@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/esm/resources/hitl-chat-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-chat-id.js","sourceRoot":"","sources":["../../../src/resources/hitl-chat-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwC,MAAM,iBAAiB,CAAC;AA2BvF,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,SAAS,CAAU,CAAC;AAE1D;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC9B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,sEAAsE;IACtE,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAgC,gCAAgC,CAAC,CAAC;IACzF,CAAC;IAED,4EAA4E;IAC5E,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,kCAAkC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,KAAa,EACb,OAAuB;QAEvB,OAAO,cAAc,CAA8C,IAAI,CAAC,IAAI,EAAE;YAC5E,IAAI,EAAE,kCAAkC,kBAAkB,CAAC,KAAK,CAAC,SAAS;YAC1E,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,cAAc,EAAE,eAAe;YAC/B,KAAK,EAAE,qBAAqB,KAAK,EAAE;SACpC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;CACF"}

package/dist/esm/resources/hitl-keys.d.ts

@@ -0,0 +1,13 @@
+import type { HttpClient } from '../http.js';
+import type { HitlKeysResponse, HitlKeysPutResponse, HitlKeysDeleteResponse, HitlKeysPutParams } from '../types.js';
+export declare class HitlKeys {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get encryption keypair for a HITL config */
+    get(hitlId: string): Promise<HitlKeysResponse>;
+    /** Upload encryption keypair for a HITL config */
+    upload(hitlId: string, params: HitlKeysPutParams): Promise<HitlKeysPutResponse>;
+    /** Delete encryption keypair from a HITL config */
+    delete(hitlId: string): Promise<HitlKeysDeleteResponse>;
+}
+//# sourceMappingURL=hitl-keys.d.ts.map

package/dist/esm/resources/hitl-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-keys.d.ts","sourceRoot":"","sources":["../../../src/resources/hitl-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,+CAA+C;IAC/C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI9C,kDAAkD;IAClD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI/E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAGxD"}

package/dist/esm/resources/hitl-keys.js

@@ -0,0 +1,18 @@
+export class HitlKeys {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Get encryption keypair for a HITL config */
+    get(hitlId) {
+        return this.http.get(`/api/v1/hitl/${encodeURIComponent(hitlId)}/keys`);
+    }
+    /** Upload encryption keypair for a HITL config */
+    upload(hitlId, params) {
+        return this.http.put(`/api/v1/hitl/${encodeURIComponent(hitlId)}/keys`, params);
+    }
+    /** Delete encryption keypair from a HITL config */
+    delete(hitlId) {
+        return this.http.del(`/api/v1/hitl/${encodeURIComponent(hitlId)}/keys`);
+    }
+}
+//# sourceMappingURL=hitl-keys.js.map

package/dist/esm/resources/hitl-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-keys.js","sourceRoot":"","sources":["../../../src/resources/hitl-keys.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,QAAQ;IACnB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,+CAA+C;IAC/C,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,kDAAkD;IAClD,MAAM,CAAC,MAAc,EAAE,MAAyB;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvG,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClG,CAAC;CACF"}

package/dist/esm/resources/hitl.d.ts

@@ -0,0 +1,39 @@
+import type { HttpClient } from '../http.js';
+import type { HitlConfig, CreateHitlParams, UpdateHitlParams, HitlListParams, HitlListResponse, HitlAuthorizationResponse, HitlFinalizeResponse, HitlApproverKeysResponse } from '../types.js';
+/**
+ * HITL config CRUD. Configs are created in `pending` status; upload an
+ * encryption keypair (see `hitlKeys`) and call `finalize(id)` to activate.
+ */
+export declare class Hitl {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a new HITL configuration (starts in `pending` status) */
+    create(params: CreateHitlParams): Promise<HitlConfig>;
+    /** List HITL configurations with optional filters */
+    list(params?: HitlListParams): Promise<HitlListResponse>;
+    /** Get a HITL configuration by ID */
+    retrieve(id: string): Promise<HitlConfig>;
+    /** Update a HITL configuration's name, channels, or timeout */
+    update(id: string, params: UpdateHitlParams): Promise<HitlConfig>;
+    /** Archive a HITL configuration (soft delete; returns the archived config) */
+    archive(id: string): Promise<HitlConfig>;
+    /**
+     * Finalize a pending HITL configuration (pending → active). Requires an
+     * uploaded encryption keypair; dispatches authorization consent messages.
+     */
+    finalize(id: string): Promise<HitlFinalizeResponse>;
+    /**
+     * Request authorization consent for channels in an active HITL config
+     * that don't have one yet.
+     */
+    requestAuthorization(id: string): Promise<HitlAuthorizationResponse>;
+    /**
+     * List enrolled approver public keys for a config. Feed these into
+     * `encryptMessageV2` to wrap a confirmation message for every approver.
+     *
+     * A key holding `confirmations:create` without `hitl:read` receives each entry as
+     * `{ authorization_id, public_key, kid }` only — `recipient` and `channel` are omitted.
+     */
+    getApproverKeys(id: string): Promise<HitlApproverKeysResponse>;
+}
+//# sourceMappingURL=hitl.d.ts.map

package/dist/esm/resources/hitl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl.d.ts","sourceRoot":"","sources":["../../../src/resources/hitl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,qBAAa,IAAI;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,mEAAmE;IACnE,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAIrD,qDAAqD;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIxD,qCAAqC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIzC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAQjE,8EAA8E;IAC9E,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxC;;;OAGG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMnD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAMpE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAK/D"}

package/dist/esm/resources/hitl.js

@@ -0,0 +1,54 @@
+/**
+ * HITL config CRUD. Configs are created in `pending` status; upload an
+ * encryption keypair (see `hitlKeys`) and call `finalize(id)` to activate.
+ */
+export class Hitl {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a new HITL configuration (starts in `pending` status) */
+    create(params) {
+        return this.http.post('/api/v1/hitl', params);
+    }
+    /** List HITL configurations with optional filters */
+    list(params) {
+        return this.http.get('/api/v1/hitl', params);
+    }
+    /** Get a HITL configuration by ID */
+    retrieve(id) {
+        return this.http.get(`/api/v1/hitl/${encodeURIComponent(id)}`);
+    }
+    /** Update a HITL configuration's name, channels, or timeout */
+    update(id, params) {
+        return this.http.request('PATCH', `/api/v1/hitl/${encodeURIComponent(id)}`, { body: params });
+    }
+    /** Archive a HITL configuration (soft delete; returns the archived config) */
+    archive(id) {
+        return this.http.del(`/api/v1/hitl/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Finalize a pending HITL configuration (pending → active). Requires an
+     * uploaded encryption keypair; dispatches authorization consent messages.
+     */
+    finalize(id) {
+        return this.http.post(`/api/v1/hitl/${encodeURIComponent(id)}/finalize`);
+    }
+    /**
+     * Request authorization consent for channels in an active HITL config
+     * that don't have one yet.
+     */
+    requestAuthorization(id) {
+        return this.http.post(`/api/v1/hitl/${encodeURIComponent(id)}/authorize`);
+    }
+    /**
+     * List enrolled approver public keys for a config. Feed these into
+     * `encryptMessageV2` to wrap a confirmation message for every approver.
+     *
+     * A key holding `confirmations:create` without `hitl:read` receives each entry as
+     * `{ authorization_id, public_key, kid }` only — `recipient` and `channel` are omitted.
+     */
+    getApproverKeys(id) {
+        return this.http.get(`/api/v1/hitl/${encodeURIComponent(id)}/approver-keys`);
+    }
+}
+//# sourceMappingURL=hitl.js.map

package/dist/esm/resources/hitl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl.js","sourceRoot":"","sources":["../../../src/resources/hitl.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,MAAM,OAAO,IAAI;IACf,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,mEAAmE;IACnE,MAAM,CAAC,MAAwB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAa,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,MAAuB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,cAAc,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,qCAAqC;IACrC,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAa,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,EAAU,EAAE,MAAwB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,OAAO,EACP,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EACxC,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAa,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAClD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,YAAY,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,CACvD,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/me.d.ts

