chore(release): version packages

packages/vecstore-sdk/CHANGELOG.md

@@ -1,5 +1,16 @@
 # vecstore-sdk
 
+## 0.1.3
+
+### Patch Changes
+
+- 14b3025: Match array-valued metadata the way the docs describe on pgvector and Supabase. `eq("tags", "x")` and `isIn("tags", ["x"])` compiled to a jsonb containment that never matches a list, so a record with `tags: ["x", "y"]` was invisible to both, and `isIn` on a list field meant "the list is a subset of the values", which nothing documented. Both compilers, the TypeScript one and `vecstore_filter_sql`, now emit `metadata @> '{"tags":"x"}' OR metadata @> '{"tags":["x"]}'` per value, which the GIN index serves, and `ne` and `notIn` are the exact negations, so they still match records that lack the field. Re-run `sql/supabase.sql` to pick up the new `vecstore_filter_sql` and its helper `vecstore_contains_any`. Qdrant `notIn` now compiles to `must_not` of `match.any`, the same filter `not(isIn(...))` produces, instead of `match.except`, which matched a list as soon as one element fell outside the values.
+- 76fb14d: Send batched provider calls four at a time instead of all at once. A 100k-record upsert used to open every chunk in one burst, which met rate limits on Pinecone, Upstash, and Supabase and took every connection of a `pg` Pool. An upsert that repeats an id now keeps the last record on Qdrant, Pinecone, Upstash, and Vectorize too; before, copies in different chunks raced. Pinecone `delete({ ids })` is chunked at 1,000, Redis `fetch` splits `JSON.MGET` at 500, and Redis delete-by-filter stops paging when a page unlinks nothing. Every adapter's `query` returns `invalid_argument` for a `topK` that is not a positive integer.
+- 0f0c636: Forget the cached pgvector metric when `createIndex` or `deleteIndex` touches a table, so a store that dropped and recreated an index with another metric, or queried before the table existed, no longer orders and scores with the stale one. Reject Postgres index names over 49 bytes on pgvector and Supabase with `invalid_argument`. Postgres truncates identifiers at 63 bytes, and the `_embedding_idx` suffix made long names collide with their own indexes or vanish from the metric lookup. The pgvector `createIndex` statement now uses a tagged dollar quote, so a name holding `$$` fails with a clear error instead of an unterminated statement. Re-run `sql/supabase.sql` to install the length check.
+- 0a33d23: Harden `sql/supabase.sql`. `vecstore_create_index` now enables row level security on the table it creates, so the `anon` and `authenticated` roles read and write nothing until you add a policy; the service role bypasses it as before. Tables created by earlier versions are unchanged: run `alter table "docs" enable row level security` on them. The script also revokes `vecstore_create_index` and `vecstore_drop_index` from `anon` and `authenticated` on Supabase, and `vecstore_filter_sql` rejects a filter leaf with a missing or non-numeric value with `invalid_argument` instead of dropping the clause, which could widen a delete. Re-run `sql/supabase.sql` to pick these up.
+- 85b28f3: Ship the MIT LICENSE inside the npm tarball, and require `@pinecone-database/pinecone` 7 or later, the first version with the object-parameter `upsert`, `fetch`, `query`, and `deleteMany` calls the adapter uses. Version 6 satisfied the old peer range and failed at runtime.
+- 52967ed: Close the last paths where a write in the default namespace could replace a record in another namespace. On Upstash in metadata mode, a default-namespace `upsert` whose id has the `{namespace}/{length}/{id}` shape of a stored namespaced record now returns `invalid_argument`; before, `docs/3/abc` overwrote record `abc` in namespace `docs` and moved it to the default namespace. On Qdrant and Vectorize, a raw default-namespace id that is a version 8 UUID, the version the adapter's hashed ids use, is now hashed like every other id, so no raw id can equal another record's stored id. A version 8 UUID written as a raw id by an earlier version has to be re-upserted. Vectorize `fetch` from a namespaced handle now drops a vector that reports no namespace, the way the Qdrant adapter already did.
+
 ## 0.1.2
 
 ### Patch Changes

packages/vecstore-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vecstore-sdk",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "A unified vector store SDK for TypeScript. One filter language across Qdrant, pgvector, Pinecone, Supabase, Upstash Vector, Cloudflare Vectorize, and Redis, so you can switch providers without rewriting queries.",
   "keywords": [
     "cloudflare",