@onlyworlds/sdk 4.22.0 → 4.23.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.23.0] — 2026-10-14
+
+### Deprecated
+- **`TokenResource.consume()`, `getAccessKey()`, `revokeSession()`, `revokeAllSessions()`**: keel
+  serves none of these routes (each answers 404 `not_found` on production; `accounts/token_api.py`
+  mounts only `status/` and `encryption-info/`). Spending is server-side, in the route that does the
+  work (the Council's acts through keel's council proxy, keel #274, Skeld's ruling h37 #4632), and
+  `OwV2Client.allowance()` reads the token rating. They stay callable and leave in 5.0. A 404 from
+  any token route now says what keel serves instead of "an older server". Found by Assembly's wire
+  gate, which until now never drove this class (its routes are not in keel's document).
+
+### Changed
+- README and docs: "token rating" is the one word for the account's daily budget (the Captain,
+  h37 #4642, OW Infra #273). Names in the API (`allowance()`, `/account/allowance`) are unchanged.
+
 ## [4.22.0] — 2026-10-14
 
 ### Added

package/README.md

@@ -191,7 +191,7 @@ const { rows, not_proposed } = await account.sort({ worldId, notes: ['Mira moved
 // rows: make (a new element), add_to (text for a field), link (one element to another), ask (which one?)
 ```
 
-Asking and sorting spend tokens from the account's daily AI allowance, the same meter the Council uses. Each answer carries `tokens_remaining` and `token_rating`; `allowance()` reads the meter without spending anything (since 4.21.0):
+Asking and sorting spend tokens from the account's token rating, its daily budget, the same meter the Council uses. Each answer carries `tokens_remaining` and `token_rating`; `allowance()` reads the meter without spending anything (since 4.21.0):
 
 ```typescript
 const { token_rating, tokens_remaining, resets_at } = await account.allowance(); // resets_at: the next midnight UTC
@@ -254,7 +254,7 @@ The four colour families (agents, world, abstract, temporal) are checked for col
 
 ## Tokens
 
-The account's token allowance and ratings, which some OnlyWorlds tools use.
+The account's token rating, which some OnlyWorlds tools use. `getStatus()` and `getEncryptionInfo()` are what keel still serves under `/tokens/`; `consume()`, `getAccessKey()` and the two session revokes are deprecated (keel answers 404) and leave in 5.0. To read the token rating, prefer `account.allowance()` above.
 
 ```typescript
 import { TokenResource } from '@onlyworlds/sdk';

package/dist/index.d.ts

@@ -3438,6 +3438,12 @@ declare enum GameTier {
  * `OwV2Client` (its `request()` is public since 4.0): `new TokenResource(client)`.
  * Wire ruling (2026-07-23): keel keeps the /tokens/* economy long-term
  * (Tangle ratings write it, Council voting reads it) — port, don't delete.
+ * Since then keel mounts only `status/` and `encryption-info/` under /tokens/
+ * (`accounts/token_api.py`; consume, access-key and both revokes answer 404 on
+ * production, 2026-10-14), and spending moved server-side: the Council spends
+ * through keel's council proxy (keel #274, Skeld's ruling h37 #4632), and
+ * `OwV2Client.allowance()` reads the token rating. The four dead methods are
+ * deprecated in 4.23.0 and leave in 5.0.
  */
 interface TokenTransport {
     request<T>(method: string, path: string, opts?: {
@@ -3474,9 +3480,9 @@ declare class TokenResource {
     private client;
     constructor(client: TokenTransport);
     /**
-     * All token routes go through here: a 404 on /tokens/* almost always means
-     * the SERVER predates the v2 token mount (keel >= 2026-07-23, e181689) —
-     * not "user has no tokens". Annotate so the failure reads correctly.
+     * All token routes go through here: a 404 on /tokens/* means keel does not
+     * serve that route, not "user has no tokens". Annotate so the failure reads
+     * correctly.
      */
     private req;
     /**
@@ -3498,6 +3504,10 @@ declare class TokenResource {
     /**
      * Consume tokens for service usage
      *
+     * @deprecated keel serves no consume route (404 on production since 2026-10;
+     * no client decides what its act costs, Skeld's ruling, keel #274): spending
+     * happens server-side in the route that does the work. Removed in 5.0.
+     *
      * Reports token consumption to track daily usage. Allows consumption even if
      * exceeds available tokens (tracks as debt), but warns via error field.
      * Matches base-tool's reportUsage() pattern.
@@ -3527,6 +3537,10 @@ declare class TokenResource {
     /**
      * Get encrypted OpenAI API key (advanced use case)
      *
+     * @deprecated keel serves no access-key route (404 on production since
+     * 2026-10). AI answers come from keel's own proxy: `OwV2Client.ask()` and
+     * `sort()`. Removed in 5.0.
+     *
      * Requires minimum 100 tokens available. Creates a 1-hour session for tracking.
      * Returns encrypted key that must be decrypted client-side using Fernet.
      *
@@ -3554,6 +3568,9 @@ declare class TokenResource {
     /**
      * Revoke a specific token session
      *
+     * @deprecated keel serves no revoke-session route (404 on production since
+     * 2026-10); sessions came from getAccessKey(), which is gone too. Removed in 5.0.
+     *
      * Invalidates the session ID obtained from getAccessKey().
      * Use when cleaning up or on logout.
      *
@@ -3568,6 +3585,9 @@ declare class TokenResource {
     /**
      * Revoke all active sessions (emergency use)
      *
+     * @deprecated keel serves no revoke-all-sessions route (404 on production
+     * since 2026-10). Removed in 5.0.
+     *
      * Invalidates all token sessions for the authenticated user.
      * Use for security cleanup or when sessions are stuck.
      *

package/dist/index.js

@@ -2627,16 +2627,16 @@ var TokenResource = class {
     this.client = client;
   }
   /**
-   * All token routes go through here: a 404 on /tokens/* almost always means
-   * the SERVER predates the v2 token mount (keel >= 2026-07-23, e181689) —
-   * not "user has no tokens". Annotate so the failure reads correctly.
+   * All token routes go through here: a 404 on /tokens/* means keel does not
+   * serve that route, not "user has no tokens". Annotate so the failure reads
+   * correctly.
    */
   async req(method, path, opts) {
     try {
       return await this.client.request(method, path, opts);
     } catch (err) {
       if (err && typeof err === "object" && err.status === 404) {
-        err.message += " [token routes require keel >= 2026-07-23 (e181689) on /api/v2 \u2014 a 404 here usually means an older server, not zero tokens]";
+        err.message += " [keel serves only /tokens/status/ and /tokens/encryption-info/; this method is deprecated (4.23.0). The token rating: OwV2Client.allowance()]";
       }
       throw err;
     }
@@ -2662,6 +2662,10 @@ var TokenResource = class {
   /**
    * Consume tokens for service usage
    *
+   * @deprecated keel serves no consume route (404 on production since 2026-10;
+   * no client decides what its act costs, Skeld's ruling, keel #274): spending
+   * happens server-side in the route that does the work. Removed in 5.0.
+   *
    * Reports token consumption to track daily usage. Allows consumption even if
    * exceeds available tokens (tracks as debt), but warns via error field.
    * Matches base-tool's reportUsage() pattern.
@@ -2700,6 +2704,10 @@ var TokenResource = class {
   /**
    * Get encrypted OpenAI API key (advanced use case)
    *
+   * @deprecated keel serves no access-key route (404 on production since
+   * 2026-10). AI answers come from keel's own proxy: `OwV2Client.ask()` and
+   * `sort()`. Removed in 5.0.
+   *
    * Requires minimum 100 tokens available. Creates a 1-hour session for tracking.
    * Returns encrypted key that must be decrypted client-side using Fernet.
    *
@@ -2729,6 +2737,9 @@ var TokenResource = class {
   /**
    * Revoke a specific token session
    *
+   * @deprecated keel serves no revoke-session route (404 on production since
+   * 2026-10); sessions came from getAccessKey(), which is gone too. Removed in 5.0.
+   *
    * Invalidates the session ID obtained from getAccessKey().
    * Use when cleaning up or on logout.
    *
@@ -2748,6 +2759,9 @@ var TokenResource = class {
   /**
    * Revoke all active sessions (emergency use)
    *
+   * @deprecated keel serves no revoke-all-sessions route (404 on production
+   * since 2026-10). Removed in 5.0.
+   *
    * Invalidates all token sessions for the authenticated user.
    * Use for security cleanup or when sessions are stuck.
    *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.22.0",
+  "version": "4.23.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {