@onlyworlds/sdk 4.72.1 → 4.72.3

package/AGENTS.md

@@ -1,6 +1,6 @@
 # For AI agents using @onlyworlds/sdk
 
-**Current as of**: SDK **4.x** · schema-dist **v0.33.0-dist.59** (canonical 00.33.00).
+**Current as of**: SDK **4.x** · schema-dist **v0.33.0-dist.61** (canonical 00.33.00).
 This line is asserted by `codegen:check` in CI — if the pin moves and this file is not
 re-read against it, the check fails rather than letting this document rot quietly.
 
@@ -27,7 +27,7 @@ against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum)
 - Never send a `"world"` field in payloads — world identity comes from the API key (422 otherwise).
 - v2 link fields use ONE name both directions (no `_ids` suffix — that is v1 dialect only).
 - PATCH is destructive on sent fields; use `editLinks` (atomic add/remove) for relationships.
-- Offline or stale edits: pass `{ ifMatch: el.change_seq }` to `patch`/`editLinks` (since 4.9.0) and `delete` (since 4.61.0, keel #563).
+- Offline or stale edits: pass `{ ifMatch: el.change_seq }` to `patch`/`editLinks` (since 4.9.0) and `delete` (since 4.61.0).
   If the element moved, nothing is written and `OwPreconditionFailedError` (412) carries
   `current`; the server never merges, the client decides.
 - Polling: `changesHead()` (since 4.15.0) gives `{head, cursor, epoch, unchanged}` without a
@@ -44,7 +44,7 @@ against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum)
 - Images: `uploadImage(bytes)` returns `{ url, ... }`; set `url` as `image_url`. The bytes go
   to the edge with a single-use ticket from keel, never with the API key. `removeImage(urlOrKey)`
   takes one back (its uploader or the world's owner); it leaves `image_url` on elements as is.
-- Files on elements (keel #393): `listFiles(type, id)`, `uploadFile(type, id, bytes, { name?,
+- Files on elements: `listFiles(type, id)`, `uploadFile(type, id, bytes, { name?,
   label?, onProgress? })` (ticket from keel, bytes to the upload host; the kind from the name's
   extension), `fileDownloadLink(type, id, fileId)` (a 5-minute link: fetch it at once, never
   store it), `removeFile(type, id, fileId)`, `worldFiles()` (`used_bytes` of `cap_bytes`).
@@ -70,7 +70,7 @@ against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum)
   without spending: `{ token_rating, tokens_used_today, tokens_remaining, resets_at }`.
 - Who am I (since 4.22.0, a world key): `client.me()` is `{ world, scope, kind, role,
   membership, character, front_door }` (`membership` is what `created_by` holds for what you
-  create; null for the owner); `front_door` (since 4.60.0, keel #558) names who answers for your
+  create; null for the owner); `front_door` (since 4.60.0) names who answers for your
   seat (`sponsor`, `sponsor_character`), your Character, and the world's Charter with up to five
   skill Objects: an agent reads `charter` first. `client.members()` is the roster's rows. An
   account token is a TypeError.
@@ -135,13 +135,13 @@ against live data). The v1 surface (`OnlyWorldsClient`, the `ElementType` enum)
   is lower case letters, digits and hyphens, 1 to 32 characters, else a TypeError at construction.
   keel stores it as `changed_client` on the element and `deleted_client` on a `/changes` delete:
   the client's claim, never proof, and null when none was sent.
-- **Proposals** (keel #519): `propose(type, id, { fields, evidence, expires? })` suggests a change
+- **Proposals**: `propose(type, id, { fields, evidence, expires? })` suggests a change
   without making it; any member who reads the element may, a read key included. The owner or a
   co-builder decides: `acceptProposal(type, id, pid)` (the write is theirs; 409 `stale_proposal`,
   an `OwStaleProposalError` with `conflicts` and `current`, when a proposed field moved since),
   `declineProposal(type, id, pid, { reason? })`; the proposer may `withdrawProposal`. Lists:
   `listProposals(type, id)`, `worldProposals({ state?, element? })`; the world's queue (since
-  4.66.0, keel #565) also lists each new element written as proposed (`kind: 'new_element'`
+  4.66.0) also lists each new element written as proposed (`kind: 'new_element'`
   beside `kind: 'proposal'`), which a keeper settles with `reviewNewElement(type, id, { decision:
   'accept' | 'decline', reason? })` (decline deletes it; 422 `err.isNotProposed` when unmarked).
   A row's `fields` holds only what differs; `omitted` names what an upsert left empty. When the world's

