@oxy.so/core 7.13.0 → 7.14.0

package/dist/esm/i18n/locales/en-US.js

@@ -1895,7 +1895,6 @@ const dict = {
                 transfer: 'Transfer ownership',
             },
             errors: {
-                emailRequired: 'Enter an email to invite.',
                 emailInvalid: 'Enter a valid email address, like name@example.com.',
                 missingAccount: 'No account selected.',
                 noPermission: 'You do not have permission to view members.',
@@ -2332,7 +2331,6 @@ const dict = {
             newLabel: 'New password',
             repeatLabel: 'Repeat the password',
             tooShort: 'Use at least {{min}} characters.',
-            tooLong: 'Use at most {{max}} characters.',
             mismatch: "The passwords don't match.",
             signOutOthers: 'Sign out everywhere else',
             save: 'Save password',

package/dist/esm/i18n/locales/es-ES.js

@@ -1895,7 +1895,6 @@ const dict = {
                 transfer: 'Transferir propiedad',
             },
             errors: {
-                emailRequired: 'Introduce un email para invitar.',
                 emailInvalid: 'Introduce un email válido, como nombre@ejemplo.com.',
                 missingAccount: 'Ninguna cuenta seleccionada.',
                 noPermission: 'No tienes permiso para ver los miembros.',
@@ -2332,7 +2331,6 @@ const dict = {
             newLabel: 'Contraseña nueva',
             repeatLabel: 'Repite la contraseña',
             tooShort: 'Usa al menos {{min}} caracteres.',
-            tooLong: 'Usa como máximo {{max}} caracteres.',
             mismatch: 'Las contraseñas no coinciden.',
             signOutOthers: 'Cerrar sesión en todos los demás sitios',
             save: 'Guardar contraseña',

package/dist/esm/index.js

@@ -22,8 +22,8 @@
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
-// tree-shake: on Hermes, `@noble/hashes` would capture an absent
-// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
+// tree-shake: on Hermes, the shim has to exist before any of it evaluates. See
+// the note in `./crypto/polyfill`.
 import './crypto/polyfill.js';
 // ---------------------------------------------------------------------------
 // API client

package/dist/esm/utils/identityCacheSweep.js

@@ -64,12 +64,19 @@ export const OXY_IDENTITY_CACHE_PREFIXES = [
     // `resolveProfile` — keyed by fediverse handle in the query payload.
     'GET:/profiles/resolve',
 ];
+/**
+ * The path `getUserById` reads, its id encoded. Built in one place so the
+ * request and every key that evicts it cannot spell the id differently.
+ */
+export function oxyUserByIdPath(userId) {
+    return `/users/${encodeURIComponent(userId)}`;
+}
 /**
  * Build the exact cache key `getUserById` reads under. The only identity key
  * derivable from a user id, so the only one that does not need a prefix sweep.
  */
 export function oxyUserByIdCacheKey(userId) {
-    return `GET:/users/${userId}`;
+    return `GET:${oxyUserByIdPath(userId)}`;
 }
 /**
  * Sweep an `OxyServices` GET response cache of everything that could carry the

package/dist/types/crypto/polyfill.d.ts

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 import { Buffer } from 'buffer';

package/dist/types/crypto/registrationPow.d.ts

@@ -11,7 +11,7 @@ import './polyfill';
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the

package/dist/types/i18n/locales/en-US.d.ts

@@ -1886,7 +1886,6 @@ declare const dict: {
                 transfer: string;
             };
             errors: {
-                emailRequired: string;
                 emailInvalid: string;
                 missingAccount: string;
                 noPermission: string;
@@ -2323,7 +2322,6 @@ declare const dict: {
             newLabel: string;
             repeatLabel: string;
             tooShort: string;
-            tooLong: string;
             mismatch: string;
             signOutOthers: string;
             save: string;

package/dist/types/i18n/locales/es-ES.d.ts

@@ -1886,7 +1886,6 @@ declare const dict: {
                 transfer: string;
             };
             errors: {
-                emailRequired: string;
                 emailInvalid: string;
                 missingAccount: string;
                 noPermission: string;
@@ -2323,7 +2322,6 @@ declare const dict: {
             newLabel: string;
             repeatLabel: string;
             tooShort: string;
-            tooLong: string;
             mismatch: string;
             signOutOthers: string;
             save: string;

package/dist/types/utils/identityCacheSweep.d.ts

@@ -65,6 +65,11 @@ export interface OxyIdentityCacheEvictor {
  * reads whose key cannot be derived from a user id. Swept wholesale.
  */
 export declare const OXY_IDENTITY_CACHE_PREFIXES: readonly string[];
+/**
+ * The path `getUserById` reads, its id encoded. Built in one place so the
+ * request and every key that evicts it cannot spell the id differently.
+ */
+export declare function oxyUserByIdPath(userId: string): string;
 /**
  * Build the exact cache key `getUserById` reads under. The only identity key
  * derivable from a user id, so the only one that does not need a prefix sweep.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.13.0",
+  "version": "7.14.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -160,7 +160,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://oxy.so",
   "engines": {
-    "node": ">=20.0.0"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
     "build": "bun run check:compact-locales && node scripts/build-workspace-deps.mjs @oxy.so/telemetry && bun run build:cjs && bun run build:esm && bun run build:types && node scripts/mark-module-formats.mjs && node -e \"const p='../app-preset/metro/source-stamp.js';require('node:fs').existsSync(p)&&require(p).writeStamp(process.cwd())\"",
@@ -179,12 +179,12 @@
     "test:bun": "cd bun-tests && bun test"
   },
   "dependencies": {
-    "@noble/ciphers": "^1.3.0",
-    "@noble/hashes": "^1.8.0",
+    "@noble/ciphers": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
     "@oxy.so/contracts": "6.5.0",
-    "@oxy.so/protocol": "^1.5.1",
+    "@oxy.so/protocol": "^1.6.0",
     "@oxy.so/telemetry": "^2.1.0",
-    "@scure/bip39": "^1.6.0",
+    "@scure/bip39": "^2.4.0",
     "buffer": "^6.0.3",
     "express-rate-limit": "^8.6.0",
     "helmet": "^8.0.0",
@@ -195,7 +195,7 @@
     "zod": "^4.6.7"
   },
   "peerDependencies": {
-    "@react-native-async-storage/async-storage": "<3.0.0",
+    "@react-native-async-storage/async-storage": "<4.0.0",
     "expo-crypto": "<59.0.0",
     "expo-secure-store": "<59.0.0",
     "express": "^4.0.0",
@@ -223,7 +223,7 @@
     }
   },
   "devDependencies": {
-    "@react-native-async-storage/async-storage": "^2.2.0",
+    "@react-native-async-storage/async-storage": "^3.1.1",
     "@types/express": "^4.17.25",
     "@types/invariant": "^2.2.34",
     "@types/node": "^20.19.43",

package/src/api/follows.ts

@@ -27,8 +27,7 @@ import {
   buildUrl,
   type FollowGraphParams,
 } from '../utils/apiUtils';
-
-const enc = encodeURIComponent;
+import { oxyUserByIdCacheKey, oxyUserByIdPath } from '../utils/identityCacheSweep';
 
 const GRAPH_TTL = 2 * 60 * 1000;
 const STATUS_TTL = 60 * 1000;
@@ -132,7 +131,7 @@ export class FollowsApi {
   async follow(userId: string): Promise<FollowMutationResult> {
     const result = await this.ctx.request<FollowMutationResult>(
       'POST',
-      `/users/${enc(userId)}/follow`,
+      `${oxyUserByIdPath(userId)}/follow`,
       undefined,
       { cache: false },
     );
@@ -157,7 +156,7 @@ export class FollowsApi {
   async unfollow(userId: string): Promise<FollowMutationResult> {
     const result = await this.ctx.request<FollowMutationResult>(
       'DELETE',
-      `/users/${enc(userId)}/follow`,
+      `${oxyUserByIdPath(userId)}/follow`,
       undefined,
       { cache: false },
     );
@@ -180,7 +179,7 @@ export class FollowsApi {
 
   /** Whether the signed-in user follows `userId`. Cached 1 minute, busted by every write. */
   async status(userId: string): Promise<{ isFollowing: boolean }> {
-    return this.ctx.request('GET', `/users/${enc(userId)}/follow-status`, undefined, {
+    return this.ctx.request('GET', `${oxyUserByIdPath(userId)}/follow-status`, undefined, {
       cache: true,
       cacheTTL: STATUS_TTL,
     });
@@ -223,13 +222,19 @@ export class FollowsApi {
    * `limit`/`offset`/`sort` combination is its own cache entry (2 minutes).
    */
   async followers(userId: string, params?: FollowGraphParams): Promise<UserPage<'followers'>> {
-    const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/followers`, params);
+    const { data, total, hasMore } = await this.userPage(
+      `${oxyUserByIdPath(userId)}/followers`,
+      params,
+    );
     return { followers: data, total, hasMore };
   }
 
   /** Who a user follows. `sort` as in `followers`. */
   async following(userId: string, params?: FollowGraphParams): Promise<UserPage<'following'>> {
-    const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/following`, params);
+    const { data, total, hasMore } = await this.userPage(
+      `${oxyUserByIdPath(userId)}/following`,
+      params,
+    );
     return { following: data, total, hasMore };
   }
 
@@ -238,7 +243,10 @@ export class FollowsApi {
    * `userId`.
    */
   async mutuals(userId: string, params?: FollowGraphParams): Promise<UserPage<'mutuals'>> {
-    const { data, total, hasMore } = await this.userPage(`/users/${enc(userId)}/mutuals`, params);
+    const { data, total, hasMore } = await this.userPage(
+      `${oxyUserByIdPath(userId)}/mutuals`,
+      params,
+    );
     return { mutuals: data, total, hasMore };
   }
 
@@ -445,15 +453,16 @@ export class FollowsApi {
     const keys: string[] = ['GET:/users/me/graph'];
     const prefixes: string[] = ['GET:/profiles/username/', 'GET:/profiles/resolve'];
     for (const id of targetUserIds) {
-      keys.push(`GET:/users/${enc(id)}/follow-status`);
+      const user = oxyUserByIdPath(id);
+      keys.push(`GET:${user}/follow-status`);
       // Profiles embed the viewer-relative `relationship`.
-      keys.push(`GET:/users/${enc(id)}`);
+      keys.push(oxyUserByIdCacheKey(id));
       // The target gained or lost a follower, and "followers you know" with it.
-      prefixes.push(`GET:/users/${enc(id)}/followers`, `GET:/users/${enc(id)}/mutuals`);
+      prefixes.push(`GET:${user}/followers`, `GET:${user}/mutuals`);
     }
     // The viewer's own following list changed.
     const viewerId = this.ctx.oxy.session.userId;
-    if (viewerId) prefixes.push(`GET:/users/${enc(viewerId)}/following`);
+    if (viewerId) prefixes.push(`GET:${oxyUserByIdPath(viewerId)}/following`);
     this.ctx.http.invalidateCache({ keys, prefixes });
   }
 }

