@oxyhq/core 21.1.0 → 22.0.0

package/dist/types/index.d.ts

@@ -95,7 +95,7 @@ export type { PaginationParams, FollowGraphParams, FollowGraphSort, ApiResponse,
 export { ErrorCodes, createApiError, handleHttpError, isHttpRequestError, parseHttpErrorBody, validateRequiredFields, } from './utils/errorUtils';
 export type { HttpRequestError, ParsedHttpErrorBody } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
 export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger';
 export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink, LoggerConfig, } from './logger';

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -180,6 +180,21 @@ export interface CreateAccountInput {
     };
     bio?: string;
     avatar?: string;
+    /**
+     * Named color preset KEY — `'blue'`, `'mint'`, … — never a hex value. The
+     * account graph's half of `User.color`, which every account DTO already
+     * carries; this is how one gets WRITTEN for an account you administer.
+     *
+     * Set it HERE rather than after the fact. For a managed account the colour is
+     * a visual identity, and an account that is discoverable without one and
+     * acquires it on a second request is a face that changes by itself.
+     *
+     * Omitted is not "no colour": the platform assigns a random preset, exactly as
+     * it did before this field existed. A reserved preset is refused unless the
+     * account has a claim to it — the administrator's own entitlements are not the
+     * ones weighed.
+     */
+    color?: string;
     /**
      * What the account is about. ORDERED — the FIRST element is the primary
      * category, so a picker must submit them in the order the user arranged them
@@ -224,6 +239,15 @@ export interface UpdateAccountInput {
     };
     bio?: string | null;
     avatar?: string | null;
+    /**
+     * Named color preset KEY, same vocabulary as `CreateAccountInput['color']`.
+     *
+     * NOT nullable, unlike `bio` and `avatar`: the column is `NOT NULL` with a
+     * default, so an account always HAS a colour and there is no "clear" to
+     * express. Sending the value the account already carries is always accepted,
+     * so a client may PATCH back the object it was served.
+     */
+    color?: string;
     /**
      * Replaces the WHOLE list, in the order given — there is no add/remove verb,
      * because a partial edit cannot express a re-ordering and the order is what

package/dist/types/utils/validationUtils.d.ts

@@ -12,10 +12,6 @@ export declare const DISPLAY_NAME_INVALID_MESSAGE = "Name may only contain lette
  * Email validation regex
  */
 export declare const EMAIL_REGEX: RegExp;
-/**
- * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
- */
-export declare const USERNAME_REGEX: RegExp;
 /**
  * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
  */
@@ -24,10 +20,6 @@ export declare const PASSWORD_REGEX: RegExp;
  * Validate email format
  */
 export declare function isValidEmail(email: string): boolean;
-/**
- * Validate username format
- */
-export declare function isValidUsername(username: string): boolean;
 /**
  * Validate password strength
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "21.1.0",
+  "version": "22.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -116,7 +116,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.31.0",
+    "@oxyhq/contracts": "^0.33.0",
     "@oxyhq/protocol": "^0.2.0",
     "@scure/bip39": "^1.6.0",
     "@types/elliptic": "^6.4.18",

package/src/index.ts

@@ -521,12 +521,10 @@ export { retryAsync } from './utils/asyncUtils';
 // ---------------------------------------------------------------------------
 export {
     EMAIL_REGEX,
-    USERNAME_REGEX,
     PASSWORD_REGEX,
     MAX_DISPLAY_NAME_LENGTH,
     DISPLAY_NAME_INVALID_MESSAGE,
     isValidEmail,
-    isValidUsername,
     isValidPassword,
     isValidDisplayName,
     DISPLAY_NAME_ALLOWED_SCRIPTS,

package/src/mixins/OxyServices.accounts.ts

@@ -201,6 +201,21 @@ export interface CreateAccountInput {
   name?: { first?: string; last?: string; displayName?: string };
   bio?: string;
   avatar?: string;
+  /**
+   * Named color preset KEY — `'blue'`, `'mint'`, … — never a hex value. The
+   * account graph's half of `User.color`, which every account DTO already
+   * carries; this is how one gets WRITTEN for an account you administer.
+   *
+   * Set it HERE rather than after the fact. For a managed account the colour is
+   * a visual identity, and an account that is discoverable without one and
+   * acquires it on a second request is a face that changes by itself.
+   *
+   * Omitted is not "no colour": the platform assigns a random preset, exactly as
+   * it did before this field existed. A reserved preset is refused unless the
+   * account has a claim to it — the administrator's own entitlements are not the
+   * ones weighed.
+   */
+  color?: string;
   /**
    * What the account is about. ORDERED — the FIRST element is the primary
    * category, so a picker must submit them in the order the user arranged them
@@ -242,6 +257,15 @@ export interface UpdateAccountInput {
   name?: { first?: string; last?: string; displayName?: string };
   bio?: string | null;
   avatar?: string | null;
+  /**
+   * Named color preset KEY, same vocabulary as `CreateAccountInput['color']`.
+   *
+   * NOT nullable, unlike `bio` and `avatar`: the column is `NOT NULL` with a
+   * default, so an account always HAS a colour and there is no "clear" to
+   * express. Sending the value the account already carries is always accepted,
+   * so a client may PATCH back the object it was served.
+   */
+  color?: string;
   /**
    * Replaces the WHOLE list, in the order given — there is no add/remove verb,
    * because a partial edit cannot express a re-ordering and the order is what

package/src/mixins/__tests__/accounts.test.ts

@@ -255,13 +255,20 @@ describe('OxyServices.accounts', () => {
     it('posts the payload, unwraps `account`, and busts every list', async () => {
       makeRequestSpy.mockResolvedValue({ account: accountNodeFixture });
 
-      const result = await oxy.createAccount({ kind: 'organization', username: 'oxy-org' });
+      const result = await oxy.createAccount({
+        kind: 'organization',
+        username: 'oxy-org',
+        color: 'purple',
+      });
 
       expect(result).toEqual(accountNodeFixture);
+      // `color` rides the CREATE body, not a follow-up patch: an account that is
+      // discoverable without its colour and acquires one on a second request is
+      // a face that changes by itself.
       expect(makeRequestSpy).toHaveBeenCalledWith(
         'POST',
         '/accounts',
-        { kind: 'organization', username: 'oxy-org' },
+        { kind: 'organization', username: 'oxy-org', color: 'purple' },
         expect.objectContaining({ cache: false }),
       );
       expect(clearEntrySpy).toHaveBeenCalledWith('GET:/accounts');
@@ -273,13 +280,13 @@ describe('OxyServices.accounts', () => {
     it('patches, unwraps `account`, and busts the detail + lists', async () => {
       makeRequestSpy.mockResolvedValue({ account: accountNodeFixture });
 
-      const result = await oxy.updateAccount('acc1', { bio: 'hello' });
+      const result = await oxy.updateAccount('acc1', { bio: 'hello', color: 'mint' });
 
       expect(result).toEqual(accountNodeFixture);
       expect(makeRequestSpy).toHaveBeenCalledWith(
         'PATCH',
         '/accounts/acc1',
-        { bio: 'hello' },
+        { bio: 'hello', color: 'mint' },
         expect.objectContaining({ cache: false }),
       );
       expect(clearEntrySpy).toHaveBeenCalledWith('GET:/accounts/acc1');

package/src/utils/__tests__/validationUtils.test.ts

@@ -7,7 +7,6 @@ import {
   isValidArray,
   isValidObject,
   isValidEmail,
-  isValidUsername,
   isValidPassword,
   isValidDisplayName,
   DISPLAY_NAME_ALLOWED_SCRIPTS,
@@ -126,21 +125,14 @@ describe('Validation Utils', () => {
     });
   });
 
-  describe('isValidUsername', () => {
-    it('should return true for valid usernames', () => {
-      expect(isValidUsername('user123')).toBe(true);
-      expect(isValidUsername('test_user')).toBe(true);
-      expect(isValidUsername('john-doe')).toBe(true);
-    });
-
-    it('should return false for invalid usernames', () => {
-      expect(isValidUsername('')).toBe(false);
-      expect(isValidUsername('a')).toBe(false); // too short
-      expect(isValidUsername('ab')).toBe(false); // too short
-      expect(isValidUsername('user@domain')).toBe(false); // invalid characters
-      expect(isValidUsername('user with spaces')).toBe(false); // spaces
-    });
-  });
+  /**
+   * `isValidUsername` and `USERNAME_REGEX` were REMOVED from this module: they
+   * were a second username policy, looser than the one the server enforced, so
+   * the SDK could call a name valid and the API 400 it. The rule now lives once,
+   * in `@oxyhq/contracts`, and its own suite covers it. What survives here is the
+   * one thing this module still does with a username — sanitise-then-validate,
+   * asserted below to answer from that single policy.
+   */
 
   describe('isValidPassword', () => {
     it('should return true for valid passwords', () => {
@@ -676,6 +668,12 @@ describe('Validation Utils', () => {
       expect(validateAndSanitizeUserInput('  testuser  ', 'username')).toBe('testuser');
       expect(validateAndSanitizeUserInput('ab', 'username')).toBeNull(); // too short
       expect(validateAndSanitizeUserInput(123, 'username')).toBeNull();
+      // Answers from the one policy in `@oxyhq/contracts`, not from a rule of its
+      // own: a dot and an edge separator are rejected here because they are
+      // rejected there.
+      expect(validateAndSanitizeUserInput('my-bot', 'username')).toBe('my-bot');
+      expect(validateAndSanitizeUserInput('my.bot', 'username')).toBeNull();
+      expect(validateAndSanitizeUserInput('-mybot', 'username')).toBeNull();
     });
 
     it('should validate and sanitize string input', () => {

package/src/utils/validationUtils.ts

@@ -9,6 +9,7 @@ import {
   DISPLAY_NAME_LETTERS_RANGES,
   DISPLAY_NAME_NAME_SEPARATORS_RANGES,
 } from './displayNamePolicyRanges.generated';
+import { usernameSchema } from '@oxyhq/contracts';
 
 /**
  * Maximum stored length of a display name, in code units after cleaning.
@@ -25,11 +26,6 @@ export const DISPLAY_NAME_INVALID_MESSAGE =
  */
 export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
-/**
- * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
- */
-export const USERNAME_REGEX = /^[a-zA-Z0-9_-]{3,30}$/;
-
 /**
  * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
  */
@@ -43,13 +39,6 @@ export function isValidEmail(email: string): boolean {
   return EMAIL_REGEX.test(email);
 }
 
-/**
- * Validate username format
- */
-export function isValidUsername(username: string): boolean {
-  return USERNAME_REGEX.test(username);
-}
-
 /**
  * Validate password strength
  */
@@ -378,7 +367,10 @@ export function validateAndSanitizeUserInput(input: unknown, type: 'string' | 'e
     case 'email':
       return isValidEmail(sanitized) ? sanitized : null;
     case 'username':
-      return isValidUsername(sanitized) ? sanitized : null;
+      // The ONE policy, from `@oxyhq/contracts`. This module used to declare a
+      // second one (`^[a-zA-Z0-9_-]{3,30}$`) that the server did not enforce, so
+      // the SDK could call a name valid and the API 400 it.
+      return usernameSchema.safeParse(sanitized).success ? sanitized : null;
     case 'string':
       return isRequiredString(sanitized) ? sanitized : null;
     default: