@recursiv/sdk 0.7.93 → 0.7.104

package/README.md

@@ -114,12 +114,13 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | `r.billing` | Usage tracking, subscriptions, checkout |
 | `r.appSubscriptions` | Consumer app plans: `checkout`, `status`, `createPortalSession`, `previewTierChange`, `changeTier` |
 | `r.boosts` | Promoted posts: `create`, `mine`, `balance`, `pause`, `resume`, `cancel`, `recordEvent`, `topup`, `confirmTopup`; admin `listPendingReview`, `review`, `grant` |
-| `r.wallet` | Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`) |
+| `r.wallet` | Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`), a wallet the member holds linked by signature (`createLinkNonce`, `linkWallet`, `listLinkedWallets`, `unlinkWallet`), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`) |
 | `r.notifications` | Notification stream (`list`, `unreadCount`, `markAsRead`, `archive`, `markAllAsRead`; `category: 'mentions'` for mentions and replies only, 0.7.72) and push tokens |
 | `r.github` | GitHub integration |
 | `r.integrations` | External service connections |
 | `r.admin` | User management, stats, content reports (`listReports`, `resolveReport`, `dismissReport`) |
 | `r.moderation` | Moderation actions: `publicLog`, `mine`, `appeal`; staff `apply`, `resolveAppeal`, `list({ target_type?, target_id? })` (one target's recorded actions, newest first, at most 100; none named = the network's latest; 0.7.74) and `reverse(actionId)` (sent once: a repeat answers 404 `action_not_found`; 0.7.74); agent grants `listAgentGrants`, `grantAgent`, `revokeAgent` |
+| `r.trust` | The signed trust log (0.7.96; 404 until the operator turns on `TRUST_LOG_PUBLIC_READS`): keyless `keys()` (every key that ever signed it), `mine({ before?, limit? })` (`users:read`: the caller's own signed events with the server's check `verified`). `r.moderation.publicLog` then carries `trust_log` on each action (`status`, and where the signed decision and reversal sit: `chain`, `seq`, `key_id`, `occurred_at`, `verified`). No read carries a hash or a signature |
 | `r.dispatcher` | Task queue, claims, signals, outcomes, webhooks |
 | `r.goals` | Org goals with task rollups (group dispatcher tasks) |
 | `r.linkPreview` | `get(url)` — a public link's Open Graph card (`data: null` when it has none). For a chat link pass `{ messageId }` or `{ conversationId }` on a signed-in key with `chat:read`: the link is fetched only when it is in the named message and a person wrote that message, or the caller wrote it in that conversation, else `refused: 'ai_link'`. A source with no id rejects (`ValidationError`). Not in encrypted chats: the server cannot read them, so leave `source` out there and apply the app's own rule |

package/dist/assistant/subjectBundle.js

@@ -9,10 +9,10 @@
  * - posts under a child-safety hold, and posts a moderator turned the assistant off for, are left out, whoever asks;
  * - a post the server's per-viewer verdict (`assist_readable`) says is not readable is left out, whoever asks;
  * - pictures go as alt text and the stored caption only: never bytes, never an address (held media not even that). A
- *   picture keeps its plain id, and Minds' last child-safety check time (`checked_at`) when its input says `held` is
- *   exactly `false` (2.1: "checked within the last 24 hours and not held"), so a renderer given the caller's image
- *   cache may attach one on the asked-about post, parent or quote (never a reply's) as a picture while that check is
- *   under 24 hours old (renderBundleForModel);
+ *   picture keeps its plain id, and the time it last passed Minds' current checks (`checked_at`) when its input says
+ *   `held` is exactly `false` (2.1: "checked within the last 24 hours and not held"; GET /posts sends both together,
+ *   recursiv#5012), so a renderer given the caller's image cache may attach one on the asked-about post, parent or
+ *   quote (never a reply's) as a picture while that check is under 24 hours old (renderBundleForModel);
  * - every string loses what a reader cannot see (stripHiddenText) and is cut to its limit, and the bundle has a total
  *   that the asked-about post is cut to fit as well.
  *

package/dist/assistant/types.d.ts

@@ -54,9 +54,9 @@ export interface SubjectMediaInput {
      */
     id?: string | null;
     /**
-     * When Minds last matched this picture against the child-safety hash lists (the post payload's `media[].checked_at`,
-     * sealed-full-scope-v1 2.1, gate P1): an ISO time with its zone, written only by the server. Kept only when `held`
-     * is exactly `false`. A picture can go to a model as a picture only while this is under 24 hours old by the
+     * When the picture last passed Minds' current checks (the post payload's `media[].checked_at`, sent with `held:
+     * false`, sealed-full-scope-v1 2.1): an ISO time with its zone, written only by the server. Under Bill's 2026-10-11
+     * departure from gate P1 no hash-bank check is among them (recursiv#5012). Kept only when `held` is exactly `false`. A picture can go to a model as a picture only while this is under 24 hours old by the
      * renderer's clock; absent, not an ISO time with its zone, or without `held: false`, means alt text and the stored
      * caption only, as for every other picture.
      */

package/dist/index.d.ts

@@ -60,6 +60,7 @@ import { JobsResource } from './resources/jobs.js';
 import { CuratorResource } from './resources/curator.js';
 import { ReportsResource } from './resources/reports.js';
 import { ModerationResource } from './resources/moderation.js';
+import { TrustResource } from './resources/trust.js';
 import { JudgmentsResource } from './resources/judgments.js';
 import { LinkPreviewResource } from './resources/link-preview.js';
 import { SearchResource } from './resources/search.js';
@@ -134,6 +135,8 @@ export declare class Recursiv {
     readonly boosts: BoostsResource;
     readonly reports: ReportsResource;
     readonly moderation: ModerationResource;
+    /** The signed trust log: its public keys, and the member's own signed events (0.7.96). */
+    readonly trust: TrustResource;
     /** Jev's labels of a post: read them, dispute or appeal one, and (staff) review a dispute. */
     readonly judgments: JudgmentsResource;
     readonly linkPreview: LinkPreviewResource;
@@ -216,7 +219,9 @@ export type { ReportTargetType, ReportStatus, CreateReportInput, ReportRecord, R
 export { JudgmentsResource, isJudgmentSharedWordsError } from './resources/judgments.js';
 export type { JudgmentSubjectKind, JudgmentSource, JudgmentOverrideMethod, PostLabelsStatus, PostLabelsQuery, PostLabelsSubject, PostLabelsCategory, PostLabelsPolitics, PostJudgmentRecord, PostJudgment, PostSafetyAttribution, PostLabelsCategoryView, PostLabelsSummaryView, PostLabelsFullView, PostLabels, DisputeJudgmentInput, JudgmentDispute, ReviewJudgmentInput, JudgmentReviewUpheld, JudgmentReviewAwaitingReviewer, JudgmentReviewOverridden, JudgmentReview, JudgmentSharedWordsDetails, JudgmentSharedWordsError, } from './resources/judgments.js';
 export { ModerationResource } from './resources/moderation.js';
-export type { ModerationTargetType, ModerationActionType, ModerationAppealStatus, ModerationPrinciple, PublicModerationAction, PublicModerationLog, OwnModerationAppeal, OwnModerationAction, OwnModerationLog, ApplyModerationActionInput, ModerationAction, ListModerationActionsParams, RecordedModerationTargetType, AgentModerationMode, AgentModerationGrant, } from './resources/moderation.js';
+export type { ModerationTargetType, ModerationActionType, ModerationAppealStatus, ModerationPrinciple, PublicModerationAction, PublicModerationLog, OwnModerationAppeal, OwnModerationAction, OwnModerationLog, ApplyModerationActionInput, ModerationAction, ListModerationActionsParams, RecordedModerationTargetType, AgentModerationMode, AgentModerationGrant, ModerationTrustStatus, ModerationTrustLog, ModerationTrustWindow, } from './resources/moderation.js';
+export { TrustResource } from './resources/trust.js';
+export type { TrustEnvelope, OwnTrustEvent, TrustPublicKey, OwnTrustEvents } from './resources/trust.js';
 export { LinkPreviewResource } from './resources/link-preview.js';
 export { SEARCH_SECTIONS, SearchResource } from './resources/search.js';
 export type { PublicSearchPage, PublicSearchTab, SearchAnswer, SearchGroup, SearchLadder, SearchOmitReason, SearchParams, SearchPerson, SearchPost, SearchRelated, SearchResponse, SearchSection, SearchStage, SearchStory, SearchTopic, SearchVia, } from './resources/search.js';
@@ -238,7 +243,7 @@ export { OrganizationSecurityResource } from './resources/organization-security.
 export { UploadsResource } from './resources/uploads.js';
 export type { UploadMediaInput, UploadUrlInput, UploadUrlResult } from './resources/uploads.js';
 export { WalletResource } from './resources/wallet.js';
-export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry } from './resources/wallet.js';
+export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry, WalletLink, WalletLinkNonce } from './resources/wallet.js';
 export { BoostsResource } from './resources/boosts.js';
 export type { BoostBalance, BoostBalanceResponse, BoostCampaign, BoostCampaignResponse, BoostEventResult, BoostLedgerEntry, BoostLedgerKind, BoostPlanCredit, BoostRejectionReason, BoostReviewStatus, BoostStatus, BoostTopupCheckout, BoostTopupConfirmation, BoostTopupLimits, } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';

package/dist/index.js

@@ -61,6 +61,7 @@ import { JobsResource } from './resources/jobs.js';
 import { CuratorResource } from './resources/curator.js';
 import { ReportsResource } from './resources/reports.js';
 import { ModerationResource } from './resources/moderation.js';
+import { TrustResource } from './resources/trust.js';
 import { JudgmentsResource } from './resources/judgments.js';
 import { LinkPreviewResource } from './resources/link-preview.js';
 import { SearchResource } from './resources/search.js';
@@ -135,6 +136,8 @@ export class Recursiv {
     boosts;
     reports;
     moderation;
+    /** The signed trust log: its public keys, and the member's own signed events (0.7.96). */
+    trust;
     /** Jev's labels of a post: read them, dispute or appeal one, and (staff) review a dispute. */
     judgments;
     linkPreview;
@@ -211,6 +214,7 @@ export class Recursiv {
         this.boosts = new BoostsResource(client);
         this.reports = new ReportsResource(client);
         this.moderation = new ModerationResource(client);
+        this.trust = new TrustResource(client);
         this.judgments = new JudgmentsResource(client);
         this.linkPreview = new LinkPreviewResource(client);
         this.search = new SearchResource(client);
@@ -274,6 +278,7 @@ export { STORY_POOL_MAX_POSTS, STORY_POST_NETWORKS, STORY_POSTS_PAGE_MAX } from
 export { ReportsResource } from './resources/reports.js';
 export { JudgmentsResource, isJudgmentSharedWordsError } from './resources/judgments.js';
 export { ModerationResource } from './resources/moderation.js';
+export { TrustResource } from './resources/trust.js';
 export { LinkPreviewResource } from './resources/link-preview.js';
 export { SEARCH_SECTIONS, SearchResource } from './resources/search.js';
 export { BOOKMARK_MERGE_MAX_ITEMS, BookmarkCollectionsResource, BookmarksResource } from './resources/bookmarks.js';

