@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/esm/resources/proofs.js

@@ -0,0 +1,433 @@
+import { inflateSync } from 'node:zlib';
+import { compactVerify, decodeJwt, decodeProtectedHeader, jwtVerify, errors as joseErrors, } from 'jose';
+import { readCapped } from '../http.js';
+import { DEFAULT_MAX_JWKS_AGE_MS, KeySetCache, assertMaxJwksAgeMs, isSupportedAlgorithm, nowWallMs, } from '../jwks/key-set-cache.js';
+import { checkKeyPolicy } from '../jwks/keyset.js';
+/** Clock skew tolerated on both the proof token and the status list, in seconds. */
+const CLOCK_TOLERANCE_SECONDS = 5;
+/** The only `iss` a proof token may carry. */
+const PROOF_TOKEN_ISSUER = 'proof.holdings';
+/** Ceiling on a fetched status list, mirroring `@proof-holdings/delegation-verifier`. */
+const MAX_STATUS_LIST_BYTES = 512 * 1024;
+const STATUS_LIST_TIMEOUT_MS = 5000;
+/** The draft's 2-bit slot values (draft-ietf-oauth-status-list). */
+const SLOT_VALID = 0b00;
+const SLOT_REVOKED = 0b01;
+const SLOT_SUSPENDED = 0b10;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** The token's own slot reference, or null when it carries none. */
+function readStatusListClaim(claims) {
+    const status = claims.status;
+    if (!isRecord(status))
+        return null;
+    const statusList = status.status_list;
+    if (!isRecord(statusList))
+        return null;
+    const { idx, uri } = statusList;
+    if (typeof idx !== 'number' || !Number.isInteger(idx) || idx < 0)
+        return null;
+    if (typeof uri !== 'string' || uri.length === 0)
+        return null;
+    return { idx, uri };
+}
+/**
+ * Read one slot out of a decoded list: lowest index in the least significant bits, `bits`
+ * statuses per byte — the draft's byte order, pinned across the four SDKs and the issuer by
+ * `sdks/shared/fixtures/status_list_slots.json`.
+ *
+ * `null` means the array does not reach that index, which is "no answer", never "valid".
+ */
+function readStatusSlot(bytes, index, bits) {
+    if (!Number.isInteger(index) || index < 0)
+        return null;
+    if (bits !== 1 && bits !== 2 && bits !== 4 && bits !== 8)
+        return null;
+    const perByte = 8 / bits;
+    const byteIndex = Math.floor(index / perByte);
+    if (byteIndex >= bytes.length)
+        return null;
+    return (bytes[byteIndex] >> ((index % perByte) * bits)) & ((1 << bits) - 1);
+}
+/**
+ * Inflate the zlib-wrapped DEFLATE payload the issuer publishes.
+ *
+ * `node:zlib` rather than the web `DecompressionStream`: this SDK already targets Node (it uses
+ * the `crypto` module and `Buffer` for the HITL envelope, and its tsconfig carries no DOM lib),
+ * so a web-stream version would buy no portability and cost a type it cannot name.
+ */
+function inflate(bytes) {
+    return inflateSync(bytes);
+}
+/**
+ * Why a token whose signature verified failed its own claims: `expired`, or `invalid` for every
+ * other claim (`iss`, `typ`, `sub`, a missing `exp`).
+ */
+function claimFailureReason(error) {
+    return error instanceof joseErrors.JWTExpired ? 'expired' : 'invalid';
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export class Proofs {
+    constructor(http, options = {}) {
+        this.http = http;
+        /** The last status list read, reusable until the issuer's own `ttl`/`exp` runs out. */
+        this.statusListCache = null;
+        const maxJwksAgeMs = options.maxJwksAgeMs ?? DEFAULT_MAX_JWKS_AGE_MS;
+        assertMaxJwksAgeMs(maxJwksAgeMs);
+        this.keySet = new KeySetCache(http, `${http.baseUrl}/.well-known/jwks.json`, maxJwksAgeMs);
+    }
+    /**
+     * Validate a proof token online (checks revocation status).
+     *
+     * Pass `identifier` to also bind the proof to the identifier you expect it to be about: a
+     * proof about anything else answers `valid: false` with reason `identifier_mismatch`, and a
+     * proof of an encrypted decision — whose hash is over ciphertext — answers
+     * `identifier_unverifiable`. For a proof about a verified identifier any format is accepted
+     * and canonicalized as it was at issuance; a proof of an approval decision binds only on the
+     * exact recipient value it was issued for.
+     */
+    validate(proofToken, identifier) {
+        return this.http.post('/api/v1/proofs/validate', {
+            proof_token: proofToken,
+            ...(identifier ? { identifier } : {}),
+        });
+    }
+    /**
+     * Revoke a proof by public handle (`ph_ctl_*`/`ph_dlg_*`) or verification id.
+     *
+     * Revoking a PROOF does not withdraw the asset, consent or delegation it is about — those have
+     * their own surfaces.
+     */
+    revoke(id, reason) {
+        return this.http.post(`/api/v1/proofs/${encodeURIComponent(id)}/revoke`, {
+            ...(reason ? { reason } : {}),
+        });
+    }
+    /** Get the status of a proof by public handle (`ph_ctl_*`/`ph_dlg_*`) or verification id. A live proof reads `active`. */
+    status(id) {
+        return this.http.get(`/api/v1/proofs/${encodeURIComponent(id)}/status`);
+    }
+    /** Get the revocation list */
+    listRevoked() {
+        return this.http.get('/api/v1/proofs/revoked');
+    }
+    /**
+     * Verify a proof token without calling the Proof API with your key.
+     *
+     * Two public documents are read, both cacheable and neither revealing which proof you are
+     * checking: the JWKS (for the signature) and the issuer's Token Status List (for revocation).
+     *
+     * By default the proof's status-list slot IS checked, so a revoked or suspended proof answers
+     * `valid: false` with `reason` `revoked`/`suspended`. A list that cannot be read — unreachable,
+     * failing its own checks, or not covering this slot — answers `status_unavailable`: the refusal
+     * to guess, not a claim that the proof is withdrawn. A token carrying no slot at all stays
+     * valid with `revocation_checked: false`, which is exactly what the issuer's own
+     * `POST /proofs/validate` answers for it.
+     *
+     * Pass `{ checkRevocation: false }` to check the signature alone; the result then reports
+     * `revocation_checked: false`.
+     *
+     * The key set follows the issuer's key-rotation rules (`sdks/shared/fixtures/jwks_rotation/`): a
+     * key the issuer revoked answers `key_revoked` with a `pull_hint` naming where a re-issued token
+     * can be fetched; a key set that could not be refreshed for longer than `maxJwksAgeMs` answers
+     * `jwks_stale` with its `cache_age_seconds`; a key of another family, a token signed outside its
+     * key's window or living longer than the key allows answer `wrong_key_purpose`,
+     * `outside_key_window` and `token_lifetime_exceeded`; a `kid` the issuer does not publish answers
+     * `unknown_key`. A key set that could not be read at all answers `status_unavailable`.
+     */
+    async verifyOffline(token, options) {
+        let unverified;
+        try {
+            unverified = decodeJwt(token);
+        }
+        catch (error) {
+            return { valid: false, error: errorMessage(error), reason: 'invalid', revocation_checked: false };
+        }
+        // The family only selects which key may answer; the signature still has to match that key.
+        const family = unverified.token_type === 'delegation' ? 'delegation' : 'proof';
+        let checked;
+        try {
+            checked = await this.verifyAgainstKeySet(token, family, { issuer: PROOF_TOKEN_ISSUER });
+        }
+        catch (error) {
+            checked = { ok: false, reason: 'invalid', message: errorMessage(error) };
+        }
+        if (!checked.ok) {
+            const handle = family === 'delegation' ? unverified.sub : unverified.proof_id;
+            return {
+                valid: false,
+                error: checked.message,
+                reason: checked.reason,
+                revocation_checked: false,
+                ...(checked.reason === 'key_revoked'
+                    ? {
+                        pull_hint: {
+                            issuer_origin: new URL(this.http.baseUrl).origin,
+                            handle: typeof handle === 'string' ? handle : null,
+                        },
+                    }
+                    : {}),
+                ...(checked.reason === 'jwks_stale' ? { cache_age_seconds: checked.cacheAgeSeconds ?? null } : {}),
+            };
+        }
+        const claims = checked.payload;
+        const verified = {
+            valid: true,
+            payload: {
+                iss: claims.iss,
+                sub: claims.sub,
+                iat: claims.iat,
+                exp: claims.exp,
+                type: claims.type,
+                channel: claims.channel,
+                identifier_hash: claims.identifier_hash,
+                verified_at: claims.verified_at,
+                user_id: claims.user_id,
+                decision: claims.decision,
+            },
+            revocation_checked: false,
+        };
+        if (options?.checkRevocation === false)
+            return verified;
+        const claim = readStatusListClaim(claims);
+        if (!claim)
+            return verified;
+        const outcome = await this.checkStatusList(claim);
+        switch (outcome.state) {
+            case 'valid':
+                return { ...verified, revocation_checked: true };
+            case 'revoked':
+            case 'suspended':
+                return {
+                    valid: false,
+                    payload: verified.payload,
+                    reason: outcome.state,
+                    error: `This proof is ${outcome.state}`,
+                    revocation_checked: true,
+                };
+            case 'unavailable':
+                return {
+                    valid: false,
+                    payload: verified.payload,
+                    reason: 'status_unavailable',
+                    error: outcome.message,
+                    revocation_checked: false,
+                };
+        }
+    }
+    /**
+     * Make the next verification refetch the key set, ignoring its 10-minute reuse window and the
+     * 30-second cooldowns, and drop the cached status list. A successful refetch resets the key
+     * set's age — the remedy a `jwks_stale` answer names. What the verifier knows is kept: key
+     * confirmations and tombstones survive (`clearTombstones()` is the separate, deliberate reset).
+     */
+    refreshJWKS() {
+        this.keySet.forceRefresh();
+        this.statusListCache = null;
+    }
+    /**
+     * Forget every revoked-key tombstone this client has applied or is waiting to confirm. They are
+     * held in memory only — a restart forgets them too — and otherwise kept until a year after the
+     * revocation, whatever later key sets say.
+     */
+    clearTombstones() {
+        this.keySet.clearTombstones();
+    }
+    /**
+     * The signature against the issuer's key set, then the window and lifetime of the key that made
+     * it, then the token's own claims — so a forgery reads as a bad signature, never as a policy
+     * violation of a key it did not come from, and a policy violation outranks an expired token.
+     */
+    async verifyAgainstKeySet(token, family, claimOptions) {
+        let alg;
+        let kid;
+        try {
+            const header = decodeProtectedHeader(token);
+            alg = header.alg;
+            kid = typeof header.kid === 'string' ? header.kid : undefined;
+        }
+        catch (error) {
+            return { ok: false, reason: 'invalid', message: errorMessage(error) };
+        }
+        // Chosen from the allow-list, never trusted from the header: `none` and HMAC die here.
+        if (!isSupportedAlgorithm(alg)) {
+            return { ok: false, reason: 'invalid', message: `token algorithm ${String(alg)} is not accepted` };
+        }
+        const resolution = await this.keySet.resolve(kid, alg, family);
+        switch (resolution.kind) {
+            case 'unavailable':
+                return { ok: false, reason: 'status_unavailable', message: resolution.message };
+            case 'stale':
+                return {
+                    ok: false,
+                    reason: 'jwks_stale',
+                    message: 'the issuer key set could not be refreshed and the cached copy is older than maxJwksAgeMs; call refreshJWKS() once the issuer is reachable',
+                    cacheAgeSeconds: resolution.cacheAgeSeconds,
+                };
+            case 'revoked':
+                return { ok: false, reason: 'key_revoked', message: `the issuer revoked signing key "${resolution.kid}"` };
+            case 'wrong_purpose':
+                return {
+                    ok: false,
+                    reason: 'wrong_key_purpose',
+                    message: `signing key "${resolution.kid}" is not a ${family} key`,
+                };
+            case 'unknown':
+                return { ok: false, reason: 'unknown_key', message: 'no key in the issuer key set matches this token' };
+            case 'keys':
+                break;
+        }
+        let matched = null;
+        for (const candidate of resolution.candidates) {
+            try {
+                await compactVerify(token, candidate.key, { algorithms: [alg] });
+                matched = candidate;
+                break;
+            }
+            catch {
+                // Not this key; a token matching none of them is a bad signature.
