@recursiv/sdk 0.7.81 → 0.7.83

package/dist/resources/agents.js

@@ -1,4 +1,4 @@
-import { RecursivError } from '../errors.js';
+import { RateLimitError, rateLimitDetailsFromResponse, RecursivError } from '../errors.js';
 import { parseSSE } from '../lib/sse.js';
 // ── Agent directory (GET /agents/discover) ──
 /** The orders the agent directory serves (server: features/agents/agentDirectory.ts). */
@@ -83,7 +83,10 @@ export class AgentsResource {
     delete(id) {
         return this.client.delete(`/agents/${id}`);
     }
-    /** Send a message to an agent (async — agent responds asynchronously) */
+    /**
+     * Send a message to an agent (async — agent responds asynchronously).
+     * `turn: { safe: true }` makes it a safe turn in the caller's Asks thread (see `AgentChatTurn`).
+     */
     chat(id, input) {
         return this.client.post(`/agents/${id}/chat`, input);
     }
@@ -224,6 +227,8 @@ export class AgentsResource {
      *
      * Requires `ReadableStream` support (Node.js, modern browsers).
      * For React Native, use `chatStreamText()` instead.
+     * `turn: { safe: true }` streams a safe turn in the caller's Asks thread (see `AgentChatTurn`); a refusal throws a
+     * `RecursivError` whose code is a `SafeTurnRefusalCode`, before anything streams.
      */
     async *chatStream(id, input) {
         yield* this.streamChunks(id, input);
@@ -286,6 +291,11 @@ export class AgentsResource {
                     code: 'stream_error',
                 });
             }
+            // A 429 is a RateLimitError, as on every other request: with its scope and reset (a safe turn's daily cap is
+            // `scope: 'action'`, see SafeTurnRefusalCode).
+            if (response.status === 429 && errorBody?.error && typeof errorBody.error === 'object') {
+                throw new RateLimitError(errorBody.error, rateLimitDetailsFromResponse(response.headers, errorBody.error));
+            }
             throw new RecursivError(response.status, errorBody.error);
         }
         return response;

package/dist/resources/chat.d.ts

@@ -116,7 +116,11 @@ export declare class ChatResource {
             type: string;
         };
     }>>;
-    /** Edit a message (only the sender can edit) */
+    /**
+     * Edit a message's words (only the sender can edit). Keep each `chat-attachment:` reference it carries as it is: the
+     * server refuses an edit that drops, adds or swaps one (400 `attachment_refs_changed`, 0.7.82). To take an attachment
+     * back, delete the message.
+     */
     editMessage(messageId: string, input: {
         content: string;
     }): Promise<SingleResponse<Message>>;
@@ -130,4 +134,72 @@ export declare class ChatResource {
     unreadCount(conversationId: string): Promise<SingleResponse<{
         unread_count: number;
     }>>;
+    /**
+     * A PUT URL for one photo or voice note to send in a plaintext chat (0.7.82). With the server's private chat
+     * storage on, `private` is true, the URL writes into a private bucket and `ref` is `chat-attachment:<key>`, the text
+     * to send; with it off, `ref` is the upload's public URL. An end-to-end encrypted chat answers 409
+     * `conversation_encrypted`: its attachments go through `r.e2ee`. Most callers want `uploadAttachment`.
+     */
+    attachmentUploadUrl(conversationId: string, input: ChatAttachmentUploadUrlInput): Promise<SingleResponse<ChatAttachmentUploadUrl>>;
+    /**
+     * Upload one photo or voice note for a plaintext chat end to end and resolve the text to send for it (0.7.82): read
+     * the bytes, get the URL, PUT them with the matching Content-Type, and reject a failed transfer. Send `ref` as the
+     * message (or within it): a private reference renders through `signAttachments`, a public URL as before.
+     */
+    uploadAttachment(conversationId: string, input: ChatAttachmentUploadInput): Promise<ChatAttachmentUploadUrl>;
+    /**
+     * Short-lived URLs for a conversation's private attachments (0.7.82), at most 50 keys a call (the keys in its
+     * messages' `chat-attachment:` references; `chatAttachmentKeysIn` finds them). The server signs a key only for a
+     * member of the conversation, and only while a message its sender wrote there still carries it; any other key
+     * comes back with `url: null`. A URL works for about five minutes and is served `private, no-store`: ask again
+     * rather than keeping it.
+     */
+    signAttachments(conversationId: string, keys: string[]): Promise<SingleResponse<{
+        attachments: SignedChatAttachment[];
+    }>>;
+}
+export interface ChatAttachmentUploadUrlInput {
+    /** image/jpeg, image/png, image/webp, image/gif, audio/mpeg, audio/mp4, audio/wav, audio/ogg or audio/webm. */
+    content_type: string;
+    /** The exact byte count the PUT will send (signed into the URL; at most 50 MB). */
+    content_length: number;
+}
+export interface ChatAttachmentUploadUrl {
+    /** True when the attachment goes to the server's private chat storage. */
+    private: boolean;
+    /** PUT the bytes here with the same Content-Type. */
+    upload_url: string;
+    key: string;
+    /** The text to send for this attachment: `chat-attachment:<key>` when private, else the public URL. */
+    ref: string;
+}
+export interface ChatAttachmentUploadInput {
+    /** Caller-held bytes, such as a browser File or React Native Blob. */
+    blob?: Blob;
+    /** A local URI that the SDK should read into a Blob first. */
+    uri?: string;
+    /** Defaults to blob.type. */
+    contentType?: string;
+    /** Optional transport override for React Native adapters and focused tests. */
+    fetchImpl?: typeof fetch;
+}
+export interface SignedChatAttachment {
+    key: string;
+    /** A GET URL valid until `expires_at`, or null when this caller may not open the key. */
+    url: string | null;
+    expires_at: string | null;
+}
+/** The text a message carries before a private chat attachment's key. */
+export declare const CHAT_ATTACHMENT_REF_PREFIX = "chat-attachment:";
+/** One private attachment a message's text refers to. */
+export interface ChatAttachmentRef {
+    /** The whole reference as it appears in the text (`chat-attachment:<key>`). */
+    ref: string;
+    /** The key to pass to `signAttachments`. */
+    key: string;
+    kind: 'image' | 'audio';
 }
+/** The private attachments a message's text refers to, in order, each once (0.7.82). */
+export declare function chatAttachmentRefsIn(content: string | null | undefined): ChatAttachmentRef[];
+/** The private attachment keys a message's text refers to, for `signAttachments` (0.7.82). */
+export declare function chatAttachmentKeysIn(content: string | null | undefined): string[];

package/dist/resources/chat.js

@@ -1,3 +1,4 @@
+import { RecursivError } from '../errors.js';
 export class ChatResource {
     client;
     constructor(client) {
@@ -127,7 +128,11 @@ export class ChatResource {
     reactToMessage(messageId, input) {
         return this.client.post(`/chat/messages/${messageId}/react`, input);
     }
-    /** Edit a message (only the sender can edit) */
+    /**
+     * Edit a message's words (only the sender can edit). Keep each `chat-attachment:` reference it carries as it is: the
+     * server refuses an edit that drops, adds or swaps one (400 `attachment_refs_changed`, 0.7.82). To take an attachment
+     * back, delete the message.
+     */
     editMessage(messageId, input) {
         return this.client.put(`/chat/messages/${messageId}`, input);
     }
@@ -143,4 +148,81 @@ export class ChatResource {
     unreadCount(conversationId) {
         return this.client.get('/chat/unread-count', { conversation_id: conversationId });
     }
+    /**
+     * A PUT URL for one photo or voice note to send in a plaintext chat (0.7.82). With the server's private chat
+     * storage on, `private` is true, the URL writes into a private bucket and `ref` is `chat-attachment:<key>`, the text
+     * to send; with it off, `ref` is the upload's public URL. An end-to-end encrypted chat answers 409
+     * `conversation_encrypted`: its attachments go through `r.e2ee`. Most callers want `uploadAttachment`.
+     */
+    attachmentUploadUrl(conversationId, input) {
+        return this.client.post(`/chat/conversations/${conversationId}/attachments/upload-url`, input);
+    }
+    /**
+     * Upload one photo or voice note for a plaintext chat end to end and resolve the text to send for it (0.7.82): read
+     * the bytes, get the URL, PUT them with the matching Content-Type, and reject a failed transfer. Send `ref` as the
+     * message (or within it): a private reference renders through `signAttachments`, a public URL as before.
+     */
+    async uploadAttachment(conversationId, input) {
+        const hasBlob = input.blob !== undefined;
+        const hasUri = typeof input.uri === 'string' && input.uri.length > 0;
+        if (hasBlob === hasUri)
+            throw attachmentError(0, 'Provide exactly one of blob or uri.', 'invalid_upload_source');
+        const doFetch = input.fetchImpl ?? fetch;
+        let blob = input.blob;
+        if (!blob && input.uri) {
+            const source = await doFetch(input.uri);
+            if (!source.ok)
+                throw attachmentError(source.status, `Could not read upload source (HTTP ${source.status}).`, 'upload_source_failed');
+            blob = await source.blob();
+        }
+        if (!blob)
+            throw attachmentError(0, 'Upload source did not produce any bytes.', 'empty_upload_source');
+        const contentType = input.contentType?.trim() || blob.type?.trim();
+        if (!contentType)
+            throw attachmentError(0, 'A content type is required for chat attachments.', 'missing_content_type');
+        const minted = await this.attachmentUploadUrl(conversationId, { content_type: contentType, content_length: blob.size });
+        if (!minted?.data?.upload_url || !minted.data.ref) {
+            throw attachmentError(0, 'The API did not return a chat attachment upload URL.', 'missing_upload_url');
+        }
+        const response = await doFetch(minted.data.upload_url, { method: 'PUT', body: blob, headers: { 'Content-Type': contentType } });
+        if (!response.ok)
+            throw attachmentError(response.status, `Chat attachment upload failed (HTTP ${response.status}).`, 'chat_attachment_upload_failed');
+        return minted.data;
+    }
+    /**
+     * Short-lived URLs for a conversation's private attachments (0.7.82), at most 50 keys a call (the keys in its
+     * messages' `chat-attachment:` references; `chatAttachmentKeysIn` finds them). The server signs a key only for a
+     * member of the conversation, and only while a message its sender wrote there still carries it; any other key
+     * comes back with `url: null`. A URL works for about five minutes and is served `private, no-store`: ask again
+     * rather than keeping it.
+     */
+    signAttachments(conversationId, keys) {
+        return this.client.post(`/chat/conversations/${conversationId}/attachments/sign`, { keys });
+    }
+}
+function attachmentError(status, message, code) {
+    return new RecursivError(status, { type: 'upload_error', message, code });
+}
+/** The text a message carries before a private chat attachment's key. */
+export const CHAT_ATTACHMENT_REF_PREFIX = 'chat-attachment:';
+const CHAT_ATTACHMENT_REF_RE = /chat-attachment:(chat\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.([a-z0-9]{2,5}))/g;
+/** The extensions the server mints a private attachment key with (and jpeg), as it parses one; anything else is text. */
+const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'webp', 'gif']);
+const AUDIO_EXTENSIONS = new Set(['mp3', 'm4a', 'wav', 'ogg', 'weba']);
+/** The private attachments a message's text refers to, in order, each once (0.7.82). */
+export function chatAttachmentRefsIn(content) {
+    if (!content?.includes(CHAT_ATTACHMENT_REF_PREFIX))
+        return [];
+    const found = new Map();
+    for (const match of content.matchAll(CHAT_ATTACHMENT_REF_RE)) {
+        const extension = match[2];
+        const kind = AUDIO_EXTENSIONS.has(extension) ? 'audio' : IMAGE_EXTENSIONS.has(extension) ? 'image' : null;
+        if (kind && !found.has(match[1]))
+            found.set(match[1], { ref: match[0], key: match[1], kind });
+    }
+    return [...found.values()];
+}
+/** The private attachment keys a message's text refers to, for `signAttachments` (0.7.82). */
+export function chatAttachmentKeysIn(content) {
+    return chatAttachmentRefsIn(content).map((attachment) => attachment.key);
 }

package/dist/resources/e2ee.d.ts

@@ -68,6 +68,38 @@ export interface E2eeAccountReset {
  * - `conflict` (409): the device name or key was used before; start the device again with fresh ones.
  */
 export type E2eeResetErrorCode = 'confirmation_failed' | 'code_limit' | 'no_email_on_file' | 'email_delivery_unavailable' | 'reset_required' | 'conflict';
+/**
+ * One account whose main device a reset of encrypted chat replaced (`peerChanges`): `at` is when the new main
+ * device was registered (the relay's clock). Look at its devices again (`devices({ user_id })`).
+ */
+export interface E2eePeerChange {
+    userId: string;
+    at: string;
+}
+/**
+ * The realtime `e2ee:peer` event (`r.realtime.onE2eePeer`), sent to each member of an encrypted conversation the
+ * account `userId` shares with them, once per such conversation, when that account reset encrypted chat
+ * (`reason: 'root_changed'`): its security code changed there. Only to sockets whose credential can read that
+ * conversation over the relay. A hint: look at the account's devices again. An app in the background catches up
+ * with `peerChanges` when it comes to the foreground.
+ */
+export interface E2eePeerRealtimeEvent {
+    userId: string;
+    reason: 'root_changed';
+    conversationId: string;
+}
+/**
+ * Codes a message that declares `trust_change` can be refused with in a direct chat whose other person reset
+ * encrypted chat, where `status().accountReset` is on (409 `ConflictError` for both):
+ * - `peer_not_joined`: no device of this account has added the other person's new device to the chat yet, so the
+ *   message would be unreadable on it. `details: { userId }` names the person. Add the device, then send again.
+ * - `stale_epoch`: encrypted under a key generation before the chat's last key update. Sync, then encrypt it again.
+ */
+export type E2eePeerErrorCode = 'peer_not_joined' | 'stale_epoch';
+/** The `details` of a `peer_not_joined` refusal. */
+export interface E2eePeerNotJoinedDetails {
+    userId: string;
+}
 /** Opaque `recursiv-mls-v2-draft1` envelope with base64 MLS bytes. */
 export interface E2eeEnvelope {
     profile: 'recursiv-mls-v2-draft1';
@@ -367,6 +399,15 @@ export declare class E2eeResource {
      * delete. A commit ignores the flag. The relay learns only that the event
      * is quiet; the flag is not stored. A relay that predates it drops the
      * key, so the event is simply not quiet there.
+     *
+     * `trust_change: true` says this device's engine can accept a contact's new
+     * main device after they reset encrypted chat. Where `status().accountReset`
+     * is on, such a message in a direct chat whose other person reset is refused
+     * 409 `peer_not_joined` (`details: { userId }`) until a device of this
+     * account added their new device, and 409 `stale_epoch` when encrypted under
+     * a key generation before the chat's last key update (E2eePeerErrorCode). A
+     * message without it is accepted as before. Never stored; relays without it
+     * ignore it.
      */
     appendEvent(conversationId: string, input: {
         device_id: string;
@@ -375,11 +416,26 @@ export declare class E2eeResource {
         welcome_for_device_id?: string;
         expected_commit_seq?: number;
         silent?: boolean;
+        trust_change?: boolean;
     }): Promise<SingleResponse<{
         seq: number;
         duplicate: boolean;
         commitSeq: number;
     }>>;
+    /**
+     * The accounts sharing an encrypted conversation with this account (a direct
+     * chat, or a group both accepted) whose main device a reset of encrypted chat
+     * replaced after `since` (ISO 8601; default and floor: 7 days ago), oldest
+     * first, at most 200 (ask again from the last `at` for more). Read it when the
+     * app comes to the foreground, then look at each account's devices again; the
+     * live form is `r.realtime.onE2eePeer`. Empty where `status().accountReset` is
+     * off. Relays without it answer 404 (`NotFoundError`): treat that as no changes.
+     */
+    peerChanges(params?: {
+        since?: string;
+    }): Promise<{
+        data: E2eePeerChange[];
+    }>;
     events(conversationId: string, params: {
         device_id: string;
         after_seq?: number;

