@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/esm/crypto/hitl-crypto.js

@@ -0,0 +1,321 @@
+/**
+ * HITL End-to-End Encryption — Crypto Module
+ *
+ * Implements the envelope spec from docs/ENCRYPTION_ENVELOPE.md.
+ * Uses Node.js crypto module (works in Node.js 18+).
+ *
+ * Two modes:
+ * - Encrypt-only: agent has public key, encrypts messages for the approver
+ * - Encrypt+decrypt: approver has password, decrypts messages in browser
+ */
+import crypto from 'crypto';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const ENVELOPE_VERSION = 1;
+const MESSAGE_ALG = 'RSA-OAEP-256+AES-256-GCM';
+const PRIVATE_KEY_ALG = 'PBKDF2-SHA256+AES-256-GCM';
+const AES_KEY_BYTES = 32;
+const AES_IV_BYTES = 12;
+const AES_TAG_BYTES = 16;
+const RSA_EK_BYTES = 512; // 4096-bit RSA
+const PBKDF2_ITERATIONS = 600000;
+const PBKDF2_SALT_BYTES = 16;
+const PBKDF2_KEY_BYTES = 32;
+// ---------------------------------------------------------------------------
+// Base64url helpers
+// ---------------------------------------------------------------------------
+function toBase64url(buf) {
+    return buf.toString('base64url');
+}
+function fromBase64url(str) {
+    return Buffer.from(str, 'base64url');
+}
+// ---------------------------------------------------------------------------
+// Key Identifier
+// ---------------------------------------------------------------------------
+/** Compute kid = lowercase_hex(SHA-256(DER-encoded SPKI public key bytes)) */
+export function computeKid(publicKeyPem) {
+    const keyObject = crypto.createPublicKey(publicKeyPem);
+    const der = keyObject.export({ type: 'spki', format: 'der' });
+    return crypto.createHash('sha256').update(der).digest('hex');
+}
+// ---------------------------------------------------------------------------
+// RSA Key Generation
+// ---------------------------------------------------------------------------
+/** Generate an RSA-4096 key pair. Returns PEM-encoded SPKI public + PKCS#8 private. */
+export function generateKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 4096,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return { publicKeyPem: publicKey, privateKeyPem: privateKey };
+}
+// ---------------------------------------------------------------------------
+// PBKDF2
+// ---------------------------------------------------------------------------
+/** Derive a 256-bit key from password + salt using PBKDF2-SHA256 at 600k iterations. */
+export function deriveKey(password, salt) {
+    return crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_BYTES, 'sha256');
+}
+// ---------------------------------------------------------------------------
+// AES-256-GCM
+// ---------------------------------------------------------------------------
+function aesGcmEncrypt(key, iv, plaintext, aad) {
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(aad);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return { ciphertext, tag };
+}
+function aesGcmDecrypt(key, iv, ciphertext, tag, aad) {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    decipher.setAAD(aad);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch {
+        throw new Error('Decryption failed');
+    }
+}
+// ---------------------------------------------------------------------------
+// RSA-OAEP-SHA256 wrap/unwrap
+// ---------------------------------------------------------------------------
+function rsaOaepWrap(publicKeyPem, plaintext) {
+    const keyObject = crypto.createPublicKey(publicKeyPem);
+    return crypto.publicEncrypt({ key: keyObject, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' }, plaintext);
+}
+function rsaOaepUnwrap(privateKeyPem, ciphertext) {
+    const keyObject = crypto.createPrivateKey(privateKeyPem);
+    try {
+        return crypto.privateDecrypt({ key: keyObject, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' }, ciphertext);
+    }
+    catch {
+        throw new Error('Decryption failed');
+    }
+}
+// ---------------------------------------------------------------------------
+// Envelope Validation
+// ---------------------------------------------------------------------------
+export function validateMessageEnvelope(obj) {
+    if (!obj || typeof obj !== 'object')
+        return false;
+    const e = obj;
+    if (e.v !== 1 && e.v !== 2)
+        return false;
+    if (e.alg !== MESSAGE_ALG)
+        return false;
+    if (typeof e.ek !== 'string' || fromBase64url(e.ek).length !== RSA_EK_BYTES)
+        return false;
+    if (typeof e.iv !== 'string' || fromBase64url(e.iv).length !== AES_IV_BYTES)
+        return false;
+    if (typeof e.tag !== 'string' || fromBase64url(e.tag).length !== AES_TAG_BYTES)
+        return false;
+    if (typeof e.ct !== 'string' || !e.ct)
+        return false;
+    if (typeof e.kid !== 'string' || !/^[a-f0-9]{64}$/.test(e.kid))
+        return false;
+    // v2: per-recipient wrapped keys (authorization_id → base64url, each RSA_EK_BYTES long)
+    if (e.v === 2) {
+        if (!e.approver_ek || typeof e.approver_ek !== 'object' || Array.isArray(e.approver_ek))
+            return false;
+        for (const wrapped of Object.values(e.approver_ek)) {
+            if (typeof wrapped !== 'string' || fromBase64url(wrapped).length !== RSA_EK_BYTES)
+                return false;
+        }
+    }
+    // Reject unknown fields (v2 additionally allows approver_ek)
+    const known = new Set(e.v === 2
+        ? ['v', 'alg', 'ek', 'approver_ek', 'iv', 'ct', 'tag', 'kid']
+        : ['v', 'alg', 'ek', 'iv', 'ct', 'tag', 'kid']);
+    for (const key of Object.keys(e)) {
+        if (!known.has(key))
+            return false;
+    }
+    return true;
+}
+export function validatePrivateKeyEnvelope(obj) {
+    if (!obj || typeof obj !== 'object')
+        return false;
+    const e = obj;
+    if (e.v !== 1)
+        return false;
+    if (e.alg !== PRIVATE_KEY_ALG)
+        return false;
+    if (typeof e.iv !== 'string' || fromBase64url(e.iv).length !== AES_IV_BYTES)
+        return false;
+    if (typeof e.tag !== 'string' || fromBase64url(e.tag).length !== AES_TAG_BYTES)
+        return false;
+    if (typeof e.ct !== 'string' || !e.ct)
+        return false;
+    if (typeof e.salt !== 'string' || fromBase64url(e.salt).length !== PBKDF2_SALT_BYTES)
+        return false;
+    if (typeof e.kid !== 'string' || !/^[a-f0-9]{64}$/.test(e.kid))
+        return false;
+    const known = new Set(['v', 'alg', 'iv', 'ct', 'tag', 'salt', 'kid']);
+    for (const key of Object.keys(e)) {
+        if (!known.has(key))
+            return false;
+    }
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Message Encryption (Section 4.1)
+// ---------------------------------------------------------------------------
+/**
+ * Encrypt a confirmation message for a HITL config.
+ * AAD = `{hitlId}`
+ */
+export function encryptMessage(plaintext, publicKeyPem, hitlId) {
+    const aesKey = crypto.randomBytes(AES_KEY_BYTES);
+    const iv = crypto.randomBytes(AES_IV_BYTES);
+    const aad = Buffer.from(hitlId, 'utf8');
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const { ciphertext, tag } = aesGcmEncrypt(aesKey, iv, plaintextBuf, aad);
+    const ek = rsaOaepWrap(publicKeyPem, aesKey);
+    const kid = computeKid(publicKeyPem);
+    return {
+        v: ENVELOPE_VERSION,
+        alg: MESSAGE_ALG,
+        ek: toBase64url(ek),
+        iv: toBase64url(iv),
+        ct: toBase64url(ciphertext),
+        tag: toBase64url(tag),
+        kid,
+    };
+}
+/**
+ * Encrypt a confirmation message with multi-recipient wrapping (v2).
+ * Wraps the AES content key with the owner's public key AND each approver's
+ * public key, so every enrolled approver can decrypt with their own key.
+ * AAD = `{hitlId}`.
+ *
+ * @param approverKeys - Map of authorization_id → approver PEM public key
+ */
+export function encryptMessageV2(plaintext, ownerPublicKeyPem, hitlId, approverKeys) {
+    const aesKey = crypto.randomBytes(AES_KEY_BYTES);
+    const iv = crypto.randomBytes(AES_IV_BYTES);
+    const aad = Buffer.from(hitlId, 'utf8');
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const { ciphertext, tag } = aesGcmEncrypt(aesKey, iv, plaintextBuf, aad);
+    const ek = rsaOaepWrap(ownerPublicKeyPem, aesKey);
+    const kid = computeKid(ownerPublicKeyPem);
+    // Wrap the same AES key with each approver's public key.
+    const approver_ek = {};
+    for (const [authzId, approverPem] of Object.entries(approverKeys)) {
+        approver_ek[authzId] = toBase64url(rsaOaepWrap(approverPem, aesKey));
+    }
+    return {
+        v: 2,
+        alg: MESSAGE_ALG,
+        ek: toBase64url(ek),
+        approver_ek,
+        iv: toBase64url(iv),
+        ct: toBase64url(ciphertext),
+        tag: toBase64url(tag),
+        kid,
+    };
+}
+/**
+ * Encrypt a message with fixed AES key and IV (for test vector generation only).
+ * @internal
+ */
+export function encryptMessageWithFixedInputs(plaintext, publicKeyPem, hitlId, aesKey, iv) {
+    const aad = Buffer.from(hitlId, 'utf8');
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const { ciphertext, tag } = aesGcmEncrypt(aesKey, iv, plaintextBuf, aad);
+    const ek = rsaOaepWrap(publicKeyPem, aesKey);
+    const kid = computeKid(publicKeyPem);
+    return {
+        v: ENVELOPE_VERSION,
+        alg: MESSAGE_ALG,
+        ek: toBase64url(ek),
+        iv: toBase64url(iv),
+        ct: toBase64url(ciphertext),
+        tag: toBase64url(tag),
+        kid,
+    };
+}
+/**
+ * Decrypt a confirmation message envelope.
+ * AAD = `{hitlId}`
+ */
+export function decryptMessage(envelope, privateKeyPem, hitlId) {
+    if (!validateMessageEnvelope(envelope)) {
+        throw new Error('Decryption failed');
+    }
+    const ek = fromBase64url(envelope.ek);
+    const iv = fromBase64url(envelope.iv);
+    const ct = fromBase64url(envelope.ct);
+    const tag = fromBase64url(envelope.tag);
+    const aad = Buffer.from(hitlId, 'utf8');
+    const aesKey = rsaOaepUnwrap(privateKeyPem, ek);
+    const plaintext = aesGcmDecrypt(aesKey, iv, ct, tag, aad);
+    return plaintext.toString('utf8');
+}
+// ---------------------------------------------------------------------------
+// Private Key Encryption (Section 4.2)
+// ---------------------------------------------------------------------------
+/**
+ * Encrypt an RSA private key with a user password for storage.
+ * AAD = `{hitlId}:{userId}`
+ */
+export function encryptPrivateKey(privateKeyPem, password, publicKeyPem, hitlId, userId) {
+    const salt = crypto.randomBytes(PBKDF2_SALT_BYTES);
+    const derivedKey = deriveKey(password, salt);
+    const iv = crypto.randomBytes(AES_IV_BYTES);
+    const aad = Buffer.from(`${hitlId}:${userId}`, 'utf8');
+    const privateKeyDer = crypto.createPrivateKey(privateKeyPem).export({ type: 'pkcs8', format: 'der' });
+    const { ciphertext, tag } = aesGcmEncrypt(derivedKey, iv, privateKeyDer, aad);
+    const kid = computeKid(publicKeyPem);
+    return {
+        v: ENVELOPE_VERSION,
+        alg: PRIVATE_KEY_ALG,
+        iv: toBase64url(iv),
+        ct: toBase64url(ciphertext),
+        tag: toBase64url(tag),
+        salt: toBase64url(salt),
+        kid,
+    };
+}
+/**
+ * Decrypt an RSA private key using the user's password.
+ * AAD = `{hitlId}:{userId}`
+ * Returns PEM-encoded PKCS#8 private key.
+ */
+export function decryptPrivateKey(envelope, password, hitlId, userId) {
+    if (!validatePrivateKeyEnvelope(envelope)) {
+        throw new Error('Decryption failed');
+    }
+    const salt = fromBase64url(envelope.salt);
+    const derivedKey = deriveKey(password, salt);
+    const iv = fromBase64url(envelope.iv);
+    const ct = fromBase64url(envelope.ct);
+    const tag = fromBase64url(envelope.tag);
+    const aad = Buffer.from(`${hitlId}:${userId}`, 'utf8');
+    const privateKeyDer = aesGcmDecrypt(derivedKey, iv, ct, tag, aad);
+    // Convert DER back to PEM
+    const keyObject = crypto.createPrivateKey({ key: privateKeyDer, format: 'der', type: 'pkcs8' });
+    return keyObject.export({ type: 'pkcs8', format: 'pem' });
+}
+// ---------------------------------------------------------------------------
+// Full Key Setup (convenience)
+// ---------------------------------------------------------------------------
+/**
+ * Generate a new RSA-4096 key pair and encrypt the private key with a password.
+ * Returns everything needed for `PUT /api/v1/hitl/:id/keys`.
+ */
+export function generateEncryptionKeyPair(password, hitlId, userId) {
+    const { publicKeyPem, privateKeyPem } = generateKeyPair();
+    const encrypted = encryptPrivateKey(privateKeyPem, password, publicKeyPem, hitlId, userId);
+    const kid = computeKid(publicKeyPem);
+    return {
+        publicKeyPem,
+        encryptedPrivateKey: encrypted,
+        kdfSalt: encrypted.salt,
+        kid,
+    };
+}
+//# sourceMappingURL=hitl-crypto.js.map

package/dist/esm/crypto/hitl-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-crypto.js","sourceRoot":"","sources":["../../../src/crypto/hitl-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,WAAW,GAAG,0BAAmC,CAAC;AACxD,MAAM,eAAe,GAAG,2BAAoC,CAAC;AAC7D,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,eAAe;AACzC,MAAM,iBAAiB,GAAG,MAAO,CAAC;AAClC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AA8C5B,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QAClE,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY;IACtD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAS,aAAa,CACpB,GAAW,EACX,EAAU,EACV,SAAiB,EACjB,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CACpB,GAAW,EACX,EAAU,EACV,UAAkB,EAClB,GAAW,EACX,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,SAAS,WAAW,CAAC,YAAoB,EAAE,SAAiB;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,aAAa,CACzB,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACxF,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,aAAqB,EAAE,UAAkB;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAC1B,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACxF,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7E,wFAAwF;IACxF,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACtG,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAsC,CAAC,EAAE,CAAC;YAC9E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;QAClG,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,CAAC,CAAC,KAAK,CAAC;QACP,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QAC7D,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CACjD,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC,CAAC,GAAG,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,YAAoB,EACpB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAErC,OAAO;QACL,CAAC,EAAE,gBAAgB;QACnB,GAAG,EAAE,WAAW;QAChB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;QAC3B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,iBAAyB,EACzB,MAAc,EACd,YAAoC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAE1C,yDAAyD;IACzD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,WAAW,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,WAAW;QAChB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,WAAW;QACX,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;QAC3B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAiB,EACjB,YAAoB,EACpB,MAAc,EACd,MAAc,EACd,EAAU;IAEV,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAErC,OAAO;QACL,CAAC,EAAE,gBAAgB;QACnB,GAAG,EAAE,WAAW;QAChB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;QAC3B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA4B,EAC5B,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAE1D,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtG,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,aAAuB,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAErC,OAAO;QACL,CAAC,EAAE,gBAAgB;QACnB,GAAG,EAAE,eAAe;QACpB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC;QAC3B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;QACvB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA6B,EAC7B,QAAgB,EAChB,MAAc,EACd,MAAc;IAEd,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAElE,0BAA0B;IAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,MAAc,EACd,MAAc;IAEd,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO;QACL,YAAY;QACZ,mBAAmB,EAAE,SAAS;QAC9B,OAAO,EAAE,SAAS,CAAC,IAAI;QACvB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/esm/errors.d.ts

@@ -0,0 +1,52 @@
+import type { ApiError } from './types.js';
+export declare class ProofError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    readonly details?: unknown;
+    readonly requestId?: string;
+    constructor(message: string, code: string, statusCode: number, details?: unknown, requestId?: string);
+    static fromResponse(statusCode: number, error?: ApiError): ProofError;
+}
+export declare class ValidationError extends ProofError {
+    constructor(message: string, code: string, details?: unknown, requestId?: string);
+}
+export declare class AuthenticationError extends ProofError {
+    constructor(message: string, code: string, details?: unknown, requestId?: string);
+}
+export declare class ForbiddenError extends ProofError {
+    constructor(message: string, code: string, details?: unknown, requestId?: string);
+}
+export declare class NotFoundError extends ProofError {
+    constructor(message: string, code: string, details?: unknown, requestId?: string);
+}
+export declare class ConflictError extends ProofError {
+    constructor(message: string, code: string, details?: unknown, requestId?: string);
+}
+export declare class RateLimitError extends ProofError {
+    /** Seconds to wait before retrying (from error response retryAfter field) */
+    readonly retryAfter?: number;
+    /** Number of remaining attempts before lockout (auth endpoints only) */
+    readonly remainingAttempts?: number;
+    constructor(message: string, code: string, details?: unknown, requestId?: string, retryAfter?: number, remainingAttempts?: number);
+    static fromApiError(error: ApiError): RateLimitError;
+}
+export declare class ServerError extends ProofError {
+    constructor(message: string, code: string, statusCode?: number, details?: unknown, requestId?: string);
+}
+export declare class NetworkError extends ProofError {
+    constructor(message: string);
+}
+export declare class TimeoutError extends ProofError {
+    constructor(message?: string);
+}
+export declare class PollingTimeoutError extends ProofError {
+    constructor(message?: string);
+}
+export declare class ConfirmationDeniedError extends ProofError {
+    /** ID of the confirmation that triggered the error */
+    readonly confirmationId: string;
+    /** Non-approved terminal status that triggered the error ('denied' or, for the createAndWait gate, 'expired') */
+    readonly status: string;
+    constructor(confirmationId: string, status?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClC,SAAgB,SAAS,CAAC,EAAE,MAAM,CAAC;gBAGjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM;IAWpB,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,UAAU;CAqBtE;AAED,qBAAa,eAAgB,SAAQ,UAAU;gBACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjF;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjF;AAED,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjF;AAED,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjF;AAED,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,6EAA6E;IAC7E,SAAgB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpC,wEAAwE;IACxE,SAAgB,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAGzC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM;IAQ5B,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc;CAMrD;AAED,qBAAa,WAAY,SAAQ,UAAU;gBAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAY,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAI3G;AAED,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,GAAE,MAA4B;CAIlD;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,GAAE,MAAmD;CAIzE;AAED,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,sDAAsD;IACtD,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,iHAAiH;IACjH,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,cAAc,EAAE,MAAM,EAAE,MAAM,GAAE,MAAiB;CAM9D"}

package/dist/esm/errors.js

@@ -0,0 +1,106 @@
+export class ProofError extends Error {
+    constructor(message, code, statusCode, details, requestId) {
+        super(message);
+        this.name = 'ProofError';
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+        this.requestId = requestId;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    static fromResponse(statusCode, error) {
+        const code = error?.code ?? `http_${statusCode}`;
+        const message = error?.message ?? `Request failed with status ${statusCode}`;
+        const details = error?.details;
+        const requestId = error?.request_id;
+        switch (statusCode) {
+            case 400: return new ValidationError(message, code, details, requestId);
+            case 401: return new AuthenticationError(message, code, details, requestId);
+            case 403: return new ForbiddenError(message, code, details, requestId);
+            case 404: return new NotFoundError(message, code, details, requestId);
+            case 409: return new ConflictError(message, code, details, requestId);
+            case 429:
+                return error
+                    ? RateLimitError.fromApiError(error)
+                    : new RateLimitError(message, code, details, requestId);
+            default:
+                if (statusCode >= 500)
+                    return new ServerError(message, code, statusCode, details, requestId);
+                return new ProofError(message, code, statusCode, details, requestId);
+        }
+    }
+}
+export class ValidationError extends ProofError {
+    constructor(message, code, details, requestId) {
+        super(message, code, 400, details, requestId);
+        this.name = 'ValidationError';
+    }
+}
+export class AuthenticationError extends ProofError {
+    constructor(message, code, details, requestId) {
+        super(message, code, 401, details, requestId);
+        this.name = 'AuthenticationError';
+    }
+}
+export class ForbiddenError extends ProofError {
+    constructor(message, code, details, requestId) {
+        super(message, code, 403, details, requestId);
+        this.name = 'ForbiddenError';
+    }
+}
+export class NotFoundError extends ProofError {
+    constructor(message, code, details, requestId) {
+        super(message, code, 404, details, requestId);
+        this.name = 'NotFoundError';
+    }
+}
+export class ConflictError extends ProofError {
+    constructor(message, code, details, requestId) {
+        super(message, code, 409, details, requestId);
+        this.name = 'ConflictError';
+    }
+}
+export class RateLimitError extends ProofError {
+    constructor(message, code, details, requestId, retryAfter, remainingAttempts) {
+        super(message, code, 429, details, requestId);
+        this.name = 'RateLimitError';
+        this.retryAfter = retryAfter;
+        this.remainingAttempts = remainingAttempts;
+    }
+    static fromApiError(error) {
+        return new RateLimitError(error.message, error.code, error.details, error.request_id, error.retryAfter, error.remaining_attempts);
+    }
+}
+export class ServerError extends ProofError {
+    constructor(message, code, statusCode = 500, details, requestId) {
+        super(message, code, statusCode, details, requestId);
+        this.name = 'ServerError';
+    }
+}
+export class NetworkError extends ProofError {
+    constructor(message) {
+        super(message, 'network_error', 0);
+        this.name = 'NetworkError';
+    }
+}
+export class TimeoutError extends ProofError {
+    constructor(message = 'Request timed out') {
+        super(message, 'timeout', 0);
+        this.name = 'TimeoutError';
+    }
+}
+export class PollingTimeoutError extends ProofError {
+    constructor(message = 'Polling timed out waiting for completion') {
+        super(message, 'polling_timeout', 0);
+        this.name = 'PollingTimeoutError';
+    }
+}
+export class ConfirmationDeniedError extends ProofError {
+    constructor(confirmationId, status = 'denied') {
+        super(`Confirmation ${confirmationId} was ${status}`, 'confirmation_denied', 0);
+        this.name = 'ConfirmationDeniedError';
+        this.confirmationId = confirmationId;
+        this.status = status;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAMnC,YACE,OAAe,EACf,IAAY,EACZ,UAAkB,EAClB,OAAiB,EACjB,SAAkB;QAElB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,UAAkB,EAAE,KAAgB;QACtD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,QAAQ,UAAU,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,8BAA8B,UAAU,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,EAAE,UAAU,CAAC;QAEpC,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACxE,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5E,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACvE,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACtE,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACtE,KAAK,GAAG;gBACN,OAAO,KAAK;oBACV,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC;oBACpC,CAAC,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D;gBACE,IAAI,UAAU,IAAI,GAAG;oBAAE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7F,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,OAAe,EAAE,IAAY,EAAE,OAAiB,EAAE,SAAkB;QAC9E,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,OAAe,EAAE,IAAY,EAAE,OAAiB,EAAE,SAAkB;QAC9E,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe,EAAE,IAAY,EAAE,OAAiB,EAAE,SAAkB;QAC9E,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C,YAAY,OAAe,EAAE,IAAY,EAAE,OAAiB,EAAE,SAAkB;QAC9E,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C,YAAY,OAAe,EAAE,IAAY,EAAE,OAAiB,EAAE,SAAkB;QAC9E,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAM5C,YACE,OAAe,EACf,IAAY,EACZ,OAAiB,EACjB,SAAkB,EAClB,UAAmB,EACnB,iBAA0B;QAE1B,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,KAAe;QACjC,OAAO,IAAI,cAAc,CACvB,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EACxC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAC7D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,YAAY,OAAe,EAAE,IAAY,EAAE,aAAqB,GAAG,EAAE,OAAiB,EAAE,SAAkB;QACxG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,UAAU;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,UAAU;IAC1C,YAAY,UAAkB,mBAAmB;QAC/C,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,UAAkB,0CAA0C;QACtE,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IAMrD,YAAY,cAAsB,EAAE,SAAiB,QAAQ;QAC3D,KAAK,CAAC,gBAAgB,cAAc,QAAQ,MAAM,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/esm/http.d.ts

@@ -0,0 +1,62 @@
+export interface HttpClientConfig {
+    apiKey: string;
+    baseUrl: string;
+    timeout: number;
+    maxRetries: number;
+    fetch: typeof globalThis.fetch;
+}
+type QueryValue = string | number | boolean | undefined;
+/**
+ * Read a response body, giving up one byte past `limit`.
+ *
+ * `response.text()` would buffer the WHOLE body and measure afterwards, which is not a ceiling
+ * at all for a reply that declares no length: a multi-gigabyte answer is fully in memory before
+ * anything refuses it. Returns null when the body is over the limit.
+ */
+export declare function readCapped(response: Response, limit: number): Promise<string | null>;
+export declare class HttpClient {
+    readonly baseUrl: string;
+    private readonly apiKey;
+    private readonly timeout;
+    private readonly maxRetries;
+    private readonly _fetch;
+    constructor(config: HttpClientConfig);
+    request<T>(method: string, path: string, options?: {
+        body?: unknown;
+        query?: Record<string, QueryValue>;
+    }): Promise<T>;
+    get<T>(path: string, query?: Record<string, QueryValue>): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    put<T>(path: string, body?: unknown): Promise<T>;
+    del<T>(path: string): Promise<T>;
+    /**
+     * Raw fetch with auth + user-agent headers applied. Used for SSE streaming
+     * and other non-JSON responses. Does NOT retry, does NOT parse body, does
+     * NOT apply the default request timeout — the caller owns lifecycle via
+     * AbortSignal.
+     */
+    rawFetch(path: string, options?: {
+        headers?: Record<string, string>;
+        signal?: AbortSignal;
+        query?: Record<string, QueryValue>;
+    }): Promise<Response>;
+    /**
+     * Fetch a PUBLIC artifact by absolute url through the configured transport — no API key, no
+     * retries, redirects refused.
+     *
+     * The key is left off deliberately rather than forgotten: the issuer's status list is a shared
+     * document whose whole point is that reading it says nothing about WHICH proof is being checked
+     * (`docs/api-map.yaml`, the status-list endpoint is public). Sending a credential with it would
+     * hand the issuer the one fact the design withholds. Redirects are refused because the caller
+     * has already decided the url's origin is trusted, and a redirect would move it.
+     */
+    fetchPublic(url: string, options: {
+        timeoutMs: number;
+        headers?: Record<string, string>;
+    }): Promise<Response>;
+    private buildUrl;
+    private backoff;
+    private sleep;
+}
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/esm/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAExD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B1F;AAED,qBAAa,UAAU;IACrB,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;gBAErC,MAAM,EAAE,gBAAgB;IAQ9B,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;KACpC,GACA,OAAO,CAAC,CAAC,CAAC;IAuFb,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIpE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC;;;;;OAKG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAO,GAC3G,OAAO,CAAC,QAAQ,CAAC;IAUpB;;;;;;;;;OASG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAY7G,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,KAAK;CAGd"}