@onlyworlds/sdk 4.27.0 → 4.27.2

package/CHANGELOG.md

@@ -5,6 +5,27 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.27.2] — 2026-10-16
+
+### Fixed
+- **`bulk` mints an id for each element that has none, as `create` does.** It sent id-less elements
+  bare and keel minted them. With an `idempotencyKey`, each id is now derived from the key and the
+  element's position in `items` (the ids the Python package mints), so the same key and items send the
+  same body from either client, and a resend after keel's 24-hour replay window rewrites the same
+  elements instead of creating new ones. Without a key, a fresh UUIDv7 each. Ids you pass are kept, and
+  your items are not changed. Found by Quillon's parity audit of the Unity SDK (h37 #5794).
+
+## [4.27.1] — 2026-10-16
+
+### Fixed
+- **A retried `create` with the same `idempotencyKey` now replays instead of failing.** `create` minted a
+  fresh id on every call, so a retry of an id-less element sent a different body and keel answered 409
+  `idempotency_error`. With a key and no id, the id is now derived from the key (a UUIDv5, the same id the
+  Python package mints), so the retry sends the same body and gets the first answer back. Without a key,
+  a fresh UUIDv7 as before; an id you pass is kept.
+- `create`'s doc said a keyed retry "rewrites the same element"; keel's replay writes nothing. Found by
+  Quillon's parity audit of the Unity SDK (h37 #5764).
+
 ## [4.27.0] — 2026-10-16
 
 ### Added

package/dist/index.d.ts

@@ -2556,9 +2556,12 @@ declare class OwV2Client {
     /** GET /{type}/{id}/ -- optional one-level stub expansion / sparse fields. */
     get(type: ElementType | string, id: string, opts?: Pick<ListParams, 'expand' | 'fields'>): Promise<OwElement>;
     /**
-     * POST /{type}/ -- create one element, minting a UUIDv7 id on the client when you leave id out.
-     * The client-side id makes a retry carrying the same Idempotency-Key safe: it rewrites
-     * the same element instead of creating a second one. You may still supply your own id.
+     * POST /{type}/ -- create one element, minting an id on the client when you leave id out.
+     * With an `idempotencyKey`, the minted id is derived from the key (a UUIDv5, the same one the
+     * Python package mints), so a retry with the same key and element sends the same body and keel
+     * replays its first answer: nothing is written twice, and the stored 201 comes back. Without a
+     * key, a fresh UUIDv7. You may still supply your own id. A new create meant to write again
+     * (an undo that re-creates) needs a new key, or none: within 24 h a reused key only replays.
      * `name` is the one required field, and required means the key is present: `''` and
      * `null` are accepted and stored as `''` (nameless Markers exist).
      */
@@ -2607,6 +2610,10 @@ declare class OwV2Client {
      * After an atomic:true request with errors:true NOTHING was written, yet the slots of
      * the items that would have succeeded still say 201 with the ids and timestamps they
      * would have had (keel's "counterfactual 201s"): do not record those ids as created.
+     * An element without an id gets one, as `create` mints it, by its position in `items`: with an
+     * `idempotencyKey`, derived from the key and the position (the ids the Python package mints),
+     * so a retry with the same key and items sends the same body; without one, a
+     * fresh UUIDv7. Ids you supply are kept.
      */
     bulk(items: OwBulkItem[], opts?: {
         atomic?: boolean;

package/dist/index.js

@@ -1,3 +1,61 @@
+// src/v2/keyed-id.ts
+var KEYED_IDS = "0199b6a0-6f0e-7c2a-9d1e-3b5c7a8e4f21";
+function sha1(msg) {
+  const ml = msg.length;
+  const total = (ml + 8 >> 6) + 1 << 6;
+  const buf = new Uint8Array(total);
+  buf.set(msg);
+  buf[ml] = 128;
+  const bits = ml * 8;
+  const view = new DataView(buf.buffer);
+  view.setUint32(total - 8, Math.floor(bits / 2 ** 32));
+  view.setUint32(total - 4, bits >>> 0);
+  let h0 = 1732584193, h1 = 4023233417, h2 = 2562383102, h3 = 271733878, h4 = 3285377520;
+  const w = new Uint32Array(80);
+  for (let off = 0; off < total; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+    for (let i = 16; i < 80; i++) {
+      const x = w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16];
+      w[i] = x << 1 | x >>> 31;
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4;
+    for (let i = 0; i < 80; i++) {
+      const [f, k] = i < 20 ? [b & c | ~b & d, 1518500249] : i < 40 ? [b ^ c ^ d, 1859775393] : i < 60 ? [b & c | b & d | c & d, 2400959708] : [b ^ c ^ d, 3395469782];
+      const t = (a << 5 | a >>> 27) + f + e + k + w[i] >>> 0;
+      e = d;
+      d = c;
+      c = b << 30 | b >>> 2;
+      b = a;
+      a = t;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+  }
+  const out = new Uint8Array(20);
+  const ov = new DataView(out.buffer);
+  [h0, h1, h2, h3, h4].forEach((h, i) => ov.setUint32(i * 4, h));
+  return out;
+}
+var hexBytes = (hex) => Uint8Array.from(hex.replace(/-/g, "").match(/../g).map((b) => parseInt(b, 16)));
+function uuid5(ns, name) {
+  const nameBytes = new TextEncoder().encode(name);
+  const input = new Uint8Array(16 + nameBytes.length);
+  input.set(hexBytes(ns));
+  input.set(nameBytes, 16);
+  const b = sha1(input).slice(0, 16);
+  b[6] = b[6] & 15 | 80;
+  b[8] = b[8] & 63 | 128;
+  const h = [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+function keyedId(idempotencyKey, index) {
+  return uuid5(KEYED_IDS, `${idempotencyKey}
+${index}`);
+}
+
 // src/v2/errors.ts
 var OwApiError = class extends Error {
   constructor(status, code, message, docUrl, detail, type = null, param = null, retryAfter = null) {
@@ -274,16 +332,19 @@ var OwV2Client = class {
     return this.request("GET", `/${type}/${id}/`, { query });
   }
   /**
-   * POST /{type}/ -- create one element, minting a UUIDv7 id on the client when you leave id out.
-   * The client-side id makes a retry carrying the same Idempotency-Key safe: it rewrites
-   * the same element instead of creating a second one. You may still supply your own id.
+   * POST /{type}/ -- create one element, minting an id on the client when you leave id out.
+   * With an `idempotencyKey`, the minted id is derived from the key (a UUIDv5, the same one the
+   * Python package mints), so a retry with the same key and element sends the same body and keel
+   * replays its first answer: nothing is written twice, and the stored 201 comes back. Without a
+   * key, a fresh UUIDv7. You may still supply your own id. A new create meant to write again
+   * (an undo that re-creates) needs a new key, or none: within 24 h a reused key only replays.
    * `name` is the one required field, and required means the key is present: `''` and
    * `null` are accepted and stored as `''` (nameless Markers exist).
    */
   async create(type, element, opts = {}) {
     const body = sanitizePayload(element);
     if (body.id === void 0 || body.id === null || body.id === "") {
-      body.id = mintUuid();
+      body.id = opts.idempotencyKey ? keyedId(opts.idempotencyKey, 0) : mintUuid();
     }
     return this.request("POST", `/${type}/`, {
       write: true,
@@ -338,10 +399,20 @@ var OwV2Client = class {
    * After an atomic:true request with errors:true NOTHING was written, yet the slots of
    * the items that would have succeeded still say 201 with the ids and timestamps they
    * would have had (keel's "counterfactual 201s"): do not record those ids as created.
+   * An element without an id gets one, as `create` mints it, by its position in `items`: with an
+   * `idempotencyKey`, derived from the key and the position (the ids the Python package mints),
+   * so a retry with the same key and items sends the same body; without one, a
+   * fresh UUIDv7. Ids you supply are kept.
    */
   async bulk(items, opts = {}) {
     const body = {
-      items: items.map((it) => ({ type: it.type, element: sanitizePayload(it.element) })),
+      items: items.map((it, index) => {
+        const element = sanitizePayload(it.element);
+        if (element.id === void 0 || element.id === null || element.id === "") {
+          element.id = opts.idempotencyKey ? keyedId(opts.idempotencyKey, index) : mintUuid();
+        }
+        return { type: it.type, element };
+      }),
       atomic: opts.atomic ?? false
     };
     return this.request("POST", "/bulk/", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.27.0",
+  "version": "4.27.2",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {