@recursiv/sdk 0.7.83 → 0.7.89

package/dist/assistant/turnCaps.js

@@ -0,0 +1,141 @@
+/**
+ * `sealedTurnCaps`: what one Sealed message may carry (sealed-full-scope-v1 3.2 rule 5, 4.2, 4.3 and 2.6). A message is
+ * dangerous when it holds three things at once: something about the member, words or pictures from someone else, and
+ * a way to send data out. Web search is a way out (page opens and search words both reach Exa), and nothing screens a
+ * post before the model reads it. So:
+ *
+ * - a message that searches never carries memory, About you or a picture from the phone. Those are never dropped to
+ *   make room for search: search is what turns off ('search.off_mix');
+ * - a message with someone else's public post in it, or earlier in its chat, doesn't search until Tinfoil limits page
+ *   opens (ask 3, `page_opens_limited`, default false) ('search.off_subject');
+ * - members-only posts and picked chat messages never search ('search.off_members'), nor do encrypted-chat messages
+ *   ('search.e2ee'): their words would reach a search company without their authors agreeing;
+ * - a message that searches carries only the question (and, after ask 3, the public post it asks about), never the
+ *   chat's earlier messages or George's earlier answers, before and after ask 3 (S-D9) ('search.question_only');
+ * - a Both message never searches ('both.no_search') and never carries a picture from the phone ('both.no_photo'),
+ *   because its Standard half is an ordinary Minds turn. For the same reason a Both message with encrypted-chat
+ *   messages throws: an encrypted-chat ask is Sealed only (G21), and Both would send the messages to Standard;
+ * - the saved facts go only when Sealed memory is on and on for this chat: the header chip in the member's own chat,
+ *   and only the member's "Use what George remembers" tick in an ask or chat carrying someone else's content (George
+ *   plan 4.7; the chip alone never counts there); never in a temporary chat or with encrypted-chat messages. About
+ *   you, when "Use these" is on, follows the same rules except that it doesn't need memory on;
+ * - an encrypted-chat ask carries no picture from the phone (G21: one message of words);
+ * - temporary chats neither read nor write memory, and a suggestion in an answer to a message that may hold anyone
+ *   else's words (a post, chat messages, search results, a picture from the phone, which may be a screenshot, or
+ *   earlier answers in a chat that searched or carried a phone picture) is never offered for saving (4.2).
+ *
+ * What the caps cannot see for themselves (someone else's content, how many pictures from the phone this message
+ * carries, a temporary chat, an earlier search, an earlier phone picture, earlier messages in the chat) are required
+ * inputs: one left out throws rather than reading as "none", so a caller that forgot one never sends more than it
+ * should or loses a line the member is owed. More than 3 pictures from the phone throws too: a message carries at most
+ * 3 pictures in all (2.2), and the composer caps them.
+ *
+ * Pure: no clock, randomness or network. The same input gives the same caps on every phone and server.
+ */
+import { BUNDLE_PICTURE_LIMITS } from './render.js';
+import { SEALED_CONTENT_KINDS } from './types.js';
+/** A choice that sends something counts only when it is exactly true. */
+const isOn = (value) => value === true;
+/** A restriction counts for anything but false, null or absent, so a value it cannot read restricts. */
+const isSet = (value) => value !== undefined && value !== null && value !== false;
+const KINDS = new Set(SEALED_CONTENT_KINDS);
+/** A required restriction: absent or null throws, so a caller that forgot it never reads as unrestricted. */
+function restriction(value, name, pass) {
+    if (value === undefined || value === null)
+        throw new TypeError(`sealedTurnCaps: ${name} is required (pass ${pass} for none)`);
+    return isSet(value);
+}
+function contentKinds(value) {
+    const out = new Set();
+    if (value === undefined || value === null) {
+        throw new TypeError("sealedTurnCaps: others_content is required (pass [] for the member's own words only)");
+    }
+    if (!Array.isArray(value))
+        throw new TypeError('sealedTurnCaps: others_content must be a list of content kinds');
+    for (const kind of value) {
+        if (!KINDS.has(kind))
+            throw new TypeError(`sealedTurnCaps: unknown content kind ${JSON.stringify(kind) ?? String(kind)}`);
+        out.add(kind);
+    }
+    return out;
+}
+/** At most 3 pictures in one message, from the phone and from posts together (sealed-full-scope-v1 2.2). */
+const MAX_PICTURES = BUNDLE_PICTURE_LIMITS.max_pictures;
+function pictureCount(value) {
+    // Required: left out, a message with a picture would search beside it, or drop it with no 'search.off_mix' line, and
+    // could offer a suggestion from a screenshot.
+    if (value === undefined || value === null)
+        throw new TypeError('sealedTurnCaps: phone_pictures is required (pass 0 for none)');
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0 || value > MAX_PICTURES) {
+        throw new TypeError(`sealedTurnCaps: phone_pictures must be a whole number from 0 to ${MAX_PICTURES}: the composer caps them`);
+    }
+    return value;
+}
+/** What `input`, one Sealed message, may carry. See the module comment for the rules. */
+export function sealedTurnCaps(input) {
+    if (!input || typeof input !== 'object')
+        throw new TypeError('sealedTurnCaps needs an input object');
+    if (input.mode !== 'sealed' && input.mode !== 'both') {
+        throw new TypeError("sealedTurnCaps: mode must be 'sealed' or 'both'");
+    }
+    const both = input.mode === 'both';
+    const kinds = contentKinds(input.others_content);
+    const others = kinds.size > 0;
+    const encrypted = kinds.has('encrypted_chat');
+    // G21: an encrypted-chat ask is Sealed only. A Both message's Standard half is an ordinary Minds turn (2.6), so it
+    // would put the decrypted messages on Minds and the AI company. No surface offers this, so it is a caller's mistake.
+    if (both && encrypted) {
+        throw new TypeError("sealedTurnCaps: an encrypted-chat ask is Sealed only (G21): mode 'both' would send it to Standard");
+    }
+    const membersOnly = kinds.has('members_only_post') || kinds.has('chat_messages');
+    const temporary = restriction(input.temporary, 'temporary', 'false');
+    const searchedEarlier = restriction(input.searched_earlier, 'searched_earlier', 'false');
+    // Decides the 'search.question_only' line (S-D9: the member is told the chat so far was left out), so it is required
+    // like the restrictions: left out, a searching message would drop the chat so far without saying so.
+    const earlierMessages = restriction(input.earlier_messages, 'earlier_messages', 'false');
+    const picturesEarlier = restriction(input.phone_pictures_earlier, 'phone_pictures_earlier', 'false');
+    const pictures = pictureCount(input.phone_pictures);
+    // The memory message (4.3): never in a temporary chat or with encrypted-chat messages. In the member's own chat the
+    // chip turns it on; with someone else's content only the "Use what George remembers" tick does, never the chip.
+    const inChat = others ? isOn(input.memory_tick) : isOn(input.memory_in_chat);
+    const memory = isOn(input.memory) && inChat && !temporary && !encrypted;
+    const aboutYou = isOn(input.about_you) && !temporary && !encrypted && (!others || isOn(input.memory_tick));
+    // G21: an encrypted-chat ask is one message of words.
+    const phonePictures = pictures > 0 && !both && !encrypted;
+    let search = false;
+    let searchOff = null;
+    if (isOn(input.search)) {
+        if (both)
+            searchOff = 'both.no_search';
+        else if (encrypted)
+            searchOff = 'search.e2ee';
+        else if (membersOnly)
+            searchOff = 'search.off_members';
+        else if (others && !isOn(input.page_opens_limited))
+            searchOff = 'search.off_subject';
+        // Memory, About you and pictures stay; search is what turns off.
+        else if (memory || aboutYou || phonePictures)
+            searchOff = 'search.off_mix';
+        else
+            search = true;
+    }
+    const reasons = [];
+    if (searchOff)
+        reasons.push(searchOff);
+    if (search && earlierMessages)
+        reasons.push('search.question_only');
+    if (pictures > 0 && both)
+        reasons.push('both.no_photo');
+    return {
+        search,
+        history: !search,
+        memory,
+        about_you: aboutYou,
+        phone_pictures: phonePictures,
+        // Search results are someone else's words too, and so is an earlier answer built from them, which this message
+        // carries in its history: a page could plant a "fact" (4.2, gate M3). A picture from the phone may be a screenshot
+        // or a meme with someone else's words in it, and an earlier answer about one stays in the history (2.2).
+        suggest_memory: memory && !others && !search && !searchedEarlier && !phonePictures && !picturesEarlier,
+        reasons,
+    };
+}

package/dist/assistant/types.d.ts

@@ -31,18 +31,36 @@ export interface SubjectAuthorInput {
     known_minor?: boolean | null;
 }
 /**
- * One picture, clip or sound on a post. Only its type and alt text are read: an address or the bytes, if the caller's
- * object carries them, are never copied into the bundle.
+ * One picture, clip or sound on a post. Only its type, its alt text, `held`, and for pictures its plain id and
+ * `checked_at` are read: an address or the bytes, if the caller's object carries them, are never copied into the bundle.
  */
 export interface SubjectMediaInput {
     type?: string | null;
     /** What the author wrote for it. */
     alt_text?: string | null;
     /**
-     * Under a child-safety hold or reported: its alt text and the post's stored caption are left out. Server-side input,
-     * like the post's hold. Any value but `false`, `null` or absent counts as set.
+     * Under a child-safety hold or reported: the builder leaves out its alt text, and the post's stored caption, which may
+     * describe it. Any value but `false`, `null` or absent counts as set. `true` is server-side, like the post's hold:
+     * never send it to another member's client. A server leaves held media out of that payload, and leaves out the
+     * post's stored caption (`ai_caption`) whenever any of its media is held: a client builder cannot see media it was
+     * never sent, so it keeps whatever caption the payload carries. `false` is also the payload's "not held" mark
+     * (sealed-full-scope-v1 2.1): a picture goes to a model as a picture only when `held` is exactly `false`, so pass
+     * it through from the payload. Absent or null still goes as alt text, but never as a picture.
      */
     held?: boolean | null;
+    /**
+     * The media's id in the post payload (`media[].id`), so a caller that renders with pictures can find the picture in
+     * its own image cache. Kept for pictures only, and only when it is a plain id: never an address.
+     */
+    id?: string | null;
+    /**
+     * When Minds last matched this picture against the child-safety hash lists (the post payload's `media[].checked_at`,
+     * sealed-full-scope-v1 2.1, gate P1): an ISO time with its zone, written only by the server. Kept only when `held`
+     * is exactly `false`. A picture can go to a model as a picture only while this is under 24 hours old by the
+     * renderer's clock; absent, not an ISO time with its zone, or without `held: false`, means alt text and the stored
+     * caption only, as for every other picture.
+     */
+    checked_at?: string | null;
 }
 export interface SubjectLinkCardInput {
     url?: string | null;
@@ -150,6 +168,13 @@ export type BundleItemRole = 'subject' | 'parent' | 'quoted' | 'reply';
 export interface BundleMedia {
     type: 'image' | 'video' | 'audio' | 'other';
     alt_text: string | null;
+    /** Pictures only: the media's id, when the input had a plain one. Never written into model input. */
+    id?: string;
+    /**
+     * Pictures only: Minds' last child-safety check of it (ISO time, UTC), when the input had a valid one and marked the
+     * picture not held (`held: false`).
+     */
+    checked_at?: string;
 }
 export interface BundleCounts {
     votes?: number;
@@ -259,7 +284,64 @@ export interface RenderBundleOptions {
     boundary: string;
     /** For 'translate': the language to translate into, as a BCP 47 tag ('es', 'pt-BR'). */
     language?: string | null;
+    /**
+     * Attach post pictures as pictures (sealed-full-scope-v1 2.1 and 2.2). Without it, or when no picture qualifies,
+     * every picture goes as its alt text and the stored caption only, and the output is exactly as before.
+     */
+    pictures?: RenderPictureOptions | null;
 }
+/** A post picture in a bundle that may go to the model as a picture: see `bundlePictures`. */
+export interface BundlePicture {
+    /** The id of the item the picture is on. */
+    item_id: string;
+    /** Where that item sits: the asked-about post, its parent or its quote. A reply's pictures never go as pictures. */
+    role: Exclude<BundleItemRole, 'reply'>;
+    /** The picture's id in the post payload: find its bytes in your image cache by this. */
+    media_id: string;
+    /** Which picture of its item it is, from 1, as the content numbers them ("picture 2 alt text"). */
+    number: number;
+    /** Minds' last child-safety check of it (ISO time, UTC), from the bundle, for your own freshness check. */
+    checked_at: string;
+}
+export interface BundlePictureOptions {
+    /** Your clock, in milliseconds since 1970 UTC, or a Date. The renderer reads no clock of its own. */
+    now: number | Date;
+    /**
+     * How many post pictures this message still has room for: 3 (the per-message limit, sealed-full-scope-v1 2.2) minus
+     * the pictures from the phone it carries (`Math.max(0, 3 - phonePictures)`). A whole number; above 3 counts as 3;
+     * absent means 3; below 0 throws. Pass the same value to bundlePictures and renderBundleForModel.
+     */
+    max?: number | null;
+}
+export interface RenderPictureOptions extends BundlePictureOptions {
+    /**
+     * The pictures you approved: the list bundlePictures gave you, less any your own checks left out. The renderer
+     * attaches only a picture on this list that still qualifies at `now`, so a picture left out here, or one that went
+     * stale since, goes as alt text only, and no other picture takes its place. Read `now` again for this call
+     * (`Date.now()` after your checks): a later clock can only take pictures away.
+     */
+    allowed: readonly BundlePicture[];
+    /**
+     * The picture's bytes from your own image cache: the base64 of a JPEG already prepared on this device (shrunk,
+     * re-encoded, metadata stripped; sealed-full-scope-v1 2.2), or null when it has not loaded. Never fetch here: a
+     * picture that has not loaded is not sent. Anything but base64 JPEG bytes, or a throw, means that picture goes as alt
+     * text only. Asked only for pictures on `allowed`. Prepare first, then check: return exactly the prepared bytes your
+     * checks passed for this picture, never a second read of the cache (an entry replaced in between would send a picture
+     * nobody checked, and the raw cached file still carries its metadata). The renderer can tell only that the bytes look
+     * like a JPEG, not that they were prepared.
+     */
+    cached: (picture: BundlePicture) => string | null | undefined;
+}
+/** One part of the user message, in the chat-completions content-part shape. */
+export type RenderedUserPart = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'image_url';
+    image_url: {
+        url: string;
+    };
+};
 /**
  * A rendered bundle. Render only a bundle this process built from its own reads: the renderer re-checks every field
  * it writes outside a member line and throws on one that does not fit, but a bundle a client sent has skipped every
@@ -268,15 +350,30 @@ export interface RenderBundleOptions {
 export interface RenderedBundle {
     /** Fixed instructions written by the renderer: trusted, for the system role. */
     system: string;
-    /** The delimited content, then the task again: for the user role. */
+    /**
+     * The delimited content, then the task again: for the user role. Words only: when `pictures` is not empty it still
+     * says which pictures are attached but cannot carry them, so send `user_parts` instead.
+     */
     user: string;
-    /** `system` and `user` as one message, for a path that sends one. */
+    /**
+     * `system` and `user` as one message, for a path that sends one. Only when `pictures` is empty: it names the
+     * attached pictures but cannot carry them.
+     */
     text: string;
     /**
      * What the rendered content holds: an answer may cite or link these and nothing else, and only as plain links (see
-     * BundleReferences): never render an image the model wrote.
+     * BundleReferences): never render an image the model wrote. Never a picture's address or bytes, attached or not.
      */
     references: BundleReferences;
+    /** The pictures attached as image parts, in order: empty unless `pictures` was given and one qualified. */
+    pictures: BundlePicture[];
+    /**
+     * The user message as content parts, for a request that takes pictures: the content's opening line and its text,
+     * then each attached picture as an image part (a `data:image/jpeg;base64,` address, never a web address), then the
+     * content's closing line and the task again, so the pictures sit inside the delimited block. Its text parts, joined
+     * with a line break, are `user`. With no picture attached it is one text part holding `user`.
+     */
+    user_parts: RenderedUserPart[];
 }
 /** Which fixed card a message calls for. */
 export type FixedCardKind = 'election' | 'crisis';
@@ -351,3 +448,122 @@ export interface FixedCardMatch {
  * 'card_then_answer' shows the card first, then the turn may go on to a model answer.
  */
 export type FixedCardAnswer = 'card_only' | 'card_then_answer';
+/**
+ * How a message is sent: Sealed alone, or 'both' (D3: the same prompt to Standard and to Sealed, side by side). 'both'
+ * with encrypted-chat messages throws: an encrypted-chat ask is Sealed only (G21).
+ */
+export type SealedTurnMode = 'sealed' | 'both';
+/**
+ * Someone else's content in a Sealed message, by where it came from:
+ * - 'public_post': a post its author made public, as the post in a George ask, an attached post, a quote or a chat's
+ *   subject (G13d);
+ * - 'members_only_post': a post in a group that is not public, in any of those places;
+ * - 'chat_messages': messages picked from a chat;
+ * - 'encrypted_chat': messages from an encrypted chat (G21). Sealed only: with mode 'both' it throws.
+ */
+export type SealedContentKind = 'public_post' | 'members_only_post' | 'chat_messages' | 'encrypted_chat';
+export declare const SEALED_CONTENT_KINDS: readonly SealedContentKind[];
+/**
+ * One Sealed message, as the app is about to send it. Choices that send something (search, memory, the chip, the tick,
+ * About you, Tinfoil's page-open limit) count only when `true`. The six facts the caps cannot see for themselves
+ * (`others_content`, `phone_pictures`, `temporary`, `searched_earlier`, `phone_pictures_earlier`, `earlier_messages`)
+ * are required: absent or null throws, and the four flags count as set for any value but `false`. A `mode`,
+ * `others_content` or `phone_pictures` this function cannot read throws a TypeError, and so does mode 'both' with
+ * 'encrypted_chat' content (G21: Sealed only).
+ */
+export interface SealedTurnInput {
+    mode: SealedTurnMode;
+    /** "Search the web" is on for this chat (the composer's switch). */
+    search?: boolean | null;
+    /**
+     * Someone else's content in this message or anywhere earlier in this chat; a chat's subject counts for every message
+     * in it. Required: pass `[]` for a message of the member's own words only.
+     */
+    others_content: readonly SealedContentKind[];
+    /**
+     * The chat has earlier messages or answers. Required: pass `false` for the first message. It decides the
+     * 'search.question_only' line: a message that searches never carries the chat so far, and the member is told so.
+     */
+    earlier_messages: boolean;
+    /**
+     * A message earlier in this chat searched the web, so George's earlier answers may echo a web page. Required: pass
+     * `false` when none did. It stops memory suggestions (4.2, gate M3); it does not stop search or memory.
+     */
+    searched_earlier: boolean;
+    /**
+     * A message earlier in this chat carried a picture from the phone to Sealed, so George's earlier answers about it,
+     * which stay in the history (2.2), may echo words written in it. Required: pass `false` when none did. It stops
+     * memory suggestions (4.2); it does not stop search or memory.
+     */
+    phone_pictures_earlier: boolean;
+    /** Sealed memory is on (Settings > George > What George remembers, "On this phone"). Off by default. */
+    memory?: boolean | null;
+    /**
+     * The header's Memory chip is on for this chat. Counts only when `others_content` is empty: memory is off in any
+     * ask or chat carrying someone else's content unless the member ticks `memory_tick` (George plan 4.7).
+     */
+    memory_in_chat?: boolean | null;
+    /**
+     * The member ticked "Use what George remembers" for this ask or chat (it starts off). The only thing that sends
+     * memory, or About you, with someone else's content; ignored when `others_content` is empty.
+     */
+    memory_tick?: boolean | null;
+    /** "Use these" is on for the About you fields ("How George talks to you"). */
+    about_you?: boolean | null;
+    /**
+     * How many pictures from the phone are attached: a whole number from 0 to 3 (a message carries at most 3 pictures in
+     * all, sealed-full-scope-v1 2.2, so the composer caps them). Required: pass `0` for none. Absent or null throws, so a
+     * caller that forgot it never searches beside a picture or drops one without its line; more than 3 throws.
+     */
+    phone_pictures: number;
+    /** A temporary Sealed chat. Required: pass `false` for a saved chat. */
+    temporary: boolean;
+    /**
+     * Tinfoil limits page opens for Minds' key to addresses from search results or the member's message
+     * (sealed-full-scope-v1 3.6, ask 3). Defaults to false. Set it only from a server switch, once Tinfoil confirms.
+     */
+    page_opens_limited?: boolean | null;
+}
+/**
+ * Why something the member turned on is off for this message, as the copy id the app shows (sealed-full-scope-v1
+ * 5.1 and 5.2):
+ * - 'search.off_mix': it carries memory, About you or a picture from the phone, so it doesn't search;
+ * - 'search.off_subject': it carries someone else's public post, and Tinfoil doesn't limit page opens yet (ask 3);
+ * - 'search.off_members': it carries a members-only post or picked chat messages, which never search;
+ * - 'search.e2ee': it carries encrypted-chat messages, which never search;
+ * - 'search.question_only': it searches, so it carries only the question, not the chat so far;
+ * - 'both.no_search': a Both message doesn't search;
+ * - 'both.no_photo': a Both message doesn't carry a picture from the phone.
+ */
+export type SealedTurnReason = 'search.off_mix' | 'search.off_subject' | 'search.off_members' | 'search.e2ee' | 'search.question_only' | 'both.no_search' | 'both.no_photo';
+export declare const SEALED_TURN_REASONS: readonly SealedTurnReason[];
+/**
+ * What one Sealed message may carry. Someone else's content in the message itself (the post asked about) always goes.
+ * In a Both message it goes to the Standard half too, an ordinary Minds turn (2.6), whose bundle is built with mode
+ * 'standard' (that leaves out posts whose authors chose Sealed only). So these caps do not keep a public post, a
+ * members-only post or picked chat messages from Standard. Only encrypted-chat content is Sealed only: a Both message
+ * with it throws instead of returning caps.
+ */
+export interface SealedTurnCaps {
+    /** Put `web_search_options`, with both of Tinfoil's filters, in the sealed body, and mark the request as one that may search. */
+    search: boolean;
+    /** Send the chat's earlier messages and George's earlier answers. Never with a message that searches. */
+    history: boolean;
+    /** Send the saved facts, in the sealed body (4.3). */
+    memory: boolean;
+    /** Send the About you fields, in the same system message as the facts. */
+    about_you: boolean;
+    /**
+     * The attached pictures from the phone may go. The picture checks (2.4) still decide each one. Never in Both, and
+     * never with encrypted-chat messages (G21 is one message of words; that surface has no Photo item, so no line).
+     */
+    phone_pictures: boolean;
+    /**
+     * A suggestion tagged in the answer may be offered for saving (4.2, gate M3). Never from a message that may hold
+     * someone else's words: a post, chat messages, this message's search results, a picture from the phone (it may be a
+     * screenshot), or an earlier answer built from a search or about a phone picture.
+     */
+    suggest_memory: boolean;
+    /** Copy ids for what the member turned on that this message leaves off, each once, in a fixed order. */
+    reasons: SealedTurnReason[];
+}

package/dist/assistant/types.js

@@ -9,3 +9,18 @@
  */
 export const ASSIST_INTENTS = ['explain', 'summarise', 'fact_context', 'translate', 'describe'];
 export const FIXED_CARD_LANGUAGES = ['en', 'es'];
+export const SEALED_CONTENT_KINDS = [
+    'public_post',
+    'members_only_post',
+    'chat_messages',
+    'encrypted_chat',
+];
+export const SEALED_TURN_REASONS = [
+    'search.off_mix',
+    'search.off_subject',
+    'search.off_members',
+    'search.e2ee',
+    'search.question_only',
+    'both.no_search',
+    'both.no_photo',
+];

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './resources/discovery-learning.js';
 import { DiscoveryResource } from './resources/discovery.js';
 export * from './resources/discovery.js';
 export * from './feed-definition.js';
+export * from './social-protocol-ids.js';
 import { AuthResource } from './resources/auth.js';
 import { PostsResource } from './resources/posts.js';
 import { UsersResource } from './resources/users.js';
@@ -67,6 +68,7 @@ import { FeedsResource } from './resources/feeds.js';
 import { AccountsResource } from './resources/accounts.js';
 import { SignalsResource } from './resources/signals.js';
 import { SealedResource } from './resources/sealed.js';
+import { PrivacyResource } from './resources/privacy.js';
 import { RealtimeClient } from './realtime.js';
 import type { RecursivConfig } from './types.js';
 export declare class Recursiv {
@@ -144,6 +146,8 @@ export declare class Recursiv {
     readonly signals: SignalsResource;
     /** Sealed mode's config and transport: targets, models, allowance, the attestation relay and the sealed send (no crypto; flag-gated). */
     readonly sealed: SealedResource;
+    /** Which platform privacy facts the deployed API's build enforces (pair with `@recursiv/sdk/privacy`). */
+    readonly privacy: PrivacyResource;
     readonly realtime: RealtimeClient;
     constructor(config?: Partial<RecursivConfig>);
     /**
@@ -218,13 +222,13 @@ export { SEARCH_SECTIONS, SearchResource } from './resources/search.js';
 export type { PublicSearchPage, PublicSearchTab, SearchAnswer, SearchGroup, SearchLadder, SearchOmitReason, SearchParams, SearchPerson, SearchPost, SearchRelated, SearchResponse, SearchSection, SearchStage, SearchStory, SearchTopic, SearchVia, } from './resources/search.js';
 export { BOOKMARK_MERGE_MAX_ITEMS, BookmarkCollectionsResource, BookmarksResource } from './resources/bookmarks.js';
 export { FEED_TOP_NETWORKS, FeedsResource } from './resources/feeds.js';
-export type { FeedStoriesParams, FeedStoriesResponse, FeedStory, FeedTopExplain, FeedTopItem, FeedTopMeta, FeedTopNetwork, FeedTopNetworkCard, FeedTopNetworkEntry, FeedTopParams, FeedTopResponse, FeedTopTarget, PublicFeedTopMeta, PublicFeedTopParams, PublicFeedTopResponse, } from './resources/feeds.js';
+export type { FeedStoriesParams, FeedStoriesResponse, FeedStory, FeedTopExplain, FeedTopItem, FeedTopMeta, FeedTopNetwork, FeedTopNetworkCard, FeedTopNetworkEntry, FeedTopNetworkMap, FeedTopParams, FeedTopResponse, FeedTopTarget, PublicFeedTopMeta, PublicFeedTopParams, PublicFeedTopResponse, } from './resources/feeds.js';
 export type { BookmarkCollection, BookmarkCollectionInput, BookmarkCollectionKind, BookmarkCollectionPatch, BookmarkCollectionsList, BookmarkCollectionTarget, BookmarkCollectionVisibility, BookmarkedPost, BookmarkInput, BookmarkItem, BookmarkKey, BookmarkKeyRow, BookmarkKeysPage, BookmarkKind, BookmarkMergeItem, BookmarkMergeResult, BookmarkProtocol, BookmarkRequestOptions, BookmarksPage, FiledBookmark, RemovedBookmarkCollection, SavedBookmark, UnfiledBookmark, UnsavedBookmark, } from './resources/bookmarks.js';
 export { AccountsResource } from './resources/accounts.js';
 export { SIGNAL_BATCH_MAX, SignalsResource } from './resources/signals.js';
 export type { SignalBatchResult, SignalEventInput, SignalEventType, SignalNotRecordedReason, SignalRecordResult, SignalSendOptions, } from './resources/signals.js';
 export { SEALED_ALLOWANCE_REMAINING_HEADER, SEALED_REFUSAL_HEADER, SealedResource, SealedTransportError, } from './resources/sealed.js';
-export type { SealedAllowance, SealedAttestationInput, SealedConfig, SealedModel, SealedSendInput, SealedTarget, SealedTargetKind, SealedTransportErrorCode, } from './resources/sealed.js';
+export type { SealedAllowance, SealedAttestationInput, SealedConfig, SealedModel, SealedPlan, SealedPurpose, SealedQuotaDetails, SealedSendInput, SealedTarget, SealedTargetKind, SealedTransportErrorCode, } from './resources/sealed.js';
 export type { SiblingAccount, SiblingAccountsResponse, SwitchAccountResult, } from './resources/accounts.js';
 export type { LinkPreview, LinkPreviewResponse, LinkPreviewSource, } from './resources/link-preview.js';
 export type { AgentCapabilityConsentRequirement, AgentCapabilityDataSensitivity, AgentCapabilityDomain, AgentCapabilityExportBoundary, AgentCapabilityRetentionClass, AgentCapabilitySubdomain, AgentCapabilitySubject, AgentCapabilityTrustTier, AgentToolAudience, AgentToolScope, BrowserUseRunTaskInput, ProjectBrainSettings, ProjectToolBundleClassification, ProjectToolBundleKey, ProjectToolPermission, ProjectToolPermissionOverrides, UpdateProjectSettingsInput, } from './resources/project-brain.js';
@@ -238,8 +242,8 @@ export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry } f
 export { BoostsResource } from './resources/boosts.js';
 export type { BoostBalance, BoostBalanceResponse, BoostCampaign, BoostCampaignResponse, BoostEventResult, BoostLedgerEntry, BoostLedgerKind, BoostPlanCredit, BoostRejectionReason, BoostReviewStatus, BoostStatus, BoostTopupCheckout, BoostTopupConfirmation, BoostTopupLimits, } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';
-export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
-export type { SocialProfile, SocialBridge, SocialSubscription, SocialSubscriptionChange, SocialProfilePage, SocialRadar, SocialRadarCluster, SocialRadarMember, SocialRadarParams, SocialRadarPosts, SocialRadarStory, SocialRadarStoryArchive, ViralBaseline, ViralItem, ViralItemFields, ViralItemSpread, ViralItemVelocity, ViralLabel, ViralMindsCard, ViralMindsItem, ViralNetwork, ViralOpenProtocol, ViralProtocol, ViralProvider, ViralReadMeta, ViralReadParams, ViralReadResponse, ViralReadStatus, ViralRef, ViralSocialItem, SocialNetwork, SocialPost, SocialConversation, SocialTrend, SocialTrendProvenance, SocialTrends, SocialTrendSourceIndex, SocialTrendFeed, SocialPopularProfiles, SocialAuthorFeed, SocialFollowingFeed, SocialFollowingSource, SearchPublicProfilesParams, SearchPublicPostsParams, SocialPostSearch, HostedProtocolConnections, HostedProtocol, HostedProtocolIdentity, HostedNostrChallenge, HostedNostrIdentityProof, NativeNostrPrepareInput, NativeNostrPrepared, NativeNostrAccount, NativeNostrPostState, NativeNostrReceipt, NativeSocialProtocol, FederationIdentity, FederationIdentityView, NativeSocialAccount, NativeSocialCallbackInput, NativeReplyPrepareInput, NativePostPrepareInput, NativeMediaInput, NativeMediaItem, NativePostBatch, NativePostQuote, NativePostHistory, NativeDelegatedPostHistoryItem, NativeNostrPostHistoryItem, NativeFollowSourceInput, NativeFollowPrepareInput, NativeFollowTarget, NativeFollowReceipt, NativeFollowState, NativeFollowAccount, NativeFollowStates, NativeFollowReview, NativeLikeSourceInput, NativeRepostSourceInput, NativeLikePrepareInput, NativeRepostPrepareInput, NativeLikeTarget, NativeRepostTarget, NativeLikeReceipt, NativeRepostReceipt, NativeLikeState, NativeRepostState, NativeLikeReview, NativeRepostReview, NativeReplyReceipt, NativeReplyBatch, NativeReplyHistory, NativeDelegatedReplyHistoryItem, NativeNostrReplyResult, NativeNostrReplyHistoryItem, NativeReplyRemovalReceipt, NativeReplyRemovalPreview, SocialSourceRef, SocialSourceControl, SocialSourceControlDisplay, SocialSourceControlChange, HostedPostPreview, ConnectHostedIdentityInput, CreateHostedIdentityInput, CreatedHostedProtocolIdentity, PreviewHostedPostInput, PublishHostedPostInput, ListProtocolCandidatesParams, ProtocolAdapterMaturity, ProtocolAdapterMetadata, ProtocolCandidateListResponse, ProtocolCandidatePageMeta, ProtocolCapabilityOperation, ProtocolCapabilityStatus, ProtocolCollectionStatus, ProtocolIngestionActivityReason, ProtocolIngestionCircuitHealth, ProtocolIngestionDeadLetterGroup, ProtocolIngestionHealthPosition, ProtocolIngestionHealthReport, ProtocolIngestionHealthRuntime, ProtocolIngestionHealthSection, ProtocolIngestionLaneActivity, ProtocolIngestionLaneCurrentJob, ProtocolIngestionLaneDeadLetters, ProtocolIngestionLaneHealth, ProtocolIngestionLaneJobs, ProtocolIngestionReplayResult, ProtocolIngestionStatus, ProtocolQuarantinedCandidate, ProtocolRefreshResult, ProtocolSettings, ProtocolSettingsUpdateResult, ReplayProtocolIngestionJobInput, UpdateSettingsInput as UpdateProtocolSettingsInput, } from './resources/protocols.js';
+export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, SOCIAL_FOLLOWING_SOURCE_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
+export type { SocialProfile, SocialBridge, SocialSubscription, SocialSubscriptionChange, SocialProfilePage, SocialRadar, SocialRadarCluster, SocialRadarMember, SocialRadarParams, SocialRadarSourceKind, SocialRadarPosts, SocialRadarStory, SocialRadarStoryArchive, ViralBaseline, ViralItem, ViralItemFields, ViralItemSpread, ViralItemVelocity, ViralLabel, ViralMindsCard, ViralMindsItem, ViralNetwork, ViralOpenProtocol, ViralProtocol, ViralProvider, ViralReadMeta, ViralReadParams, ViralReadResponse, ViralReadStatus, ViralRef, ViralSocialItem, SocialNetwork, SocialPost, SocialConversation, SocialTrend, SocialTrendProvenance, SocialTrends, SocialTrendSourceIndex, SocialTrendFeed, SocialPopularProfiles, SocialAuthorFeed, SocialFollowingFeed, SocialFollowingSource, SocialFollowingSourceStatus, SearchPublicProfilesParams, SearchPublicPostsParams, SocialPostSearch, HostedProtocolConnections, HostedProtocol, HostedProtocolIdentity, HostedNostrChallenge, HostedNostrIdentityProof, NativeNostrPrepareInput, NativeNostrPrepared, NativeNostrAccount, NativeNostrPostState, NativeNostrReceipt, NativeSocialProtocol, FederationIdentity, FederationIdentityView, NativeSocialAccount, NativeNetwork, NativeNetworkState, NativeNetworkPresence, NativeNetworkActivation, NativeNetworkOff, SetNativeNetworkInput, NativeSocialCallbackInput, NativeReplyPrepareInput, NativePostPrepareInput, NativeMediaInput, NativeMediaItem, NativePostBatch, NativePostQuote, NativePostHistory, NativeDelegatedPostHistoryItem, NativeNostrPostHistoryItem, NativeFollowSourceInput, NativeFollowPrepareInput, NativeFollowTarget, NativeFollowReceipt, NativeFollowState, NativeFollowAccount, NativeFollowStates, NativeFollowReview, NativeLikeSourceInput, NativeRepostSourceInput, NativeLikePrepareInput, NativeRepostPrepareInput, NativeLikeTarget, NativeRepostTarget, NativeLikeReceipt, NativeRepostReceipt, NativeLikeState, NativeRepostState, NativeLikeReview, NativeRepostReview, NativeReplyReceipt, NativeReplyBatch, NativeReplyHistory, NativeDelegatedReplyHistoryItem, NativeNostrReplyResult, NativeNostrReplyHistoryItem, NativeReplyRemovalReceipt, NativeReplyRemovalPreview, SocialSourceRef, SocialSourceControl, SocialSourceControlDisplay, SocialSourceControlChange, HostedPostPreview, ConnectHostedIdentityInput, CreateHostedIdentityInput, CreatedHostedProtocolIdentity, PreviewHostedPostInput, PublishHostedPostInput, ListProtocolCandidatesParams, ProtocolAdapterMaturity, ProtocolAdapterMetadata, ProtocolCandidateListResponse, ProtocolCandidatePageMeta, ProtocolCapabilityOperation, ProtocolCapabilityStatus, ProtocolCollectionStatus, ProtocolIngestionActivityReason, ProtocolIngestionCircuitHealth, ProtocolIngestionDeadLetterGroup, ProtocolIngestionHealthPosition, ProtocolIngestionHealthReport, ProtocolIngestionHealthRuntime, ProtocolIngestionHealthSection, ProtocolIngestionLaneActivity, ProtocolIngestionLaneCurrentJob, ProtocolIngestionLaneDeadLetters, ProtocolIngestionLaneHealth, ProtocolIngestionLaneJobs, ProtocolIngestionReplayResult, ProtocolIngestionStatus, ProtocolQuarantinedCandidate, ProtocolRefreshResult, ProtocolSettings, ProtocolSettingsUpdateResult, ReplayProtocolIngestionJobInput, UpdateSettingsInput as UpdateProtocolSettingsInput, } from './resources/protocols.js';
 export { InboxResource } from './resources/inbox.js';
 export { NetworkResource } from './resources/network.js';
 export { SimulatorResource } from './resources/simulator.js';
@@ -273,3 +277,5 @@ export type { PrepareHostedServiceInput, HostedServiceScope, HostedServiceOperat
 export { ASSISTANT_SURFACE_IDS, assistantSurfaceOn, assistantSurfaces, isAssistantSurfaceId, } from './assistant-surfaces.js';
 export type { AssistantSettings, AssistantSettingsUpdate, AssistantSurfaceId, AssistantSurfaces, } from './assistant-surfaces.js';
 export type { CurrentUser } from './resources/users.js';
+export { PrivacyResource } from './resources/privacy.js';
+export type { LiveFactOptions, PrivacyCapabilities } from './privacy/index.js';

package/dist/index.js

@@ -2,6 +2,7 @@ export * from './resources/discovery-learning.js';
 import { DiscoveryResource } from './resources/discovery.js';
 export * from './resources/discovery.js';
 export * from './feed-definition.js';
+export * from './social-protocol-ids.js';
 import { HttpClient } from './client.js';
 import { AuthResource } from './resources/auth.js';
 import { PostsResource } from './resources/posts.js';
@@ -68,6 +69,7 @@ import { FeedsResource } from './resources/feeds.js';
 import { AccountsResource } from './resources/accounts.js';
 import { SignalsResource } from './resources/signals.js';
 import { SealedResource } from './resources/sealed.js';
+import { PrivacyResource } from './resources/privacy.js';
 import { RealtimeClient } from './realtime.js';
 export class Recursiv {
     /** Shared transport, kept so the client name can be set after construction. */
@@ -145,6 +147,8 @@ export class Recursiv {
     signals;
     /** Sealed mode's config and transport: targets, models, allowance, the attestation relay and the sealed send (no crypto; flag-gated). */
     sealed;
+    /** Which platform privacy facts the deployed API's build enforces (pair with `@recursiv/sdk/privacy`). */
+    privacy;
     realtime;
     constructor(config) {
         const client = new HttpClient(config);
@@ -214,6 +218,7 @@ export class Recursiv {
         this.accounts = new AccountsResource(client);
         this.signals = new SignalsResource(client);
         this.sealed = new SealedResource(client);
+        this.privacy = new PrivacyResource(client);
         this.realtime = new RealtimeClient(client);
         this.#http = client;
     }
@@ -283,7 +288,7 @@ export { UploadsResource } from './resources/uploads.js';
 export { WalletResource } from './resources/wallet.js';
 export { BoostsResource } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';
-export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
+export { PROTOCOL_ADAPTER_MATURITIES, PROTOCOL_CAPABILITY_OPERATIONS, PROTOCOL_CAPABILITY_STATUSES, SOCIAL_FOLLOWING_SOURCE_STATUSES, viralItemHasVideo, } from './resources/protocols.js';
 export { InboxResource } from './resources/inbox.js';
 export { NetworkResource } from './resources/network.js';
 export { SimulatorResource } from './resources/simulator.js';
@@ -303,3 +308,4 @@ export { RecursivError, AuthenticationError, AuthorizationError, LegacyHandoffEr
 export { parseSSE } from './lib/sse.js';
 export * from './lib/webhooks.js';
 export { ASSISTANT_SURFACE_IDS, assistantSurfaceOn, assistantSurfaces, isAssistantSurfaceId, } from './assistant-surfaces.js';
+export { PrivacyResource } from './resources/privacy.js';

package/dist/privacy/facts.generated.d.ts

@@ -0,0 +1,79 @@
+export declare const PRIVACY_REGISTRY_VERSION: 0;
+export declare const PRIVACY_FACTS: readonly [{
+    readonly id: "agents.tool_mode.chat_only";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "web_tools";
+    readonly step: "S5";
+    readonly says: "An agent in chat_only tool mode is given no tools, so it opens no web page.";
+}, {
+    readonly id: "agents.turn_stamp";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: null;
+    readonly step: "S7";
+    readonly says: "Every reply a model writes in an agent chat through the platform's agent turn records, in metadata.ai, the model, its maker and the route, a model swapped in and whether for usage limits or after a failure, and the tools it called.";
+}, {
+    readonly id: "agents.personal_context_sections";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "activity";
+    readonly step: "S26";
+    readonly says: "A personal agent's turn carries no follows, upvotes, groups or views of the member unless the member turned that part of their activity on.";
+}, {
+    readonly id: "sealed.attest_before_send";
+    readonly status: "enforced";
+    readonly enforcement: "device";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The phone seals a Sealed request only to the key of a router it checked against a fresh challenge of its own: the router's report, signed by its AMD hardware, must answer that challenge with debug mode off and firmware at or above a floor, and its software must be a release Tinfoil signed and listed in a public log. If any check fails there is no key to seal to, so nothing is sealed or sent. How long a checked router is used before it is checked again is up to the app.";
+}, {
+    readonly id: "sealed.attest_second_signer";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The phone also requires Recursiv's own signature over the router's release, so a release Tinfoil signed alone is refused.";
+}, {
+    readonly id: "sealed.no_standard_fallback";
+    readonly status: "enforced";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The SDK sends a Sealed request only to the Sealed route, marked Sealed, and only once: a refusal, an error or an answer that is not sealed goes back to the app, and the SDK never sends the request again, to Sealed or to any other route.";
+}, {
+    readonly id: "sealed.gateway_opaque";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The Sealed gateway passes each Sealed request and answer on as bytes it does not read: it never parses, stores or logs a request or answer body. It refuses a request that carries no EHBP encapsulated key, the mark of a sealed body, and a success answer that carries no well-formed EHBP response nonce, the mark of a sealed answer; it cannot tell from the bytes themselves whether a body is sealed.";
+}, {
+    readonly id: "sealed.dest_tinfoil_only";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The Sealed gateway sends Sealed requests, and asks for attestation documents, only to the router origins its configuration lists, named exactly, and it lists only https origins of Tinfoil router hosts (inference.tinfoil.sh or router-N.tinfoil.sh). It refuses any other server a client names and follows no redirect.";
+}, {
+    readonly id: "sealed.no_server_history";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "The platform keeps no Sealed chat history: no Sealed route writes a conversation or message row, and the gateway stores no request or answer body.";
+}, {
+    readonly id: "sealed.backup_excluded";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Sealed chats saved on a phone are left out of the phone's backups.";
+}, {
+    readonly id: "sealed.no_push";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.";
+}];