package/dist/privacy/facts.generated.d.ts

@@ -76,4 +76,235 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly capability: "chat_tier";
     readonly step: "S29";
     readonly says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.";
+}, {
+    readonly id: "ai_prefs.agent_enabled";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "agent_enabled";
+    readonly step: "S9";
+    readonly says: "When a member turns their personal agent off, their turns to it make no provider call, it is not created again at sign-in, its chat leaves their conversation list and it sends them no push.";
+}, {
+    readonly id: "ai_prefs.standard_allowed";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "standard_allowed";
+    readonly step: "S28";
+    readonly says: "When a member turns Standard AI off, no agent makes a call through OpenRouter or a model maker for a turn they send.";
+}, {
+    readonly id: "ai_prefs.memory_facts";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_facts";
+    readonly step: "S11";
+    readonly says: "When a member turns memory off, no agent in the app saves new facts about them, and saved facts are not sent with their turns.";
+}, {
+    readonly id: "ai_prefs.memory_recall";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_recall";
+    readonly step: "S11";
+    readonly says: "When a member turns off using their other chats, a turn carries only that chat's own messages and, while memory is on, saved facts.";
+}, {
+    readonly id: "ai_prefs.memory_summaries";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_summaries";
+    readonly step: "S11";
+    readonly says: "When a member turns summaries off, no summary call is made for their chats.";
+}, {
+    readonly id: "ai_prefs.chat_memory";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "chat_memory";
+    readonly step: "S13";
+    readonly says: "When memory is off for one chat or one turn, nothing from it is saved to memory or used in other chats, and saved facts are not sent from it.";
+}, {
+    readonly id: "ai_prefs.activity";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "activity";
+    readonly step: "S26";
+    readonly says: "Who a member follows, what they upvoted, their groups and their interests go with a turn only for the parts they ticked, and only once they decided.";
+}, {
+    readonly id: "ai_prefs.feed_from_questions";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "feed_from_questions";
+    readonly step: "S26";
+    readonly says: "Asking an agent about a post is stored as a feed signal only when the member turned that on, and only the post id is stored, never the question.";
+}, {
+    readonly id: "ai_prefs.push_preview";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "push_preview";
+    readonly step: "S16";
+    readonly says: "A push for a message an AI agent sends in a chat carries the agent's name and none of the message's words, unless the member turned the preview on; a push whose sender cannot be read carries none of its words either.";
+}, {
+    readonly id: "ai_prefs.standard_history_days";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "standard_history_days";
+    readonly step: "S24";
+    readonly says: "When a member picks 7 or 30 days, a daily job deletes their one-on-one agent chats older than that, with the chats' summaries and usage copies; billing rows without content stay.";
+}, {
+    readonly id: "notifications.ai_message";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "push_ai_replies";
+    readonly step: "S16";
+    readonly says: "Pushes for agent replies have their own setting, separate from messages from people, and start from the member's Messages push setting.";
+}, {
+    readonly id: "reports.ai_review_filter";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "report_ai_review";
+    readonly step: "S20";
+    readonly says: "An agent's key cannot list, resolve or dismiss a report whose reporter turned AI review off.";
+}, {
+    readonly id: "posts.ai_ask_allowed";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "allow_ask_on_my_posts";
+    readonly step: "S22";
+    readonly says: "When an author turns asks off, agents do not read their posts from links, and each post carries ai_ask_allowed false so apps hide the ask option.";
+}, {
+    readonly id: "posts.public_posts_ai";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "public_posts_ai";
+    readonly step: "S22";
+    readonly says: "When an author turns it off, their public posts are not embedded, topic or leaning labelled, or picked for editions, and existing vectors and those labels are removed; safety labels still run.";
+}, {
+    readonly id: "openrouter.deny_all_paths";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: null;
+    readonly step: "S4";
+    readonly says: "Every OpenRouter request, on the direct, fallback and summary paths, asks for providers whose stated policy is not to collect data (data_collection: deny). That is their policy; it is not checked.";
+}, {
+    readonly id: "account.export_ai";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_manage";
+    readonly step: "S18";
+    readonly says: "The account download includes the member's agent chats, the agents' replies, what agents saved about them and their agent's settings.";
+}, {
+    readonly id: "account.delete_personal_agent";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: null;
+    readonly step: "S18";
+    readonly says: "Deleting an account deletes the member's personal agent, its instructions, its saved preferences and its decision rows.";
+}, {
+    readonly id: "sealed.guard_checks_every_turn";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Every Sealed message and every Sealed answer goes through the sealed text check (gpt-oss-safeguard-120b) before it is sent or shown; with no check, nothing is sent.";
+}, {
+    readonly id: "sealed.picture_checked_on_phone";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Every phone picture added to a Sealed chat passes the on-phone nudity check first; one it flags stays on the phone unless the member is a known adult whose adult setting is on, in a build that applies the adult policy.";
+}, {
+    readonly id: "sealed.picture_check_block_only";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The sealed picture check (gemma4-31b) sees the picture alone, before anything else of the turn is sent, and only blocks: no report, flag or verdict reaches Minds. The gateway sees only that a check request was made, and counts it in the day's checks.";
+}, {
+    readonly id: "sealed.post_picture_server_checked";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "A post picture goes into a Sealed chat only once the server's current checks have cleared it, and never while it or its post is held or under a child-safety report; no hash-bank match is claimed.";
+}, {
+    readonly id: "sealed.search_via_tinfoil_to_exa";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "Sealed search runs only through Tinfoil's search, which sends the search words and page addresses to Exa, and nothing of the member's account or IP address.";
+}, {
+    readonly id: "sealed.search_filters_in_body";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "The phone sets the PII and injection filters in the sealed body of every message that searches, and never a location; a search with no filter marker turns search off for the chat.";
+}, {
+    readonly id: "sealed.memory_on_phone_only";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Sealed memory and About you live only in the phone's no-backup store, under the account, never on Minds.";
+}, {
+    readonly id: "sealed.memory_not_with_search_temporary_or_standard";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Sealed memory and About you never go with a message that searches, a temporary chat or a Standard turn, and memory tags in answers to messages that carry someone else's words are ignored.";
+}, {
+    readonly id: "sealed.signout_clears_phone";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Signing out clears the account's Sealed chats, pictures, memory and About you from the phone, after a warning.";
+}, {
+    readonly id: "sealed.adult_setting_web_known_adult";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: null;
+    readonly step: "S29";
+    readonly says: "The adult setting (D17) changes only on the web, only a member Minds knows is 18 or over can turn it on, and the phone only reads it.";
+}, {
+    readonly id: "sealed.search_question_only";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "A Sealed message that searches carries only the question: no earlier message, memory, About you or phone picture.";
+}, {
+    readonly id: "sealed.search_off_with_others_content";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "A Sealed message that carries someone else's words (a post, a members-only post, or messages from any chat) does not search.";
+}, {
+    readonly id: "sealed.search_shown_as_sent";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "The search words shown are the words Exa got (the filter's redacted query), and each page opened is shown with its full address.";
+}, {
+    readonly id: "sealed.temporary_not_saved";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "A temporary Sealed chat writes nothing to the phone: no history, picture or memory.";
+}, {
+    readonly id: "sealed.services_from_path";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "'Other services this chat used' is computed from the path the chat's turns took.";
+}, {
+    readonly id: "sealed.export_to_phone_only";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Exporting a Sealed chat writes a file on the phone and sends nothing.";
 }];

package/dist/privacy/facts.generated.js

@@ -90,4 +90,268 @@ export const PRIVACY_FACTS = [
         step: "S29",
         says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.",
     },
+    {
+        id: "ai_prefs.agent_enabled",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "agent_enabled",
+        step: "S9",
+        says: "When a member turns their personal agent off, their turns to it make no provider call, it is not created again at sign-in, its chat leaves their conversation list and it sends them no push.",
+    },
+    {
+        id: "ai_prefs.standard_allowed",
+        status: "planned",
+        enforcement: "server",
+        capability: "standard_allowed",
+        step: "S28",
+        says: "When a member turns Standard AI off, no agent makes a call through OpenRouter or a model maker for a turn they send.",
+    },
+    {
+        id: "ai_prefs.memory_facts",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_facts",
+        step: "S11",
+        says: "When a member turns memory off, no agent in the app saves new facts about them, and saved facts are not sent with their turns.",
+    },
+    {
+        id: "ai_prefs.memory_recall",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_recall",
+        step: "S11",
+        says: "When a member turns off using their other chats, a turn carries only that chat's own messages and, while memory is on, saved facts.",
+    },
+    {
+        id: "ai_prefs.memory_summaries",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_summaries",
+        step: "S11",
+        says: "When a member turns summaries off, no summary call is made for their chats.",
+    },
+    {
+        id: "ai_prefs.chat_memory",
+        status: "planned",
+        enforcement: "server",
+        capability: "chat_memory",
+        step: "S13",
+        says: "When memory is off for one chat or one turn, nothing from it is saved to memory or used in other chats, and saved facts are not sent from it.",
+    },
+    {
+        id: "ai_prefs.activity",
+        status: "planned",
+        enforcement: "server",
+        capability: "activity",
+        step: "S26",
+        says: "Who a member follows, what they upvoted, their groups and their interests go with a turn only for the parts they ticked, and only once they decided.",
+    },
+    {
+        id: "ai_prefs.feed_from_questions",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "feed_from_questions",
+        step: "S26",
+        says: "Asking an agent about a post is stored as a feed signal only when the member turned that on, and only the post id is stored, never the question.",
+    },
+    {
+        id: "ai_prefs.push_preview",
+        status: "enforced",
+        enforcement: "server",
+        capability: "push_preview",
+        step: "S16",
+        says: "A push for a message an AI agent sends in a chat carries the agent's name and none of the message's words, unless the member turned the preview on; a push whose sender cannot be read carries none of its words either.",
+    },
+    {
+        id: "ai_prefs.standard_history_days",
+        status: "planned",
+        enforcement: "server",
+        capability: "standard_history_days",
+        step: "S24",
+        says: "When a member picks 7 or 30 days, a daily job deletes their one-on-one agent chats older than that, with the chats' summaries and usage copies; billing rows without content stay.",
+    },
+    {
+        id: "notifications.ai_message",
+        status: "planned",
+        enforcement: "server",
+        capability: "push_ai_replies",
+        step: "S16",
+        says: "Pushes for agent replies have their own setting, separate from messages from people, and start from the member's Messages push setting.",
+    },
+    {
+        id: "reports.ai_review_filter",
+        status: "planned",
+        enforcement: "server",
+        capability: "report_ai_review",
+        step: "S20",
+        says: "An agent's key cannot list, resolve or dismiss a report whose reporter turned AI review off.",
+    },
+    {
+        id: "posts.ai_ask_allowed",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "allow_ask_on_my_posts",
+        step: "S22",
+        says: "When an author turns asks off, agents do not read their posts from links, and each post carries ai_ask_allowed false so apps hide the ask option.",
+    },
+    {
+        id: "posts.public_posts_ai",
+        status: "planned",
+        enforcement: "server",
+        capability: "public_posts_ai",
+        step: "S22",
+        says: "When an author turns it off, their public posts are not embedded, topic or leaning labelled, or picked for editions, and existing vectors and those labels are removed; safety labels still run.",
+    },
+    {
+        id: "openrouter.deny_all_paths",
+        status: "planned",
+        enforcement: "server",
+        capability: null,
+        step: "S4",
+        says: "Every OpenRouter request, on the direct, fallback and summary paths, asks for providers whose stated policy is not to collect data (data_collection: deny). That is their policy; it is not checked.",
+    },
+    {
+        id: "account.export_ai",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_manage",
+        step: "S18",
+        says: "The account download includes the member's agent chats, the agents' replies, what agents saved about them and their agent's settings.",
+    },
+    {
+        id: "account.delete_personal_agent",
+        status: "planned",
+        enforcement: "server",
+        capability: null,
+        step: "S18",
+        says: "Deleting an account deletes the member's personal agent, its instructions, its saved preferences and its decision rows.",
+    },
+    {
+        id: "sealed.guard_checks_every_turn",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Every Sealed message and every Sealed answer goes through the sealed text check (gpt-oss-safeguard-120b) before it is sent or shown; with no check, nothing is sent.",
+    },
+    {
+        id: "sealed.picture_checked_on_phone",
+        status: "planned",
+        enforcement: "device",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Every phone picture added to a Sealed chat passes the on-phone nudity check first; one it flags stays on the phone unless the member is a known adult whose adult setting is on, in a build that applies the adult policy.",
+    },
+    {
+        id: "sealed.picture_check_block_only",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The sealed picture check (gemma4-31b) sees the picture alone, before anything else of the turn is sent, and only blocks: no report, flag or verdict reaches Minds. The gateway sees only that a check request was made, and counts it in the day's checks.",
+    },
+    {
+        id: "sealed.post_picture_server_checked",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "A post picture goes into a Sealed chat only once the server's current checks have cleared it, and never while it or its post is held or under a child-safety report; no hash-bank match is claimed.",
+    },
+    {
+        id: "sealed.search_via_tinfoil_to_exa",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "Sealed search runs only through Tinfoil's search, which sends the search words and page addresses to Exa, and nothing of the member's account or IP address.",
+    },
+    {
+        id: "sealed.search_filters_in_body",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "The phone sets the PII and injection filters in the sealed body of every message that searches, and never a location; a search with no filter marker turns search off for the chat.",
+    },
+    {
+        id: "sealed.memory_on_phone_only",
+        status: "planned",
+        enforcement: "device",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Sealed memory and About you live only in the phone's no-backup store, under the account, never on Minds.",
+    },
+    {
+        id: "sealed.memory_not_with_search_temporary_or_standard",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Sealed memory and About you never go with a message that searches, a temporary chat or a Standard turn, and memory tags in answers to messages that carry someone else's words are ignored.",
+    },
+    {
+        id: "sealed.signout_clears_phone",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Signing out clears the account's Sealed chats, pictures, memory and About you from the phone, after a warning.",
+    },
+    {
+        id: "sealed.adult_setting_web_known_adult",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: null,
+        step: "S29",
+        says: "The adult setting (D17) changes only on the web, only a member Minds knows is 18 or over can turn it on, and the phone only reads it.",
+    },
+    {
+        id: "sealed.search_question_only",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "A Sealed message that searches carries only the question: no earlier message, memory, About you or phone picture.",
+    },
+    {
+        id: "sealed.search_off_with_others_content",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "A Sealed message that carries someone else's words (a post, a members-only post, or messages from any chat) does not search.",
+    },
+    {
+        id: "sealed.search_shown_as_sent",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "The search words shown are the words Exa got (the filter's redacted query), and each page opened is shown with its full address.",
+    },
+    {
+        id: "sealed.temporary_not_saved",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "A temporary Sealed chat writes nothing to the phone: no history, picture or memory.",
+    },
+    {
+        id: "sealed.services_from_path",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "'Other services this chat used' is computed from the path the chat's turns took.",
+    },
+    {
+        id: "sealed.export_to_phone_only",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Exporting a Sealed chat writes a file on the phone and sends nothing.",
+    },
 ];

package/dist/resources/moderation.d.ts

@@ -1,5 +1,6 @@
 import type { HttpClient } from '../client.js';
 import type { SingleResponse } from '../types.js';
+import type { TrustEnvelope } from './trust.js';
 export type ModerationTargetType = 'post' | 'user' | 'message' | 'community' | 'agent' | 'source_actor' | 'source_post';
 export type ModerationActionType = 'down_rank' | 'label' | 'remove' | 'suspend' | 'ban';
 export type ModerationAppealStatus = 'none' | 'pending' | 'upheld' | 'overturned';
@@ -8,9 +9,30 @@ export interface ModerationPrinciple {
     title: string;
     summary: string;
 }
+/**
+ * Whether a decision is in the signed trust log, by the server's check (0.7.96): `verified` (signed, and its signature,
+ * hash and link to the event before it hold), `unverified` (signed, and one of those does not), `unsigned` (decided
+ * before the log was written, or not signed yet), `unavailable` (the log could not be read just now).
+ */
+export type ModerationTrustStatus = 'verified' | 'unverified' | 'unsigned' | 'unavailable';
+/** One decision's signed envelopes: where they sit in the chain and what signed them, never the moderator, the subject or a hash. */
+export interface ModerationTrustLog {
+    status: ModerationTrustStatus;
+    decision: TrustEnvelope | null;
+    reversal: TrustEnvelope | null;
+}
+/** The page as a whole: unverified if any action is, verified if any is signed, else unsigned. */
+export interface ModerationTrustWindow {
+    status: ModerationTrustStatus;
+    verified: number;
+    unverified: number;
+    unsigned: number;
+}
 export interface PublicModerationAction {
     id: string;
     target_type: ModerationTargetType;
+    /** One sentence: what kind of thing was acted on and how, never which one. */
+    description?: string;
     action: ModerationActionType;
     policy: string | null;
     actor_type: 'human' | 'ai' | 'system';
@@ -18,6 +40,8 @@ export interface PublicModerationAction {
     reversed_at: string | null;
     created_at: string;
     appeal_status: ModerationAppealStatus;
+    /** Present once the operator turns on the signed log's reads (TRUST_LOG_PUBLIC_READS); absent before. */
+    trust_log?: ModerationTrustLog;
 }
 export interface PublicModerationLog {
     principles: ModerationPrinciple[];
@@ -27,6 +51,8 @@ export interface PublicModerationLog {
         offset: number;
         has_more: boolean;
     };
+    /** Present once the operator turns on the signed log's reads; absent before. */
+    trust_log?: ModerationTrustWindow;
 }
 export interface OwnModerationAppeal {
     id: string;

package/dist/resources/trust.d.ts

@@ -0,0 +1,85 @@
+import type { HttpClient } from '../client.js';
+import type { SingleResponse } from '../types.js';
+/**
+ * Where one event sits in the signed trust log, which key signed it, and whether the server's check of it holds
+ * (0.7.96). The public moderation log carries one per signed decision and reversal (`PublicModerationAction.trust_log`):
+ * never the moderator, the subject or the payload, and never a hash or a signature. The log's v1 encoding signs the
+ * moderator and the subject unsalted, so a published hash or signature would let anyone test guesses of who acted on
+ * what; `verified` is the server's verdict, not something a client re-checks.
+ */
+export interface TrustEnvelope {
+    /** The chain the event is on: the network's id. */
+    chain: string;
+    seq: number;
+    key_id: string;
+    algorithm: 'ed25519';
+    occurred_at: string;
+    /** The server's own check: the signature, the hash, and the link to the event before it. */
+    verified: boolean;
+}
+/** One of the caller's own events: what they did, where it sits in the log, and the server's check of it. */
+export interface OwnTrustEvent extends TrustEnvelope {
+    id: number;
+    network_id: string;
+    project_id: string | null;
+    /** e.g. `follow`, `unfollow`, `block`, `mute`, `hide`, `appeal`, `moderation_action` (a moderator's own decision). */
+    kind: string;
+    actor: {
+        kind: 'user' | 'agent' | 'system';
+        user_id: string | null;
+        principal_id: string | null;
+    };
+    subject: {
+        kind: string;
+        id: string | null;
+        key: string | null;
+        principal_id: string | null;
+    };
+    payload: Record<string, unknown>;
+}
+/** A public key that signed the log. A retired or compromised key still verifies what it signed before that instant. */
+export interface TrustPublicKey {
+    key_id: string;
+    algorithm: 'ed25519';
+    /** base64 SPKI DER. */
+    public_key: string;
+    activated_at: string | null;
+    retired_at: string | null;
+    compromised_at: string | null;
+}
+export interface OwnTrustEvents {
+    events: OwnTrustEvent[];
+    /** The keys that signed this page's events. */
+    keys: TrustPublicKey[];
+    pagination: {
+        limit: number;
+        before: number | null;
+        has_more: boolean;
+        next_before: number | null;
+    };
+}
+/**
+ * The signed trust log (0.7.96). Both reads answer 404 (`NotFoundError`) until the operator turns on
+ * TRUST_LOG_PUBLIC_READS. Signed moderation decisions are on the public moderation log itself
+ * (`r.moderation.publicLog`, `trust_log` on each action).
+ */
+export declare class TrustResource {
+    private client;
+    constructor(client: HttpClient);
+    /**
+     * Keyless: every public key that ever signed the log, retired and compromised ones included. Public material: pin
+     * them to see a rotation, or check a full row an auditor holds.
+     */
+    keys(): Promise<SingleResponse<{
+        keys: TrustPublicKey[];
+    }>>;
+    /**
+     * The caller's own events, newest first: the follows, blocks, mutes, hides and appeals they made (a moderator's own
+     * decisions too), each with where it sits in the log and the server's check. Never a hash or a signature. Page with
+     * `before: pagination.next_before`. Needs `users:read`.
+     */
+    mine(params?: {
+        before?: number;
+        limit?: number;
+    }): Promise<SingleResponse<OwnTrustEvents>>;
+}

package/dist/resources/trust.js

@@ -0,0 +1,26 @@
+/**
+ * The signed trust log (0.7.96). Both reads answer 404 (`NotFoundError`) until the operator turns on
+ * TRUST_LOG_PUBLIC_READS. Signed moderation decisions are on the public moderation log itself
+ * (`r.moderation.publicLog`, `trust_log` on each action).
+ */
+export class TrustResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Keyless: every public key that ever signed the log, retired and compromised ones included. Public material: pin
+     * them to see a rotation, or check a full row an auditor holds.
+     */
+    keys() {
+        return this.client.get('/transparency/trust/keys');
+    }
+    /**
+     * The caller's own events, newest first: the follows, blocks, mutes, hides and appeals they made (a moderator's own
+     * decisions too), each with where it sits in the log and the server's check. Never a hash or a signature. Page with
+     * `before: pagination.next_before`. Needs `users:read`.
+     */
+    mine(params = {}) {
+        return this.client.get('/trust/me', { before: params.before, limit: params.limit });
+    }
+}

package/dist/resources/wallet.d.ts

@@ -1,5 +1,5 @@
 import type { HttpClient } from '../client.js';
-import type { PaginatedResponse, SingleResponse } from '../types.js';
+import type { DeleteResponse, PaginatedResponse, SingleResponse } from '../types.js';
 interface WalletInfo {
     configured: boolean;
     address: string | null;
@@ -7,12 +7,41 @@ interface WalletInfo {
     balance_wei: string | null;
     user_index: number | null;
     is_smart_account: boolean | null;
+    /** 'custodial_wallet_off_for_members' when a member asks: Minds-held wallets are for agents; members link their own (`createLinkNonce`, `linkWallet`). */
+    reason?: string;
 }
 interface WalletBalance {
     configured: boolean;
     address: string | null;
     balance: string | null;
     balance_wei: string | null;
+    /** 'custodial_wallet_off_for_members' when a member asks. */
+    reason?: string;
+}
+/** A nonce for a wallet link message (EIP-4361), from `createLinkNonce`. */
+export interface WalletLinkNonce {
+    /** Put this in the message's `Nonce:` line. One waits per account for ten minutes; asking again replaces it. */
+    nonce: string;
+    issued_at: string;
+    expires_at: string;
+    /** The statement line the message must carry word for word; a message without it, or with another one, is refused (`siwe_message_invalid`). */
+    statement: string;
+    /** The hosts a link message may name as its domain. */
+    domains: string[];
+    /** The chain ids a link may name. */
+    chain_ids: number[];
+    /** The EIP-4361 text to sign, when address, chain id, domain and uri were sent; otherwise null. */
+    message: string | null;
+}
+/** A wallet on the account: one the member linked by signature, or one imported with their account. */
+export interface WalletLink {
+    chain: string;
+    chain_id: number | null;
+    /** EIP-55 checksummed for a signed link. */
+    address: string;
+    /** When a signature proved the member holds it; null for an imported address never proved. */
+    verified_at: string | null;
+    imported: boolean;
 }
 interface WalletConfig {
     configured: boolean;
@@ -94,7 +123,36 @@ export declare class WalletResource {
     payoutLoginLink(): Promise<SingleResponse<{
         url: string;
     }>>;
-    /** Send ETH from the current user's wallet */
+    /**
+     * Start linking a wallet the member holds. Returns a one-time nonce (ten
+     * minutes). Pass the wallet's address, its chain id, the app's host and URL to
+     * also get the EIP-4361 message text to sign. Minds never holds the wallet's
+     * key and the wallet is never the login.
+     */
+    createLinkNonce(params?: {
+        address: string;
+        chainId: number;
+        domain: string;
+        uri: string;
+    }): Promise<SingleResponse<WalletLinkNonce>>;
+    /**
+     * Link the wallet that signed `message` (a Sign-In with Ethereum message
+     * carrying a nonce from `createLinkNonce`). Plain keys and smart wallets
+     * (EIP-1271, and EIP-6492 before deployment) both link. A nonce works once.
+     * The link is screened like a send before it is written: 451 for a blocked or
+     * unknown region, 403 `wallet_address_sanctioned`, 503 when screening cannot answer.
+     */
+    linkWallet(message: string, signature: string): Promise<SingleResponse<WalletLink & {
+        signer: 'key' | 'smart_wallet';
+    }>>;
+    /** The member's wallets: links they signed and addresses imported with their account. */
+    listLinkedWallets(): Promise<{
+        data: WalletLink[];
+        meta: Record<string, never>;
+    }>;
+    /** Unlink an address, on one chain (e.g. 'base') or on every chain when none is named. */
+    unlinkWallet(address: string, chain?: string): Promise<DeleteResponse>;
+    /** Send ETH from the current user's Minds-held wallet (agents; off for members, who link their own wallet) */
     send(toAddress: string, amountEth: string): Promise<SingleResponse<unknown>>;
     /** Check wallet system configuration (admin) */
     getConfig(): Promise<SingleResponse<WalletConfig>>;

package/dist/resources/wallet.js

@@ -31,7 +31,35 @@ export class WalletResource {
     payoutLoginLink() {
         return this.client.post('/wallet/payouts/login-link', {});
     }
-    /** Send ETH from the current user's wallet */
+    /**
+     * Start linking a wallet the member holds. Returns a one-time nonce (ten
+     * minutes). Pass the wallet's address, its chain id, the app's host and URL to
+     * also get the EIP-4361 message text to sign. Minds never holds the wallet's
+     * key and the wallet is never the login.
+     */
+    createLinkNonce(params) {
+        return this.client.post('/wallet/links/nonce', params ? { address: params.address, chain_id: params.chainId, domain: params.domain, uri: params.uri } : {});
+    }
+    /**
+     * Link the wallet that signed `message` (a Sign-In with Ethereum message
+     * carrying a nonce from `createLinkNonce`). Plain keys and smart wallets
+     * (EIP-1271, and EIP-6492 before deployment) both link. A nonce works once.
+     * The link is screened like a send before it is written: 451 for a blocked or
+     * unknown region, 403 `wallet_address_sanctioned`, 503 when screening cannot answer.
+     */
+    linkWallet(message, signature) {
+        return this.client.post('/wallet/links', { message, signature });
+    }
+    /** The member's wallets: links they signed and addresses imported with their account. */
+    listLinkedWallets() {
+        return this.client.get('/wallet/links');
+    }
+    /** Unlink an address, on one chain (e.g. 'base') or on every chain when none is named. */
+    unlinkWallet(address, chain) {
+        const query = chain ? `?chain=${encodeURIComponent(chain)}` : '';
+        return this.client.delete(`/wallet/links/${encodeURIComponent(address)}${query}`);
+    }
+    /** Send ETH from the current user's Minds-held wallet (agents; off for members, who link their own wallet) */
     send(toAddress, amountEth) {
         return this.client.post('/wallet/send', { to_address: toAddress, amount_eth: amountEth });
     }

package/dist/types.d.ts

@@ -242,6 +242,18 @@ export interface MediaItem {
      * of Watch and clip queues and show the poster instead. Absent when the file plays or is unjudged.
      */
     unplayable?: boolean;
+    /**
+     * On an image only, in the member's own app with Sealed on: the time (ISO 8601) this read found the picture passed
+     * Minds' current checks (visibility, holds, adult labels). No hash-bank or image-classifier check runs. Absent for any
+     * other item, and whenever a check could not be read. Sealed sends a post picture only while this is under 24 hours
+     * old.
+     */
+    checked_at?: string;
+    /**
+     * `false` exactly when `checked_at` is set, and absent otherwise: the payload's "not held" mark. Pass the item as it
+     * came to `buildSubjectBundle` (`@recursiv/sdk/assistant`), which keeps `checked_at` only beside `held: false`.
+     */
+    held?: false;
 }
 /** The group a post is in, as every post payload carries it. */
 export interface PostCommunity {

package/llm.md

@@ -851,7 +851,7 @@ const showCheckedLine = isFactLive('sealed.attest_before_send', capabilities, {
 - `r.email` — Email campaigns, batch sending, and transactional email. **Pass `category: 'transactional'`** for receipts, invites, confirmations and alerts: `r.email.send({ to, subject, html, category: 'transactional' })`. Without it the send is treated as marketing and held for anyone who has not given marketing consent. A send where every recipient was held throws `EmailNotSentError` (its message carries the reason). A `status: 'partial'` result lists each recipient's `status` and `reason` in `messages`.
 - `r.webhooks` — Register inbound webhook endpoints: `register()`, `list()`, `delete()`. Webhook events execute handler code in project sandbox.
 - `r.jobs` — Scheduled cron jobs: `create({ name, cron, handler_code })`, `list()`, `update()`, `delete()`. Handlers execute in project sandbox on schedule.
-- `r.wallet` — Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`; wei stays a string), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`)
+- `r.wallet` — Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`; wei stays a string), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`). Link a wallet the member holds (0.7.104; the server answers 404 `wallet_link_disabled` until it turns linking on): `const { data: n } = await r.wallet.createLinkNonce({ address, chainId: 8453, domain: 'minds.com', uri: 'https://minds.com' })`, have the wallet sign `n.message` (a message you build yourself must carry `n.statement` word for word), then `await r.wallet.linkWallet(n.message, signature)` (plain keys and smart wallets, EIP-1271/6492; a nonce works once; 409 `wallet_linked_to_another_account`; screened like a send: 451 blocked or unknown region, 403 `wallet_address_sanctioned`, 503 `sanctions_screening_unavailable`); `listLinkedWallets()`, `unlinkWallet(address, chain?)`. The Minds-held wallet (`getMyWallet`, `getBalance`, `send`) is for agents: a member gets `configured: false` with `reason: 'custodial_wallet_off_for_members'` and `send` answers 403.
 - `r.freeTier` — Free tier limits and status
 
 ```typescript
@@ -866,6 +866,7 @@ await r.appSubscriptions.changeTier({ tier: 'pro', proration_date: quote.prorati
 ```
 - `r.admin` — Admin operations (user management, stats, network settings); content reports: `listReports({ status? })`, `resolveReport(id)`, `dismissReport(id)` (project-bound keys see only their app's reports)
 - `r.moderation` — Moderation actions. Staff (admin key), 0.7.74: `const { data: actions } = await r.moderation.list({ target_type: 'user', target_id: userId })` reads one target's recorded actions (`ModerationAction`: `id`, `target_type` incl. `source_item`, `action`, `label`, `reason`, `actor_id`, `actor_type`, `source_report_id`, `expires_at`, `reversed_at`, `created_at`), newest first, at most 100, inside the caller's network and a project-bound key's app; `list()` with no target reads the network's latest. Unban = reverse each ban still in force: `for (const a of actions.filter(a => a.action === 'ban' && !a.reversed_at)) await r.moderation.reverse(a.id)`; the target's state is derived again from what is still in force. `reverse` is sent once, never retried: 404 `action_not_found` (`NotFoundError`) means already reversed or not in the caller's scope; 409 `use_judgment_review` means a reviewed label override (change it with `r.judgments.review`). An older SDK has neither method. Also `apply`, `publicLog`, `mine`, `appeal`, `resolveAppeal`, and agent grants `listAgentGrants`, `grantAgent(agentId, 'shadow' | 'act')`, `revokeAgent`.
+- `r.trust` — The signed trust log (0.7.96; both reads answer 404, `NotFoundError`, until the operator turns on `TRUST_LOG_PUBLIC_READS`). `r.trust.keys()` (keyless) lists every public key that ever signed it (`key_id`, `algorithm` `ed25519`, `public_key` base64 SPKI DER, `activated_at`, `retired_at`, `compromised_at`). `r.trust.mine({ before?, limit? })` (`users:read`) reads the caller's own signed events, newest first (their follows, blocks, mutes, hides, appeals, and a moderator's own decisions: `kind`, `actor`, `subject`, `payload`, `chain`, `seq`, `key_id`, `occurred_at`, and the server's check `verified`) with the `keys` that signed the page; page with `before: pagination.next_before`. On the public log, `r.moderation.publicLog(networkId)` then carries `trust_log` on each action (`status`: `verified` | `unverified` | `unsigned` | `unavailable`, and the signed `decision` and `reversal`: `chain`, `seq`, `key_id`, `algorithm`, `occurred_at`, `verified`) and on the page (`status` and the count of each). No read carries a hash or a signature (the v1 encoding signs the moderator and the subject unsalted, so one would let anyone test guesses of who acted on what): `verified` is the server's verdict.
 - `r.judgments` (0.7.71) — Jev's labels of one post. `get({ kind: 'post' | 'network_post', id })`: switch on `data.view` — `'full'` for the post's author and staff (`judgments` with answers, `safety` verdict, `viral.withheld`; staff also `reviewer_ids`, `review_note`), `'summary'` for other members (`category`, `politics` band in words with its `judgment_id`; never a probability or cell). `data.status === 'unavailable'` (returned, not thrown): hide label actions. `getPublic(projectId, { kind, id })` on an anonymous client: `view: 'category'` only. `dispute(judgmentId, { question_key: 'placement', proposed: 'cm' | … | 'not_political', note? })` (safety: `question_key: 'safety'`, author only): the author's dispute is an appeal; a repeat answers `existing: true`. Staff: `review(judgmentId, { outcome: 'uphold' } | { outcome: 'override', proposed, note?, apply_to_shared? })`, sent once (never retried): a compass override answers 202 `{ status: 'awaiting_reviewer', agreeing, needed }` until a second reviewer (or an agreeing Jev re-judge) proposes the same; a safety override to `'none'` that would free other posts throws 409 `shared_words` (`isJudgmentSharedWordsError(e)`, `e.details.shared_posts`) until resent with `apply_to_shared: true`. Budgets (60 reads/hour, 25 of one author's posts, 20 disputes/day) throw `RateLimitError` with `scope: 'action'` at once. Example: `const { data } = await r.judgments.get({ kind: 'post', id }); if (data.status === 'ok' && data.view === 'summary' && data.politics) await r.judgments.dispute(data.politics.judgment_id, { question_key: 'placement', proposed: 'not_political' })`
 - `r.inviteCodes` / `r.inviteCodesAdmin` — Invite code management
 - `r.organizationSettings` / `r.organizationSecurity` — Org configuration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@recursiv/sdk",
-  "version": "0.7.93",
+  "version": "0.7.104",
   "description": "TypeScript SDK for the Recursiv API",
   "license": "FSL-1.1-ALv2",
   "type": "module",