@recursiv/sdk 0.7.50 → 0.7.52

package/dist/resources/agents.js

@@ -12,8 +12,11 @@ import { parseSSE } from '../lib/sse.js';
 export const SUPPORTED_MODELS = [
     // <<< GENERATED: openrouter-sync — do not edit by hand (npm run models:sync)
     'anthropic/claude-fable-5',
+    'anthropic/claude-fable-5.1',
     'anthropic/claude-opus-4.6',
     'anthropic/claude-opus-4.8',
+    'anthropic/claude-opus-5',
+    'anthropic/claude-opus-5.5',
     'anthropic/claude-sonnet-4.6',
     'anthropic/claude-sonnet-5',
     'deepseek/deepseek-v3.2',
@@ -21,6 +24,7 @@ export const SUPPORTED_MODELS = [
     'google/gemini-3-flash-preview',
     'google/gemini-3.1-pro-preview',
     'google/gemini-3.5-flash',
+    'google/gemini-3.8-flash',
     'minimax/minimax-m2.5',
     'minimax/minimax-m3',
     'moonshotai/kimi-k3',
@@ -28,6 +32,8 @@ export const SUPPORTED_MODELS = [
     'openai/gpt-5.5',
     'openai/gpt-5.6-sol',
     'openai/gpt-5.6-terra',
+    'openai/gpt-6-astra',
+    'openai/gpt-6-sol',
     'x-ai/grok-4.3',
     // >>> GENERATED
 ];
@@ -51,7 +57,7 @@ export class AgentsResource {
     get(id) {
         return this.client.get(`/agents/${id}`);
     }
-    /** Create a new AI agent */
+    /** Create a new AI agent. Omit username for a server-generated collision-resistant handle. */
     create(input) {
         return this.client.post('/agents', input);
     }
@@ -92,7 +98,14 @@ export class AgentsResource {
     conversationMessages(id, conversationId, params) {
         return this.client.get(`/agents/${id}/conversations/${conversationId}/messages`, params);
     }
-    /** List discoverable agents (public + same-org) */
+    /**
+     * List the agents a member may discover: an app key gets the agents of its
+     * project and owning org, a personal key gets global and same-org agents.
+     * Only member-facing agents are returned. Agents that run a tenant (a
+     * project's Lead, swarm workers, dispatcher role agents, MCP client agents,
+     * the workspace AI, anyone's personal AI) never appear here; list your own
+     * with `list()`.
+     */
     listDiscoverable(params) {
         return this.client.get('/agents/discoverable', params);
     }
@@ -181,26 +194,19 @@ export class AgentsResource {
      * For React Native, use `chatStreamText()` instead.
      */
     async *chatStream(id, input) {
-        const response = await this.client.fetchRaw(`/agents/${id}/chat/stream`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(input),
-        });
-        if (!response.ok) {
-            let errorBody;
-            try {
-                errorBody = await response.json();
-            }
-            catch {
-                throw new RecursivError(response.status, {
-                    type: 'api_error',
-                    message: `HTTP ${response.status}: ${response.statusText}`,
-                    code: 'stream_error',
-                });
-            }
-            throw new RecursivError(response.status, errorBody.error);
-        }
-        yield* parseSSE(response.body);
+        yield* this.streamChunks(id, input);
+    }
+    /**
+     * Retry a turn: stream a fresh reply to one of your existing messages
+     * without sending it again. Use it for "Try again" after a reply failed.
+     * The agent's earlier reply to that message, if any, is removed first.
+     *
+     * The message must be yours and the latest one in the conversation
+     * (409 `retry_not_latest` otherwise), and a reply still being written must
+     * finish or be stopped first (409 `run_in_progress`).
+     */
+    async *retryChatStream(id, input) {
+        yield* this.streamChunks(id, input);
     }
     /**
      * Chat with an agent and get the full response text.
@@ -220,12 +226,19 @@ export class AgentsResource {
      * });
      * ```
      */
-    async chatStreamText(id, input) {
+    chatStreamText(id, input) {
+        return this.streamText(id, input);
+    }
+    /** `retryChatStream()` for platforms without `ReadableStream` (React Native). */
+    retryChatStreamText(id, input) {
+        return this.streamText(id, input);
+    }
+    async openStream(id, input, accept) {
         const response = await this.client.fetchRaw(`/agents/${id}/chat/stream`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Accept: 'text/event-stream',
+                ...(accept ? { Accept: accept } : {}),
             },
             body: JSON.stringify(input),
         });
@@ -243,6 +256,14 @@ export class AgentsResource {
             }
             throw new RecursivError(response.status, errorBody.error);
         }
+        return response;
+    }
+    async *streamChunks(id, input) {
+        const response = await this.openStream(id, input);
+        yield* parseSSE(response.body);
+    }
+    async streamText(id, input) {
+        const response = await this.openStream(id, input, 'text/event-stream');
         const text = await response.text();
         const lines = text.split('\n');
         let fullText = '';

package/dist/resources/app-subscriptions.d.ts

@@ -6,12 +6,64 @@ export interface AppSubscriptionCheckoutResult {
 export interface AppSubscriptionPortalResult {
     /** Stripe Billing Portal URL for the current app user. */
     url: string;
+    /**
+     * The page the portal opens on: `cancel` for the plan's cancel confirmation, null for the
+     * portal home. A plan already set to end opens the home, where the member can renew it.
+     * Absent from older servers.
+     */
+    flow?: 'cancel' | null;
+}
+/** The boost credit a paid plan on this app adds to the member's boost balance. */
+export interface AppSubscriptionBoostCredit {
+    /** Micro-USD (1 USD = 1,000,000) each paid billing period of a plan adds, by tier key (e.g. `plus`, `pro`). */
+    perPeriodMicros: Record<string, number>;
+    /** What the member's current plan adds each paid period; 0 without a paid plan here. */
+    currentMicros: number;
+    /**
+     * When the next paid period starts and adds `currentMicros`. Null without a plan that adds
+     * credit, or while a payment is overdue. A plan set to end at the period's end still shows it.
+     */
+    nextGrantAt: string | null;
+    /**
+     * Plan credit the member owes: taken back after their plan dropped or ended inside a period, but
+     * already spent. The next plan credit repays it before adding anything. 0 when nothing is owed
+     * (absent from older servers).
+     */
+    owedMicros?: number;
 }
 export interface AppSubscriptionStatusResult {
     tier: string;
-    status: 'active' | 'past_due' | 'canceled' | 'none';
+    /** 'legacy' is a membership carried over from a previous platform, with no subscription here. */
+    status: 'active' | 'past_due' | 'canceled' | 'none' | 'legacy';
     active: boolean;
     currentPeriodEnd: string | null;
+    /** Where the entitlement comes from: a Stripe subscription here, or the legacy import. */
+    source?: 'stripe' | 'legacy';
+    /**
+     * The boost credit each paid period of a plan adds (once per period, from the payment that
+     * starts it). Null when this app's plans include none; absent from older servers.
+     */
+    boostCredit?: AppSubscriptionBoostCredit | null;
+}
+export interface AppSubscriptionTierChangePreview {
+    /** The plan the preview prices. */
+    tier: string;
+    /** The plan the member pays for now. */
+    currentTier: string;
+    /** Prorated charge (positive) or credit (negative) for the rest of this period, in minor units. */
+    prorationAmount: number;
+    /** What the next invoice totals with the change applied, in minor units. */
+    amountDue: number;
+    currency: string;
+    /** Pass to `changeTier` so the charge matches this preview exactly. */
+    prorationDate: number;
+    nextPaymentAt: string | null;
+}
+export interface AppSubscriptionTierChangeResult {
+    tier: string;
+    previousTier: string;
+    status: 'active' | 'past_due' | 'canceled';
+    currentPeriodEnd: string | null;
 }
 /**
  * Per-app-user consumer subscriptions (e.g. Plus/Pro) billed through the app's
@@ -20,20 +72,66 @@ export interface AppSubscriptionStatusResult {
 export declare class AppSubscriptionsResource {
     private client;
     constructor(client: HttpClient);
-    /** Start a Stripe Checkout for the current user to subscribe to a plan tier ('plus' | 'pro'). */
+    /**
+     * Start a Stripe Checkout for the current user to subscribe to a plan tier ('plus' | 'pro').
+     * Answers 409 `subscription_exists` when the member already has a subscription:
+     * use `changeTier` for them instead, so they are never billed twice.
+     *
+     * Only one checkout can be paid at a time. Repeating the same request (same tier and
+     * `return_url`) returns the checkout already open; any other request expires the
+     * member's earlier open checkouts for this app. Answers 503 `checkout_busy` when
+     * Stripe is too slow to finish safely: retry. `return_url` keeps its own query and fragment;
+     * `sub=success&tier=<tier>` or `sub=cancelled` is added to its query (to the
+     * fragment's query for a hash route such as `#/billing`).
+     */
     checkout(input: {
         tier: string;
         return_url: string;
     }): Promise<{
         data: AppSubscriptionCheckoutResult;
     }>;
-    /** Open the current app user's Stripe Billing Portal for this project. */
+    /**
+     * Price a switch of the current member's plan to `tier`, prorated, without changing anything.
+     * Errors (409) name why a switch cannot run: `no_subscription`, `already_on_tier`,
+     * `subscription_not_active`, `subscription_canceling`, `legacy_membership`.
+     */
+    previewTierChange(input: {
+        tier: string;
+    }): Promise<{
+        data: AppSubscriptionTierChangePreview;
+    }>;
+    /**
+     * Switch the current member's existing subscription to `tier`, prorated, in place.
+     * Never opens a second subscription. Pass `proration_date` from `previewTierChange`
+     * to charge exactly what the preview showed. A switch to a lower plan takes effect
+     * now: the unused time on the higher plan is credited, and that plan ends at once.
+     * Not retried automatically: on an
+     * unclear failure, read `status()` before trying again (a repeat answers 409
+     * `already_on_tier` rather than charging twice).
+     */
+    changeTier(input: {
+        tier: string;
+        proration_date?: number;
+    }): Promise<{
+        data: AppSubscriptionTierChangeResult;
+    }>;
+    /**
+     * Open the current app user's Stripe Billing Portal for this project.
+     *
+     * `flow: 'cancel'` opens it straight on the cancel confirmation for the member's plan, and
+     * returns to `return_url` once they confirm. Answers 409 `no_subscription` when there is no
+     * plan to cancel, and 409 `legacy_membership` for a carried-over member with nothing to manage.
+     */
     createPortalSession(input: {
         return_url: string;
+        flow?: 'cancel';
     }): Promise<{
         data: AppSubscriptionPortalResult;
     }>;
-    /** Read the current user's app-subscription status for this project-scoped key. */
+    /**
+     * Read the current user's app-subscription status for this project-scoped key, with the
+     * boost credit the app's plans include (`boostCredit`).
+     */
     status(): Promise<{
         data: AppSubscriptionStatusResult;
     }>;

package/dist/resources/app-subscriptions.js

@@ -7,15 +7,55 @@ export class AppSubscriptionsResource {
     constructor(client) {
         this.client = client;
     }
-    /** Start a Stripe Checkout for the current user to subscribe to a plan tier ('plus' | 'pro'). */
+    /**
+     * Start a Stripe Checkout for the current user to subscribe to a plan tier ('plus' | 'pro').
+     * Answers 409 `subscription_exists` when the member already has a subscription:
+     * use `changeTier` for them instead, so they are never billed twice.
+     *
+     * Only one checkout can be paid at a time. Repeating the same request (same tier and
+     * `return_url`) returns the checkout already open; any other request expires the
+     * member's earlier open checkouts for this app. Answers 503 `checkout_busy` when
+     * Stripe is too slow to finish safely: retry. `return_url` keeps its own query and fragment;
+     * `sub=success&tier=<tier>` or `sub=cancelled` is added to its query (to the
+     * fragment's query for a hash route such as `#/billing`).
+     */
     checkout(input) {
         return this.client.post('/app-subscriptions/checkout', input);
     }
-    /** Open the current app user's Stripe Billing Portal for this project. */
+    /**
+     * Price a switch of the current member's plan to `tier`, prorated, without changing anything.
+     * Errors (409) name why a switch cannot run: `no_subscription`, `already_on_tier`,
+     * `subscription_not_active`, `subscription_canceling`, `legacy_membership`.
+     */
+    previewTierChange(input) {
+        return this.client.get('/app-subscriptions/change-tier/preview', { tier: input.tier });
+    }
+    /**
+     * Switch the current member's existing subscription to `tier`, prorated, in place.
+     * Never opens a second subscription. Pass `proration_date` from `previewTierChange`
+     * to charge exactly what the preview showed. A switch to a lower plan takes effect
+     * now: the unused time on the higher plan is credited, and that plan ends at once.
+     * Not retried automatically: on an
+     * unclear failure, read `status()` before trying again (a repeat answers 409
+     * `already_on_tier` rather than charging twice).
+     */
+    changeTier(input) {
+        return this.client.post('/app-subscriptions/change-tier', input, { retry: false });
+    }
+    /**
+     * Open the current app user's Stripe Billing Portal for this project.
+     *
+     * `flow: 'cancel'` opens it straight on the cancel confirmation for the member's plan, and
+     * returns to `return_url` once they confirm. Answers 409 `no_subscription` when there is no
+     * plan to cancel, and 409 `legacy_membership` for a carried-over member with nothing to manage.
+     */
     createPortalSession(input) {
         return this.client.post('/app-subscriptions/portal', input);
     }
-    /** Read the current user's app-subscription status for this project-scoped key. */
+    /**
+     * Read the current user's app-subscription status for this project-scoped key, with the
+     * boost credit the app's plans include (`boostCredit`).
+     */
     status() {
         return this.client.get('/app-subscriptions/status');
     }

package/dist/resources/auth.d.ts

@@ -17,6 +17,73 @@ export interface SignInInput {
     email: string;
     password: string;
 }
+export interface UsernameSignInInput {
+    /** The member's handle, without the leading @. Matching is case-insensitive. */
+    username: string;
+    password: string;
+}
+/** The customer app a keyless auth call is made for (see `signIn`). */
+export interface AppContext {
+    projectId?: string;
+    organizationId?: string;
+}
+export interface ResetPasswordInput {
+    /** The new password. Must meet the server's password policy. */
+    newPassword: string;
+    /** The reset token from the link in the reset email. */
+    token: string;
+}
+/**
+ * How a two-factor change is confirmed. An account with a password sends
+ * `password`. An account with no password (OTP-only) sends `emailCode`, the
+ * six digits from `requestTwoFactorEmailCode` (or `settings.requestConfirmationCode('two_factor')`).
+ */
+export interface TwoFactorConfirmation {
+    password?: string;
+    emailCode?: string;
+}
+/** Public facts about a registered OAuth (MCP) client, for a consent screen. */
+export interface OAuthClientInfo {
+    client_id: string;
+    /** Chosen by whoever registered the client. Show it as a claim, next to the redirect host. */
+    name: string | null;
+    icon: string | null;
+    type: 'public' | 'web';
+    disabled: boolean;
+    /** Hosts the client may send the member back to. This is the fact to show. */
+    redirect_hosts: string[];
+    /** Present when `redirectUri` was passed: whether the client registered it. */
+    redirect_uri_registered?: boolean;
+    scopes_supported: string[];
+    /** Present when `scope` was passed: the requested scopes this server grants, and the rest. */
+    requested_scopes?: string[];
+    unsupported_scopes?: string[];
+}
+/**
+ * The `details` of the `two_factor_required` error a password sign-in throws
+ * for a two-factor account. The challenge is single-use, lives ten minutes
+ * and allows five codes.
+ */
+export interface TwoFactorChallenge {
+    /** Pass to `completeTwoFactorSignIn`. Null only from a server older than this field. */
+    twoFactorToken: string | null;
+    /** Second factors the server offers for this account, e.g. `['totp']`. Backup codes always work. */
+    methods: string[];
+}
+export interface CompleteTwoFactorSignInInput {
+    /** From the `two_factor_required` error's `details.twoFactorToken`. */
+    twoFactorToken: string;
+    /** The six digits from the authenticator app, or one backup code. */
+    code: string;
+    /** `backup_code` for a backup code. Defaults to `totp`. */
+    method?: 'totp' | 'backup_code';
+}
+export interface TwoFactorEnrollment {
+    /** otpauth:// URI for an authenticator app (render it as a QR code). */
+    totpURI: string;
+    /** One-time backup codes. Shown once; ask the member to save them. */
+    backupCodes: string[];
+}
 export interface SendOtpInput {
     email: string;
 }
@@ -143,6 +210,16 @@ export declare class AuthResource {
         projectId?: string;
         organizationId?: string;
     }): Promise<AuthSession>;
+    /**
+     * Sign in with a username (handle) and password.
+     *
+     * Handles are unique per network, not globally, so pass the customer app's
+     * `appContext` when the API is reached through a shared hostname: the server
+     * resolves the handle on that app's network and never on another. Returns a
+     * session token, like `signIn`. A two-factor account throws
+     * `two_factor_required`; finish with `completeTwoFactorSignIn`.
+     */
+    signInWithUsername(input: UsernameSignInInput, appContext?: AppContext): Promise<AuthSession>;
     /**
      * Send a one-time password to an email address.
      * Works for both new and existing users — no password required.
@@ -180,12 +257,21 @@ export declare class AuthResource {
      * whether the email exists, to avoid leaking account existence.
      *
      * Sends the client's API key (when configured) so the server can brand the
-     * reset email for YOUR org — same surface-scoped rule as `sendOtp`.
+     * reset email for YOUR org — same surface-scoped rule as `sendOtp`. Keyless
+     * apps pass `appContext` (same shape as `sendOtp`) for the same effect.
      */
     forgetPassword(input: {
         email: string;
         redirectTo?: string;
-    }): Promise<{
+    }, appContext?: AppContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * Set a new password with the token from a password reset email (the
+     * `token` your reset screen receives). Every existing session and API key
+     * for the account is revoked by the server, so sign in again afterwards.
+     */
+    resetPassword(input: ResetPasswordInput, appContext?: AppContext): Promise<{
         success: true;
     }>;
     /**
@@ -231,6 +317,17 @@ export declare class AuthResource {
         user: AuthSession['user'];
         session: AuthSession;
     }>;
+    /**
+     * `signInWithUsername`, then the app API key, exactly like `signInAndCreateKey`.
+     * The key's project/organization is forwarded as the sign-in's app context,
+     * so the handle is resolved on the app's network.
+     */
+    signInWithUsernameAndCreateKey(credentials: UsernameSignInInput, keyInput: CreateApiKeyInput): Promise<{
+        apiKey: string;
+        apiKeyId: string;
+        user: AuthSession['user'];
+        session: AuthSession;
+    }>;
     /**
      * Complete mobile auth flow: sign up → create API key → return key.
      *
@@ -246,6 +343,10 @@ export declare class AuthResource {
      * Exchange a legacy Minds session (the OAuth access token or minds_sess JWT
      * the legacy mobile app stored) for a session on this stack. Only answers
      * during the cutover window; every failure means "show the OTP screen".
+     *
+     * A legacy token is single-use: after one successful exchange the server
+     * answers `legacy_token_used`, so erase the stored legacy token as soon as
+     * this resolves and never retry it.
      */
     legacyHandoff(legacyToken: string, appContext?: {
         projectId?: string;
@@ -275,6 +376,101 @@ export declare class AuthResource {
         user: AuthSession['user'];
         session: AuthSession;
     }>;
+    /**
+     * Set the API-origin session cookie from a session token this client
+     * already holds, so a browser can continue an OAuth authorize request
+     * (`/api/auth/mcp/authorize`) without signing in again: the one-tap
+     * "Continue as @handle". Browser only in effect: the cookie is stored by the
+     * browser because the request is sent with `credentials: 'include'`.
+     * Returns the account the cookie now signs in.
+     */
+    exchangeSessionForCookie(sessionToken: string): Promise<{
+        user: {
+            id: string;
+            name: string | null;
+            username: string | null;
+            image: string | null;
+        };
+    }>;
+    /**
+     * Public facts about the OAuth client behind an authorize request: its name,
+     * icon, redirect hosts, whether `redirectUri` is one it registered, and which
+     * requested scopes are granted. No authentication needed.
+     */
+    getOAuthClientInfo(input: {
+        clientId: string;
+        redirectUri?: string;
+        scope?: string;
+    }): Promise<OAuthClientInfo>;
+    /**
+     * Finish a password sign-in on a two-factor account. `signIn`,
+     * `signInWithUsername` and their `*AndCreateKey` forms throw
+     * `AuthenticationError` with code `two_factor_required`; its `details` is a
+     * `TwoFactorChallenge`. Send its `twoFactorToken` with the code the member
+     * types. Returns the session, like `signIn`.
+     *
+     * Errors keep the server's code: `INVALID_CODE` / `INVALID_BACKUP_CODE` (a
+     * wrong code: ask again), `INVALID_TWO_FACTOR_COOKIE` (the challenge expired
+     * or was used: sign in again), `TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE` (five
+     * wrong codes on this challenge: sign in again), and
+     * `ACCOUNT_TEMPORARILY_LOCKED` (too many wrong codes on the account: wait
+     * `retryAfter` seconds).
+     */
+    completeTwoFactorSignIn(input: CompleteTwoFactorSignInInput): Promise<AuthSession>;
+    /**
+     * `completeTwoFactorSignIn`, then the app API key, exactly like
+     * `signInAndCreateKey`: the second half of a `*AndCreateKey` sign-in that
+     * threw `two_factor_required`.
+     */
+    completeTwoFactorSignInAndCreateKey(input: CompleteTwoFactorSignInInput, keyInput: CreateApiKeyInput): Promise<{
+        apiKey: string;
+        apiKeyId: string;
+        user: AuthSession['user'];
+        session: AuthSession;
+    }>;
+    private sessionRequest;
+    private static confirmationBody;
+    /**
+     * Email a two-factor confirmation code to an account that has no password.
+     * An account with a password answers `PASSWORD_REQUIRED`: it confirms with
+     * the password instead. Pass the app's `appContext` (as for `sendOtp`) when
+     * the API is reached through a shared hostname, so the email carries the
+     * app's brand rather than the platform's.
+     */
+    requestTwoFactorEmailCode(sessionToken: string, appContext?: AppContext): Promise<{
+        expiresAt: string;
+    }>;
+    /**
+     * Start two-factor enrollment. Returns the authenticator URI and backup
+     * codes; two-factor is not on until `verifyTwoFactor` accepts a code from
+     * the authenticator.
+     *
+     * An account with no password answers `PASSWORD_REQUIRED_FOR_TWO_FACTOR`
+     * unless the server enables code-only enrollment: its sign-ins (email
+     * code, passkey, social) do not ask for the second factor yet.
+     */
+    enableTwoFactor(input: TwoFactorConfirmation & {
+        issuer?: string;
+    }, sessionToken: string): Promise<TwoFactorEnrollment & {
+        sessionToken: string;
+    }>;
+    /**
+     * Confirm enrollment with a code from the authenticator app. This is the
+     * call that turns two-factor on.
+     */
+    verifyTwoFactor(input: {
+        code: string;
+    }, sessionToken: string): Promise<{
+        sessionToken: string;
+    }>;
+    /** Turn two-factor off. Confirmed with the password, or an email code for accounts without one. */
+    disableTwoFactor(input: TwoFactorConfirmation, sessionToken: string): Promise<{
+        sessionToken: string;
+    }>;
+    /** Replace the backup codes. The old ones stop working. */
+    regenerateTwoFactorBackupCodes(input: TwoFactorConfirmation, sessionToken: string): Promise<{
+        backupCodes: string[];
+    }>;
     /**
      * The key-mint leg of the `*AndCreateKey` flows. When the mint fails, the
      * caller receives only the thrown error — the session created one step