@onlyworlds/sdk 4.1.0 → 4.3.0

package/AGENTS.md

@@ -1,34 +1,54 @@
-# For AI agents using @onlyworlds/sdk
-
-**Start with [SCHEMA.md](SCHEMA.md)** (in this package): the full generated schema reference —
-every type, every field with its meaning, link directions, families, icons, display sections.
-It is generated from the same canonical YAML as the types, so it cannot drift.
-
-**What this package is**: the canonical typed TypeScript client for the OnlyWorlds v2 API,
-plus the canonical constants (element types, icons, colour families, field schema).
-OnlyWorlds is an open standard for portable world data — 22 element types, UUID-linked.
-
-**Use the v2 surface.** `OwV2Client` + the `V2ElementType` slug union + the generated
-interfaces in `types.generated.ts` (emitted from the canonical schema YAML, validated
-against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum) is frozen
-legacy — do not build new work on it.
-
-**SDK vs MCP server — pick correctly**:
-- Known, deterministic operations (CRUD, sync, bulk) → **this SDK**. Typed calls, typed
-  responses, far cheaper than tool-schema reasoning.
-- Live exploration of a user's world from a chat/agent context → the **MCP server** at
-  `https://www.onlyworlds.com/mcp` (same `API-Key`/`API-Pin` headers, 11 tools).
-
-**Wire facts that bite** (full details in README):
-- Never send a `"world"` field in payloads — world identity comes from the API key (422 otherwise).
-- v2 link fields use ONE name both directions (no `_ids` suffix — that is v1 dialect only).
-- PATCH is destructive on sent fields; use `editLinks` (atomic add/remove) for relationships.
-- World-meta changes do NOT appear in `/changes` — poll `GET /world` separately.
-- Extension fields: `x_<toolname>_*` is the sanctioned namespace for tool-specific state;
-  unknown unprefixed fields 422.
-- Colour carries the element's FAMILY (`elementColor(type, mode)`); the icon
-  (`ELEMENT_ICONS`) carries the TYPE. Icon + label are required alongside colour, not optional.
-
-**Auth**: prefixed keys — `ow_w_` (read+write), `ow_r_` (read-only, no PIN — the share
-primitive), `ow_a_` (account Bearer). Demo keys `0000000000`–`0000000009` are read-only
-test credentials against real data.
+# For AI agents using @onlyworlds/sdk
+
+**Current as of**: SDK **4.x** · schema-dist **v0.30.1-dist.15** (canonical 00.30.01).
+This line is asserted by `codegen:check` in CI — if the pin moves and this file is not
+re-read against it, the check fails rather than letting this document rot quietly.
+
+**Start with [SCHEMA.md](SCHEMA.md)** (in this package): the full generated schema reference —
+every type, every field with its meaning, link directions, families, icons, display sections.
+It is generated from the same canonical YAML as the types, so it cannot drift.
+
+**What this package is**: the canonical typed TypeScript client for the OnlyWorlds v2 API,
+plus the canonical constants (element types, icons, colour families, field schema).
+OnlyWorlds is an open standard for portable world data — 22 element types, UUID-linked.
+
+**Use the v2 surface.** `OwV2Client` + the `V2ElementType` slug union + the generated
+interfaces in `types.generated.ts` (emitted from the canonical schema YAML, validated
+against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum) is not in
+4.x — it was removed at 4.0.0 and lives only in 3.x. Do not build new work on it.
+
+**SDK vs MCP server — pick correctly**:
+- Known, deterministic operations (CRUD, sync, bulk) → **this SDK**. Typed calls, typed
+  responses, far cheaper than tool-schema reasoning.
+- Live exploration of a user's world from a chat/agent context → the **MCP server** at
+  `https://www.onlyworlds.com/mcp` (same `API-Key`/`API-Pin` headers, 11 tools).
+
+**Wire facts that bite** (full details in README):
+- Never send a `"world"` field in payloads — world identity comes from the API key (422 otherwise).
+- v2 link fields use ONE name both directions (no `_ids` suffix — that is v1 dialect only).
+- PATCH is destructive on sent fields; use `editLinks` (atomic add/remove) for relationships.
+- World-meta changes do NOT appear in `/changes` — poll `GET /world` separately.
+- Extension fields: `x_<toolname>_*` is the sanctioned namespace for tool-specific state;
+  unknown unprefixed fields 422. Extensions are capped at **64 KB per element** (422,
+  `param: extensions`).
+- List filters: only `name__icontains`, `supertype` and `subtype` are built. Any other
+  filter key — and `?ordering=` — returns 422 naming it. Filter or sort client-side.
+- Ids: the client mints **UUIDv7** on an id-less `create` (since 4.2.0; keel mints v7 too).
+  A v4 or v7 id you supply is accepted. **Never sort elements by id**: worlds mix v7, v4
+  and legacy `06x…` ids (nibble 7 too, but seconds-first). For creation order use
+  `created_at`; `change_seq` is last-write order, not creation.
+  A create with an id that already exists, or a PUT whose id belongs to **another world**,
+  returns 409 `id_conflict` (`err.isIdConflict`; retrying won't help). `/bulk` never throws:
+  check each slot for `status: 409` with `error.code: 'id_conflict'`. A different 409, `idempotency_error`, means an
+  Idempotency-Key was reused with another body (`err.isIdempotencyConflict`).
+- Under load keel answers 503 `server_busy` with `Retry-After` (`err.isBusy`, `err.retryAfter`
+  in seconds). The client does not retry for you; back off and retry yourself. Works the same
+  in browsers.
+- A string holding an unpaired surrogate (text cut mid-emoji) is a 422 naming the field.
+  Slice strings by code point, not by UTF-16 unit.
+- Colour carries the element's FAMILY (`elementColor(type, mode)`); the icon
+  (`ELEMENT_ICONS`) carries the TYPE. Icon + label are required alongside colour, not optional.
+
+**Auth**: prefixed keys — `ow_w_` (read+write), `ow_r_` (read-only, no PIN — the share
+primitive), `ow_a_` (account Bearer). Demo keys `0000000000`–`0000000009` are read-only
+test credentials against real data.

package/CHANGELOG.md

@@ -3,6 +3,90 @@
 All notable changes to `@onlyworlds/sdk`. Maintained from 3.1.0 onward (Kael, Assembly);
 earlier history lives in git log only.
 
+## [Unreleased]
+
+## [4.3.0] — 2026-09-28
+
+Errors you can act on: the two 409s told apart, and the busy server's `Retry-After`, in Node and
+browsers. One getter narrows (see Fixed); nothing is removed.
+
+### Fixed
+- **`OwApiError.isIdempotencyConflict` no longer claims every 409.** keel sends two: 409
+  `idempotency_error` (a key reused with a different body) and 409 `id_conflict` (the id is
+  taken: a create with an existing id since D39, or a PUT / bulk id held by another world since
+  D70). The getter was true for both, so an id conflict read as a key problem, and retrying with
+  a fresh key could never help. It now matches `idempotency_error` only, and the new
+  **`isIdConflict`** names the other. A caller who relied on the old catch-all for `id_conflict`
+  should switch to `isIdConflict`. A 409 with no code (a proxy, a non-JSON body) now reads
+  false for both. `/bulk` is unaffected: it answers 200 and reports a per-item 409 in the slot.
+
+### Added
+- **`OwApiError.retryAfter`** (seconds, or null) is parsed from `Retry-After`, as a delay or an
+  HTTP date, and **`isBusy`** marks keel's 503 `server_busy` (admission control, keel D71: six
+  requests at once per worker, up to 10 s of queueing, then 503 with `Retry-After: 5`). The client
+  still never retries on its own; it gives callers what they need to back off. A malformed
+  `Retry-After` is null, never "retry now". **Works in browsers too** since keel `4949406`
+  (2026-09-28): every response exposes `Retry-After`, `Idempotent-Replay` and
+  `X-OW-Schema-Version` over CORS (probed from an allowed origin), and keel reports that the
+  admission gate's 503 now carries CORS headers, so a busy server reads as busy, not as
+  `OwNetworkError` (keel's word; the 503 can't be triggered on demand to probe). Six tests; the
+  four core ones watched failing on the previous `errors.ts`.
+
+## [4.2.0] — 2026-09-28
+
+Ids, honest filter docs, and the schema repin. Nothing is removed; no call needs to change.
+
+### Changed
+- **`create()` now mints an RFC 9562 UUIDv7** when the element has no id (was v4). The first
+  48 bits are the creation millisecond, so ids this client mints a millisecond or more apart
+  sort by creation (while the clock does not step backwards), which gives databases better
+  index locality. **This holds within one client only**: worlds also hold v4 ids and legacy
+  v1-server ids (`06x…`, which also carry version nibble 7 but put seconds first), so never
+  order elements by id. For creation order use `created_at`; `change_seq` is last-write
+  order. This is a **default, not a
+  requirement**: a v4 or v7 id a caller supplies is still accepted as-is, and
+  every id already stored stays valid. Keel mints v7 server-side too (Captain's ruling,
+  2026-09-28). Pinned by six tests: version and variant, the big-endian timestamp above
+  bit 32, fractional and pre-1970 clocks floored consistently, creation order across 50
+  consecutive milliseconds, 1,000 distinct ids inside one millisecond, and the no-`crypto`
+  fallback (asserting `Math.random` is actually used). Five injected defects (v4 nibble,
+  32-bit truncation, a dropped random fill, a dropped variant mask, an unfloored clock)
