@oxy.so/core 7.13.0 → 7.14.0

package/dist/cjs/i18n/locales/en-US.js

@@ -1897,7 +1897,6 @@ const dict = {
                 transfer: 'Transfer ownership',
             },
             errors: {
-                emailRequired: 'Enter an email to invite.',
                 emailInvalid: 'Enter a valid email address, like name@example.com.',
                 missingAccount: 'No account selected.',
                 noPermission: 'You do not have permission to view members.',
@@ -2334,7 +2333,6 @@ const dict = {
             newLabel: 'New password',
             repeatLabel: 'Repeat the password',
             tooShort: 'Use at least {{min}} characters.',
-            tooLong: 'Use at most {{max}} characters.',
             mismatch: "The passwords don't match.",
             signOutOthers: 'Sign out everywhere else',
             save: 'Save password',

package/dist/cjs/i18n/locales/es-ES.js

@@ -1897,7 +1897,6 @@ const dict = {
                 transfer: 'Transferir propiedad',
             },
             errors: {
-                emailRequired: 'Introduce un email para invitar.',
                 emailInvalid: 'Introduce un email válido, como nombre@ejemplo.com.',
                 missingAccount: 'Ninguna cuenta seleccionada.',
                 noPermission: 'No tienes permiso para ver los miembros.',
@@ -2334,7 +2333,6 @@ const dict = {
             newLabel: 'Contraseña nueva',
             repeatLabel: 'Repite la contraseña',
             tooShort: 'Usa al menos {{min}} caracteres.',
-            tooLong: 'Usa como máximo {{max}} caracteres.',
             mismatch: 'Las contraseñas no coinciden.',
             signOutOthers: 'Cerrar sesión en todos los demás sitios',
             save: 'Guardar contraseña',

package/dist/cjs/index.js

@@ -28,8 +28,8 @@ exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthRetur
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
-// tree-shake: on Hermes, `@noble/hashes` would capture an absent
-// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
+// tree-shake: on Hermes, the shim has to exist before any of it evaluates. See
+// the note in `./crypto/polyfill`.
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
 // API client

package/dist/cjs/utils/identityCacheSweep.js

@@ -53,6 +53,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OXY_IDENTITY_CACHE_PREFIXES = void 0;
+exports.oxyUserByIdPath = oxyUserByIdPath;
 exports.oxyUserByIdCacheKey = oxyUserByIdCacheKey;
 exports.evictOxyIdentityCache = evictOxyIdentityCache;
 /**
@@ -69,12 +70,19 @@ exports.OXY_IDENTITY_CACHE_PREFIXES = [
     // `resolveProfile` — keyed by fediverse handle in the query payload.
     'GET:/profiles/resolve',
 ];
+/**
+ * The path `getUserById` reads, its id encoded. Built in one place so the
+ * request and every key that evicts it cannot spell the id differently.
+ */
+function oxyUserByIdPath(userId) {
+    return `/users/${encodeURIComponent(userId)}`;
+}
 /**
  * Build the exact cache key `getUserById` reads under. The only identity key
  * derivable from a user id, so the only one that does not need a prefix sweep.
  */
 function oxyUserByIdCacheKey(userId) {
-    return `GET:/users/${userId}`;
+    return `GET:${oxyUserByIdPath(userId)}`;
 }
 /**
  * Sweep an `OxyServices` GET response cache of everything that could carry the

package/dist/esm/api/follows.js

@@ -1,5 +1,5 @@
 import { buildPaginationParams, buildQueryParams, buildUrl, } from '../utils/apiUtils.js';
-const enc = encodeURIComponent;
+import { oxyUserByIdCacheKey, oxyUserByIdPath } from '../utils/identityCacheSweep.js';
 const GRAPH_TTL = 2 * 60 * 1000;
 const STATUS_TTL = 60 * 1000;
 /**
@@ -14,7 +14,7 @@ export class FollowsApi {
     // ── People ───────────────────────────────────────────────────────────────
     /** Follow a user. */
     async follow(userId) {
-        const result = await this.ctx.request('POST', `/users/${enc(userId)}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('POST', `${oxyUserByIdPath(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -28,7 +28,7 @@ export class FollowsApi {
     }
     /** Unfollow a user. */
     async unfollow(userId) {
-        const result = await this.ctx.request('DELETE', `/users/${enc(userId)}/follow`, undefined, { cache: false });
+        const result = await this.ctx.request('DELETE', `${oxyUserByIdPath(userId)}/follow`, undefined, { cache: false });
         this.invalidate([userId]);
         return result;
     }
@@ -42,7 +42,7 @@ export class FollowsApi {
     }
     /** Whether the signed-in user follows `userId`. Cached 1 minute, busted by every write. */
     async status(userId) {
-        return this.ctx.request('GET', `/users/${enc(userId)}/follow-status`, undefined, {
+        return this.ctx.request('GET', `${oxyUserByIdPath(userId)}/follow-status`, undefined, {
             cache: true,
             cacheTTL: STATUS_TTL,
         });
@@ -72,12 +72,12 @@ export class FollowsApi {
      * `limit`/`offset`/`sort` combination is its own cache entry (2 minutes).
      */
     async followers(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/followers`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/followers`, params);
         return { followers: data, total, hasMore };
     }
     /** Who a user follows. `sort` as in `followers`. */
     async following(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/following`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/following`, params);
         return { following: data, total, hasMore };
     }
     /**
@@ -85,7 +85,7 @@ export class FollowsApi {
      * `userId`.
      */
     async mutuals(userId, params) {
-        const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/mutuals`, params);
+        const { data, total, hasMore } = await this.userPage(`${oxyUserByIdPath(userId)}/mutuals`, params);
         return { mutuals: data, total, hasMore };
     }
     /**
@@ -220,16 +220,17 @@ export class FollowsApi {
         const keys = ['GET:/users/me/graph'];
         const prefixes = ['GET:/profiles/username/', 'GET:/profiles/resolve'];
         for (const id of targetUserIds) {
-            keys.push(`GET:/users/${enc(id)}/follow-status`);
+            const user = oxyUserByIdPath(id);
+            keys.push(`GET:${user}/follow-status`);
             // Profiles embed the viewer-relative `relationship`.
-            keys.push(`GET:/users/${enc(id)}`);
+            keys.push(oxyUserByIdCacheKey(id));
             // The target gained or lost a follower, and "followers you know" with it.
-            prefixes.push(`GET:/users/${enc(id)}/followers`, `GET:/users/${enc(id)}/mutuals`);
+            prefixes.push(`GET:${user}/followers`, `GET:${user}/mutuals`);
         }
         // The viewer's own following list changed.
         const viewerId = this.ctx.oxy.session.userId;
         if (viewerId)
-            prefixes.push(`GET:/users/${enc(viewerId)}/following`);
+            prefixes.push(`GET:${oxyUserByIdPath(viewerId)}/following`);
         this.ctx.http.invalidateCache({ keys, prefixes });
     }
 }

package/dist/esm/api/users.js

@@ -1,7 +1,7 @@
 import { recommendationRequestCheck, parseContract } from '@oxy.so/contracts/client';
 import { buildQueryParams } from '../utils/apiUtils.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
-import { OXY_IDENTITY_CACHE_PREFIXES, oxyUserByIdCacheKey } from '../utils/identityCacheSweep.js';
+import { OXY_IDENTITY_CACHE_PREFIXES, oxyUserByIdCacheKey, oxyUserByIdPath, } from '../utils/identityCacheSweep.js';
 import { OXY_ACCOUNT_LIST_CACHE_KEY, OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX, oxyAccountDetailCacheKey, } from '../utils/accountCacheSweep.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { runBatchLookup } from '../utils/batchLookup.js';
@@ -26,7 +26,7 @@ export class UsersApi {
      * registry-fresh read that neither serves nor overwrites a cached entry.
      */
     async get(userId, options) {
-        const user = await this.ctx.request('GET', `/users/${enc(userId)}`, undefined, {
+        const user = await this.ctx.request('GET', oxyUserByIdPath(userId), undefined, {
             cache: options?.cache ?? true,
             cacheTTL: PROFILE_TTL,
         });

