wontopos 2.2.28 → 2.2.30

package/README.md

@@ -162,20 +162,28 @@ const mem = new Client({ apiKey: "...", baseUrl: "https://wos.your-host.com" });
 
 ## Changelog
 
-- **2.2.10** — `Memory` fix: the relevance field is `similarity` (not `score`,
-  which was never in the response); added typed `importance`, `category`,
-  `is_superseded`, `superseded_by`, `created_at`, `event_date`.
-- **2.2.9** — typed responses for every method (index-signature friendly) +
-  typed `SearchOptions`; security round 2: 64MB response cap, key/model-name
-  hygiene, `Client.fromEnv()`.
-- **2.2.8** — reliability + hardening: automatic retries (429/502/503 + connection
-  errors, backoff + jitter, honors `Retry-After`), redirects refused, key masked in
-  `toJSON`/inspect, `WosError.requestId`, guard against `delete()` without
-  `memoryId`, plain-HTTP warning, `User-Agent`.
-- **2.2.7** — speakers: `addSpeaker` / `listSpeakers` / `removeSpeaker`.
-- **2.2.6** — docs: `userId` = store, clarified everywhere.
-- **2.2.5** — docs: speakers + recall caching sections.
-- **2.2.4** — Python/TypeScript/Rust converge on one version; all three now
-  release in lockstep (same version, same surface). Patch releases are additive.
+The three clients release in lockstep — same version, same surface, same day.
+Patch releases are additive: nothing is removed or reordered within a minor line.
+
+- **2.2.30** — documentation only: this changelog, which had not been updated
+  in the shipped package since 2.2.10.
+- **2.2.29** — a store id that was PASSED but unusable no longer becomes the
+  default store. 2.2.28 caught a blank string; the value a failed tenant lookup
+  actually produces in JavaScript is `null` — and `String(null)` is the truthy
+  `"null"`, so it walked past the check and `null || default` sent the write to
+  the client's default store. `0` did the same. Anything but a non-blank string
+  now throws, on `deleteStore` / `deleteAll` too. Omitting the argument still
+  means "use the default". Also: `deleteStore` validates before it warns, so a
+  non-string no longer surfaces as a `TypeError` from inside the SDK.
+- **2.2.28** — audit: the API key no longer survives an object spread (`private`
+  is erased at runtime, so `{...client}` copied it), a whitespace `memoryId` can
+  no longer read as a whole-store delete, and a blank store id throws instead of
+  silently using the default.
+- **2.2.11–2.2.27** — additive fixes and hardening across all three clients.
+- **2.2.10** — `Memory` fix: the relevance field is `similarity` (not `score`);
+  added typed `importance`, `category`, `is_superseded`, `superseded_by`,
+  `created_at`, `event_date`.
+- **2.2.4–2.2.9** — one version across Python, TypeScript and Rust, released in
+  lockstep; retries, redirect refusal, response cap, key masking, speakers.
 
 License: MIT.

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.28";
+const VERSION = "2.2.30";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -448,9 +448,18 @@ export class Client {
         // tenant id and got nothing. Falling back there writes one customer's memories into
         // whatever store this client defaults to, silently. Omission is a choice; a blank
         // string is a bug, and it should say so where it happened.
-        if (userId !== undefined && !String(userId).trim()) {
-            throw new Error("userId was passed but is blank. Omit it to use the client's default store, or pass a real store id — " +
-                "a blank id would silently write into the default store.");
+        //
+        // The check is `typeof !== "string"`, not `!String(userId).trim()`. The old form
+        // only caught a blank STRING, and the value a failed lookup actually produces in
+        // JavaScript is `null` — `String(null)` is the truthy "null", so it sailed through
+        // the guard and then `null || default` sent the write to the client's default
+        // store. `0` (an integer primary key) did the same. Both are the exact outcome the
+        // guard was written to stop, and both were still silent.
+        //
+        // `undefined` alone means "omitted", because that is what an absent argument is.
+        if (userId !== undefined && (typeof userId !== "string" || !userId.trim())) {
+            throw new Error(`userId must be a non-blank string; got ${JSON.stringify(userId)}. Omit it to use the client's ` +
+                "default store, or pass a real store id — anything else would silently write into the default store.");
         }
         const id = userId || this.defaultUser;
         warnIfStoreIdCollapses(id);
@@ -682,9 +691,12 @@ export class Client {
     }
     /** Delete a store and ALL its memories. Returns `{ user_id, status }`. */
     deleteStore(userId) {
+        // Validate BEFORE warning. The warning helper lowercases the id, so a non-string
+        // used to die there as "id.toLowerCase is not a function" — the caller got a
+        // TypeError from our internals instead of being told what was wrong with the id.
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) — deleteStore never falls back to the default store.");
         warnIfStoreIdCollapses(userId); // destructive: the collision warning belongs here too
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) — deleteStore never falls back to the default store.");
         return this.request("DELETE", "/api/v1/memory/collection", { user_id: userId });
     }
     // ----- speakers (who said it) -----
@@ -722,8 +734,8 @@ export class Client {
     /** Delete ALL memories for a store (GDPR erase). `userId` is required on purpose -
      * this is destructive, so it never falls back to the default store. */
     deleteAll(userId) {
-        if (!userId || !userId.trim())
-            throw new Error("userId is required (non-blank) for deleteAll — a blank/whitespace id would wipe the default store.");
+        if (typeof userId !== "string" || !userId.trim())
+            throw new Error("userId is required (a non-blank string) for deleteAll — anything else would wipe the default store.");
         // These two take the store id directly instead of going through uid(), so the
         // collision warning — the one that says `Alice.Smith` and `alice_smith` are ONE
         // store — never fired on the two calls that DESTROY data. Erasing the wrong

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.28",
+  "version": "2.2.30",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",