@oxy.so/core 7.12.0 → 7.13.1

package/dist/cjs/i18n/locales/en-US.js

@@ -163,6 +163,9 @@ const dict = {
             requestExpired: 'This sign-in expired. Send a new email.',
             secondFactorInvalid: "That code isn't right. Try the current one.",
             originNotAllowed: "Sign-in isn't available here.",
+            network: "Couldn't reach Oxy. Check your connection and try again.",
+            invalidInput: "Something you entered isn't valid. Check it and try again.",
+            server: "Oxy couldn't finish this right now. Try again in a moment.",
             generic: 'Something went wrong. Please try again.',
         },
         subtitleToApp: 'to continue to {{app}}',
@@ -225,6 +228,31 @@ const dict = {
             invalidDescription: 'It expired or was already used. Ask for a new email in the app, or type the code from the latest one.',
         },
     },
+    actionErrors: {
+        updateProfile: "Couldn't update your profile. Please try again.",
+        uploadAvatar: "Couldn't upload the picture. Please try again.",
+        updateSettings: "Couldn't save your settings. Please try again.",
+        updatePrivacy: "Couldn't save your privacy settings. Please try again.",
+        updateNotifications: "Couldn't save your notification preferences. Please try again.",
+        updatePreferences: "Couldn't save your preferences. Please try again.",
+        revokeConnectedApp: "Couldn't disconnect the app. Please try again.",
+        switchSession: "Couldn't switch accounts. Please try again.",
+        logout: "Couldn't sign out. Please try again.",
+        logoutAll: "Couldn't sign out everywhere. Please try again.",
+        updateDeviceName: "Couldn't rename the device. Please try again.",
+        removeDevice: "Couldn't remove the device. Please try again.",
+    },
+    usernamePolicy: {
+        hint: 'Letters, numbers, - and _. No spaces.',
+        required: 'Choose a username.',
+        tooShort: 'Use at least {{min}} characters.',
+        tooLong: 'Use at most {{max}} characters.',
+        noSpaces: "Usernames can't contain spaces. Use - or _ instead.",
+        characters: 'Use only letters, numbers, - and _. Start and end with a letter or number, and never put two of - or _ together.',
+        onlyNumbers: "A username can't be only numbers. Add a letter.",
+        reserved: 'That username is reserved. Choose another one.',
+        mustEndInBot: 'A bot account’s username must end in “bot”.',
+    },
     signup: {
         title: 'Create your account',
         subtitle: 'Choose your username. Then we confirm your email.',
@@ -233,7 +261,6 @@ const dict = {
         username: {
             label: 'Username',
             placeholder: 'yourname',
-            required: 'Choose a username.',
             taken: 'That username is taken.',
         },
         email: {
@@ -281,7 +308,6 @@ const dict = {
             firstPlaceholder: 'Your first name',
             lastLabel: 'Last name',
             lastPlaceholder: 'Your last name',
-            saveFailed: 'Could not save your name',
         },
         avatar: {
             title: 'Make It Yours',
@@ -604,8 +630,6 @@ const dict = {
                 label: 'Username',
                 placeholder: 'Choose a username',
                 choose: 'Choose a username',
-                required: 'Username is required',
-                tooShort: 'Username must be at least 3 characters',
             },
             email: {
                 title: 'Email',
@@ -1260,7 +1284,7 @@ const dict = {
             },
             rules: {
                 title: 'Username rules',
-                content: 'Usernames can only contain lowercase letters (a-z) and numbers (0-9). They must be at least 4 characters long. Special characters, spaces, and uppercase letters are not allowed to keep usernames simple and easy to remember.',
+                content: 'Usernames are 3 to 30 characters long and use letters, numbers, hyphens (-) and underscores (_). They start and end with a letter or number, never put two of - or _ together, and are not only numbers. Spaces are not allowed. Capital letters are kept as you type them, but Alice and alice are the same username.',
             },
             unique: {
                 title: 'Why must it be unique?',
@@ -1839,9 +1863,6 @@ const dict = {
                 label: 'Username',
                 available: 'Username is available',
                 taken: 'Username is taken',
-                tooShort: 'Username must be at least 3 characters',
-                invalidChars: 'Only letters, numbers, hyphens, and underscores',
-                mustEndInBot: 'A bot account’s username must end in “bot”',
                 checkFailed: 'Could not check availability',
             },
             accountCategory: {
@@ -1876,16 +1897,15 @@ const dict = {
                 transfer: 'Transfer ownership',
             },
             errors: {
-                identifierRequired: 'Enter a username or email to invite',
+                emailInvalid: 'Enter a valid email address, like name@example.com.',
                 missingAccount: 'No account selected.',
                 noPermission: 'You do not have permission to view members.',
-                userNotFound: 'User not found',
             },
             invite: {
-                title: 'Add a member',
-                identifierLabel: 'Username or email',
+                title: 'Invite a member',
+                emailLabel: 'Email',
                 roleLabel: 'Role',
-                submit: 'Add member',
+                submit: 'Send invitation',
             },
             removeConfirm: {
                 title: 'Remove member',
@@ -1896,8 +1916,9 @@ const dict = {
                 description: 'Transfer ownership of this account to this member? You will be demoted to admin. This cannot be undone.',
             },
             toasts: {
-                added: 'Member added',
-                addFailed: 'Failed to add member',
+                invited: 'Invitation sent',
+                inviteFailed: "Couldn't send the invitation. Please try again.",
+                invitationUpdateFailed: "Couldn't update the invitation. Please try again.",
                 removed: 'Member removed',
                 removeFailed: 'Failed to remove member',
                 roleUpdated: 'Role updated',
@@ -1959,6 +1980,7 @@ const dict = {
         title: 'Delete Account',
         warning: 'This action cannot be undone. Your account and all associated data will be permanently deleted.',
         confirmLabel: 'Type "{{username}}" to confirm',
+        confirmMismatch: 'That isn\'t your username. Type "{{username}}" exactly.',
         confirm: 'Delete Forever',
         error: 'Failed to delete account',
         handoff: {
@@ -2373,6 +2395,7 @@ const dict = {
             request: "Couldn't start the verification. Check the domain and try again.",
             notYet: 'Not verified yet. Changes to DNS can take a while to show up.',
             remove: "Couldn't remove the domain",
+            invalid: 'Enter just the domain, like example.com — no https://, slashes or spaces.',
         },
         remove: {
             title: 'Remove domain',