+  each fail the suite on every run, on Node 20 and 22. An independent reviewer's decoder agreed on 20,000 random timestamps and the 48-bit
+  edges, and keel's `uuid7()` agrees on timestamp, version and variant for a pinned clock.
+- **`elementColor()` on an unknown type now throws a `TypeError` that names the type.** It
+  used to crash with `Cannot read properties of undefined (reading 'dark')`. Found while
+  building the Forge's colour gate: atlas's own copy falls back to the `world` family for an
+  unknown type, so swapping it for this export is not a pure re-export for that input, and the
+  docstring now says so. Whether the package should fall back is left to its consumers.
+- The generated field-schema comment no longer calls `maximum:` an open question or counts
+  its occurrences (the count was 41; since 00.30.01 it is 15). The question was ruled on
+  2026-07-29.
+- **`ListParams.filter` JSDoc names what the server actually accepts**: `name__icontains`,
+  `supertype`, `subtype`. It used to list `__in`, `__gte`, `__lte` and `__isnull`, copied
+  from keel's spec, which described them but never built them. Probed live 2026-09-28: the
+  three accepted keys answer 200; every other one, and `?ordering=`, answers 422.
+- **Schema repinned `v0.30.1-dist.13` → `v0.30.1-dist.15`** (canonical unchanged, 00.30.01).
+  Two generated values move: `ELEMENT_ICONS.institution` `business` → `account_balance`,
+  `ELEMENT_ICONS.marker` `place` → `location_on` (both Material Symbols names). dist.15
+  also adds `minimum: 0` to `ability.potency`; the walk does not surface bounds, so nothing
+  generated changes for it. 31/31 file hashes recomputed from a fresh download.
+- **`AGENTS.md` re-read against the new pin** (its gate fired on the repin, as designed).
+  It still called the v1 client "frozen legacy" in this package; v1 was removed at 4.0.0.
+  It now also names the wire behaviours keel deployed on 2026-09-28 (keel D70): the 64 KB
+  extension cap, the three built filters and the `?ordering=` 422, 409 `id_conflict` for a
+  PUT or bulk id that belongs to another world, and the 422 for unpaired surrogates. None of
+  them needs client code.
+
+### Also in this release (staged earlier)
+- **`SCHEMA.md` now opens with its own provenance** (dist tag, canonical version, publish
+  date — rendered from `schema-pin.json`, never the wall clock). It ships in the tarball
+  and is read cold by agents outside this repo, where the pin file is not present; a
+  generated reference that cannot name its source was the one remaining self-dating gap.
+- **`AGENTS.md` carries a "Current as of" line, asserted by `codegen:check`** — the tag it
+  names must match the pin or CI fails. A hand-maintained agent doc with an ungated date
+  is how this repo's previous agent doc went a major version stale. Gate watched firing
+  (tampered tag → exit 1, restored → 0).
+
 ## [4.1.0] — 2026-07-29
 
 Public-surface hygiene. Nothing breaks; one member is now marked for removal, and one

package/SCHEMA.md

@@ -1,5 +1,7 @@
 # OnlyWorlds Schema Reference
 
+**Source**: https://github.com/OnlyWorlds/schema-dist @ **v0.30.1-dist.15** — canonical schema **00.30.01**, published 2026-09-18.
+
 GENERATED from the canonical schema YAML — do not hand-edit (regenerate: `python codegen/generate_types.py`).
 Written for both humans and AI agents reading this package locally.
 
@@ -244,7 +246,7 @@ Families (colour semantics; icon carries the type): agents · world · abstract
 - `creatures` (multi link → creature) — Creatures owned, bonded to, or representing the family
 
 
-## institution  ·  family: agents  ·  icon: business
+## institution  ·  family: agents  ·  icon: account_balance
 
 
 ### Foundation
@@ -376,7 +378,7 @@ Families (colour semantics; icon carries the type): agents · world · abstract
 - `location` (single link → location) — Location element that this map represents
 
 
-## marker  ·  family: world  ·  icon: place
+## marker  ·  family: world  ·  icon: location_on
 
 
 ### Details

package/dist/index.d.ts

@@ -1958,9 +1958,10 @@ interface ListParams {
     /** Sparse include-set of field names. */
     fields?: string[];
     /**
-     * Blessed Django-style filters: __icontains, __in, __gte, __lte, __isnull,
-     * supertype/subtype equality. Unknown params 422 loudly server-side -- the
-     * client passes them through and lets the platform name the typo.
+     * Accepted: `name__icontains`, `supertype`, `subtype`. Any other key 422s
+     * server-side, which names the typo -- the client passes keys through
+     * unchecked and lets the platform say so. (`__in`, `__gte`, `__lte` and
+     * `__isnull` are designed in keel's spec but not built; `ordering` 422s too.)
      */
     filter?: Record<string, string | number | boolean>;
 }
@@ -2013,12 +2014,34 @@ declare class OwApiError extends Error {
     readonly docUrl: string | null;
     /** Raw parsed envelope (or body text when the body wasn't JSON). */
     readonly detail: unknown;
-    constructor(status: number, code: string | null, message: string, docUrl: string | null, detail: unknown, type?: string | null, param?: string | null);
+    /**
+     * Seconds to wait before retrying, from the `Retry-After` header (a delay in
+     * seconds or an HTTP date), else null. keel sends it on 503 `server_busy`
+     * (admission control, D71) and 429 `rate_limited`. This client never retries
+     * on its own; the value is here so callers can back off politely.
+     * Readable in browsers too: keel exposes `Retry-After` over CORS and its
+     * admission gate's 503 carries CORS headers (keel `4949406`, 2026-09-28).
+     */
+    readonly retryAfter: number | null;
+    constructor(status: number, code: string | null, message: string, docUrl: string | null, detail: unknown, type?: string | null, param?: string | null, retryAfter?: number | null);
     get isAuthError(): boolean;
     /** 422s/400s name the offending param/field -- typos error loudly platform-wide. */
     get isValidationError(): boolean;
-    /** Same Idempotency-Key replayed with a different payload. */
+    /**
+     * Same Idempotency-Key replayed with a different payload (409 `idempotency_error`).
+     * Through 4.2.0 this was true for ANY 409, which misread an id conflict as a key
+     * conflict: keel also answers 409 `id_conflict` (see isIdConflict).
+     */
     get isIdempotencyConflict(): boolean;
+    /**
+     * The id is already taken (409 `id_conflict`): a create with an id that exists
+     * (keel D39), or a PUT whose id belongs to another world (D70). Retrying will not
+     * help; the id is the problem. `/bulk` never throws for this: it answers 200 with a
+     * per-item slot `{status: 409, error: {code: 'id_conflict'}}` — check the slot.
+     */
+    get isIdConflict(): boolean;
+    /** keel's admission control turned the request away (503 `server_busy`); see retryAfter. */
+    get isBusy(): boolean;
 }
 /** Network-level failure (fetch rejected) -- no envelope to parse. */
 declare class OwNetworkError extends Error {
@@ -2028,7 +2051,7 @@ declare class OwNetworkError extends Error {
 /** Parse a wire envelope into OwApiError parts (exported for the error type-tests). */
 /** Parse the platform ERROR envelope into an OwApiError. (Renamed from parseEnvelope in 4.0 —
  *  distinct from the world-export envelope, which is a different artifact entirely.) */
-declare function parseErrorEnvelope(status: number, body: unknown): OwApiError;
+declare function parseErrorEnvelope(status: number, body: unknown, retryAfter?: number | null): OwApiError;
 /** Build an OwApiError from a non-2xx response, tolerating non-JSON bodies. */
 declare function errorFromResponse(res: Response): Promise<OwApiError>;
 