package/dist/esm/crypto/aead.js

@@ -22,7 +22,7 @@
 // Loading the polyfill guarantees `globalThis.crypto.getRandomValues` exists on
 // every platform (native crypto on web/Node; expo-crypto-backed shim on RN).
 import './polyfill.js';
-import { xchacha20poly1305 } from '@noble/ciphers/chacha';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
 /** Key length for XChaCha20-Poly1305, in bytes (256-bit). */
 export const AEAD_KEY_LENGTH = 32;
 /** Nonce length for XChaCha20-Poly1305, in bytes (192-bit). */

package/dist/esm/crypto/contentHash.js

@@ -6,8 +6,8 @@
  * directly: `@noble/hashes` must load after this entry's polyfill, and through
  * the ONE lazy root, so it never lands in an app's startup JavaScript.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
 export function createContentHasher() {
     const hash = sha256.create();
     return {

package/dist/esm/crypto/identityDerivations.js

@@ -10,8 +10,8 @@
  *
  * ESM/CJS safe: static `import` only, no `require()`.
  */
-import { hmac } from '@noble/hashes/hmac';
-import { sha256, sha512 } from '@noble/hashes/sha2';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { deriveSecp256k1PublicKey, normalizeSecp256k1PrivateKey, signSecp256k1Digest, tweakAddSecp256k1PrivateKey, } from '@oxy.so/protocol/secp256k1';
 import { hkdfSha256 } from './kdf.js';
 /**

package/dist/esm/crypto/identityLink.js

@@ -5,8 +5,8 @@
  * Commons from its own; the person checks they match before the link is
  * confirmed, so a photographed QR cannot slip another key in.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
 const DOMAIN = 'oxy-identity-link-code/v1';
 export function deriveIdentityLinkCode(linkId, publicKey) {
     const digest = sha256(utf8ToBytes(`${DOMAIN}|${linkId}|${publicKey.trim().toLowerCase()}`));

package/dist/esm/crypto/identityProof.js

@@ -6,8 +6,8 @@
  * its own JSON.
  */
 import './polyfill.js';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { signMessage } from '@oxy.so/protocol/sign';
 import { buildIdentityProofMessage, canonicalJson, IDENTITY_PROOF_VERSION, } from '@oxy.so/contracts/client';
 /** SHA-256 hex of the canonical JSON of `payload` — the `payloadDigest` claim. */

package/dist/esm/crypto/index.js

@@ -10,8 +10,8 @@
  * internal barrel) made Metro hoist the shared stack into the always-loaded
  * common chunk, which is the cost the lazy loading exists to avoid.
  */
-// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
-// it is evaluated, so the shim has to exist before anything below reaches it.
+// MUST stay the first import: the shim has to exist before any module below
+// evaluates or draws randomness (see `./polyfill`).
 import './polyfill.js';
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityUnavailableError, } from './keyManager.js';
 export { readIdentityMarker, updateIdentityMarker } from './identityMarker.js';

package/dist/esm/crypto/kdf.js

@@ -9,8 +9,8 @@
  *
  * ESM/CJS safe: static `import` only, no `require()`.
  */
-import { hkdf } from '@noble/hashes/hkdf';
-import { sha256 } from '@noble/hashes/sha256';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 /**
  * Derive `length` bytes of keying material from `ikm` using HKDF-SHA256
  * (RFC 5869 — extract-then-expand).

package/dist/esm/crypto/polyfill.js

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 import _cjs_buffer from 'buffer';

package/dist/esm/crypto/recoveryPhrase.js

@@ -13,7 +13,7 @@
  * app. Adding another language means one more subpath import, ideally lazy.
  */
 import { generateMnemonic, mnemonicToSeed, validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { KeyManager } from './keyManager.js';
 import { hkdfSha256 } from './kdf.js';
 /**

package/dist/esm/crypto/registrationPow.js

@@ -7,8 +7,8 @@
  * `auth/registrationPow.ts` — this file is only the solve loop.
  */
 import './polyfill.js';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { meetsRegistrationPowDifficulty, registrationPowMessage, REGISTRATION_POW_DIFFICULTY_BITS, } from '@oxy.so/protocol';
 /**
  * How many attempts the grind loop runs before yielding to the event loop.
@@ -28,7 +28,7 @@ function yieldToEventLoop() {
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the