@onlyworlds/sdk 4.50.0 → 4.51.0

package/CHANGELOG.md

@@ -5,6 +5,12 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.51.0] - 2026-10-22
+
+### Changed
+
+- **`list()` and `listAll()` refuse an unknown top-level key** with a TypeError before anything is sent, naming the key and where a wire filter goes (`filter: { name__icontains: ... }`). Until now an unknown key was dropped without a word, so a plain-JavaScript caller who wrote `list('character', { name__icontains: 'probe' })` got every Character, unfiltered, and TypeScript's compile-time check was the only fence. A cleanup script written that way deleted 99 Characters on a test world on 2026-10-22; this is the SDK's half of the lesson. A caller who passed a stray key by accident now hears about it; the known keys are `limit`, `cursor`, `ids`, `createdBy`, `expand`, `fields`, `filter`, `viewAs`.
+
 ## [4.50.0] - 2026-10-22
 
 ### Added

package/dist/index.d.ts

@@ -3159,8 +3159,9 @@ declare class OwV2Client {
      * PUT /me/character -- pick the roster Character that is you in this world, or none (keel PR 160,
      * #533). A person member's write key with its PIN; answers GET /me's body. 422 for a hidden
      * Character (`character_hidden`, `err.isCharacterHidden`), a guest's pick it did not make, or a
-     * taken Character (`character_taken`); 404 for one this key cannot see; 403 for an agent seat, a
-     * player, the owner (who sets it on the world page) or a read key. A guest's view resets once.
+     * taken Character (`invalid_request`, `param` character); 404 for one this key cannot see; 403 for
+     * an agent seat, a player, the owner (whose own is the world's `owner_character`, set with
+     * patchWorld) or a read key. A guest's view resets once.
      */
     setMyCharacter(character: string | null): Promise<OwMe>;
     me(): Promise<OwMe>;

package/dist/index.js

@@ -544,8 +544,9 @@ var OwV2Client = class {
    * PUT /me/character -- pick the roster Character that is you in this world, or none (keel PR 160,
    * #533). A person member's write key with its PIN; answers GET /me's body. 422 for a hidden
    * Character (`character_hidden`, `err.isCharacterHidden`), a guest's pick it did not make, or a
-   * taken Character (`character_taken`); 404 for one this key cannot see; 403 for an agent seat, a
-   * player, the owner (who sets it on the world page) or a read key. A guest's view resets once.
+   * taken Character (`invalid_request`, `param` character); 404 for one this key cannot see; 403 for
+   * an agent seat, a player, the owner (whose own is the world's `owner_character`, set with
+   * patchWorld) or a read key. A guest's view resets once.
    */
   async setMyCharacter(character) {
     if (this.keyKind === "account") {
@@ -574,6 +575,13 @@ var OwV2Client = class {
   // -- Element CRUD --------------------------------------------------------
   /** GET /{type}/ -- one cursor page. */
   async list(type, params = {}) {
+    for (const k of Object.keys(params)) {
+      if (!LIST_PARAM_KEYS.has(k)) {
+        throw new TypeError(
+          `list: unknown parameter '${k}'. A wire filter (name, name__icontains, supertype, subtype, characters) goes under filter: { ${k}: ... }; the other keys are ${[...LIST_PARAM_KEYS].join(", ")}. Nothing was sent: an unknown key was once dropped, and the list came back whole.`
+        );
+      }
+    }
     const query = buildQuery({
       limit: params.limit ?? this.pageSize,
       cursor: params.cursor,
@@ -1637,6 +1645,7 @@ function objectKey(keyOrUrl) {
   if (!/^https?:\/\//i.test(keyOrUrl)) return keyOrUrl;
   return decodeURIComponent(new URL(keyOrUrl).pathname.replace(/^\/+/, ""));
 }
+var LIST_PARAM_KEYS = /* @__PURE__ */ new Set(["limit", "cursor", "ids", "createdBy", "expand", "fields", "filter", "viewAs"]);
 function buildQuery(params) {
   const q = new URLSearchParams();
   for (const [k, v] of Object.entries(params)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.50.0",
+  "version": "4.51.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {