@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/cjs/http.d.ts

@@ -0,0 +1,62 @@
+export interface HttpClientConfig {
+    apiKey: string;
+    baseUrl: string;
+    timeout: number;
+    maxRetries: number;
+    fetch: typeof globalThis.fetch;
+}
+type QueryValue = string | number | boolean | undefined;
+/**
+ * Read a response body, giving up one byte past `limit`.
+ *
+ * `response.text()` would buffer the WHOLE body and measure afterwards, which is not a ceiling
+ * at all for a reply that declares no length: a multi-gigabyte answer is fully in memory before
+ * anything refuses it. Returns null when the body is over the limit.
+ */
+export declare function readCapped(response: Response, limit: number): Promise<string | null>;
+export declare class HttpClient {
+    readonly baseUrl: string;
+    private readonly apiKey;
+    private readonly timeout;
+    private readonly maxRetries;
+    private readonly _fetch;
+    constructor(config: HttpClientConfig);
+    request<T>(method: string, path: string, options?: {
+        body?: unknown;
+        query?: Record<string, QueryValue>;
+    }): Promise<T>;
+    get<T>(path: string, query?: Record<string, QueryValue>): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    put<T>(path: string, body?: unknown): Promise<T>;
+    del<T>(path: string): Promise<T>;
+    /**
+     * Raw fetch with auth + user-agent headers applied. Used for SSE streaming
+     * and other non-JSON responses. Does NOT retry, does NOT parse body, does
+     * NOT apply the default request timeout — the caller owns lifecycle via
+     * AbortSignal.
+     */
+    rawFetch(path: string, options?: {
+        headers?: Record<string, string>;
+        signal?: AbortSignal;
+        query?: Record<string, QueryValue>;
+    }): Promise<Response>;
+    /**
+     * Fetch a PUBLIC artifact by absolute url through the configured transport — no API key, no
+     * retries, redirects refused.
+     *
+     * The key is left off deliberately rather than forgotten: the issuer's status list is a shared
+     * document whose whole point is that reading it says nothing about WHICH proof is being checked
+     * (`docs/api-map.yaml`, the status-list endpoint is public). Sending a credential with it would
+     * hand the issuer the one fact the design withholds. Redirects are refused because the caller
+     * has already decided the url's origin is trusted, and a redirect would move it.
+     */
+    fetchPublic(url: string, options: {
+        timeoutMs: number;
+        headers?: Record<string, string>;
+    }): Promise<Response>;
+    private buildUrl;
+    private backoff;
+    private sleep;
+}
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/cjs/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAExD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B1F;AAED,qBAAa,UAAU;IACrB,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;gBAErC,MAAM,EAAE,gBAAgB;IAQ9B,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;KACpC,GACA,OAAO,CAAC,CAAC,CAAC;IAuFb,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIpE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC;;;;;OAKG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAO,GAC3G,OAAO,CAAC,QAAQ,CAAC;IAUpB;;;;;;;;;OASG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAY7G,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,KAAK;CAGd"}

package/dist/cjs/http.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpClient = void 0;
+exports.readCapped = readCapped;
+const errors_js_1 = require("./errors.js");
+const version_js_1 = require("./version.js");
+/**
+ * Read a response body, giving up one byte past `limit`.
+ *
+ * `response.text()` would buffer the WHOLE body and measure afterwards, which is not a ceiling
+ * at all for a reply that declares no length: a multi-gigabyte answer is fully in memory before
+ * anything refuses it. Returns null when the body is over the limit.
+ */
+async function readCapped(response, limit) {
+    const body = response.body;
+    if (!body) {
+        // No streamable body (a mocked or already-buffered response): fall back to reading it whole,
+        // which is still bounded by whatever produced it. Measured in BYTES, like the streamed path
+        // and like the ceiling itself — `text.length` counts UTF-16 units, which is a different
+        // number for any non-ASCII body.
+        const text = await response.text();
+        return new TextEncoder().encode(text).byteLength > limit ? null : text;
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let read = 0;
+    let out = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            read += value.byteLength;
+            if (read > limit)
+                return null;
+            out += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+    return out + decoder.decode();
+}
+class HttpClient {
+    constructor(config) {
+        this.apiKey = config.apiKey;
+        this.baseUrl = config.baseUrl.replace(/\/$/, '');
+        this.timeout = config.timeout;
+        this.maxRetries = config.maxRetries;
+        this._fetch = config.fetch;
+    }
+    async request(method, path, options) {
+        const url = this.buildUrl(path, options?.query);
+        let lastError;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+            try {
+                const response = await this._fetch(url, {
+                    method,
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'Authorization': `Bearer ${this.apiKey}`,
+                        'User-Agent': `proof-sdk-js/${version_js_1.VERSION}`,
+                    },
+                    body: options?.body ? JSON.stringify(options.body) : undefined,
+                    signal: controller.signal,
+                });
+                clearTimeout(timeoutId);
+                // Rate limiting — retry with backoff
+                if (response.status === 429 && attempt < this.maxRetries) {
+                    const retryAfter = response.headers.get('Retry-After');
+                    const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : this.backoff(attempt);
+                    await this.sleep(delay);
+                    continue;
+                }
+                // Server errors — retry with backoff
+                if (response.status >= 500 && attempt < this.maxRetries) {
+                    await this.sleep(this.backoff(attempt));
+                    continue;
+                }
+                // Non-JSON success (e.g. avatar images): return a {data, content_type}
+                // envelope instead of attempting a JSON parse. Only when the server
+                // EXPLICITLY declares a non-JSON content type — responses without a
+                // Content-Type header keep the legacy JSON-parse path.
+                const contentType = response.headers.get('content-type') ?? '';
+                if (response.ok && contentType !== '' && !contentType.includes('application/json')) {
+                    const buf = await response.arrayBuffer();
+                    if (buf.byteLength > 0) {
+                        return { data: new Uint8Array(buf), content_type: contentType };
+                    }
+                    return {};
+                }
+                // Parse response body
+                const body = (await response.json().catch(() => ({})));
+                // Error responses
+                if (!response.ok) {
+                    const apiError = body.error;
+                    throw errors_js_1.ProofError.fromResponse(response.status, apiError);
+                }
+                return body;
+            }
+            catch (error) {
+                clearTimeout(timeoutId);
+                if (error instanceof errors_js_1.ProofError)
+                    throw error;
+                lastError = error;
+                // Abort = timeout
+                if (lastError.name === 'AbortError') {
+                    if (attempt < this.maxRetries) {
+                        await this.sleep(this.backoff(attempt));
+                        continue;
+                    }
+                    throw new errors_js_1.TimeoutError(`Request to ${method} ${path} timed out after ${this.timeout}ms`);
+                }
+                // Network errors — retry
+                if (attempt < this.maxRetries) {
+                    await this.sleep(this.backoff(attempt));
+                    continue;
+                }
+            }
+        }
+        throw new errors_js_1.NetworkError(lastError?.message ?? 'Network request failed');
+    }
+    get(path, query) {
+        return this.request('GET', path, { query });
+    }
+    post(path, body) {
+        return this.request('POST', path, { body });
+    }
+    put(path, body) {
+        return this.request('PUT', path, { body });
+    }
+    del(path) {
+        return this.request('DELETE', path);
+    }
+    /**
+     * Raw fetch with auth + user-agent headers applied. Used for SSE streaming
+     * and other non-JSON responses. Does NOT retry, does NOT parse body, does
+     * NOT apply the default request timeout — the caller owns lifecycle via
+     * AbortSignal.
+     */
+    rawFetch(path, options = {}) {
+        const url = this.buildUrl(path, options.query);
+        const headers = {
+            'Authorization': `Bearer ${this.apiKey}`,
+            'User-Agent': `proof-sdk-js/${version_js_1.VERSION}`,
+            ...(options.headers ?? {}),
+        };
+        return this._fetch(url, { method: 'GET', headers, signal: options.signal });
+    }
+    /**
+     * Fetch a PUBLIC artifact by absolute url through the configured transport — no API key, no
+     * retries, redirects refused.
+     *
+     * The key is left off deliberately rather than forgotten: the issuer's status list is a shared
+     * document whose whole point is that reading it says nothing about WHICH proof is being checked
+     * (`docs/api-map.yaml`, the status-list endpoint is public). Sending a credential with it would
+     * hand the issuer the one fact the design withholds. Redirects are refused because the caller
+     * has already decided the url's origin is trusted, and a redirect would move it.
+     */
+    fetchPublic(url, options) {
+        return this._fetch(url, {
+            method: 'GET',
+            headers: {
+                'User-Agent': `proof-sdk-js/${version_js_1.VERSION}`,
+                ...(options.headers ?? {}),
+            },
+            redirect: 'error',
+            signal: AbortSignal.timeout(options.timeoutMs),
+        });
+    }
+    buildUrl(path, query) {
+        const url = new URL(path, this.baseUrl);
+        if (query) {
+            for (const [key, value] of Object.entries(query)) {
+                if (value !== undefined) {
+                    url.searchParams.set(key, String(value));
+                }
+            }
+        }
+        return url.toString();
+    }
+    backoff(attempt) {
+        return Math.min(1000 * Math.pow(2, attempt), 10000);
+    }
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}
+exports.HttpClient = HttpClient;
+//# sourceMappingURL=http.js.map

package/dist/cjs/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":";;;AAqBA,gCA2BC;AAhDD,2CAAqE;AAErE,6CAAuC;AAYvC;;;;;;GAMG;AACI,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,KAAa;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,6FAA6F;QAC7F,4FAA4F;QAC5F,wFAAwF;QACxF,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC9B,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,MAAa,UAAU;IAOrB,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,OAGC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAEhD,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACtC,MAAM;oBACN,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;wBACxC,YAAY,EAAE,gBAAgB,oBAAO,EAAE;qBACxC;oBACD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,qCAAqC;gBACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACvD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACnF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACxB,SAAS;gBACX,CAAC;gBAED,qCAAqC;gBACrC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,uEAAuE;gBACvE,oEAAoE;gBACpE,oEAAoE;gBACpE,uDAAuD;gBACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC/D,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACnF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,WAAW,EAAO,CAAC;oBACvE,CAAC;oBACD,OAAO,EAAO,CAAC;gBACjB,CAAC;gBAED,sBAAsB;gBACtB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;gBAElF,kBAAkB;gBAClB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAA6B,CAAC;oBACpD,MAAM,sBAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3D,CAAC;gBAED,OAAO,IAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,IAAI,KAAK,YAAY,sBAAU;oBAAE,MAAM,KAAK,CAAC;gBAE7C,SAAS,GAAG,KAAc,CAAC;gBAE3B,kBAAkB;gBAClB,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACpC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;wBACxC,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,wBAAY,CAAC,cAAc,MAAM,IAAI,IAAI,oBAAoB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3F,CAAC;gBAED,yBAAyB;gBACzB,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,wBAAY,CAAC,SAAS,EAAE,OAAO,IAAI,wBAAwB,CAAC,CAAC;IACzE,CAAC;IAED,GAAG,CAAI,IAAY,EAAE,KAAkC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAI,IAAY,EAAE,IAAc;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAI,IAAY,EAAE,IAAc;QACjC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAI,IAAY;QACjB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CACN,IAAY,EACZ,UAA0G,EAAE;QAE5G,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACxC,YAAY,EAAE,gBAAgB,oBAAO,EAAE;YACvC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC3B,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,GAAW,EAAE,OAAgE;QACvF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,YAAY,EAAE,gBAAgB,oBAAO,EAAE;gBACvC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;aAC3B;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAAkC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAzLD,gCAyLC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,26 @@
+export { Proof } from './client.js';
+export { VERSION } from './version.js';
+export { resolveApiKey, resolveBaseUrl, credentialKey, defaultCredentialsPath, LOGIN_COMMAND, } from './credentials.js';
+export type { ResolvedKey, KeySource } from './credentials.js';
+export { streamEndpoint, type SSEEvent, type StreamEvent, type StreamOptions, type StreamConfig, } from './streaming.js';
+export { AuthSessions, type AuthSession, type AuthSessionStreamConnected, type AuthSessionStreamUpdate, type AuthSessionStreamEvent, } from './resources/auth-sessions.js';
+export { Me, type PhoneAddSession, type PhoneAddSessionStreamConnected, type PhoneAddSessionStreamUpdate, type PhoneAddSessionStreamEvent, type EmailAddSession, type EmailAddSessionStreamConnected, type EmailAddSessionStreamUpdate, type EmailAddSessionStreamEvent, type TwoFASession, type TwoFASessionStreamConnected, type TwoFASessionStreamUpdate, type TwoFASessionStreamEvent, } from './resources/me.js';
+export { HitlChatIdDiscovery, type ChatIdDiscovery, type ChatIdDiscoveryStreamConnected, type ChatIdDiscoveryStreamUpdate, type ChatIdDiscoveryStreamEvent, } from './resources/hitl-chat-id.js';
+export type { ConfirmationStreamConnected, ConfirmationStreamUpdate, ConfirmationStreamEvent, } from './resources/confirmations.js';
+export type { VerificationStreamConnected, VerificationStreamUpdate, VerificationStreamEvent, } from './resources/verifications.js';
+export { Authorizations } from './resources/authorizations.js';
+export type { VerificationRequestAssetStatus, VerificationRequestAssetStreamConnected, VerificationRequestAssetStreamUpdate, VerificationRequestAssetStreamEvent, } from './resources/verification-requests.js';
+export { Hitl } from './resources/hitl.js';
+export { Templates } from './resources/templates.js';
+export { Profiles } from './resources/profiles.js';
+export { PublicProfiles } from './resources/public-profiles.js';
+export { ProofMe } from './resources/proof-me.js';
+export type { ProofMeChannel, CreateIdentityChallengeParams, IdentityChallenge, IdentityChallengeStatus, } from './resources/proof-me.js';
+export { Circles } from './resources/circles.js';
+export { Delegations } from './resources/delegations.js';
+export { ProofError, ValidationError, AuthenticationError, ForbiddenError, NotFoundError, ConflictError, RateLimitError, ServerError, NetworkError, TimeoutError, PollingTimeoutError, ConfirmationDeniedError, } from './errors.js';
+export type { VerificationType, VerificationChannel, VerificationStatus, SessionChannel, SessionSmsNumber, VerificationRequestStatus, ActionType, ApiError, Pagination, PaginatedList, ChallengeInstructions, ProofToken, Verification, CreateVerificationParams, ListVerificationsParams, ResendResponse, TestVerifyResponse, StartDomainVerificationParams, DomainVerification, DomainCheckResponse, VerifiedUserVerification, VerifiedUser, ListVerifiedUsersParams, MultiChannelPhoneChannel, CreateMultiChannelVerificationParams, MultiChannelChannelBlock, MultiChannelVerificationResponse, MultiChannelGroupStatusResponse, RequestedAsset, VerificationRequestAsset, VerificationRequest, VerificationRequestListItem, CancelVerificationRequestResponse, CreateVerificationRequestParams, ListVerificationRequestsParams, ProofStatus, ProofValidation, RevokedProof, RevocationList, RevokeResponse, OfflineVerificationResult, OfflineVerificationOptions, OfflineFailureReason, OfflinePullHint, Session, CreateSessionParams, WebhookDelivery, WebhookRetryResponse, WebhookDeliveryList, WebhookDeliveryStats, WebhookPagination, ListWebhookDeliveriesParams, HitlStatus, HitlChannel, HitlConfig, CreateHitlParams, UpdateHitlParams, HitlListParams, HitlListResponse, HitlAuthorizationResult, HitlAuthorizationResponse, HitlFinalizeResponse, ChatIdDiscoveryCreateResponse, ApprovalLinkResponse, VerificationRequestProof, VerificationRequestProofsResponse, CircleStatus, CircleMemberStatus, CircleMemberChannelType, CircleMemberChannelStatus, CircleMember, Circle, CircleListResponse, CircleMemberInput, CreateCircleParams, UpdateCircleParams, CircleListParams, CircleMemberListResponse, CreateCircleMemberParams, CircleMemberInviteResponse, CircleMemberDrillResponse, AddCircleMemberChannelParams, CircleMemberChannel, CircleMemberChannelListResponse, DelegateIdentifierType, DelegationStatus, DelegationEffectiveStatus, RevokeDelegationReason, DelegateIdentifier, Delegation, DelegationWithToken, DelegationDetail, CreateDelegationParams, DelegationListParams, DelegationListResponse, RevokeDelegationParams, HitlKeysResponse, HitlKeysPutParams, HitlKeysPutResponse, HitlKeysDeleteResponse, HitlApproverKey, HitlApproverKeysResponse, Authorization, UpdateAuthorizationBody, CreateAuthorizationParams, AuthorizationListParams, AuthorizationListResponse, CreateAuthorizationResponse, AuthorizationExportParams, AuthorizationExportResponse, TemplateChannel, TemplateMessageType, TemplateContent, TemplateProjectOptions, Template, TemplateVariable, TemplateListResponse, TemplateDefaultsResponse, TemplateGetResponse, TemplateUpsertResponse, TemplateDeleteResponse, RenderedTemplate, TemplatePreviewParams, TemplatePreviewResponse, TemplateRenderParams, TemplateRenderResponse, ProfileTheme, CustomLink, Profile, CreateProfileParams, UpdateProfileParams, ProfileListResponse, ProfileDeleteResponse, ProfileTemplate, ProfileTemplateListResponse, ProfileTemplateUpdateParams, ProfileTemplatePreviewParams, ProfileTemplatePreviewResponse, PublicProfileProof, PublicProfileLink, PublicProfileView, PublicProfileDelegation, UsernameAvailabilityResponse, BinaryResponse, AvatarResponse, ComputedState, MeEnvironmentParams, MeSearchBucket, MeSearchParams, MeSearchResults, PlatformSummary, ApiKeyMetadata, ApiKeyUsage, WebhookEventType, ProofOptions, WaitOptions, ConfirmAndWaitOptions, } from './types.js';
+export { computeKid, generateKeyPair, generateEncryptionKeyPair, deriveKey, encryptMessage, encryptMessageV2, decryptMessage, encryptPrivateKey, decryptPrivateKey, validateMessageEnvelope, validatePrivateKeyEnvelope, } from './crypto/hitl-crypto.js';
+export type { CiphertextEnvelope, CiphertextEnvelopeV1, CiphertextEnvelopeV2, EncryptedPrivateKey, HitlKeyPair, } from './crypto/hitl-crypto.js';
+export { Proof as default } from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG/D,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EACV,8BAA8B,EAC9B,uCAAuC,EACvC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGrD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGhE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,YAAY,EACV,cAAc,EACd,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EACL,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAEV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,UAAU,EAGV,QAAQ,EACR,UAAU,EACV,aAAa,EAGb,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,oCAAoC,EACpC,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAG/B,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,8BAA8B,EAG9B,WAAW,EACX,eAAe,EACf,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,eAAe,EAGf,OAAO,EACP,mBAAmB,EAGnB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,EAG3B,UAAU,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,iCAAiC,EAGjC,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,YAAY,EACZ,MAAM,EACN,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,EAC5B,mBAAmB,EACnB,+BAA+B,EAG/B,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EAGtB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,wBAAwB,EAGxB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAG3B,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EAGtB,YAAY,EACZ,UAAU,EACV,OAAO,EACP,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAG9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,cAAc,EAGd,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EAGX,gBAAgB,EAGhB,YAAY,EACZ,WAAW,EACX,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,eAAe,EACf,yBAAyB,EACzB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,GACZ,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = exports.validatePrivateKeyEnvelope = exports.validateMessageEnvelope = exports.decryptPrivateKey = exports.encryptPrivateKey = exports.decryptMessage = exports.encryptMessageV2 = exports.encryptMessage = exports.deriveKey = exports.generateEncryptionKeyPair = exports.generateKeyPair = exports.computeKid = exports.ConfirmationDeniedError = exports.PollingTimeoutError = exports.TimeoutError = exports.NetworkError = exports.ServerError = exports.RateLimitError = exports.ConflictError = exports.NotFoundError = exports.ForbiddenError = exports.AuthenticationError = exports.ValidationError = exports.ProofError = exports.Delegations = exports.Circles = exports.ProofMe = exports.PublicProfiles = exports.Profiles = exports.Templates = exports.Hitl = exports.Authorizations = exports.HitlChatIdDiscovery = exports.Me = exports.AuthSessions = exports.streamEndpoint = exports.LOGIN_COMMAND = exports.defaultCredentialsPath = exports.credentialKey = exports.resolveBaseUrl = exports.resolveApiKey = exports.VERSION = exports.Proof = void 0;
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "Proof", { enumerable: true, get: function () { return client_js_1.Proof; } });
+var version_js_1 = require("./version.js");
+Object.defineProperty(exports, "VERSION", { enumerable: true, get: function () { return version_js_1.VERSION; } });
+// Key and base-URL resolution (what `new Proof()` with no key runs)
+var credentials_js_1 = require("./credentials.js");
+Object.defineProperty(exports, "resolveApiKey", { enumerable: true, get: function () { return credentials_js_1.resolveApiKey; } });
+Object.defineProperty(exports, "resolveBaseUrl", { enumerable: true, get: function () { return credentials_js_1.resolveBaseUrl; } });
+Object.defineProperty(exports, "credentialKey", { enumerable: true, get: function () { return credentials_js_1.credentialKey; } });
+Object.defineProperty(exports, "defaultCredentialsPath", { enumerable: true, get: function () { return credentials_js_1.defaultCredentialsPath; } });
+Object.defineProperty(exports, "LOGIN_COMMAND", { enumerable: true, get: function () { return credentials_js_1.LOGIN_COMMAND; } });
+// Streaming helpers
+var streaming_js_1 = require("./streaming.js");
+Object.defineProperty(exports, "streamEndpoint", { enumerable: true, get: function () { return streaming_js_1.streamEndpoint; } });
+// Resource classes and types for streaming endpoints
+var auth_sessions_js_1 = require("./resources/auth-sessions.js");
+Object.defineProperty(exports, "AuthSessions", { enumerable: true, get: function () { return auth_sessions_js_1.AuthSessions; } });
+var me_js_1 = require("./resources/me.js");
+Object.defineProperty(exports, "Me", { enumerable: true, get: function () { return me_js_1.Me; } });
+var hitl_chat_id_js_1 = require("./resources/hitl-chat-id.js");
+Object.defineProperty(exports, "HitlChatIdDiscovery", { enumerable: true, get: function () { return hitl_chat_id_js_1.HitlChatIdDiscovery; } });
+// Authorization consent resource
+var authorizations_js_1 = require("./resources/authorizations.js");
+Object.defineProperty(exports, "Authorizations", { enumerable: true, get: function () { return authorizations_js_1.Authorizations; } });
+// HITL config resource
+var hitl_js_1 = require("./resources/hitl.js");
+Object.defineProperty(exports, "Hitl", { enumerable: true, get: function () { return hitl_js_1.Hitl; } });
+// Message templates resource
+var templates_js_1 = require("./resources/templates.js");
+Object.defineProperty(exports, "Templates", { enumerable: true, get: function () { return templates_js_1.Templates; } });
+// Profiles resource
+var profiles_js_1 = require("./resources/profiles.js");
+Object.defineProperty(exports, "Profiles", { enumerable: true, get: function () { return profiles_js_1.Profiles; } });
+// Public profiles resource
+var public_profiles_js_1 = require("./resources/public-profiles.js");
+Object.defineProperty(exports, "PublicProfiles", { enumerable: true, get: function () { return public_profiles_js_1.PublicProfiles; } });
+// Proof-Me resource (anti-impersonation challengers + identity challenges + drills)
+var proof_me_js_1 = require("./resources/proof-me.js");
+Object.defineProperty(exports, "ProofMe", { enumerable: true, get: function () { return proof_me_js_1.ProofMe; } });
+// Circles resource (people-primitive: members + member channels)
+var circles_js_1 = require("./resources/circles.js");
+Object.defineProperty(exports, "Circles", { enumerable: true, get: function () { return circles_js_1.Circles; } });
+// Delegations resource (Proof of Delegation: domain → typed artifact)
+var delegations_js_1 = require("./resources/delegations.js");
+Object.defineProperty(exports, "Delegations", { enumerable: true, get: function () { return delegations_js_1.Delegations; } });
+// Error classes
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "ProofError", { enumerable: true, get: function () { return errors_js_1.ProofError; } });
+Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return errors_js_1.ValidationError; } });
+Object.defineProperty(exports, "AuthenticationError", { enumerable: true, get: function () { return errors_js_1.AuthenticationError; } });
+Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: function () { return errors_js_1.ForbiddenError; } });
+Object.defineProperty(exports, "NotFoundError", { enumerable: true, get: function () { return errors_js_1.NotFoundError; } });
+Object.defineProperty(exports, "ConflictError", { enumerable: true, get: function () { return errors_js_1.ConflictError; } });
+Object.defineProperty(exports, "RateLimitError", { enumerable: true, get: function () { return errors_js_1.RateLimitError; } });
+Object.defineProperty(exports, "ServerError", { enumerable: true, get: function () { return errors_js_1.ServerError; } });
+Object.defineProperty(exports, "NetworkError", { enumerable: true, get: function () { return errors_js_1.NetworkError; } });
+Object.defineProperty(exports, "TimeoutError", { enumerable: true, get: function () { return errors_js_1.TimeoutError; } });
+Object.defineProperty(exports, "PollingTimeoutError", { enumerable: true, get: function () { return errors_js_1.PollingTimeoutError; } });
+Object.defineProperty(exports, "ConfirmationDeniedError", { enumerable: true, get: function () { return errors_js_1.ConfirmationDeniedError; } });
+// HITL E2E encryption crypto helpers
+var hitl_crypto_js_1 = require("./crypto/hitl-crypto.js");
+Object.defineProperty(exports, "computeKid", { enumerable: true, get: function () { return hitl_crypto_js_1.computeKid; } });
+Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return hitl_crypto_js_1.generateKeyPair; } });
+Object.defineProperty(exports, "generateEncryptionKeyPair", { enumerable: true, get: function () { return hitl_crypto_js_1.generateEncryptionKeyPair; } });
+Object.defineProperty(exports, "deriveKey", { enumerable: true, get: function () { return hitl_crypto_js_1.deriveKey; } });
+Object.defineProperty(exports, "encryptMessage", { enumerable: true, get: function () { return hitl_crypto_js_1.encryptMessage; } });
+Object.defineProperty(exports, "encryptMessageV2", { enumerable: true, get: function () { return hitl_crypto_js_1.encryptMessageV2; } });
+Object.defineProperty(exports, "decryptMessage", { enumerable: true, get: function () { return hitl_crypto_js_1.decryptMessage; } });
+Object.defineProperty(exports, "encryptPrivateKey", { enumerable: true, get: function () { return hitl_crypto_js_1.encryptPrivateKey; } });
+Object.defineProperty(exports, "decryptPrivateKey", { enumerable: true, get: function () { return hitl_crypto_js_1.decryptPrivateKey; } });
+Object.defineProperty(exports, "validateMessageEnvelope", { enumerable: true, get: function () { return hitl_crypto_js_1.validateMessageEnvelope; } });
+Object.defineProperty(exports, "validatePrivateKeyEnvelope", { enumerable: true, get: function () { return hitl_crypto_js_1.validatePrivateKeyEnvelope; } });
+// Default export for convenience: import Proof from '@proof-holdings/sdk'
+var client_js_2 = require("./client.js");
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return client_js_2.Proof; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AAA3B,kGAAA,KAAK,OAAA;AACd,2CAAuC;AAA9B,qGAAA,OAAO,OAAA;AAEhB,oEAAoE;AACpE,mDAM0B;AALxB,+GAAA,aAAa,OAAA;AACb,gHAAA,cAAc,OAAA;AACd,+GAAA,aAAa,OAAA;AACb,wHAAA,sBAAsB,OAAA;AACtB,+GAAA,aAAa,OAAA;AAIf,oBAAoB;AACpB,+CAMwB;AALtB,8GAAA,cAAc,OAAA;AAOhB,qDAAqD;AACrD,iEAMsC;AALpC,gHAAA,YAAY,OAAA;AAMd,2CAc2B;AAbzB,2FAAA,EAAE,OAAA;AAcJ,+DAMqC;AALnC,sHAAA,mBAAmB,OAAA;AAiBrB,iCAAiC;AACjC,mEAA+D;AAAtD,mHAAA,cAAc,OAAA;AAQvB,uBAAuB;AACvB,+CAA2C;AAAlC,+FAAA,IAAI,OAAA;AAEb,6BAA6B;AAC7B,yDAAqD;AAA5C,yGAAA,SAAS,OAAA;AAElB,oBAAoB;AACpB,uDAAmD;AAA1C,uGAAA,QAAQ,OAAA;AAEjB,2BAA2B;AAC3B,qEAAgE;AAAvD,oHAAA,cAAc,OAAA;AAEvB,oFAAoF;AACpF,uDAAkD;AAAzC,sGAAA,OAAO,OAAA;AAQhB,iEAAiE;AACjE,qDAAiD;AAAxC,qGAAA,OAAO,OAAA;AAEhB,sEAAsE;AACtE,6DAAyD;AAAhD,6GAAA,WAAW,OAAA;AAEpB,gBAAgB;AAChB,yCAaqB;AAZnB,uGAAA,UAAU,OAAA;AACV,4GAAA,eAAe,OAAA;AACf,gHAAA,mBAAmB,OAAA;AACnB,2GAAA,cAAc,OAAA;AACd,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,yGAAA,YAAY,OAAA;AACZ,gHAAA,mBAAmB,OAAA;AACnB,oHAAA,uBAAuB,OAAA;AAuMzB,qCAAqC;AACrC,0DAYiC;AAX/B,4GAAA,UAAU,OAAA;AACV,iHAAA,eAAe,OAAA;AACf,2HAAA,yBAAyB,OAAA;AACzB,2GAAA,SAAS,OAAA;AACT,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAChB,gHAAA,cAAc,OAAA;AACd,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,yHAAA,uBAAuB,OAAA;AACvB,4HAAA,0BAA0B,OAAA;AAU5B,0EAA0E;AAC1E,yCAA+C;AAAtC,oGAAA,KAAK,OAAW"}

package/dist/cjs/jwks/key-set-cache.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The issuer's key set as offline verification holds it — the I/O half around `keyset.ts`, which
+ * owns the rules. Mirrors `packages/delegation-verifier/src/jwks.ts`, minus persistence: this SDK
+ * keeps tombstones in memory only.
+ *
+ * Replaces jose's `createRemoteJWKSet`, which hid the fetch time and the registry's own JWK members
+ * and so could enforce neither tombstones, windows nor staleness. The behaviours it supplied are
+ * kept: a 10-minute reuse window, one forced refetch per 30 s for an unknown `kid`, one fetch in
+ * flight at a time. What it did not do, and this does:
+ *
+ *   - A fetch is MERGED into what the verifier knows (`mergeFetchedDocument`), never swapped in.
+ *   - A failed refetch does not discard the cache. Within `maxJwksAgeMs` its CONFIRMED keys keep
+ *     answering; beyond it the answer is `stale` — except an applied tombstone, which is `revoked`
+ *     at any age. A set never fetched has nothing to fall back on and stays `unavailable`.
+ *   - A failed refetch of a cached set is retried at most once per cooldown, so an outage does not
+ *     turn every verification into an outbound request.
+ *   - Age is measured on a monotonic clock; claim checks use the wall clock.
+ */
+import { type KeyLike } from 'jose';
+import { type HttpClient } from '../http.js';
+import type { KeyFamily, KeyRecord, KeySetEvent } from './keyset.js';
+export declare const SUPPORTED_ALGORITHMS: readonly ["RS256", "ES256"];
+export type SupportedAlgorithm = (typeof SUPPORTED_ALGORITHMS)[number];
+/** How long a `kid` miss — or a failed refetch of a cached set — suppresses further fetches. */
+export declare const KEY_MISS_COOLDOWN_MS = 30000;
+/** How long a fetched key set is reused without refetching (jose's default, kept). */
+export declare const KEY_SET_TTL_MS: number;
+/** Default `maxJwksAgeMs`. */
+export declare const DEFAULT_MAX_JWKS_AGE_MS: number;
+/** Largest accepted `maxJwksAgeMs` — below the issuer's ~30-day lead on its next key. */
+export declare const MAX_JWKS_AGE_CAP_MS: number;
+export interface JwksClock {
+    monotonicMs(): number;
+    wallMs(): number;
+}
+/** Test seam — replaces both clocks; `null` restores the system clocks. Not exported from the package. */
+export declare function setJwksClockForTests(replacement: JwksClock | null): void;
+/** Test seam — receives every key-set event; `null` detaches. Not exported from the package. */
+export declare function setJwksEventListenerForTests(listener: ((event: KeySetEvent) => void) | null): void;
+export declare function nowWallMs(): number;
+/** Throws unless `value` is a usable `maxJwksAgeMs`: whole milliseconds, 1 … 25 days. */
+export declare function assertMaxJwksAgeMs(value: unknown): asserts value is number;
+export declare function isSupportedAlgorithm(alg: unknown): alg is SupportedAlgorithm;
+export interface KeyCandidate {
+    key: KeyLike | Uint8Array;
+    record: KeyRecord;
+}
+export type KeyResolution = {
+    kind: 'keys';
+    candidates: KeyCandidate[];
+    registryLive: boolean;
+} | {
+    kind: 'revoked';
+    kid: string;
+} | {
+    kind: 'wrong_purpose';
+    kid: string;
+} | {
+    kind: 'unknown';
+} | {
+    kind: 'stale';
+    cacheAgeSeconds: number | null;
+} | {
+    kind: 'unavailable';
+    message: string;
+};
+export declare class KeySetCache {
+    private readonly http;
+    private readonly jwksUri;
+    private readonly maxJwksAgeMs;
+    private state;
+    /** Imported keys by key material + algorithm; `null` records a JWK that failed to import. */
+    private readonly imported;
+    private lastMissAt;
+    private lastFailedAt;
+    private inFlight;
+    private forceNext;
+    constructor(http: HttpClient, jwksUri: string, maxJwksAgeMs: number);
+    /**
+     * The keys that may verify a token of `family` carrying `kid` — or why none may. Fetches when the
+     * set is older than the TTL, after `forceRefresh()`, or once per cooldown when `kid` is unknown.
+     */
+    resolve(kid: string | undefined, alg: SupportedAlgorithm, family: KeyFamily): Promise<KeyResolution>;
+    /** Make the next resolution refetch, ignoring the TTL and both cooldowns. Keeps what is known. */
+    forceRefresh(): void;
+    /** Forget every applied and pending tombstone — the documented manual reset. */
+    clearTombstones(): void;
+    /** What the cache holds, for tests. */
+    diagnostics(): {
+        cacheAgeSeconds: number | null;
+        registryLive: boolean;
+        vanishedKids: string[];
+    };
+    private cacheAgeMs;
+    private isFresh;
+    /**
+     * One fetch at a time. The shared promise RESOLVES to the outcome rather than recording it on
+     * the instance, so a waiter cannot be handed the result of the NEXT fetch.
+     */
+    private runFetch;
+    private fetchDocument;
+    private resolveFromState;
+    private importRecord;
+}
+//# sourceMappingURL=key-set-cache.d.ts.map

package/dist/cjs/jwks/key-set-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-set-cache.d.ts","sourceRoot":"","sources":["../../../src/jwks/key-set-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAuB,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AASzD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAe,MAAM,aAAa,CAAC;AAGlF,eAAO,MAAM,oBAAoB,6BAA8B,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,sFAAsF;AACtF,eAAO,MAAM,cAAc,QAAc,CAAC;AAC1C,8BAA8B;AAC9B,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,QAAwB,CAAC;AAMzD,MAAM,WAAW,SAAS;IACxB,WAAW,IAAI,MAAM,CAAC;IACtB,MAAM,IAAI,MAAM,CAAC;CAClB;AAUD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAExE;AAED,gGAAgG;AAChG,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAElG;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAM1E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,kBAAkB,CAE5E;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,YAAY,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GACnE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAI7C,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAX/B,OAAO,CAAC,KAAK,CAAmC;IAChD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkD;IAC3E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAS;gBAGP,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM;IAGvC;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IA6C1G,kGAAkG;IAClG,YAAY,IAAI,IAAI;IAIpB,gFAAgF;IAChF,eAAe,IAAI,IAAI;IAIvB,uCAAuC;IACvC,WAAW,IAAI;QAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;IAWhG,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,OAAO;IAIf;;;OAGG;IACH,OAAO,CAAC,QAAQ;YAgCF,aAAa;YAwBb,gBAAgB;YAiBhB,YAAY;CAsB3B"}