@openmarket/rooms-client 0.7.1 → 0.9.0

package/README.md

@@ -22,4 +22,23 @@ Bun consumers resolve raw TypeScript via the `bun` export condition; Node and bu
 
 ## Versioning
 
-The npm version is managed by hand: bump `package.json` here, `npm publish`, then bump the consumers' pins. The monorepo's release script deliberately skips this package's `package.json`. `src/version.ts` is the exception: it carries the wire/runner version and is auto-bumped with every `om` release so the WebSocket handshake tracks the daemon.
+The npm version is released separately from the OpenMarket application. The
+monorepo release script deliberately skips this package's `package.json`;
+`src/version.ts` is the exception because it carries the wire/runner version.
+
+Prepare a version commit with the guarded package gates:
+
+```bash
+bun run rooms-client:release prepare 0.8.0
+```
+
+After that version commit is merged, publish only from a clean, current
+`main` checkout:
+
+```bash
+bun run rooms-client:release publish 0.8.0
+```
+
+The publish command verifies npm identity and version availability, reruns
+the package gates, publishes, and prints the update commands for
+`openmarket-chat` and `openmarket-chat-cloud`. It never commits or pushes.

package/dist/agent/library-model.d.ts

@@ -24,7 +24,9 @@ export declare class LibraryModel {
     refresh(): Promise<boolean>;
     private refreshSpace;
     private applyChanges;
-    /** Upsert after our own write so the UI reflects it without waiting a poll. */
+    /** Upsert after our own write so the UI reflects it without waiting a poll.
+     *  Every local write (archive included) advances the receipt: our write IS
+     *  the head we would otherwise refetch. */
     applyLocalWrite(doc: RoomDoc): void;
     docsFor(spaceId: string): RoomDoc[];
     recentFor(spaceId: string, limit?: number): RoomDoc[];
@@ -34,6 +36,17 @@ export declare class LibraryModel {
     freshCount(spaceId: string): number;
     isFresh(spaceId: string, docId: string): boolean;
     markSeen(spaceId: string): void;
+    /**
+     * Record a server poke (DOC_CHANGED) that the space's change head moved.
+     * Bookkeeping only: latestSeq ratchets up (never down) so atHead() reports
+     * stale until a refresh catches up. Returns whether a refresh would fetch
+     * anything: false for untracked spaces, true for a seqless poke (an
+     * unconditional "something changed"), otherwise whether the poked head is
+     * ahead of the cursor. Callers own debounce/refresh scheduling, and must
+     * re-check atHead() after a refresh completes: the refresh() single-flight
+     * guard drops a poke that lands mid-refresh.
+     */
+    noteRemoteHead(spaceId: string, latestSeq?: number): boolean;
     /** True when the cache has provably caught up to the space's change head. */
     atHead(spaceId: string): boolean;
     syncedOnce(spaceId: string): boolean;

package/dist/agent/library-model.js

@@ -95,21 +95,23 @@ export class LibraryModel {
         }
         return changed;
     }
-    /** Upsert after our own write so the UI reflects it without waiting a poll. */
+    /** Upsert after our own write so the UI reflects it without waiting a poll.
+     *  Every local write (archive included) advances the receipt: our write IS
+     *  the head we would otherwise refetch. */
     applyLocalWrite(doc) {
         const state = this.spaces.get(doc.spaceId);
         if (!state)
             return;
+        if (doc.spaceDocSeq > state.cursor) {
+            state.cursor = doc.spaceDocSeq;
+            state.latestSeq = Math.max(state.latestSeq, doc.spaceDocSeq);
+        }
         if (doc.status === "archived") {
             state.docs.delete(doc.docId);
             state.freshDocIds.delete(doc.docId);
             return;
         }
         state.docs.set(doc.docId, doc);
-        if (doc.spaceDocSeq > state.cursor) {
-            state.cursor = doc.spaceDocSeq;
-            state.latestSeq = Math.max(state.latestSeq, doc.spaceDocSeq);
-        }
     }
     docsFor(spaceId) {
         const state = this.spaces.get(spaceId);
@@ -157,6 +159,25 @@ export class LibraryModel {
     markSeen(spaceId) {
         this.spaces.get(spaceId)?.freshDocIds.clear();
     }
+    /**
+     * Record a server poke (DOC_CHANGED) that the space's change head moved.
+     * Bookkeeping only: latestSeq ratchets up (never down) so atHead() reports
+     * stale until a refresh catches up. Returns whether a refresh would fetch
+     * anything: false for untracked spaces, true for a seqless poke (an
+     * unconditional "something changed"), otherwise whether the poked head is
+     * ahead of the cursor. Callers own debounce/refresh scheduling, and must
+     * re-check atHead() after a refresh completes: the refresh() single-flight
+     * guard drops a poke that lands mid-refresh.
+     */
+    noteRemoteHead(spaceId, latestSeq) {
+        const state = this.spaces.get(spaceId);
+        if (!state)
+            return false;
+        if (latestSeq === undefined)
+            return true;
+        state.latestSeq = Math.max(state.latestSeq, latestSeq);
+        return latestSeq > state.cursor;
+    }
     /** True when the cache has provably caught up to the space's change head. */
     atHead(spaceId) {
         const state = this.spaces.get(spaceId);

package/dist/client.d.ts

@@ -212,6 +212,7 @@ export interface RoomDmSendRequest {
      *  URL. Stored on the message's imageUrl; the client signs keys on render.
      *  Additive — omitted for text-only sends. */
     imageUrl?: string;
+    attachments?: RoomAttachmentInput[];
     metadata?: RoomForwardMetadata;
 }
 export interface RoomDmReplyRequest extends RoomDmSendRequest {

package/dist/client.js

@@ -489,6 +489,9 @@ export async function sendRoomDmOnClient(client, request, timeoutMs) {
             ...(request.username ? { username: request.username } : {}),
             ...(request.conversationId ? { conversationId: request.conversationId } : {}),
             ...(request.imageUrl ? { imageUrl: request.imageUrl } : {}),
+            ...(request.attachments?.length
+                ? { attachments: toRoomAttachmentPayloads(request.attachments) }
+                : {}),
             ...(request.metadata ? { metadata: request.metadata } : {}),
         },
         timestamp: Date.now(),
@@ -511,6 +514,9 @@ export async function replyRoomDmOnClient(client, request, timeoutMs) {
             ...(request.username ? { username: request.username } : {}),
             ...(request.conversationId ? { conversationId: request.conversationId } : {}),
             ...(request.imageUrl ? { imageUrl: request.imageUrl } : {}),
+            ...(request.attachments?.length
+                ? { attachments: toRoomAttachmentPayloads(request.attachments) }
+                : {}),
             ...(request.metadata ? { metadata: request.metadata } : {}),
         },
         timestamp: Date.now(),

package/dist/shared/rooms-protocol.d.ts

@@ -98,11 +98,14 @@ export declare const RoomServerMessageType: {
     readonly DM_MESSAGE_EDITED: "DM_MESSAGE_EDITED";
     readonly DM_MESSAGE_DELETED: "DM_MESSAGE_DELETED";
     readonly DM_REACTION_UPDATED: "DM_REACTION_UPDATED";
+    readonly DM_ATTACHMENT_UPDATED: "DM_ATTACHMENT_UPDATED";
     readonly DM_PIN_UPDATED: "DM_PIN_UPDATED";
     readonly DM_PINS: "DM_PINS";
     readonly TOPIC: "TOPIC";
     readonly TOPICS: "TOPICS";
     readonly TOPIC_UPDATED: "TOPIC_UPDATED";
+    readonly DOC_CHANGED: "DOC_CHANGED";
+    readonly FRIEND_UPDATED: "FRIEND_UPDATED";
 };
 export declare function addBounded<T>(set: Set<T>, value: T, max: number): void;
 export type RoomServerMessageType = (typeof RoomServerMessageType)[keyof typeof RoomServerMessageType];
@@ -278,10 +281,11 @@ export interface RoomWebhookMetadata {
 }
 export interface RoomAttachment {
     /**
-     * Object key under room-attachments/; clients sign it at render time.
-     * Absent while scanStatus is "pending" on entries served to members: the
-     * store withholds the signable key until the scan clears, so render the
-     * metadata as a placeholder and do not attempt signing without a key.
+     * Object key under room-attachments/ or dm-attachments/; clients sign it
+     * at render time. Absent while scanStatus is "pending" on entries served
+     * to recipients: the store withholds the signable key until the scan
+     * clears, so render the metadata as a placeholder and do not attempt
+     * signing without a key.
      */
     key?: string | undefined;
     name: string;
@@ -292,7 +296,7 @@ export interface RoomAttachment {
 /**
  * A postable attachment reference. Outbound frames must always carry the
  * stored key (senders reference their own uploads, which include it); only
- * read views of pending entries may be keyless, and those must never be
+ * recipient views of pending entries may be keyless, and those must never be
  * forwarded back into a post.
  */
 export type RoomAttachmentInput = RoomAttachment & {
@@ -619,6 +623,7 @@ export interface RoomDmSendPayload {
     /** DM-attachment key or legacy public image URL; stored on the message's
      *  imageUrl. Additive — text-only sends omit it. */
     imageUrl?: string;
+    attachments?: RoomAttachmentInput[];
     metadata?: RoomForwardMetadata | undefined;
 }
 /** Client → server: send a DM whose parent is another message in the same conversation. */
@@ -677,6 +682,12 @@ export interface RoomDmReactionUpdatedPayload {
     }>;
     participant: RoomDmParticipant;
 }
+export interface RoomDmAttachmentUpdatedPayload {
+    conversationId: string;
+    messageId: string;
+    scanStatus: "clean" | "held";
+    attachments: RoomAttachment[];
+}
 export interface RoomDmPinPayload {
     requestId?: string;
     conversationId?: string;
@@ -966,6 +977,19 @@ export interface RoomTopicUpdatedPayload {
     room: string;
     topic: RoomTopic;
 }
+/** Poke: a space's doc-library change head moved (create/edit/archive/restore).
+ *  Deliberately content-free: clients refetch deltas over REST. */
+export interface RoomDocChangedPayload {
+    spaceId: string;
+    /** The space's change head after the mutation, when the server knows it
+     *  cheaply; absent still means "something changed, refetch". */
+    latestSeq?: number | undefined;
+}
+/** Poke: the recipient's friendship graph changed. Clients refetch over REST. */
+export interface RoomFriendUpdatedPayload {
+    kind: "request" | "accepted" | "rejected" | "removed";
+    friendshipId?: string | undefined;
+}
 export type RoomClientMessage = {
     type: typeof RoomClientMessageType.AUTHENTICATE;
     payload: {
@@ -1471,6 +1495,10 @@ export type RoomServerMessage = {
     type: typeof RoomServerMessageType.DM_REACTION_UPDATED;
     payload: RoomDmReactionUpdatedPayload;
     timestamp: number;
+} | {
+    type: typeof RoomServerMessageType.DM_ATTACHMENT_UPDATED;
+    payload: RoomDmAttachmentUpdatedPayload;
+    timestamp: number;
 } | {
     type: typeof RoomServerMessageType.DM_PIN_UPDATED;
     payload: RoomDmPinUpdatedPayload;
@@ -1491,6 +1519,14 @@ export type RoomServerMessage = {
     type: typeof RoomServerMessageType.TOPIC_UPDATED;
     payload: RoomTopicUpdatedPayload;
     timestamp: number;
+} | {
+    type: typeof RoomServerMessageType.DOC_CHANGED;
+    payload: RoomDocChangedPayload;
+    timestamp: number;
+} | {
+    type: typeof RoomServerMessageType.FRIEND_UPDATED;
+    payload: RoomFriendUpdatedPayload;
+    timestamp: number;
 };
 export type RoomServerMessageOf<T extends RoomServerMessageType> = Extract<RoomServerMessage, {
     type: T;

package/dist/shared/rooms-protocol.js

@@ -97,11 +97,14 @@ export const RoomServerMessageType = {
     DM_MESSAGE_EDITED: "DM_MESSAGE_EDITED",
     DM_MESSAGE_DELETED: "DM_MESSAGE_DELETED",
     DM_REACTION_UPDATED: "DM_REACTION_UPDATED",
+    DM_ATTACHMENT_UPDATED: "DM_ATTACHMENT_UPDATED",
     DM_PIN_UPDATED: "DM_PIN_UPDATED",
     DM_PINS: "DM_PINS",
     TOPIC: "TOPIC",
     TOPICS: "TOPICS",
     TOPIC_UPDATED: "TOPIC_UPDATED",
+    DOC_CHANGED: "DOC_CHANGED",
+    FRIEND_UPDATED: "FRIEND_UPDATED",
 };
 export function addBounded(set, value, max) {
     set.add(value);

package/dist/social-client.d.ts

@@ -604,8 +604,10 @@ export declare function socialRequest<T>(config: RoomSocialConfig, path: string,
     formData?: FormData;
     headers?: Record<string, string>;
     /** Fetch cache mode; token-bearing reads pass "no-store" so posting
-     *  credentials never persist in a browser HTTP cache. */
-    cache?: RequestCache;
+     *  credentials never persist in a browser HTTP cache. Spelled as the
+     *  literal union rather than DOM's RequestCache: this package
+     *  typechecks without the DOM lib. */
+    cache?: "default" | "force-cache" | "no-cache" | "no-store" | "only-if-cached" | "reload";
 }): Promise<T>;
 export declare function cleanUsername(username: string): string;
 export declare function cleanRoomId(room: string): string;

package/dist/social-types.d.ts

@@ -125,6 +125,8 @@ export interface RoomDmMessage {
     /** DM image: a private dm-attachments/ key (signed on render) or a legacy
      *  public URL. Additive — old messages carry none. */
     imageUrl?: string | null;
+    /** Private scanned attachments. Keys are absent until the bytes are clean. */
+    attachments?: RoomAttachment[];
     /** Aggregated reactions (per-emoji userId lists). Additive. */
     reactions?: Array<{
         emoji: string;

package/dist/types.d.ts

@@ -1,2 +1,2 @@
-export type { RoomAccessMode, RoomAttachment, RoomAttachmentInput, RoomAuditEntry, RoomAuditLogPayload, RoomAuditLogRequestPayload, RoomAuthSuccessPayload, RoomBackfillPayload, RoomClientMessage, RoomClientPlatform, RoomCreatedPayload, RoomCreatePayload, RoomDmHistoryPayload, RoomDmHistoryResultPayload, RoomDmInboxUpdatedPayload, RoomDmMessage, RoomDmMessageDeletedPayload, RoomDmMessageEditedPayload, RoomDmMessagePayload, RoomDmOpenedPayload, RoomDmOpenPayload, RoomDmParticipant, RoomDmPinsResultPayload, RoomDmPinUpdatedPayload, RoomDmReactionUpdatedPayload, RoomDmReadPayload, RoomDmReplyPayload, RoomDmSendPayload, RoomEntryUpdatedPayload, RoomErrorPayload, RoomForwardedFrom, RoomForwardMetadata, RoomFriendPresence, RoomInvitedPayload, RoomInvitePayload, RoomLedgerEntry, RoomMember, RoomMemberRemovedPayload, RoomMemberRoleChangedPayload, RoomMemberTier, RoomMessagePayload, RoomMeta, RoomModerateMemberPayload, RoomMutedPayload, RoomPinsPayload, RoomPollOption, RoomPollSummary, RoomPresenceDeltaPayload, RoomPresencePayload, RoomReactorsPayload, RoomReadStatePayload, RoomRemoveMemberPayload, RoomReportedPayload, RoomReportPayload, RoomResyncPayload, RoomRole, RoomRoleChangePayload, RoomSearchPayload, RoomSearchResultsPayload, RoomSearchScope, RoomServerMessage, RoomServerMessageOf, RoomSetAttentionPayload, RoomSetReadOnlyPayload, RoomSpace, RoomSpaceJoinedPayload, RoomSpacesPayload, RoomThreadPayload, RoomTopic, RoomTopicAttention, RoomTopicBucketState, RoomTopicCreatePayload, RoomTopicListPayload, RoomTopicMergePayload, RoomTopicMovePayload, RoomTopicRenamePayload, RoomTopicResolvePayload, RoomTopicResultPayload, RoomTopicSetAttentionPayload, RoomTopicsPolicy, RoomTopicsResultPayload, RoomTopicUpdatedPayload, RoomTypingPayload, RoomUnfurl, RoomUserStatus, RoomWhoPayload, } from "./shared/rooms-protocol.js";
+export type { RoomAccessMode, RoomAttachment, RoomAttachmentInput, RoomAuditEntry, RoomAuditLogPayload, RoomAuditLogRequestPayload, RoomAuthSuccessPayload, RoomBackfillPayload, RoomClientMessage, RoomClientPlatform, RoomCreatedPayload, RoomCreatePayload, RoomDmAttachmentUpdatedPayload, RoomDmHistoryPayload, RoomDmHistoryResultPayload, RoomDmInboxUpdatedPayload, RoomDmMessage, RoomDmMessageDeletedPayload, RoomDmMessageEditedPayload, RoomDmMessagePayload, RoomDmOpenedPayload, RoomDmOpenPayload, RoomDmParticipant, RoomDmPinsResultPayload, RoomDmPinUpdatedPayload, RoomDmReactionUpdatedPayload, RoomDmReadPayload, RoomDmReplyPayload, RoomDmSendPayload, RoomEntryUpdatedPayload, RoomErrorPayload, RoomForwardedFrom, RoomForwardMetadata, RoomFriendPresence, RoomInvitedPayload, RoomInvitePayload, RoomLedgerEntry, RoomMember, RoomMemberRemovedPayload, RoomMemberRoleChangedPayload, RoomMemberTier, RoomMessagePayload, RoomMeta, RoomModerateMemberPayload, RoomMutedPayload, RoomPinsPayload, RoomPollOption, RoomPollSummary, RoomPresenceDeltaPayload, RoomPresencePayload, RoomReactorsPayload, RoomReadStatePayload, RoomRemoveMemberPayload, RoomReportedPayload, RoomReportPayload, RoomResyncPayload, RoomRole, RoomRoleChangePayload, RoomSearchPayload, RoomSearchResultsPayload, RoomSearchScope, RoomServerMessage, RoomServerMessageOf, RoomSetAttentionPayload, RoomSetReadOnlyPayload, RoomSpace, RoomSpaceJoinedPayload, RoomSpacesPayload, RoomThreadPayload, RoomTopic, RoomTopicAttention, RoomTopicBucketState, RoomTopicCreatePayload, RoomTopicListPayload, RoomTopicMergePayload, RoomTopicMovePayload, RoomTopicRenamePayload, RoomTopicResolvePayload, RoomTopicResultPayload, RoomTopicSetAttentionPayload, RoomTopicsPolicy, RoomTopicsResultPayload, RoomTopicUpdatedPayload, RoomTypingPayload, RoomUnfurl, RoomUserStatus, RoomWhoPayload, } from "./shared/rooms-protocol.js";
 export { applyRoomPresenceDelta, isSystemRoomLedgerEntryType, ROOM_PRESENCE_SAMPLE_LIMIT, RoomClientMessageType, RoomLedgerEntryType, RoomServerMessageType, SUPPORTED_ROOM_PROTOCOL_VERSION, } from "./shared/rooms-protocol.js";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.7.0";
-export declare const RUNNER_VERSION = "0.7.0";
+export declare const VERSION = "0.9.0";
+export declare const RUNNER_VERSION = "0.9.0";

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.7.0";
-export const RUNNER_VERSION = "0.7.0";
+export const VERSION = "0.9.0";
+export const RUNNER_VERSION = "0.9.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmarket/rooms-client",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "OM Rooms protocol client: wire types, WebSocket + REST clients, and chat view-models. Browser-safe (no node:/bun: imports).",
   "type": "module",
   "license": "Apache-2.0",

package/src/agent/armed-mode.ts

@@ -170,9 +170,7 @@ export function ownSeqsOf(entries: ReadonlyArray<RoomLedgerEntry>, ownUserId: st
  *  autonomous turn, and webhook chatter cannot satisfy the
  *  human-activity brake. */
 function isWebhookEntry(entry: RoomLedgerEntry): boolean {
-  return Boolean(
-    (entry.metadata as { webhook?: unknown } | undefined)?.webhook,
-  );
+  return Boolean((entry.metadata as { webhook?: unknown } | undefined)?.webhook);
 }
 
 export function isTriggeringEntry(

package/src/agent/library-model.ts

@@ -129,20 +129,22 @@ export class LibraryModel {
     return changed;
   }
 
-  /** Upsert after our own write so the UI reflects it without waiting a poll. */
+  /** Upsert after our own write so the UI reflects it without waiting a poll.
+   *  Every local write (archive included) advances the receipt: our write IS
+   *  the head we would otherwise refetch. */
   applyLocalWrite(doc: RoomDoc): void {
     const state = this.spaces.get(doc.spaceId);
     if (!state) return;
+    if (doc.spaceDocSeq > state.cursor) {
+      state.cursor = doc.spaceDocSeq;
+      state.latestSeq = Math.max(state.latestSeq, doc.spaceDocSeq);
+    }
     if (doc.status === "archived") {
       state.docs.delete(doc.docId);
       state.freshDocIds.delete(doc.docId);
       return;
     }
     state.docs.set(doc.docId, doc);
-    if (doc.spaceDocSeq > state.cursor) {
-      state.cursor = doc.spaceDocSeq;
-      state.latestSeq = Math.max(state.latestSeq, doc.spaceDocSeq);
-    }
   }
 
   docsFor(spaceId: string): RoomDoc[] {
@@ -193,6 +195,24 @@ export class LibraryModel {
     this.spaces.get(spaceId)?.freshDocIds.clear();
   }
 
+  /**
+   * Record a server poke (DOC_CHANGED) that the space's change head moved.
+   * Bookkeeping only: latestSeq ratchets up (never down) so atHead() reports
+   * stale until a refresh catches up. Returns whether a refresh would fetch
+   * anything: false for untracked spaces, true for a seqless poke (an
+   * unconditional "something changed"), otherwise whether the poked head is
+   * ahead of the cursor. Callers own debounce/refresh scheduling, and must
+   * re-check atHead() after a refresh completes: the refresh() single-flight
+   * guard drops a poke that lands mid-refresh.
+   */
+  noteRemoteHead(spaceId: string, latestSeq?: number): boolean {
+    const state = this.spaces.get(spaceId);
+    if (!state) return false;
+    if (latestSeq === undefined) return true;
+    state.latestSeq = Math.max(state.latestSeq, latestSeq);
+    return latestSeq > state.cursor;
+  }
+
   /** True when the cache has provably caught up to the space's change head. */
   atHead(spaceId: string): boolean {
     const state = this.spaces.get(spaceId);

package/src/client.ts

@@ -297,6 +297,7 @@ export interface RoomDmSendRequest {
    *  URL. Stored on the message's imageUrl; the client signs keys on render.
    *  Additive — omitted for text-only sends. */
   imageUrl?: string;
+  attachments?: RoomAttachmentInput[];
   metadata?: RoomForwardMetadata;
 }
 
@@ -994,6 +995,9 @@ export async function sendRoomDmOnClient(
       ...(request.username ? { username: request.username } : {}),
       ...(request.conversationId ? { conversationId: request.conversationId } : {}),
       ...(request.imageUrl ? { imageUrl: request.imageUrl } : {}),
+      ...(request.attachments?.length
+        ? { attachments: toRoomAttachmentPayloads(request.attachments) }
+        : {}),
       ...(request.metadata ? { metadata: request.metadata } : {}),
     },
     timestamp: Date.now(),
@@ -1027,6 +1031,9 @@ export async function replyRoomDmOnClient(
       ...(request.username ? { username: request.username } : {}),
       ...(request.conversationId ? { conversationId: request.conversationId } : {}),
       ...(request.imageUrl ? { imageUrl: request.imageUrl } : {}),
+      ...(request.attachments?.length
+        ? { attachments: toRoomAttachmentPayloads(request.attachments) }
+        : {}),
       ...(request.metadata ? { metadata: request.metadata } : {}),
     },
     timestamp: Date.now(),

package/src/shared/rooms-protocol.ts

@@ -101,11 +101,14 @@ export const RoomServerMessageType = {
   DM_MESSAGE_EDITED: "DM_MESSAGE_EDITED",
   DM_MESSAGE_DELETED: "DM_MESSAGE_DELETED",
   DM_REACTION_UPDATED: "DM_REACTION_UPDATED",
+  DM_ATTACHMENT_UPDATED: "DM_ATTACHMENT_UPDATED",
   DM_PIN_UPDATED: "DM_PIN_UPDATED",
   DM_PINS: "DM_PINS",
   TOPIC: "TOPIC",
   TOPICS: "TOPICS",
   TOPIC_UPDATED: "TOPIC_UPDATED",
+  DOC_CHANGED: "DOC_CHANGED",
+  FRIEND_UPDATED: "FRIEND_UPDATED",
 } as const;
 
 export function addBounded<T>(set: Set<T>, value: T, max: number): void {
@@ -278,7 +281,9 @@ export interface RoomLedgerEntry {
    *  (and servers older than the unfurl worker) omit it. */
   unfurls?: RoomUnfurl[] | undefined;
   roomRole?: RoomRole | null | undefined;
-  metadata?: (Record<string, unknown> & Partial<RoomForwardMetadata> & Partial<RoomWebhookMetadata>) | undefined;
+  metadata?:
+    | (Record<string, unknown> & Partial<RoomForwardMetadata> & Partial<RoomWebhookMetadata>)
+    | undefined;
 }
 
 export type RoomForwardedFrom =
@@ -312,10 +317,11 @@ export interface RoomWebhookMetadata {
 
 export interface RoomAttachment {
   /**
-   * Object key under room-attachments/; clients sign it at render time.
-   * Absent while scanStatus is "pending" on entries served to members: the
-   * store withholds the signable key until the scan clears, so render the
-   * metadata as a placeholder and do not attempt signing without a key.
+   * Object key under room-attachments/ or dm-attachments/; clients sign it
+   * at render time. Absent while scanStatus is "pending" on entries served
+   * to recipients: the store withholds the signable key until the scan
+   * clears, so render the metadata as a placeholder and do not attempt
+   * signing without a key.
    */
   key?: string | undefined;
   name: string;
@@ -327,7 +333,7 @@ export interface RoomAttachment {
 /**
  * A postable attachment reference. Outbound frames must always carry the
  * stored key (senders reference their own uploads, which include it); only
- * read views of pending entries may be keyless, and those must never be
+ * recipient views of pending entries may be keyless, and those must never be
  * forwarded back into a post.
  */
 export type RoomAttachmentInput = RoomAttachment & { key: string };
@@ -683,7 +689,9 @@ export interface RoomDmMessage {
   createdAt?: string | number | undefined;
   /** Sealed DM: content is '' and the opaque envelope rides here. */
   secret?: RoomLedgerSecretPayload | null | undefined;
-  metadata?: (Record<string, unknown> & Partial<RoomForwardMetadata> & Partial<RoomWebhookMetadata>) | undefined;
+  metadata?:
+    | (Record<string, unknown> & Partial<RoomForwardMetadata> & Partial<RoomWebhookMetadata>)
+    | undefined;
   /** Legacy public chat-image URL (renders as-is, no signing). */
   imageUrl?: string | null | undefined;
   /** Private, signed, scanned DM attachments (dm-attachments/ keyspace).
@@ -718,6 +726,7 @@ export interface RoomDmSendPayload {
   /** DM-attachment key or legacy public image URL; stored on the message's
    *  imageUrl. Additive — text-only sends omit it. */
   imageUrl?: string;
+  attachments?: RoomAttachmentInput[];
   metadata?: RoomForwardMetadata | undefined;
 }
 
@@ -781,6 +790,13 @@ export interface RoomDmReactionUpdatedPayload {
   participant: RoomDmParticipant;
 }
 
+export interface RoomDmAttachmentUpdatedPayload {
+  conversationId: string;
+  messageId: string;
+  scanStatus: "clean" | "held";
+  attachments: RoomAttachment[];
+}
+
 export interface RoomDmPinPayload {
   requestId?: string;
   conversationId?: string;
@@ -1104,6 +1120,21 @@ export interface RoomTopicUpdatedPayload {
   topic: RoomTopic;
 }
 
+/** Poke: a space's doc-library change head moved (create/edit/archive/restore).
+ *  Deliberately content-free: clients refetch deltas over REST. */
+export interface RoomDocChangedPayload {
+  spaceId: string;
+  /** The space's change head after the mutation, when the server knows it
+   *  cheaply; absent still means "something changed, refetch". */
+  latestSeq?: number | undefined;
+}
+
+/** Poke: the recipient's friendship graph changed. Clients refetch over REST. */
+export interface RoomFriendUpdatedPayload {
+  kind: "request" | "accepted" | "rejected" | "removed";
+  friendshipId?: string | undefined;
+}
+
 export type RoomClientMessage =
   | {
       type: typeof RoomClientMessageType.AUTHENTICATE;
@@ -1653,6 +1684,11 @@ export type RoomServerMessage =
       payload: RoomDmReactionUpdatedPayload;
       timestamp: number;
     }
+  | {
+      type: typeof RoomServerMessageType.DM_ATTACHMENT_UPDATED;
+      payload: RoomDmAttachmentUpdatedPayload;
+      timestamp: number;
+    }
   | {
       type: typeof RoomServerMessageType.DM_PIN_UPDATED;
       payload: RoomDmPinUpdatedPayload;
@@ -1677,6 +1713,16 @@ export type RoomServerMessage =
       type: typeof RoomServerMessageType.TOPIC_UPDATED;
       payload: RoomTopicUpdatedPayload;
       timestamp: number;
+    }
+  | {
+      type: typeof RoomServerMessageType.DOC_CHANGED;
+      payload: RoomDocChangedPayload;
+      timestamp: number;
+    }
+  | {
+      type: typeof RoomServerMessageType.FRIEND_UPDATED;
+      payload: RoomFriendUpdatedPayload;
+      timestamp: number;
     };
 
 export type RoomServerMessageOf<T extends RoomServerMessageType> = Extract<

package/src/social-client.ts

@@ -1934,8 +1934,10 @@ export async function socialRequest<T>(
     formData?: FormData;
     headers?: Record<string, string>;
     /** Fetch cache mode; token-bearing reads pass "no-store" so posting
-     *  credentials never persist in a browser HTTP cache. */
-    cache?: RequestCache;
+     *  credentials never persist in a browser HTTP cache. Spelled as the
+     *  literal union rather than DOM's RequestCache: this package
+     *  typechecks without the DOM lib. */
+    cache?: "default" | "force-cache" | "no-cache" | "no-store" | "only-if-cached" | "reload";
   } = {},
 ): Promise<T> {
   const url = `${trimTrailingSlash(config.apiUrl)}${path}`;

package/src/social-types.ts

@@ -147,6 +147,8 @@ export interface RoomDmMessage {
   /** DM image: a private dm-attachments/ key (signed on render) or a legacy
    *  public URL. Additive — old messages carry none. */
   imageUrl?: string | null;
+  /** Private scanned attachments. Keys are absent until the bytes are clean. */
+  attachments?: RoomAttachment[];
   /** Aggregated reactions (per-emoji userId lists). Additive. */
   reactions?: Array<{ emoji: string; users: string[] }>;
   /** Shared pin state. Additive; absent means unpinned. */

package/src/types.ts

@@ -11,6 +11,7 @@ export type {
   RoomClientPlatform,
   RoomCreatedPayload,
   RoomCreatePayload,
+  RoomDmAttachmentUpdatedPayload,
   RoomDmHistoryPayload,
   RoomDmHistoryResultPayload,
   RoomDmInboxUpdatedPayload,

package/src/version.ts

@@ -1,2 +1,2 @@
-export const VERSION = "0.7.0";
-export const RUNNER_VERSION = "0.7.0";
+export const VERSION = "0.9.0";
+export const RUNNER_VERSION = "0.9.0";