@pouchy_ai/admin-sdk 0.39.1 → 0.40.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to `@pouchy_ai/admin-sdk` are documented here.
 
+## 0.40.1 — 2026-09-30
+
+- **A 2xx whose body cannot be read now rejects with `AdminApiError`.** It
+  used to resolve as `{}` typed as the method's result: an HTML 200 from a
+  proxy or captive portal, a truncated body, or a deadline that fired
+  mid-body read as a success with every field `undefined`. For a one-shot
+  secret (`createKey`, `rotateKey`, `createWebhook`, `rotateWebhookSecret`)
+  the server had already minted it, and the caller lost it silently. The
+  error's `status` is the server's 2xx, because the request did land: do not
+  blindly retry a mint. A 204 / 205 still resolves `{}`; non-2xx errors are
+  unchanged.
+
+## 0.40.0 — 2026-09-29
+
+- **`recording` on agents.** Turning it on grants `call.record` on the agent's
+  session mints, so a call started with `record: true` (companion-sdk 0.65.0)
+  is recorded by the voice provider — both voices, one MP3, kept 7 days — and
+  fetchable with `getCallRecording`. Default false; the template flag is the
+  only way to get the scope. You own telling readers their calls are recorded
+  and getting their consent.
+
 ## 0.39.1 — 2026-09-28
 
 Type corrections. The server's responses did not change; three return types

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const ADMIN_SDK_VERSION = "0.39.1";
+export declare const ADMIN_SDK_VERSION = "0.40.1";
 export declare const DEFAULT_BASE_URL = "https://pouchy.ai/v1/admin";
 /** Deadline for the routes whose server handler declares `maxDuration: 300` —
  *  the server's own ceiling plus headroom, so a client abort can only ever mean
@@ -176,6 +176,13 @@ export interface Agent {
      *  on purpose, so asking for it in the session-mint body is narrowed away.
      *  Leave it off unless your backend assembles per-turn rules itself. */
     instructions?: boolean;
+    /** Grant `call.record` on this agent's session mints (0.40.0), so a call
+     *  started with `record: true` is recorded by the voice provider — both
+     *  voices, one MP3, kept 7 days — and fetchable with the companion SDK's
+     *  `getCallRecording`. Default false; this flag is the ONLY way to obtain
+     *  the scope. Turning it on makes you responsible for telling readers their
+     *  calls are recorded and getting their consent. */
+    recording?: boolean;
     /** Reply-cue opt-in (see ReplyCues). */
     replyCues?: ReplyCues;
     templateRev: number;

package/dist/index.js

@@ -8,7 +8,7 @@
 //   import { createAdminClient } from '@pouchy_ai/admin-sdk';
 //   const admin = createAdminClient({ adminKey: process.env.POUCHY_ADMIN_KEY! });
 //   const { agents } = await admin.listAgents();
-export const ADMIN_SDK_VERSION = '0.39.1';
+export const ADMIN_SDK_VERSION = '0.40.1';
 export const DEFAULT_BASE_URL = 'https://pouchy.ai/v1/admin';
 /** Default per-request timeout (ms). A hung upstream otherwise never rejects. */
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -270,7 +270,25 @@ export function createAdminClient(opts) {
                 ? `${method} ${path} — request timed out after ${timeoutMs}ms`
                 : `${method} ${path} — network error: ${e instanceof Error ? e.message : String(e)}`, 0);
         }
-        const data = (await res.json().catch(() => ({})));
+        // 0.40.1: a 2xx whose body cannot be read is an error, not `{}`. It used
+        // to resolve as a success with every field undefined — an HTML 200 from a
+        // proxy, a truncated body, a deadline that fired mid-body — and a secret
+        // the server had already minted (`createKey`, `rotateKey`,
+        // `createWebhook`) was lost with no signal. `status` stays the server's
+        // 2xx: the request DID land, so a blind retry of a mint is not safe. A
+        // 204 / 205 (no body by definition) still resolves `{}`, and the non-2xx
+        // arm keeps its fallback. Still `res.json()`, not `text()`: an injected
+        // `fetch` may hand back a minimal response that only implements `json`.
+        let readError = null;
+        const data = (await res.json().catch((e) => {
+            readError = e;
+            return {};
+        }));
+        if (res.ok && readError !== null && res.status !== 204 && res.status !== 205) {
+            const why = readError instanceof Error ? readError.message : String(readError);
+            const msg = `${method} ${path} — unreadable ${res.status} body: ${why}`;
+            throw new AdminApiError(msg, res.status, retryAfterFrom(res, null));
+        }
         if (!res.ok)
             throw new AdminApiError(
             // The server's own `error` string is passed through UNCHANGED — it is

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@pouchy_ai/admin-sdk",
-	"version": "0.39.1",
+	"version": "0.40.1",
 	"description": "Typed TypeScript client for the Pouchy Admin API \u2014 manage agents, keys, end users, knowledge, skills, channels, schedules, webhooks and credentials headlessly, with a project Admin key.",
 	"type": "module",
 	"license": "SEE LICENSE IN LICENSE",