@onlyworlds/sdk 4.76.2 → 4.78.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.78.0] - 2026-10-26
+
+### Added
+
+- **`revokeWorldKey(worldId, keyId)`**: revoke a world key by the `id` `mintWorldKey` returned (`DELETE /account/worlds/{id}/keys/{key_id}`, account token only). The key then answers 401 `key_revoked`. The owner revokes any of the world's keys, a member only their own; any other id is a 404. Revoking a revoked key answers the same 204, so a tool that mints a key when a person signs in can revoke it when they sign out without tracking whether it already did.
+
+## [4.77.0] - 2026-10-26
+
+### Added
+
+- **`isCharacterPlayed`** on `OwApiError`: a delete (or a review's decline) of a Character someone plays on the roster, the world's `owner_character` or a live member's, an AI seat's or a player's, answers 422 `character_played` (`param` id) and deletes nothing. The predicate tells it from a malformed id's 422, which carries the same `param`. The way out is to re-point that member to another Character, or remove the member, then delete.
+
 ## [4.76.2] - 2026-10-25
 
 ### Changed

package/dist/index.d.ts

@@ -3336,6 +3336,16 @@ declare class OwApiError extends Error {
      * `character_taken` (see isCharacterTaken).
      */
     get isCharacterInvalid(): boolean;
+    /**
+     * delete, or reviewNewElement's decline: the Character is one someone plays on the roster, the
+     * world's `owner_character` or a live member's, an AI seat's or a player's Character (422
+     * `character_played`, `param` id). Nothing was deleted; the message says who plays it, never by
+     * email or username. Re-point that member to another Character (the owner's own through
+     * patchWorld's `owner_character`, a seat's by the owner on the member PATCH, a person's own
+     * through setMyCharacter), or remove the member, then delete. Never true for a malformed id's
+     * 422, which carries the same `param`.
+     */
+    get isCharacterPlayed(): boolean;
     /**
      * redeemJoin: the world already has its 50 live players (422 `world_full`),
      * at any player link, a table's or a link for one's. Nothing is spent; a place frees when the
@@ -4286,6 +4296,14 @@ declare class OwV2Client {
         scope?: 'read' | 'write';
         name?: string;
     }): Promise<OwMintedKey>;
+    /**
+     * DELETE /account/worlds/{worldId}/keys/{keyId} -- revoke a world key, by the `id` mintWorldKey
+     * returned: from then on it answers 401 `key_revoked`. The owner revokes any of the world's keys,
+     * a member only their own; any other id is a 404 (`err.isNotFound`). Revoking a revoked key
+     * changes nothing and answers the same 204, so a tool that signs out can revoke its key without
+     * knowing whether it already did. Account token only.
+     */
+    revokeWorldKey(worldId: string, keyId: string): Promise<void>;
     /**
      * Start Sign in with OnlyWorlds from a tool's page: mint `state` and a PKCE verifier, keep them
      * under `clientId` in `storage` (sessionStorage by default; in Node pass one), and send the

package/dist/index.js

@@ -223,6 +223,18 @@ var OwApiError = class extends Error {
   get isCharacterInvalid() {
     return this.status === 422 && this.code === "invalid_request" && this.param === "character";
   }
+  /**
+   * delete, or reviewNewElement's decline: the Character is one someone plays on the roster, the
+   * world's `owner_character` or a live member's, an AI seat's or a player's Character (422
+   * `character_played`, `param` id). Nothing was deleted; the message says who plays it, never by
+   * email or username. Re-point that member to another Character (the owner's own through
+   * patchWorld's `owner_character`, a seat's by the owner on the member PATCH, a person's own
+   * through setMyCharacter), or remove the member, then delete. Never true for a malformed id's
+   * 422, which carries the same `param`.
+   */
+  get isCharacterPlayed() {
+    return this.status === 422 && this.code === "character_played";
+  }
   /**
    * redeemJoin: the world already has its 50 live players (422 `world_full`),
    * at any player link, a table's or a link for one's. Nothing is spent; a place frees when the
@@ -1715,6 +1727,19 @@ var OwV2Client = class {
     if (opts.name !== void 0) body.name = opts.name;
     return this.request("POST", `/account/worlds/${encodeURIComponent(worldId)}/keys`, { write: true, body });
   }
+  /**
+   * DELETE /account/worlds/{worldId}/keys/{keyId} -- revoke a world key, by the `id` mintWorldKey
+   * returned: from then on it answers 401 `key_revoked`. The owner revokes any of the world's keys,
+   * a member only their own; any other id is a 404 (`err.isNotFound`). Revoking a revoked key
+   * changes nothing and answers the same 204, so a tool that signs out can revoke its key without
+   * knowing whether it already did. Account token only.
+   */
+  async revokeWorldKey(worldId, keyId) {
+    if (this.keyKind !== "account") {
+      throw new TypeError("revokeWorldKey needs an account token (ow_a_)");
+    }
+    await this.request("DELETE", `/account/worlds/${encodeURIComponent(worldId)}/keys/${encodeURIComponent(keyId)}`);
+  }
   // -- Sign in with OnlyWorlds (OAuth 2.1 code + PKCE, keel PR 154) ---------
   /**
    * Start Sign in with OnlyWorlds from a tool's page: mint `state` and a PKCE verifier, keep them

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.76.2",
+  "version": "4.78.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {