@curviate/sdk 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -7,6 +7,98 @@ Versioning: semantic — minor for additive changes, patch for bug fixes; no sta
 
 ---
 
+## [0.15.0] — 2026-07-11
+
+Full v2 parity. The SDK is re-aligned 1:1 to the served API surface: every
+operation is now exactly one method at the exact wire encoding, the entire
+account-scoped surface moves to the account-first path grammar, and three
+namespaces are reorganized. This is a **breaking** release touching nearly
+every namespace. The five breaking categories below — removals, namespace
+reorganization, method renames/relocations, request/response shape changes, and
+the account-first path-grammar migration — are the complete set of breaks a
+`0.14.1` → `0.15.0` upgrade must reconcile, gathered here so a consumer finds
+every break in one place.
+
+### Removed (BREAKING)
+
+- **14 methods that map to no served operation are removed, with no alias:**
+  - `accounts.createConnectLink()`, `accounts.createReconnectLink()`, `accounts.reconnect()` — hosted connect/reconnect link minting and in-place reconnect are no longer part of the API surface.
+  - `messaging.syncChat()`, `messaging.syncMessages()`, `recruiter.syncMessages()`, `salesNavigator.syncMessages()` — explicit sync operations are gone; accounts sync continuously and deliver via webhooks.
+  - `posts.list()` — the standalone feed list has no served operation (use `posts.listUserPosts(userId)` for a member's posts).
+  - `companies.followers()` — no served operation.
+  - `recruiter.addApplicant()`, `recruiter.rejectApplicant()`, `recruiter.solveJobCheckpoint()` — superseded by the project-centric pipeline surface.
+  - `webhooks.getStateDiff()` — no served operation.
+- **`invites.respond()` is removed** — split into two dedicated bodyless methods, `invites.accept(invitationId)` and `invites.decline(invitationId)` (see below).
+- **`profiles.getCompany()` stays removed** — dropped ahead of this release with no return; company reads live on the `companies` namespace.
+
+### Changed (BREAKING) — namespaces reorganized
+
+- **`profiles` namespace renamed to `users`.** Every `curviate.account(id).profiles.*` call becomes `…users.*`; the served group is "Users" and every path is `/users/{user_id}`.
+- **New root-scoped `auth` namespace, split out of `accounts`.** The connect/checkpoint operations move off `accounts`: `accounts.link` → `auth.intent`, `accounts.solveCheckpoint` → `auth.solveCheckpoint`, plus `auth.requestCheckpoint`, `auth.pollCheckpoint`, and `accounts.getConnectSession` → `auth.getSession(sessionId)`. `accounts` now carries only `list` / `get` / `update` / `disconnect`.
+- **New account-scoped `comments` namespace.** The comment-thread surface (create / edit / delete / reply / list replies / reactions) plus the relocated `listUserComments` live here rather than on `posts`.
+- **Root and account surfaces are now strictly disjoint.** The root client exposes only `accounts`, `auth`, `webhooks`. Every other namespace is reachable exclusively through `curviate.account(id)` — the account-scoped namespaces are no longer mounted on the root client (they cannot build a valid path without a bound `account_id`).
+
+### Changed (BREAKING) — methods renamed / relocated
+
+- `profiles.endorse(userId, { skill_endorsement_id })` → **`users.endorseSkill(userId, { endorsement_id })`** — renamed, and the body key changed from `skill_endorsement_id` to `endorsement_id`.
+- `profiles.listConnections()` → **`users.listRelations()`**.
+- `messaging.getInMailBalance()` → **`users.getInMailCredits()`** (relocated onto `users`).
+- `posts.comment(postId, …)` → **`comments.create(postId, …)`**.
+- `profiles.listComments(userId)` → **`comments.listUserComments(userId)`**.
+- `profiles.listPosts(userId)` → **`posts.listUserPosts(userId)`**.
+- `profiles.listReactions(userId)` → **`posts.listUserReactions(userId)`**.
+- `invites.respond(...)` → **`invites.accept(invitationId)` / `invites.decline(invitationId)`** (split; both bodyless).
+- `recruiter.addCandidate(...)` → **`recruiter.saveCandidate(projectId, { stage_id, candidate_id })`**.
+- `recruiter.getParameters(...)` (GET) → **`recruiter.searchParameters(body)` (POST)** — the HTTP verb changed GET→POST, with a `source`-discriminated body.
+- `recruiter.listProjectJobs(projectId)` → **`recruiter.getProjectJob(projectId)`** — the operation returns the single attached job posting, not a list.
+
+### Changed (BREAKING) — request / response shapes
+
+- **`users.update(userId, body)`** never sends `description`; accepted keys are `{ first_name, last_name, headline, bio, skills, picture, background_picture }`.
+- **`users.endorseSkill`** body key is `endorsement_id` (was `skill_endorsement_id`).
+- **`jobs.publish` / `recruiter.publishJob`** take a `mode`-discriminated body (`FREE` | `PROMOTED` | `PROMOTED_PLUS`; the `PROMOTED*` modes require a `budget { currency, amount, scope }`) and respond `{ object, job_state }`.
+- **`jobs.close` / `recruiter.closeJob`** are bodyless POSTs responding `{ object }`.
+- **`invites.cancel`** withdrawal now discriminates on `invitation_withdrawn`.
+- **Message operations are re-homed under the chat.** `getMessage` / `editMessage` / `deleteMessage` / `addReaction` / `getAttachment` now path under `/chats/{chat_id}/messages/…` and take `chatId` as the leading argument.
+- **`messaging.sendInMail`** body drops the `surface` field.