@@ -0,0 +1,102 @@
+import type { HttpClient } from '../http.js';
+import { type StreamEvent, type StreamOptions } from '../streaming.js';
+import type { ApiKeyMetadata, ApiKeyUsage, MeEnvironmentParams, MeSearchParams, MeSearchResults, PlatformSummary } from '../types.js';
+/** Dashboard-side add-phone session. */
+export interface PhoneAddSession {
+    id: string;
+    status: string;
+    [key: string]: unknown;
+}
+/** Dashboard-side add-email session. */
+export interface EmailAddSession {
+    id: string;
+    status: string;
+    [key: string]: unknown;
+}
+/** Dashboard-side 2FA challenge session. */
+export interface TwoFASession {
+    id: string;
+    status: string;
+    [key: string]: unknown;
+}
+/** The `connected` frame of `me.streamPhoneAddSession()`, written once when the connection opens. */
+export interface PhoneAddSessionStreamConnected {
+    session_id: string;
+    status: string;
+    channel: string;
+}
+/** The `update` frame of `me.streamPhoneAddSession()`: a status signal, not the session. */
+export interface PhoneAddSessionStreamUpdate {
+    status: string;
+    timestamp: string;
+    phone_number?: string;
+}
+export type PhoneAddSessionStreamEvent = StreamEvent<'update', PhoneAddSessionStreamConnected, PhoneAddSessionStreamUpdate, PhoneAddSession>;
+/** The `connected` frame of `me.streamEmailAddSession()`, written once when the connection opens. */
+export interface EmailAddSessionStreamConnected {
+    session_id: string;
+    status: string;
+    email: string;
+    channel: string;
+}
+/** The `update` frame of `me.streamEmailAddSession()`: a status signal, not the session. */
+export interface EmailAddSessionStreamUpdate {
+    status: string;
+    timestamp: string;
+    email?: string;
+}
+export type EmailAddSessionStreamEvent = StreamEvent<'update', EmailAddSessionStreamConnected, EmailAddSessionStreamUpdate, EmailAddSession>;
+/** The `connected` frame of `me.stream2FASession()`, written once when the connection opens. */
+export interface TwoFASessionStreamConnected {
+    session_id: string;
+    status: string;
+    action_type: string;
+}
+/** The `update` frame of `me.stream2FASession()`: a status signal, not the session. */
+export interface TwoFASessionStreamUpdate {
+    status: string;
+    timestamp: string;
+}
+export type TwoFASessionStreamEvent = StreamEvent<'update', TwoFASessionStreamConnected, TwoFASessionStreamUpdate, TwoFASession>;
+/**
+ * `/me` account-management resources: phone/email add flows and 2FA. All
+ * endpoints are JWT-authenticated and scoped to the current user on the
+ * backend, so the SDK just forwards the session ID.
+ */
+export declare class Me {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Retrieve an add-phone session (polling fallback). */
+    retrievePhoneAddSession(sessionId: string): Promise<PhoneAddSession>;
+    /** Retrieve an add-email session (polling fallback). */
+    retrieveEmailAddSession(sessionId: string): Promise<EmailAddSession>;
+    /** Retrieve a 2FA session (polling fallback). */
+    retrieve2FASession(sessionId: string): Promise<TwoFASession>;
+    /**
+     * Stream phone-add session status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the session as `poll` / `terminal`.
+     */
+    streamPhoneAddSession(sessionId: string, options?: StreamOptions): AsyncIterable<PhoneAddSessionStreamEvent>;
+    /**
+     * Stream email-add session status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the session as `poll` / `terminal`.
+     */
+    streamEmailAddSession(sessionId: string, options?: StreamOptions): AsyncIterable<EmailAddSessionStreamEvent>;
+    /**
+     * Stream 2FA session status via SSE (`connected` / `update` signals), with a
+     * polling fallback that yields the session as `poll` / `terminal`.
+     */
+    stream2FASession(sessionId: string, options?: StreamOptions): AsyncIterable<TwoFASessionStreamEvent>;
+    /** One-call account snapshot: quota + EoM projection, request health, channel stats, HITL counts, active keys. */
+    summary(params?: MeEnvironmentParams): Promise<PlatformSummary>;
+    /** Prefix-anchored global account search across six resource buckets. */
+    search(params: MeSearchParams): Promise<MeSearchResults>;
+    /** Retrieve the calling API key's own redacted metadata (agent self-inspection). */
+    apiKeySelf(): Promise<ApiKeyMetadata>;
+    /**
+     * Per-API-key usage counts (verifications/requests/confirmations/authorizations) plus attribution
+     * context, for the key and every key it replaced (`api_key.replaced_key_ids`).
+     */
+    apiKeyUsage(id: string, params?: MeEnvironmentParams): Promise<ApiKeyUsage>;
+}
+//# sourceMappingURL=me.d.ts.map

package/dist/esm/resources/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/resources/me.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qGAAqG;AACrG,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,QAAQ,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,eAAe,CAAC,CAAC;AAE7I,qGAAqG;AACrG,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,QAAQ,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,eAAe,CAAC,CAAC;AAE7I,gGAAgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,uFAAuF;AACvF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,CAAC,QAAQ,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,YAAY,CAAC,CAAC;AAIjI;;;;GAIG;AACH,qBAAa,EAAE;IACD,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,wDAAwD;IACxD,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpE,wDAAwD;IACxD,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpE,iDAAiD;IACjD,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI5D;;;OAGG;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,GACtB,aAAa,CAAC,0BAA0B,CAAC;IAS5C;;;OAGG;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,GACtB,aAAa,CAAC,0BAA0B,CAAC;IAS5C;;;OAGG;IACH,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,GACtB,aAAa,CAAC,uBAAuB,CAAC;IAWzC,kHAAkH;IAClH,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI/D,yEAAyE;IACzE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAIxD,oFAAoF;IACpF,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAIrC;;;OAGG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;CAG5E"}

package/dist/esm/resources/me.js

@@ -0,0 +1,81 @@
+import { streamEndpoint } from '../streaming.js';
+const SESSION_TERMINAL_STATES = ['verified', 'failed', 'expired'];
+/**
+ * `/me` account-management resources: phone/email add flows and 2FA. All
+ * endpoints are JWT-authenticated and scoped to the current user on the
+ * backend, so the SDK just forwards the session ID.
+ */
+export class Me {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Retrieve an add-phone session (polling fallback). */
+    retrievePhoneAddSession(sessionId) {
+        return this.http.get(`/api/v1/me/phones/add/${encodeURIComponent(sessionId)}`);
+    }
+    /** Retrieve an add-email session (polling fallback). */
+    retrieveEmailAddSession(sessionId) {
+        return this.http.get(`/api/v1/me/emails/add/${encodeURIComponent(sessionId)}`);
+    }
+    /** Retrieve a 2FA session (polling fallback). */
+    retrieve2FASession(sessionId) {
+        return this.http.get(`/api/v1/me/2fa/${encodeURIComponent(sessionId)}`);
+    }
+    /**
+     * Stream phone-add session status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the session as `poll` / `terminal`.
+     */
+    streamPhoneAddSession(sessionId, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/me/phones/add/${encodeURIComponent(sessionId)}/events`,
+            retrieve: () => this.retrievePhoneAddSession(sessionId),
+            terminalStates: SESSION_TERMINAL_STATES,
+            label: `Phone-add session ${sessionId}`,
+        }, options);
+    }
+    /**
+     * Stream email-add session status via SSE (`connected` / `update` signals),
+     * with a polling fallback that yields the session as `poll` / `terminal`.
+     */
+    streamEmailAddSession(sessionId, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/me/emails/add/${encodeURIComponent(sessionId)}/events`,
+            retrieve: () => this.retrieveEmailAddSession(sessionId),
+            terminalStates: SESSION_TERMINAL_STATES,
+            label: `Email-add session ${sessionId}`,
+        }, options);
+    }
+    /**
+     * Stream 2FA session status via SSE (`connected` / `update` signals), with a
+     * polling fallback that yields the session as `poll` / `terminal`.
+     */
+    stream2FASession(sessionId, options) {
+        return streamEndpoint(this.http, {
+            path: `/api/v1/me/2fa/${encodeURIComponent(sessionId)}/events`,
+            retrieve: () => this.retrieve2FASession(sessionId),
+            terminalStates: SESSION_TERMINAL_STATES,
+            label: `2FA session ${sessionId}`,
+        }, options);
+    }
+    // --- Dashboard / agent data surface (dual-auth: JWT or API key) ---
+    /** One-call account snapshot: quota + EoM projection, request health, channel stats, HITL counts, active keys. */
+    summary(params) {
+        return this.http.get('/api/v1/me/summary', params);
+    }
+    /** Prefix-anchored global account search across six resource buckets. */
+    search(params) {
+        return this.http.get('/api/v1/me/search', params);
+    }
+    /** Retrieve the calling API key's own redacted metadata (agent self-inspection). */
+    apiKeySelf() {
+        return this.http.get('/api/v1/me/api-key');
+    }
+    /**
+     * Per-API-key usage counts (verifications/requests/confirmations/authorizations) plus attribution
+     * context, for the key and every key it replaced (`api_key.replaced_key_ids`).
+     */
+    apiKeyUsage(id, params) {
+        return this.http.get(`/api/v1/me/api-keys/${encodeURIComponent(id)}/usage`, params);
+    }
+}
+//# sourceMappingURL=me.js.map

package/dist/esm/resources/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../../src/resources/me.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwC,MAAM,iBAAiB,CAAC;AA+EvF,MAAM,uBAAuB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAE3E;;;;GAIG;AACH,MAAM,OAAO,EAAE;IACb,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,wDAAwD;IACxD,uBAAuB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,wDAAwD;IACxD,uBAAuB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,iDAAiD;IACjD,kBAAkB,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAiB,EACjB,OAAuB;QAEvB,OAAO,cAAc,CAA8C,IAAI,CAAC,IAAI,EAAE;YAC5E,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,SAAS;YACrE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YACvD,cAAc,EAAE,uBAAuB;YACvC,KAAK,EAAE,qBAAqB,SAAS,EAAE;SACxC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAiB,EACjB,OAAuB;QAEvB,OAAO,cAAc,CAA8C,IAAI,CAAC,IAAI,EAAE;YAC5E,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,SAAS;YACrE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YACvD,cAAc,EAAE,uBAAuB;YACvC,KAAK,EAAE,qBAAqB,SAAS,EAAE;SACxC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,gBAAgB,CACd,SAAiB,EACjB,OAAuB;QAEvB,OAAO,cAAc,CAAwC,IAAI,CAAC,IAAI,EAAE;YACtE,IAAI,EAAE,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,SAAS;YAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAClD,cAAc,EAAE,uBAAuB;YACvC,KAAK,EAAE,eAAe,SAAS,EAAE;SAClC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,qEAAqE;IAErE,kHAAkH;IAClH,OAAO,CAAC,MAA4B;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,oBAAoB,EAAE,MAA+D,CAAC,CAAC;IAC/H,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAsB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,mBAAmB,EAAE,MAA0E,CAAC,CAAC;IACzI,CAAC;IAED,oFAAoF;IACpF,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,EAAU,EAAE,MAA4B;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAc,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAA+D,CAAC,CAAC;IAC5J,CAAC;CACF"}

package/dist/esm/resources/profiles.d.ts

@@ -0,0 +1,47 @@
+import type { HttpClient } from '../http.js';
+import type { Profile, CreateProfileParams, UpdateProfileParams, ProfileListResponse, ProfileDeleteResponse, ProfileTemplate, ProfileTemplateListResponse, ProfileTemplateUpdateParams, ProfileTemplatePreviewParams, ProfileTemplatePreviewResponse, TemplateChannel, TemplateMessageType } from '../types.js';
+export declare class Profiles {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List all profiles for the authenticated user */
+    list(): Promise<ProfileListResponse>;
+    /** Create a new profile */
+    create(params?: CreateProfileParams): Promise<Profile>;
+    /** Get a profile by ID */
+    retrieve(profileId: string): Promise<Profile>;
+    /** Update a profile */
+    update(profileId: string, params: UpdateProfileParams): Promise<Profile>;
+    /** Delete a profile */
+    delete(profileId: string): Promise<ProfileDeleteResponse>;
+    /** Set a profile as the primary profile */
+    setPrimary(profileId: string): Promise<Profile>;
+    /**
+     * List a profile's message templates (custom and default)
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.list({ profileId })`.
+     */
+    listTemplates(profileId: string): Promise<ProfileTemplateListResponse>;
+    /**
+     * Create or update a profile template for a channel/message type
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.upsert(channel, messageType, content, { profileId })`.
+     */
+    updateTemplate(profileId: string, channel: TemplateChannel, type: TemplateMessageType, params: ProfileTemplateUpdateParams): Promise<ProfileTemplate>;
+    /**
+     * Delete a profile template (resets to default)
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.delete(channel, messageType, { profileId })`.
+     */
+    deleteTemplate(profileId: string, channel: TemplateChannel, type: TemplateMessageType): Promise<ProfileTemplate>;
+    /**
+     * Preview a profile template with the profile's branding
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.preview(params, { profileId })`.
+     */
+    previewTemplate(profileId: string, params: ProfileTemplatePreviewParams): Promise<ProfileTemplatePreviewResponse>;
+}
+//# sourceMappingURL=profiles.d.ts.map

package/dist/esm/resources/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/resources/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAC;AAErB,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,mDAAmD;IACnD,IAAI,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIpC,2BAA2B;IAC3B,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAItD,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,uBAAuB;IACvB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQxE,uBAAuB;IACvB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIzD,2CAA2C;IAC3C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/C;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMtE;;;;;OAKG;IACH,cAAc,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,eAAe,CAAC;IAO3B;;;;;OAKG;IACH,cAAc,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC;IAM3B;;;;;OAKG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,8BAA8B,CAAC;CAM3C"}

package/dist/esm/resources/profiles.js

@@ -0,0 +1,66 @@
+export class Profiles {
+    constructor(http) {
+        this.http = http;
+    }
+    /** List all profiles for the authenticated user */
+    list() {
+        return this.http.get('/api/v1/me/profiles');
+    }
+    /** Create a new profile */
+    create(params) {
+        return this.http.post('/api/v1/me/profiles', params);
+    }
+    /** Get a profile by ID */
+    retrieve(profileId) {
+        return this.http.get(`/api/v1/me/profiles/${encodeURIComponent(profileId)}`);
+    }
+    /** Update a profile */
+    update(profileId, params) {
+        return this.http.request('PATCH', `/api/v1/me/profiles/${encodeURIComponent(profileId)}`, { body: params });
+    }
+    /** Delete a profile */
+    delete(profileId) {
+        return this.http.del(`/api/v1/me/profiles/${encodeURIComponent(profileId)}`);
+    }
+    /** Set a profile as the primary profile */
+    setPrimary(profileId) {
+        return this.http.post(`/api/v1/me/profiles/${encodeURIComponent(profileId)}/primary`);
+    }
+    /**
+     * List a profile's message templates (custom and default)
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.list({ profileId })`.
+     */
+    listTemplates(profileId) {
+        return this.http.get(`/api/v1/me/profiles/${encodeURIComponent(profileId)}/templates`);
+    }
+    /**
+     * Create or update a profile template for a channel/message type
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.upsert(channel, messageType, content, { profileId })`.
+     */
+    updateTemplate(profileId, channel, type, params) {
+        return this.http.put(`/api/v1/me/profiles/${encodeURIComponent(profileId)}/templates/${encodeURIComponent(channel)}/${encodeURIComponent(type)}`, params);
+    }
+    /**
+     * Delete a profile template (resets to default)
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.delete(channel, messageType, { profileId })`.
+     */
+    deleteTemplate(profileId, channel, type) {
+        return this.http.del(`/api/v1/me/profiles/${encodeURIComponent(profileId)}/templates/${encodeURIComponent(channel)}/${encodeURIComponent(type)}`);
+    }
+    /**
+     * Preview a profile template with the profile's branding
+     *
+     * @deprecated The server retired this route (410 `endpoint_retired`). Use
+     * `templates.preview(params, { profileId })`.
+     */
+    previewTemplate(profileId, params) {
+        return this.http.post(`/api/v1/me/profiles/${encodeURIComponent(profileId)}/templates/preview`, params);
+    }
+}
+//# sourceMappingURL=profiles.js.map

package/dist/esm/resources/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/resources/profiles.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,QAAQ;IACnB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,mDAAmD;IACnD,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,qBAAqB,CAAC,CAAC;IACnE,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,MAA4B;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,0BAA0B;IAC1B,QAAQ,CAAC,SAAiB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,SAAiB,EAAE,MAA2B;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,OAAO,EACP,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EACtD,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAwB,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,2CAA2C;IAC3C,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,YAAY,CACjE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,SAAiB,EACjB,OAAwB,EACxB,IAAyB,EACzB,MAAmC;QAEnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC3H,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,SAAiB,EACjB,OAAwB,EACxB,IAAyB;QAEzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAC5H,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,eAAe,CACb,SAAiB,EACjB,MAAoC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,oBAAoB,EACxE,MAAM,CACP,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/proof-me.d.ts

@@ -0,0 +1,48 @@
+import type { HttpClient } from '../http.js';
+/** Channel a Proof-Me identity challenge can run on. */
+export type ProofMeChannel = 'telegram' | 'whatsapp';
+export interface CreateIdentityChallengeParams {
+    circle_id: string;
+    member_id: string;
+    /** Channel the suspicious contact reached the member on; defaults to the member's channel. */
+    suspicious_channel?: ProofMeChannel;
+    [key: string]: unknown;
+}
+/**
+ * The one status every read reports: `cancelled` — whoever started the check withdrew it; `failed` — it
+ * could not be delivered; `expired` — nobody answered; `revoked` / `suspended` — the confirmation's
+ * proof was revoked or suspended, or (`revoked` only) the member being checked was removed while the
+ * check was pending.
+ */
+export type IdentityChallengeStatus = 'pending' | 'confirmed' | 'denied' | 'cancelled' | 'failed' | 'expired' | 'revoked' | 'suspended';
+export interface IdentityChallenge {
+    id: string;
+    status: IdentityChallengeStatus;
+    confirm_channel?: string;
+    channel?: string;
+    single_channel_warning?: boolean;
+    circle_id?: string | null;
+    is_drill?: boolean;
+    /** Public handle of the decision's proof — what `proofs.revoke(proof_id)` takes. */
+    proof_id?: string | null;
+    proof_token?: string | null;
+    created_at?: string;
+    resolved_at?: string | null;
+    expires_at?: string;
+    [key: string]: unknown;
+}
+/**
+ * Proof-Me — anti-impersonation reverse verification. A Circle member can trigger a
+ * cross-channel CONFIRM (identity challenge) so the account holder approves on a
+ * different channel than the suspicious contact reached them on. Member enrollment
+ * and drills live on the `circles` resource (the Circle people-primitive).
+ */
+export declare class ProofMe {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a cross-channel identity challenge (CONFIRM) for an enrolled Circle member. */
+    createIdentityChallenge(params: CreateIdentityChallengeParams): Promise<IdentityChallenge>;
+    /** Get an identity challenge by ID (poll for resolution). */
+    getIdentityChallenge(id: string): Promise<IdentityChallenge>;
+}
+//# sourceMappingURL=proof-me.d.ts.map

package/dist/esm/resources/proof-me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-me.d.ts","sourceRoot":"","sources":["../../../src/resources/proof-me.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAC/B,SAAS,GACT,WAAW,GACX,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,uBAAuB,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,yFAAyF;IACzF,uBAAuB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI1F,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAK7D"}

package/dist/esm/resources/proof-me.js

@@ -0,0 +1,20 @@
+/**
+ * Proof-Me — anti-impersonation reverse verification. A Circle member can trigger a
+ * cross-channel CONFIRM (identity challenge) so the account holder approves on a
+ * different channel than the suspicious contact reached them on. Member enrollment
+ * and drills live on the `circles` resource (the Circle people-primitive).
+ */
+export class ProofMe {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a cross-channel identity challenge (CONFIRM) for an enrolled Circle member. */
+    createIdentityChallenge(params) {
+        return this.http.post('/api/v1/identity-challenges', params);
+    }
+    /** Get an identity challenge by ID (poll for resolution). */
+    getIdentityChallenge(id) {
+        return this.http.get(`/api/v1/identity-challenges/${encodeURIComponent(id)}`);
+    }
+}
+//# sourceMappingURL=proof-me.js.map

package/dist/esm/resources/proof-me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-me.js","sourceRoot":"","sources":["../../../src/resources/proof-me.ts"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,MAAM,OAAO,OAAO;IAClB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,yFAAyF;IACzF,uBAAuB,CAAC,MAAqC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAoB,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,+BAA+B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACxD,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/proofs.d.ts

@@ -0,0 +1,81 @@
+import { type HttpClient } from '../http.js';
+import type { ProofStatus, ProofValidation, RevocationList, RevokeResponse, OfflineVerificationOptions, OfflineVerificationResult } from '../types.js';
+export declare class Proofs {
+    private readonly http;
+    private readonly keySet;
+    /** The last status list read, reusable until the issuer's own `ttl`/`exp` runs out. */
+    private statusListCache;
+    constructor(http: HttpClient, options?: {
+        maxJwksAgeMs?: number;
+    });
+    /**
+     * Validate a proof token online (checks revocation status).
+     *
+     * Pass `identifier` to also bind the proof to the identifier you expect it to be about: a
+     * proof about anything else answers `valid: false` with reason `identifier_mismatch`, and a
+     * proof of an encrypted decision — whose hash is over ciphertext — answers
+     * `identifier_unverifiable`. For a proof about a verified identifier any format is accepted
+     * and canonicalized as it was at issuance; a proof of an approval decision binds only on the
+     * exact recipient value it was issued for.
+     */
+    validate(proofToken: string, identifier?: string): Promise<ProofValidation>;
+    /**
+     * Revoke a proof by public handle (`ph_ctl_*`/`ph_dlg_*`) or verification id.
+     *
+     * Revoking a PROOF does not withdraw the asset, consent or delegation it is about — those have
+     * their own surfaces.
+     */
+    revoke(id: string, reason?: string): Promise<RevokeResponse>;
+    /** Get the status of a proof by public handle (`ph_ctl_*`/`ph_dlg_*`) or verification id. A live proof reads `active`. */
+    status(id: string): Promise<ProofStatus>;
+    /** Get the revocation list */
+    listRevoked(): Promise<RevocationList>;
+    /**
+     * Verify a proof token without calling the Proof API with your key.
+     *
+     * Two public documents are read, both cacheable and neither revealing which proof you are
+     * checking: the JWKS (for the signature) and the issuer's Token Status List (for revocation).
+     *
+     * By default the proof's status-list slot IS checked, so a revoked or suspended proof answers
+     * `valid: false` with `reason` `revoked`/`suspended`. A list that cannot be read — unreachable,
+     * failing its own checks, or not covering this slot — answers `status_unavailable`: the refusal
+     * to guess, not a claim that the proof is withdrawn. A token carrying no slot at all stays
+     * valid with `revocation_checked: false`, which is exactly what the issuer's own
+     * `POST /proofs/validate` answers for it.
+     *
+     * Pass `{ checkRevocation: false }` to check the signature alone; the result then reports
+     * `revocation_checked: false`.
+     *
+     * The key set follows the issuer's key-rotation rules (`sdks/shared/fixtures/jwks_rotation/`): a
+     * key the issuer revoked answers `key_revoked` with a `pull_hint` naming where a re-issued token
+     * can be fetched; a key set that could not be refreshed for longer than `maxJwksAgeMs` answers
+     * `jwks_stale` with its `cache_age_seconds`; a key of another family, a token signed outside its
+     * key's window or living longer than the key allows answer `wrong_key_purpose`,
+     * `outside_key_window` and `token_lifetime_exceeded`; a `kid` the issuer does not publish answers
+     * `unknown_key`. A key set that could not be read at all answers `status_unavailable`.
+     */
+    verifyOffline(token: string, options?: OfflineVerificationOptions): Promise<OfflineVerificationResult>;
+    /**
+     * Make the next verification refetch the key set, ignoring its 10-minute reuse window and the
+     * 30-second cooldowns, and drop the cached status list. A successful refetch resets the key
+     * set's age — the remedy a `jwks_stale` answer names. What the verifier knows is kept: key
+     * confirmations and tombstones survive (`clearTombstones()` is the separate, deliberate reset).
+     */
+    refreshJWKS(): void;
+    /**
+     * Forget every revoked-key tombstone this client has applied or is waiting to confirm. They are
+     * held in memory only — a restart forgets them too — and otherwise kept until a year after the
+     * revocation, whatever later key sets say.
+     */
+    clearTombstones(): void;
+    /**
+     * The signature against the issuer's key set, then the window and lifetime of the key that made
+     * it, then the token's own claims — so a forgery reads as a bad signature, never as a policy
+     * violation of a key it did not come from, and a policy violation outranks an expired token.
+     */
+    private verifyAgainstKeySet;
+    /** Resolve one token's slot against the issuer's signed status list. */
+    private checkStatusList;
+    private loadStatusList;
+}
+//# sourceMappingURL=proofs.d.ts.map

package/dist/esm/resources/proofs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofs.d.ts","sourceRoot":"","sources":["../../../src/resources/proofs.ts"],"names":[],"mappings":"AAUA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAUzD,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,cAAc,EAEd,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAC;AAwFrB,qBAAa,MAAM;IAOf,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,uFAAuF;IACvF,OAAO,CAAC,eAAe,CAChB;gBAGY,IAAI,EAAE,UAAU,EACjC,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IAOzC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAO3E;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5D,0HAA0H;IAC1H,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxC,8BAA8B;IAC9B,WAAW,IAAI,OAAO,CAAC,cAAc,CAAC;IAItC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC;IAkFrC;;;;;OAKG;IACH,WAAW,IAAI,IAAI;IAKnB;;;;OAIG;IACH,eAAe,IAAI,IAAI;IAIvB;;;;OAIG;YACW,mBAAmB;IAmFjC,wEAAwE;YAC1D,eAAe;YAkCf,cAAc;CAuF7B"}