@onlyworlds/sdk 4.77.0 → 4.78.0

package/CHANGELOG.md

@@ -5,6 +5,12 @@ earlier history lives in git log only.
 
 ## [Unreleased]
 
+## [4.78.0] - 2026-10-26
+
+### Added
+
+- **`revokeWorldKey(worldId, keyId)`**: revoke a world key by the `id` `mintWorldKey` returned (`DELETE /account/worlds/{id}/keys/{key_id}`, account token only). The key then answers 401 `key_revoked`. The owner revokes any of the world's keys, a member only their own; any other id is a 404. Revoking a revoked key answers the same 204, so a tool that mints a key when a person signs in can revoke it when they sign out without tracking whether it already did.
+
 ## [4.77.0] - 2026-10-26
 
 ### Added

package/dist/index.d.ts

@@ -4296,6 +4296,14 @@ declare class OwV2Client {
         scope?: 'read' | 'write';
         name?: string;
     }): Promise<OwMintedKey>;
+    /**
+     * DELETE /account/worlds/{worldId}/keys/{keyId} -- revoke a world key, by the `id` mintWorldKey
+     * returned: from then on it answers 401 `key_revoked`. The owner revokes any of the world's keys,
+     * a member only their own; any other id is a 404 (`err.isNotFound`). Revoking a revoked key
+     * changes nothing and answers the same 204, so a tool that signs out can revoke its key without
+     * knowing whether it already did. Account token only.
+     */
+    revokeWorldKey(worldId: string, keyId: string): Promise<void>;
     /**
      * Start Sign in with OnlyWorlds from a tool's page: mint `state` and a PKCE verifier, keep them
      * under `clientId` in `storage` (sessionStorage by default; in Node pass one), and send the

package/dist/index.js

@@ -1727,6 +1727,19 @@ var OwV2Client = class {
     if (opts.name !== void 0) body.name = opts.name;
     return this.request("POST", `/account/worlds/${encodeURIComponent(worldId)}/keys`, { write: true, body });
   }
+  /**
+   * DELETE /account/worlds/{worldId}/keys/{keyId} -- revoke a world key, by the `id` mintWorldKey
+   * returned: from then on it answers 401 `key_revoked`. The owner revokes any of the world's keys,
+   * a member only their own; any other id is a 404 (`err.isNotFound`). Revoking a revoked key
+   * changes nothing and answers the same 204, so a tool that signs out can revoke its key without
+   * knowing whether it already did. Account token only.
+   */
+  async revokeWorldKey(worldId, keyId) {
+    if (this.keyKind !== "account") {
+      throw new TypeError("revokeWorldKey needs an account token (ow_a_)");
+    }
+    await this.request("DELETE", `/account/worlds/${encodeURIComponent(worldId)}/keys/${encodeURIComponent(keyId)}`);
+  }
   // -- Sign in with OnlyWorlds (OAuth 2.1 code + PKCE, keel PR 154) ---------
   /**
    * Start Sign in with OnlyWorlds from a tool's page: mint `state` and a PKCE verifier, keep them

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlyworlds/sdk",
-  "version": "4.77.0",
+  "version": "4.78.0",
   "description": "TypeScript SDK for the OnlyWorlds API - build world-building applications with type safety",
   "type": "module",
   "exports": {