+- **Media-bearing writes moved from multipart to JSON + base64** where the surface retired multipart (recruiter, sales-navigator, posts, messaging); read each operation's declared content-type — some remain multipart.
+- **Sales Navigator `saveAccount` / `saveLead` bodies shrank** to the minimal saved-entity shape.
+- **`recruiter.startChat`** now requires a `signature` (alongside `attendees_ids`, `text`, `subject`).
+- **`recruiter.createJob`** now requires `project_name` and responds `{ job_id, object, project_id }` (was a full job object).
+- **`recruiter.saveCandidate`** body is `{ stage_id, candidate_id }`.
+
+### Changed (BREAKING) — account-first path grammar
+
+- **Every account-scoped method now carries `account_id` as the leading path segment** (`/v1/{account_id}/…`), never as a query parameter, body field, or omitted. Bind it once with `curviate.account(id)` and it is injected on every call. Companies and relations, which previously carried `account_id` as a query argument, drop it entirely.
+
+### Added
+
+- **`comments` namespace (9 methods):** `listUserComments`, `create`, `edit`, `delete`, `reply`, `listReplies`, `listReactions`, `addReaction`, `removeReaction` — `removeReaction` is a DELETE that carries a `{ reaction }` body.
+- **`jobs` write surface (9 new methods):** `list`, `create`, `update`, `getBudget`, `publish`, `close`, `listApplicants`, `getApplicant`, `downloadResume` (binary `ArrayBuffer`). `jobs.create` takes object-shaped `job_title` / `company` and a `method`-discriminated `apply_method`.
+- **Project-centric `recruiter` surface (9 new methods):** `searchTalentPool`, `searchFromUrl`, `updateProject`, `listPipeline`, `getProjectJob`, `createProjectJob`, `getProjectJobBudget`, `updateProjectJob`, `closeJob`, with `getApplicant` / `downloadResume` re-homed under the project scope.
+- **`users.follow` / `users.unfollow`** (bodyless POST / DELETE), **`users.listFollowing`**, **`users.update`**.
+- **`messaging.markChatRead(chatId, { read })`**.
+- **`search.fromUrl({ url })`** and **`salesNavigator.searchFromUrl({ url })`** — resolve a LinkedIn search-results URL into a search.
+- **`posts.delete`** (bodyless, 204) and **`posts.unreact(postId, { reaction })`** (DELETE with body).
+- **`users.get(userId)` accepts `'me'`** — `users.get('me')` reads the caller's own profile (folds in the old `getMe`).
+- **New `ErrorCode` value: `LINKEDIN_OPERATION_NOT_SUPPORTED`.** The `422` a permanent LinkedIn platform limitation for the attempted operation returns (e.g. listing a non-self user's following list) — `user_fixable: true`, `retry_likely_to_succeed: false` (not a transient failure; retrying will not help). Added to the `ErrorCode` union and the transport's known-code set — previously this narrowed to `INTERNAL`, which is retryable.
+
+### Fixed
+
+- **`CONNECTION_REQUEST_CONFLICT` was silently downgraded to `INTERNAL`.** The `409` the API returns when a connect-request to a member already exists (or you are already a first-degree connection) is a real, documented error code, but the transport's runtime known-code set omitted it — so callers received `code: "INTERNAL"` with the wrong semantics (`INTERNAL` is retryable, whereas this conflict is `user_fixable: true`, `retry_likely_to_succeed: false` and must never be re-sent). The transport now decodes `CONNECTION_REQUEST_CONFLICT` to itself. To eliminate the class of bug: the `ErrorCode` type and the transport's runtime known-code set are now both **derived from one source array**, so the code a caller narrows on and the code the transport recognizes can never drift apart again.
+- **`RATE_LIMITED` was silently downgraded to `INTERNAL`.** The `429` the Recruiter and Sales Navigator read surface returns under LinkedIn-platform throttling (dedicated `RateLimit-Policy` / `RateLimit` / `Retry-After` response headers, `retry_likely_to_succeed: true`) is a real, documented error code, but the transport's runtime known-code set omitted it — so callers received `code: "INTERNAL"`, which happened to auto-retry on `GET`/`HEAD` by accident but with the wrong (generic backoff) delay instead of honoring `Retry-After`. The transport now decodes `RATE_LIMITED` to itself and retries it on `GET`/`HEAD` like the other rate-limit codes, honoring `Retry-After`.
+- **`users.update` forwarded an unsupported `description` key if a caller smuggled one in.** The `UserUpdateBody` type never declared `description`, so a typed caller was already rejected at compile time — but an untyped/JS caller (or an `as`-cast) could still put it on the object, and `update()` forwarded the body verbatim with no runtime check. `update()` now strips `description` from the outgoing payload before the request is sent, regardless of caller strictness.
+
+---
+
+## [0.14.1] — 2026-07-07
+
+### Fixed
+
+- **`constructEvent` examples referenced a wrong header name (`X-Curviate-Signature` → `Curviate-Signature`); corrected a stale default-count description.** The JSDoc and both code examples (Express/Node, Hono) for `constructEvent` named the header `X-Curviate-Signature`; the dispatcher actually sends `Curviate-Signature` (Node lowercases it to `curviate-signature` on `req.headers`), so integrators copying the examples verbatim got `undefined` for the signature header. Also corrected the generated `events` field description on the webhook-create schema from a stale "default: all 7" to "default: all 11 lifecycle events", matching the account_status catalogue.
+
+---
+
 ## [0.14.0] — 2026-07-07
 
 Webhooks surface re-based onto the v2 catalogue. Additive minor: one new method,

package/README.md

@@ -3,7 +3,7 @@
 The official TypeScript SDK for the [Curviate API](https://docs.curviate.com) — agent-native
 LinkedIn infrastructure for AI engineers and agent builders.
 
-> **Status:** `0.1.0` — pre-GA. The surface is public but not yet stability-promised.
+> **Status:** `0.15.0` — pre-1.0. Full v2 API parity; the surface is public but not yet stability-promised.
 
 ---
 
@@ -37,10 +37,10 @@ const curviate = new Curviate({
 
 ## Account-scoped accessor
 
-Every LinkedIn operation (messages, profiles, invites, posts) is tied to a **managed account** — a LinkedIn session you have connected via `curviate.accounts.link()`. The `curviate.account(id)` accessor fixes the `account_id` on every call so you do not have to thread it manually:
+Every LinkedIn operation (messages, member profiles, invites, posts) is tied to a **managed account** — a LinkedIn session you have connected via the connect flow (`curviate.auth.intent()`). The `curviate.account(id)` accessor fixes the `account_id` on every call so you do not have to thread it manually:
 
 ```ts
-// Root-level: tenant-wide operations
+// Root-level: tenant-wide operations (accounts, auth, webhooks)
 const { items: accounts } = await curviate.accounts.list();
 
 // Account-scoped: all LinkedIn ops under a specific account
@@ -48,7 +48,8 @@ const acc = curviate.account(accounts?.[0]?.account_id ?? "");
 
 // Now every resource call is scoped to that account:
 const { items: chats } = await acc.messaging.listChats();
-const profile = await acc.profiles.get("some-profile-id");
+const me = await acc.users.get("me");           // your own profile
+const profile = await acc.users.get("some-user-id"); // someone else's
 ```
 
 ---
@@ -131,7 +132,7 @@ Resources that return lists support cursor pagination. `curviate.paginate()` is
 ```ts
 // Iterate over every chat across all pages
 for await (const chat of curviate.paginate(acc.messaging.listChats.bind(acc.messaging), {})) {
-  console.log(chat.id, chat.unread_count);
+  console.log(chat.id);
 }
 
 // With initial params
@@ -154,7 +155,7 @@ import { constructEvent, WebhookSignatureError } from "@curviate/sdk";
 
 // Express (Node 18+)
 app.post("/webhook", express.raw({ type: "application/json" }), async (req, res) => {
-  const sig = req.headers["x-curviate-signature"] as string;
+  const sig = req.headers["curviate-signature"] as string;
   const secret = process.env.CURVIATE_WEBHOOK_SECRET!;
 
   let event;
@@ -185,7 +186,7 @@ app.post("/webhook", express.raw({ type: "application/json" }), async (req, res)
 // Hono / Vercel Edge — always await (Web Crypto is async)
 app.post("/webhook", async (c) => {
   const rawBody = await c.req.text();
-  const event = await constructEvent(rawBody, c.req.header("x-curviate-signature")!, secret);
+  const event = await constructEvent(rawBody, c.req.header("curviate-signature")!, secret);
   return c.text("ok");
 });
 ```