/${enc(sessionId)}`, undefined, {
             cache: false,
         });
     }
     /** Sign out `sessionId`, or — with `targetSessionId` — one of the sessions beside it. */
     async logout(sessionId, targetSessionId) {
         const url = targetSessionId
-            ? `/session/logout/${sessionId}/${targetSessionId}`
-            : `/session/logout/${sessionId}`;
+            ? `/session/logout/${enc(sessionId)}/${enc(targetSessionId)}`
+            : `/session/logout/${enc(sessionId)}`;
         await this.ctx.request('POST', url, undefined, { cache: false });
     }
     /** Sign out the other sessions for this account; preserve `sessionId`. */
     async logoutAll(sessionId) {
-        await this.ctx.request('POST', `/session/logout-all/${sessionId}`, undefined, { cache: false });
+        await this.ctx.request('POST', `/session/logout-all/${enc(sessionId)}`, undefined, {
+            cache: false,
+        });
     }
     /** Decoded claims of the current token, memoised per token string. */
     claims() {

package/dist/cjs/api/topics.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TopicsApi = void 0;
+const enc = encodeURIComponent;
 const SHORT = 60 * 1000;
 const LONG = 5 * 60 * 1000;
 const EXTRA_LONG = 30 * 60 * 1000;
@@ -44,7 +45,7 @@ class TopicsApi {
     }
     /** One topic by slug. */
     async get(slug) {
-        return this.ctx.request('GET', `/topics/${slug}`, undefined, {
+        return this.ctx.request('GET', `/topics/${enc(slug)}`, undefined, {
             cache: true,
             cacheTTL: LONG,
         });
@@ -63,10 +64,10 @@ class TopicsApi {
     }
     /** Update a topic's description and translations. Staff or service only. */
     async update(slug, data) {
-        const topic = await this.ctx.request('PATCH', `/topics/${slug}`, data, {
+        const topic = await this.ctx.request('PATCH', `/topics/${enc(slug)}`, data, {
             cache: false,
         });
-        this.ctx.oxy.cache.delete(`GET:/topics/${slug}`);
+        this.ctx.oxy.cache.delete(`GET:/topics/${enc(slug)}`);
         return topic;
     }
 }

package/dist/cjs/api/users.js

@@ -42,6 +42,7 @@ const accountCacheSweep_1 = require("../utils/accountCacheSweep");
 const errorUtils_1 = require("../utils/errorUtils");
 const batchLookup_1 = require("../utils/batchLookup");
 const logger_1 = require("../logger");
+const enc = encodeURIComponent;
 const PROFILE_TTL = 5 * 60 * 1000;
 const SESSION_USER_TTL = 2 * 60 * 1000;
 const ME_TTL = 60 * 1000;
@@ -61,7 +62,7 @@ class UsersApi {
      * registry-fresh read that neither serves nor overwrites a cached entry.
      */
     async get(userId, options) {
-        const user = await this.ctx.request('GET', `/users/${userId}`, undefined, {
+        const user = await this.ctx.request('GET', `/users/${enc(userId)}`, undefined, {
             cache: options?.cache ?? true,
             cacheTTL: PROFILE_TTL,
         });
@@ -143,7 +144,7 @@ class UsersApi {
     }
     /** The user a session belongs to. */
     async bySession(sessionId) {
-        const user = await this.ctx.request('GET', `/session/user/${sessionId}`, undefined, {
+        const user = await this.ctx.request('GET', `/session/user/${enc(sessionId)}`, undefined, {
             cache: true,
             cacheTTL: SESSION_USER_TTL,
         });
@@ -219,7 +220,7 @@ class UsersApi {
         const pagination = typeof limitOrPagination === 'number'
             ? { limit: limitOrPagination }
             : (limitOrPagination ?? {});
-        const users = await this.ctx.request('GET', `/profiles/${userId}/similar`, (0, apiUtils_1.buildQueryParams)(pagination), {
+        const users = await this.ctx.request('GET', `/profiles/${enc(userId)}/similar`, (0, apiUtils_1.buildQueryParams)(pagination), {
             cache: true,
             cacheTTL: PROFILE_TTL,
         });
@@ -231,7 +232,7 @@ class UsersApi {
      * account. Cached 5 minutes.
      */
     async moderators(communityId) {
-        const moderators = await this.ctx.request('GET', `/users/${communityId}/moderators`, undefined, { cache: true, cacheTTL: PROFILE_TTL });
+        const moderators = await this.ctx.request('GET', `/users/${enc(communityId)}/moderators`, undefined, { cache: true, cacheTTL: PROFILE_TTL });
         return moderators.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user));
     }
     /**