package/src/api/users.ts

@@ -12,7 +12,11 @@ import type { OxyContext } from '../client/context';
 import type { PaginationInfo, SearchProfilesResponse, User } from '../models/interfaces';
 import { buildQueryParams, type PaginationParams } from '../utils/apiUtils';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity';
-import { OXY_IDENTITY_CACHE_PREFIXES, oxyUserByIdCacheKey } from '../utils/identityCacheSweep';
+import {
+  OXY_IDENTITY_CACHE_PREFIXES,
+  oxyUserByIdCacheKey,
+  oxyUserByIdPath,
+} from '../utils/identityCacheSweep';
 import {
   OXY_ACCOUNT_LIST_CACHE_KEY,
   OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX,
@@ -67,7 +71,7 @@ export class UsersApi {
    * registry-fresh read that neither serves nor overwrites a cached entry.
    */
   async get(userId: string, options?: { cache?: boolean }): Promise<User> {
-    const user = await this.ctx.request<User>('GET', `/users/${enc(userId)}`, undefined, {
+    const user = await this.ctx.request<User>('GET', oxyUserByIdPath(userId), undefined, {
       cache: options?.cache ?? true,
       cacheTTL: PROFILE_TTL,
     });

package/src/crypto/aead.ts

@@ -23,7 +23,7 @@
 // Loading the polyfill guarantees `globalThis.crypto.getRandomValues` exists on
 // every platform (native crypto on web/Node; expo-crypto-backed shim on RN).
 import './polyfill';
-import { xchacha20poly1305 } from '@noble/ciphers/chacha';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
 
 /** Key length for XChaCha20-Poly1305, in bytes (256-bit). */
 export const AEAD_KEY_LENGTH = 32;

package/src/crypto/contentHash.ts

@@ -6,8 +6,8 @@
  * directly: `@noble/hashes` must load after this entry's polyfill, and through
  * the ONE lazy root, so it never lands in an app's startup JavaScript.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
 
 export interface ContentHasher {
   update(chunk: Uint8Array): void;

package/src/crypto/identityDerivations.ts

@@ -11,8 +11,8 @@
  * ESM/CJS safe: static `import` only, no `require()`.
  */
 
-import { hmac } from '@noble/hashes/hmac';
-import { sha256, sha512 } from '@noble/hashes/sha2';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import {
   deriveSecp256k1PublicKey,
   normalizeSecp256k1PrivateKey,

package/src/crypto/identityLink.ts

@@ -6,8 +6,8 @@
  * confirmed, so a photographed QR cannot slip another key in.
  */
 
-import { sha256 } from '@noble/hashes/sha256';
-import { utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
 
 const DOMAIN = 'oxy-identity-link-code/v1';
 

package/src/crypto/identityProof.ts

@@ -7,8 +7,8 @@
  */
 
 import './polyfill';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { signMessage } from '@oxy.so/protocol/sign';
 import type { IdentityProof, IdentityProofClaims } from '@oxy.so/contracts';
 import {

package/src/crypto/index.ts

@@ -11,8 +11,8 @@
  * common chunk, which is the cost the lazy loading exists to avoid.
  */
 
-// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
-// it is evaluated, so the shim has to exist before anything below reaches it.
+// MUST stay the first import: the shim has to exist before any module below
+// evaluates or draws randomness (see `./polyfill`).
 import './polyfill';
 
 export {

package/src/crypto/kdf.ts

@@ -10,8 +10,8 @@
  * ESM/CJS safe: static `import` only, no `require()`.
  */
 
-import { hkdf } from '@noble/hashes/hkdf';
-import { sha256 } from '@noble/hashes/sha256';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 
 /**
  * Derive `length` bytes of keying material from `ikm` using HKDF-SHA256

package/src/crypto/polyfill.ts

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 

package/src/crypto/recoveryPhrase.ts

@@ -14,7 +14,7 @@
  */
 
 import { generateMnemonic, mnemonicToSeed, validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { KeyManager } from './keyManager';
 import { hkdfSha256 } from './kdf';
 

package/src/crypto/registrationPow.ts

@@ -8,8 +8,8 @@
  */
 
 import './polyfill';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import {
   meetsRegistrationPowDifficulty,
   registrationPowMessage,
@@ -36,7 +36,7 @@ function yieldToEventLoop(): Promise<void> {
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the