@onlyworlds/sdk 4.27.1 → 4.27.2

package/CHANGELOG.md

@@ -5,6 +5,16 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.27.2] — 2026-10-16
+
+### Fixed
+- **`bulk` mints an id for each element that has none, as `create` does.** It sent id-less elements
+  bare and keel minted them. With an `idempotencyKey`, each id is now derived from the key and the
+  element's position in `items` (the ids the Python package mints), so the same key and items send the
+  same body from either client, and a resend after keel's 24-hour replay window rewrites the same
+  elements instead of creating new ones. Without a key, a fresh UUIDv7 each. Ids you pass are kept, and
+  your items are not changed. Found by Quillon's parity audit of the Unity SDK (h37 #5794).
+
 ## [4.27.1] — 2026-10-16
 
 ### Fixed

package/dist/index.d.ts

@@ -2610,6 +2610,10 @@ declare class OwV2Client {
      * After an atomic:true request with errors:true NOTHING was written, yet the slots of
      * the items that would have succeeded still say 201 with the ids and timestamps they
      * would have had (keel's "counterfactual 201s"): do not record those ids as created.
+     * An element without an id gets one, as `create` mints it, by its position in `items`: with an
+     * `idempotencyKey`, derived from the key and the position (the ids the Python package mints),
+     * so a retry with the same key and items sends the same body; without one, a
+     * fresh UUIDv7. Ids you supply are kept.
      */
     bulk(items: OwBulkItem[], opts?: {
         atomic?: boolean;

package/dist/index.js

@@ -399,10 +399,20 @@ var OwV2Client = class {
    * After an atomic:true request with errors:true NOTHING was written, yet the slots of
    * the items that would have succeeded still say 201 with the ids and timestamps they
    * would have had (keel's "counterfactual 201s"): do not record those ids as created.
+   * An element without an id gets one, as `create` mints it, by its position in `items`: with an
+   * `idempotencyKey`, derived from the key and the position (the ids the Python package mints),
+   * so a retry with the same key and items sends the same body; without one, a
+   * fresh UUIDv7. Ids you supply are kept.
    */
   async bulk(items, opts = {}) {
     const body = {
-      items: items.map((it) => ({ type: it.type, element: sanitizePayload(it.element) })),
+      items: items.map((it, index) => {
+        const element = sanitizePayload(it.element);
+        if (element.id === void 0 || element.id === null || element.id === "") {
+          element.id = opts.idempotencyKey ? keyedId(opts.idempotencyKey, index) : mintUuid();
+        }
+        return { type: it.type, element };
+      }),
       atomic: opts.atomic ?? false
     };
     return this.request("POST", "/bulk/", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.27.1",
+  "version": "4.27.2",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {