@onlyworlds/sdk 4.72.0 → 4.72.1

package/AGENTS.md

@@ -1,6 +1,6 @@
 # For AI agents using @onlyworlds/sdk
 
-**Current as of**: SDK **4.x** · schema-dist **v0.33.0-dist.57** (canonical 00.33.00).
+**Current as of**: SDK **4.x** · schema-dist **v0.33.0-dist.59** (canonical 00.33.00).
 This line is asserted by `codegen:check` in CI — if the pin moves and this file is not
 re-read against it, the check fails rather than letting this document rot quietly.
 

package/CHANGELOG.md

@@ -5,6 +5,17 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.72.1] - 2026-10-24
+
+### Fixed
+
+- **`readWorldFile` refuses a deflate stream that ends before its entry's declared compressed size** (folder spec §4.7, OW-14, its size bullet; ruled 2026-10-24, published at schema-dist serial 58). The size bullet speaks of every size an entry declares, the compressed one too. fflate stopped at the stream's end and ignored the bytes after it, so an entry whose stream ended four bytes early, those bytes junk and its sizes and CRC honest, was read (`fail-OW-14-deflate-early-end`); it is now `not_openable`. fflate never says where a stream ended, so each deflated entry is inflated twice: once whole, as before, then again short of its last byte (in 64 KiB chunks past that size, the output dropped), where a stream that ends at its declared size runs out and fflate refuses it, and one that ends sooner still inflates. A stream that never ends (`fail-OW-14-deflate-no-end`) was already refused, as `not_openable`. A world file whose streams end where their entries say reads as before.
+- Tests: the whole `.owworld` set, 96 cases, through the reader, the count floor 96; built streams with 1 and 4 junk bytes after their end, short and past 64 KiB, refused, and the same streams with nothing after them read. The three zips the fix was tested on before the serial was vendored (`test/fixtures/owworld-next/`) are gone: the set carries them.
+
+### Changed
+
+- **Schema repinned to schema-dist `v0.33.0-dist.59`** (commit a40a5f3; same canonical 00.33.00; no schema file moved, `schema.json` and `presentation.json` unchanged, no generated type changed, `ONLYWORLDS_VERSION` still `'00.33.00'`; generated output moves only its source header and SCHEMA.md's line). Serials 58 and 59 together bring what follows; 59's own change is text only (the set's generator and verdicts regenerated with the same 96 zips byte for byte, and the profile pages, the checks fixture's note and the folder lint say when a rule was ruled). The `.owworld` set at 96 zips: the two deflate cases above, and `pass-OW-18-nfc-unassigned`, U+11383 beside U+11382 U+113C9, two names at Unicode 15.1, which 4.71.0's `nfc` already keeps apart; none of the earlier 93 zips moved. The spine profile's serial-58 sentences: `x_spine_owner` the keeping seat's name, the projection's World mark `x_spine_projection`, the audit's one Seat and folded-name uniqueness, the Retirement Event's typed link. The dist's README, LICENSE and SECURITY.md, written by its publisher.
+
 ## [4.72.0] - 2026-10-24
 
 ### Changed

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024-2025 OnlyWorlds
+Copyright (c) 2021-2026 Titus Oosting
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -5,6 +5,8 @@
 
 OnlyWorlds is an open standard for worldbuilding data: 22 element types (characters, locations, events, laws and the rest) that any tool can read and write. This is a typed client for its API, with the schema's constants (element types, icons, colour families, field metadata) generated from the published [schema distribution](https://github.com/OnlyWorlds/schema-dist). It runs in Node 18+ and in the browser through a bundler (ESM only).
 
+**Who writes this repository.** The SDK is maintained by Kael, one of a crew of AI minds working with the OnlyWorlds founder, who answers for it. Kael reads and answers its issues and pull requests; until the crew posts from an identity of its own, those replies post from the founder's account, so a reply from `tmoosting` may be Kael's. `CHANGELOG.md` is the crew's record as it was written: its crew names, room references and keel items (keel #519, the API server's own tracker) point at records outside this repository.
+
 ## Install
 
 ```bash
@@ -400,6 +402,6 @@ Use this SDK for known operations in your own code (CRUD, sync, bulk). To let an
 
 [Docs](https://onlyworlds.github.io/docs/development/typescript) · [Games](https://onlyworlds.github.io/docs/development/games) · [API reference](https://www.onlyworlds.com/api/docs) · [Issues](https://github.com/OnlyWorlds/sdk/issues) · [Changelog](CHANGELOG.md)
 
-## License
+## Licence and contributions
 
-MIT
+The code is MIT (`LICENSE`). Issues are welcome: a bug, a wrong word, a thing you could not do. Pull requests are read; a small fix is usually taken as is, and a change to what the package does is better opened as an issue first, since it may already be built or ruled out. A reply can take a few days. A vulnerability goes privately, never in an issue: `SECURITY.md`.

package/SCHEMA.md

@@ -1,6 +1,6 @@
 # OnlyWorlds Schema Reference
 
-**Source**: https://github.com/OnlyWorlds/schema-dist @ **v0.33.0-dist.57** — canonical schema **00.33.00**, published 2026-10-24.
+**Source**: https://github.com/OnlyWorlds/schema-dist @ **v0.33.0-dist.59** — canonical schema **00.33.00**, published 2026-10-24.
 
 GENERATED from the canonical schema YAML — do not hand-edit (regenerate: `python codegen/generate_types.py`).
 Written for both humans and AI agents reading this package locally.

package/dist/index.js

@@ -3278,6 +3278,24 @@ function crc32(data) {
   return (c ^ -1) >>> 0;
 }
 var CHUNK = 64 * 1024;
+function endsEarly(payload) {
+  const short = payload.subarray(0, payload.length - 1);
+  try {
+    if (short.length <= CHUNK) {
+      inflateSync(short);
+    } else {
+      const inf = new Inflate(() => {
+      });
+      for (let i = 0; i < short.length; i += CHUNK) {
+        const stop = Math.min(i + CHUNK, short.length);
+        inf.push(short.subarray(i, stop), stop === short.length);
+      }
+    }
+  } catch {
+    return false;
+  }
+  return true;
+}
 function inflateEntry(bytes, e) {
   const off = e.offset;
   if (off + 30 > bytes.length || u32(bytes, off) !== SIG_LOCAL) refuse("not_openable", `${e.name}: no local header at its offset.`);
@@ -3316,6 +3334,9 @@ function inflateEntry(bytes, e) {
   }
   if (data.length > e.usize) refuse("too_big", `${e.name} holds more than the ${e.usize} bytes it declares.`);
   if (data.length !== e.usize) refuse("not_openable", `${e.name} holds ${data.length} bytes and declares ${e.usize}.`);
+  if (e.method !== 0 && payload.length > 0 && endsEarly(payload)) {
+    refuse("not_openable", `${e.name}: its deflate stream ends before its declared compressed size.`);
+  }
   if (crc32(data) !== e.crc) refuse("not_openable", `${e.name} fails its CRC.`);
   return e.method === 0 ? data.slice() : data;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.72.0",
+  "version": "4.72.1",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {