wontopos 2.2.28 → 2.2.29

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.28";
+const VERSION = "2.2.29";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -448,9 +448,18 @@ export class Client {
         // tenant id and got nothing. Falling back there writes one customer's memories into
         // whatever store this client defaults to, silently. Omission is a choice; a blank
         // string is a bug, and it should say so where it happened.
-        if (userId !== undefined && !String(userId).trim()) {
-            throw new Error("userId was passed but is blank. Omit it to use the client's default store, or pass a real store id — " +
-                "a blank id would silently write into the default store.");
+        //
+        // The check is `typeof !== "string"`, not `!String(userId).trim()`. The old form
+        // only caught a blank STRING, and the value a failed lookup actually produces in
+        // JavaScript is `null` — `String(null)` is the truthy "null", so it sailed through
+        // the guard and then `null || default` sent the write to the client's default
+        // store. `0` (an integer primary key) did the same. Both are the exact outcome the
+        // guard was written to stop, and both were still silent.
+        //
+        // `undefined` alone means "omitted", because that is what an absent argument is.
+        if (userId !== undefined && (typeof userId !== "string" || !userId.trim())) {
+            throw new Error(`userId must be a non-blank string; got ${JSON.stringify(userId)}. Omit it to use the client's ` +
+                "default store, or pass a real store id — anything else would silently write into the default store.");
         }
         const id = userId || this.defaultUser;
         warnIfStoreIdCollapses(id);
@@ -682,9 +691,12 @@ export class Client {
     }
     /** Delete a store and ALL its memories. Returns `{ user_id, status }`. */
     deleteStore(userId) {
+        // Validate BEFORE warning. The warning helper lowercases the id, so a non-string
+        // used to die there as "id.toLowerCase is not a function" — the caller got a
+        // TypeError from our internals instead of being told what was wrong with the id.
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) — deleteStore never falls back to the default store.");
         warnIfStoreIdCollapses(userId); // destructive: the collision warning belongs here too
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) — deleteStore never falls back to the default store.");
         return this.request("DELETE", "/api/v1/memory/collection", { user_id: userId });
     }
     // ----- speakers (who said it) -----
@@ -722,8 +734,8 @@ export class Client {
     /** Delete ALL memories for a store (GDPR erase). `userId` is required on purpose -
      * this is destructive, so it never falls back to the default store. */
     deleteAll(userId) {
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) for deleteAll — a blank/whitespace id would wipe the default store.");
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) for deleteAll — anything else would wipe the default store.");
         // These two take the store id directly instead of going through uid(), so the
         // collision warning — the one that says `Alice.Smith` and `alice_smith` are ONE
         // store — never fired on the two calls that DESTROY data. Erasing the wrong

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.28",
+  "version": "2.2.29",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",