@oxyhq/core 12.3.0 → 12.4.1

package/dist/types/index.d.ts

@@ -77,7 +77,7 @@ export { buildSearchParams, buildUrl, buildPaginationParams, safeJsonParse, } fr
 export type { PaginationParams, ApiResponse, ErrorResponse, } from './utils/apiUtils';
 export { ErrorCodes, createApiError, handleHttpError, validateRequiredFields, } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
 export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger';
 export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink, LoggerConfig, } from './logger';

package/dist/types/utils/validationUtils.d.ts

@@ -25,6 +25,71 @@ export declare function isValidUsername(username: string): boolean;
  * Validate password strength
  */
 export declare function isValidPassword(password: string): boolean;
+/**
+ * Display-name character policy.
+ *
+ * A clean display name is composed ONLY of:
+ *   - letters from a curated ALLOWLIST of scripts that real names use
+ *     ({@link DISPLAY_NAME_ALLOWED_SCRIPTS}) — NOT `\p{L}` (letters of ANY
+ *     script), which admits decorative / historic / limited-use scripts whose
+ *     characters are `\p{L}` yet never appear in a real name (e.g. `ᯅ` U+1BC5
+ *     Batak, Runic, Deseret, dingbat letters),
+ *   - combining marks / accents (`\p{M}`, e.g. the acute accent in a decomposed
+ *     "é"),
+ *   - Unicode space separators (`\p{Zs}`: the ASCII space, NBSP, ideographic
+ *     space, …) — but NOT control whitespace such as tab, newline, or carriage
+ *     return, which would break layout or enable multi-line spoofing,
+ *   - the straight apostrophe (`'`, e.g. "O'Brien").
+ *
+ * Everything else is rejected: emoji (🐧), symbols (⁂ ⏚), `:emoji:` shortcodes,
+ * digits, hyphens, dots, control whitespace (tab/newline/CR), letters from
+ * non-allowlisted scripts, and any other punctuation. The allowed set never
+ * includes `<`, `>`, `&`, or `"`, so a value that passes this predicate can
+ * never contain an HTML/XSS vector.
+ *
+ * The allowlist is expressed with Unicode Script_Extensions (`\p{scx=…}`)
+ * escapes so a letter shared by several scripts (e.g. a Han ideograph used in
+ * both Chinese and Japanese) still matches. It is the set of scripts Unicode
+ * UTS #39 marks "Recommended" for general interchange / identifiers, plus
+ * Cherokee and Mongolian (both in real modern name use). "Common" script is
+ * deliberately EXCLUDED — that is where ASCII digits and general punctuation
+ * live, and this policy excludes those; the space separators, combining marks,
+ * and apostrophe a name needs are added back explicitly. Limited-use / excluded
+ * / historic scripts (Batak, Runic, Deseret, Adlam, …) are simply absent.
+ *
+ * This is the SINGLE definition of the policy: the character-class sources below
+ * are the ONE source of truth, shared between the API strip/gate
+ * (`@oxyhq/api` `displayNameSanitize.ts` builds its global-flag patterns from
+ * them) and client-side inline validation (the RN profile editor via
+ * {@link isValidDisplayName}) so the two can never drift. It is platform-agnostic
+ * (no react/react-native/expo).
+ */
+/**
+ * The curated allowlist of Unicode scripts permitted in a display name, as a
+ * character-class body of Script_Extensions (`scx`) property escapes. Ordered by
+ * rough script family for readability; order has no semantic effect.
+ */
+export declare const DISPLAY_NAME_ALLOWED_SCRIPTS: string;
+/**
+ * Source of the disallowed-character pattern: the negation of the full allowed
+ * set (allowlisted scripts + combining marks `\p{M}` + space separators `\p{Zs}`
+ * + the straight apostrophe). Consumers compile this with the `u` flag (and `g`
+ * for a global strip). The whitespace class is `\p{Zs}` (space separators only),
+ * NOT `\s` — the latter would admit tab/newline/carriage return, which break
+ * layout and enable multi-line spoofing.
+ */
+export declare const DISPLAY_NAME_DISALLOWED_SOURCE = "[^\\p{scx=Latin}\\p{scx=Greek}\\p{scx=Cyrillic}\\p{scx=Armenian}\\p{scx=Hebrew}\\p{scx=Arabic}\\p{scx=Thaana}\\p{scx=Devanagari}\\p{scx=Bengali}\\p{scx=Gurmukhi}\\p{scx=Gujarati}\\p{scx=Oriya}\\p{scx=Tamil}\\p{scx=Telugu}\\p{scx=Kannada}\\p{scx=Malayalam}\\p{scx=Sinhala}\\p{scx=Thai}\\p{scx=Lao}\\p{scx=Tibetan}\\p{scx=Myanmar}\\p{scx=Georgian}\\p{scx=Hangul}\\p{scx=Ethiopic}\\p{scx=Cherokee}\\p{scx=Khmer}\\p{scx=Mongolian}\\p{scx=Hiragana}\\p{scx=Katakana}\\p{scx=Bopomofo}\\p{scx=Han}\\p{M}\\p{Zs}']";
+/**
+ * Source of the orphaned combining-mark pattern: a run of `\p{M}` NOT attached
+ * to a base letter (preceded by string start, whitespace, the apostrophe, or a
+ * position vacated by a stripped character). A mark preceded by `\p{L}` (a base
+ * letter, e.g. the decomposed accent in "Renée") or by another `\p{M}` (a
+ * multi-mark cluster) is NOT matched because the negative lookbehind fails at its
+ * position. Used both as a non-global probe (`.test`) and, with the `g` flag, to
+ * strip whole orphaned runs. The lookbehind intentionally still uses the broad
+ * `\p{L}` so that a mark riding on an allowlisted base letter is preserved.
+ */
+export declare const DISPLAY_NAME_ORPHANED_MARK_SOURCE = "(?<![\\p{L}\\p{M}])\\p{M}+";
 /**
  * Whether `raw` already satisfies the display-name policy, i.e. it contains no
  * disallowed characters AND no orphaned combining marks. Used to REJECT native

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "12.3.0",
+  "version": "12.4.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/index.ts

@@ -457,6 +457,9 @@ export {
     isValidUsername,
     isValidPassword,
     isValidDisplayName,
+    DISPLAY_NAME_ALLOWED_SCRIPTS,
+    DISPLAY_NAME_DISALLOWED_SOURCE,
+    DISPLAY_NAME_ORPHANED_MARK_SOURCE,
     isRequiredString,
     isRequiredNumber,
     isRequiredBoolean,

package/src/session/__tests__/refresh.test.ts

@@ -159,6 +159,26 @@ describe('refreshPersistedSession — arm 1 (device-secret mint)', () => {
     expect(await store.load()).toEqual(STORED);
     expect(signInWithSharedIdentity).not.toHaveBeenCalled();
   });
+
+  it('KEEPS the store on an UNRECOGNIZED 401 (proxy / middleware / deploy-window) — never wipes the credential on an ambiguous 401', async () => {
+    const store = createMemoryAuthStateStore();
+    await store.save(STORED);
+    const signInWithSharedIdentity = jest.fn(async () => null);
+    const { oxy } = makeOxy({
+      mintFromDeviceSecret: async () => {
+        // A 401 whose body is NEITHER `invalid_device_secret` NOR `no_active_session`
+        // — an auth-layer / proxy / starting-instance 401 common during a deploy
+        // window. It is NOT proof the secret diverged, so the durable device
+        // credential must survive (treated as transient) and a later attempt self-heals.
+        throw Object.assign(new Error('Unauthorized'), { status: 401 });
+      },
+      signInWithSharedIdentity,
+    });
+
+    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true })).toBeNull();
+    expect(await store.load()).toEqual(STORED);
+    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
+  });
 });
 
 describe('refreshPersistedSession — arm 2 (native shared-key fallback)', () => {

package/src/session/refresh.ts

@@ -136,9 +136,18 @@ export async function refreshDeviceSecretArm(deps: {
         // Structural read (not `instanceof Error`): the thrown value can be a
         // plain ApiError-shaped object or come from another realm.
         const message = (error as { message?: unknown })?.message;
-        return typeof message === 'string' && message.includes('no_active_session')
-          ? { status: 'no-session' }
-          : { status: 'invalid-secret' };
+        const body = typeof message === 'string' ? message : '';
+        // ONLY the server's explicit `invalid_device_secret` proves the presented
+        // secret is bad and may clear the durable device credential. `no_active_session`
+        // is an authoritative signed-out. ANY OTHER 401 — a middleware/CSRF/proxy 401,
+        // an ALB/starting-instance 401, a CORS error page, etc., all common during a
+        // deploy/restart window — is NOT proof the secret diverged: treat it as
+        // transient and KEEP the credential so a later attempt self-heals. Wiping the
+        // credential on an ambiguous 401 is what logged users out on every deploy,
+        // ecosystem-wide.
+        if (body.includes('invalid_device_secret')) return { status: 'invalid-secret' };
+        if (body.includes('no_active_session')) return { status: 'no-session' };
+        return { status: 'transient' };
       }
       return { status: 'transient' };
     }

package/src/utils/__tests__/validationUtils.test.ts

@@ -148,6 +148,22 @@ describe('Validation Utils', () => {
       expect(isValidDisplayName('')).toBe(true); // empty is valid; non-empty enforced elsewhere
     });
 