@@ -2099,7 +2122,7 @@ declare class OwV2Client {
     /** GET /{type}/{id}/ -- optional one-level stub expansion / sparse fields. */
     get(type: ElementType | string, id: string, opts?: Pick<ListParams, 'expand' | 'fields'>): Promise<OwElement>;
     /**
-     * POST /{type}/ -- create. Mints an RFC-4122 UUID for element.id when the
+     * POST /{type}/ -- create. Mints an RFC 9562 UUIDv7 for element.id when the
      * caller omits one (design ruling D29d) so a retry carrying the same
      * Idempotency-Key is structurally safe. Callers MAY still supply their own id.
      */
@@ -2223,6 +2246,13 @@ declare function familyOf(type: ElementType): ElementFamily;
  * Name matches the live atlas/council implementations so their SDK swap is a
  * re-export, not a rename. Defaults to `dark` (both current consumers are
  * dark-surface).
+ *
+ * An unknown type throws a TypeError naming it (since 4.2.0; before, it crashed
+ * with "Cannot read properties of undefined"). This is the one place a swap from
+ * atlas's own copy is NOT a pure re-export: atlas falls back to the `world`
+ * family for an unknown type. A caller that wants a fallback catches, or checks
+ * `type in ELEMENT_FAMILIES` first; which fallback, if any, is a design call
+ * this package does not make for its consumers.
  */
 declare function elementColor(type: ElementType, mode?: 'light' | 'dark'): string;
 /** All four families, in ruling order (the order IS the CVD-safety mechanism of the source palette). */

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/v2/errors.ts
 var OwApiError = class extends Error {
-  constructor(status, code, message, docUrl, detail, type = null, param = null) {
+  constructor(status, code, message, docUrl, detail, type = null, param = null, retryAfter = null) {
     super(message);
     this.name = "OwApiError";
     this.status = status;
@@ -9,6 +9,7 @@ var OwApiError = class extends Error {
     this.param = param;
     this.docUrl = docUrl;
     this.detail = detail;
+    this.retryAfter = retryAfter;
   }
   get isAuthError() {
     return this.code === "invalid_credentials" || this.code === "key_revoked" || this.code === "world_gone";
@@ -17,9 +18,26 @@ var OwApiError = class extends Error {
   get isValidationError() {
     return this.status === 422 || this.status === 400;
   }
-  /** Same Idempotency-Key replayed with a different payload. */
+  /**
+   * Same Idempotency-Key replayed with a different payload (409 `idempotency_error`).
+   * Through 4.2.0 this was true for ANY 409, which misread an id conflict as a key
+   * conflict: keel also answers 409 `id_conflict` (see isIdConflict).
+   */
   get isIdempotencyConflict() {
-    return this.status === 409;
+    return this.status === 409 && this.code === "idempotency_error";
+  }
+  /**
+   * The id is already taken (409 `id_conflict`): a create with an id that exists
+   * (keel D39), or a PUT whose id belongs to another world (D70). Retrying will not
+   * help; the id is the problem. `/bulk` never throws for this: it answers 200 with a
+   * per-item slot `{status: 409, error: {code: 'id_conflict'}}` — check the slot.
+   */
+  get isIdConflict() {
+    return this.status === 409 && this.code === "id_conflict";
+  }
+  /** keel's admission control turned the request away (503 `server_busy`); see retryAfter. */
+  get isBusy() {
+    return this.status === 503 && this.code === "server_busy";
   }
 };
 var OwNetworkError = class extends Error {
@@ -29,7 +47,7 @@ var OwNetworkError = class extends Error {
     this.cause2 = cause;
   }
 };
-function parseErrorEnvelope(status, body) {
+function parseErrorEnvelope(status, body, retryAfter = null) {
   const env = body && typeof body === "object" ? body : {};
   const nested = typeof env.error === "object" && env.error !== null ? env.error : void 0;
   const code = env.code ?? nested?.code ?? (typeof env.error === "string" ? env.error : null) ?? null;
@@ -37,7 +55,16 @@ function parseErrorEnvelope(status, body) {
   const param = env.param ?? nested?.param ?? null;
   const docUrl = env.doc_url ?? nested?.doc_url ?? null;
   const message = env.message ?? nested?.message ?? (typeof env.detail === "string" ? env.detail : void 0) ?? `OnlyWorlds API error ${status}${code ? ` (${code})` : ""}`;
-  return new OwApiError(status, code, message, docUrl, body, type, param);
+  return new OwApiError(status, code, message, docUrl, body, type, param, retryAfter);
+}
+function parseRetryAfter(value, now = Date.now()) {
+  if (value == null) return null;
+  const v = value.trim();
+  if (/^\d+$/.test(v)) return Number(v);
+  if (!/[A-Za-z]/.test(v)) return null;
+  const when = Date.parse(v);
+  if (Number.isNaN(when)) return null;
+  return Math.max(0, Math.ceil((when - now) / 1e3));
 }
 async function errorFromResponse(res) {
   let body = null;
@@ -48,7 +75,7 @@ async function errorFromResponse(res) {
   } catch {
     body = text || null;
   }
-  return parseErrorEnvelope(res.status, body);
+  return parseErrorEnvelope(res.status, body, parseRetryAfter(res.headers?.get?.("Retry-After") ?? null));
 }
 
 // src/v2/keys.ts
@@ -143,7 +170,7 @@ var OwV2Client = class {
     return this.request("GET", `/${type}/${id}/`, { query });
   }
   /**
-   * POST /{type}/ -- create. Mints an RFC-4122 UUID for element.id when the
+   * POST /{type}/ -- create. Mints an RFC 9562 UUIDv7 for element.id when the
    * caller omits one (design ruling D29d) so a retry carrying the same
    * Idempotency-Key is structurally safe. Callers MAY still supply their own id.
    */
@@ -289,16 +316,22 @@ function readReplayHeader(headers) {
   const v = headers.get("Idempotent-Replay");
   return v != null && v.toLowerCase() === "true";
 }
-function mintUuid() {
+function mintUuid(now = Date.now()) {
   const c = globalThis.crypto;
-  if (c && typeof c.randomUUID === "function") return c.randomUUID();
   const bytes = new Uint8Array(16);
   if (c && typeof c.getRandomValues === "function") {
     c.getRandomValues(bytes);
   } else {
     for (let i = 0; i < 16; i++) bytes[i] = Math.floor(Math.random() * 256);
   }
-  bytes[6] = bytes[6] & 15 | 64;
+  const ms = Math.floor(now);
+  bytes[0] = Math.floor(ms / 2 ** 40) & 255;
+  bytes[1] = Math.floor(ms / 2 ** 32) & 255;
+  bytes[2] = ms >>> 24 & 255;
+  bytes[3] = ms >>> 16 & 255;
+  bytes[4] = ms >>> 8 & 255;
+  bytes[5] = ms & 255;
+  bytes[6] = bytes[6] & 15 | 112;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = [];
   for (let i = 0; i < 256; i++) hex.push((i + 256).toString(16).slice(1));
@@ -347,12 +380,12 @@ var ELEMENT_ICONS = {
   creature: "bug_report",
   event: "saved_search",
   family: "supervisor_account",
-  institution: "business",
+  institution: "account_balance",
   language: "edit_road",
   law: "gpp_bad",
   location: "castle",
   map: "map",
-  marker: "place",
+  marker: "location_on",
   narrative: "menu_book",
   object: "webhook",
   phenomenon: "thunderstorm",
@@ -1072,7 +1105,9 @@ function familyOf(type) {
   return ELEMENT_FAMILIES[type];
 }
 function elementColor(type, mode = "dark") {
-  return FAMILY_COLORS[ELEMENT_FAMILIES[type]][mode];
+  const family = ELEMENT_FAMILIES[type];
+  if (family === void 0) throw new TypeError(`elementColor: unknown element type "${String(type)}"`);
+  return FAMILY_COLORS[family][mode];
 }
 var FAMILY_ORDER = ["agents", "world", "abstract", "temporal"];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {
@@ -28,7 +28,8 @@
     "codegen:check": "python codegen/generate_types.py --check",
     "schema:verify": "python codegen/verify_dist.py",
     "schema:check": "npm run schema:verify && npm run codegen:check",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "release:verify": "node codegen/verify_release.mjs"
   },
   "keywords": [
     "onlyworlds",