@onlyworlds/sdk 4.36.0 → 4.36.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.36.2] - 2026-10-20
+
+### Changed
+
+- `pinExpectation`'s doc comment: a legacy key that can write sends its PIN on every read of a world that has one, whether or not the world is open to read (keel #421 PR 105, the demo split). The `'required-for-private-reads'` literal keeps its name until 5.0, since renaming a literal in a published union is a type break. A demo-range key is kind `legacy` too and never needs a PIN. No code change.
+
+## [4.36.1] - 2026-10-20
+
+### Changed
+
+- The reset rule in `isResyncRequired`'s and `changes`' doc comments: on a 409 `resync_required`, walk from zero and keep what the local copy holds that the new walk does not name; a reset never empties a copy. It said replace. Keel says keep since PR 104 (the Captain's ruling, 2026-10-20: sharing is forward-only). No code change.
+
 ## [4.36.0] - 2026-10-20
 
 ### Changed

package/dist/index.d.ts

@@ -2627,8 +2627,9 @@ declare class OwApiError extends Error {
     /**
      * `/changes` refused the cursor (409 `resync_required`): a guest's view of the world
      * changed, or the key's role did (a guest's cursor has another shape). Drop the stored
-     * cursor, walk again from the start, and REPLACE the local copy rather than merging into
-     * it: a guest never receives delete ops, so only the replace removes what it no longer sees.
+     * cursor, walk again from the start, and keep what the local copy holds that the new walk
+     * does not name: a reset never empties a copy (keel PR 104, the Captain's ruling: sharing
+     * is forward-only).
      */
     get isResyncRequired(): boolean;
     /** keel's admission control turned the request away (503 `server_busy`); see retryAfter. */
@@ -2762,8 +2763,11 @@ declare function detectKeyKind(key: string): OwKeyKind;
 declare function kindCanWrite(kind: OwKeyKind): boolean;
 /**
  * Should a credential UI ask for a PIN with this key?
- * Prefixed keys read PIN-less; legacy keys may need it; writes on pinned
- * worlds always need it. 'optional' means: show the field, don't require it.
+ * Prefixed keys read PIN-less; writes on pinned worlds always need it. 'optional' means: show
+ * the field, don't require it. A legacy key that can write sends its PIN on every read of a
+ * world that has one, whether or not the world is open to read (keel #421 PR 105, 2026-10-20):
+ * the literal `'required-for-private-reads'` predates that rule and keeps its name until 5.0.
+ * A demo-range key (`isDemoKey`) is also kind `legacy` and never needs a PIN.
  */
 declare function pinExpectation(kind: OwKeyKind): 'never' | 'optional' | 'required-for-private-reads';
 
@@ -2889,8 +2893,8 @@ declare class OwV2Client {
      * another shape than everyone else's).
      * Zero/absent cursor = full export (byte-aligned with the Folder Format).
      * Reset rule: a 409 `resync_required` (err.isResyncRequired) means the key's
-     * view changed (a guest's, or its role): drop the cursor, walk from zero, and
-     * replace the local copy rather than merging into it.
+     * view changed (a guest's, or its role): drop the cursor, walk from zero, and keep what the
+     * local copy holds that the new walk does not name (keel's own words; sharing is forward-only).
      * Citizenship: heaviest route on the platform; default page size is polite.
      * keel sends the cursor of a page at the head as a number (an empty page, for anyone
      * but a guest); it is handed back as a string, like every cursor here.

package/dist/index.js

@@ -105,8 +105,9 @@ var OwApiError = class extends Error {
   /**
    * `/changes` refused the cursor (409 `resync_required`): a guest's view of the world
    * changed, or the key's role did (a guest's cursor has another shape). Drop the stored
-   * cursor, walk again from the start, and REPLACE the local copy rather than merging into
-   * it: a guest never receives delete ops, so only the replace removes what it no longer sees.
+   * cursor, walk again from the start, and keep what the local copy holds that the new walk
+   * does not name: a reset never empties a copy (keel PR 104, the Captain's ruling: sharing
+   * is forward-only).
    */
   get isResyncRequired() {
     return this.status === 409 && this.code === "resync_required";
@@ -457,8 +458,8 @@ var OwV2Client = class {
    * another shape than everyone else's).
    * Zero/absent cursor = full export (byte-aligned with the Folder Format).
    * Reset rule: a 409 `resync_required` (err.isResyncRequired) means the key's
-   * view changed (a guest's, or its role): drop the cursor, walk from zero, and
-   * replace the local copy rather than merging into it.
+   * view changed (a guest's, or its role): drop the cursor, walk from zero, and keep what the
+   * local copy holds that the new walk does not name (keel's own words; sharing is forward-only).
    * Citizenship: heaviest route on the platform; default page size is polite.
    * keel sends the cursor of a page at the head as a number (an empty page, for anyone
    * but a guest); it is handed back as a string, like every cursor here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.36.0",
+  "version": "4.36.2",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {