wontopos 2.2.27 → 2.2.29

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.27";
+const VERSION = "2.2.29";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -102,6 +102,8 @@ function normalizeStoreId(id) {
  *  oldest rather than refusing new ones means a collision that first shows up late
  *  still gets its one warning. */
 const WARNED_STORE_IDS_MAX = 1024;
+/** Same cap, same reason, for the unknown-filter warn set. */
+const WARNED_FILTER_KEYS_MAX = 1024;
 const warnedStoreIds = new Set();
 function warnIfStoreIdCollapses(id) {
     if (!id || warnedStoreIds.has(id))
@@ -309,6 +311,14 @@ function warnOnUnknownFilters(filters) {
         if (KNOWN_FILTER_KEYS.has(k) || warnedFilterKeys.has(k))
             continue;
         warnedFilterKeys.add(k);
+        // 2.2.27 capped the store-id warn set and left this sibling unbounded. An app that
+        // forwards user-supplied filter keys grows it forever, one entry per distinct typo.
+        while (warnedFilterKeys.size > WARNED_FILTER_KEYS_MAX) {
+            const oldest = warnedFilterKeys.values().next().value;
+            if (oldest === undefined)
+                break;
+            warnedFilterKeys.delete(oldest);
+        }
         console.warn(`wontopos: unknown search filter ${JSON.stringify(k)} — the API drops keys it does not know, ` +
             `so this filter has NO effect and the search is wider than you think. ` +
             `Known keys: ${[...KNOWN_FILTER_KEYS].join(", ")}.`);
@@ -386,11 +396,30 @@ export class Client {
         // An API key on plain HTTP travels readable by anyone on the path. Loopback
         // is fine (local dev / self-hosted on the same box); anything else gets a
         // warning, not an error, so private-network gateways keep working.
-        const host = this.base.replace(/^https?:\/\//i, "").split(/[/:]/)[0].toLowerCase();
+        // Parse, don't split. `http://127.0.0.1:9@evil.example` splits to "127.0.0.1" — the
+        // USERINFO, not the host — so this check called it loopback and stayed quiet while
+        // the key travelled in cleartext to evil.example. `new URL()` knows the difference.
+        // (Python already used urlsplit here; this was the copy that did not.)
+        let host;
+        try {
+            host = new URL(this.base).hostname.toLowerCase();
+        }
+        catch {
+            host = ""; // unparseable → not loopback → warn, which is the safe direction
+        }
         // Scheme compare is case-insensitive — `HTTP://` connects in plaintext too.
         if (/^http:\/\//i.test(this.base) && !LOOPBACK_HOSTS.has(host)) {
             console.warn("wontopos: baseUrl uses plain HTTP on a non-local host, so the API key travels unencrypted. Use https://.");
         }
+        // TypeScript `private` is erased at runtime: `apiKey` is an ordinary enumerable
+        // property, so `{...client}` copies it and `JSON.stringify({...client})` prints the
+        // key in full. The existing masking covers `JSON.stringify(client)` and
+        // `util.inspect(client)` — but spreading an object into a log record is the common
+        // shape in structured logging, and it went straight past both. Make the key and the
+        // prepared auth header non-enumerable so a spread cannot pick them up; they stay
+        // readable inside the class, which is all the code needs.
+        Object.defineProperty(this, "apiKey", { enumerable: false });
+        Object.defineProperty(this, "headers", { enumerable: false });
     }
     /** A client whose key comes from `WONTOPOS_API_KEY` (or `WOS_API_KEY`) — keeps
      * keys out of source code. Node/Bun/Deno-with-env only. */
@@ -414,6 +443,24 @@ export class Client {
     }
     /** Resolve a call's store: the explicit userId, else the client default. */
     uid(userId) {
+        // An OMITTED id means "use the client's default" — that is the documented shortcut.
+        // An id that was PASSED but is blank is a different thing: the caller computed a
+        // tenant id and got nothing. Falling back there writes one customer's memories into
+        // whatever store this client defaults to, silently. Omission is a choice; a blank
+        // string is a bug, and it should say so where it happened.
+        //
+        // The check is `typeof !== "string"`, not `!String(userId).trim()`. The old form
+        // only caught a blank STRING, and the value a failed lookup actually produces in
+        // JavaScript is `null` — `String(null)` is the truthy "null", so it sailed through
+        // the guard and then `null || default` sent the write to the client's default
+        // store. `0` (an integer primary key) did the same. Both are the exact outcome the
+        // guard was written to stop, and both were still silent.
+        //
+        // `undefined` alone means "omitted", because that is what an absent argument is.
+        if (userId !== undefined && (typeof userId !== "string" || !userId.trim())) {
+            throw new Error(`userId must be a non-blank string; got ${JSON.stringify(userId)}. Omit it to use the client's ` +
+                "default store, or pass a real store id — anything else would silently write into the default store.");
+        }
         const id = userId || this.defaultUser;
         warnIfStoreIdCollapses(id);
         return id;
@@ -644,8 +691,12 @@ export class Client {
     }
     /** Delete a store and ALL its memories. Returns `{ user_id, status }`. */
     deleteStore(userId) {
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) — deleteStore never falls back to the default store.");
+        // Validate BEFORE warning. The warning helper lowercases the id, so a non-string
+        // used to die there as "id.toLowerCase is not a function" — the caller got a
+        // TypeError from our internals instead of being told what was wrong with the id.
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) — deleteStore never falls back to the default store.");
+        warnIfStoreIdCollapses(userId); // destructive: the collision warning belongs here too
         return this.request("DELETE", "/api/v1/memory/collection", { user_id: userId });
     }
     // ----- speakers (who said it) -----
@@ -669,16 +720,27 @@ export class Client {
     delete(userId, memoryId) {
         // Guard: without a memory_id the API's forget endpoint means "delete the
         // whole store". An undefined/"" slipping in here must never become a wipe.
-        if (!memoryId || typeof memoryId !== "string") {
-            throw new Error("memoryId is required. To delete every memory in a store, call deleteAll(userId) explicitly.");
+        //
+        // `.trim()` matters as much as the emptiness check: "   " is truthy, so it used to
+        // pass this guard and travel as memory_id. A server that trims it back to nothing
+        // reads the request as the whole-store form — the single most destructive way for
+        // this SDK to be wrong. `deleteAll` below already trimmed; the more dangerous path
+        // was the one that did not.
+        if (typeof memoryId !== "string" || !memoryId.trim()) {
+            throw new Error("memoryId is required (non-blank). To delete every memory in a store, call deleteAll(userId) explicitly.");
         }
-        return this.post("/api/v1/memory/forget", { user_id: this.uid(userId), memory_id: memoryId });
+        return this.post("/api/v1/memory/forget", { user_id: this.uid(userId), memory_id: memoryId.trim() });
     }
     /** Delete ALL memories for a store (GDPR erase). `userId` is required on purpose -
      * this is destructive, so it never falls back to the default store. */
     deleteAll(userId) {
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) for deleteAll — a blank/whitespace id would wipe the default store.");
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) for deleteAll — anything else would wipe the default store.");
+        // These two take the store id directly instead of going through uid(), so the
+        // collision warning — the one that says `Alice.Smith` and `alice_smith` are ONE
+        // store — never fired on the two calls that DESTROY data. Erasing the wrong
+        // tenant's memories is exactly the outcome that warning exists to prevent.
+        warnIfStoreIdCollapses(userId);
         return this.post("/api/v1/memory/forget", { user_id: userId });
     }
     // ----- internal -----

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.27",
+  "version": "2.2.29",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",