@pouchy_ai/companion-sdk 0.26.0 → 0.26.1

package/CHANGELOG.md

@@ -12,6 +12,19 @@ a protocol bump is always called out explicitly here.
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-07-12
+
+### Changed
+
+- **Docs: `/api/stt` now requires auth.** The audio-transcription relay the
+  `ingestKnowledge` guidance points at is no longer an open endpoint — send
+  your `pchy_…` access token as the bearer (any valid token works; the call
+  is metered like other companion ops). No SDK code paths changed; this
+  release updates the inline JSDoc guidance only.
+- Server-side hardening (no client change needed): concurrent `input` posts
+  on one session now lose cleanly with the existing 409 `turn_pending` code
+  instead of double-running a turn — retry after the in-flight reply lands.
+
 ## [0.26.0] - 2026-07-11
 
 ### Fixed

package/dist/client.d.ts

@@ -432,7 +432,8 @@ export declare class CompanionClient {
      *  materials" list with source attribution, exactly like a first-party upload.
      *  So the materials entry point can live in YOUR app, not just Pouchy's.
      *
-     *  Extract the text yourself (your own parser, or Pouchy's /api/stt for audio)
+     *  Extract the text yourself (your own parser, or Pouchy's /api/stt for audio —
+     *  send your pchy_ token as the bearer; the relay is auth-gated and metered)
      *  and pass it here. Writes the user's SHARED knowledge, so the token must
      *  hold `memory.write:core` (the user's consent) — otherwise 403. Embeddings
      *  are computed on the user's next first-party open (eventually-consistent

package/dist/client.js

@@ -642,7 +642,8 @@ export class CompanionClient {
      *  materials" list with source attribution, exactly like a first-party upload.
      *  So the materials entry point can live in YOUR app, not just Pouchy's.
      *
-     *  Extract the text yourself (your own parser, or Pouchy's /api/stt for audio)
+     *  Extract the text yourself (your own parser, or Pouchy's /api/stt for audio —
+     *  send your pchy_ token as the bearer; the relay is auth-gated and metered)
      *  and pass it here. Writes the user's SHARED knowledge, so the token must
      *  hold `memory.write:core` (the user's consent) — otherwise 403. Embeddings
      *  are computed on the user's next first-party open (eventually-consistent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pouchy_ai/companion-sdk",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Embed the Pouchy companion — chat, voice, tools, memory, live world-state, instant UI, and agent-to-agent messaging — in any app, game, or site.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",