memorysync-sdk 1.7.0 → 1.7.2

package/dist/index.mjs

@@ -532,7 +532,7 @@ var IntegrationsNamespace = class extends Namespace {
 };
 
 // src/control-plane.ts
-var SDK_VERSION = "1.7.0";
+var SDK_VERSION = "1.7.2";
 function safeJson(text) {
   try {
     return JSON.parse(text);
@@ -1088,7 +1088,7 @@ var ControlPlaneClient = class {
 };
 
 // src/index.ts
-var SDK_VERSION2 = "1.7.0";
+var SDK_VERSION2 = "1.7.2";
 function camelToSnakeKey(key) {
   return key.replace(/([A-Z])/g, "_$1").toLowerCase();
 }
@@ -1365,7 +1365,7 @@ var MemorySyncClient = class {
       if (f.after !== void 0) filters.after = f.after;
       if (Object.keys(filters).length === 0) {
         throw new ValidationError(
-          "filters must set at least one criterion; use purgeUser() to remove everything for an end user"
+          "filters must set at least one criterion; to remove everything for an end user use a wide criterion such as { before: new Date() }"
         );
       }
       body.filters = filters;
@@ -1375,13 +1375,33 @@ var MemorySyncClient = class {
     return await this.request("DELETE", "/memory/forget", { body });
   }
   /**
-   * Delete every memory belonging to the calling end user.
+   * Not a memory operation, and not callable from this SDK. Always throws.
    *
-   * Separate from {@link forget} on purpose: this reads like what it does, so a
-   * whole-namespace delete can never be the accidental result of an empty filter.
+   * `DELETE /memory/user/purge` reads as if it clears one end user's memories.
+   * It does neither. It ignores `endUserId` and erases the **account** behind
+   * the credential, cascading to the password hash, every API key, memberships,
+   * auth providers and MFA credentials. Nobody can sign in afterwards, and the
+   * API cannot repair it, because the credential that would authorise a repair
+   * is one of the things it destroys.
+   *
+   * Earlier versions of this method described it as "delete every memory
+   * belonging to the calling end user", and callers who believed that lost
+   * accounts.
+   *
+   * The server now refuses account erasure for every API-key caller, and this
+   * client authenticates only with an API key, so the call could never succeed.
+   * It throws locally rather than sending a request that can only come back 403,
+   * so the reason arrives immediately and no destructive intent leaves the
+   * process. Erase an account from the dashboard, where a human is present.
+   *
+   * @deprecated Use {@link forget} for anything memory-related: by ids, or with
+   * a wide criterion such as `{ before: new Date() }` to clear an end user.
+   * @throws {ValidationError} Always.
    */
   async purgeUser() {
-    return await this.request("DELETE", "/memory/user/purge") ?? {};
+    throw new ValidationError(
+      "purgeUser() erases the whole account, not its memories: the password hash, every API key and all sign-in credentials go with it. The API refuses this for API-key callers, and this client only supports API keys, so the call cannot succeed. To delete memories use forget(), either with ids or a wide criterion such as { before: new Date() }. To close an account, use the dashboard."
+    );
   }
   async summarize(req) {
     if (!req.memoryIds || req.memoryIds.length === 0) {