@oxyhq/core 21.2.0 → 22.0.0

package/dist/esm/index.js

@@ -123,7 +123,7 @@ export { retryAsync } from './utils/asyncUtils.js';
 // ---------------------------------------------------------------------------
 // Validation
 // ---------------------------------------------------------------------------
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils.js';
+export { EMAIL_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils.js';
 // ---------------------------------------------------------------------------
 // Text normalization
 // ---------------------------------------------------------------------------

package/dist/esm/utils/validationUtils.js

@@ -2,6 +2,7 @@
  * Validation utilities for common data validation patterns
  */
 import { DISPLAY_NAME_ALLOWED_SCRIPTS_RANGES, DISPLAY_NAME_COMBINING_MARKS_RANGES, DISPLAY_NAME_SPACE_SEPARATORS_RANGES, DISPLAY_NAME_LETTERS_RANGES, DISPLAY_NAME_NAME_SEPARATORS_RANGES, } from './displayNamePolicyRanges.generated.js';
+import { usernameSchema } from '@oxyhq/contracts';
 /**
  * Maximum stored length of a display name, in code units after cleaning.
  * Shared by the API write path and client input surfaces.
@@ -13,10 +14,6 @@ export const DISPLAY_NAME_INVALID_MESSAGE = 'Name may only contain letters, spac
  * Email validation regex
  */
 export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-/**
- * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
- */
-export const USERNAME_REGEX = /^[a-zA-Z0-9_-]{3,30}$/;
 /**
  * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
  */
@@ -28,12 +25,6 @@ export const PASSWORD_REGEX = /^.{8,}$/;
 export function isValidEmail(email) {
     return EMAIL_REGEX.test(email);
 }
-/**
- * Validate username format
- */
-export function isValidUsername(username) {
-    return USERNAME_REGEX.test(username);
-}
 /**
  * Validate password strength
  */
@@ -336,7 +327,10 @@ export function validateAndSanitizeUserInput(input, type) {
         case 'email':
             return isValidEmail(sanitized) ? sanitized : null;
         case 'username':
-            return isValidUsername(sanitized) ? sanitized : null;
+            // The ONE policy, from `@oxyhq/contracts`. This module used to declare a
+            // second one (`^[a-zA-Z0-9_-]{3,30}$`) that the server did not enforce, so
+            // the SDK could call a name valid and the API 400 it.
+            return usernameSchema.safeParse(sanitized).success ? sanitized : null;
         case 'string':
             return isRequiredString(sanitized) ? sanitized : null;
         default: