wontopos 2.2.45 → 2.2.47

package/dist/wontopos.js

@@ -1,4 +1,4 @@
-const VERSION = "2.2.45";
+const VERSION = "2.2.47";
 const RUNTIME = (() => {
     const p = globalThis?.process;
     return p?.version ? ` (node/${p.version}; ${p.platform}-${p.arch})` : "";
@@ -263,12 +263,7 @@ const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "
 const IMF_FIXDATE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) ([A-Z][a-z]{2}) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
 const RFC850_DATE = /^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-([A-Z][a-z]{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
 const ASCTIME_DATE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) ([A-Z][a-z]{2}) ([ \d]\d) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
-function retryAfterMs(v, now = Date.now()) {
-    if (v == null)
-        return undefined;
-    const s = v.trim();
-    if (/^\d+$/.test(s))
-        return Math.min(Number(s), Number.MAX_SAFE_INTEGER / 1000) * 1000;
+function httpDateMs(s, now = Date.now()) {
     let parts;
     let m;
     if ((m = IMF_FIXDATE.exec(s)))
@@ -288,7 +283,37 @@ function retryAfterMs(v, now = Date.now()) {
     const d = Number(day), h = Number(hh), mi = Number(mm), se = Number(ss);
     if (month < 0 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60)
         return undefined;
-    return Math.max(0, Date.UTC(year, month, d, h, mi, se) - now);
+    return Date.UTC(year, month, d, h, mi, se);
+}
+function retryAfterMs(v, now = Date.now()) {
+    if (v == null)
+        return undefined;
+    const s = v.trim();
+    if (/^\d+$/.test(s))
+        return Math.min(Number(s), Number.MAX_SAFE_INTEGER / 1000) * 1000;
+    const at = httpDateMs(s, now);
+    return at === undefined ? undefined : Math.max(0, at - now);
+}
+const warnedRetirements = new Set();
+const WARNED_RETIREMENTS_MAX = 64;
+function warnIfRetiring(model, h) {
+    const v = h.get("Sunset");
+    if (!v)
+        return;
+    const at = httpDateMs(v.trim());
+    if (at === undefined)
+        return;
+    const day = new Date(at).toISOString().slice(0, 10);
+    const k = `${model}|${day}`;
+    if (warnedRetirements.has(k) || warnedRetirements.size >= WARNED_RETIREMENTS_MAX)
+        return;
+    warnedRetirements.add(k);
+    const which = model ? `model ${JSON.stringify(model)}` : "the model this client uses";
+    console.warn(`wontopos: ${which} retires on ${day} (UTC). From then on its calls answer 410, except ` +
+        "deleteStore. listModels() lists the models you can move to.");
+}
+export function _resetRetirementWarnings() {
+    warnedRetirements.clear();
 }
 const BRIEF_BODY_MS = 1_000;
 class SlowBody extends Error {
@@ -313,6 +338,23 @@ function tryUrl(s, base) {
         return undefined;
     }
 }
+function inBrowserPage() {
+    try {
+        const g = globalThis;
+        return typeof g.window !== "undefined" && typeof g.window.document !== "undefined" && typeof g.navigator !== "undefined";
+    }
+    catch {
+        return false;
+    }
+}
+function isServiceHost(host) {
+    const h = host.toLowerCase();
+    return h === "wontopos.com" || h.endsWith(".wontopos.com");
+}
+const BROWSER_REFUSAL = "wontopos: refusing to run in a browser page. The API key would be readable by anyone who " +
+    "opens the page, and with it every memory in its workspace. Call Wontopos from your server, " +
+    "or put a proxy of your own in front of it and point baseUrl there. For a local demo with a " +
+    "key you will revoke, pass dangerouslyAllowBrowser: true.";
 function pageHref() {
     try {
         const href = globalThis.location?.href;
@@ -389,6 +431,18 @@ const memoryFromGet = (r) => {
         return o.memory;
     return typeof o.id === "string" ? o : {};
 };
+function recallShape(r) {
+    const o = asObj(r);
+    const st = asObj(o.short_term);
+    const lt = asObj(o.long_term);
+    const cx = asObj(o.context);
+    return {
+        ...o,
+        short_term: { ...st, turns: asRecords(st.turns) },
+        long_term: { ...lt, memories: asRecords(lt.memories) },
+        context: { ...cx, around_top_memory: asList(cx.around_top_memory).filter((x) => typeof x === "string") },
+    };
+}
 function mergeResults(r) {
     const out = asRecords(r?.memories);
     const seen = new Set(out.map((m) => m.id).filter((id) => typeof id === "string"));
@@ -553,6 +607,15 @@ function writeKey(opts, takesImage = false) {
         (takesImage ? "add takes idempotencyKey and image." : "This call takes idempotencyKey only."));
     return opts.idempotencyKey;
 }
+function newIdempotencyKey() {
+    const c = globalThis.crypto;
+    if (typeof c?.randomUUID === "function")
+        return `sdk-${String(c.randomUUID()).replace(/-/g, "")}`;
+    let hex = "";
+    for (let i = 0; i < 4; i++)
+        hex += Math.floor(Math.random() * 0x100000000).toString(16).padStart(8, "0");
+    return `sdk-${hex}`;
+}
 function warnOnUnknownFilters(filters) {
     warnOnceUnknownKeys(filters, KNOWN_FILTER_KEYS, warnedFilterKeys, (k) => `wontopos: unknown search filter ${JSON.stringify(k)} — the API drops keys it does not know, ` +
         `so this filter has NO effect and the search is wider than you think. ` +
@@ -581,6 +644,7 @@ export class Client {
     userinfo;
     pageRelative;
     customFetch;
+    allowBrowser;
     defaultUser;
     _rateLimit = null;
     get rateLimit() {
@@ -614,6 +678,10 @@ export class Client {
             throw new Error(notAUrl(trimmed));
         this.pageRelative = !url;
         this.userinfo = Boolean(parsed.username || parsed.password);
+        this.allowBrowser = opts.dangerouslyAllowBrowser === true;
+        if (!this.allowBrowser && inBrowserPage() && isServiceHost(parsed.hostname)) {
+            throw new Error(BROWSER_REFUSAL);
+        }
         this.timeoutMs = checkMs(opts.timeoutMs) ?? 30_000;
         this.model = opts.model ?? DEFAULT_MODEL;
         if (this.model && !MODEL_RE.test(this.model)) {
@@ -682,6 +750,7 @@ export class Client {
             fetch: this.fetchImpl,
             deadlineMs: this.deadlineMs,
             signal: this.signal,
+            dangerouslyAllowBrowser: this.allowBrowser,
             ...overrides,
         });
     }
@@ -713,22 +782,22 @@ export class Client {
         if (opts.image !== undefined)
             body.image = normalizeImage(opts.image);
         warnOnUnknownMetadata(metadata);
-        return this.post("/api/v1/memory/store", body, writeKey(opts, true));
+        return this.write("/api/v1/memory/store", body, writeKey(opts, true));
     }
     async store(content, userId, metadata = {}, opts = {}) {
         return this.add(content, userId, metadata, opts);
     }
     async addTurn(userMsg, assistantMsg, userId, opts = {}) {
-        return this.post("/api/v1/memory/store-turn", { user_id: this.uid(userId), user_msg: userMsg, assistant_msg: assistantMsg }, writeKey(opts));
+        return this.write("/api/v1/memory/store-turn", { user_id: this.uid(userId), user_msg: userMsg, assistant_msg: assistantMsg }, writeKey(opts));
     }
     async addBulk(content, userId, category = "general", timestamp, opts = {}) {
         const body = { user_id: this.uid(userId), content, category: category ?? "general" };
         if (timestamp)
             body.timestamp = timestamp;
-        return this.post("/api/v1/memory/bulk-store", body, writeKey(opts));
+        return this.write("/api/v1/memory/bulk-store", body, writeKey(opts));
     }
     async update(oldMemoryId, newContent, userId, opts = {}) {
-        return this.post("/api/v1/memory/supersede", { user_id: this.uid(userId), old_memory_id: oldMemoryId, new_content: newContent }, writeKey(opts));
+        return this.write("/api/v1/memory/supersede", { user_id: this.uid(userId), old_memory_id: oldMemoryId, new_content: newContent }, writeKey(opts));
     }
     async search(query, userId, limit = 10, opts = {}) {
         checkSearchOpts(opts);
@@ -773,7 +842,7 @@ export class Client {
             checkContextLimit(opts.context_limit);
             body.context_limit = opts.context_limit;
         }
-        return this.post("/api/v1/memory/recall", withForm(body, opts.form, opts.tz));
+        return recallShape(await this.post("/api/v1/memory/recall", withForm(body, opts.form, opts.tz)));
     }
     async engram(name, query, userId, opts = {}) {
         checkOpts(opts, KNOWN_ENGRAM_KEYS, "engram");
@@ -978,8 +1047,12 @@ export class Client {
         warnIfStoreIdCollapses(userId);
         return this.post("/api/v1/memory/forget", { user_id: userId });
     }
-    post(path, body, idempotencyKey) {
-        return this.request("POST", path, body, idempotencyKey);
+    post(path, body) {
+        return this.request("POST", path, body);
+    }
+    write(path, body, idempotencyKey) {
+        const made = idempotencyKey == null;
+        return this.request("POST", path, body, made ? newIdempotencyKey() : idempotencyKey, false, made);
     }
     remove(path, body) {
         return this.request("DELETE", path, body, undefined, true);
@@ -1097,8 +1170,9 @@ export class Client {
         }
         const attempts = this.maxRetries + 1;
         const upper = method.toUpperCase();
-        const idempotent = IDEMPOTENT_METHODS.has(upper);
         const logPath = path.split("?")[0];
+        const idempotent = IDEMPOTENT_METHODS.has(upper) || reads || (upper === "POST" && READ_POSTS.has(logPath));
+        const replaySafe = idempotent || extraHeaders?.["Idempotency-Key"] !== undefined;
         const deadlineAt = this.deadlineAt();
         const headers = extraHeaders ? { ...this.headers, ...extraHeaders } : this.headers;
         let ambiguous = false;
@@ -1119,7 +1193,7 @@ export class Client {
             };
             const cutShort = () => {
                 const why = att.why();
-                if (why === "deadline" && (idempotent || reads || (upper === "POST" && READ_POSTS.has(logPath))) && previous) {
+                if (why === "deadline" && idempotent && previous) {
                     return previous;
                 }
                 return new APIConnectionError(0, this.abortMessage(why));
@@ -1140,7 +1214,7 @@ export class Client {
                 if (timedOut)
                     throw cutShort();
                 const connect = isConnectFailure(e);
-                if ((idempotent || connect) && !last) {
+                if ((replaySafe || connect) && !last) {
                     if (!connect)
                         ambiguous = true;
                     await pauseWithoutAnswer(e?.code ?? e?.name ?? "network error");
@@ -1157,7 +1231,7 @@ export class Client {
                         throw cutShort();
                     if (e instanceof WosError)
                         throw e;
-                    if (idempotent && !last)
+                    if (replaySafe && !last)
                         return null;
                     throw this.networkError(e, path);
                 }
@@ -1184,9 +1258,10 @@ export class Client {
                     throw new WosError(res.status, "unexpected redirect — refused (the API key never follows a redirect). Check baseUrl: exact host, https://.");
                 }
                 this._rateLimit = parseRateLimit(res.headers) ?? this._rateLimit;
+                warnIfRetiring(this.model, res.headers);
                 if (!res.ok) {
                     const ra = retryAfterMs(res.headers.get("Retry-After"));
-                    let wait = RETRY_ALWAYS.has(res.status) || (RETRY_IF_IDEMPOTENT.has(res.status) && idempotent)
+                    let wait = RETRY_ALWAYS.has(res.status) || (RETRY_IF_IDEMPOTENT.has(res.status) && replaySafe)
                         ? ra ?? this.backoffMs(attempt)
                         : undefined;
                     const retrying = wait !== undefined && !last && wait <= MAX_RETRY_WAIT_MS && this.fits(wait, deadlineAt);
@@ -1313,7 +1388,7 @@ export class Client {
             clearTimeout(timer);
         }
     }
-    async request(method, path, body, idempotencyKey, removes = false) {
+    async request(method, path, body, idempotencyKey, removes = false, madeKey = false) {
         const extraHeaders = this.idemHeader(idempotencyKey);
         let payload;
         try {
@@ -1341,7 +1416,7 @@ export class Client {
             const got = data === null ? "null" : Array.isArray(data) ? "array" : typeof data;
             throw new WosError(res.status, `expected a JSON object in the response, got ${got}`);
         }
-        if (res.headers.get("Idempotent-Replayed") === "true" && !("replayed" in data)) {
+        if (!madeKey && res.headers.get("Idempotent-Replayed") === "true" && !("replayed" in data)) {
             data.replayed = true;
         }
         return data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.45",
+  "version": "2.2.47",
   "description": "Wontopos \u2014 long-term memory for AI agents. Identical recall in every language, ~100\u00d7 lower LLM bill.",
   "keywords": [
     "memory",