@recursiv/sdk 0.7.123 → 0.7.195

package/README.md

@@ -68,7 +68,7 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | `r.databases` | `ensure`, `create`, `list`, `getCredentials`, `query` |
 | `r.envVars` | `set`, `list`, `delete` (values write-only; secrets masked on read) |
 | `r.projects` | `create`, `deploy`, `executeCode`, `createSandbox`, `stopSandbox`, `deploymentLogs` |
-| `r.deployments` | Operator release coordination: `reserveRelease`, `getRelease`, `advanceRelease`, `startRelease`, `finishRelease`, `recoverRelease`; follow the [shared release guide](../../docs/deploy/shared-releases.md) |
+| `r.deployments` | Operator release coordination: `reserveRelease` (optional initial-run `coordinator_identity_token` after compatible API rollout), `getRelease`, `advanceRelease`, `startRelease`, `finishRelease`, `recoverRelease`; follow the [shared release guide](../../docs/deploy/shared-releases.md) |
 | `r.storage` | `ensureBucket`, `getUploadUrl`, `getDownloadUrl`, `listItems`, `deleteObject` |
 | `r.telemetry` | `productCounts` — app-bound first-party aggregate counts; reviewed event names and counts only, retained at most 30 days |
 | `r.sandbox` | `execute` (anonymous, no API key needed) |
@@ -76,7 +76,7 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 ### AI Agents
 | Resource | Key methods |
 |----------|------------|
-| `r.agents` | `create`, `update`, `chat`, `chatStream`, `retryChatStream`, `grantProjectAccess`, `conversations`, `discover` (the app's agent directory: server search and sort, keyless-readable) |
+| `r.agents` | `create`, `update`, `chat`, `chatStream`, `retryChatStream`, `grantProjectAccess`, `conversations` (each with a `name`), `createConversation` ("New chat" with your own personal agent; send its first message with `chatStream` and its `conversation_id`), `discover` (the app's agent directory: server search and sort, keyless-readable) |
 | `r.e2ee` | `status`, `registerDevice`, `devices`, `revokeDevice` (`{ cascade }` to also revoke devices approved through it; 409 `has_dependents` otherwise), `requestResetCode` and `resetAccount` (reset encrypted chat with an emailed code where `status().accountReset`), `peerChanges` (contacts whose main device a reset replaced since a time), `publishKeyPackages`, `keyPackageStatus`, `claimKeyPackage`, `appendEvent` (`trust_change: true`: after a contact's reset, 409 `peer_not_joined` until this account added their new device), `events`, `acknowledge`, `conversations`, `requestStart` and `cancelStartRequest` (ask the other person to encrypt a chat when they have no device yet: a message with `metadata.kind` `e2ee_start_request`; the live ones are `ConversationDetail.encryption_requests`); device linking by scan: `createLink`, `link`, `scannedLink`, `approveLink`, `completeLink`, `linkProgress`, `cancelLink` (flag-gated E2EE v2 transport; its doorbell is `r.realtime.onE2eeEvent`, which carries a small message's stored ciphertext to the owner's own sockets; link and device changes arrive on `r.realtime.onE2eeLink` and `onE2eeDevices`, a contact's reset on `onE2eePeer`) |
 | `r.brain` | `sendMessage` |
 | `r.commands` | `execute`, `gatePrompt` |
@@ -96,14 +96,16 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | Resource | Key methods |
 |----------|------------|
 | `r.posts` | `create`, `update`, `list`, `get`, `getMany(ids)` (up to 25 posts by id per request, no thread; a `Map` of each id's post or `NotFoundError`; 0.7.77), `liked`, `bookmarked`, `bookmark`, `unbookmark`, `search`, `replies`, `react` |
-| `r.search` | `query` (blended search in sections; a thin answer steps down the search ladder, each item labelled `via`, the answer's `ladder` says how) |
+| `r.search` | `query` (blended search in sections; a thin answer steps down the search ladder, each item labelled `via`, the answer's `ladder` says how). A visitor's search posts (`publicDiscovery.search`, `PublicSearchPage`) may carry `picture` (`SearchPicture`, 0.7.162): `kind`, `textHeavy`, `tileQuality` (0-3) and an optional `focal` point, layout hints from a background read of pictures the floors cleared, absent until judged and never a safety signal; on the `deep` stage `picture.showsQuery` (0.7.190) says whether the picture itself shows the query, absent unless the operator turned on `SEARCH_PICTURE_SUBJECT`. Both answers may carry `video_lead` (`SearchVideoLeadEntry[]`, 0.7.173): every clip in the order to lead and play it, the most about the words first, then the freshest, a Minds member's clip winning a tie |
 | `r.bookmarks` | `save`, `unsave`, `posts`, `list`, `keys`, `merge` — the member's saved posts, open-network posts and articles, synced across devices; `collections`: `list`, `create`, `update`, `remove`, `add`, `removeItem`, `items`, `posts` — private named collections of saves (0.7.68, where `network.getConfig()` advertises `capabilities.bookmark_collections`) |
-| `r.feeds` | `top` (what the member is most likely to engage with, rotated by what they saw, with open-network lanes and the lead story), `stories` (the story tail), `publicTop` (a visitor's top, keyless and edge-cacheable) |
+| `r.feeds` | `top` (what the member is most likely to engage with, rotated by what they saw, with open-network lanes and the lead story), `stories` (the story tail), `publicTop` (a visitor's top, keyless and edge-cacheable), `firehose` (0.7.195: the member's live stream of the most engaged, viral and breaking posts, never repeated in a session) |
+| `r.alive` | `tick({ followingSince?, posts?, thread? })` (0.7.193; the member's own app key, `users:read`; 404 `alive_disabled` until the operator sets `ALIVE_TICK_ENABLED`): whether anyone the member follows posted since the newest row they hold (`following.fresh`), the current counts of up to 30 posts on screen they may see, the new replies under the open post (their own left out), and `nextAfterMs` (when to tick next). Asked once; at most 4 a minute |
 | `r.communities` | `create`, `join`, `search`, `members` |
 | `r.chat` | `send`, `dm`, `createGroup` (`encrypted: true` for an end-to-end encrypted group, 0.7.59), `messages` (cursor paging), `acceptRequest`, `declineRequest`, `leave`, `deleteConversation`; a private group's admin: `addMembers`, `removeMember`, `updateGroup` (0.7.59); photos and voice notes: `uploadAttachment`, `signAttachments` (private chat storage, 0.7.82) |
 | `r.tags` | `create`, `list` |
 | `r.signals` | `batch` (up to 100 engagement signals, such as views, dwell and hides, for the member's own ranking; `keepalive` for a page-leave flush), `record` (one signal) (0.7.71); `clearViewingHistory` ("Clear my viewing history"); typed `SignalMetadata`, an id per event so a retry is stored once, and `duplicates`/`limited`/`rejected` in the answer (0.7.93) |
 | `r.privacy` | `capabilities` (the platform privacy facts the deployed API's build enforces, and its commit); pair with `@recursiv/sdk/privacy` (`PRIVACY_FACTS`, `isFactLive`, `liveFacts`) (unreleased) |
+| `r.reports` | `create`, `list`, `resolve`, `dismiss`, `signAttachments`; 0.7.152 `sealed_answer` reports target the key's exact project id and need `posts:write` on a human-owned, non-agent project key. This intake does not recheck live app membership; the Sealed gateway additionally does. Review applies no account enforcement. Every answer request, including a join, spends report budget. `create` returns the report `id`, optional `existing`, and `details_kept` for an answer: false means its reason was kept but its text did not fit in full. Deploy supporting API before client adoption. |
 | `r.sealed` | Sealed mode: `config`, `attestation`, `send`; for web Sealed's frame (unreleased): `frameToken` (a short-lived `sft_` credential for the frame), `me` (the member's own age view and Sealed adult setting), `report`; pair with `@recursiv/sdk/sealed` (the resource alone) and `@recursiv/sdk/sealed-frame` (below) |
 | `r.curator` | `today` (World Today; a world story can carry `story_key` and `discussion`, its count across networks), `storyPosts` / `memberStoryPosts` (one page of a story's posts, keyless or under the member's key), `storyPostPages` (walk every page), `forYou`, `run`, `refreshIfStale`, `seedDeck` |
 | `r.uploads` | `uploadMedia` — upload post/chat bytes end to end |
@@ -113,10 +115,11 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 ### Platform
 | Resource | Purpose |
 |----------|---------|
+| `r.settings` experience | `getExperience`, `updateExperience({ version, goals?, interests?, avoid_categories? })`, `undoExperience({ version })` — explicit per-app starting choices with a real category Discover link; requires the member's own project-bound key (unreleased). Does not change whole-feed ranking or privacy settings. |
 | `r.settings` | User preferences (including app-scoped content choices; per-kind notification settings in `notifications.channels`, set one kind with `updateNotifications({ channels: { post_reaction: { push: false } } })`, 0.7.72), sessions (`revokeOtherSessions` keeps this device), password management, email change (`requestConfirmationCode` for accounts with no password), deactivation (`disableAccount({ password })`, 0.7.71; 404 on an API that does not serve it) |
 | `r.billing` | Usage tracking, subscriptions, checkout |
 | `r.appSubscriptions` | Consumer app plans: `checkout`, `status`, `createPortalSession`, `previewTierChange`, `changeTier` |
-| `r.boosts` | Promoted posts: `create`, `mine`, `balance`, `pause`, `resume`, `cancel`, `recordEvent`, `topup`, `confirmTopup`; admin `listPendingReview`, `review`, `grant` |
+| `r.boosts` | Promoted posts: `create`, `mine`, `balance`, `pause`, `resume`, `cancel`, `recordEvent`, `stats`, `topup`, `confirmTopup`, `topupWithTokens`; a feed page's boosts `slots` / `publicSlots` (splice with `spliceBoostSlots`); admin `listPendingReview`, `review`, `grant` |
 | `r.wallet` | Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`), a wallet the member holds linked by signature (`createLinkNonce`, `linkWallet`, `listLinkedWallets`, `unlinkWallet`), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`) |
 | `r.notifications` | Notification stream (`list`, `unreadCount`, `markAsRead`, `archive`, `markAllAsRead`; `category: 'mentions'` for mentions and replies only, 0.7.72) and push tokens |
 | `r.github` | GitHub integration |
@@ -128,7 +131,7 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | `r.goals` | Org goals with task rollups (group dispatcher tasks) |
 | `r.media` | `sourceApprovals({ projectId, sources })` — cached public host/purpose judgments and exact owned hosts; no caller-triggered provider fetch or inference. Image/icon requests stay relayed; direct players use approved, unexpired decisions once enforcement is active |
 | `r.linkPreview` | `get(url, source?, { projectId })` opts into expiring relayed image/icon capabilities; refresh before `media_expires_at`, and preserve source authorization. `get(url)` — a public link's Open Graph card (`data: null` when it has none). For a chat link pass `{ messageId }` or `{ conversationId }` on a signed-in key with `chat:read`: the link is fetched only when it is in the named message and a person wrote that message, or the caller wrote it in that conversation, else `refused: 'ai_link'`. A source with no id rejects (`ValidationError`). Not in encrypted chats: the server cannot read them, so leave `source` out there and apply the app's own rule |
-| `r.protocols` | Private Minds safety: `sourceControls` (current enablement and saved choices; filter with `control`, each item may carry a `display` label), `setSourceControl`, `onSourceControlChange`, `reportSource`. Delegated accounts: `nativeSocialAccounts`, `startNativeSocialConnection`, `finishNativeSocialConnection`, `disconnectNativeSocialAccount`. Native follows: `nativeFollowStates` (every connected account's state for one source, one read), `nativeFollowState`, `prepareNativeFollow`, `submitNativeFollow`, `nativeFollowStatus` (native following or pending approval, distinct from a Minds feed subscription; preserve the complete signed Nostr list). Native reposts and undo: `nativeRepostState`, `prepareNativeRepost`, `submitNativeRepost`, `nativeRepostStatus` (public posts, explicit approval, connected account, no uncertain retries). Native likes and unlikes: `nativeLikeState`, `prepareNativeLike`, `submitNativeLike`, `nativeLikeStatus` (connected authority, app enablement and explicit approval; resume pending actions instead of duplicating them). Reviewed replies and optional linked posts: `prepareNativeReply`, `submitNativeReply`, `nativeReplyStatus`, `nativeReplyHistory`, `prepareNativeReplyRemoval`, `removeNativeReply` (require deployed API support and app enablement). Keyless shared post links: `sharedNetworks(projectId)`, `getSharedConversation(projectId, { protocol, post, readRef?, replies?: 'none' })` (`replies: 'none'`, 0.7.78: the post alone for a card, with `repliesStatus: 'not_requested'`; `getPublicConversation` and `getConnectedSocialConversation` take it too). Member public reading: `searchPublicPosts` (selected account required for Bluesky/ActivityPub; public Nostr search), `getConnectedSocialConversation` (preserve result readerAccountId/readRef), `publicNetworks`, `searchPublicProfiles`, `getPublicProfile`, `getPublicAuthorFeed`, `getFollowingFeed`, `getPublicConversation`, `getPublicTrends`, `getPublicTrendFeed`; a Fediverse community's newest threads, read-only (0.7.109): `getOpenGroupThreads({ group, limit?, cursor?, compass? })`, `group` being the `actor` of a groups read's `open_network` entry; radar stories: `getPublicRadarStory` (one story by id with its posts; one that left the radar within its minimum lifetime, or within the last half hour, still answers live with `liveUntil` and the story that continues it; one that has left for longer comes with its archived copy and the live story it continues as; the id may be a World Today edition story's, and the answer then names it in `editionStory` under the story's radar id; a story a World Today story seeded carries `volume`, the first page of the posts that story counts across Minds and the open networks, whose `cursor` goes on with `curator.storyPosts` or `curator.memberStoryPosts`), keyless `getSharedRadarStory(projectId, { cluster })` and `getSharedRadarPosts(projectId, { cluster })` (keyless reads carry images and videos only from outlets and members marked `visitorMedia`; signed-in reads keep all media, so a share card uses only those); the Viral read (fastest-moving posts across Bluesky, the Fediverse, Nostr and Minds, each against its own network's pace; 0.7.59): `getPublicViral({ network?, category?, media?: 'video', limit?: 5 | 10 | 20 | 40, cursor?, compass? })` under the member's key and keyless `getSharedViral(projectId, params)` (visitors: `compass` `all` or `hide` only; a visitor's `media: 'video'` read can carry items whose video the server withheld, so filter with the exported `viralItemHasVideo` before a video player; `item.post` narrows on `item.protocol`). `status: 'off'` resolves with no items until the app enables the read, and `getSharedViral` also resolves an older API's 401 `missing_api_key` as off; `getPublicViral` throws every 401 and 403, so a session failure is never read as off; private app subscriptions: `listSubscriptions`, `subscribeToProfile`, `unsubscribeFromProfile`, `onSubscriptionChange`. `list` returns bounded adapter `maturity`, `limitations`, and exhaustive `supported`/`planned`/`unsupported` implementation capabilities (not provider health or enablement); settings, candidate refresh/status, search, and read-only quarantined candidate review via `listCandidates` / `getCandidate` |
+| `r.protocols` | Private Minds safety: `sourceControls` (current enablement and saved choices; filter with `control`, each item may carry a `display` label), `setSourceControl`, `onSourceControlChange`, `reportSource`. Delegated accounts: `nativeSocialAccounts`, `startNativeSocialConnection`, `finishNativeSocialConnection`, `disconnectNativeSocialAccount`. Native follows: `nativeFollowStates` (every connected account's state for one source, one read), `nativeFollowState`, `prepareNativeFollow`, `submitNativeFollow`, `nativeFollowStatus` (native following or pending approval, distinct from a Minds feed subscription; preserve the complete signed Nostr list). Native reposts and undo: `nativeRepostState`, `prepareNativeRepost`, `submitNativeRepost`, `nativeRepostStatus` (public posts, explicit approval, connected account, no uncertain retries). Native likes and unlikes: `nativeLikeState`, `prepareNativeLike`, `submitNativeLike`, `nativeLikeStatus` (connected authority, app enablement and explicit approval; resume pending actions instead of duplicating them). Reviewed replies and optional linked posts: `prepareNativeReply`, `submitNativeReply`, `nativeReplyStatus`, `nativeReplyHistory`, `prepareNativeReplyRemoval`, `removeNativeReply` (require deployed API support and app enablement). Keyless shared post links: `sharedNetworks(projectId)`, `getSharedConversation(projectId, { protocol, post, readRef?, replies?: 'none' })` (`replies: 'none'`, 0.7.78: the post alone for a card, with `repliesStatus: 'not_requested'`; `getPublicConversation` and `getConnectedSocialConversation` take it too). Member public reading: `searchPublicPosts` (selected account required for Bluesky/ActivityPub; public Nostr search), `getConnectedSocialConversation` (preserve result readerAccountId/readRef), `publicNetworks`, `searchPublicProfiles`, `getPublicProfile`, `getPublicAuthorFeed`, `getFollowingFeed`, `getPublicConversation`, `getPublicTrends`, `getPublicTrendFeed`; a Fediverse community's newest threads, read-only (0.7.109): `getOpenGroupThreads({ group, limit?, cursor?, compass? })`, `group` being the `actor` of a groups read's `open_network` entry; radar stories: `getPublicRadarStory` (one story by id with its posts; one that left the radar within its minimum lifetime, or within the last half hour, still answers live with `liveUntil` and the story that continues it; one that has left for longer comes with its archived copy and the live story it continues as; the id may be a World Today edition story's, and the answer then names it in `editionStory` under the story's radar id; a story a World Today story seeded carries `volume`, the first page of the posts that story counts across Minds and the open networks, whose `cursor` goes on with `curator.storyPosts` or `curator.memberStoryPosts`), keyless `getSharedRadarStory(projectId, { cluster })` and `getSharedRadarPosts(projectId, { cluster })` (keyless reads carry images and videos only from outlets and members marked `visitorMedia`; signed-in reads keep all media, so a share card uses only those); keyless category surface (0.7.165): `getSharedCategorySurface(projectId, { category, compass? })`, a category's `stories`, `network` and `clips` for a signed-out page in one read under every visitor floor (`compass` `all` or `hide`, or a side or Mix where the visitor catalog lists `compass_sides`, answered `unavailable`; never people or groups); the Viral read (fastest-moving posts across Bluesky, the Fediverse, Nostr and Minds, each against its own network's pace; 0.7.59): `getPublicViral({ network?, category?, media?: 'video', limit?: 5 | 10 | 20 | 40, cursor?, compass? })` under the member's key and keyless `getSharedViral(projectId, params)` (visitors: `compass` `all` or `hide` only; a visitor's `media: 'video'` read can carry items whose video the server withheld, so filter with the exported `viralItemHasVideo` before a video player; `item.post` narrows on `item.protocol`). `status: 'off'` resolves with no items until the app enables the read, and `getSharedViral` also resolves an older API's 401 `missing_api_key` as off; `getPublicViral` throws every 401 and 403, so a session failure is never read as off; private app subscriptions: `listSubscriptions`, `subscribeToProfile`, `unsubscribeFromProfile`, `onSubscriptionChange`. `list` returns bounded adapter `maturity`, `limitations`, and exhaustive `supported`/`planned`/`unsupported` implementation capabilities (not provider health or enablement); settings, candidate refresh/status, search, and read-only quarantined candidate review via `listCandidates` / `getCandidate` |
 
 Full reference: see [llm.md](./llm.md) (ships with this package) or the type definitions in `dist/`.
 
@@ -655,8 +658,67 @@ for (const network of data.networks) {
 await r.protocols.setNetwork('nostr', { enabled: false, removePast: true });
 ```
 
+One-tap actions act as the member's own identity on that network by default (0.7.191). `engageLike`,
+`engageRepost`, `engageFollow`, `engageReply` and `engageQuote` take `identity?: 'native' | 'linked'`. A
+native answer is sent (`queued: false`, with the network's `delivery`) or, while the identity is still
+being set up, queued (202, `queued: true`, sent in order once it is on; `pendingInteractions()` lists
+them). A linked answer is the review to submit, as `prepareNativeLike` always returned. Every answer
+says who acted (`actedAs`). A member who linked an account before the cutover keeps acting as it until they
+choose otherwise with `setEngageDefault(network, 'native')`; the first such answer carries
+`notice: 'engage_default_linked'`. An account linked later is a choice: `setEngageDefault(network, 'linked')`.
+Keep the same `clientMutationId` across retries: a retry is answered from the first tap, never sent twice
+(once that tap expired unsent, with `delivery.code` `interaction_expired`; a new tap takes a new id). A native
+reply's or quote's `media` takes only the member's own Minds uploads, as the linked flows do.
+
+```ts
+const { data } = await r.protocols.engageLike({ protocol: 'bluesky', nativeId: post.nativeId, clientMutationId, action: 'like' });
+if (data.identity === 'native') showActedAs(data.actedAs, data.queued ? 'Sending when your account is ready' : null);
+else await r.protocols.submitNativeLike(data.id, { approve: true });
+```
+
+A member's AT Protocol account is created on the PDS Minds runs, with their verified email (0.7.191); Minds keeps only a
+revocable app password named "Minds". `claimAtprotoPassword({ password })` (or `{ emailCode }` from
+`POST /settings/confirmation-code` with purpose `atproto_password`, for an account with no password) has the PDS
+email a reset code to that address, so the member can sign in from any AT Protocol app and revoke Minds there.
+A member without a verified email reads `needs_action` with reason `needs_verified_email` on AT Protocol.
+
+```ts
+const { data } = await r.protocols.claimAtprotoPassword({ password });
+show(`We sent a reset code for ${data.handle} to ${data.sentTo}`);
+```
+
+AT Protocol reads `needs_action` with reason `needs_atproto_grant` for an account made before Minds ran it natively,
+and `error` with `app_password_revoked` after the member revoked Minds' app password. `grantAtproto({ password })`
+(0.7.191), with that account's password (or a non-privileged app password the member made), lets Minds act as it again:
+Minds keeps only a new revocable app password, and answers the handle and the presence after the grant.
+
+```ts
+const { data } = await r.protocols.grantAtproto({ password: atPassword });
+if (data.presence.state === 'on') show(`Minds acts as ${data.handle} again`);
+```
+
+A member can take their Minds-held Nostr key home, in three steps of their own:
+`protocols.exportNostrKey({ password })` returns it as an `nsec` (an account with no password
+sends `{ emailCode }` from `settings.requestConfirmationCode('nostr_key')`); after they
+import it into their signer, `nostrRebindChallenge()` and `rebindNostrKey(signedEvent)`
+prove the device holds the same key; then `deleteManagedNostrCopy({ password })` deletes
+Minds' copy, and every later Nostr action is signed on their device. What Minds published
+with the key still comes down when they delete a post or their account (Minds signs those
+takedowns before the copy goes; 409 `too_many_published` keeps the copy when there is too
+much). Show the `nsec` to the member alone and never log it. None of these is retried
+automatically.
+
 ### Native Nostr signing
 
+A member's Nostr key is either their own, signed on their device, or one Minds holds for them (0.7.192).
+`nativeNostrAccount()` says which: `signing: 'client'` is the flow below; `signing: 'server'` (with
+`mode: 'managed'`) means Minds signs. Then `prepareNativeNostr` is the preview to show (nothing is signed
+or sent), and `prepareNativeNostr(id, { ...input, send: true })` once the member approves signs and sends
+in that call and answers with the `receipt` (nothing to submit). A like, repost or follow review is submitted with
+`{ approve: true }` and no `event`, and `engageLike`, `engageReply`, `engageFollow` and the rest with
+`identity: 'native'` act as that key in one tap. For a key Minds holds, a like or repost Minds is still sending (the
+relay has not taken it yet) reads as liked or reposted with `acknowledged: false`, and an unlike or unrepost removes it.
+
 Use `protocols.nativeNostrAccount()` to check the app's explicit native-write
 capability. For an enabled connected key, prepare a text post with
 `prepareNativeNostr(identityId, { action: 'publish', content })`, show its
@@ -957,6 +1019,16 @@ is a visitor's top (safe items only, the same for every visitor in one 15-minute
 read with no credential so the edge can hold it. Each answers 404 while the app's operator
 has it off. Send `block: 'top'` and the item's position with a visible view of a top item.
 
+`sdk.feeds.firehose({ session, limit?, compass?, network? })` (0.7.195) is the member's live
+stream: the next items of the most engaged, viral and breaking posts of Minds and the open
+networks, re-checked for the member on the server and never sent twice in one `session`. Each
+item carries `network`, `state` (`breaking`, `viral` or null), `publishedAt`, `chosenAt`, an
+in-app `target` and, for an open-network post, a `card`. Reveal them one at a time and read
+again no sooner than `meta.refillAfterMs`; remove the refs in `retract` wherever you hold them.
+404 while the app's operator has it off; 429 and 503 carry Retry-After. A Mix or Choose sides `compass`
+spends one of the member's hourly sided Politics reads at most once per `session` and choice in ten
+minutes, and answers 429 `compass_rate_limited` once those are spent.
+
 A feed session opens with it when asked: `createFeed({ networks, top: { ref, session? }, seen,
 seenClusters?, bucket? })` (or `new DiscoveryFeedSession(..., { top: { ref, read, post? }, seen })`
 with your own readers). The top's read starts with the first page's reads, and the top holds

package/dist/index.d.ts

@@ -68,6 +68,7 @@ import { LinkPreviewResource } from './resources/link-preview.js';
 import { SearchResource } from './resources/search.js';
 import { BookmarksResource } from './resources/bookmarks.js';
 import { FeedsResource } from './resources/feeds.js';
+import { AliveResource } from './resources/alive.js';
 import { AccountsResource } from './resources/accounts.js';
 import { SignalsResource } from './resources/signals.js';
 import { SealedResource } from './resources/sealed.js';
@@ -133,6 +134,8 @@ export declare class Recursiv {
     readonly discovery: DiscoveryResource;
     /** The top of a feed: what the member (or a visitor) is most likely to engage with, rotated by what they have seen. */
     readonly feeds: FeedsResource;
+    /** The alive tick: whether people the member follows posted, current counts on screen, new replies (0.7.193). */
+    readonly alive: AliveResource;
     readonly video: VideoResource;
     readonly appSubscriptions: AppSubscriptionsResource;
     readonly boosts: BoostsResource;
@@ -182,7 +185,7 @@ export type { E2eeAccountReset, E2eeDevice, E2eeDevicesRealtimeEvent, E2eeEnvelo
 export { ProjectsResource } from './resources/projects.js';
 export { AgentsResource, SUPPORTED_MODELS, AGENT_DIRECTORY_SORTS, AGENT_DIRECTORY_MAX_LIMIT } from './resources/agents.js';
 export { EvidenceResource } from './resources/evidence.js';
-export type { EvidenceTarget, EvalType, CreateEvalInput, SimulateInput, SimulateResult, EvalRunRow, EvalResultRow, EvalRunDetail, EvidenceSummary, EvidenceEvent, EvidenceRecordDetail } from './resources/evidence.js';
+export type { EvidenceTarget, EvalType, CreateEvalInput, SimulateInput, SimulateResult, EvalRunRow, EvalResultRow, EvalRunDetail, EvidenceSummary, EvidenceEvent, EvidenceRecordDetail, CreateEvalSetInput, EvalSetRow, EvalRunExport } from './resources/evidence.js';
 export type { AgentMessage, AgentMessageInput, AgentInboxParams, AgentAskInput, AgentAskResult, SupportedModel, SalesLead, SalesLeadListParams, SalesLeadStatus, AgentDirectorySort, AgentDirectoryParams, AgentDirectoryEntry, AgentDirectoryMeta, AgentDirectoryPage } from './resources/agents.js';
 export { TagsResource } from './resources/tags.js';
 export { SandboxResource } from './resources/sandbox.js';
@@ -191,6 +194,7 @@ export { OrganizationsResource } from './resources/organizations.js';
 export { NotificationsResource } from './resources/notifications.js';
 export type { Notification, NotificationActor, NotificationCategory, NotificationPostPreview, NotificationPostTag, NotificationScopeParams, NotificationUnreadCount, ListNotificationsParams, NotificationListResponse, } from './resources/notifications.js';
 export { SettingsResource } from './resources/settings.js';
+export type { ExperienceGoal, ExperienceCategory, MemberExperience, UpdateMemberExperienceInput } from './resources/member-experience.js';
 export { BillingResource } from './resources/billing.js';
 export { FreeTierResource } from './resources/free-tier.js';
 export { InviteCodesResource } from './resources/invite-codes.js';
@@ -204,7 +208,7 @@ export { EnvVarsResource } from './resources/env-vars.js';
 export type { QueryDatabaseInput, QueryResult } from './resources/databases.js';
 export { GitHubResource } from './resources/github.js';
 export { DeploymentsResource } from './resources/deployments.js';
-export type { DeploymentReleaseInput, DeploymentRelease, DeploymentReleaseOperation, DeploymentReleaseRecoveryInput } from './resources/deployments.js';
+export type { DeploymentReleaseInput, DeploymentReleaseReservationInput, DeploymentRelease, DeploymentReleaseOperation, DeploymentReleaseRecoveryInput } from './resources/deployments.js';
 export type { PrepareProtocolServersInput, PreparedProtocolServers, ProtocolServerPreparation, ProtocolServerUpgradePreview, ProtocolServerUpgradeInput, ProtocolServerUpgradeStatus } from './resources/deployments.js';
 export { IntegrationsResource } from './resources/integrations.js';
 export type { ExecuteToolInput, ExecuteToolResult } from './resources/integrations.js';
@@ -228,10 +232,12 @@ export { TrustResource } from './resources/trust.js';
 export type { TrustEnvelope, OwnTrustEvent, TrustPublicKey, OwnTrustEvents } from './resources/trust.js';
 export { LinkPreviewResource } from './resources/link-preview.js';
 export { SEARCH_MEDIA_KINDS, SEARCH_SECTIONS, SearchResource } from './resources/search.js';
-export type { PublicSearchPage, PublicSearchTab, SearchAnswer, SearchGroup, SearchLadder, SearchOmitReason, SearchParams, SearchPerson, SearchPost, SearchRelated, SearchResponse, SearchSection, SearchStage, SearchStory, SearchTopic, SearchVia, SearchMedia, SearchMediaEmbed, SearchMediaItem, SearchMediaKind, SearchMediaProvider, SearchMediaProviderStatus, SearchMediaSource, } from './resources/search.js';
+export type { PublicSearchPage, PublicSearchTab, SearchAnswer, SearchGroup, SearchLadder, SearchOmitReason, SearchParams, SearchPerson, SearchPicture, SearchPost, SearchRelated, SearchResponse, SearchSection, SearchStage, SearchStory, SearchTopic, SearchVia, SearchVideoLeadEntry, SearchVideoLeadSource, SearchMedia, SearchMediaEmbed, SearchMediaItem, SearchMediaKind, SearchMediaProvider, SearchMediaProviderStatus, SearchMediaSource, } from './resources/search.js';
 export { BOOKMARK_MERGE_MAX_ITEMS, BookmarkCollectionsResource, BookmarksResource } from './resources/bookmarks.js';
 export { FEED_TOP_NETWORKS, FeedsResource } from './resources/feeds.js';
-export type { FeedStoriesParams, FeedStoriesResponse, FeedStory, FeedTopExplain, FeedTopItem, FeedTopMeta, FeedTopNetwork, FeedTopNetworkCard, FeedTopNetworkEntry, FeedTopNetworkMap, FeedTopParams, FeedTopResponse, FeedTopTarget, PublicFeedTopMeta, PublicFeedTopParams, PublicFeedTopResponse, } from './resources/feeds.js';
+export { AliveResource } from './resources/alive.js';
+export type { AliveTick, AliveTickCounts, AliveTickParams } from './resources/alive.js';
+export type { FeedFirehoseItem, FeedFirehoseMeta, FeedFirehoseNetwork, FeedFirehoseParams, FeedFirehoseResponse, FeedStoriesParams, FeedStoriesResponse, FeedStory, FeedTopExplain, FeedTopItem, FeedTopMeta, FeedTopNetwork, FeedTopNetworkCard, FeedTopNetworkEntry, FeedTopNetworkMap, FeedTopParams, FeedTopResponse, FeedTopTarget, PublicFeedTopMeta, PublicFeedTopParams, PublicFeedTopResponse, } from './resources/feeds.js';
 export type { BookmarkCollection, BookmarkCollectionInput, BookmarkCollectionKind, BookmarkCollectionPatch, BookmarkCollectionsList, BookmarkCollectionTarget, BookmarkCollectionVisibility, BookmarkedPost, BookmarkInput, BookmarkItem, BookmarkKey, BookmarkKeyRow, BookmarkKeysPage, BookmarkKind, BookmarkMergeItem, BookmarkMergeResult, BookmarkProtocol, BookmarkRequestOptions, BookmarksPage, FiledBookmark, RemovedBookmarkCollection, SavedBookmark, UnfiledBookmark, UnsavedBookmark, } from './resources/bookmarks.js';
 export { AccountsResource } from './resources/accounts.js';
 export { SIGNAL_BATCH_MAX, SignalsResource, newClientEventId } from './resources/signals.js';
@@ -248,11 +254,11 @@ export { UploadsResource } from './resources/uploads.js';
 export type { UploadMediaInput, UploadUrlInput, UploadUrlResult } from './resources/uploads.js';
 export { WalletResource } from './resources/wallet.js';
 export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry, WalletLink, WalletLinkNonce } from './resources/wallet.js';
-export { BoostsResource } from './resources/boosts.js';
-export type { BoostBalance, BoostBalanceResponse, BoostCampaign, BoostCampaignResponse, BoostEventResult, BoostLedgerEntry, BoostLedgerKind, BoostPlanCredit, BoostRejectionReason, BoostReviewStatus, BoostStatus, BoostTopupCheckout, BoostTopupConfirmation, BoostTopupLimits, } from './resources/boosts.js';
+export { BoostsResource, spliceBoostSlots } from './resources/boosts.js';
+export type { BoostBalance, BoostBalanceResponse, BoostCampaign, BoostCampaignResponse, BoostCampaignStats, BoostDailyStats, BoostEventResult, BoostLedgerEntry, BoostLedgerKind, BoostPlanCredit, BoostRejectionReason, BoostReviewStatus, BoostSlotItem, BoostSlotSurface, BoostSlotsParams, BoostSlotsResponse, BoostStatus, BoostTopupCheckout, BoostTopupConfirmation, BoostTopupLimits, BoostTokenTopupInfo, BoostTokenTopupResult, PublicBoostSlotsParams, } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';
 export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, SOCIAL_FOLLOWING_SOURCE_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
-export type { SocialProfile, SocialBridge, SocialSubscription, SocialSubscriptionChange, SocialProfilePage, SocialRadar, SocialRadarCluster, SocialRadarMember, SocialRadarParams, SocialRadarSourceKind, SocialRadarPosts, SocialRadarStory, SocialRadarStoryArchive, ViralBaseline, ViralItem, ViralItemFields, ViralItemSpread, ViralItemVelocity, ViralLabel, ViralMindsCard, ViralMindsItem, ViralNetwork, ViralOpenProtocol, ViralProtocol, ViralProvider, ViralReadMeta, ViralReadParams, ViralReadResponse, ViralReadStatus, ViralRef, ViralSocialItem, SocialNetwork, SocialPost, SocialConversation, SocialTrend, SocialTrendProvenance, SocialTrends, SocialTrendSourceIndex, SocialTrendFeed, SocialPopularProfiles, SocialAuthorFeed, OpenGroupThreads, OpenGroupThreadsGroup, OpenGroupThreadsParams, SocialFollowingFeed, SocialFollowingSource, SocialFollowingSourceStatus, SearchPublicProfilesParams, SearchPublicPostsParams, SocialPostSearch, HostedProtocolConnections, HostedProtocol, HostedProtocolIdentity, HostedNostrChallenge, HostedNostrIdentityProof, NativeNostrPrepareInput, NativeNostrPrepared, NativeNostrAccount, NativeNostrPostState, NativeNostrReceipt, NativeSocialProtocol, FederationIdentity, FederationIdentityView, NativeSocialAccount, NativeNetwork, NativeNetworkState, NativeNetworkPresence, NativeNetworkActivation, NativeNetworkOff, SetNativeNetworkInput, NativeSocialCallbackInput, NativeReplyPrepareInput, NativePostPrepareInput, NativeMediaInput, NativeMediaItem, NativePostBatch, NativePostQuote, NativePostHistory, NativeDelegatedPostHistoryItem, NativeNostrPostHistoryItem, NativeFollowSourceInput, NativeFollowPrepareInput, NativeFollowTarget, NativeFollowReceipt, NativeFollowState, NativeFollowAccount, NativeFollowStates, NativeFollowReview, NativeLikeSourceInput, NativeRepostSourceInput, NativeLikePrepareInput, NativeRepostPrepareInput, NativeLikeTarget, NativeRepostTarget, NativeLikeReceipt, NativeRepostReceipt, NativeLikeState, NativeRepostState, NativeLikeReview, NativeRepostReview, NativeReplyReceipt, NativeReplyBatch, NativeReplyHistory, NativeDelegatedReplyHistoryItem, NativeNostrReplyResult, NativeNostrReplyHistoryItem, NativeReplyRemovalReceipt, NativeReplyRemovalPreview, SocialSourceRef, SocialSourceControl, SocialSourceControlDisplay, SocialSourceControlChange, HostedPostPreview, ConnectHostedIdentityInput, CreateHostedIdentityInput, CreatedHostedProtocolIdentity, PreviewHostedPostInput, PublishHostedPostInput, ListProtocolCandidatesParams, ProtocolAdapterMaturity, ProtocolAdapterMetadata, ProtocolCandidateListResponse, ProtocolCandidatePageMeta, ProtocolCapabilityOperation, ProtocolCapabilityStatus, ProtocolCollectionStatus, ProtocolIngestionActivityReason, ProtocolIngestionCircuitHealth, ProtocolIngestionDeadLetterGroup, ProtocolIngestionHealthPosition, ProtocolIngestionHealthReport, ProtocolIngestionHealthRuntime, ProtocolIngestionHealthSection, ProtocolIngestionLaneActivity, ProtocolIngestionLaneCurrentJob, ProtocolIngestionLaneDeadLetters, ProtocolIngestionLaneHealth, ProtocolIngestionLaneJobs, ProtocolIngestionReplayResult, ProtocolIngestionStatus, ProtocolQuarantinedCandidate, ProtocolRefreshResult, ProtocolSettings, ProtocolSettingsUpdateResult, ReplayProtocolIngestionJobInput, UpdateSettingsInput as UpdateProtocolSettingsInput, } from './resources/protocols.js';
+export type { SocialProfile, SocialBridge, SocialMention, SocialSubscription, SocialSubscriptionChange, SocialProfilePage, SocialRadar, SocialRadarCluster, SocialRadarMember, SocialRadarParams, SocialRadarSourceKind, SocialRadarPosts, SocialRadarStory, SharedCategorySurface, SharedCategorySurfaceParams, SocialRadarStoryArchive, ViralBaseline, ViralItem, ViralItemFields, ViralItemSpread, ViralItemVelocity, ViralLabel, ViralMindsCard, ViralMindsItem, ViralNetwork, ViralOpenProtocol, ViralProtocol, ViralProvider, ViralReadMeta, ViralReadParams, ViralReadResponse, ViralReadStatus, ViralRef, ViralSocialItem, SocialNetwork, SocialPost, SocialConversation, SocialTrend, SocialTrendProvenance, SocialTrends, SocialTrendSourceIndex, SocialTrendFeed, SocialPopularProfiles, SocialPopularProfile, SocialPopularProfilesParams, SocialPopularProfilesProtocol, SocialPopularProfilesSource, SocialAuthorFeed, OpenGroupThreads, OpenGroupThreadsGroup, OpenGroupThreadsParams, SocialFollowingFeed, SocialFollowingSource, SocialFollowingSourceStatus, SearchPublicProfilesParams, SearchPublicPostsParams, SocialPostSearch, HostedProtocolConnections, HostedProtocol, HostedProtocolIdentity, HostedNostrChallenge, HostedNostrIdentityProof, NativeNostrPrepareInput, NativeNostrPrepared, NativeNostrAccount, NativeNostrPostState, NativeNostrReceipt, NativeSocialProtocol, FederationIdentity, FederationIdentityView, NativeSocialAccount, NativeNetwork, NativeNetworkState, NativeNetworkPresence, NativeNetworkActivation, NativeNetworkOff, SetNativeNetworkInput, AtprotoPasswordClaimProof, AtprotoPasswordClaim, AtprotoGrant, EngageIdentity, EngageActedAs, EngageLinkedFields, NativeEngageSent, NativeEngageQueued, EngageAnswer, PendingNativeInteraction, EngageOneInput, NostrKeyStepUp, ManagedNostrKeyExport, NostrRebindChallenge, NostrRebindResult, ManagedNostrCopyDeleted, NativeSocialCallbackInput, NativeReplyPrepareInput, NativePostPrepareInput, NativeMediaInput, NativeMediaItem, NativePostBatch, NativePostQuote, NativePostHistory, NativeDelegatedPostHistoryItem, NativeNostrPostHistoryItem, NativeFollowSourceInput, NativeFollowPrepareInput, NativeFollowTarget, NativeFollowReceipt, NativeFollowState, NativeFollowAccount, NativeFollowStates, NativeFollowReview, NativeLikeSourceInput, NativeRepostSourceInput, NativeLikePrepareInput, NativeRepostPrepareInput, NativeLikeTarget, NativeRepostTarget, NativeLikeReceipt, NativeRepostReceipt, NativeLikeState, NativeRepostState, NativeLikeReview, NativeRepostReview, NativeReplyReceipt, NativeReplyBatch, NativeReplyHistory, NativeDelegatedReplyHistoryItem, NativeNostrReplyResult, NativeNostrReplyHistoryItem, NativeReplyRemovalReceipt, NativeReplyRemovalPreview, SocialSourceRef, SocialSourceControl, SocialSourceControlDisplay, SocialSourceControlChange, HostedPostPreview, ConnectHostedIdentityInput, CreateHostedIdentityInput, CreatedHostedProtocolIdentity, PreviewHostedPostInput, PublishHostedPostInput, ListProtocolCandidatesParams, ProtocolAdapterMaturity, ProtocolAdapterMetadata, ProtocolCandidateListResponse, ProtocolCandidatePageMeta, ProtocolCapabilityOperation, ProtocolCapabilityStatus, ProtocolCollectionStatus, ProtocolIngestionActivityReason, ProtocolIngestionCircuitHealth, ProtocolIngestionDeadLetterGroup, ProtocolIngestionHealthPosition, ProtocolIngestionHealthReport, ProtocolIngestionHealthRuntime, ProtocolIngestionHealthSection, ProtocolIngestionLaneActivity, ProtocolIngestionLaneCurrentJob, ProtocolIngestionLaneDeadLetters, ProtocolIngestionLaneHealth, ProtocolIngestionLaneJobs, ProtocolIngestionReplayResult, ProtocolIngestionStatus, ProtocolQuarantinedCandidate, ProtocolRefreshResult, ProtocolSettings, ProtocolSettingsUpdateResult, ReplayProtocolIngestionJobInput, UpdateSettingsInput as UpdateProtocolSettingsInput, } from './resources/protocols.js';
 export { InboxResource } from './resources/inbox.js';
 export { NetworkResource } from './resources/network.js';
 export { SimulatorResource } from './resources/simulator.js';

package/dist/index.js

@@ -69,6 +69,7 @@ import { LinkPreviewResource } from './resources/link-preview.js';
 import { SearchResource } from './resources/search.js';
 import { BookmarksResource } from './resources/bookmarks.js';
 import { FeedsResource } from './resources/feeds.js';
+import { AliveResource } from './resources/alive.js';
 import { AccountsResource } from './resources/accounts.js';
 import { SignalsResource } from './resources/signals.js';
 import { SealedResource } from './resources/sealed.js';
@@ -134,6 +135,8 @@ export class Recursiv {
     discovery;
     /** The top of a feed: what the member (or a visitor) is most likely to engage with, rotated by what they have seen. */
     feeds;
+    /** The alive tick: whether people the member follows posted, current counts on screen, new replies (0.7.193). */
+    alive;
     video;
     appSubscriptions;
     boosts;
@@ -212,6 +215,7 @@ export class Recursiv {
         this.jobs = new JobsResource(client);
         this.curator = new CuratorResource(client);
         this.feeds = new FeedsResource(client);
+        this.alive = new AliveResource(client);
         this.discovery = new DiscoveryResource(this.posts, this.protocols, this.curator, client, this.feeds);
         this.video = new VideoResource(client);
         this.appSubscriptions = new AppSubscriptionsResource(client);
@@ -287,6 +291,7 @@ export { LinkPreviewResource } from './resources/link-preview.js';
 export { SEARCH_MEDIA_KINDS, SEARCH_SECTIONS, SearchResource } from './resources/search.js';
 export { BOOKMARK_MERGE_MAX_ITEMS, BookmarkCollectionsResource, BookmarksResource } from './resources/bookmarks.js';
 export { FEED_TOP_NETWORKS, FeedsResource } from './resources/feeds.js';
+export { AliveResource } from './resources/alive.js';
 export { AccountsResource } from './resources/accounts.js';
 export { SIGNAL_BATCH_MAX, SignalsResource, newClientEventId } from './resources/signals.js';
 export { SEALED_ALLOWANCE_REMAINING_HEADER, SEALED_REFUSAL_HEADER, SealedResource, SealedTransportError, SEALED_WEB_OFF, isSealedWebOff, } from './resources/sealed.js';
@@ -295,7 +300,7 @@ export { ProjectSettingsResource } from './resources/project-settings.js';
 export { OrganizationSecurityResource } from './resources/organization-security.js';
 export { UploadsResource } from './resources/uploads.js';
 export { WalletResource } from './resources/wallet.js';
-export { BoostsResource } from './resources/boosts.js';
+export { BoostsResource, spliceBoostSlots } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';
 export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, SOCIAL_FOLLOWING_SOURCE_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
 export { InboxResource } from './resources/inbox.js';

package/dist/privacy/facts.generated.d.ts

@@ -47,7 +47,7 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly enforcement: "server";
     readonly capability: "chat_tier";
     readonly step: "S28";
-    readonly says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body. It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed.";
+    readonly says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body, except the report a member chooses to file (below). It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed. Two routes the Sealed frame uses relay nothing, and answer only while Sealed in a browser is switched on: GET /sealed/me answers the member's own age view and adult setting, and POST /sealed/reports reads the report a member chooses to file (a reason, and details they write) and files it as any report is filed.";
 }, {
     readonly id: "sealed.dest_tinfoil_only";
     readonly status: "enforced";
@@ -61,7 +61,7 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly enforcement: "server";
     readonly capability: "sealed_history";
     readonly step: "S29";
-    readonly says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body.";
+    readonly says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body, except a report the member chooses to file at POST /sealed/reports, whose reason and the details they write (which may quote the exchange they report) are kept as any report is. GET /sealed/me, which answers the member's own age view and adult setting, writes no row and keeps nothing it answers; it counts the member's requests for a minute in the shared counters, as the attestation relay does.";
 }, {
     readonly id: "sealed.backup_excluded";
     readonly status: "planned";
@@ -75,7 +75,7 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly enforcement: "server";
     readonly capability: "chat_tier";
     readonly step: "S29";
-    readonly says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.";
+    readonly says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it. The one exception is the report a member chooses to file at POST /sealed/reports, which answers only while Sealed in a browser is switched on: it is filed as any report is, so a report whose reason is child sexual abuse material, intimate images shared without consent or child safety may page Minds staff by email and on the safety rota's pager webhook, carrying the report's ids and the reason's category, never the details the member wrote.";
 }, {
     readonly id: "ai_prefs.agent_enabled";
     readonly status: "planned";
@@ -307,4 +307,53 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly capability: "sealed_history";
     readonly step: "S29";
     readonly says: "Exporting a Sealed chat writes a file on the phone and sends nothing.";
+}, {
+    readonly id: "sealed.attest_before_send_browser";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "In a browser, the Sealed frame seals a Sealed request only to the key of a router it checked against a fresh challenge of its own, with the phone's checks: the router's report, signed by its AMD hardware, must answer that challenge with debug mode off and firmware at or above a floor, and its software must be a release Tinfoil signed and listed in a public log. The checks and the sealing are the phone's own Sealed core, built for the browser and run in a Worker inside the frame. If any check fails there is no key to seal to, so nothing is sealed or sent. How long a checked router is used before it is checked again is up to the app.";
+}, {
+    readonly id: "sealed.frame_separate_origin";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "In a browser, Sealed runs only in the Sealed frame, a page of its own loaded from sealed.minds.com, so the Minds page it sits in (such as minds.com or build.minds.com) cannot read what is typed or answered there. The frame tells that page only fixed signals (that it is ready, its state, that it needs a new token, where to go, and that a sign-out clear finished), never words, answers, chat names or counts, and its content security policy, enforced and never report-only, lets only Minds' own pages embed it and lets it connect only to its own origin and the Minds API.";
+}, {
+    readonly id: "sealed.frame_token_scoped";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The Sealed frame never holds the member's app key. The page around it mints a Sealed frame token from that key and hands the frame only that token, which lasts at most 15 minutes, works only on the Sealed routes the frame uses and only from the frame's own origin, cannot mint another, and stops working on its next request once the key it was minted from is revoked.";
+}, {
+    readonly id: "sealed.history_browser_only";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "In a browser, Sealed chats are saved only in that browser, in the storage it keeps for sealed.minds.com (the Sealed frame's origin), under the account; Minds keeps none of them, apart from what a member chooses to put in a report.";
+}, {
+    readonly id: "sealed.signout_clears_browser";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Signing out of Minds in a browser clears the account's Sealed chats from that browser when the Sealed frame or its sign-out page answers that they are gone; sign-out waits at most 1.5 seconds for that answer. If neither answers in time but the sign-out page had noted the clear in that browser, the clear finishes the next time the Sealed frame loads there. If the sign-out page could not load, or was stopped before it noted the clear, nothing is noted: the chats can stay in that browser until the Sealed frame next loads there with no one signed in to Minds, which clears every account's Sealed chats in it, or until the member clears the site's data.";
+}, {
+    readonly id: "sealed.frame_no_telemetry";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "The Sealed frame runs no analytics or error-reporting code, and its content security policy names no address for violation reports: besides its own origin, the only place it connects to is the Minds API.";
+}, {
+    readonly id: "sealed.web_switch_enforced";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "While Sealed in a browser is switched off on the server (SEALED_GATEWAY_WEB, off unless set), the Sealed gateway mints no frame token and accepts none, and refuses every Sealed request that carries an Origin header, as a web page's requests do, whatever its credential, except GET /sealed/config, which reports the switch. Turning it off stops each frame token on its next request.";
 }];

package/dist/privacy/facts.generated.js

@@ -56,7 +56,7 @@ export const PRIVACY_FACTS = [
         enforcement: "server",
         capability: "chat_tier",
         step: "S28",
-        says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body. It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed.",
+        says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body, except the report a member chooses to file (below). It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed. Two routes the Sealed frame uses relay nothing, and answer only while Sealed in a browser is switched on: GET /sealed/me answers the member's own age view and adult setting, and POST /sealed/reports reads the report a member chooses to file (a reason, and details they write) and files it as any report is filed.",
     },
     {
         id: "sealed.dest_tinfoil_only",
@@ -72,7 +72,7 @@ export const PRIVACY_FACTS = [
         enforcement: "server",
         capability: "sealed_history",
         step: "S29",
-        says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body.",
+        says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body, except a report the member chooses to file at POST /sealed/reports, whose reason and the details they write (which may quote the exchange they report) are kept as any report is. GET /sealed/me, which answers the member's own age view and adult setting, writes no row and keeps nothing it answers; it counts the member's requests for a minute in the shared counters, as the attestation relay does.",
     },
     {
         id: "sealed.backup_excluded",
@@ -88,7 +88,7 @@ export const PRIVACY_FACTS = [
         enforcement: "server",
         capability: "chat_tier",
         step: "S29",
-        says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.",
+        says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it. The one exception is the report a member chooses to file at POST /sealed/reports, which answers only while Sealed in a browser is switched on: it is filed as any report is, so a report whose reason is child sexual abuse material, intimate images shared without consent or child safety may page Minds staff by email and on the safety rota's pager webhook, carrying the report's ids and the reason's category, never the details the member wrote.",
     },
     {
         id: "ai_prefs.agent_enabled",
@@ -354,4 +354,60 @@ export const PRIVACY_FACTS = [
         step: "S29",
         says: "Exporting a Sealed chat writes a file on the phone and sends nothing.",
     },
+    {
+        id: "sealed.attest_before_send_browser",
+        status: "planned",
+        enforcement: "device",
+        capability: "chat_tier",
+        step: "S28",
+        says: "In a browser, the Sealed frame seals a Sealed request only to the key of a router it checked against a fresh challenge of its own, with the phone's checks: the router's report, signed by its AMD hardware, must answer that challenge with debug mode off and firmware at or above a floor, and its software must be a release Tinfoil signed and listed in a public log. The checks and the sealing are the phone's own Sealed core, built for the browser and run in a Worker inside the frame. If any check fails there is no key to seal to, so nothing is sealed or sent. How long a checked router is used before it is checked again is up to the app.",
+    },
+    {
+        id: "sealed.frame_separate_origin",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "In a browser, Sealed runs only in the Sealed frame, a page of its own loaded from sealed.minds.com, so the Minds page it sits in (such as minds.com or build.minds.com) cannot read what is typed or answered there. The frame tells that page only fixed signals (that it is ready, its state, that it needs a new token, where to go, and that a sign-out clear finished), never words, answers, chat names or counts, and its content security policy, enforced and never report-only, lets only Minds' own pages embed it and lets it connect only to its own origin and the Minds API.",
+    },
+    {
+        id: "sealed.frame_token_scoped",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The Sealed frame never holds the member's app key. The page around it mints a Sealed frame token from that key and hands the frame only that token, which lasts at most 15 minutes, works only on the Sealed routes the frame uses and only from the frame's own origin, cannot mint another, and stops working on its next request once the key it was minted from is revoked.",
+    },
+    {
+        id: "sealed.history_browser_only",
+        status: "planned",
+        enforcement: "device",
+        capability: "sealed_history",
+        step: "S29",
+        says: "In a browser, Sealed chats are saved only in that browser, in the storage it keeps for sealed.minds.com (the Sealed frame's origin), under the account; Minds keeps none of them, apart from what a member chooses to put in a report.",
+    },
+    {
+        id: "sealed.signout_clears_browser",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Signing out of Minds in a browser clears the account's Sealed chats from that browser when the Sealed frame or its sign-out page answers that they are gone; sign-out waits at most 1.5 seconds for that answer. If neither answers in time but the sign-out page had noted the clear in that browser, the clear finishes the next time the Sealed frame loads there. If the sign-out page could not load, or was stopped before it noted the clear, nothing is noted: the chats can stay in that browser until the Sealed frame next loads there with no one signed in to Minds, which clears every account's Sealed chats in it, or until the member clears the site's data.",
+    },
+    {
+        id: "sealed.frame_no_telemetry",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "The Sealed frame runs no analytics or error-reporting code, and its content security policy names no address for violation reports: besides its own origin, the only place it connects to is the Minds API.",
+    },
+    {
+        id: "sealed.web_switch_enforced",
+        status: "planned",
+        enforcement: "server",
+        capability: "chat_tier",
+        step: "S28",
+        says: "While Sealed in a browser is switched off on the server (SEALED_GATEWAY_WEB, off unless set), the Sealed gateway mints no frame token and accepts none, and refuses every Sealed request that carries an Origin header, as a web page's requests do, whatever its credential, except GET /sealed/config, which reports the switch. Turning it off stops each frame token on its next request.",
+    },
 ];

package/dist/resources/agents.d.ts

@@ -1,5 +1,5 @@
 import type { HttpClient } from '../client.js';
-import type { PaginatedResponse, SingleResponse, DeleteResponse, Agent, AgentDetail, CreateAgentInput, CreatedAgent, UpdateAgentInput, UpdatedAgent, AgentChatInput, AgentChatRetryInput, AgentChatResult, AgentConversation, AgentConversationMessage, PaginationParams, StreamChunk } from '../types.js';
+import type { PaginatedResponse, SingleResponse, DeleteResponse, Agent, AgentDetail, CreateAgentInput, CreatedAgent, UpdateAgentInput, UpdatedAgent, AgentChatInput, AgentChatRetryInput, AgentChatResult, AgentConversation, AgentConversationMessage, CreatedAgentConversation, PaginationParams, StreamChunk } from '../types.js';
 export interface AgentMessage {
     id: string;
     networkId: string;
@@ -241,6 +241,15 @@ export declare class AgentsResource {
     chat(id: string, input: AgentChatInput): Promise<SingleResponse<AgentChatResult>>;
     /** List an agent's conversations */
     conversations(id: string, params?: PaginationParams): Promise<PaginatedResponse<AgentConversation>>;
+    /**
+     * Start a new chat with the caller's own personal agent (`id`): an empty thread in this key's app. Send its first
+     * message with `chatStream(id, { message, conversation_id })`; `conversations()` then lists it with its `name`.
+     * When the member already has an empty chat with the agent there, that one comes back with `created: false`, so a
+     * second tap (or a resent request) never makes another blank thread. An id that names no agent, or an agent outside
+     * the network of this key and its app, is 404 `agent_not_found` (the same answer for both); in the caller's network,
+     * any agent that is not the caller's own personal agent, or a key acting as an agent, is 403 `not_owner`.
+     */
+    createConversation(id: string): Promise<SingleResponse<CreatedAgentConversation>>;
     /**
      * Read the messages in one of an agent's conversations, oldest first.
      *

package/dist/resources/agents.js

@@ -103,6 +103,17 @@ export class AgentsResource {
     conversations(id, params) {
         return this.client.get(`/agents/${id}/conversations`, params);
     }
+    /**
+     * Start a new chat with the caller's own personal agent (`id`): an empty thread in this key's app. Send its first
+     * message with `chatStream(id, { message, conversation_id })`; `conversations()` then lists it with its `name`.
+     * When the member already has an empty chat with the agent there, that one comes back with `created: false`, so a
+     * second tap (or a resent request) never makes another blank thread. An id that names no agent, or an agent outside
+     * the network of this key and its app, is 404 `agent_not_found` (the same answer for both); in the caller's network,
+     * any agent that is not the caller's own personal agent, or a key acting as an agent, is 403 `not_owner`.
+     */
+    createConversation(id) {
+        return this.client.post(`/agents/${id}/conversations`, {});
+    }
     /**
      * Read the messages in one of an agent's conversations, oldest first.
      *

package/dist/resources/alive.d.ts

@@ -0,0 +1,61 @@
+import type { HttpClient } from '../client.js';
+/**
+ * The alive tick (0.7.193): one calm read for the member, with their own key of the app, that says whether anyone they
+ * follow has posted since the newest row they hold, keeps the counts of the posts on their screen current, and counts
+ * the new replies under the post they have open. Off until the operator turns on `ALIVE_TICK_ENABLED`: the read then
+ * throws `NotFoundError` (code `alive_disabled`), and the app stops ticking.
+ *
+ * Tick again after `nextAfterMs` (the server slows every client this way), only while the page is visible. One tick
+ * carries every open screen's interests. A tick is asked once (`retry: false`): the next tick is its retry. More than
+ * 4 a minute for one member throws `RateLimitError`.
+ */
+/** What one tick asks about. Each part is answered only when asked for. */
+export interface AliveTickParams {
+    /** The newest row the member holds on Following (a Date or an ISO 8601 instant). */
+    followingSince?: Date | string;
+    /** Ids of the Minds posts on screen, at most 30 (more is refused). */
+    posts?: readonly string[];
+    /** The open post's id and the newest reply the member holds under it (or when the thread was loaded). */
+    thread?: {
+        id: string;
+        since: Date | string;
+    };
+}
+/** A post's numbers, as its card shows them. */
+export interface AliveTickCounts {
+    score: number;
+    upvote_count: number;
+    reply_count: number;
+    reposts_count: number;
+}
+export interface AliveTick {
+    /**
+     * Whether anyone the member follows posted a top-level Minds post after `followingSince` that they may be served
+     * (their blocks, mutes and safety setting applied), and when the newest of them was written. Load the new rows behind
+     * the new-posts pill; never move what the member is reading.
+     */
+    following?: {
+        fresh: boolean;
+        newestAt: string | null;
+    };
+    /**
+     * The current numbers of the posts asked for that the member may be served, by post id. A post left out (a repost,
+     * a reply, one the member may not be served) keeps the number the app has.
+     */
+    counts?: Record<string, AliveTickCounts>;
+    /** How many replies under the open post the member may see were written after `thread.since`, their own left out. */
+    thread?: {
+        newReplies: number;
+        newestAt: string | null;
+    };
+    /** When to tick next, in milliseconds. */
+    nextAfterMs: number;
+    /** When the server read it. */
+    asOf: string;
+}
+export declare class AliveResource {
+    private client;
+    constructor(client: HttpClient);
+    /** One tick for the member (GET /alive/tick, `users:read`, their own key of the app). */
+    tick(params?: AliveTickParams): Promise<AliveTick>;
+}

package/dist/resources/alive.js

@@ -0,0 +1,16 @@
+const iso = (value) => (value instanceof Date ? value.toISOString() : value);
+export class AliveResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /** One tick for the member (GET /alive/tick, `users:read`, their own key of the app). */
+    tick(params = {}) {
+        return this.client.get('/alive/tick', {
+            following_since: params.followingSince === undefined ? undefined : iso(params.followingSince),
+            posts: params.posts?.length ? params.posts.join(',') : undefined,
+            thread: params.thread?.id,
+            thread_since: params.thread ? iso(params.thread.since) : undefined,
+        }, { retry: false });
+    }
+}