@onlyworlds/sdk 4.3.0 → 4.4.0

package/AGENTS.md

@@ -44,6 +44,11 @@ against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum)
 - Under load keel answers 503 `server_busy` with `Retry-After` (`err.isBusy`, `err.retryAfter`
   in seconds). The client does not retry for you; back off and retry yourself. Works the same
   in browsers.
+- `created_by` rides every element read: the id of the membership that created it, `null` for
+  the world's owner and for anything made before memberships existed. It is read-only; a write
+  body that carries it has it dropped, never an error. A **contributor** can change only what
+  they created: anything else is 403 `not_author` (`err.isNotAuthor`; retrying will not help).
+  `/bulk` reports it per slot, not as a throw.
 - A string holding an unpaired surrogate (text cut mid-emoji) is a 422 naming the field.
   Slice strings by code point, not by UTF-16 unit.
 - Colour carries the element's FAMILY (`elementColor(type, mode)`); the icon

package/CHANGELOG.md

@@ -5,6 +5,36 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.4.0] — 2026-10-04 (staged, not published)
+
+Membership, as far as the server has shipped it: who created an element, and the refusal a
+contributor meets on someone else's. Additive; nothing is removed or narrows.
+
+### Added
+- **`created_by`** on `OwElementBase` (so on every element type): `string | null`, the id of the
+  membership that created the element, `null` for the world's owner and for anything made
+  before memberships existed (keel D72 phase 2, live 2026-09-28; keel spec §4). Read-only. The
+  schema does not carry it (like `created_at` it is server bookkeeping), so the generator adds
+  it to the wire base under the declared mapping. A write body that carries it has it dropped
+  by the server, so the client does not strip it and a read body still round-trips.
+- **`OwApiError.isNotAuthor`**: 403 `not_author`, a contributor changing, replacing, relinking
+  or deleting an element someone else created. `/bulk` answers 200 and reports it in the item
+  slot, so check the slot (documented on `OwBulkItemResult`).
+
+### Fixed
+- **`FIELD_SCHEMA` no longer marks `marker.map/zone/x/y/order` and `pin.map/element_type/element_id/x/y`
+  as `required: true`.** The wire requires `name` and nothing else (rulings.yaml `nullable-by-default`,
+  Captain 2026-07-28; keel's OpenAPI write schemas say `required: [name]`), but the schema files still
+  list those fields and the generator copied the lists, so a form built from the table demanded
+  coordinates the server never did. Found by comparing the SDK with keel's OpenAPI document (the
+  new `verify-sdk-wire` gate in Assembly). **If you read `required` from this table, marker and pin
+  fields now read as optional**, which is what the server accepts. The generator notes the lists it
+  ignores on every run and says when canonical stops carrying them.
+
+### Not yet
+- `me()` and `members()` wait for the server routes (keel's M2b). Nothing in this release
+  guesses at their names.
+
 ## [4.3.0] — 2026-09-28
 
 Errors you can act on: the two 409s told apart, and the busy server's `Retry-After`, in Node and

package/SCHEMA.md

@@ -6,7 +6,7 @@ GENERATED from the canonical schema YAML — do not hand-edit (regenerate: `pyth
 Written for both humans and AI agents reading this package locally.
 
 **The shape rules** (v2 wire dialect): every element carries `id` (UUID), `name`, optional
-`description`/`supertype`/`subtype`/`image_url`, server-managed `type`/`created_at`/`updated_at`/`change_seq`,
+`description`/`supertype`/`subtype`/`image_url`, server-managed `type`/`created_at`/`updated_at`/`change_seq`/`created_by`,
 and namespaced extension fields (`x_*` etc.) returned verbatim. Link fields use ONE bare
 name in both read and write (no `_ids` suffix). Single links are `UUID | null`; multi links
 are `UUID[]`. **Links are owned one-way**: the type listed below owns the field (e.g.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /** Every element carries these. The extension index signature admits namespaced
  *  pass-through fields (atlas_* / shadow_* / x_*) returned verbatim by the server.
  *  Derived from base_properties.yaml: `World` is dropped (the API rejects it in
- *  bodies -- the key determines the world) and the four server-managed fields are
+ *  bodies -- the key determines the world) and the five server-managed fields are
  *  added, since they ride every wire body and appear in no element YAML. */
 interface OwElementBase {
     /** Element type slug (server-managed, read-only). */
@@ -24,6 +24,8 @@ interface OwElementBase {
     updated_at?: string;
     /** Per-world change cursor, stamped on every write (server-managed, read-only). */
     change_seq?: number;
+    /** The membership that created this element (server-managed, read-only); null for the world's owner and for anything created before memberships existed. */
+    created_by?: string | null;
     /** Namespaced extension fields (atlas_* / shadow_* / x_*), returned verbatim. */
     [ext: string]: unknown;
 }
@@ -1100,27 +1102,22 @@ declare const FIELD_SCHEMA: {
         readonly map: {
             readonly type: "single_link";
             readonly target: "map";
-            readonly required: true;
         };
         readonly zone: {
             readonly type: "single_link";
             readonly target: "zone";
-            readonly required: true;
         };
         readonly x: {
             readonly type: "integer";
-            readonly required: true;
         };
         readonly y: {
             readonly type: "integer";
-            readonly required: true;
         };
         readonly z: {
             readonly type: "integer";
         };
         readonly order: {
             readonly type: "integer";
-            readonly required: true;
         };
     };
     readonly narrative: {
@@ -1407,24 +1404,19 @@ declare const FIELD_SCHEMA: {
         readonly map: {
             readonly type: "single_link";
             readonly target: "map";
-            readonly required: true;
         };
         readonly element_type: {
             readonly type: "text";
-            readonly required: true;
         };
         readonly element_id: {
             readonly type: "single_link";
             readonly target: "any";
-            readonly required: true;
         };
         readonly x: {
             readonly type: "integer";
-            readonly required: true;
         };
         readonly y: {
             readonly type: "integer";
-            readonly required: true;
         };
         readonly z: {
             readonly type: "integer";
@@ -1918,6 +1910,8 @@ interface OwBulkItem {
  * One slot of a /bulk response. WIRE-CORRECTED (fixtures P2a/P2c): `status` is
  * the NUMERIC HTTP status of that slot (201/400/...), success slots echo
  * created_at/updated_at, error slots carry an OwErrorBody under `error`.
+ * A contributor's write on someone else's element fails in its slot as
+ * `{status: 403, error: {code: 'not_author'}}` (keel D72), never as a thrown error.
  */
 interface OwBulkItemResult {
     status: number;
@@ -2042,6 +2036,13 @@ declare class OwApiError extends Error {
     get isIdConflict(): boolean;
     /** keel's admission control turned the request away (503 `server_busy`); see retryAfter. */
     get isBusy(): boolean;
+    /**
+     * A contributor tried to change, replace, relink or delete an element someone else
+     * created (403 `not_author`, keel D72 membership phase 2). Retrying will not help; the
+     * element is not theirs. `/bulk` never throws for this: it answers 200 with a per-item
+     * slot `{status: 403, error: {code: 'not_author'}}`. Owners and co-builders never see it.
+     */
+    get isNotAuthor(): boolean;
 }
 /** Network-level failure (fetch rejected) -- no envelope to parse. */
 declare class OwNetworkError extends Error {

package/dist/index.js

@@ -39,6 +39,15 @@ var OwApiError = class extends Error {
   get isBusy() {
     return this.status === 503 && this.code === "server_busy";
   }
+  /**
+   * A contributor tried to change, replace, relink or delete an element someone else
+   * created (403 `not_author`, keel D72 membership phase 2). Retrying will not help; the
+   * element is not theirs. `/bulk` never throws for this: it answers 200 with a per-item
+   * slot `{status: 403, error: {code: 'not_author'}}`. Owners and co-builders never see it.
+   */
+  get isNotAuthor() {
+    return this.status === 403 && this.code === "not_author";
+  }
 };
 var OwNetworkError = class extends Error {
   constructor(message, cause) {
@@ -846,12 +855,12 @@ var FIELD_SCHEMA = {
     subtype: { type: "text", required: false },
     image_url: { type: "text", required: false },
     // Details
-    map: { type: "single_link", target: "map", required: true },
-    zone: { type: "single_link", target: "zone", required: true },
-    x: { type: "integer", required: true },
-    y: { type: "integer", required: true },
+    map: { type: "single_link", target: "map" },
+    zone: { type: "single_link", target: "zone" },
+    x: { type: "integer" },
+    y: { type: "integer" },
     z: { type: "integer" },
-    order: { type: "integer", required: true }
+    order: { type: "integer" }
   },
   narrative: {
     // Base fields (shared by all elements)
@@ -944,11 +953,11 @@ var FIELD_SCHEMA = {
     subtype: { type: "text", required: false },
     image_url: { type: "text", required: false },
     // Details
-    map: { type: "single_link", target: "map", required: true },
-    element_type: { type: "text", required: true },
-    element_id: { type: "single_link", target: "any", required: true },
-    x: { type: "integer", required: true },
-    y: { type: "integer", required: true },
+    map: { type: "single_link", target: "map" },
+    element_type: { type: "text" },
+    element_id: { type: "single_link", target: "any" },
+    x: { type: "integer" },
+    y: { type: "integer" },
     z: { type: "integer" }
   },
   relation: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {