@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/esm/resources/auth-sessions.d.ts

@@ -0,0 +1,41 @@
+import type { HttpClient } from '../http.js';
+import { type StreamEvent, type StreamOptions } from '../streaming.js';
+/**
+ * Auth session resource envelope, as `retrieve()` returns it; shape is left
+ * open so callers can narrow to their dashboard/login flow's own type.
+ */
+export interface AuthSession {
+    id: string;
+    status: string;
+    [key: string]: unknown;
+}
+/** The `connected` frame of `authSessions.stream()`, written once when the connection opens. */
+export interface AuthSessionStreamConnected {
+    session_id: string;
+    status: string;
+    channel: string;
+}
+/** The `update` frame of `authSessions.stream()`: a status signal, not the session. */
+export interface AuthSessionStreamUpdate {
+    status: string;
+    timestamp: string;
+}
+export type AuthSessionStreamEvent = StreamEvent<'update', AuthSessionStreamConnected, AuthSessionStreamUpdate, AuthSession>;
+/**
+ * Dashboard-side authentication sessions (magic-link / QR login). The
+ * session ID itself acts as the bearer secret — no API key required for the
+ * SSE endpoint, but format is enforced server-side (`auth_[a-f0-9]{32}`).
+ */
+export declare class AuthSessions {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Retrieve an auth session by ID (polling fallback target). */
+    retrieve(id: string): Promise<AuthSession>;
+    /**
+     * Stream auth session status changes via Server-Sent Events: `connected` and
+     * `update` signals, not the session. When SSE is unavailable it falls back to
+     * polling `retrieve(id)` and yields the session as `poll` / `terminal` events.
+     */
+    stream(id: string, options?: StreamOptions): AsyncIterable<AuthSessionStreamEvent>;
+}
+//# sourceMappingURL=auth-sessions.d.ts.map

package/dist/esm/resources/auth-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-sessions.d.ts","sourceRoot":"","sources":["../../../src/resources/auth-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEvF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,QAAQ,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC;AAI7H;;;;GAIG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,aAAa,CAAC,sBAAsB,CAAC;CAQnF"}

package/dist/esm/resources/auth-sessions.js

@@ -0,0 +1,30 @@
+import { streamEndpoint } from '../streaming.js';
+const TERMINAL_STATES = ['verified', 'failed', 'expired'];
+/**
+ * Dashboard-side authentication sessions (magic-link / QR login). The
+ * session ID itself acts as the bearer secret — no API key required for the
+ * SSE endpoint, but format is enforced server-side (`auth_[a-f0-9]{32}`).
+ */
+export class AuthSessions {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Retrieve an auth session by ID (polling fallback target). */
+    retrieve(id) {
+        return this.http.get(`/api/v1/auth/sessions/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Stream auth session status changes via Server-Sent Events: `connected` and
+     * `update` signals, not the session. When SSE is unavailable it falls back to
+     * polling `retrieve(id)` and yields the session as `poll` / `terminal` events.
+     */
+    stream(id, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/auth/sessions/${encodeURIComponent(id)}/events`,
+            retrieve: () => this.retrieve(id),
+            terminalStates: TERMINAL_STATES,
+            label: `Auth session ${id}`,
+        }, options);
+    }
+}
+//# sourceMappingURL=auth-sessions.js.map

package/dist/esm/resources/auth-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-sessions.js","sourceRoot":"","sources":["../../../src/resources/auth-sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwC,MAAM,iBAAiB,CAAC;AA2BvF,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACvB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,gEAAgE;IAChE,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAc,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAU,EAAE,OAAuB;QACxC,OAAO,cAAc,CAAsC,IAAI,CAAC,IAAI,EAAE;YACpE,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,SAAS;YAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,cAAc,EAAE,eAAe;YAC/B,KAAK,EAAE,gBAAgB,EAAE,EAAE;SAC5B,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;CACF"}

package/dist/esm/resources/authorizations.d.ts

@@ -0,0 +1,23 @@
+import type { HttpClient } from '../http.js';
+import type { Authorization, CreateAuthorizationParams, AuthorizationListParams, AuthorizationListResponse, CreateAuthorizationResponse, AuthorizationExportParams, AuthorizationExportResponse, BinaryResponse } from '../types.js';
+export declare class Authorizations {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a new authorization request */
+    create(params: CreateAuthorizationParams): Promise<CreateAuthorizationResponse>;
+    /** Get an authorization by ID */
+    retrieve(id: string): Promise<Authorization>;
+    /** List authorizations with optional filters */
+    list(params?: AuthorizationListParams): Promise<AuthorizationListResponse>;
+    /** Revoke an authorization */
+    revoke(id: string, params?: {
+        reason?: string;
+    }): Promise<Authorization>;
+    /** Export authorizations as CSV — served as text/csv, returned as the binary envelope */
+    export(params: AuthorizationExportParams & {
+        format: 'csv';
+    }): Promise<BinaryResponse>;
+    /** Export authorizations as JSON */
+    export(params?: AuthorizationExportParams): Promise<AuthorizationExportResponse>;
+}
+//# sourceMappingURL=authorizations.d.ts.map

package/dist/esm/resources/authorizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.d.ts","sourceRoot":"","sources":["../../../src/resources/authorizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,aAAa,EACb,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,yCAAyC;IACzC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI/E,iCAAiC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAI5C,gDAAgD;IAChD,IAAI,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAI1E,8BAA8B;IAC9B,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAQxE,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IACtF,oCAAoC;IACpC,MAAM,CAAC,MAAM,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC;CAIjF"}

package/dist/esm/resources/authorizations.js

@@ -0,0 +1,25 @@
+export class Authorizations {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a new authorization request */
+    create(params) {
+        return this.http.post('/api/v1/authorizations', params);
+    }
+    /** Get an authorization by ID */
+    retrieve(id) {
+        return this.http.get(`/api/v1/authorizations/${encodeURIComponent(id)}`);
+    }
+    /** List authorizations with optional filters */
+    list(params) {
+        return this.http.get('/api/v1/authorizations', params);
+    }
+    /** Revoke an authorization */
+    revoke(id, params) {
+        return this.http.request('DELETE', `/api/v1/authorizations/${encodeURIComponent(id)}`, { body: params });
+    }
+    export(params) {
+        return this.http.get('/api/v1/authorizations/export', params);
+    }
+}
+//# sourceMappingURL=authorizations.js.map

package/dist/esm/resources/authorizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.js","sourceRoot":"","sources":["../../../src/resources/authorizations.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,cAAc;IACzB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,yCAAyC;IACzC,MAAM,CAAC,MAAiC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAA8B,wBAAwB,EAAE,MAAM,CAAC,CAAC;IACvF,CAAC;IAED,iCAAiC;IACjC,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAgB,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,MAAgC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA4B,wBAAwB,EAAE,MAA+D,CAAC,CAAC;IAC7I,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,EAAU,EAAE,MAA4B;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,QAAQ,EACR,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAClD,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;IACJ,CAAC;IAMD,MAAM,CAAC,MAAkC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA+C,+BAA+B,EAAE,MAA+D,CAAC,CAAC;IACvK,CAAC;CACF"}

package/dist/esm/resources/circles.d.ts

@@ -0,0 +1,38 @@
+import type { HttpClient } from '../http.js';
+import type { Circle, CreateCircleParams, UpdateCircleParams, CircleListParams, CircleListResponse, CircleMember, CircleMemberListResponse, CreateCircleMemberParams, CircleMemberInviteResponse, CircleMemberDrillResponse, AddCircleMemberChannelParams, CircleMemberChannel, CircleMemberChannelListResponse } from '../types.js';
+/**
+ * Circle people-primitive: named groups of trusted contacts, their members, and
+ * per-member channels. Member and channel responses expose reachability booleans
+ * only — an identifier is NEVER returned (SEC-PM-006).
+ */
+export declare class Circles {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a new Circle (optionally with initial members) */
+    create(params: CreateCircleParams): Promise<Circle>;
+    /** List Circles (archived excluded by default; pass `status: 'archived'` to surface them) */
+    list(params?: CircleListParams): Promise<CircleListResponse>;
+    /** Get a Circle by ID */
+    retrieve(id: string): Promise<Circle>;
+    /** Update a Circle's name (the profile binding is create-only) */
+    update(id: string, params: UpdateCircleParams): Promise<Circle>;
+    /** Archive a Circle (soft delete) */
+    archive(id: string): Promise<void>;
+    /** Add a pending member by name (+ an optional pre-declared WhatsApp phone) */
+    addMember(id: string, params: CreateCircleMemberParams): Promise<CircleMember>;
+    /** List a Circle's members (channel presence booleans and a masked enrollment phone only, never an identifier) */
+    listMembers(id: string): Promise<CircleMemberListResponse>;
+    /** Mint a single-use enrollment deep link (both channels + QR) for a member */
+    inviteMember(id: string, memberId: string): Promise<CircleMemberInviteResponse>;
+    /** Fire a cross-channel Proof-Me identity challenge against an enrolled member */
+    triggerDrill(id: string, memberId: string): Promise<CircleMemberDrillResponse>;
+    /** Remove a member (deletes its channels and revokes its live authorizations) */
+    removeMember(id: string, memberId: string): Promise<void>;
+    /** Declare a channel for a member (409 if that channel type already exists) */
+    addMemberChannel(id: string, memberId: string, params: AddCircleMemberChannelParams): Promise<CircleMemberChannel>;
+    /** List a member's channels (metadata only, never an identifier) */
+    listMemberChannels(id: string, memberId: string): Promise<CircleMemberChannelListResponse>;
+    /** Remove a member channel (removing the last channel is allowed) */
+    removeMemberChannel(id: string, memberId: string, channelId: string): Promise<void>;
+}
+//# sourceMappingURL=circles.d.ts.map

package/dist/esm/resources/circles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circles.d.ts","sourceRoot":"","sources":["../../../src/resources/circles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,EAC5B,mBAAmB,EACnB,+BAA+B,EAChC,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,4DAA4D;IAC5D,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,6FAA6F;IAC7F,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI5D,yBAAyB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,kEAAkE;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/D,qCAAqC;IACrC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAO9E,kHAAkH;IAClH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAM1D,+EAA+E;IAC/E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAO/E,kFAAkF;IAClF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM9E,iFAAiF;IACjF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD,+EAA+E;IAC/E,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAO/B,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAM1F,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKpF"}

package/dist/esm/resources/circles.js

@@ -0,0 +1,63 @@
+/**
+ * Circle people-primitive: named groups of trusted contacts, their members, and
+ * per-member channels. Member and channel responses expose reachability booleans
+ * only — an identifier is NEVER returned (SEC-PM-006).
+ */
+export class Circles {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a new Circle (optionally with initial members) */
+    create(params) {
+        return this.http.post('/api/v1/circles', params);
+    }
+    /** List Circles (archived excluded by default; pass `status: 'archived'` to surface them) */
+    list(params) {
+        return this.http.get('/api/v1/circles', params);
+    }
+    /** Get a Circle by ID */
+    retrieve(id) {
+        return this.http.get(`/api/v1/circles/${encodeURIComponent(id)}`);
+    }
+    /** Update a Circle's name (the profile binding is create-only) */
+    update(id, params) {
+        return this.http.request('PATCH', `/api/v1/circles/${encodeURIComponent(id)}`, { body: params });
+    }
+    /** Archive a Circle (soft delete) */
+    archive(id) {
+        return this.http.del(`/api/v1/circles/${encodeURIComponent(id)}`);
+    }
+    /** Add a pending member by name (+ an optional pre-declared WhatsApp phone) */
+    addMember(id, params) {
+        return this.http.post(`/api/v1/circles/${encodeURIComponent(id)}/members`, params);
+    }
+    /** List a Circle's members (channel presence booleans and a masked enrollment phone only, never an identifier) */
+    listMembers(id) {
+        return this.http.get(`/api/v1/circles/${encodeURIComponent(id)}/members`);
+    }
+    /** Mint a single-use enrollment deep link (both channels + QR) for a member */
+    inviteMember(id, memberId) {
+        return this.http.post(`/api/v1/circles/${encodeURIComponent(id)}/members/invite`, { member_id: memberId });
+    }
+    /** Fire a cross-channel Proof-Me identity challenge against an enrolled member */
+    triggerDrill(id, memberId) {
+        return this.http.post(`/api/v1/circles/${encodeURIComponent(id)}/members/${encodeURIComponent(memberId)}/drill`);
+    }
+    /** Remove a member (deletes its channels and revokes its live authorizations) */
+    removeMember(id, memberId) {
+        return this.http.del(`/api/v1/circles/${encodeURIComponent(id)}/members/${encodeURIComponent(memberId)}`);
+    }
+    /** Declare a channel for a member (409 if that channel type already exists) */
+    addMemberChannel(id, memberId, params) {
+        return this.http.post(`/api/v1/circles/${encodeURIComponent(id)}/members/${encodeURIComponent(memberId)}/channels`, params);
+    }
+    /** List a member's channels (metadata only, never an identifier) */
+    listMemberChannels(id, memberId) {
+        return this.http.get(`/api/v1/circles/${encodeURIComponent(id)}/members/${encodeURIComponent(memberId)}/channels`);
+    }
+    /** Remove a member channel (removing the last channel is allowed) */
+    removeMemberChannel(id, memberId, channelId) {
+        return this.http.del(`/api/v1/circles/${encodeURIComponent(id)}/members/${encodeURIComponent(memberId)}/channels/${encodeURIComponent(channelId)}`);
+    }
+}
+//# sourceMappingURL=circles.js.map

package/dist/esm/resources/circles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circles.js","sourceRoot":"","sources":["../../../src/resources/circles.ts"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,MAAM,OAAO,OAAO;IAClB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,4DAA4D;IAC5D,MAAM,CAAC,MAA0B;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAS,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,MAAyB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,yBAAyB;IACzB,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,EAAU,EAAE,MAA0B;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,OAAO,EACP,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAO,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,+EAA+E;IAC/E,SAAS,CAAC,EAAU,EAAE,MAAgC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,UAAU,EACnD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,kHAAkH;IAClH,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,UAAU,CACpD,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,YAAY,CAAC,EAAU,EAAE,QAAgB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,EAC1D,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,YAAY,CAAC,EAAU,EAAE,QAAgB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAC1F,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,YAAY,CAAC,EAAU,EAAE,QAAgB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gBAAgB,CACd,EAAU,EACV,QAAgB,EAChB,MAAoC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAC5F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,kBAAkB,CAAC,EAAU,EAAE,QAAgB;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAC7F,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,EAAU,EAAE,QAAgB,EAAE,SAAiB;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/confirmations.d.ts

@@ -0,0 +1,111 @@
+import type { HttpClient } from '../http.js';
+import { type StreamEvent, type StreamOptions } from '../streaming.js';
+import type { ApprovalLinkResponse, ConfirmAndWaitOptions } from '../types.js';
+/**
+ * A HITL confirmation as the API returns it (the OpenAPI `Confirmation`
+ * component). The live frames of `stream()` are content-free signals; read the
+ * full confirmation via `retrieve(id)` when one arrives.
+ */
+export interface Confirmation {
+    id: string;
+    hitl_id: string;
+    /** The stored ciphertext envelope, echoed back verbatim — never the plaintext sentence. */
+    message: string;
+    /** A timeout is `denied` with `response.channel` `'system'` and `response.text` `'timeout'`; there is no `expired` status. */
+    status: 'pending' | 'approved' | 'denied';
+    /** The approver's decision; null while pending. */
+    response?: {
+        action: 'approve' | 'deny';
+        /**
+         * The approver's optional comment, encrypted by the approval page: a ciphertext envelope (JSON).
+         * When `channel` is `'system'` no approver acted and this is the plaintext reason instead
+         * (`'timeout'`, `'key_rotated'`, `'config_archived'`).
+         */
+        text?: string | null;
+        channel?: string | null;
+        at: string;
+        /** The enrolled approver's Authorization that resolved it, verified server-side. */
+        authorization_id?: string | null;
+    } | null;
+    timeout_at?: string | null;
+    /** Signed proof of an approver's decision (approval or denial); null while pending and for a system denial. */
+    proof_token?: string | null;
+    resolved_at?: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface CreateConfirmationParams {
+    hitl_id: string;
+    message: string;
+    [key: string]: unknown;
+}
+export interface ConfirmationListParams {
+    /** A stored status, or `'expired'`: the confirmations that timed out (system denials for `'timeout'`, and pending rows past `timeout_at`). */
+    status?: 'pending' | 'approved' | 'denied' | 'expired';
+    limit?: number;
+    page?: number;
+    [key: string]: string | number | boolean | undefined;
+}
+export interface ConfirmationListResponse {
+    data: Confirmation[];
+    pagination: {
+        page: number;
+        limit: number;
+        total: number;
+        total_pages: number;
+    };
+}
+/** The `connected` frame of `confirmations.stream()`, written once when the connection opens. */
+export interface ConfirmationStreamConnected {
+    confirmation_id: string;
+    status: Confirmation['status'];
+}
+/** The `update` frame of `confirmations.stream()`: a resolution signal, not the confirmation. */
+export interface ConfirmationStreamUpdate {
+    type: 'resolved';
+    status: Confirmation['status'];
+    resolved_at?: string;
+}
+export type ConfirmationStreamEvent = StreamEvent<'update', ConfirmationStreamConnected, ConfirmationStreamUpdate, Confirmation>;
+export declare class Confirmations {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a new confirmation request */
+    create(params: CreateConfirmationParams): Promise<Confirmation>;
+    /** Get a confirmation by ID */
+    retrieve(id: string): Promise<Confirmation>;
+    /** List confirmations with optional filters */
+    list(params?: ConfirmationListParams): Promise<ConfirmationListResponse>;
+    /** Generate a fresh HMAC approval link for a pending confirmation */
+    approvalLink(id: string): Promise<ApprovalLinkResponse>;
+    /**
+     * Poll a confirmation until it reaches a terminal state (approved/denied/expired).
+     * Mirrors `verifications.waitForCompletion`. When `throwOnDenial` is set and the
+     * confirmation is denied, throws `ConfirmationDeniedError`; otherwise returns the
+     * terminal confirmation.
+     */
+    waitForResolution(id: string, options?: ConfirmAndWaitOptions): Promise<Confirmation>;
+    /**
+     * Encrypt a message with the HITL config's public key, create a confirmation,
+     * and poll until the approver resolves it — a one-call CI/CD approval gate.
+     *
+     * Uses the v1 (owner-key) envelope. If the HITL config has enrolled approvers,
+     * they cannot decrypt a v1 envelope (see docs/ENCRYPTION_ENVELOPE.md §2.5);
+     * v2 multi-recipient support is a planned follow-up.
+     *
+     * `throwOnDenial` defaults to `true` here (gate semantics): any terminal state
+     * other than `approved` — `denied`, including a timeout (the server records an
+     * unanswered confirmation as a system denial, `response.channel === 'system'`) —
+     * throws `ConfirmationDeniedError` rather than returning silently, so a CI/CD
+     * gate cannot pass on an un-approved confirmation. Pass `throwOnDenial: false`
+     * to receive the terminal confirmation and inspect `status` yourself.
+     */
+    createAndWait(hitlId: string, message: string, options?: ConfirmAndWaitOptions): Promise<Confirmation>;
+    /**
+     * Stream confirmation status changes via Server-Sent Events: a `connected`
+     * signal, then `update` signals, neither carrying the confirmation. When SSE is unavailable it falls back to polling
+     * `retrieve(id)` and yields the confirmation as `poll` / `terminal` events.
+     */
+    stream(id: string, options?: StreamOptions): AsyncIterable<ConfirmationStreamEvent>;
+}
+//# sourceMappingURL=confirmations.d.ts.map

package/dist/esm/resources/confirmations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmations.d.ts","sourceRoot":"","sources":["../../../src/resources/confirmations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIvF,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAoB,MAAM,aAAa,CAAC;AAEjG;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,8HAA8H;IAC9H,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,mDAAmD;IACnD,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B;;;;WAIG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;QACX,oFAAoF;QACpF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,GAAG,IAAI,CAAC;IACT,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+GAA+G;IAC/G,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,8IAA8I;IAC9I,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,iGAAiG;AACjG,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;CAChC;AAED,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,CAAC,QAAQ,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,YAAY,CAAC,CAAC;AAIjI,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,wCAAwC;IACxC,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAI/D,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI3C,+CAA+C;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAIxE,qEAAqE;IACrE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMvD;;;;;OAKG;IACG,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC;IAa3F;;;;;;;;;;;;;;OAcG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,YAAY,CAAC;IAiBxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,aAAa,CAAC,uBAAuB,CAAC;CAQpF"}

package/dist/esm/resources/confirmations.js

@@ -0,0 +1,82 @@
+import { streamEndpoint } from '../streaming.js';
+import { pollUntilComplete } from '../polling.js';
+import { encryptMessage } from '../crypto/hitl-crypto.js';
+import { ConfirmationDeniedError } from '../errors.js';
+const TERMINAL_STATES = ['approved', 'denied', 'expired'];
+export class Confirmations {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a new confirmation request */
+    create(params) {
+        return this.http.post('/api/v1/confirmations', params);
+    }
+    /** Get a confirmation by ID */
+    retrieve(id) {
+        return this.http.get(`/api/v1/confirmations/${encodeURIComponent(id)}`);
+    }
+    /** List confirmations with optional filters */
+    list(params) {
+        return this.http.get('/api/v1/confirmations', params);
+    }
+    /** Generate a fresh HMAC approval link for a pending confirmation */
+    approvalLink(id) {
+        return this.http.post(`/api/v1/confirmations/${encodeURIComponent(id)}/approval-link`);
+    }
+    /**
+     * Poll a confirmation until it reaches a terminal state (approved/denied/expired).
+     * Mirrors `verifications.waitForCompletion`. When `throwOnDenial` is set and the
+     * confirmation is denied, throws `ConfirmationDeniedError`; otherwise returns the
+     * terminal confirmation.
+     */
+    async waitForResolution(id, options) {
+        const confirmation = await pollUntilComplete(() => this.retrieve(id), TERMINAL_STATES, `Confirmation ${id}`, options);
+        if (options?.throwOnDenial && confirmation.status === 'denied') {
+            throw new ConfirmationDeniedError(id, confirmation.status);
+        }
+        return confirmation;
+    }
+    /**
+     * Encrypt a message with the HITL config's public key, create a confirmation,
+     * and poll until the approver resolves it — a one-call CI/CD approval gate.
+     *
+     * Uses the v1 (owner-key) envelope. If the HITL config has enrolled approvers,
+     * they cannot decrypt a v1 envelope (see docs/ENCRYPTION_ENVELOPE.md §2.5);
+     * v2 multi-recipient support is a planned follow-up.
+     *
+     * `throwOnDenial` defaults to `true` here (gate semantics): any terminal state
+     * other than `approved` — `denied`, including a timeout (the server records an
+     * unanswered confirmation as a system denial, `response.channel === 'system'`) —
+     * throws `ConfirmationDeniedError` rather than returning silently, so a CI/CD
+     * gate cannot pass on an un-approved confirmation. Pass `throwOnDenial: false`
+     * to receive the terminal confirmation and inspect `status` yourself.
+     */
+    async createAndWait(hitlId, message, options) {
+        const keys = await this.http.get(`/api/v1/hitl/${encodeURIComponent(hitlId)}/keys`);
+        const envelope = encryptMessage(message, keys.public_key, hitlId);
+        const created = await this.create({
+            hitl_id: hitlId,
+            message: JSON.stringify(envelope),
+            ...(options?.proofExpiryDays !== undefined ? { proof_expiry_days: options.proofExpiryDays } : {}),
+        });
+        const resolved = await this.waitForResolution(created.id, { ...options, throwOnDenial: false });
+        if ((options?.throwOnDenial ?? true) && resolved.status !== 'approved') {
+            throw new ConfirmationDeniedError(created.id, resolved.status);
+        }
+        return resolved;
+    }
+    /**
+     * Stream confirmation status changes via Server-Sent Events: a `connected`
+     * signal, then `update` signals, neither carrying the confirmation. When SSE is unavailable it falls back to polling
+     * `retrieve(id)` and yields the confirmation as `poll` / `terminal` events.
+     */
+    stream(id, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/confirmations/${encodeURIComponent(id)}/events`,
+            retrieve: () => this.retrieve(id),
+            terminalStates: TERMINAL_STATES,
+            label: `Confirmation ${id}`,
+        }, options);
+    }
+}
+//# sourceMappingURL=confirmations.js.map

package/dist/esm/resources/confirmations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmations.js","sourceRoot":"","sources":["../../../src/resources/confirmations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwC,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAuEvD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEnE,MAAM,OAAO,aAAa;IACxB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,wCAAwC;IACxC,MAAM,CAAC,MAAgC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAe,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,+BAA+B;IAC/B,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,MAA+B;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA2B,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,qEAAqE;IACrE,YAAY,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,CAChE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,OAA+B;QACjE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,eAAe,EACf,gBAAgB,EAAE,EAAE,EACpB,OAAO,CACR,CAAC;QACF,IAAI,OAAO,EAAE,aAAa,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,uBAAuB,CAAC,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAAe,EACf,OAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAClD,CAAC;QACF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjC,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAU,EAAE,OAAuB;QACxC,OAAO,cAAc,CAAwC,IAAI,CAAC,IAAI,EAAE;YACtE,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,SAAS;YAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,cAAc,EAAE,eAAe;YAC/B,KAAK,EAAE,gBAAgB,EAAE,EAAE;SAC5B,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;CACF"}

package/dist/esm/resources/delegations.d.ts

@@ -0,0 +1,36 @@
+import type { HttpClient } from '../http.js';
+import type { CreateDelegationParams, DelegationDetail, DelegationListItem, DelegationListParams, DelegationListResponse, RevokeDelegationParams } from '../types.js';
+/**
+ * Delegations — Proof of Delegation. A control-proven domain authorizes a typed
+ * url/purl artifact for a set of capability scopes; the attestation is that the
+ * domain's controller authorized the artifact, nothing more.
+ */
+export declare class Delegations {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Create a delegation from your active domain control proof (each mint is a billable proof).
+     *
+     * The result carries the publishable token AND the derived `effective_status`/`is_valid`,
+     * the same pair the reads carry — the shape does not depend on the verb.
+     */
+    create(params: CreateDelegationParams): Promise<DelegationDetail>;
+    /**
+     * List your own delegations (tokens are not included in the list).
+     *
+     * Each item carries the DERIVED `effective_status`/`is_valid` beside its stored `status` —
+     * render the derived one. `params.status` filters the stored record only.
+     */
+    list(params?: DelegationListParams): Promise<DelegationListResponse>;
+    /** Get a delegation by Mongo id or `ph_dlg_*` handle — returns the stored token and derived status */
+    retrieve(id: string): Promise<DelegationDetail>;
+    /**
+     * Revoke one delegation — the domain proof and sibling delegations stay valid.
+     *
+     * Idempotent: a repeat revoke answers 200 with the same body, here and on
+     * `POST /proofs/{handle}/revoke`. (A PROOF differs deliberately — that one answers
+     * `400 already_revoked`.) The result carries the derived `effective_status`/`is_valid`.
+     */
+    revoke(id: string, params?: RevokeDelegationParams): Promise<DelegationListItem>;
+}
+//# sourceMappingURL=delegations.d.ts.map

package/dist/esm/resources/delegations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegations.d.ts","sourceRoot":"","sources":["../../../src/resources/delegations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIjE;;;;;OAKG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAIpE,sGAAsG;IACtG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI/C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAGjF"}

package/dist/esm/resources/delegations.js

@@ -0,0 +1,43 @@
+/**
+ * Delegations — Proof of Delegation. A control-proven domain authorizes a typed
+ * url/purl artifact for a set of capability scopes; the attestation is that the
+ * domain's controller authorized the artifact, nothing more.
+ */
+export class Delegations {
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * Create a delegation from your active domain control proof (each mint is a billable proof).
+     *
+     * The result carries the publishable token AND the derived `effective_status`/`is_valid`,
+     * the same pair the reads carry — the shape does not depend on the verb.
+     */
+    create(params) {
+        return this.http.post('/api/v1/delegations', params);
+    }
+    /**
+     * List your own delegations (tokens are not included in the list).
+     *
+     * Each item carries the DERIVED `effective_status`/`is_valid` beside its stored `status` —
+     * render the derived one. `params.status` filters the stored record only.
+     */
+    list(params) {
+        return this.http.get('/api/v1/delegations', params);
+    }
+    /** Get a delegation by Mongo id or `ph_dlg_*` handle — returns the stored token and derived status */
+    retrieve(id) {
+        return this.http.get(`/api/v1/delegations/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Revoke one delegation — the domain proof and sibling delegations stay valid.
+     *
+     * Idempotent: a repeat revoke answers 200 with the same body, here and on
+     * `POST /proofs/{handle}/revoke`. (A PROOF differs deliberately — that one answers
+     * `400 already_revoked`.) The result carries the derived `effective_status`/`is_valid`.
+     */
+    revoke(id, params) {
+        return this.http.post(`/api/v1/delegations/${encodeURIComponent(id)}/revoke`, params);
+    }
+}
+//# sourceMappingURL=delegations.js.map

package/dist/esm/resources/delegations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegations.js","sourceRoot":"","sources":["../../../src/resources/delegations.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACtB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,MAA8B;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAmB,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAA6B;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,qBAAqB,EAAE,MAA+D,CAAC,CAAC;IACvI,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAU,EAAE,MAA+B;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAqB,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5G,CAAC;CACF"}

package/dist/esm/resources/hitl-chat-id.d.ts

@@ -0,0 +1,42 @@
+import type { HttpClient } from '../http.js';
+import { type StreamEvent, type StreamOptions } from '../streaming.js';
+import type { ChatIdDiscoveryCreateResponse } from '../types.js';
+/** HITL chat-ID discovery session response shape. */
+export interface ChatIdDiscovery {
+    token: string;
+    status: string;
+    chat_id?: string | null;
+    [key: string]: unknown;
+}
+/** The `connected` frame of `hitlChatIdDiscovery.stream()`, written once when the connection opens. */
+export interface ChatIdDiscoveryStreamConnected {
+    token: string;
+    status: string;
+    chat_id?: string;
+}
+/** The `update` frame of `hitlChatIdDiscovery.stream()`: a status signal, not the discovery. */
+export interface ChatIdDiscoveryStreamUpdate {
+    status: string;
+    timestamp: string;
+    chat_id?: string;
+}
+export type ChatIdDiscoveryStreamEvent = StreamEvent<'update', ChatIdDiscoveryStreamConnected, ChatIdDiscoveryStreamUpdate, ChatIdDiscovery>;
+/**
+ * HITL Telegram chat-ID discovery session stream. Tokens are short-lived
+ * and scoped per-user. The polling fallback hits the poll endpoint
+ * `/api/v1/hitl/chat-id-discovery/:token`.
+ */
+export declare class HitlChatIdDiscovery {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a chat-ID discovery token (Telegram deeplink + QR code). */
+    create(): Promise<ChatIdDiscoveryCreateResponse>;
+    /** Retrieve chat-ID discovery status by token (polling fallback target). */
+    retrieve(token: string): Promise<ChatIdDiscovery>;
+    /**
+     * Stream chat-ID discovery status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the discovery as `poll` / `terminal`.
+     */
+    stream(token: string, options?: StreamOptions): AsyncIterable<ChatIdDiscoveryStreamEvent>;
+}
+//# sourceMappingURL=hitl-chat-id.d.ts.map

package/dist/esm/resources/hitl-chat-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-chat-id.d.ts","sourceRoot":"","sources":["../../../src/resources/hitl-chat-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAEjE,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uGAAuG;AACvG,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gGAAgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,QAAQ,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,eAAe,CAAC,CAAC;AAI7I;;;;GAIG;AACH,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,sEAAsE;IACtE,MAAM,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAIhD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMjD;;;OAGG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,aAAa,CAAC,0BAA0B,CAAC;CAQ7C"}

package/dist/esm/resources/hitl-chat-id.js

@@ -0,0 +1,33 @@
+import { streamEndpoint } from '../streaming.js';
+const TERMINAL_STATES = ['completed', 'expired'];
+/**
+ * HITL Telegram chat-ID discovery session stream. Tokens are short-lived
+ * and scoped per-user. The polling fallback hits the poll endpoint
+ * `/api/v1/hitl/chat-id-discovery/:token`.
+ */
+export class HitlChatIdDiscovery {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a chat-ID discovery token (Telegram deeplink + QR code). */
+    create() {
+        return this.http.post('/api/v1/hitl/chat-id-discovery');
+    }
+    /** Retrieve chat-ID discovery status by token (polling fallback target). */
+    retrieve(token) {
+        return this.http.get(`/api/v1/hitl/chat-id-discovery/${encodeURIComponent(token)}`);
+    }
+    /**
+     * Stream chat-ID discovery status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the discovery as `poll` / `terminal`.
+     */
+    stream(token, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/hitl/chat-id-discovery/${encodeURIComponent(token)}/events`,
+            retrieve: () => this.retrieve(token),
+            terminalStates: TERMINAL_STATES,
+            label: `Chat ID discovery ${token}`,
+        }, options);
+    }
+}
+//# sourceMappingURL=hitl-chat-id.js.map