@thurinlabs/identity-kit 1.2.0 → 1.3.0

package/dist/core.d.cts

@@ -1305,66 +1305,6 @@ interface EnsTextReader {
 /** Read a name's `id.thurin` record and compare it with the verified fingerprint. */
 declare function fetchEnsHint(client: EnsTextReader, name: string, verifiedFingerprint: string | null | undefined): Promise<EnsHint>;
 
-declare function identifyProof(notation: Notation): Proof | null;
-declare function displayUrl(proof: Proof): string;
-declare function proofHref(proof: Proof): string | null;
-declare function proofSecondaryHref(proof: Proof): string | null;
-declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
-
-declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
-declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
-    pgpPublicKey: string | null;
-    pgpSignature: string | null;
-    fingerprint: string;
-    ethAddress: string;
-}): Promise<PGPVerification>;
-interface StrippedKey {
-    /** Armored public key containing only the non-email user IDs. */
-    armored: string;
-    /** User IDs kept (no `@`). */
-    kept: string[];
-    /** User IDs removed (contained an `@`). */
-    removed: string[];
-}
-/**
- * Remove every user ID that contains an email address, keeping the rest (and
- * their self-certifications, so proof notations on a non-email user ID survive).
- * Returns null when nothing would remain — openpgp needs at least one
- * self-certified user ID to verify signatures, so such a key must not be
- * published. The key material and subkeys are untouched; the fingerprint is
- * unchanged.
- */
-declare function stripEmailUserIDs(armoredKey: string): Promise<StrippedKey | null>;
-/** True when any user ID on the key contains an email address. */
-declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
-declare function fetchKeyByFingerprint(fingerprint: string): Promise<string | null>;
-declare function fetchKeyByKeyId(keyId: string): Promise<string | null>;
-
-/**
- * EFP social graph for an address. Followers are counted by EFP for any address,
- * whether or not it has published a list of its own; following and top-8 exist
- * only when it has (its "primary list"). An address with followers but no list
- * — a project account that has never followed anyone — is still on EFP.
- */
-declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
-
-/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
-declare function normalizeFingerprint(input: string): string | null;
-/** Fingerprint → the raw `bytes` argument the v2 registry takes (0x-prefixed, 20 or 32 bytes). */
-declare function fingerprintToBytes(fingerprint: string): Hex;
-/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
-declare function bytesToFingerprint(bytes: Hex | string): string;
-/** keccak256 of the raw fingerprint bytes — the `fingerprintHash` the registry indexes by. */
-declare function fingerprintHash(fingerprint: string): Hex;
-/**
- * The long key ID as the `bytes8` the registry indexes by. Per RFC 9580 §5.5.4 it is the
- * low-order 8 bytes of a v4 (20-byte) fingerprint and the high-order 8 bytes of a v6
- * (32-byte) fingerprint — the same value `gpg --keyid-format long` prints.
- */
-declare function keyIdOf(fingerprint: string): Hex;
-/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
-declare function keyIdToBytes(keyId: string): Hex | null;
-
 /**
  * EIP-712 authorizations for the registry's relayed writes (`attestFor`, `reattestFor`,
  * `updateKeyFor`, `revokeFor`, `setRecordFor`). The owner signs one of these typed
@@ -1661,4 +1601,159 @@ declare function authorizationDigest(typedData: ReturnType<typeof attestTypedDat
 /** `bytes32 kind` for a record from a human-readable name, e.g. recordKind('thurin.vouch'). */
 declare function recordKind(name: string): Hex;
 
-export { AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, type IdentityKitConfig, NETWORKS, type NetworkName, type Notation, type PGPKeyInfo, type PGPVerification, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, attestTypedData, authorizationDigest, bytesToFingerprint, chainFor, displayUrl, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchKeyByFingerprint, fetchKeyByKeyId, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, isNetworkName, keyIdOf, keyIdToBytes, normalizeFingerprint, parsePgpKey, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyProof };
+/**
+ * Records: one small value per claim per kind, set only by the owner (or by anyone holding
+ * the owner's `setRecordFor` authorization), readable by anyone, clearable. The contract looks
+ * a record up by kind and cannot list them, so readers ask for the kinds they know.
+ *
+ * Conventions: kind = keccak256("thurin.<name>"); simple kinds are UTF-8 text, structured
+ * kinds small JSON with a `v`, encrypted kinds an armored PGP message; readers ignore unknown
+ * fields. Third parties use reverse-dot names (`com.example.thing`) without asking. 1 KB max.
+ */
+declare const MAX_RECORD_BYTES = 1024;
+/** `thurin.` is the default namespace: kindName('canary') === 'thurin.canary'. Dotted names pass through. */
+declare function kindName(input: string): string;
+/** Every kind Thurin defines. `thurin.pointer` is the Thurin Labs release list (CLI only; not shown on identity pages). */
+declare const KNOWN_KINDS: readonly ["thurin.railgun", "thurin.security", "thurin.successor", "thurin.affiliation", "thurin.canary", "thurin.private", "thurin.disclosure", "thurin.pointer"];
+type KnownKind = (typeof KNOWN_KINDS)[number];
+/** The kinds an identity page shows, in display order. */
+declare const IDENTITY_KINDS: readonly KnownKind[];
+declare function encodeRecord(value: string): Hex;
+declare function decodeRecord(hex: Hex): string;
+interface PointerEntry {
+    name: string;
+    sha256: string;
+    date: string;
+    url?: string;
+}
+interface PointerRecord {
+    v: 1;
+    releases: PointerEntry[];
+}
+declare function parsePointer(text: string): PointerRecord;
+/** Add a release, newest first; drop the oldest until it fits the 1 KB slot. */
+declare function addPointer(existing: PointerRecord | null, entry: PointerEntry): {
+    record: PointerRecord;
+    dropped: PointerEntry[];
+};
+declare function renderPointer(p: PointerRecord): string;
+/** A record as the identity page shows it: what was stored, and what it means if it parses. */
+interface ParsedRecord {
+    kind: string;
+    /** The raw UTF-8 value. */
+    text: string;
+    bytes: number;
+    /** True when the value has the shape the kind defines. A malformed record is still shown, as text. */
+    valid: boolean;
+    /** Why it is not valid, when it is not. */
+    reason?: string;
+    /** Kind-specific fields, when valid. */
+    data: RecordData;
+}
+type RecordData = {
+    type: 'railgun';
+    address: string;
+} | {
+    type: 'security';
+    contact: string;
+    url: string | null;
+} | {
+    type: 'successor';
+    fingerprint: string;
+} | {
+    type: 'affiliation';
+    with: string;
+    role: string | null;
+} | {
+    type: 'canary';
+    date: string;
+    statement: string;
+    clearsigned: boolean;
+} | {
+    type: 'encrypted';
+    recipients: number | null;
+} | {
+    type: 'pointer';
+    releases: PointerEntry[];
+} | {
+    type: 'text';
+};
+/**
+ * Parse a record of a known kind. Never throws: a value that does not fit its kind comes back
+ * with `valid: false` and a reason, so a page can still show what is there.
+ */
+declare function parseRecord(kind: string, text: string): Promise<ParsedRecord>;
+/** Minimal client shape: viem's PublicClient has it. */
+interface RecordReader {
+    readContract(args: {
+        address: `0x${string}`;
+        abi: unknown;
+        functionName: 'record';
+        args: readonly [`0x${string}`, bigint, Hex];
+    }): Promise<unknown>;
+}
+/**
+ * Read and parse the given kinds on one claim. Kinds with no record are left out.
+ * `registry` is the contract address; pass the kit's REGISTRY_ABI.
+ */
+declare function fetchRecords(client: RecordReader, registry: `0x${string}`, abi: unknown, owner: `0x${string}`, index: number | bigint, kinds?: readonly string[]): Promise<ParsedRecord[]>;
+
+declare function identifyProof(notation: Notation): Proof | null;
+declare function displayUrl(proof: Proof): string;
+declare function proofHref(proof: Proof): string | null;
+declare function proofSecondaryHref(proof: Proof): string | null;
+declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
+
+declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
+declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
+    pgpPublicKey: string | null;
+    pgpSignature: string | null;
+    fingerprint: string;
+    ethAddress: string;
+}): Promise<PGPVerification>;
+interface StrippedKey {
+    /** Armored public key containing only the non-email user IDs. */
+    armored: string;
+    /** User IDs kept (no `@`). */
+    kept: string[];
+    /** User IDs removed (contained an `@`). */
+    removed: string[];
+}
+/**
+ * Remove every user ID that contains an email address, keeping the rest (and
+ * their self-certifications, so proof notations on a non-email user ID survive).
+ * Returns null when nothing would remain — openpgp needs at least one
+ * self-certified user ID to verify signatures, so such a key must not be
+ * published. The key material and subkeys are untouched; the fingerprint is
+ * unchanged.
+ */
+declare function stripEmailUserIDs(armoredKey: string): Promise<StrippedKey | null>;
+/** True when any user ID on the key contains an email address. */
+declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
+
+/**
+ * EFP social graph for an address. Followers are counted by EFP for any address,
+ * whether or not it has published a list of its own; following and top-8 exist
+ * only when it has (its "primary list"). An address with followers but no list
+ * — a project account that has never followed anyone — is still on EFP.
+ */
+declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
+
+/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
+declare function normalizeFingerprint(input: string): string | null;
+/** Fingerprint → the raw `bytes` argument the v2 registry takes (0x-prefixed, 20 or 32 bytes). */
+declare function fingerprintToBytes(fingerprint: string): Hex;
+/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
+declare function bytesToFingerprint(bytes: Hex | string): string;
+/** keccak256 of the raw fingerprint bytes — the `fingerprintHash` the registry indexes by. */
+declare function fingerprintHash(fingerprint: string): Hex;
+/**
+ * The long key ID as the `bytes8` the registry indexes by. Per RFC 9580 §5.5.4 it is the
+ * low-order 8 bytes of a v4 (20-byte) fingerprint and the high-order 8 bytes of a v6
+ * (32-byte) fingerprint — the same value `gpg --keyid-format long` prints.
+ */
+declare function keyIdOf(fingerprint: string): Hex;
+/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
+declare function keyIdToBytes(keyId: string): Hex | null;
+
+export { AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, IDENTITY_KINDS, type IdentityKitConfig, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, type NetworkName, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, isNetworkName, keyIdOf, keyIdToBytes, kindName, normalizeFingerprint, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyProof };

package/dist/core.d.ts

@@ -1305,66 +1305,6 @@ interface EnsTextReader {
 /** Read a name's `id.thurin` record and compare it with the verified fingerprint. */
 declare function fetchEnsHint(client: EnsTextReader, name: string, verifiedFingerprint: string | null | undefined): Promise<EnsHint>;
 
-declare function identifyProof(notation: Notation): Proof | null;
-declare function displayUrl(proof: Proof): string;
-declare function proofHref(proof: Proof): string | null;
-declare function proofSecondaryHref(proof: Proof): string | null;
-declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
-
-declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
-declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
-    pgpPublicKey: string | null;
-    pgpSignature: string | null;
-    fingerprint: string;
-    ethAddress: string;
-}): Promise<PGPVerification>;
-interface StrippedKey {
-    /** Armored public key containing only the non-email user IDs. */
-    armored: string;
-    /** User IDs kept (no `@`). */
-    kept: string[];
-    /** User IDs removed (contained an `@`). */
-    removed: string[];
-}
-/**
- * Remove every user ID that contains an email address, keeping the rest (and
- * their self-certifications, so proof notations on a non-email user ID survive).
- * Returns null when nothing would remain — openpgp needs at least one
- * self-certified user ID to verify signatures, so such a key must not be
- * published. The key material and subkeys are untouched; the fingerprint is
- * unchanged.
- */
-declare function stripEmailUserIDs(armoredKey: string): Promise<StrippedKey | null>;
-/** True when any user ID on the key contains an email address. */
-declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
-declare function fetchKeyByFingerprint(fingerprint: string): Promise<string | null>;
-declare function fetchKeyByKeyId(keyId: string): Promise<string | null>;
-
-/**
- * EFP social graph for an address. Followers are counted by EFP for any address,
- * whether or not it has published a list of its own; following and top-8 exist
- * only when it has (its "primary list"). An address with followers but no list
- * — a project account that has never followed anyone — is still on EFP.
- */
-declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
-
-/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
-declare function normalizeFingerprint(input: string): string | null;
-/** Fingerprint → the raw `bytes` argument the v2 registry takes (0x-prefixed, 20 or 32 bytes). */
-declare function fingerprintToBytes(fingerprint: string): Hex;
-/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
-declare function bytesToFingerprint(bytes: Hex | string): string;
-/** keccak256 of the raw fingerprint bytes — the `fingerprintHash` the registry indexes by. */
-declare function fingerprintHash(fingerprint: string): Hex;
-/**
- * The long key ID as the `bytes8` the registry indexes by. Per RFC 9580 §5.5.4 it is the
- * low-order 8 bytes of a v4 (20-byte) fingerprint and the high-order 8 bytes of a v6
- * (32-byte) fingerprint — the same value `gpg --keyid-format long` prints.
- */
-declare function keyIdOf(fingerprint: string): Hex;
-/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
-declare function keyIdToBytes(keyId: string): Hex | null;
-
 /**
  * EIP-712 authorizations for the registry's relayed writes (`attestFor`, `reattestFor`,
  * `updateKeyFor`, `revokeFor`, `setRecordFor`). The owner signs one of these typed
@@ -1661,4 +1601,159 @@ declare function authorizationDigest(typedData: ReturnType<typeof attestTypedDat
 /** `bytes32 kind` for a record from a human-readable name, e.g. recordKind('thurin.vouch'). */
 declare function recordKind(name: string): Hex;
 
-export { AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, type IdentityKitConfig, NETWORKS, type NetworkName, type Notation, type PGPKeyInfo, type PGPVerification, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, attestTypedData, authorizationDigest, bytesToFingerprint, chainFor, displayUrl, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchKeyByFingerprint, fetchKeyByKeyId, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, isNetworkName, keyIdOf, keyIdToBytes, normalizeFingerprint, parsePgpKey, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyProof };
+/**
+ * Records: one small value per claim per kind, set only by the owner (or by anyone holding
+ * the owner's `setRecordFor` authorization), readable by anyone, clearable. The contract looks
+ * a record up by kind and cannot list them, so readers ask for the kinds they know.
+ *
+ * Conventions: kind = keccak256("thurin.<name>"); simple kinds are UTF-8 text, structured
+ * kinds small JSON with a `v`, encrypted kinds an armored PGP message; readers ignore unknown
+ * fields. Third parties use reverse-dot names (`com.example.thing`) without asking. 1 KB max.
+ */
+declare const MAX_RECORD_BYTES = 1024;
+/** `thurin.` is the default namespace: kindName('canary') === 'thurin.canary'. Dotted names pass through. */
+declare function kindName(input: string): string;
+/** Every kind Thurin defines. `thurin.pointer` is the Thurin Labs release list (CLI only; not shown on identity pages). */
+declare const KNOWN_KINDS: readonly ["thurin.railgun", "thurin.security", "thurin.successor", "thurin.affiliation", "thurin.canary", "thurin.private", "thurin.disclosure", "thurin.pointer"];
+type KnownKind = (typeof KNOWN_KINDS)[number];
+/** The kinds an identity page shows, in display order. */
+declare const IDENTITY_KINDS: readonly KnownKind[];
+declare function encodeRecord(value: string): Hex;
+declare function decodeRecord(hex: Hex): string;
+interface PointerEntry {
+    name: string;
+    sha256: string;
+    date: string;
+    url?: string;
+}
+interface PointerRecord {
+    v: 1;
+    releases: PointerEntry[];
+}
+declare function parsePointer(text: string): PointerRecord;
+/** Add a release, newest first; drop the oldest until it fits the 1 KB slot. */
+declare function addPointer(existing: PointerRecord | null, entry: PointerEntry): {
+    record: PointerRecord;
+    dropped: PointerEntry[];
+};
+declare function renderPointer(p: PointerRecord): string;
+/** A record as the identity page shows it: what was stored, and what it means if it parses. */
+interface ParsedRecord {
+    kind: string;
+    /** The raw UTF-8 value. */
+    text: string;
+    bytes: number;
+    /** True when the value has the shape the kind defines. A malformed record is still shown, as text. */
+    valid: boolean;
+    /** Why it is not valid, when it is not. */
+    reason?: string;
+    /** Kind-specific fields, when valid. */
+    data: RecordData;
+}
+type RecordData = {
+    type: 'railgun';
+    address: string;
+} | {
+    type: 'security';
+    contact: string;
+    url: string | null;
+} | {
+    type: 'successor';
+    fingerprint: string;
+} | {
+    type: 'affiliation';
+    with: string;
+    role: string | null;
+} | {
+    type: 'canary';
+    date: string;
+    statement: string;
+    clearsigned: boolean;
+} | {
+    type: 'encrypted';
+    recipients: number | null;
+} | {
+    type: 'pointer';
+    releases: PointerEntry[];
+} | {
+    type: 'text';
+};
+/**
+ * Parse a record of a known kind. Never throws: a value that does not fit its kind comes back
+ * with `valid: false` and a reason, so a page can still show what is there.
+ */
+declare function parseRecord(kind: string, text: string): Promise<ParsedRecord>;
+/** Minimal client shape: viem's PublicClient has it. */
+interface RecordReader {
+    readContract(args: {
+        address: `0x${string}`;
+        abi: unknown;
+        functionName: 'record';
+        args: readonly [`0x${string}`, bigint, Hex];
+    }): Promise<unknown>;
+}
+/**
+ * Read and parse the given kinds on one claim. Kinds with no record are left out.
+ * `registry` is the contract address; pass the kit's REGISTRY_ABI.
+ */
+declare function fetchRecords(client: RecordReader, registry: `0x${string}`, abi: unknown, owner: `0x${string}`, index: number | bigint, kinds?: readonly string[]): Promise<ParsedRecord[]>;
+
+declare function identifyProof(notation: Notation): Proof | null;
+declare function displayUrl(proof: Proof): string;
+declare function proofHref(proof: Proof): string | null;
+declare function proofSecondaryHref(proof: Proof): string | null;
+declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
+
+declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
+declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
+    pgpPublicKey: string | null;
+    pgpSignature: string | null;
+    fingerprint: string;
+    ethAddress: string;
+}): Promise<PGPVerification>;
+interface StrippedKey {
+    /** Armored public key containing only the non-email user IDs. */
+    armored: string;
+    /** User IDs kept (no `@`). */
+    kept: string[];
+    /** User IDs removed (contained an `@`). */
+    removed: string[];
+}
+/**
+ * Remove every user ID that contains an email address, keeping the rest (and
+ * their self-certifications, so proof notations on a non-email user ID survive).
+ * Returns null when nothing would remain — openpgp needs at least one
+ * self-certified user ID to verify signatures, so such a key must not be
+ * published. The key material and subkeys are untouched; the fingerprint is
+ * unchanged.
+ */
+declare function stripEmailUserIDs(armoredKey: string): Promise<StrippedKey | null>;
+/** True when any user ID on the key contains an email address. */
+declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
+
+/**
+ * EFP social graph for an address. Followers are counted by EFP for any address,
+ * whether or not it has published a list of its own; following and top-8 exist
+ * only when it has (its "primary list"). An address with followers but no list
+ * — a project account that has never followed anyone — is still on EFP.
+ */
+declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
+
+/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
+declare function normalizeFingerprint(input: string): string | null;
+/** Fingerprint → the raw `bytes` argument the v2 registry takes (0x-prefixed, 20 or 32 bytes). */
+declare function fingerprintToBytes(fingerprint: string): Hex;
+/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
+declare function bytesToFingerprint(bytes: Hex | string): string;
+/** keccak256 of the raw fingerprint bytes — the `fingerprintHash` the registry indexes by. */
+declare function fingerprintHash(fingerprint: string): Hex;
+/**
+ * The long key ID as the `bytes8` the registry indexes by. Per RFC 9580 §5.5.4 it is the
+ * low-order 8 bytes of a v4 (20-byte) fingerprint and the high-order 8 bytes of a v6
+ * (32-byte) fingerprint — the same value `gpg --keyid-format long` prints.
+ */
+declare function keyIdOf(fingerprint: string): Hex;
+/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
+declare function keyIdToBytes(keyId: string): Hex | null;
+
+export { AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, IDENTITY_KINDS, type IdentityKitConfig, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, type NetworkName, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, isNetworkName, keyIdOf, keyIdToBytes, kindName, normalizeFingerprint, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyProof };

package/dist/core.js

@@ -4,21 +4,26 @@ import {
   EIP712_VERSION,
   ENS_HINT_KEY,
   ENS_TEXT_RESOLVER_ABI,
+  IDENTITY_KINDS,
+  KNOWN_KINDS,
+  MAX_RECORD_BYTES,
   NETWORKS,
   REGISTRY_ABI,
   REGISTRY_ADDRESS,
+  addPointer,
   attestTypedData,
   authorizationDigest,
   bytesToFingerprint,
   chainFor,
+  decodeRecord,
   displayUrl,
+  encodeRecord,
   ensHintFor,
   ensHintValue,
   ensHintWrite,
   fetchEFPGraph,
   fetchEnsHint,
-  fetchKeyByFingerprint,
-  fetchKeyByKeyId,
+  fetchRecords,
   fingerprintHash,
   fingerprintToBytes,
   getRegistry,
@@ -27,41 +32,50 @@ import {
   isNetworkName,
   keyIdOf,
   keyIdToBytes,
+  kindName,
   normalizeFingerprint,
   parsePgpKey,
+  parsePointer,
+  parseRecord,
   proofHref,
   proofSecondaryHref,
   reattestTypedData,
   recordKind,
   registryDomain,
+  renderPointer,
   revokeTypedData,
   setRecordTypedData,
   stripEmailUserIDs,
   updateKeyTypedData,
   verifyAttestation,
   verifyProof
-} from "./chunk-Y4E5MMGR.js";
+} from "./chunk-4H57JHDJ.js";
 export {
   AUTHORIZATION_TYPES,
   EIP712_NAME,
   EIP712_VERSION,
   ENS_HINT_KEY,
   ENS_TEXT_RESOLVER_ABI,
+  IDENTITY_KINDS,
+  KNOWN_KINDS,
+  MAX_RECORD_BYTES,
   NETWORKS,
   REGISTRY_ABI,
   REGISTRY_ADDRESS,
+  addPointer,
   attestTypedData,
   authorizationDigest,
   bytesToFingerprint,
   chainFor,
+  decodeRecord,
   displayUrl,
+  encodeRecord,
   ensHintFor,
   ensHintValue,
   ensHintWrite,
   fetchEFPGraph,
   fetchEnsHint,
-  fetchKeyByFingerprint,
-  fetchKeyByKeyId,
+  fetchRecords,
   fingerprintHash,
   fingerprintToBytes,
   getRegistry,
@@ -70,13 +84,17 @@ export {
   isNetworkName,
   keyIdOf,
   keyIdToBytes,
+  kindName,
   normalizeFingerprint,
   parsePgpKey,
+  parsePointer,
+  parseRecord,
   proofHref,
   proofSecondaryHref,
   reattestTypedData,
   recordKind,
   registryDomain,
+  renderPointer,
   revokeTypedData,
   setRecordTypedData,
   stripEmailUserIDs,