@nurama/sdk 1.4.2 → 1.4.4

package/src/routes/auth.ts

@@ -9,6 +9,12 @@ import {
   type LinkedAuthProvider,
   type OAuthExchangeRequest,
   type OAuthExchangeResponse,
+  type Passkey,
+  type PasskeyRegistrationProof,
+  type PasskeyCredentialOptions,
+  type PasskeyCredentialResponse,
+  type PasskeyDesktopLoginRequest,
+  type PasskeyDesktopLoginResponse,
 } from '@nurama/types';
 
 // Define specific types for auth requests
@@ -468,6 +474,134 @@ export default function createAuthMethods(client: NuramaClient) {
       return result;
     },
 
+    /**
+     * Gets the options for the browser's passkey sign-in prompt. Pass them to the WebAuthn library
+     * (`startAuthentication` in @simplewebauthn/browser), then send its result to `loginWithPasskey`.
+     * @param origin - The web origin to sign in for, from a native app (which has no browser `Origin`); pass the
+     *   same one to `loginWithPasskey`. Browsers send their own and ignore this.
+     * @returns Promise resolving to WebAuthn request options.
+     */
+    async getPasskeyLoginOptions(origin?: string): Promise<PasskeyCredentialOptions> {
+      return client._request<PasskeyCredentialOptions>({
+        endpoint: "/v1/auth/passkeys/login-options",
+        method: "POST",
+        sendJWT: false,
+        ...(origin ? { customHeaders: { Origin: origin } } : {}),
+      });
+    },
+
+    /**
+     * Signs in with the browser's response to the passkey prompt and stores the tokens.
+     * A passkey stands in for two-factor, so this never returns an MFA challenge.
+     * @param credential - The WebAuthn library's AuthenticationResponseJSON.
+     * @param origin - From a native app: the origin passed to `getPasskeyLoginOptions`.
+     * @returns Promise resolving to the user and tokens.
+     */
+    async loginWithPasskey(credential: PasskeyCredentialResponse, origin?: string): Promise<LoginRegisterResponse> {
+      const result: LoginRegisterResponse = await client._request({
+        endpoint: "/v1/auth/passkeys/login",
+        method: "POST",
+        body: { credential },
+        sendJWT: false,
+        ...(origin ? { customHeaders: { Origin: origin } } : {}),
+      });
+      (client as any)._setTokens(
+        result.tokens.access.token,
+        result.tokens.refresh.token,
+        result.tokens.access.expires,
+        result.tokens.refresh.expires
+      );
+      return result;
+    },
+
+    /**
+     * Signs the desktop app in with a passkey, from the browser. Stores nothing: the tokens wait behind the
+     * returned one-time code, which the desktop app redeems with `exchangeOAuthCode(code, { codeVerifier })`.
+     * @param credential - The WebAuthn library's AuthenticationResponseJSON.
+     * @param handoff - The `state` and PKCE `codeChallenge` the desktop app made.
+     * @returns Promise resolving to the one-time code.
+     */
+    async loginDesktopWithPasskey(
+      credential: PasskeyCredentialResponse,
+      handoff: Omit<PasskeyDesktopLoginRequest, "credential">
+    ): Promise<PasskeyDesktopLoginResponse> {
+      return client._request<PasskeyDesktopLoginResponse>({
+        endpoint: "/v1/auth/passkeys/desktop-login",
+        method: "POST",
+        body: { credential, ...handoff } satisfies PasskeyDesktopLoginRequest,
+        sendJWT: false,
+      });
+    },
+
+    /**
+     * Gets the options for the browser's "create a passkey" prompt, after confirming who is asking.
+     * @param proof - The password when the account has one, and a two-factor code when two-factor is on.
+     * @returns Promise resolving to WebAuthn creation options.
+     */
+    async getPasskeyRegistrationOptions(proof: PasskeyRegistrationProof = {}): Promise<PasskeyCredentialOptions> {
+      return client._request<PasskeyCredentialOptions>({
+        endpoint: "/v1/auth/passkeys/registration-options",
+        method: "POST",
+        body: proof,
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Saves the passkey the browser created.
+     * @param credential - The WebAuthn library's RegistrationResponseJSON.
+     * @param name - Optional name to tell it apart, e.g. "MacBook".
+     * @returns Promise resolving to the saved passkey.
+     */
+    async registerPasskey(credential: PasskeyCredentialResponse, name?: string): Promise<Passkey> {
+      return client._request<Passkey>({
+        endpoint: "/v1/auth/passkeys",
+        method: "POST",
+        body: { credential, ...(name ? { name } : {}) },
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Lists the authenticated user's passkeys, oldest first.
+     * @returns Promise resolving to the user's passkeys.
+     */
+    async listPasskeys(): Promise<Passkey[]> {
+      return client._request<Passkey[]>({
+        endpoint: "/v1/auth/passkeys",
+        method: "GET",
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Renames one of the authenticated user's passkeys.
+     * @param passkeyId - The passkey's id.
+     * @param name - The new name.
+     * @returns Promise resolving to the renamed passkey.
+     */
+    async renamePasskey(passkeyId: string, name: string): Promise<Passkey> {
+      return client._request<Passkey>({
+        endpoint: `/v1/auth/passkeys/${passkeyId}`,
+        method: "PATCH",
+        body: { name },
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Removes one of the authenticated user's passkeys.
+     * @param passkeyId - The passkey's id.
+     * @returns Promise resolving when complete.
+     */
+    async deletePasskey(passkeyId: string): Promise<void> {
+      await client._request<void>({
+        endpoint: `/v1/auth/passkeys/${passkeyId}`,
+        method: "DELETE",
+        sendJWT: true,
+      });
+    },
+
     /**
      * Unlinks an OAuth provider from the authenticated user's account.
      * User must have at least one authentication method remaining (password or another OAuth provider).
@@ -553,11 +687,17 @@ export default function createAuthMethods(client: NuramaClient) {
       });
     },
 
-    async exchangeOAuthCode(code: string): Promise<OAuthExchangeResponse> {
+    /**
+     * Exchanges a one-time sign-in code for tokens and stores them.
+     * @param code - The code from the sign-in redirect.
+     * @param options.codeVerifier - The PKCE verifier, for a code made with a challenge.
+     * @returns Promise resolving to the user and tokens, or a two-factor challenge.
+     */
+    async exchangeOAuthCode(code: string, { codeVerifier }: { codeVerifier?: string } = {}): Promise<OAuthExchangeResponse> {
       const result: OAuthExchangeResponse = await client._request({
         endpoint: "/v1/auth/oauth/exchange",
         method: "POST",
-        body: { code } satisfies OAuthExchangeRequest,
+        body: { code, ...(codeVerifier ? { codeVerifier } : {}) } satisfies OAuthExchangeRequest,
         sendJWT: false, // No authentication needed - the code is the proof
       });
 

package/src/routes/chat.ts

@@ -9,10 +9,24 @@ import {
   type Membership,
   type PaginatedResult,
   type CursorPaginatedResult,
+  type ReadState,
 } from '@nurama/types'; // Import pagination types
 
 // --- Common Interfaces ---
 
+/** Unread state for one member chat, as returned by `getMemberChatReadStates`. */
+export interface MemberChatReadState {
+  chatId: string;
+  /** Epoch ms of the newest message, or null when the chat is empty. */
+  lastMessageAt: number | null;
+  /** Epoch ms you last read to, or null when you never have. */
+  lastReadAt: number | null;
+  /** Messages newer than your position, excluding your own. */
+  unreadCount: number;
+  /** `unreadCount > 0`. Null `lastReadAt` does not imply false. */
+  hasUnread: boolean;
+}
+
 // Base interface for pagination options
 export interface PaginationParams {
     limit?: number;
@@ -617,6 +631,59 @@ export default function createChatMethods(client: NuramaClient) {
       });
     },
 
+    /**
+     * Gets unread state for every member chat you belong to — one row per chat,
+     * carrying the chat's `lastMessageAt`, your `lastReadAt` and a `hasUnread`
+     * flag. Compares timestamps rather than counting, so it costs the same
+     * whether you have three chats or three hundred; for a count, read the
+     * single-chat endpoint for the chat on screen.
+     * @returns {Promise<{ results: MemberChatReadState[] }>} Unread state per member chat.
+     */
+    async getMemberChatReadStates(): Promise<{ results: MemberChatReadState[] }> {
+      return client._request<{ results: MemberChatReadState[] }>({
+        method: 'GET',
+        endpoint: `/v1/chats/member/read-state`,
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Gets where you had read up to in a member chat, and how many messages have
+     * arrived since. `lastReadAt` is null if you have never recorded a position,
+     * and `unreadCount` is 0 then. Your own messages never count.
+     * @param {string} chatId - The ID of the member chat.
+     * @returns {Promise<ReadState>} Your reading position in that chat.
+     * @throws {Error} 'chatId is required.' when `chatId` is falsy.
+     */
+    async getMemberChatReadState(chatId: string): Promise<ReadState> {
+      if (!chatId) throw new Error('chatId is required.');
+      return client._request<ReadState>({
+        method: 'GET',
+        endpoint: `/v1/chats/member/${chatId}/read-state`,
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Marks a member chat as caught up. Pass `lastReadAt` (epoch ms) to catch up
+     * to the newest message you had loaded; omit it to catch up to now. The
+     * marker only moves forward and never past the present, so a stale value is
+     * a no-op rather than an error.
+     * @param {string} chatId - The ID of the member chat.
+     * @param {number} [lastReadAt] - Epoch ms of the newest message you had loaded.
+     * @returns {Promise<ReadState>} Your updated reading position.
+     * @throws {Error} 'chatId is required.' when `chatId` is falsy.
+     */
+    async markMemberChatCaughtUp(chatId: string, lastReadAt?: number): Promise<ReadState> {
+      if (!chatId) throw new Error('chatId is required.');
+      return client._request<ReadState>({
+        method: 'POST',
+        endpoint: `/v1/chats/member/${chatId}/read-state`,
+        body: lastReadAt === undefined ? {} : { lastReadAt },
+        sendJWT: true,
+      });
+    },
+
     /**
      * Creates an icon asset for a member chat and returns signed upload URLs for it.
      * Any existing icon is marked for deletion. The caller must be a member of the chat;

package/src/routes/project.ts

@@ -19,6 +19,7 @@ import {
   type FeedVisibility,
   type ListFeedEventsParams,
   type CursorPaginatedFeedEvents,
+  type ReadState,
 } from '@nurama/types';
 
 // Combine pagination metadata with a results array
@@ -597,6 +598,44 @@ export default function createProjectMethods(client: NuramaClient) {
       });
     },
 
+    /**
+     * Gets where you had read up to in a project feed, and how many cards have
+     * moved since. `lastReadAt` is null if you have never recorded a position,
+     * and `unreadCount` is 0 then. Cards you are the actor on never count.
+     * @param {string} projectId - The ID of the project.
+     * @param {'creator' | 'reviewer'} visibility - Which feed to read.
+     * @returns {Promise<ReadState>} Your reading position in that feed.
+     */
+    async getFeedReadState(projectId: string, visibility: FeedVisibility): Promise<ReadState> {
+      if (!projectId) throw new Error('projectId is required.');
+      if (!visibility) throw new Error('visibility is required (creator or reviewer).');
+
+      return client._request<ReadState>({
+        method: 'GET',
+        endpoint: `/v1/projects/${projectId}/feed-events/${visibility}/read-state`,
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Marks a project feed as caught up. Pass `lastReadAt` (epoch ms) to catch
+     * up to the newest card you had loaded; omit it to catch up to now. The
+     * marker only moves forward and never past the present, so a stale value is
+     * a no-op rather than an error.
+     * @returns {Promise<ReadState>} Your updated reading position.
+     */
+    async markFeedCaughtUp(projectId: string, visibility: FeedVisibility, lastReadAt?: number): Promise<ReadState> {
+      if (!projectId) throw new Error('projectId is required.');
+      if (!visibility) throw new Error('visibility is required (creator or reviewer).');
+
+      return client._request<ReadState>({
+        method: 'POST',
+        endpoint: `/v1/projects/${projectId}/feed-events/${visibility}/read-state`,
+        body: lastReadAt === undefined ? {} : { lastReadAt },
+        sendJWT: true,
+      });
+    },
+
     // --- Folder Listing ---
 
     /**

package/src/routes/task.ts

@@ -28,6 +28,8 @@ export interface GetTasksBaseParams extends SortParams {
     relatedToId?: string;
     visibility?: TaskVisibility;
     acknowledged?: boolean;
+    /** `'chatMessage'` returns only mention-tasks; without it, board tasks assigned to you come too. */
+    originType?: 'chatMessage';
     limit?: number;
 }
 
@@ -223,31 +225,29 @@ export default function createTaskMethods(client: NuramaClient) {
     },
 
     /**
-         * Retrieves the count of unacknowledged tasks for the current user within a specific project.
-         * Requires authentication.
-         * @param {string} projectId - The ID of the project.
+         * Retrieves the count of unacknowledged tasks for the current user within a specific project,
+         * or across every project when none is given. Requires authentication.
+         * @param {string} [projectId] - The ID of the project; omit for every project.
          * @returns {Promise<UnacknowledgedTaskCountResponse>} An object containing total, creator, and reviewer unacknowledged task counts.
          */
-    async getUnacknowledgedTaskCount(projectId: string): Promise<UnacknowledgedTaskCountResponse> {
-      if (!projectId) throw new Error('projectId is required.');
+    async getUnacknowledgedTaskCount(projectId?: string): Promise<UnacknowledgedTaskCountResponse> {
       return client._request<UnacknowledgedTaskCountResponse>({
         method: 'GET',
-        endpoint: `/v1/tasks/unacknowledged/${projectId}`,
+        endpoint: projectId ? `/v1/tasks/unacknowledged/${projectId}` : '/v1/tasks/unacknowledged',
         sendJWT: true,
       });
     },
 
     /**
          * Acknowledge every unacknowledged mention-task the current user has in a
-         * project. Idempotent server-side.
-         * @param {string} projectId - The ID of the project.
+         * project, or in every project when none is given. Idempotent server-side.
+         * @param {string} [projectId] - The ID of the project; omit for every project.
          * @returns {Promise<AcknowledgeAllTasksResponse>} The number acknowledged and the remaining unacknowledged count.
          */
-    async acknowledgeAllTasks(projectId: string): Promise<AcknowledgeAllTasksResponse> {
-      if (!projectId) throw new Error('projectId is required.');
+    async acknowledgeAllTasks(projectId?: string): Promise<AcknowledgeAllTasksResponse> {
       return client._request<AcknowledgeAllTasksResponse>({
         method: 'PUT',
-        endpoint: `/v1/tasks/acknowledge-all/${projectId}`,
+        endpoint: projectId ? `/v1/tasks/acknowledge-all/${projectId}` : '/v1/tasks/acknowledge-all',
         sendJWT: true,
       });
     },

package/src/routes/userFeed.ts

@@ -0,0 +1,113 @@
+import NuramaClient from '../NuramaClient.js';
+import {
+  type ObjectId,
+  type ReadState,
+  type ListUserFeedParams,
+  type CursorPaginatedUserFeed,
+  type UserFeedEntry,
+  type UserFeedSummary,
+} from '@nurama/types';
+
+/**
+ * Defines the methods for the caller's own cross-project feed: project
+ * activity from every project they can read, and the things waiting on them.
+ * Every call is scoped to the signed-in user.
+ * @param {NuramaClient} client - The NuramaClient instance.
+ * @returns {object} An object containing the user feed methods.
+ */
+export default function createUserFeedMethods(client: NuramaClient) {
+  return {
+    /**
+     * Gets one page of your feed, most recent first. Pass `category` for only
+     * project activity or only action items; dismissed items are left out
+     * unless `states` asks for them.
+     * @returns {Promise<CursorPaginatedUserFeed>}
+     */
+    async getFeed(params?: ListUserFeedParams): Promise<CursorPaginatedUserFeed> {
+      return client._request<CursorPaginatedUserFeed>({
+        method: 'GET',
+        endpoint: '/v1/users/feed',
+        params,
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Gets every badge the app shows: open action items, project activity since
+     * you last caught up, and that activity broken down by project in
+     * `byProject` — one row per project with something new, for the badge on
+     * its icon. The two totals stop at 100.
+     *
+     * The totals and `byProject` move independently: the totals are measured
+     * against your feed-wide marker, each `byProject` row against that
+     * project's own. So catching up in the feed does not clear project badges,
+     * and reading one project does not clear the feed's own count.
+     * @returns {Promise<UserFeedSummary>}
+     */
+    async getSummary(): Promise<UserFeedSummary> {
+      return client._request<UserFeedSummary>({
+        method: 'GET',
+        endpoint: '/v1/users/feed/summary',
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Gets your reading position in your feed's project activity.
+     * @returns {Promise<ReadState>}
+     */
+    async getReadState(): Promise<ReadState> {
+      return client._request<ReadState>({
+        method: 'GET',
+        endpoint: '/v1/users/feed/read-state',
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Marks your feed's project activity as caught up. Pass `lastReadAt`
+     * (epoch ms) to catch up to the newest card you had loaded; omit it to
+     * catch up to now. The marker only moves forward.
+     * @returns {Promise<ReadState>}
+     */
+    async markCaughtUp(lastReadAt?: number): Promise<ReadState> {
+      return client._request<ReadState>({
+        method: 'POST',
+        endpoint: '/v1/users/feed/read-state',
+        body: lastReadAt === undefined ? {} : { lastReadAt },
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Clears one of your action items (`dismissed`), or brings a cleared one
+     * back (`open`).
+     * @returns {Promise<UserFeedEntry>} The updated item.
+     */
+    async setEntryState(entryId: ObjectId, state: 'dismissed' | 'open'): Promise<UserFeedEntry> {
+      if (!entryId) throw new Error('entryId is required.');
+
+      return client._request<UserFeedEntry>({
+        method: 'PATCH',
+        endpoint: `/v1/users/feed/${entryId}`,
+        body: { state },
+        sendJWT: true,
+      });
+    },
+
+    /**
+     * Clears every open action item up to `before` (epoch ms) — the newest one
+     * you had loaded — so one that arrived since stays. Omit it to clear
+     * everything open now.
+     * @returns {Promise<{ dismissed: number }>}
+     */
+    async dismissAll(before?: number): Promise<{ dismissed: number }> {
+      return client._request<{ dismissed: number }>({
+        method: 'POST',
+        endpoint: '/v1/users/feed/dismiss',
+        body: before === undefined ? {} : { before },
+        sendJWT: true,
+      });
+    },
+  };
+}

package/src/version.ts

@@ -14,9 +14,9 @@ export interface SDKVersionInfo {
 }
 
 export const SDK_VERSION: SDKVersionInfo = {
-  version: '1.4.2',
-  buildTimestamp: '2026-10-13T14:29:32.506Z',
-  buildHash: '4d2cf795aed2effc13ea74e85309a692',
-  gitCommit: '6c603cf',
+  version: '1.4.4',
+  buildTimestamp: '2026-10-23T15:39:41.191Z',
+  buildHash: 'b0bbfd265120e5fd826237cc63c5bf7d',
+  gitCommit: '7c333f8',
   dirty: false,
 };