wontopos 2.2.29 → 2.2.30

package/README.md

@@ -162,20 +162,28 @@ const mem = new Client({ apiKey: "...", baseUrl: "https://wos.your-host.com" });
 
 ## Changelog
 
-- **2.2.10** — `Memory` fix: the relevance field is `similarity` (not `score`,
-  which was never in the response); added typed `importance`, `category`,
-  `is_superseded`, `superseded_by`, `created_at`, `event_date`.
-- **2.2.9** — typed responses for every method (index-signature friendly) +
-  typed `SearchOptions`; security round 2: 64MB response cap, key/model-name
-  hygiene, `Client.fromEnv()`.
-- **2.2.8** — reliability + hardening: automatic retries (429/502/503 + connection
-  errors, backoff + jitter, honors `Retry-After`), redirects refused, key masked in
-  `toJSON`/inspect, `WosError.requestId`, guard against `delete()` without
-  `memoryId`, plain-HTTP warning, `User-Agent`.
-- **2.2.7** — speakers: `addSpeaker` / `listSpeakers` / `removeSpeaker`.
-- **2.2.6** — docs: `userId` = store, clarified everywhere.
-- **2.2.5** — docs: speakers + recall caching sections.
-- **2.2.4** — Python/TypeScript/Rust converge on one version; all three now
-  release in lockstep (same version, same surface). Patch releases are additive.
+The three clients release in lockstep — same version, same surface, same day.
+Patch releases are additive: nothing is removed or reordered within a minor line.
+
+- **2.2.30** — documentation only: this changelog, which had not been updated
+  in the shipped package since 2.2.10.
+- **2.2.29** — a store id that was PASSED but unusable no longer becomes the
+  default store. 2.2.28 caught a blank string; the value a failed tenant lookup
+  actually produces in JavaScript is `null` — and `String(null)` is the truthy
+  `"null"`, so it walked past the check and `null || default` sent the write to
+  the client's default store. `0` did the same. Anything but a non-blank string
+  now throws, on `deleteStore` / `deleteAll` too. Omitting the argument still
+  means "use the default". Also: `deleteStore` validates before it warns, so a
+  non-string no longer surfaces as a `TypeError` from inside the SDK.
+- **2.2.28** — audit: the API key no longer survives an object spread (`private`
+  is erased at runtime, so `{...client}` copied it), a whitespace `memoryId` can
+  no longer read as a whole-store delete, and a blank store id throws instead of
+  silently using the default.
+- **2.2.11–2.2.27** — additive fixes and hardening across all three clients.
+- **2.2.10** — `Memory` fix: the relevance field is `similarity` (not `score`);
+  added typed `importance`, `category`, `is_superseded`, `superseded_by`,
+  `created_at`, `event_date`.
+- **2.2.4–2.2.9** — one version across Python, TypeScript and Rust, released in
+  lockstep; retries, redirect refusal, response cap, key masking, speakers.
 
 License: MIT.

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.29";
+const VERSION = "2.2.30";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.29",
+  "version": "2.2.30",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",