package/dist/resources/e2ee.js

@@ -96,11 +96,32 @@ export class E2eeResource {
      * delete. A commit ignores the flag. The relay learns only that the event
      * is quiet; the flag is not stored. A relay that predates it drops the
      * key, so the event is simply not quiet there.
+     *
+     * `trust_change: true` says this device's engine can accept a contact's new
+     * main device after they reset encrypted chat. Where `status().accountReset`
+     * is on, such a message in a direct chat whose other person reset is refused
+     * 409 `peer_not_joined` (`details: { userId }`) until a device of this
+     * account added their new device, and 409 `stale_epoch` when encrypted under
+     * a key generation before the chat's last key update (E2eePeerErrorCode). A
+     * message without it is accepted as before. Never stored; relays without it
+     * ignore it.
      */
     appendEvent(conversationId, input) {
         // Retries are safe: the server is idempotent on (conversation, device, event id).
         return this.client.post(`/e2ee/conversations/${encodeURIComponent(conversationId)}/events`, input, { retry: true });
     }
+    /**
+     * The accounts sharing an encrypted conversation with this account (a direct
+     * chat, or a group both accepted) whose main device a reset of encrypted chat
+     * replaced after `since` (ISO 8601; default and floor: 7 days ago), oldest
+     * first, at most 200 (ask again from the last `at` for more). Read it when the
+     * app comes to the foreground, then look at each account's devices again; the
+     * live form is `r.realtime.onE2eePeer`. Empty where `status().accountReset` is
+     * off. Relays without it answer 404 (`NotFoundError`): treat that as no changes.
+     */
+    peerChanges(params) {
+        return this.client.get('/e2ee/peer-changes', params);
+    }
     events(conversationId, params) {
         return this.client.get(`/e2ee/conversations/${encodeURIComponent(conversationId)}/events`, params);
     }

package/dist/resources/link-preview.d.ts

@@ -17,6 +17,30 @@ export interface LinkPreviewResponse {
      */
     data: LinkPreview | null;
     cached?: boolean;
+    /**
+     * `'ai_link'`: the link is not in the named message in a person's own words,
+     * and the caller did not write the same address in that conversation, so the
+     * server did not fetch it (it may be an AI's). Show the plain link, and do not
+     * ask again for this message. Only on a request that named its message or
+     * conversation (`source`).
+     */
+    refused?: 'ai_link';
+}
+/**
+ * Where a chat link came from. Name the message when you have its id; the
+ * conversation alone when you do not have it yet (an AI reply still being
+ * saved). With the conversation alone, a link is previewed only when the caller
+ * wrote it there, so another member's message not yet saved waits for its id.
+ * At least one of the two must be a non-empty id: `get` rejects otherwise and
+ * never falls back to a request without a source.
+ *
+ * Not for an encrypted conversation: the server has no readable messages there,
+ * so every link would be refused, the member's own included. There the app
+ * decides by its own rule (no preview of a link the member did not write).
+ */
+export interface LinkPreviewSource {
+    messageId?: string;
+    conversationId?: string;
 }
 export declare class LinkPreviewResource {
     private client;
@@ -27,6 +51,23 @@ export declare class LinkPreviewResource {
      * preview (`data: null`). No auth required — the endpoint is intentionally
      * public so unauthenticated UIs can render link previews. A URL that is not
      * http(s), or points at a private or internal address, still rejects (422).
+     *
+     * For a link in a chat message, pass `source`: the server then previews the
+     * link only when it is in the named message and a person wrote that message,
+     * or when the caller wrote the same address in that conversation (in a
+     * message, or as the card link of a Minds post they shared there). Otherwise
+     * it answers `{ data: null, refused: 'ai_link' }` without fetching it. A
+     * request with `source` is the caller's own: make it on a signed-in client
+     * whose key has `chat:read` (a keyless one gets 401). A message or
+     * conversation the caller cannot read rejects with 404. A `source` with no
+     * id in it (an AI reply whose id is not known yet, say) rejects with a
+     * ValidationError and sends nothing. Do not pass `source` in an encrypted
+     * conversation (see LinkPreviewSource). Servers before this change ignore
+     * `source` and preview the link, so an app keeps its own rule too: no
+     * preview of an AI-written link the member did not write.
+     *
+     * @example
+     * const { data, refused } = await r.linkPreview.get(url, { messageId: message.id });
      */
-    get(url: string): Promise<LinkPreviewResponse>;
+    get(url: string, source?: LinkPreviewSource | null): Promise<LinkPreviewResponse>;
 }

package/dist/resources/link-preview.js

@@ -1,3 +1,4 @@
+import { ValidationError } from '../errors.js';
 export class LinkPreviewResource {
     client;
     constructor(client) {
@@ -9,8 +10,41 @@ export class LinkPreviewResource {
      * preview (`data: null`). No auth required — the endpoint is intentionally
      * public so unauthenticated UIs can render link previews. A URL that is not
      * http(s), or points at a private or internal address, still rejects (422).
+     *
+     * For a link in a chat message, pass `source`: the server then previews the
+     * link only when it is in the named message and a person wrote that message,
+     * or when the caller wrote the same address in that conversation (in a
+     * message, or as the card link of a Minds post they shared there). Otherwise
+     * it answers `{ data: null, refused: 'ai_link' }` without fetching it. A
+     * request with `source` is the caller's own: make it on a signed-in client
+     * whose key has `chat:read` (a keyless one gets 401). A message or
+     * conversation the caller cannot read rejects with 404. A `source` with no
+     * id in it (an AI reply whose id is not known yet, say) rejects with a
+     * ValidationError and sends nothing. Do not pass `source` in an encrypted
+     * conversation (see LinkPreviewSource). Servers before this change ignore
+     * `source` and preview the link, so an app keeps its own rule too: no
+     * preview of an AI-written link the member did not write.
+     *
+     * @example
+     * const { data, refused } = await r.linkPreview.get(url, { messageId: message.id });
      */
-    get(url) {
-        return this.client.get('/link-preview', { url });
+    async get(url, source) {
+        const params = { url };
+        if (source != null) {
+            // A source with no id must not turn into a bare request: the server would
+            // then fetch the link with no check at all.
+            if (!source.messageId && !source.conversationId) {
+                throw new ValidationError({
+                    type: 'validation_error',
+                    code: 'link_preview_source_missing',
+                    message: 'linkPreview.get: source needs a messageId or a conversationId. Wait for the id, or show the plain link.',
+                });
+            }
+            if (source.messageId)
+                params.message_id = source.messageId;
+            if (source.conversationId)
+                params.conversation_id = source.conversationId;
+        }
+        return this.client.get('/link-preview', params);
     }
 }

package/dist/resources/network.d.ts

@@ -1,5 +1,6 @@
 import type { HttpClient } from '../client.js';
 import type { SingleResponse } from '../types.js';
+import type { AssistantSettings } from '../assistant-surfaces.js';
 interface NetworkConfig {
     name: string;
     slug: string | null;
@@ -11,14 +12,25 @@ interface NetworkConfig {
      * `bookmark_collections` (0.7.68; absent on older servers): this server serves bookmark collections
      * (`bookmarks.collections`). Show collections only when it is true, and still treat a 503
      * `lists_unavailable` as off.
+     *
+     * `child_safety_report_category` (absent on older servers): this server files the child-safety report category's
+     * sub-types (`child_safety:minor_in_danger`, `:sexualised_minor`, `:grooming_enticement`, `:trafficking`) as
+     * urgent: top severity, an immediate staff alert, decided by a person. Offer them only when it is true; otherwise
+     * report child sexual abuse material as `csam`, which every server files as urgent.
      */
     capabilities: {
         ws_token: boolean;
         bookmark_collections?: boolean;
+        child_safety_report_category?: boolean;
     };
     auth_methods: string;
     default_template_name: string | null;
     locale: string;
+    /**
+     * The assistant surface switches for the app this key is bound to (absent on servers from before George plan G7a).
+     * Read them with `assistantSurfaceOn(config, id)`, which is off for anything but an explicit true.
+     */
+    assistant?: AssistantSettings;
 }
 export declare class NetworkResource {
     private client;

package/dist/resources/project-brain.d.ts

@@ -1,5 +1,6 @@
 import type { HttpClient } from '../client.js';
 import type { SingleResponse } from '../types.js';
+import type { AssistantSettings, AssistantSettingsUpdate } from '../assistant-surfaces.js';
 export interface BrainTask {
     id: string;
     title: string;
@@ -153,6 +154,8 @@ export interface ProjectBrainSettings {
     maxStepsPerRun?: number;
     heartbeatTimeoutMinutes?: number;
     dailySpendingLimitUsd?: number;
+    /** The assistant surface switches: every surface id, off unless stored as true (absent on older servers). */
+    assistant?: AssistantSettings;
     [key: string]: unknown;
 }
 export interface UpdateProjectSettingsInput {
@@ -161,6 +164,11 @@ export interface UpdateProjectSettingsInput {
     max_steps_per_run?: number;
     heartbeat_timeout_minutes?: number;
     daily_spending_limit_usd?: number;
+    /**
+     * Turn assistant surfaces on or off for this app (George plan G7a): the ids given are set, the rest kept. The
+     * project's owner or an admin only (403 `project_admin_required` otherwise); an unknown id is a 400.
+     */
+    assistant?: AssistantSettingsUpdate;
 }
 export interface BrowserUseRunTaskInput {
     task: string;

package/dist/resources/reports.d.ts

@@ -57,4 +57,28 @@ export declare class ReportsResource {
     dismiss(reportId: string): Promise<SingleResponse<{
         success: true;
     }>>;
+    /**
+     * Short-lived URLs for the private chat photos and voice notes a reported message carries (0.7.82), for the staff
+     * person reviewing the report. A live admin's own key only: an AI account or an agent key gets 403
+     * `human_required`. Only the reported message's own attachments are signed; each URL works for about five minutes
+     * and is served `private, no-store`, so ask again rather than keeping it. A report of anything but a message is
+     * 400 `not_a_message_report`. Only a recipient's report opens anything: a report you filed yourself is 403
+     * `own_report`, and one not filed by a person in that chat (other than the message's sender) is 403
+     * `reporter_not_a_recipient`.
+     */
+    signAttachments(reportId: string): Promise<SingleResponse<ReportedMessageAttachments>>;
+}
+export interface ReportedMessageAttachment {
+    key: string;
+    kind: 'image' | 'audio';
+    content_type: string;
+    /** A GET URL valid until `expires_at`. */
+    url: string;
+    expires_at: string;
+}
+export interface ReportedMessageAttachments {
+    report_id: string;
+    message_id: string;
+    conversation_id: string;
+    attachments: ReportedMessageAttachment[];
 }

package/dist/resources/reports.js

@@ -27,4 +27,16 @@ export class ReportsResource {
     dismiss(reportId) {
         return this.client.post(`/reports/${encodeURIComponent(reportId)}/dismiss`);
     }
+    /**
+     * Short-lived URLs for the private chat photos and voice notes a reported message carries (0.7.82), for the staff
+     * person reviewing the report. A live admin's own key only: an AI account or an agent key gets 403
+     * `human_required`. Only the reported message's own attachments are signed; each URL works for about five minutes
+     * and is served `private, no-store`, so ask again rather than keeping it. A report of anything but a message is
+     * 400 `not_a_message_report`. Only a recipient's report opens anything: a report you filed yourself is 403
+     * `own_report`, and one not filed by a person in that chat (other than the message's sender) is 403
+     * `reporter_not_a_recipient`.
+     */
+    signAttachments(reportId) {
+        return this.client.post(`/reports/${encodeURIComponent(reportId)}/attachments/sign`);
+    }
 }

package/dist/resources/users.d.ts

@@ -1,10 +1,19 @@
 import type { HttpClient } from '../client.js';
 import type { PaginatedResponse, SingleResponse, User, FollowUser, PaginationParams } from '../types.js';
+import type { AssistantSettings } from '../assistant-surfaces.js';
+/** The signed-in user as `users.me()` returns it. */
+export interface CurrentUser extends User {
+    /**
+     * The assistant surface switches for the app this key is bound to (absent on servers from before George plan G7a).
+     * Read them with `assistantSurfaceOn(me, id)`, which is off for anything but an explicit true.
+     */
+    assistant?: AssistantSettings;
+}
 export declare class UsersResource {
     private client;
     constructor(client: HttpClient);
-    /** Get the authenticated user's profile */
-    me(): Promise<SingleResponse<User>>;
+    /** Get the authenticated user's profile, with the app's assistant surface switches */
+    me(): Promise<SingleResponse<CurrentUser>>;
     /** Get a user by ID */
     get(id: string): Promise<SingleResponse<User>>;
     /** List a user's followers */

package/dist/resources/users.js

@@ -3,7 +3,7 @@ export class UsersResource {
     constructor(client) {
         this.client = client;
     }
-    /** Get the authenticated user's profile */
+    /** Get the authenticated user's profile, with the app's assistant surface switches */
     me() {
         return this.client.get('/users/me');
     }

package/dist/types.d.ts

@@ -1316,7 +1316,35 @@ export interface AgentChatInput {
     message: string;
     conversation_id?: string;
     new_conversation?: boolean;
+    /** Per-turn options. `{ safe: true }` makes this a safe turn (see {@link AgentChatTurn}). */
+    turn?: AgentChatTurn;
 }
+/**
+ * Per-turn options for an agent chat message.
+ *
+ * `safe: true` (George plan G6a) asks about something on the network, typically someone else's post, on the caller's
+ * own personal agent, in their one Asks thread with it (found or made by the server; leave out `new_conversation`, and
+ * send `conversation_id` only for that thread). The turn has no tools whatever the agent's tool mode, reads and saves
+ * no memory, sends OpenRouter `data_collection: 'deny'` whatever the member chose, writes no audit copy of the prompt
+ * or reply (`ai_usage_detail`), sends pictures as alt text and stored descriptions only, and counts against a small
+ * daily allowance. Every later turn in the Asks thread is a safe turn too, however it is sent. The reply
+ * carries `metadata.safe_turn: true`. Refusals answer with a fixed {@link SafeTurnRefusalCode}; none names a plan or
+ * a price, and the server never creates an agent for an ask.
+ */
+export interface AgentChatTurn {
+    safe?: boolean;
+}
+/**
+ * Why the server refused a safe turn (the `code` of the error):
+ * - `safe_turn_limit` (429): today's asks are used up (an app shows its own "limit" words). Marked
+ *   `X-RateLimit-Scope: action`, so the SDK throws it at once as a `RateLimitError` with `scope: 'action'` and
+ *   `resetAt` (the next midnight UTC), and does not resend it.
+ * - `safe_turn_needs_personal_agent` (409): the agent is not the caller's own personal agent.
+ * - `safe_turn_needs_app` (403): the key is bound to no app (a personal key, say); an ask goes with the app's own key.
+ * - `safe_turn_ai_off` / `safe_turn_standard_off` (403): the member's AI choices refuse it.
+ * - `safe_turn_conversation` (400): `new_conversation` was sent, or `conversation_id` is not the Asks thread.
+ */
+export type SafeTurnRefusalCode = 'safe_turn_limit' | 'safe_turn_needs_personal_agent' | 'safe_turn_needs_app' | 'safe_turn_ai_off' | 'safe_turn_standard_off' | 'safe_turn_conversation';
 /** Answer an existing message of yours again, without sending it a second time. */
 export interface AgentChatRetryInput {
     conversation_id: string;
@@ -1597,6 +1625,12 @@ export interface ContentPreferences {
     autoplay_video: boolean;
     ai_enabled: boolean;
     default_feed: 'foryou' | 'following';
+    /**
+     * True when the member picked `default_feed` themselves (any `updateContent({ default_feed })` sets it).
+     * When false, `default_feed` is only the default and the app may choose for them. Absent from APIs older than
+     * this field: treat absent as unknown, not as false.
+     */
+    default_feed_chosen?: boolean;
 }
 export interface UpdateNotificationChannelsInput {
     /** Master switch: sets in-app on every kind. */