@recursiv/sdk 0.7.96 → 0.7.104

package/README.md

@@ -114,7 +114,7 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | `r.billing` | Usage tracking, subscriptions, checkout |
 | `r.appSubscriptions` | Consumer app plans: `checkout`, `status`, `createPortalSession`, `previewTierChange`, `changeTier` |
 | `r.boosts` | Promoted posts: `create`, `mine`, `balance`, `pause`, `resume`, `cancel`, `recordEvent`, `topup`, `confirmTopup`; admin `listPendingReview`, `review`, `grant` |
-| `r.wallet` | Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`) |
+| `r.wallet` | Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`), a wallet the member holds linked by signature (`createLinkNonce`, `linkWallet`, `listLinkedWallets`, `unlinkWallet`), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`) |
 | `r.notifications` | Notification stream (`list`, `unreadCount`, `markAsRead`, `archive`, `markAllAsRead`; `category: 'mentions'` for mentions and replies only, 0.7.72) and push tokens |
 | `r.github` | GitHub integration |
 | `r.integrations` | External service connections |

package/dist/assistant/subjectBundle.js

@@ -9,10 +9,10 @@
  * - posts under a child-safety hold, and posts a moderator turned the assistant off for, are left out, whoever asks;
  * - a post the server's per-viewer verdict (`assist_readable`) says is not readable is left out, whoever asks;
  * - pictures go as alt text and the stored caption only: never bytes, never an address (held media not even that). A
- *   picture keeps its plain id, and Minds' last child-safety check time (`checked_at`) when its input says `held` is
- *   exactly `false` (2.1: "checked within the last 24 hours and not held"), so a renderer given the caller's image
- *   cache may attach one on the asked-about post, parent or quote (never a reply's) as a picture while that check is
- *   under 24 hours old (renderBundleForModel);
+ *   picture keeps its plain id, and the time it last passed Minds' current checks (`checked_at`) when its input says
+ *   `held` is exactly `false` (2.1: "checked within the last 24 hours and not held"; GET /posts sends both together,
+ *   recursiv#5012), so a renderer given the caller's image cache may attach one on the asked-about post, parent or
+ *   quote (never a reply's) as a picture while that check is under 24 hours old (renderBundleForModel);
  * - every string loses what a reader cannot see (stripHiddenText) and is cut to its limit, and the bundle has a total
  *   that the asked-about post is cut to fit as well.
  *

package/dist/assistant/types.d.ts

@@ -54,9 +54,9 @@ export interface SubjectMediaInput {
      */
     id?: string | null;
     /**
-     * When Minds last matched this picture against the child-safety hash lists (the post payload's `media[].checked_at`,
-     * sealed-full-scope-v1 2.1, gate P1): an ISO time with its zone, written only by the server. Kept only when `held`
-     * is exactly `false`. A picture can go to a model as a picture only while this is under 24 hours old by the
+     * When the picture last passed Minds' current checks (the post payload's `media[].checked_at`, sent with `held:
+     * false`, sealed-full-scope-v1 2.1): an ISO time with its zone, written only by the server. Under Bill's 2026-10-11
+     * departure from gate P1 no hash-bank check is among them (recursiv#5012). Kept only when `held` is exactly `false`. A picture can go to a model as a picture only while this is under 24 hours old by the
      * renderer's clock; absent, not an ISO time with its zone, or without `held: false`, means alt text and the stored
      * caption only, as for every other picture.
      */

package/dist/index.d.ts

@@ -243,7 +243,7 @@ export { OrganizationSecurityResource } from './resources/organization-security.
 export { UploadsResource } from './resources/uploads.js';
 export type { UploadMediaInput, UploadUrlInput, UploadUrlResult } from './resources/uploads.js';
 export { WalletResource } from './resources/wallet.js';
-export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry } from './resources/wallet.js';
+export type { LinkedTokenWallet, PayoutState, TokenBalance, TokenLedgerEntry, WalletLink, WalletLinkNonce } from './resources/wallet.js';
 export { BoostsResource } from './resources/boosts.js';
 export type { BoostBalance, BoostBalanceResponse, BoostCampaign, BoostCampaignResponse, BoostEventResult, BoostLedgerEntry, BoostLedgerKind, BoostPlanCredit, BoostRejectionReason, BoostReviewStatus, BoostStatus, BoostTopupCheckout, BoostTopupConfirmation, BoostTopupLimits, } from './resources/boosts.js';
 export { ProtocolsResource } from './resources/protocols.js';

package/dist/privacy/facts.generated.d.ts

@@ -76,4 +76,235 @@ export declare const PRIVACY_FACTS: readonly [{
     readonly capability: "chat_tier";
     readonly step: "S29";
     readonly says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.";
+}, {
+    readonly id: "ai_prefs.agent_enabled";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "agent_enabled";
+    readonly step: "S9";
+    readonly says: "When a member turns their personal agent off, their turns to it make no provider call, it is not created again at sign-in, its chat leaves their conversation list and it sends them no push.";
+}, {
+    readonly id: "ai_prefs.standard_allowed";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "standard_allowed";
+    readonly step: "S28";
+    readonly says: "When a member turns Standard AI off, no agent makes a call through OpenRouter or a model maker for a turn they send.";
+}, {
+    readonly id: "ai_prefs.memory_facts";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_facts";
+    readonly step: "S11";
+    readonly says: "When a member turns memory off, no agent in the app saves new facts about them, and saved facts are not sent with their turns.";
+}, {
+    readonly id: "ai_prefs.memory_recall";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_recall";
+    readonly step: "S11";
+    readonly says: "When a member turns off using their other chats, a turn carries only that chat's own messages and, while memory is on, saved facts.";
+}, {
+    readonly id: "ai_prefs.memory_summaries";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_summaries";
+    readonly step: "S11";
+    readonly says: "When a member turns summaries off, no summary call is made for their chats.";
+}, {
+    readonly id: "ai_prefs.chat_memory";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "chat_memory";
+    readonly step: "S13";
+    readonly says: "When memory is off for one chat or one turn, nothing from it is saved to memory or used in other chats, and saved facts are not sent from it.";
+}, {
+    readonly id: "ai_prefs.activity";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "activity";
+    readonly step: "S26";
+    readonly says: "Who a member follows, what they upvoted, their groups and their interests go with a turn only for the parts they ticked, and only once they decided.";
+}, {
+    readonly id: "ai_prefs.feed_from_questions";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "feed_from_questions";
+    readonly step: "S26";
+    readonly says: "Asking an agent about a post is stored as a feed signal only when the member turned that on, and only the post id is stored, never the question.";
+}, {
+    readonly id: "ai_prefs.push_preview";
+    readonly status: "enforced";
+    readonly enforcement: "server";
+    readonly capability: "push_preview";
+    readonly step: "S16";
+    readonly says: "A push for a message an AI agent sends in a chat carries the agent's name and none of the message's words, unless the member turned the preview on; a push whose sender cannot be read carries none of its words either.";
+}, {
+    readonly id: "ai_prefs.standard_history_days";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "standard_history_days";
+    readonly step: "S24";
+    readonly says: "When a member picks 7 or 30 days, a daily job deletes their one-on-one agent chats older than that, with the chats' summaries and usage copies; billing rows without content stay.";
+}, {
+    readonly id: "notifications.ai_message";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "push_ai_replies";
+    readonly step: "S16";
+    readonly says: "Pushes for agent replies have their own setting, separate from messages from people, and start from the member's Messages push setting.";
+}, {
+    readonly id: "reports.ai_review_filter";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "report_ai_review";
+    readonly step: "S20";
+    readonly says: "An agent's key cannot list, resolve or dismiss a report whose reporter turned AI review off.";
+}, {
+    readonly id: "posts.ai_ask_allowed";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "allow_ask_on_my_posts";
+    readonly step: "S22";
+    readonly says: "When an author turns asks off, agents do not read their posts from links, and each post carries ai_ask_allowed false so apps hide the ask option.";
+}, {
+    readonly id: "posts.public_posts_ai";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "public_posts_ai";
+    readonly step: "S22";
+    readonly says: "When an author turns it off, their public posts are not embedded, topic or leaning labelled, or picked for editions, and existing vectors and those labels are removed; safety labels still run.";
+}, {
+    readonly id: "openrouter.deny_all_paths";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: null;
+    readonly step: "S4";
+    readonly says: "Every OpenRouter request, on the direct, fallback and summary paths, asks for providers whose stated policy is not to collect data (data_collection: deny). That is their policy; it is not checked.";
+}, {
+    readonly id: "account.export_ai";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: "memory_manage";
+    readonly step: "S18";
+    readonly says: "The account download includes the member's agent chats, the agents' replies, what agents saved about them and their agent's settings.";
+}, {
+    readonly id: "account.delete_personal_agent";
+    readonly status: "planned";
+    readonly enforcement: "server";
+    readonly capability: null;
+    readonly step: "S18";
+    readonly says: "Deleting an account deletes the member's personal agent, its instructions, its saved preferences and its decision rows.";
+}, {
+    readonly id: "sealed.guard_checks_every_turn";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Every Sealed message and every Sealed answer goes through the sealed text check (gpt-oss-safeguard-120b) before it is sent or shown; with no check, nothing is sent.";
+}, {
+    readonly id: "sealed.picture_checked_on_phone";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Every phone picture added to a Sealed chat passes the on-phone nudity check first; one it flags stays on the phone unless the member is a known adult whose adult setting is on, in a build that applies the adult policy.";
+}, {
+    readonly id: "sealed.picture_check_block_only";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "The sealed picture check (gemma4-31b) sees the picture alone, before anything else of the turn is sent, and only blocks: no report, flag or verdict reaches Minds. The gateway sees only that a check request was made, and counts it in the day's checks.";
+}, {
+    readonly id: "sealed.post_picture_server_checked";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "A post picture goes into a Sealed chat only once the server's current checks have cleared it, and never while it or its post is held or under a child-safety report; no hash-bank match is claimed.";
+}, {
+    readonly id: "sealed.search_via_tinfoil_to_exa";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: "chat_tier";
+    readonly step: "S28";
+    readonly says: "Sealed search runs only through Tinfoil's search, which sends the search words and page addresses to Exa, and nothing of the member's account or IP address.";
+}, {
+    readonly id: "sealed.search_filters_in_body";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "The phone sets the PII and injection filters in the sealed body of every message that searches, and never a location; a search with no filter marker turns search off for the chat.";
+}, {
+    readonly id: "sealed.memory_on_phone_only";
+    readonly status: "planned";
+    readonly enforcement: "device";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Sealed memory and About you live only in the phone's no-backup store, under the account, never on Minds.";
+}, {
+    readonly id: "sealed.memory_not_with_search_temporary_or_standard";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "Sealed memory and About you never go with a message that searches, a temporary chat or a Standard turn, and memory tags in answers to messages that carry someone else's words are ignored.";
+}, {
+    readonly id: "sealed.signout_clears_phone";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Signing out clears the account's Sealed chats, pictures, memory and About you from the phone, after a warning.";
+}, {
+    readonly id: "sealed.adult_setting_web_known_adult";
+    readonly status: "planned";
+    readonly enforcement: "server_and_client";
+    readonly capability: null;
+    readonly step: "S29";
+    readonly says: "The adult setting (D17) changes only on the web, only a member Minds knows is 18 or over can turn it on, and the phone only reads it.";
+}, {
+    readonly id: "sealed.search_question_only";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "A Sealed message that searches carries only the question: no earlier message, memory, About you or phone picture.";
+}, {
+    readonly id: "sealed.search_off_with_others_content";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "A Sealed message that carries someone else's words (a post, a members-only post, or messages from any chat) does not search.";
+}, {
+    readonly id: "sealed.search_shown_as_sent";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "The search words shown are the words Exa got (the filter's redacted query), and each page opened is shown with its full address.";
+}, {
+    readonly id: "sealed.temporary_not_saved";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "A temporary Sealed chat writes nothing to the phone: no history, picture or memory.";
+}, {
+    readonly id: "sealed.services_from_path";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "chat_tier";
+    readonly step: "S29";
+    readonly says: "'Other services this chat used' is computed from the path the chat's turns took.";
+}, {
+    readonly id: "sealed.export_to_phone_only";
+    readonly status: "planned";
+    readonly enforcement: "client";
+    readonly capability: "sealed_history";
+    readonly step: "S29";
+    readonly says: "Exporting a Sealed chat writes a file on the phone and sends nothing.";
 }];

package/dist/privacy/facts.generated.js

@@ -90,4 +90,268 @@ export const PRIVACY_FACTS = [
         step: "S29",
         says: "No Sealed route sends a push notification or writes a notification: a Sealed answer goes back only on the request that asked for it.",
     },
+    {
+        id: "ai_prefs.agent_enabled",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "agent_enabled",
+        step: "S9",
+        says: "When a member turns their personal agent off, their turns to it make no provider call, it is not created again at sign-in, its chat leaves their conversation list and it sends them no push.",
+    },
+    {
+        id: "ai_prefs.standard_allowed",
+        status: "planned",
+        enforcement: "server",
+        capability: "standard_allowed",
+        step: "S28",
+        says: "When a member turns Standard AI off, no agent makes a call through OpenRouter or a model maker for a turn they send.",
+    },
+    {
+        id: "ai_prefs.memory_facts",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_facts",
+        step: "S11",
+        says: "When a member turns memory off, no agent in the app saves new facts about them, and saved facts are not sent with their turns.",
+    },
+    {
+        id: "ai_prefs.memory_recall",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_recall",
+        step: "S11",
+        says: "When a member turns off using their other chats, a turn carries only that chat's own messages and, while memory is on, saved facts.",
+    },
+    {
+        id: "ai_prefs.memory_summaries",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_summaries",
+        step: "S11",
+        says: "When a member turns summaries off, no summary call is made for their chats.",
+    },
+    {
+        id: "ai_prefs.chat_memory",
+        status: "planned",
+        enforcement: "server",
+        capability: "chat_memory",
+        step: "S13",
+        says: "When memory is off for one chat or one turn, nothing from it is saved to memory or used in other chats, and saved facts are not sent from it.",
+    },
+    {
+        id: "ai_prefs.activity",
+        status: "planned",
+        enforcement: "server",
+        capability: "activity",
+        step: "S26",
+        says: "Who a member follows, what they upvoted, their groups and their interests go with a turn only for the parts they ticked, and only once they decided.",
+    },
+    {
+        id: "ai_prefs.feed_from_questions",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "feed_from_questions",
+        step: "S26",
+        says: "Asking an agent about a post is stored as a feed signal only when the member turned that on, and only the post id is stored, never the question.",
+    },
+    {
+        id: "ai_prefs.push_preview",
+        status: "enforced",
+        enforcement: "server",
+        capability: "push_preview",
+        step: "S16",
+        says: "A push for a message an AI agent sends in a chat carries the agent's name and none of the message's words, unless the member turned the preview on; a push whose sender cannot be read carries none of its words either.",
+    },
+    {
+        id: "ai_prefs.standard_history_days",
+        status: "planned",
+        enforcement: "server",
+        capability: "standard_history_days",
+        step: "S24",
+        says: "When a member picks 7 or 30 days, a daily job deletes their one-on-one agent chats older than that, with the chats' summaries and usage copies; billing rows without content stay.",
+    },
+    {
+        id: "notifications.ai_message",
+        status: "planned",
+        enforcement: "server",
+        capability: "push_ai_replies",
+        step: "S16",
+        says: "Pushes for agent replies have their own setting, separate from messages from people, and start from the member's Messages push setting.",
+    },
+    {
+        id: "reports.ai_review_filter",
+        status: "planned",
+        enforcement: "server",
+        capability: "report_ai_review",
+        step: "S20",
+        says: "An agent's key cannot list, resolve or dismiss a report whose reporter turned AI review off.",
+    },
+    {
+        id: "posts.ai_ask_allowed",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "allow_ask_on_my_posts",
+        step: "S22",
+        says: "When an author turns asks off, agents do not read their posts from links, and each post carries ai_ask_allowed false so apps hide the ask option.",
+    },
+    {
+        id: "posts.public_posts_ai",
+        status: "planned",
+        enforcement: "server",
+        capability: "public_posts_ai",
+        step: "S22",
+        says: "When an author turns it off, their public posts are not embedded, topic or leaning labelled, or picked for editions, and existing vectors and those labels are removed; safety labels still run.",
+    },
+    {
+        id: "openrouter.deny_all_paths",
+        status: "planned",
+        enforcement: "server",
+        capability: null,
+        step: "S4",
+        says: "Every OpenRouter request, on the direct, fallback and summary paths, asks for providers whose stated policy is not to collect data (data_collection: deny). That is their policy; it is not checked.",
+    },
+    {
+        id: "account.export_ai",
+        status: "planned",
+        enforcement: "server",
+        capability: "memory_manage",
+        step: "S18",
+        says: "The account download includes the member's agent chats, the agents' replies, what agents saved about them and their agent's settings.",
+    },
+    {
+        id: "account.delete_personal_agent",
+        status: "planned",
+        enforcement: "server",
+        capability: null,
+        step: "S18",
+        says: "Deleting an account deletes the member's personal agent, its instructions, its saved preferences and its decision rows.",
+    },
+    {
+        id: "sealed.guard_checks_every_turn",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Every Sealed message and every Sealed answer goes through the sealed text check (gpt-oss-safeguard-120b) before it is sent or shown; with no check, nothing is sent.",
+    },
+    {
+        id: "sealed.picture_checked_on_phone",
+        status: "planned",
+        enforcement: "device",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Every phone picture added to a Sealed chat passes the on-phone nudity check first; one it flags stays on the phone unless the member is a known adult whose adult setting is on, in a build that applies the adult policy.",
+    },
+    {
+        id: "sealed.picture_check_block_only",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "The sealed picture check (gemma4-31b) sees the picture alone, before anything else of the turn is sent, and only blocks: no report, flag or verdict reaches Minds. The gateway sees only that a check request was made, and counts it in the day's checks.",
+    },
+    {
+        id: "sealed.post_picture_server_checked",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "A post picture goes into a Sealed chat only once the server's current checks have cleared it, and never while it or its post is held or under a child-safety report; no hash-bank match is claimed.",
+    },
+    {
+        id: "sealed.search_via_tinfoil_to_exa",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: "chat_tier",
+        step: "S28",
+        says: "Sealed search runs only through Tinfoil's search, which sends the search words and page addresses to Exa, and nothing of the member's account or IP address.",
+    },
+    {
+        id: "sealed.search_filters_in_body",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "The phone sets the PII and injection filters in the sealed body of every message that searches, and never a location; a search with no filter marker turns search off for the chat.",
+    },
+    {
+        id: "sealed.memory_on_phone_only",
+        status: "planned",
+        enforcement: "device",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Sealed memory and About you live only in the phone's no-backup store, under the account, never on Minds.",
+    },
+    {
+        id: "sealed.memory_not_with_search_temporary_or_standard",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "Sealed memory and About you never go with a message that searches, a temporary chat or a Standard turn, and memory tags in answers to messages that carry someone else's words are ignored.",
+    },
+    {
+        id: "sealed.signout_clears_phone",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Signing out clears the account's Sealed chats, pictures, memory and About you from the phone, after a warning.",
+    },
+    {
+        id: "sealed.adult_setting_web_known_adult",
+        status: "planned",
+        enforcement: "server_and_client",
+        capability: null,
+        step: "S29",
+        says: "The adult setting (D17) changes only on the web, only a member Minds knows is 18 or over can turn it on, and the phone only reads it.",
+    },
+    {
+        id: "sealed.search_question_only",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "A Sealed message that searches carries only the question: no earlier message, memory, About you or phone picture.",
+    },
+    {
+        id: "sealed.search_off_with_others_content",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "A Sealed message that carries someone else's words (a post, a members-only post, or messages from any chat) does not search.",
+    },
+    {
+        id: "sealed.search_shown_as_sent",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "The search words shown are the words Exa got (the filter's redacted query), and each page opened is shown with its full address.",
+    },
+    {
+        id: "sealed.temporary_not_saved",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "A temporary Sealed chat writes nothing to the phone: no history, picture or memory.",
+    },
+    {
+        id: "sealed.services_from_path",
+        status: "planned",
+        enforcement: "client",
+        capability: "chat_tier",
+        step: "S29",
+        says: "'Other services this chat used' is computed from the path the chat's turns took.",
+    },
+    {
+        id: "sealed.export_to_phone_only",
+        status: "planned",
+        enforcement: "client",
+        capability: "sealed_history",
+        step: "S29",
+        says: "Exporting a Sealed chat writes a file on the phone and sends nothing.",
+    },
 ];

package/dist/resources/wallet.d.ts

@@ -1,5 +1,5 @@
 import type { HttpClient } from '../client.js';
-import type { PaginatedResponse, SingleResponse } from '../types.js';
+import type { DeleteResponse, PaginatedResponse, SingleResponse } from '../types.js';
 interface WalletInfo {
     configured: boolean;
     address: string | null;
@@ -7,12 +7,41 @@ interface WalletInfo {
     balance_wei: string | null;
     user_index: number | null;
     is_smart_account: boolean | null;
+    /** 'custodial_wallet_off_for_members' when a member asks: Minds-held wallets are for agents; members link their own (`createLinkNonce`, `linkWallet`). */
+    reason?: string;
 }
 interface WalletBalance {
     configured: boolean;
     address: string | null;
     balance: string | null;
     balance_wei: string | null;
+    /** 'custodial_wallet_off_for_members' when a member asks. */
+    reason?: string;
+}
+/** A nonce for a wallet link message (EIP-4361), from `createLinkNonce`. */
+export interface WalletLinkNonce {
+    /** Put this in the message's `Nonce:` line. One waits per account for ten minutes; asking again replaces it. */
+    nonce: string;
+    issued_at: string;
+    expires_at: string;
+    /** The statement line the message must carry word for word; a message without it, or with another one, is refused (`siwe_message_invalid`). */
+    statement: string;
+    /** The hosts a link message may name as its domain. */
+    domains: string[];
+    /** The chain ids a link may name. */
+    chain_ids: number[];
+    /** The EIP-4361 text to sign, when address, chain id, domain and uri were sent; otherwise null. */
+    message: string | null;
+}
+/** A wallet on the account: one the member linked by signature, or one imported with their account. */
+export interface WalletLink {
+    chain: string;
+    chain_id: number | null;
+    /** EIP-55 checksummed for a signed link. */
+    address: string;
+    /** When a signature proved the member holds it; null for an imported address never proved. */
+    verified_at: string | null;
+    imported: boolean;
 }
 interface WalletConfig {
     configured: boolean;
@@ -94,7 +123,36 @@ export declare class WalletResource {
     payoutLoginLink(): Promise<SingleResponse<{
         url: string;
     }>>;
-    /** Send ETH from the current user's wallet */
+    /**
+     * Start linking a wallet the member holds. Returns a one-time nonce (ten
+     * minutes). Pass the wallet's address, its chain id, the app's host and URL to
+     * also get the EIP-4361 message text to sign. Minds never holds the wallet's
+     * key and the wallet is never the login.
+     */
+    createLinkNonce(params?: {
+        address: string;
+        chainId: number;
+        domain: string;
+        uri: string;
+    }): Promise<SingleResponse<WalletLinkNonce>>;
+    /**
+     * Link the wallet that signed `message` (a Sign-In with Ethereum message
+     * carrying a nonce from `createLinkNonce`). Plain keys and smart wallets
+     * (EIP-1271, and EIP-6492 before deployment) both link. A nonce works once.
+     * The link is screened like a send before it is written: 451 for a blocked or
+     * unknown region, 403 `wallet_address_sanctioned`, 503 when screening cannot answer.
+     */
+    linkWallet(message: string, signature: string): Promise<SingleResponse<WalletLink & {
+        signer: 'key' | 'smart_wallet';
+    }>>;
+    /** The member's wallets: links they signed and addresses imported with their account. */
+    listLinkedWallets(): Promise<{
+        data: WalletLink[];
+        meta: Record<string, never>;
+    }>;
+    /** Unlink an address, on one chain (e.g. 'base') or on every chain when none is named. */
+    unlinkWallet(address: string, chain?: string): Promise<DeleteResponse>;
+    /** Send ETH from the current user's Minds-held wallet (agents; off for members, who link their own wallet) */
     send(toAddress: string, amountEth: string): Promise<SingleResponse<unknown>>;
     /** Check wallet system configuration (admin) */
     getConfig(): Promise<SingleResponse<WalletConfig>>;

package/dist/resources/wallet.js

@@ -31,7 +31,35 @@ export class WalletResource {
     payoutLoginLink() {
         return this.client.post('/wallet/payouts/login-link', {});
     }
-    /** Send ETH from the current user's wallet */
+    /**
+     * Start linking a wallet the member holds. Returns a one-time nonce (ten
+     * minutes). Pass the wallet's address, its chain id, the app's host and URL to
+     * also get the EIP-4361 message text to sign. Minds never holds the wallet's
+     * key and the wallet is never the login.
+     */
+    createLinkNonce(params) {
+        return this.client.post('/wallet/links/nonce', params ? { address: params.address, chain_id: params.chainId, domain: params.domain, uri: params.uri } : {});
+    }
+    /**
+     * Link the wallet that signed `message` (a Sign-In with Ethereum message
+     * carrying a nonce from `createLinkNonce`). Plain keys and smart wallets
+     * (EIP-1271, and EIP-6492 before deployment) both link. A nonce works once.
+     * The link is screened like a send before it is written: 451 for a blocked or
+     * unknown region, 403 `wallet_address_sanctioned`, 503 when screening cannot answer.
+     */
+    linkWallet(message, signature) {
+        return this.client.post('/wallet/links', { message, signature });
+    }
+    /** The member's wallets: links they signed and addresses imported with their account. */
+    listLinkedWallets() {
+        return this.client.get('/wallet/links');
+    }
+    /** Unlink an address, on one chain (e.g. 'base') or on every chain when none is named. */
+    unlinkWallet(address, chain) {
+        const query = chain ? `?chain=${encodeURIComponent(chain)}` : '';
+        return this.client.delete(`/wallet/links/${encodeURIComponent(address)}${query}`);
+    }
+    /** Send ETH from the current user's Minds-held wallet (agents; off for members, who link their own wallet) */
     send(toAddress, amountEth) {
         return this.client.post('/wallet/send', { to_address: toAddress, amount_eth: amountEth });
     }

package/dist/types.d.ts

@@ -242,6 +242,18 @@ export interface MediaItem {
      * of Watch and clip queues and show the poster instead. Absent when the file plays or is unjudged.
      */
     unplayable?: boolean;
+    /**
+     * On an image only, in the member's own app with Sealed on: the time (ISO 8601) this read found the picture passed
+     * Minds' current checks (visibility, holds, adult labels). No hash-bank or image-classifier check runs. Absent for any
+     * other item, and whenever a check could not be read. Sealed sends a post picture only while this is under 24 hours
+     * old.
+     */
+    checked_at?: string;
+    /**
+     * `false` exactly when `checked_at` is set, and absent otherwise: the payload's "not held" mark. Pass the item as it
+     * came to `buildSubjectBundle` (`@recursiv/sdk/assistant`), which keeps `checked_at` only beside `held: false`.
+     */
+    held?: false;
 }
 /** The group a post is in, as every post payload carries it. */
 export interface PostCommunity {

package/llm.md

@@ -851,7 +851,7 @@ const showCheckedLine = isFactLive('sealed.attest_before_send', capabilities, {
 - `r.email` — Email campaigns, batch sending, and transactional email. **Pass `category: 'transactional'`** for receipts, invites, confirmations and alerts: `r.email.send({ to, subject, html, category: 'transactional' })`. Without it the send is treated as marketing and held for anyone who has not given marketing consent. A send where every recipient was held throws `EmailNotSentError` (its message carries the reason). A `status: 'partial'` result lists each recipient's `status` and `reason` in `messages`.
 - `r.webhooks` — Register inbound webhook endpoints: `register()`, `list()`, `delete()`. Webhook events execute handler code in project sandbox.
 - `r.jobs` — Scheduled cron jobs: `create({ name, cron, handler_code })`, `list()`, `update()`, `delete()`. Handlers execute in project sandbox on schedule.
-- `r.wallet` — Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`; wei stays a string), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`)
+- `r.wallet` — Wallet, MINDS tokens (`getTokenBalance`, `getTokenLedger`; wei stays a string), USD payouts (`getPayouts`, `startPayoutOnboarding`, `payoutLoginLink`). Link a wallet the member holds (0.7.104; the server answers 404 `wallet_link_disabled` until it turns linking on): `const { data: n } = await r.wallet.createLinkNonce({ address, chainId: 8453, domain: 'minds.com', uri: 'https://minds.com' })`, have the wallet sign `n.message` (a message you build yourself must carry `n.statement` word for word), then `await r.wallet.linkWallet(n.message, signature)` (plain keys and smart wallets, EIP-1271/6492; a nonce works once; 409 `wallet_linked_to_another_account`; screened like a send: 451 blocked or unknown region, 403 `wallet_address_sanctioned`, 503 `sanctions_screening_unavailable`); `listLinkedWallets()`, `unlinkWallet(address, chain?)`. The Minds-held wallet (`getMyWallet`, `getBalance`, `send`) is for agents: a member gets `configured: false` with `reason: 'custodial_wallet_off_for_members'` and `send` answers 403.
 - `r.freeTier` — Free tier limits and status
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@recursiv/sdk",
-  "version": "0.7.96",
+  "version": "0.7.104",
   "description": "TypeScript SDK for the Recursiv API",
   "license": "FSL-1.1-ALv2",
   "type": "module",