+    it.each([
+      ['Владимир', 'Cyrillic'],
+      ['مُحَمَد', 'Arabic with harakat'],
+      ['נתן', 'Hebrew'],
+      ['नमस्ते', 'Devanagari'],
+      ['김철수', 'Hangul'],
+      ['Αριστοτέλης', 'Greek'],
+      ['Արամ', 'Armenian'],
+      ['დავით', 'Georgian'],
+      ['สมชาย', 'Thai'],
+      ['ᏔᎳ', 'Cherokee'],
+      ['ᠮᠣᠩᠭᠣᠯ', 'Mongolian'],
+    ])('should return true for allowlisted-script real name %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
     it('should return false for emoji, symbols, digits, and punctuation', () => {
       expect(isValidDisplayName('nixCraft \u{1f427}')).toBe(false); // penguin emoji
       expect(isValidDisplayName('Agent007')).toBe(false);
@@ -155,6 +171,17 @@ describe('Validation Utils', () => {
       expect(isValidDisplayName('J.R.')).toBe(false);
     });
 
+    it.each([
+      ['ᯅ', 'Batak U+1BC5 (Limited-Use script)'],
+      ['ᚠ', 'Runic'],
+      ['Miguel de Icaza ᯅ', 'a Latin name with a trailing Batak letter'],
+    ])('should return false for non-allowlisted-script letter %p (%s)', (name) => {
+      // These characters are General_Category Lo (`\p{L}`), so the old
+      // all-scripts policy accepted them; the curated script allowlist rejects
+      // decorative / limited-use scripts a real name never uses.
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
     it('should return false for control whitespace (tab/newline/CR)', () => {
       // \p{Zs} (space separators only) rejects layout-breaking / multi-line
       // spoofing whitespace that \s would have admitted.

package/src/utils/validationUtils.ts

@@ -43,7 +43,11 @@ export function isValidPassword(password: string): boolean {
  * Display-name character policy.
  *
  * A clean display name is composed ONLY of:
- *   - letters of any script (`\p{L}`),
+ *   - letters from a curated ALLOWLIST of scripts that real names use
+ *     ({@link DISPLAY_NAME_ALLOWED_SCRIPTS}) — NOT `\p{L}` (letters of ANY
+ *     script), which admits decorative / historic / limited-use scripts whose
+ *     characters are `\p{L}` yet never appear in a real name (e.g. `ᯅ` U+1BC5
+ *     Batak, Runic, Deseret, dingbat letters),
  *   - combining marks / accents (`\p{M}`, e.g. the acute accent in a decomposed
  *     "é"),
  *   - Unicode space separators (`\p{Zs}`: the ASCII space, NBSP, ideographic
@@ -52,34 +56,71 @@ export function isValidPassword(password: string): boolean {
  *   - the straight apostrophe (`'`, e.g. "O'Brien").
  *
  * Everything else is rejected: emoji (🐧), symbols (⁂ ⏚), `:emoji:` shortcodes,
- * digits, hyphens, dots, control whitespace (tab/newline/CR), and any other
- * punctuation. The allowed set `\p{L}\p{M}\p{Zs}'` explicitly EXCLUDES `<`, `>`,
- * `&`, and `"`, so a value that passes this predicate can never contain an
- * HTML/XSS vector.
+ * digits, hyphens, dots, control whitespace (tab/newline/CR), letters from
+ * non-allowlisted scripts, and any other punctuation. The allowed set never
+ * includes `<`, `>`, `&`, or `"`, so a value that passes this predicate can
+ * never contain an HTML/XSS vector.
  *
- * This is the SINGLE definition of the policy, shared between the API 400-gate
- * (`@oxyhq/api` `displayNameSanitize.ts`) and client-side inline validation
- * (the RN profile editor) so the two can never drift. It is platform-agnostic
+ * The allowlist is expressed with Unicode Script_Extensions (`\p{scx=…}`)
+ * escapes so a letter shared by several scripts (e.g. a Han ideograph used in
+ * both Chinese and Japanese) still matches. It is the set of scripts Unicode
+ * UTS #39 marks "Recommended" for general interchange / identifiers, plus
+ * Cherokee and Mongolian (both in real modern name use). "Common" script is
+ * deliberately EXCLUDED — that is where ASCII digits and general punctuation
+ * live, and this policy excludes those; the space separators, combining marks,
+ * and apostrophe a name needs are added back explicitly. Limited-use / excluded
+ * / historic scripts (Batak, Runic, Deseret, Adlam, …) are simply absent.
+ *
+ * This is the SINGLE definition of the policy: the character-class sources below
+ * are the ONE source of truth, shared between the API strip/gate
+ * (`@oxyhq/api` `displayNameSanitize.ts` builds its global-flag patterns from
+ * them) and client-side inline validation (the RN profile editor via
+ * {@link isValidDisplayName}) so the two can never drift. It is platform-agnostic
  * (no react/react-native/expo).
  */
 
 /**
- * Single test for the presence of a disallowed character (non-global). The
- * whitespace class is `\p{Zs}` (space separators only), NOT `\s` — the latter
- * would admit tab/newline/carriage return, which break layout and enable
- * multi-line spoofing.
+ * The curated allowlist of Unicode scripts permitted in a display name, as a
+ * character-class body of Script_Extensions (`scx`) property escapes. Ordered by
+ * rough script family for readability; order has no semantic effect.
+ */
+export const DISPLAY_NAME_ALLOWED_SCRIPTS =
+  '\\p{scx=Latin}\\p{scx=Greek}\\p{scx=Cyrillic}\\p{scx=Armenian}' +
+  '\\p{scx=Hebrew}\\p{scx=Arabic}\\p{scx=Thaana}\\p{scx=Devanagari}' +
+  '\\p{scx=Bengali}\\p{scx=Gurmukhi}\\p{scx=Gujarati}\\p{scx=Oriya}' +
+  '\\p{scx=Tamil}\\p{scx=Telugu}\\p{scx=Kannada}\\p{scx=Malayalam}' +
+  '\\p{scx=Sinhala}\\p{scx=Thai}\\p{scx=Lao}\\p{scx=Tibetan}' +
+  '\\p{scx=Myanmar}\\p{scx=Georgian}\\p{scx=Hangul}\\p{scx=Ethiopic}' +
+  '\\p{scx=Cherokee}\\p{scx=Khmer}\\p{scx=Mongolian}\\p{scx=Hiragana}' +
+  '\\p{scx=Katakana}\\p{scx=Bopomofo}\\p{scx=Han}';
+
+/**
+ * Source of the disallowed-character pattern: the negation of the full allowed
+ * set (allowlisted scripts + combining marks `\p{M}` + space separators `\p{Zs}`
+ * + the straight apostrophe). Consumers compile this with the `u` flag (and `g`
+ * for a global strip). The whitespace class is `\p{Zs}` (space separators only),
+ * NOT `\s` — the latter would admit tab/newline/carriage return, which break
+ * layout and enable multi-line spoofing.
  */
-const DISALLOWED_PROBE = /[^\p{L}\p{M}\p{Zs}']/u;
+export const DISPLAY_NAME_DISALLOWED_SOURCE = `[^${DISPLAY_NAME_ALLOWED_SCRIPTS}\\p{M}\\p{Zs}']`;
 
 /**
- * Single test for the presence of an orphaned combining mark (non-global) — a
- * `\p{M}` not attached to a base letter (string start, whitespace, the
- * apostrophe, or a position vacated by a stripped character). A mark preceded by
- * `\p{L}` (a base letter, e.g. the decomposed accent in "Renée") or by another
- * `\p{M}` (a multi-mark cluster) is NOT matched because the negative lookbehind
- * fails at its position.
+ * Source of the orphaned combining-mark pattern: a run of `\p{M}` NOT attached
+ * to a base letter (preceded by string start, whitespace, the apostrophe, or a
+ * position vacated by a stripped character). A mark preceded by `\p{L}` (a base
+ * letter, e.g. the decomposed accent in "Renée") or by another `\p{M}` (a
+ * multi-mark cluster) is NOT matched because the negative lookbehind fails at its
+ * position. Used both as a non-global probe (`.test`) and, with the `g` flag, to
+ * strip whole orphaned runs. The lookbehind intentionally still uses the broad
+ * `\p{L}` so that a mark riding on an allowlisted base letter is preserved.
  */
-const ORPHANED_MARK_PROBE = /(?<![\p{L}\p{M}])\p{M}/u;
+export const DISPLAY_NAME_ORPHANED_MARK_SOURCE = '(?<![\\p{L}\\p{M}])\\p{M}+';
+
+/** Non-global probe for the presence of a disallowed character. */
+const DISALLOWED_PROBE = new RegExp(DISPLAY_NAME_DISALLOWED_SOURCE, 'u');
+
+/** Non-global probe for the presence of an orphaned combining mark. */
+const ORPHANED_MARK_PROBE = new RegExp(DISPLAY_NAME_ORPHANED_MARK_SOURCE, 'u');
 
 /**
  * Whether `raw` already satisfies the display-name policy, i.e. it contains no