+            }
+        }
+        if (!matched)
+            return { ok: false, reason: 'invalid', message: 'signature verification failed' };
+        const signed = decodeJwt(token);
+        const violation = checkKeyPolicy(matched.record, { iat: signed.iat, exp: signed.exp }, resolution.registryLive);
+        if (violation === 'outside_key_window') {
+            return { ok: false, reason: violation, message: "token iat lies outside the signing key's window" };
+        }
+        if (violation === 'token_lifetime_exceeded') {
+            return {
+                ok: false,
+                reason: violation,
+                message: "token exp lies beyond iat plus the signing key's max_token_lifetime",
+            };
+        }
+        try {
+            const { payload } = await jwtVerify(token, matched.key, {
+                ...claimOptions,
+                algorithms: [alg],
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                currentDate: new Date(nowWallMs()),
+            });
+            return { ok: true, payload: payload };
+        }
+        catch (error) {
+            return { ok: false, reason: claimFailureReason(error), message: errorMessage(error) };
+        }
+    }
+    /** Resolve one token's slot against the issuer's signed status list. */
+    async checkStatusList(claim) {
+        let uri;
+        try {
+            uri = new URL(claim.uri);
+        }
+        catch {
+            return { state: 'unavailable', message: 'status list uri is not a valid URL' };
+        }
+        // The uri arrives INSIDE the artifact being verified, so fetching whatever it names would
+        // hand a forged token both the status authority and a request from your network. Only the
+        // origin this client is configured against is honoured.
+        const configuredOrigin = new URL(this.http.baseUrl).origin;
+        if (uri.origin !== configuredOrigin) {
+            return {
+                state: 'unavailable',
+                message: `status list uri origin ${uri.origin} is not the configured issuer origin ${configuredOrigin}`,
+            };
+        }
+        const list = await this.loadStatusList(uri.toString());
+        if ('message' in list)
+            return { state: 'unavailable', message: list.message };
+        const slot = readStatusSlot(list.bytes, claim.idx, list.bits);
+        if (slot === null) {
+            return { state: 'unavailable', message: `status list has no slot ${claim.idx}` };
+        }
+        if (slot === SLOT_REVOKED)
+            return { state: 'revoked' };
+        if (slot === SLOT_SUSPENDED)
+            return { state: 'suspended' };
+        if (slot === SLOT_VALID)
+            return { state: 'valid' };
+        // `0b11` is reserved for application-specific use by the draft; the issuer packs it when it
+        // could not resolve a delegation's control proof. It is an absence of an answer.
+        return { state: 'unavailable', message: `status list slot carries unknown status ${slot}` };
+    }
+    async loadStatusList(uri) {
+        const cached = this.statusListCache;
+        if (cached && cached.uri === uri && cached.expiresAtMs > nowWallMs()) {
+            return { bytes: cached.bytes, bits: cached.bits };
+        }
+        let response;
+        let read;
+        try {
+            response = await this.http.fetchPublic(uri, {
+                timeoutMs: STATUS_LIST_TIMEOUT_MS,
+                headers: { accept: 'application/statuslist+jwt, application/jwt, text/plain' },
+            });
+            if (response.status !== 200) {
+                return { message: `status list fetch failed with HTTP ${response.status}` };
+            }
+            const declaredLength = Number(response.headers.get('content-length'));
+            if (Number.isFinite(declaredLength) && declaredLength > MAX_STATUS_LIST_BYTES) {
+                return { message: 'status list response is too large' };
+            }
+            // Inside the SAME try as the fetch: a body that breaks AFTER the headers, or a deadline
+            // that lands mid-read, rejects here — and the other three SDKs answer that with
+            // `status_unavailable` rather than throwing out of verifyOffline.
+            read = await readCapped(response, MAX_STATUS_LIST_BYTES);
+        }
+        catch (error) {
+            return {
+                message: `status list fetch failed: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        if (read === null) {
+            return { message: 'status list response is too large' };
+        }
+        const listToken = read.trim();
+        // The list is held to its own key family (`status-list`) and that key's window. `typ` separates
+        // a status list from every other token this issuer signs; `subject` is what stops a valid list
+        // being replayed in place of another one; `exp` is REQUIRED because a freshness channel without
+        // one would be honoured forever. `iss` is deliberately not required — the issuer does not put
+        // one in the list.
+        let checked;
+        try {
+            checked = await this.verifyAgainstKeySet(listToken, 'status-list', {
+                typ: 'statuslist+jwt',
+                subject: uri,
+                requiredClaims: ['exp'],
+            });
+        }
+        catch (error) {
+            checked = { ok: false, reason: 'invalid', message: errorMessage(error) };
+        }
+        if (!checked.ok)
+            return { message: `status list did not verify: ${checked.message}` };
+        const payload = checked.payload;
+        const statusList = payload.status_list;
+        if (!isRecord(statusList) || typeof statusList.lst !== 'string') {
+            return { message: 'status list payload has no `lst`' };
+        }
+        const bits = typeof statusList.bits === 'number' ? statusList.bits : 2;
+        let bytes;
+        try {
+            bytes = inflate(Buffer.from(statusList.lst, 'base64url'));
+        }
+        catch (error) {
+            return {
+                message: `status list payload could not be decompressed: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        // Honour the shorter of the issuer's published `ttl` and the token's own `exp`: `ttl` is the
+        // window it asks consumers to cache for (55s today), `exp` the point past which the list must
+        // not be used at all.
+        const expSeconds = typeof payload.exp === 'number' ? payload.exp : 0;
+        const ttlSeconds = typeof payload.ttl === 'number' ? payload.ttl : 0;
+        const expiresAtMs = Math.min(expSeconds * 1000, ttlSeconds > 0 ? nowWallMs() + ttlSeconds * 1000 : Number.POSITIVE_INFINITY);
+        this.statusListCache = { uri, bytes, bits, expiresAtMs };
+        return { bytes, bits };
+    }
+}
+//# sourceMappingURL=proofs.js.map

package/dist/esm/resources/proofs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofs.js","sourceRoot":"","sources":["../../../src/resources/proofs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,MAAM,IAAI,UAAU,GAErB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAmB,MAAM,YAAY,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GAEV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AAWnE,oFAAoF;AACpF,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,8CAA8C;AAC9C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEzC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,oEAAoE;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,cAAc,GAAG,IAAI,CAAC;AAa5B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,MAA+B;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAiB,EAAE,KAAa,EAAE,IAAY;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAiB;IAChC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAMD,MAAM,OAAO,MAAM;IAMjB,YACmB,IAAgB,EACjC,UAAqC,EAAE;QADtB,SAAI,GAAJ,IAAI,CAAY;QALnC,uFAAuF;QAC/E,oBAAe,GACrB,IAAI,CAAC;QAML,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,uBAAuB,CAAC;QACrE,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,wBAAwB,EAAE,YAAY,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAmB;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAkB,yBAAyB,EAAE;YAChE,WAAW,EAAE,UAAU;YACvB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,EAAU,EAAE,MAAe;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAiB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE;YACvF,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,0HAA0H;IAC1H,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAc,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,8BAA8B;IAC9B,WAAW;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,wBAAwB,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAoC;QAEpC,IAAI,UAAmC,CAAC;QACxC,IAAI,CAAC;YACH,UAAU,GAAG,SAAS,CAAC,KAAK,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;QACpG,CAAC;QACD,2FAA2F;QAC3F,MAAM,MAAM,GAAc,UAAU,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1F,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC9E,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,OAAO,CAAC,OAAO;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,kBAAkB,EAAE,KAAK;gBACzB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa;oBAClC,CAAC,CAAC;wBACE,SAAS,EAAE;4BACT,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;4BAChD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;yBACnD;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;QAE/B,MAAM,QAAQ,GAA8B;YAC1C,KAAK,EAAE,IAAI;YACX,OAAO,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAc;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAiB;gBACjC,eAAe,EAAE,MAAM,CAAC,eAAyB;gBACjD,WAAW,EAAE,MAAM,CAAC,WAAqB;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAiB;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAA0C;aAC5D;YACD,kBAAkB,EAAE,KAAK;SAC1B,CAAC;QAEF,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC;QAExD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,QAAQ,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,OAAO;gBACV,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACnD,KAAK,SAAS,CAAC;YACf,KAAK,WAAW;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,OAAO,CAAC,KAA6B;oBAC7C,KAAK,EAAE,iBAAiB,OAAO,CAAC,KAAK,EAAE;oBACvC,kBAAkB,EAAE,IAAI;iBACzB,CAAC;YACJ,KAAK,aAAa;gBAChB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,oBAAoB;oBAC5B,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,kBAAkB,EAAE,KAAK;iBAC1B,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,WAAW;QACT,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAC/B,KAAa,EACb,MAAiB,EACjB,YAA8B;QAE9B,IAAI,GAAY,CAAC;QACjB,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC5C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACjB,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,uFAAuF;QACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,aAAa;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;YAClF,KAAK,OAAO;gBACV,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY;oBACpB,OAAO,EACL,2IAA2I;oBAC7I,eAAe,EAAE,UAAU,CAAC,eAAe;iBAC5C,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,UAAU,CAAC,GAAG,GAAG,EAAE,CAAC;YAC7G,KAAK,eAAe;gBAClB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,mBAAmB;oBAC3B,OAAO,EAAE,gBAAgB,UAAU,CAAC,GAAG,cAAc,MAAM,MAAM;iBAClE,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;YAC1G,KAAK,MAAM;gBACT,MAAM;QACV,CAAC;QAED,IAAI,OAAO,GAAwB,IAAI,CAAC;QACxC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjE,OAAO,GAAG,SAAS,CAAC;gBACpB,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QAEhG,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QAChH,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;QACtG,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qEAAqE;aAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE;gBACtD,GAAG,YAAY;gBACf,UAAU,EAAE,CAAC,GAAG,CAAC;gBACjB,cAAc,EAAE,uBAAuB;gBACvC,WAAW,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;aACnC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAkC,EAAE,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,eAAe,CAAC,KAAsB;QAClD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;QACjF,CAAC;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,wCAAwC,gBAAgB,EAAE;aACxG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAE9E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACnD,4FAA4F;QAC5F,iFAAiF;QACjF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,IAAI,EAAE,EAAE,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,GAAW;QAEX,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC;QACpC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC1C,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;aAC/E,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9E,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;gBAC9E,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC1D,CAAC;YAED,wFAAwF;YACxF,gFAAgF;YAChF,kEAAkE;YAClE,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE9B,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,mBAAmB;QACnB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,aAAa,EAAE;gBACjE,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,GAAG;gBACZ,cAAc,EAAE,CAAC,KAAK,CAAC;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvE,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,kDACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;aACH,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,sBAAsB;QACtB,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,UAAU,GAAG,IAAI,EACjB,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAC5E,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAEzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/esm/resources/public-profiles.d.ts

@@ -0,0 +1,36 @@
+import type { HttpClient } from '../http.js';
+import type { ProfileBadge, PublicProfileView, UsernameAvailabilityResponse, AvatarResponse } from '../types.js';
+/**
+ * Public profile reads — unauthenticated endpoints; the client's
+ * Authorization header is sent but ignored by the server.
+ */
+export declare class PublicProfiles {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Get a public profile by its PUBLIC `profile_id` (the `profile_id` field
+     * on `/me/profiles` responses) — the internal `id` is NOT accepted by this
+     * endpoint and will 404.
+     */
+    getById(profileId: string): Promise<PublicProfileView>;
+    /**
+     * Get a profile's avatar image. Accepts either the public `profile_id` or
+     * the internal `id`. Returns raw bytes plus the content type; https-hosted
+     * avatars are followed through the server's 301 redirect.
+     */
+    getAvatar(profileId: string): Promise<AvatarResponse>;
+    /** Get a public profile by username */
+    getByUsername(username: string): Promise<PublicProfileView>;
+    /**
+     * Get the embeddable badge descriptor for a username.
+     *
+     * Everything needed to embed the verification badge in one call: the subject it asserts, the
+     * live verified count, the badge image URL for each style, and ready-to-paste snippets. A
+     * username with no public record answers 200 with `state: 'no_public_record'` rather than a
+     * 404, so a caller never has to treat "nothing to show" as an error.
+     */
+    getBadge(username: string): Promise<ProfileBadge>;
+    /** Check username availability */
+    checkUsername(username: string): Promise<UsernameAvailabilityResponse>;
+}
+//# sourceMappingURL=public-profiles.d.ts.map

package/dist/esm/resources/public-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-profiles.d.ts","sourceRoot":"","sources":["../../../src/resources/public-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACf,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAItD;;;;OAIG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,uCAAuC;IACvC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI3D;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIjD,kCAAkC;IAClC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;CAKvE"}

package/dist/esm/resources/public-profiles.js

@@ -0,0 +1,45 @@
+/**
+ * Public profile reads — unauthenticated endpoints; the client's
+ * Authorization header is sent but ignored by the server.
+ */
+export class PublicProfiles {
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * Get a public profile by its PUBLIC `profile_id` (the `profile_id` field
+     * on `/me/profiles` responses) — the internal `id` is NOT accepted by this
+     * endpoint and will 404.
+     */
+    getById(profileId) {
+        return this.http.get(`/api/v1/profiles/p/${encodeURIComponent(profileId)}`);
+    }
+    /**
+     * Get a profile's avatar image. Accepts either the public `profile_id` or
+     * the internal `id`. Returns raw bytes plus the content type; https-hosted
+     * avatars are followed through the server's 301 redirect.
+     */
+    getAvatar(profileId) {
+        return this.http.get(`/api/v1/profiles/p/${encodeURIComponent(profileId)}/avatar`);
+    }
+    /** Get a public profile by username */
+    getByUsername(username) {
+        return this.http.get(`/api/v1/profiles/u/${encodeURIComponent(username)}`);
+    }
+    /**
+     * Get the embeddable badge descriptor for a username.
+     *
+     * Everything needed to embed the verification badge in one call: the subject it asserts, the
+     * live verified count, the badge image URL for each style, and ready-to-paste snippets. A
+     * username with no public record answers 200 with `state: 'no_public_record'` rather than a
+     * 404, so a caller never has to treat "nothing to show" as an error.
+     */
+    getBadge(username) {
+        return this.http.get(`/api/v1/profiles/badge/${encodeURIComponent(username)}`);
+    }
+    /** Check username availability */
+    checkUsername(username) {
+        return this.http.get(`/api/v1/profiles/check-username/${encodeURIComponent(username)}`);
+    }
+}
+//# sourceMappingURL=public-profiles.js.map

package/dist/esm/resources/public-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-profiles.js","sourceRoot":"","sources":["../../../src/resources/public-profiles.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,OAAO,cAAc;IACzB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD;;;;OAIG;IACH,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAoB,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrG,CAAC;IAED,uCAAuC;IACvC,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAoB,sBAAsB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,0BAA0B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,kCAAkC;IAClC,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,mCAAmC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/sessions.d.ts

@@ -0,0 +1,15 @@
+import type { HttpClient } from '../http.js';
+import type { Session, CreateSessionParams, WaitOptions } from '../types.js';
+export declare class Sessions {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a new phone verification session */
+    create(params: CreateSessionParams): Promise<Session>;
+    /** Get session status by ID */
+    retrieve(id: string): Promise<Session>;
+    /**
+     * Poll until session reaches a terminal state (verified/failed/expired).
+     */
+    waitForCompletion(id: string, options?: WaitOptions): Promise<Session>;
+}
+//# sourceMappingURL=sessions.d.ts.map

package/dist/esm/resources/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/resources/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI7E,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,8CAA8C;IAC9C,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItC;;OAEG;IACH,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAQvE"}

package/dist/esm/resources/sessions.js

@@ -0,0 +1,22 @@
+import { pollUntilComplete } from '../polling.js';
+const TERMINAL_STATES = ['verified', 'failed', 'expired'];
+export class Sessions {
+    constructor(http) {
+        this.http = http;
+    }
+    /** Create a new phone verification session */
+    create(params) {
+        return this.http.post('/api/v1/sessions', params);
+    }
+    /** Get session status by ID */
+    retrieve(id) {
+        return this.http.get(`/api/v1/sessions/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Poll until session reaches a terminal state (verified/failed/expired).
+     */
+    waitForCompletion(id, options) {
+        return pollUntilComplete(() => this.retrieve(id), TERMINAL_STATES, `Session ${id}`, options);
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/esm/resources/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/resources/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEnE,MAAM,OAAO,QAAQ;IACnB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,8CAA8C;IAC9C,MAAM,CAAC,MAA2B;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,+BAA+B;IAC/B,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,EAAU,EAAE,OAAqB;QACjD,OAAO,iBAAiB,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,eAAe,EACf,WAAW,EAAE,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/resources/templates.d.ts

@@ -0,0 +1,25 @@
+import type { HttpClient } from '../http.js';
+import type { TemplateChannel, TemplateMessageType, TemplateContent, TemplateProjectOptions, TemplateListResponse, TemplateDefaultsResponse, TemplateGetResponse, TemplateUpsertResponse, TemplateDeleteResponse, TemplatePreviewParams, TemplatePreviewResponse, TemplateRenderParams, TemplateRenderResponse } from '../types.js';
+/**
+ * Message templates. Templates exist per project (sub-account) only: every method but
+ * `getDefaults` takes an optional `{ profileId }` naming the project, sent as `profile_id`.
+ */
+export declare class Templates {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List the project's custom templates plus available channels, message types, and variables */
+    list(options?: TemplateProjectOptions): Promise<TemplateListResponse>;
+    /** Get all default templates (for reference) */
+    getDefaults(): Promise<TemplateDefaultsResponse>;
+    /** Get a specific template (the project's own if set, default otherwise) */
+    retrieve(channel: TemplateChannel, messageType: TemplateMessageType, options?: TemplateProjectOptions): Promise<TemplateGetResponse>;
+    /** Create or update the project's custom template */
+    upsert(channel: TemplateChannel, messageType: TemplateMessageType, content: TemplateContent, options?: TemplateProjectOptions): Promise<TemplateUpsertResponse>;
+    /** Delete the project's custom template (resets to default; 404 if no custom template exists) */
+    delete(channel: TemplateChannel, messageType: TemplateMessageType, options?: TemplateProjectOptions): Promise<TemplateDeleteResponse>;
+    /** Preview a template with sample data and the project's branding */
+    preview(params: TemplatePreviewParams, options?: TemplateProjectOptions): Promise<TemplatePreviewResponse>;
+    /** Render the project's template with provided variables (for testing) */
+    render(params: TemplateRenderParams, options?: TemplateProjectOptions): Promise<TemplateRenderResponse>;
+}
+//# sourceMappingURL=templates.d.ts.map

package/dist/esm/resources/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../../src/resources/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AAOrB;;;GAGG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAIrE,gDAAgD;IAChD,WAAW,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAIhD,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAOpI,qDAAqD;IACrD,MAAM,CACJ,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,sBAAsB,CAAC;IAQlC,iGAAiG;IACjG,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQrI,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ1G,0EAA0E;IAC1E,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAOxG"}