wontopos 2.2.16 → 2.2.17

package/dist/wontopos.d.ts

@@ -273,7 +273,7 @@ export declare class Client {
     withTimeout(timeoutMs: number): Client;
     /** A client with a different retry budget (everything else kept). 0 disables retries. */
     withRetries(maxRetries: number): Client;
-    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01" }).
+    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01T00:00:00Z" } — RFC3339).
      * `metadata.speaker`: "me" = the assistant's own words, or a person's name (up to 50 per store). */
     add(content: string, userId?: string, metadata?: Record<string, unknown>): Promise<StoreResult>;
     /** Alias of `add` — store one memory. Same surface as the Python SDK's `store`. */

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.16";
+const VERSION = "2.2.17";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -298,7 +298,7 @@ export class Client {
     // ----- write -----
     // `userId` is optional in every call below - omit it to use the client's default
     // store (set via `new Client({ apiKey, userId })` or `withUser`).
-    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01" }).
+    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01T00:00:00Z" } — RFC3339).
      * `metadata.speaker`: "me" = the assistant's own words, or a person's name (up to 50 per store). */
     add(content, userId, metadata = {}) {
         return this.post("/api/v1/memory/store", { user_id: this.uid(userId), content, metadata });
@@ -625,15 +625,24 @@ export class Client {
                 throw errorFor(res.status, msg, requestId);
             }
             if (!text)
-                return null;
+                return {};
+            let data;
             try {
-                return JSON.parse(text);
+                data = JSON.parse(text);
             }
             catch (e) {
                 // A 2xx with a corrupt body is a real failure — surface it, don't leak
                 // a raw SyntaxError (parity with the Rust SDK).
                 throw new WosError(res.status, `invalid JSON in response: ${e?.message ?? e}`);
             }
+            // Enforce a JSON OBJECT: every method reads the result with `.field`, so a
+            // body that parses to null / a number / a string / an array (a broken or
+            // hostile server) must be a clean WosError, not a `null.memories` TypeError.
+            if (data === null || typeof data !== "object" || Array.isArray(data)) {
+                const got = data === null ? "null" : Array.isArray(data) ? "array" : typeof data;
+                throw new WosError(res.status, `expected a JSON object in the response, got ${got}`);
+            }
+            return data;
         }
         throw new WosError(0, "retries exhausted"); // unreachable; keeps the compiler happy
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.16",
+  "version": "2.2.17",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",