package/CHANGELOG.md

@@ -5,6 +5,19 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.72.3] - 2026-10-24
+
+### Changed
+
+- **Schema repinned to schema-dist `v0.33.0-dist.61`** (from dist.59; the same canonical 00.33.00, so `ONLYWORLDS_VERSION` stays `'00.33.00'`, no schema file moved and no generated type changed). Serial 60 rules eight spine readings and adds `x_spine_retires`, the profile's thirteenth key; serial 61 gives `schema.json` the advisory minimum and maximum of the 15 integer fields that have them (this package's types and `FIELD_SCHEMA` are generated from the field list, which does not carry them), rules two more spine readings with four fixture cases, and has the folder lint name the format's version. The SDK reads no spine key; the profile pages it replays (names, room, review) moved only their ruled-when lines.
+
+## [4.72.2] - 2026-10-24
+
+### Fixed
+
+- **`OwElementBase.hidden`'s doc comment says what a create does with it.** It said a write ignores the mark. Since keel PR 199 (live 2026-10-23), a create (a POST, a PUT of a new id, a `/bulk` item that creates) carrying `hidden: true` creates the element hidden, from the owner's keys or a co-builder's; any other key gets 403 `hidden_not_allowed` and nothing is created. Every other write still ignores it. The SDK already sent the mark as the element had it; only the words were wrong, in the types an editor shows (`dist/index.d.ts`). (Corrected after release: the entry first said they reach the docs' TypeScript reference, which lists the methods and not this field.)
+- Tests: `create`, `upsert` and `bulk` send `hidden` as given (it is not on the stripped list); a 403 `hidden_not_allowed` surfaces as `OwApiError.code`.
+
 ## [4.72.1] - 2026-10-24
 
 ### Fixed

package/README.md

@@ -368,7 +368,7 @@ A lore view (a list, a count, search, a graph, a link picker, a story's context)
 
 ### A world's own words for the types
 
-A world may carry `x_names` on the World: its own word for a type (Character shown as *Employee* in a work world), and a finer word for a supertype inside one. `typeWord(world, type, { supertype, many })` returns that word, or `null` for the standard's name. `world` is a `getWorld()` body (keel serves `x_` keys on the World from Keel #571) or a folder's `world.json`. The API, the folder, the schema and every id keep the standard's names; the word is for display only.
+A world may carry `x_names` on the World: its own word for a type (Character shown as *Employee* in a work world), and a finer word for a supertype inside one. `typeWord(world, type, { supertype, many })` returns that word, or `null` for the standard's name. `world` is a `getWorld()` body (keel serves `x_` keys on the World) or a folder's `world.json`. The API, the folder, the schema and every id keep the standard's names; the word is for display only.
 
 ```typescript
 import { typeWord } from '@onlyworlds/sdk';
@@ -404,4 +404,4 @@ Use this SDK for known operations in your own code (CRUD, sync, bulk). To let an
 
 ## Licence and contributions
 
-The code is MIT (`LICENSE`). Issues are welcome: a bug, a wrong word, a thing you could not do. Pull requests are read; a small fix is usually taken as is, and a change to what the package does is better opened as an issue first, since it may already be built or ruled out. A reply can take a few days. A vulnerability goes privately, never in an issue: `SECURITY.md`.
+The code is MIT (`LICENSE`). Issues are welcome: a bug, a wrong word, a thing you could not do. Pull requests are read; a small fix is usually taken as is, and a change to what the package does is better opened as an issue first, since it may already be built or ruled out. A reply can take a few days. A vulnerability goes privately, never in an issue: `SECURITY.md`. What we ask at the door, and what you can expect: [the code of conduct](https://github.com/OnlyWorlds/OnlyWorlds/blob/main/CODE_OF_CONDUCT.md).

package/SCHEMA.md

@@ -1,6 +1,6 @@
 # OnlyWorlds Schema Reference
 
-**Source**: https://github.com/OnlyWorlds/schema-dist @ **v0.33.0-dist.59** — canonical schema **00.33.00**, published 2026-10-24.
+**Source**: https://github.com/OnlyWorlds/schema-dist @ **v0.33.0-dist.61** — canonical schema **00.33.00**, published 2026-10-24.
 
 GENERATED from the canonical schema YAML — do not hand-edit (regenerate: `python codegen/generate_types.py`).
 Written for both humans and AI agents reading this package locally.