@oxyhq/core 21.2.0 → 22.0.0

package/dist/types/index.d.ts

@@ -95,7 +95,7 @@ export type { PaginationParams, FollowGraphParams, FollowGraphSort, ApiResponse,
 export { ErrorCodes, createApiError, handleHttpError, isHttpRequestError, parseHttpErrorBody, validateRequiredFields, } from './utils/errorUtils';
 export type { HttpRequestError, ParsedHttpErrorBody } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
 export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger';
 export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink, LoggerConfig, } from './logger';

package/dist/types/utils/validationUtils.d.ts

@@ -12,10 +12,6 @@ export declare const DISPLAY_NAME_INVALID_MESSAGE = "Name may only contain lette
  * Email validation regex
  */
 export declare const EMAIL_REGEX: RegExp;
-/**
- * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
- */
-export declare const USERNAME_REGEX: RegExp;
 /**
  * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
  */
@@ -24,10 +20,6 @@ export declare const PASSWORD_REGEX: RegExp;
  * Validate email format
  */
 export declare function isValidEmail(email: string): boolean;
-/**
- * Validate username format
- */
-export declare function isValidUsername(username: string): boolean;
 /**
  * Validate password strength
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "21.2.0",
+  "version": "22.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -116,7 +116,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.32.0",
+    "@oxyhq/contracts": "^0.33.0",
     "@oxyhq/protocol": "^0.2.0",
     "@scure/bip39": "^1.6.0",
     "@types/elliptic": "^6.4.18",

package/src/index.ts

@@ -521,12 +521,10 @@ export { retryAsync } from './utils/asyncUtils';
 // ---------------------------------------------------------------------------
 export {
     EMAIL_REGEX,
-    USERNAME_REGEX,
     PASSWORD_REGEX,
     MAX_DISPLAY_NAME_LENGTH,
     DISPLAY_NAME_INVALID_MESSAGE,
     isValidEmail,
-    isValidUsername,
     isValidPassword,
     isValidDisplayName,
     DISPLAY_NAME_ALLOWED_SCRIPTS,

package/src/utils/__tests__/validationUtils.test.ts

@@ -7,7 +7,6 @@ import {
   isValidArray,
   isValidObject,
   isValidEmail,
-  isValidUsername,
   isValidPassword,
   isValidDisplayName,
   DISPLAY_NAME_ALLOWED_SCRIPTS,
@@ -126,21 +125,14 @@ describe('Validation Utils', () => {
     });
   });
 
-  describe('isValidUsername', () => {
-    it('should return true for valid usernames', () => {
-      expect(isValidUsername('user123')).toBe(true);
-      expect(isValidUsername('test_user')).toBe(true);
-      expect(isValidUsername('john-doe')).toBe(true);
-    });
-
-    it('should return false for invalid usernames', () => {
-      expect(isValidUsername('')).toBe(false);
-      expect(isValidUsername('a')).toBe(false); // too short
-      expect(isValidUsername('ab')).toBe(false); // too short
-      expect(isValidUsername('user@domain')).toBe(false); // invalid characters
-      expect(isValidUsername('user with spaces')).toBe(false); // spaces
-    });
-  });
+  /**
+   * `isValidUsername` and `USERNAME_REGEX` were REMOVED from this module: they
+   * were a second username policy, looser than the one the server enforced, so
+   * the SDK could call a name valid and the API 400 it. The rule now lives once,
+   * in `@oxyhq/contracts`, and its own suite covers it. What survives here is the
+   * one thing this module still does with a username — sanitise-then-validate,
+   * asserted below to answer from that single policy.
+   */
 
   describe('isValidPassword', () => {
     it('should return true for valid passwords', () => {
@@ -676,6 +668,12 @@ describe('Validation Utils', () => {
       expect(validateAndSanitizeUserInput('  testuser  ', 'username')).toBe('testuser');
       expect(validateAndSanitizeUserInput('ab', 'username')).toBeNull(); // too short
       expect(validateAndSanitizeUserInput(123, 'username')).toBeNull();
+      // Answers from the one policy in `@oxyhq/contracts`, not from a rule of its
+      // own: a dot and an edge separator are rejected here because they are
+      // rejected there.
+      expect(validateAndSanitizeUserInput('my-bot', 'username')).toBe('my-bot');
+      expect(validateAndSanitizeUserInput('my.bot', 'username')).toBeNull();
+      expect(validateAndSanitizeUserInput('-mybot', 'username')).toBeNull();
     });
 
     it('should validate and sanitize string input', () => {

package/src/utils/validationUtils.ts

@@ -9,6 +9,7 @@ import {
   DISPLAY_NAME_LETTERS_RANGES,
   DISPLAY_NAME_NAME_SEPARATORS_RANGES,
 } from './displayNamePolicyRanges.generated';
+import { usernameSchema } from '@oxyhq/contracts';
 
 /**
  * Maximum stored length of a display name, in code units after cleaning.
@@ -25,11 +26,6 @@ export const DISPLAY_NAME_INVALID_MESSAGE =
  */
 export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
-/**
- * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
- */
-export const USERNAME_REGEX = /^[a-zA-Z0-9_-]{3,30}$/;
-
 /**
  * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
  */
@@ -43,13 +39,6 @@ export function isValidEmail(email: string): boolean {
   return EMAIL_REGEX.test(email);
 }
 
-/**
- * Validate username format
- */
-export function isValidUsername(username: string): boolean {
-  return USERNAME_REGEX.test(username);
-}
-
 /**
  * Validate password strength
  */
@@ -378,7 +367,10 @@ export function validateAndSanitizeUserInput(input: unknown, type: 'string' | 'e
     case 'email':
       return isValidEmail(sanitized) ? sanitized : null;
     case 'username':
-      return isValidUsername(sanitized) ? sanitized : null;
+      // The ONE policy, from `@oxyhq/contracts`. This module used to declare a
+      // second one (`^[a-zA-Z0-9_-]{3,30}$`) that the server did not enforce, so
+      // the SDK could call a name valid and the API 400 it.
+      return usernameSchema.safeParse(sanitized).success ? sanitized : null;
     case 'string':
       return isRequiredString(sanitized) ? sanitized : null;
     default: