@pouchy_ai/admin-sdk 0.40.0 → 0.40.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to `@pouchy_ai/admin-sdk` are documented here.
 
+## 0.40.1 — 2026-09-30
+
+- **A 2xx whose body cannot be read now rejects with `AdminApiError`.** It
+  used to resolve as `{}` typed as the method's result: an HTML 200 from a
+  proxy or captive portal, a truncated body, or a deadline that fired
+  mid-body read as a success with every field `undefined`. For a one-shot
+  secret (`createKey`, `rotateKey`, `createWebhook`, `rotateWebhookSecret`)
+  the server had already minted it, and the caller lost it silently. The
+  error's `status` is the server's 2xx, because the request did land: do not
+  blindly retry a mint. A 204 / 205 still resolves `{}`; non-2xx errors are
+  unchanged.
+
 ## 0.40.0 — 2026-09-29
 
 - **`recording` on agents.** Turning it on grants `call.record` on the agent's

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const ADMIN_SDK_VERSION = "0.40.0";
+export declare const ADMIN_SDK_VERSION = "0.40.1";
 export declare const DEFAULT_BASE_URL = "https://pouchy.ai/v1/admin";
 /** Deadline for the routes whose server handler declares `maxDuration: 300` —
  *  the server's own ceiling plus headroom, so a client abort can only ever mean

package/dist/index.js

@@ -8,7 +8,7 @@
 //   import { createAdminClient } from '@pouchy_ai/admin-sdk';
 //   const admin = createAdminClient({ adminKey: process.env.POUCHY_ADMIN_KEY! });
 //   const { agents } = await admin.listAgents();
-export const ADMIN_SDK_VERSION = '0.40.0';
+export const ADMIN_SDK_VERSION = '0.40.1';
 export const DEFAULT_BASE_URL = 'https://pouchy.ai/v1/admin';
 /** Default per-request timeout (ms). A hung upstream otherwise never rejects. */
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -270,7 +270,25 @@ export function createAdminClient(opts) {
                 ? `${method} ${path} — request timed out after ${timeoutMs}ms`
                 : `${method} ${path} — network error: ${e instanceof Error ? e.message : String(e)}`, 0);
         }
-        const data = (await res.json().catch(() => ({})));
+        // 0.40.1: a 2xx whose body cannot be read is an error, not `{}`. It used
+        // to resolve as a success with every field undefined — an HTML 200 from a
+        // proxy, a truncated body, a deadline that fired mid-body — and a secret
+        // the server had already minted (`createKey`, `rotateKey`,
+        // `createWebhook`) was lost with no signal. `status` stays the server's
+        // 2xx: the request DID land, so a blind retry of a mint is not safe. A
+        // 204 / 205 (no body by definition) still resolves `{}`, and the non-2xx
+        // arm keeps its fallback. Still `res.json()`, not `text()`: an injected
+        // `fetch` may hand back a minimal response that only implements `json`.
+        let readError = null;
+        const data = (await res.json().catch((e) => {
+            readError = e;
+            return {};
+        }));
+        if (res.ok && readError !== null && res.status !== 204 && res.status !== 205) {
+            const why = readError instanceof Error ? readError.message : String(readError);
+            const msg = `${method} ${path} — unreadable ${res.status} body: ${why}`;
+            throw new AdminApiError(msg, res.status, retryAfterFrom(res, null));
+        }
         if (!res.ok)
             throw new AdminApiError(
             // The server's own `error` string is passed through UNCHANGED — it is

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@pouchy_ai/admin-sdk",
-	"version": "0.40.0",
+	"version": "0.40.1",
 	"description": "Typed TypeScript client for the Pouchy Admin API \u2014 manage agents, keys, end users, knowledge, skills, channels, schedules, webhooks and credentials headlessly, with a project Admin key.",
 	"type": "module",
 	"license": "SEE LICENSE IN LICENSE",