package/dist/cjs/i18n/locales/es-ES.js

@@ -163,6 +163,9 @@ const dict = {
             requestExpired: 'Este inicio de sesión ha caducado. Envía un email nuevo.',
             secondFactorInvalid: 'Ese código no es correcto. Prueba con el actual.',
             originNotAllowed: 'Aquí no se puede iniciar sesión.',
+            network: 'No se ha podido conectar con Oxy. Comprueba tu conexión e inténtalo de nuevo.',
+            invalidInput: 'Algo de lo que has escrito no es válido. Revísalo e inténtalo de nuevo.',
+            server: 'Oxy no ha podido terminar esto ahora. Inténtalo de nuevo en un momento.',
             generic: 'Algo ha ido mal. Inténtalo de nuevo.',
         },
         subtitleToApp: 'para continuar en {{app}}',
@@ -225,6 +228,31 @@ const dict = {
             invalidDescription: 'Ha caducado o ya se ha usado. Pide un email nuevo en la app o escribe el código del último.',
         },
     },
+    actionErrors: {
+        updateProfile: 'No se ha podido actualizar tu perfil. Inténtalo de nuevo.',
+        uploadAvatar: 'No se ha podido subir la foto. Inténtalo de nuevo.',
+        updateSettings: 'No se han podido guardar tus ajustes. Inténtalo de nuevo.',
+        updatePrivacy: 'No se han podido guardar tus ajustes de privacidad. Inténtalo de nuevo.',
+        updateNotifications: 'No se han podido guardar tus preferencias de notificaciones. Inténtalo de nuevo.',
+        updatePreferences: 'No se han podido guardar tus preferencias. Inténtalo de nuevo.',
+        revokeConnectedApp: 'No se ha podido desconectar la app. Inténtalo de nuevo.',
+        switchSession: 'No se ha podido cambiar de cuenta. Inténtalo de nuevo.',
+        logout: 'No se ha podido cerrar la sesión. Inténtalo de nuevo.',
+        logoutAll: 'No se ha podido cerrar la sesión en todas partes. Inténtalo de nuevo.',
+        updateDeviceName: 'No se ha podido cambiar el nombre del dispositivo. Inténtalo de nuevo.',
+        removeDevice: 'No se ha podido quitar el dispositivo. Inténtalo de nuevo.',
+    },
+    usernamePolicy: {
+        hint: 'Letras, números, - y _. Sin espacios.',
+        required: 'Elige un nombre de usuario.',
+        tooShort: 'Usa al menos {{min}} caracteres.',
+        tooLong: 'Usa como máximo {{max}} caracteres.',
+        noSpaces: 'El nombre de usuario no puede tener espacios. Usa - o _ en su lugar.',
+        characters: 'Usa solo letras, números, - y _. Empieza y termina con una letra o un número, y no pongas dos - o _ seguidos.',
+        onlyNumbers: 'El nombre de usuario no puede ser solo números. Añade una letra.',
+        reserved: 'Ese nombre de usuario está reservado. Elige otro.',
+        mustEndInBot: 'El nombre de usuario de una cuenta bot debe terminar en «bot».',
+    },
     signup: {
         title: 'Crea tu cuenta',
         subtitle: 'Elige tu nombre de usuario. Después confirmamos tu email.',
@@ -233,7 +261,6 @@ const dict = {
         username: {
             label: 'Nombre de usuario',
             placeholder: 'tunombre',
-            required: 'Elige un nombre de usuario.',
             taken: 'Ese nombre de usuario ya está en uso.',
         },
         email: {
@@ -305,8 +332,6 @@ const dict = {
                 label: 'Usuario',
                 placeholder: 'Elige un usuario',
                 choose: 'Elige un usuario',
-                required: 'El usuario es obligatorio',
-                tooShort: 'El usuario debe tener al menos 3 caracteres',
             },
             email: {
                 title: 'Correo electrónico',
@@ -904,7 +929,6 @@ const dict = {
             firstPlaceholder: 'Tu nombre',
             lastLabel: 'Apellidos',
             lastPlaceholder: 'Tus apellidos',
-            saveFailed: 'No se pudo guardar tu nombre',
         },
         avatar: {
             title: 'Hazlo tuyo',
@@ -1260,7 +1284,7 @@ const dict = {
             },
             rules: {
                 title: 'Reglas del nombre de usuario',
-                content: 'Los nombres de usuario solo pueden contener letras minúsculas (a-z) y números (0-9). Deben tener al menos 4 caracteres. No se permiten caracteres especiales, espacios ni mayúsculas para mantener los nombres de usuario simples y fáciles de recordar.',
+                content: 'Los nombres de usuario tienen entre 3 y 30 caracteres y usan letras, números, guiones (-) y guiones bajos (_). Empiezan y terminan con una letra o un número, nunca llevan dos - o _ seguidos y no son solo números. No se permiten espacios. Las mayúsculas se guardan tal como las escribes, pero Alicia y alicia son el mismo nombre de usuario.',
             },
             unique: {
                 title: '¿Por qué debe ser único?',
@@ -1839,9 +1863,6 @@ const dict = {
                 label: 'Nombre de usuario',
                 available: 'El nombre de usuario está disponible',
                 taken: 'El nombre de usuario ya está en uso',
-                tooShort: 'El nombre de usuario debe tener al menos 3 caracteres',
-                invalidChars: 'Solo letras, números, guiones y guiones bajos',
-                mustEndInBot: 'El nombre de usuario de una cuenta de bot debe terminar en “bot”',
                 checkFailed: 'No se pudo comprobar la disponibilidad',
             },
             accountCategory: {
@@ -1876,16 +1897,15 @@ const dict = {
                 transfer: 'Transferir propiedad',
             },
             errors: {
-                identifierRequired: 'Introduce un nombre de usuario o correo para invitar',
+                emailInvalid: 'Introduce un email válido, como nombre@ejemplo.com.',
                 missingAccount: 'Ninguna cuenta seleccionada.',
                 noPermission: 'No tienes permiso para ver los miembros.',
-                userNotFound: 'Usuario no encontrado',
             },
             invite: {
-                title: 'Añadir un miembro',
-                identifierLabel: 'Nombre de usuario o correo',
+                title: 'Invitar a un miembro',
+                emailLabel: 'Email',
                 roleLabel: 'Rol',
-                submit: 'Añadir miembro',
+                submit: 'Enviar invitación',
             },
             removeConfirm: {
                 title: 'Eliminar miembro',
@@ -1896,8 +1916,9 @@ const dict = {
                 description: '¿Transferir la propiedad de esta cuenta a este miembro? Pasarás a ser administrador. Esto no se puede deshacer.',
             },
             toasts: {
-                added: 'Miembro añadido',
-                addFailed: 'No se pudo añadir el miembro',
+                invited: 'Invitación enviada',
+                inviteFailed: 'No se ha podido enviar la invitación. Inténtalo de nuevo.',
+                invitationUpdateFailed: 'No se ha podido actualizar la invitación. Inténtalo de nuevo.',
                 removed: 'Miembro eliminado',
                 removeFailed: 'No se pudo eliminar el miembro',
                 roleUpdated: 'Rol actualizado',
@@ -1959,6 +1980,7 @@ const dict = {
         title: 'Eliminar cuenta',
         warning: 'Esta acción no se puede deshacer. Tu cuenta y todos los datos asociados se eliminarán de forma permanente.',
         confirmLabel: 'Escribe "{{username}}" para confirmar',
+        confirmMismatch: 'Ese no es tu nombre de usuario. Escribe "{{username}}" exactamente.',
         confirm: 'Eliminar para siempre',
         error: 'No se pudo eliminar la cuenta',
         handoff: {
@@ -2373,6 +2395,7 @@ const dict = {
             request: 'No se pudo empezar la verificación. Revisa el dominio e inténtalo otra vez.',
             notYet: 'Aún no está verificado. Los cambios de DNS pueden tardar en aparecer.',
             remove: 'No se pudo quitar el dominio',
+            invalid: 'Escribe solo el dominio, como ejemplo.com, sin https://, barras ni espacios.',
         },
         remove: {
             title: 'Quitar dominio',

package/dist/cjs/utils/identityCacheSweep.js

@@ -53,6 +53,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OXY_IDENTITY_CACHE_PREFIXES = void 0;
+exports.oxyUserByIdPath = oxyUserByIdPath;
 exports.oxyUserByIdCacheKey = oxyUserByIdCacheKey;
 exports.evictOxyIdentityCache = evictOxyIdentityCache;
 /**
@@ -69,12 +70,19 @@ exports.OXY_IDENTITY_CACHE_PREFIXES = [
     // `resolveProfile` — keyed by fediverse handle in the query payload.
     'GET:/profiles/resolve',
 ];
+/**
+ * The path `getUserById` reads, its id encoded. Built in one place so the
+ * request and every key that evicts it cannot spell the id differently.
+ */
+function oxyUserByIdPath(userId) {
+    return `/users/${encodeURIComponent(userId)}`;
+}
 /**
  * Build the exact cache key `getUserById` reads under. The only identity key
  * derivable from a user id, so the only one that does not need a prefix sweep.
  */
 function oxyUserByIdCacheKey(userId) {
-    return `GET:/users/${userId}`;
+    return `GET:${oxyUserByIdPath(userId)}`;
 }
 /**
  * Sweep an `OxyServices` GET response cache of everything that could carry the

package/dist/esm/api/apps.js

@@ -81,7 +81,7 @@ export class ConnectedAppsApi {
      *   `ConnectedApp.applicationId`, NOT a credential/client id).
      */
     async revoke(applicationId) {
-        await this.ctx.request('DELETE', `/auth/grants/${applicationId}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/auth/grants/${enc(applicationId)}`, undefined, { cache: false });
         this.ctx.oxy.cache.delete('GET:/auth/grants');
     }
     /** Resource-bound external MCP connections for the active Oxy account. */

package/dist/esm/api/auth.js

@@ -932,7 +932,7 @@ export class AuthApi {
      */
     async checkUsername(username) {
         // Public availability lookup (pre-session) — skip the bearer preflight.
-        return this.ctx.request('GET', `/auth/check-username/${username}`, undefined, {
+        return this.ctx.request('GET', `/auth/check-username/${encodeURIComponent(username)}`, undefined, {
             cache: false,
             skipAuth: true,
         });

package/dist/esm/api/billing.js

@@ -10,6 +10,7 @@
  * arrive as ISO-8601 strings.
  */
 import { cancelProductSubscriptionCheck, parseContract, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productPlanCatalogueCheck, productPlanCheckoutRequestCheck, productSubscriptionCancellationResultCheck, productSubscriptionRenewalRequestCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from '@oxy.so/contracts/client';
+const enc = encodeURIComponent;
 const SUBSCRIPTION_TTL = 2 * 60 * 1000;
 const WALLET_TTL = 60 * 1000;
 export class BillingApi {
@@ -73,7 +74,7 @@ export class BillingApi {
     /** A user's subscription (default: the signed-in user's). */
     async subscription(userId) {
         const id = this.resolveUserId(userId);
-        return this.ctx.request('GET', `/subscription/${id}`, undefined, {
+        return this.ctx.request('GET', `/subscription/${enc(id)}`, undefined, {
             cache: true,
             cacheTTL: SUBSCRIPTION_TTL,
         });
@@ -81,7 +82,7 @@ export class BillingApi {
     /** A user's wallet (default: the signed-in user's). Cached briefly: the balance moves. */
     async wallet(userId) {
         const id = this.resolveUserId(userId);
-        return this.ctx.request('GET', `/wallet/${id}`, undefined, {
+        return this.ctx.request('GET', `/wallet/${enc(id)}`, undefined, {
             cache: true,
             cacheTTL: WALLET_TTL,
         });
@@ -94,7 +95,7 @@ export class BillingApi {
             params.limit = options.limit;
         if (options.offset)
             params.offset = options.offset;
-        return this.ctx.request('GET', `/wallet/transactions/${id}`, params, {
+        return this.ctx.request('GET', `/wallet/transactions/${enc(id)}`, params, {
             cache: false,
         });
     }

package/dist/esm/api/devices.js

@@ -1,6 +1,7 @@
 import { checkContract, deviceBackgroundCredentialResponseCheck, deviceJoinCodeResponseCheck, deviceJoinResponseCheck, deviceRegisterResponseCheck, deviceTokenMintResponseCheck, } from '@oxy.so/contracts/client';
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
+const enc = encodeURIComponent;
 /**
  * The server's `401 account_not_on_device` for a PINNED mint: the requested
  * `accountId` is not (or is no longer) a live account of this device session.
@@ -71,7 +72,7 @@ export class DevicesApi {
      * @param deviceId - The device ID to remove
      */
     async remove(deviceId) {
-        await this.ctx.request('DELETE', `/devices/${deviceId}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/devices/${enc(deviceId)}`, undefined, { cache: false });
     }
     /**
      * Get device sessions for a given session ID
@@ -81,7 +82,7 @@ export class DevicesApi {
      */
     async sessions(sessionId) {
         // Cache disabled by default to ensure fresh session data
-        return this.ctx.request('GET', `/session/device/sessions/${sessionId}`, undefined, {
+        return this.ctx.request('GET', `/session/device/sessions/${enc(sessionId)}`, undefined, {
             cache: false, // Don't cache sessions - always get fresh data
             deduplicate: true, // Deduplicate concurrent requests for same sessionId
         });
@@ -99,7 +100,7 @@ export class DevicesApi {
             urlParams.deviceId = deviceId;
         if (excludeCurrent)
             urlParams.excludeCurrent = 'true';
-        return this.ctx.request('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
+        return this.ctx.request('POST', `/session/device/logout-all/${enc(sessionId)}`, urlParams, { cache: false });
     }
     /**
      * Update device name
@@ -108,7 +109,7 @@ export class DevicesApi {
      * @returns Updated device object
      */
     async rename(sessionId, deviceName) {
-        return this.ctx.request('PUT', `/session/device/name/${sessionId}`, { deviceName }, { cache: false });
+        return this.ctx.request('PUT', `/session/device/name/${enc(sessionId)}`, { deviceName }, { cache: false });
     }
     /**
      * Get security information

package/dist/esm/api/follows.js

@@ -1,4 +1,5 @@
 import { buildPaginationParams, buildQueryParams, buildUrl, } from '../utils/apiUtils.js';
+import { oxyUserByIdCacheKey, oxyUserByIdPath } from '../utils/identityCacheSweep.js';
 const GRAPH_TTL = 2 * 60 * 1000;
 const STATUS_TTL = 60 * 1000;
 /**
@@ -13,7 +14,7 @@ export class FollowsApi {
     // ── People ───────────────────────────────────────────────────────────────
     /** Follow a user. */
     async follow(userId) {
-        const result = await this.ctx.request('POST', `/users/${userId}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('POST', `${oxyUserByIdPath(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -27,7 +28,7 @@ export class FollowsApi {
     }
     /** Unfollow a user. */
     async unfollow(userId) {
-        const result = await this.ctx.request('DELETE', `/users/${userId}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('DELETE', `${oxyUserByIdPath(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -41,7 +42,7 @@ export class FollowsApi {
     }
     /** Whether the signed-in user follows `userId`. Cached 1 minute, busted by every write. */
     async status(userId) {
-        return this.ctx.request('GET', `/users/${userId}/follow-status`, undefined, {
+        return this.ctx.request('GET', `${oxyUserByIdPath(userId)}/follow-status`, undefined, {
             cache: true,
             cacheTTL: STATUS_TTL,
         });
@@ -71,12 +72,12 @@ export class FollowsApi {
      * `limit`/`offset`/`sort` combination is its own cache entry (2 minutes).
      */
     async followers(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/followers`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/followers`, params);
         return { followers: data, total, hasMore };
     }
     /** Who a user follows. `sort` as in `followers`. */
     async following(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/following`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/following`, params);
         return { following: data, total, hasMore };
     }
     /**
@@ -84,7 +85,7 @@ export class FollowsApi {
      * `userId`.
      */
     async mutuals(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${userId}/mutuals`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/mutuals`, params);
         return { mutuals: data, total, hasMore };
     }
     /**
@@ -219,16 +220,17 @@ export class FollowsApi {
         const keys = ['GET:/users/me/graph'];
         const prefixes = ['GET:/profiles/username/', 'GET:/profiles/resolve'];
         for (const id of targetUserIds) {
-            keys.push(`GET:/users/${id}/follow-status`);
+            const user = oxyUserByIdPath(id);
+            keys.push(`GET:${user}/follow-status`);
             // Profiles embed the viewer-relative `relationship`.
-            keys.push(`GET:/users/${id}`);
+            keys.push(oxyUserByIdCacheKey(id));
             // The target gained or lost a follower, and "followers you know" with it.
-            prefixes.push(`GET:/users/${id}/followers`, `GET:/users/${id}/mutuals`);
+            prefixes.push(`GET:${user}/followers`, `GET:${user}/mutuals`);
         }
         // The viewer's own following list changed.
         const viewerId = this.ctx.oxy.session.userId;
         if (viewerId)
-            prefixes.push(`GET:/users/${viewerId}/following`);
+            prefixes.push(`GET:${oxyUserByIdPath(viewerId)}/following`);
         this.ctx.http.invalidateCache({ keys, prefixes });
     }
 }

package/dist/esm/api/privacy.js

@@ -1,4 +1,5 @@
 import { evictOxyIdentityCache } from '../utils/identityCacheSweep.js';
+const enc = encodeURIComponent;
 const LIST_TTL = 60 * 1000;
 const SETTINGS_TTL = 2 * 60 * 1000;
 const refId = (ref) => (typeof ref === 'string' ? ref : ref._id);
@@ -10,7 +11,7 @@ export class PrivacyApi {
     /** A user's privacy settings (default: the signed-in user's). */
     async settings(userId) {
         const id = await this.resolveUserId(userId);
-        return this.ctx.request('GET', `/privacy/${id}/privacy`, undefined, {
+        return this.ctx.request('GET', `/privacy/${enc(id)}/privacy`, undefined, {
             cache: true,
             cacheTTL: SETTINGS_TTL,
         });
@@ -18,10 +19,10 @@ export class PrivacyApi {
     /** Update privacy settings (default: the signed-in user's). */
     async updateSettings(settings, userId) {
         const id = await this.resolveUserId(userId);
-        const res = await this.ctx.request('PATCH', `/privacy/${id}/privacy`, settings, { cache: false });
+        const res = await this.ctx.request('PATCH', `/privacy/${enc(id)}/privacy`, settings, { cache: false });
         // Privacy settings ride the user DTO, so every identity read goes stale too.
         evictOxyIdentityCache(this.ctx.http, id);
-        this.ctx.oxy.cache.delete(`GET:/privacy/${id}/privacy`);
+        this.ctx.oxy.cache.delete(`GET:/privacy/${enc(id)}/privacy`);
         return res;
     }
     // ── Blocked ──────────────────────────────────────────────────────────────
@@ -35,14 +36,14 @@ export class PrivacyApi {
     /** Block a user. */
     async block(userId) {
         requireId(userId);
-        const res = await this.ctx.request('POST', `/privacy/blocked/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('POST', `/privacy/blocked/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/blocked');
         return res;
     }
     /** Unblock a user. */
     async unblock(userId) {
         requireId(userId);
-        const res = await this.ctx.request('DELETE', `/privacy/blocked/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('DELETE', `/privacy/blocked/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/blocked');
         return res;
     }
@@ -68,14 +69,14 @@ export class PrivacyApi {
     /** Restrict a user: limit their interactions without blocking them. */
     async restrict(userId) {
         requireId(userId);
-        const res = await this.ctx.request('POST', `/privacy/restricted/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('POST', `/privacy/restricted/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/restricted');
         return res;
     }
     /** Lift a restriction. */
     async unrestrict(userId) {
         requireId(userId);
-        const res = await this.ctx.request('DELETE', `/privacy/restricted/${userId}`, undefined, { cache: false });
+        const res = await this.ctx.request('DELETE', `/privacy/restricted/${enc(userId)}`, undefined, { cache: false });
         this.invalidate('GET:/privacy/restricted');
         return res;
     }

package/dist/esm/api/session.js

@@ -9,6 +9,7 @@ import { jwtDecode } from 'jwt-decode';
 import { normalizeUserIdentity } from '../utils/userIdentity.js';
 import { OxyApiError } from '../OxyServices.errors.js';
 import { checkContract, holderContextEvidenceV1ResponseCheck } from '@oxy.so/contracts/client';
+const enc = encodeURIComponent;
 /** How long a refusal (disabled, rate limited, unreachable) is remembered per installation. */
 const EVIDENCE_REFUSAL_MS = 5000;
 const unavailable = (reason) => ({
@@ -290,7 +291,7 @@ export class SessionApi {
                             : {}),
                     },
                 })
-                : await this.ctx.request('GET', `/session/validate/${sessionId}`, {
+                : await this.ctx.request('GET', `/session/validate/${enc(sessionId)}`, {
                     ...(options.deviceFingerprint
                         ? { deviceFingerprint: options.deviceFingerprint }
                         : {}),
@@ -317,7 +318,7 @@ export class SessionApi {
                 const invalid = candidate?.status === 401 && candidate.code === 'OXY_LIVE_SESSION_INVALID_V1';
                 const denied = candidate?.status === 403 && candidate.code === 'OXY_LIVE_SESSION_POLICY_V1';
                 if (invalid)
-                    this.ctx.oxy.cache.delete(`GET:/session/user/${sessionId}`);
+                    this.ctx.oxy.cache.delete(`GET:/session/user/${enc(sessionId)}`);
                 if (invalid || denied)
                     throw error;
                 throw new OxyApiError('Live session authority is unavailable', {
@@ -327,26 +328,28 @@ export class SessionApi {
                 });
             }
             // The session is gone: drop any user cached for it (#196).
-            this.ctx.oxy.cache.delete(`GET:/session/user/${sessionId}`);
+            this.ctx.oxy.cache.delete(`GET:/session/user/${enc(sessionId)}`);
             throw error;
         }
     }
     /** The sessions that belong with `sessionId` (same account set). */
     async list(sessionId) {
-        return this.ctx.request('GET', `/session/sessions/${sessionId}`, undefined, {
+        return this.ctx.request('GET', `/session/sessions/${enc(sessionId)}`, undefined, {
             cache: false,
         });
     }
     /** Sign out `sessionId`, or — with `targetSessionId` — one of the sessions beside it. */
     async logout(sessionId, targetSessionId) {
         const url = targetSessionId
-            ? `/session/logout/${sessionId}/${targetSessionId}`
-            : `/session/logout/${sessionId}`;
+            ? `/session/logout/${enc(sessionId)}/${enc(targetSessionId)}`
+            : `/session/logout/${enc(sessionId)}`;
         await this.ctx.request('POST', url, undefined, { cache: false });
     }
     /** Sign out the other sessions for this account; preserve `sessionId`. */
     async logoutAll(sessionId) {
-        await this.ctx.request('POST', `/session/logout-all/${sessionId}`, undefined, { cache: false });
+        await this.ctx.request('POST', `/session/logout-all/${enc(sessionId)}`, undefined, {
+            cache: false,
+        });
     }
     /** Decoded claims of the current token, memoised per token string. */
     claims() {

package/dist/esm/api/topics.js

@@ -1,3 +1,4 @@
+const enc = encodeURIComponent;
 const SHORT = 60 * 1000;
 const LONG = 5 * 60 * 1000;
 const EXTRA_LONG = 30 * 60 * 1000;
@@ -41,7 +42,7 @@ export class TopicsApi {
     }
     /** One topic by slug. */
     async get(slug) {
-        return this.ctx.request('GET', `/topics/${slug}`, undefined, {
+        return this.ctx.request('GET', `/topics/${enc(slug)}`, undefined, {
             cache: true,
             cacheTTL: LONG,
         });
@@ -60,10 +61,10 @@ export class TopicsApi {
     }
     /** Update a topic's description and translations. Staff or service only. */
     async update(slug, data) {
-        const topic = await this.ctx.request('PATCH', `/topics/${slug}`, data, {
+        const topic = await this.ctx.request('PATCH', `/topics/${enc(slug)}`, data, {
             cache: false,
         });
-        this.ctx.oxy.cache.delete(`GET:/topics/${slug}`);
+        this.ctx.oxy.cache.delete(`GET:/topics/${enc(slug)}`);
         return topic;
     }
 }