@oxyhq/core 16.1.0 → 17.0.0

package/dist/types/HttpService.d.ts

@@ -131,12 +131,21 @@ export declare class HttpService {
      *
      * Why we explicitly reject `URLSearchParams`:
      *  - `URLSearchParams` ALSO exposes `append` / `get` / `has`, so the
-     *    duck-type fallback below would have misidentified it as FormData.
-     *  - We want urlencoded payloads to take the JSON-stringify path so the
-     *    server receives them as `application/x-www-form-urlencoded` instead
-     *    of an empty multipart body.
+     *    duck-type fallback below would have misidentified it as FormData and
+     *    sent an empty multipart body.
+     *  - It has its own encoding path instead — see {@link isUrlSearchParams}.
      */
     private isFormData;
+    /**
+     * True for an `application/x-www-form-urlencoded` payload.
+     *
+     * Needed because a handful of endpoints are defined by a standard that fixes
+     * their request encoding rather than by our own JSON conventions — today
+     * `POST /auth/oauth/token`, whose encoding RFC 6749 §4.1.3 mandates. Passing
+     * a `URLSearchParams` as `data` selects that encoding; everything else is
+     * still JSON.
+     */
+    private isUrlSearchParams;
     /**
      * Main request method - handles everything in one place
      */

package/dist/types/index.d.ts

@@ -25,7 +25,7 @@ export { ServiceCredentialMismatchError, } from './mixins/OxyServices.auth';
 export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval';
 export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery';
 export type { CommonsDeliveryFacts, CommonsDeliveryPlatform, CommonsDeliveryRoute, } from './utils/commonsDelivery';
-export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
+export type { ServiceTokenResponse, OAuthUserInfoResponse } from './mixins/OxyServices.auth';
 export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
 export type { PushTokenPlatform, RegisterPushTokenInput, } from './mixins/OxyServices.notifications';
 export type { ServiceApp, ServiceActingAsVerification } from './mixins/OxyServices.utility';
@@ -83,7 +83,7 @@ export { buildQueryParams, buildSearchParams, buildUrl, buildPaginationParams, s
 export type { PaginationParams, FollowGraphParams, FollowGraphSort, ApiResponse, ErrorResponse, } from './utils/apiUtils';
 export { ErrorCodes, createApiError, handleHttpError, validateRequiredFields, } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
 export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger';
 export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink, LoggerConfig, } from './logger';

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -32,6 +32,13 @@ export interface PublicKeyCheckResponse {
     registered: boolean;
     message: string;
 }
+/** OpenID Connect userinfo claims returned by `GET /auth/oauth/userinfo`. */
+export interface OAuthUserInfoResponse {
+    sub: string;
+    preferred_username?: string;
+    name?: string;
+    picture?: string;
+}
 /**
  * How a "Sign in with Oxy" request finalizes once the approver authorizes it.
  *
@@ -779,6 +786,13 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * after sign-in at auth.oxy.so) for a device-first session.
          * Public first-party clients use PKCE (`codeVerifier`); the access token is
          * planted immediately on success.
+         *
+         * Speaks the standard RFC 6749 §4.1.3 token request — a form-urlencoded
+         * body with snake_case parameters and `grant_type=authorization_code` — and
+         * reads the flat §5.1 response. The camelCase JSON request and `{ data }`
+         * response this method used before were an Oxy invention no OAuth library
+         * could interoperate with; the endpoint no longer accepts them. The method's
+         * OWN signature is unchanged, so callers are unaffected.
          */
         exchangeOAuthCode(params: {
             code: string;
@@ -786,6 +800,11 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
             redirectUri: string;
             codeVerifier: string;
         }): Promise<LoginSessionResult>;
+        /**
+         * Fetch OpenID Connect userinfo for the current bearer (`GET /auth/oauth/userinfo`).
+         * The response is a flat JSON document — no `{ data }` wrapper.
+         */
+        getOAuthUserInfo(): Promise<OAuthUserInfoResponse>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;

package/dist/types/server/index.d.ts

@@ -25,5 +25,7 @@ export type { OxyCorsOptions } from './cors';
 export { buildOxyCspDirectives, buildOxyPagesHeaders, createOxySecurityHeaders, formatOxyCspPolicy, OXY_CSP_BASELINE, } from './securityHeaders';
 export type { OxyCspDirective, OxyCspExtensions, OxyPagesHeadersOptions, OxySecurityHeadersOptions, } from './securityHeaders';
 export { verifySecret } from './verifySecret';
+export { createOxyUserInvalidationHandler, evictOxyIdentityCache, publishOxyUserInvalidation, } from './userInvalidation';
+export type { OxyIdentityCacheEvictor, OxyInvalidationPublisher, OxyUserInvalidationHandlerOptions, } from './userInvalidation';
 export { registrableApex } from '../utils/registrableApex';
 export { isOfficialWebOrigin } from '../utils/officialOrigins';

package/dist/types/server/userInvalidation.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Oxy user-invalidation publish/consume helpers for Oxy backends.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Every Oxy backend caches Oxy identity, and none of them find out when it
+ * changes. The `OxyServices` GET response cache holds `GET /users/:id` and
+ * `GET /profiles/username/:name` for five minutes; it is swept when THIS process
+ * writes the profile (see the `clearCacheEntry` calls in the user mixin) and
+ * never when somebody else does — which is the normal case, since profiles are
+ * edited in Oxy's own apps. So an avatar or display-name change is invisible to
+ * every consuming backend for up to five minutes, per process.
+ *
+ * oxy-api broadcasts {@link OXY_USER_INVALIDATION_CHANNEL} on the shared Valkey
+ * when a user's identity changes. This module is the consumer half: it parses
+ * and validates the event, sweeps the SDK's own cache, and hands the event to
+ * app-specific eviction. Wiring it is two lines and every backend that does so
+ * stops serving stale identity.
+ *
+ * WHY THE TRANSPORT IS THE CALLER'S JOB
+ * -------------------------------------
+ * This module deliberately does NOT take a Redis client. ioredis and node-redis
+ * disagree about how to subscribe — node-redis passes the listener to
+ * `subscribe(channel, listener)`, ioredis takes `subscribe(channel)` and then
+ * emits `'message'` on the client — and a helper that accepted "a client" would
+ * have to sniff which library it was handed. That kind of detection is exactly
+ * what breaks silently when a consumer upgrades a client library.
+ *
+ * So the split is: this module owns parsing, validation, dispatch and the
+ * never-throw guarantee (the parts that are easy to get wrong and identical
+ * everywhere), and the caller owns its own client's two-line subscribe idiom
+ * (trivial, but library-specific).
+ *
+ *     // node-redis
+ *     await subscriber.subscribe(
+ *       OXY_USER_INVALIDATION_CHANNEL,
+ *       createOxyUserInvalidationHandler({ oxy: oxyClient }),
+ *     );
+ *
+ *     // ioredis
+ *     const handle = createOxyUserInvalidationHandler({ oxy: oxyClient });
+ *     await subscriber.subscribe(OXY_USER_INVALIDATION_CHANNEL);
+ *     subscriber.on('message', (_channel, raw) => handle(raw));
+ *
+ * Subscribe on EVERY task, not just an elected leader. The SDK cache this sweeps
+ * is per-process in-memory, so a leader-only subscriber would leave every other
+ * task stale — and leader-gating would add a failure mode (leader down means no
+ * invalidation anywhere) to a signal whose whole point is that losing it is
+ * merely slow, never wrong.
+ *
+ * Node-only; exported solely from `@oxyhq/core/server`.
+ */
+import { type OxyUserChangeReason, type OxyUserInvalidationEvent } from '@oxyhq/contracts';
+/**
+ * The publish surface of a Redis client. Both `ioredis` and `node-redis`
+ * satisfy this structurally, so neither library is a dependency here.
+ */
+export interface OxyInvalidationPublisher {
+    publish(channel: string, message: string): unknown;
+}
+/**
+ * The cache-eviction surface of an {@link OxyServices} instance. Declared
+ * structurally so this Node-only module does not pull in the client.
+ */
+export interface OxyIdentityCacheEvictor {
+    clearCacheEntry(key: string): void;
+    clearCacheByPrefix(prefix: string): number;
+}
+/**
+ * Broadcast that an Oxy user's record changed.
+ *
+ * Returns `true` when a message was put on the wire and `false` when the reason
+ * is not a broadcast one ({@link isPublishedOxyUserChangeReason}) — the latter is
+ * a deliberate no-op, not a failure. Suppressing at the publisher rather than
+ * letting every subscriber discard matters at bulk-follow scale, where a single
+ * call moves up to 200 edges.
+ *
+ * NEVER THROWS AND NEVER RETURNS A REJECTED PROMISE. This is called from inside
+ * cache invalidation, which itself runs after a successful database write on the
+ * request path: a publish failure must not turn a completed profile update into
+ * a 500. A dropped message costs a consumer its TTL and nothing more.
+ *
+ * @param publisher - A connected Redis client. Must NOT be a client currently in
+ *                    subscriber mode — Redis forbids `PUBLISH` on a subscribed
+ *                    connection, so pass the publisher half of a pub/sub pair.
+ * @param userId    - The Oxy user whose record changed.
+ * @param reason    - How the record changed. See {@link OxyUserChangeReason}.
+ * @param onError   - Optional diagnostic sink for a failed publish.
+ */
+export declare function publishOxyUserInvalidation(publisher: OxyInvalidationPublisher, userId: string, reason: OxyUserChangeReason, onError?: (error: unknown) => void): boolean;
+/** Options for {@link createOxyUserInvalidationHandler}. */
+export interface OxyUserInvalidationHandlerOptions {
+    /**
+     * The backend's `OxyServices` instance. When supplied, its GET response cache
+     * is swept for the invalidated user — this is the whole reason a backend that
+     * has no cache of its own still benefits from subscribing.
+     */
+    oxy?: OxyIdentityCacheEvictor;
+    /**
+     * App-specific eviction (e.g. a Redis identity cache the app maintains itself).
+     * May be async; a rejection is routed to `onError` and never escapes.
+     */
+    onInvalidate?: (event: OxyUserInvalidationEvent) => void | Promise<void>;
+    /** Diagnostic sink for an unparseable message or a failing `onInvalidate`. */
+    onError?: (error: unknown, raw: string) => void;
+}
+/**
+ * Build the message handler for {@link OXY_USER_INVALIDATION_CHANNEL}.
+ *
+ * The returned function NEVER THROWS and never returns a rejected promise. It
+ * runs inside the Redis client's message dispatch, where an exception either
+ * takes down the subscriber connection or surfaces as an unhandled rejection —
+ * and losing the subscription is strictly worse than losing one message, because
+ * it is silent and permanent.
+ *
+ * A message that fails schema validation is dropped, not retried: the payload is
+ * produced by a contract both sides compile against, so a malformed one means a
+ * version skew or an unrelated publisher on the channel, neither of which a retry
+ * fixes.
+ */
+export declare function createOxyUserInvalidationHandler(options?: OxyUserInvalidationHandlerOptions): (raw: string) => void;
+/**
+ * Sweep an `OxyServices` GET response cache of everything that could carry the
+ * given user's identity.
+ *
+ * The by-id entry is exact. The by-username and resolve entries are keyed by
+ * HANDLE, which cannot be derived from an id without the very lookup we are
+ * invalidating, so those are swept by prefix — the same imprecision the SDK
+ * already accepts when it sweeps its own cache after a local profile write, and
+ * bounded by the fact that over-eviction costs a refetch and can never serve
+ * wrong data.
+ */
+export declare function evictOxyIdentityCache(oxy: OxyIdentityCacheEvictor, userId: string): void;

package/dist/types/utils/validationUtils.d.ts

@@ -6,6 +6,8 @@
  * Shared by the API write path and client input surfaces.
  */
 export declare const MAX_DISPLAY_NAME_LENGTH = 80;
+/** Shared 400 / inline-validation copy for native display-name policy rejections. */
+export declare const DISPLAY_NAME_INVALID_MESSAGE = "Name may only contain letters, spaces, apostrophes, and name separators (\u00B7, \u05BE, \u0F0B, \u30FB).";
 /**
  * Email validation regex
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "16.1.0",
+  "version": "17.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/HttpService.ts

@@ -373,10 +373,9 @@ export class HttpService {
    *
    * Why we explicitly reject `URLSearchParams`:
    *  - `URLSearchParams` ALSO exposes `append` / `get` / `has`, so the
-   *    duck-type fallback below would have misidentified it as FormData.
-   *  - We want urlencoded payloads to take the JSON-stringify path so the
-   *    server receives them as `application/x-www-form-urlencoded` instead
-   *    of an empty multipart body.
+   *    duck-type fallback below would have misidentified it as FormData and
+   *    sent an empty multipart body.
+   *  - It has its own encoding path instead — see {@link isUrlSearchParams}.
    */
   private isFormData(data: unknown): data is FormDataLike {
     if (!data || typeof data !== 'object') {
@@ -417,6 +416,19 @@ export class HttpService {
     );
   }
 
+  /**
+   * True for an `application/x-www-form-urlencoded` payload.
+   *
+   * Needed because a handful of endpoints are defined by a standard that fixes
+   * their request encoding rather than by our own JSON conventions — today
+   * `POST /auth/oauth/token`, whose encoding RFC 6749 §4.1.3 mandates. Passing
+   * a `URLSearchParams` as `data` selects that encoding; everything else is
+   * still JSON.
+   */
+  private isUrlSearchParams(data: unknown): data is URLSearchParams {
+    return typeof URLSearchParams !== 'undefined' && data instanceof URLSearchParams;
+  }
+
   /**
    * Main request method - handles everything in one place
    */
@@ -482,6 +494,7 @@ export class HttpService {
 
         // Determine if data is FormData using robust detection
         const isFormData = this.isFormData(data);
+        const isUrlEncoded = this.isUrlSearchParams(data);
 
         // Make fetch request
         const controller = new AbortController();
@@ -497,7 +510,9 @@ export class HttpService {
         };
 
         // Only set Content-Type for non-FormData requests (FormData sets it automatically with boundary)
-        if (!isFormData) {
+        if (isUrlEncoded) {
+          headers['Content-Type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
+        } else if (!isFormData) {
           headers['Content-Type'] = 'application/json';
         }
 
@@ -545,8 +560,11 @@ export class HttpService {
           });
         }
 
+        // `URLSearchParams` is serialised explicitly rather than handed to
+        // `fetch` as-is: RN's fetch does not consistently encode it, and doing
+        // it here keeps the body identical across every platform.
         const bodyValue = method !== 'GET' && data
-            ? (isFormData ? data : JSON.stringify(data))
+            ? (isFormData ? data : isUrlEncoded ? data.toString() : JSON.stringify(data))
             : undefined;
 
         // React Native FormData workaround:
@@ -619,10 +637,17 @@ export class HttpService {
           const contentType = response.headers.get('content-type');
           if (contentType && contentType.includes('application/json')) {
             try {
-              const errorData = await response.json() as { message?: string; error?: string } | null;
+              const errorData = await response.json() as {
+                message?: string;
+                error?: string;
+                error_description?: string;
+              } | null;
               // Accept either structured error field from API responses.
               if (errorData?.message) {
                 errorMessage = errorData.message;
+              } else if (errorData?.error_description) {
+                // RFC 6749 §5.2 / RFC 6750 §3 — OAuth endpoints surface human text here.
+                errorMessage = errorData.error_description;
               } else if (errorData?.error) {
                 errorMessage = errorData.error;
               }

package/src/__tests__/httpServiceFormEncoded.test.ts

@@ -0,0 +1,142 @@
+/**
+ * `application/x-www-form-urlencoded` request bodies.
+ *
+ * Needed because a few endpoints are defined by a standard that fixes their
+ * request encoding instead of by our JSON conventions — `POST /auth/oauth/token`
+ * (RFC 6749 §4.1.3) is the first. Before this path existed, a `URLSearchParams`
+ * payload fell through to `JSON.stringify`, which serialises it to `"{}"`: the
+ * request left with an empty body and a JSON content type, and the server saw
+ * no parameters at all. That silent failure is what these tests prevent.
+ */
+
+import { HttpService } from '../HttpService';
+
+interface FetchCall {
+  url: string;
+  init: RequestInit | undefined;
+}
+
+function jsonResponse(data: unknown): Response {
+  return new Response(JSON.stringify(data), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+function readHeaders(init: RequestInit | undefined): Record<string, string> {
+  const headers = init?.headers;
+  if (!headers) {
+    return {};
+  }
+  if (headers instanceof Headers) {
+    return Object.fromEntries(headers.entries());
+  }
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+  return headers as Record<string, string>;
+}
+
+describe('HttpService form-urlencoded bodies', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  /**
+   * POST a form body and return the token-endpoint call. Selected by URL
+   * because an unauthenticated write is preceded by a `GET /csrf-token`.
+   */
+  async function postForm(body: URLSearchParams): Promise<FetchCall> {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return jsonResponse({ ok: true });
+    };
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+    await http.post('/auth/oauth/token', body, { skipAuth: true, cache: false });
+
+    const tokenCalls = calls.filter((call) => call.url.endsWith('/auth/oauth/token'));
+    expect(tokenCalls).toHaveLength(1);
+    return tokenCalls[0];
+  }
+
+  it('serialises URLSearchParams into the request body', async () => {
+    const call = await postForm(
+      new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: 'code-1',
+        redirect_uri: 'https://app.example/callback',
+      }),
+    );
+
+    // Not `"{}"` — the actual encoded parameters.
+    expect(call.init?.body).toBe(
+      'grant_type=authorization_code&code=code-1&redirect_uri=https%3A%2F%2Fapp.example%2Fcallback',
+    );
+  });
+
+  it('declares the form content type instead of application/json', async () => {
+    const call = await postForm(new URLSearchParams({ grant_type: 'authorization_code' }));
+
+    expect(readHeaders(call.init)['Content-Type']).toBe(
+      'application/x-www-form-urlencoded;charset=UTF-8',
+    );
+  });
+
+  it('percent-encodes values that would otherwise break the encoding', async () => {
+    const call = await postForm(new URLSearchParams({ code: 'a+b c&d=e' }));
+
+    expect(call.init?.body).toBe('code=a%2Bb+c%26d%3De');
+  });
+
+  it('still sends plain objects as JSON', async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return jsonResponse({ ok: true });
+    };
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+    await http.post('/auth/session/claim', { sessionToken: 'abc' }, { skipAuth: true });
+
+    const claimCall = calls.find((call) => call.url.endsWith('/auth/session/claim'));
+    expect(claimCall?.init?.body).toBe(JSON.stringify({ sessionToken: 'abc' }));
+    expect(readHeaders(claimCall?.init)['Content-Type']).toBe('application/json');
+  });
+
+  it('prefers OAuth error_description over the bare error code', async () => {
+    globalThis.fetch = async (input) => {
+      const url = String(input);
+      if (url.endsWith('/csrf-token')) {
+        return jsonResponse({ csrfToken: 'csrf-test' });
+      }
+      return new Response(
+        JSON.stringify({
+          error: 'invalid_grant',
+          error_description: 'The authorization code has expired.',
+        }),
+        { status: 400, headers: { 'content-type': 'application/json' } },
+      );
+    };
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+    let caught: unknown;
+    try {
+      await http.post(
+        '/auth/oauth/token',
+        new URLSearchParams({ grant_type: 'authorization_code', code: 'expired' }),
+        { skipAuth: true, cache: false, deduplicate: false, retry: false },
+      );
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeDefined();
+    expect(String((caught as { message?: string })?.message ?? caught)).toContain(
+      'The authorization code has expired.',
+    );
+  });
+});

package/src/i18n/locales/en-US.json

@@ -678,7 +678,7 @@
         "firstNamePlaceholder": "Enter first name",
         "lastName": "Last Name",
         "lastNamePlaceholder": "Enter last name (optional)",
-        "invalidChars": "Use letters and spaces only"
+        "invalidChars": "Use letters, spaces, apostrophes, and name separators only"
       },
       "username": {
         "title": "Username",
@@ -1752,7 +1752,8 @@
       "title": "Create account",
       "subtitle": "Create an account you control. It will have its own profile, members, and apps.",
       "displayName": {
-        "label": "Display name"
+        "label": "Display name",
+        "invalidChars": "Use letters, spaces, apostrophes, and name separators only"
       },
       "bio": {
         "label": "Bio (optional)"
@@ -1829,7 +1830,8 @@
       "subtitle": "Manage this account’s profile, members, and access.",
       "save": "Save changes",
       "displayName": {
-        "label": "Display name"
+        "label": "Display name",
+        "invalidChars": "Use letters, spaces, apostrophes, and name separators only"
       },
       "bio": {
         "label": "Bio (optional)"

package/src/i18n/locales/es-ES.json

@@ -203,7 +203,7 @@
         "firstNamePlaceholder": "Introduce tu nombre",
         "lastName": "Apellido",
         "lastNamePlaceholder": "Introduce tu apellido (opcional)",
-        "invalidChars": "Usa solo letras y espacios"
+        "invalidChars": "Usa solo letras, espacios, apóstrofos y separadores de nombre"
       },
       "username": {
         "title": "Usuario",
@@ -1752,7 +1752,8 @@
       "title": "Crear cuenta",
       "subtitle": "Crea una cuenta que tú controlas. Tendrá su propio perfil, miembros y aplicaciones.",
       "displayName": {
-        "label": "Nombre visible"
+        "label": "Nombre visible",
+        "invalidChars": "Usa solo letras, espacios, apóstrofos y separadores de nombre"
       },
       "bio": {
         "label": "Biografía (opcional)"
@@ -1829,7 +1830,8 @@
       "subtitle": "Gestiona el perfil, los miembros y el acceso de esta cuenta.",
       "save": "Guardar cambios",
       "displayName": {
-        "label": "Nombre visible"
+        "label": "Nombre visible",
+        "invalidChars": "Usa solo letras, espacios, apóstrofos y separadores de nombre"
       },
       "bio": {
         "label": "Biografía (opcional)"

package/src/index.ts

@@ -49,7 +49,7 @@ export type {
     CommonsDeliveryPlatform,
     CommonsDeliveryRoute,
 } from './utils/commonsDelivery';
-export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
+export type { ServiceTokenResponse, OAuthUserInfoResponse } from './mixins/OxyServices.auth';
 // "Sign in with Oxy" — handoff (Workstream C)
 export type {
     CommonsSignInHandle,
@@ -480,6 +480,7 @@ export {
     USERNAME_REGEX,
     PASSWORD_REGEX,
     MAX_DISPLAY_NAME_LENGTH,
+    DISPLAY_NAME_INVALID_MESSAGE,
     isValidEmail,
     isValidUsername,
     isValidPassword,