@thurinlabs/identity-kit 1.3.5 → 1.3.7

package/dist/core.cjs

@@ -59,10 +59,10 @@
 
 
 
-var _chunkYTO7Z5SIcjs = require('./chunk-YTO7Z5SI.cjs');
 
 
 
+var _chunkOIE72R6Jcjs = require('./chunk-OIE72R6J.cjs');
 
 
 
@@ -121,5 +121,11 @@ var _chunkYTO7Z5SIcjs = require('./chunk-YTO7Z5SI.cjs');
 
 
 
-exports.ARWEAVE_GATEWAY = _chunkYTO7Z5SIcjs.ARWEAVE_GATEWAY; exports.AUTHORIZATION_TYPES = _chunkYTO7Z5SIcjs.AUTHORIZATION_TYPES; exports.EIP712_NAME = _chunkYTO7Z5SIcjs.EIP712_NAME; exports.EIP712_VERSION = _chunkYTO7Z5SIcjs.EIP712_VERSION; exports.ENS_HINT_KEY = _chunkYTO7Z5SIcjs.ENS_HINT_KEY; exports.ENS_TEXT_RESOLVER_ABI = _chunkYTO7Z5SIcjs.ENS_TEXT_RESOLVER_ABI; exports.IDENTITY_ERROR_TEXT = _chunkYTO7Z5SIcjs.IDENTITY_ERROR_TEXT; exports.IDENTITY_KINDS = _chunkYTO7Z5SIcjs.IDENTITY_KINDS; exports.IPFS_GATEWAY = _chunkYTO7Z5SIcjs.IPFS_GATEWAY; exports.KNOWN_KINDS = _chunkYTO7Z5SIcjs.KNOWN_KINDS; exports.MAX_RECORD_BYTES = _chunkYTO7Z5SIcjs.MAX_RECORD_BYTES; exports.NETWORKS = _chunkYTO7Z5SIcjs.NETWORKS; exports.NFT_AVATAR_ABI = _chunkYTO7Z5SIcjs.NFT_AVATAR_ABI; exports.REGISTRY_ABI = _chunkYTO7Z5SIcjs.REGISTRY_ABI; exports.REGISTRY_ADDRESS = _chunkYTO7Z5SIcjs.REGISTRY_ADDRESS; exports.addPointer = _chunkYTO7Z5SIcjs.addPointer; exports.attestTypedData = _chunkYTO7Z5SIcjs.attestTypedData; exports.authorizationDigest = _chunkYTO7Z5SIcjs.authorizationDigest; exports.avatarUrl = _chunkYTO7Z5SIcjs.avatarUrl; exports.bytesToFingerprint = _chunkYTO7Z5SIcjs.bytesToFingerprint; exports.chainFor = _chunkYTO7Z5SIcjs.chainFor; exports.decodeRecord = _chunkYTO7Z5SIcjs.decodeRecord; exports.displayUrl = _chunkYTO7Z5SIcjs.displayUrl; exports.encodeRecord = _chunkYTO7Z5SIcjs.encodeRecord; exports.ensHintFor = _chunkYTO7Z5SIcjs.ensHintFor; exports.ensHintValue = _chunkYTO7Z5SIcjs.ensHintValue; exports.ensHintWrite = _chunkYTO7Z5SIcjs.ensHintWrite; exports.fetchEFPGraph = _chunkYTO7Z5SIcjs.fetchEFPGraph; exports.fetchEnsHint = _chunkYTO7Z5SIcjs.fetchEnsHint; exports.fetchRecords = _chunkYTO7Z5SIcjs.fetchRecords; exports.fingerprintHash = _chunkYTO7Z5SIcjs.fingerprintHash; exports.fingerprintToBytes = _chunkYTO7Z5SIcjs.fingerprintToBytes; exports.getRegistry = _chunkYTO7Z5SIcjs.getRegistry; exports.hasEmailUserID = _chunkYTO7Z5SIcjs.hasEmailUserID; exports.identifyProof = _chunkYTO7Z5SIcjs.identifyProof; exports.identityErrorKind = _chunkYTO7Z5SIcjs.identityErrorKind; exports.isNetworkName = _chunkYTO7Z5SIcjs.isNetworkName; exports.keyIdOf = _chunkYTO7Z5SIcjs.keyIdOf; exports.keyIdToBytes = _chunkYTO7Z5SIcjs.keyIdToBytes; exports.kindName = _chunkYTO7Z5SIcjs.kindName; exports.needsRpcProbe = _chunkYTO7Z5SIcjs.needsRpcProbe; exports.nftAvatarImage = _chunkYTO7Z5SIcjs.nftAvatarImage; exports.normalizeFingerprint = _chunkYTO7Z5SIcjs.normalizeFingerprint; exports.parseNftAvatar = _chunkYTO7Z5SIcjs.parseNftAvatar; exports.parsePgpKey = _chunkYTO7Z5SIcjs.parsePgpKey; exports.parsePointer = _chunkYTO7Z5SIcjs.parsePointer; exports.parseRecord = _chunkYTO7Z5SIcjs.parseRecord; exports.proofHref = _chunkYTO7Z5SIcjs.proofHref; exports.proofSecondaryHref = _chunkYTO7Z5SIcjs.proofSecondaryHref; exports.reattestTypedData = _chunkYTO7Z5SIcjs.reattestTypedData; exports.recordKind = _chunkYTO7Z5SIcjs.recordKind; exports.registryDomain = _chunkYTO7Z5SIcjs.registryDomain; exports.renderPointer = _chunkYTO7Z5SIcjs.renderPointer; exports.revokeTypedData = _chunkYTO7Z5SIcjs.revokeTypedData; exports.setRecordTypedData = _chunkYTO7Z5SIcjs.setRecordTypedData; exports.stripEmailUserIDs = _chunkYTO7Z5SIcjs.stripEmailUserIDs; exports.updateKeyTypedData = _chunkYTO7Z5SIcjs.updateKeyTypedData; exports.verifyAttestation = _chunkYTO7Z5SIcjs.verifyAttestation; exports.verifyClearsigned = _chunkYTO7Z5SIcjs.verifyClearsigned; exports.verifyProof = _chunkYTO7Z5SIcjs.verifyProof;
+
+
+
+
+
+
+exports.ARWEAVE_GATEWAY = _chunkOIE72R6Jcjs.ARWEAVE_GATEWAY; exports.AUTHORIZATION_TYPES = _chunkOIE72R6Jcjs.AUTHORIZATION_TYPES; exports.EIP712_NAME = _chunkOIE72R6Jcjs.EIP712_NAME; exports.EIP712_VERSION = _chunkOIE72R6Jcjs.EIP712_VERSION; exports.ENS_HINT_KEY = _chunkOIE72R6Jcjs.ENS_HINT_KEY; exports.ENS_TEXT_RESOLVER_ABI = _chunkOIE72R6Jcjs.ENS_TEXT_RESOLVER_ABI; exports.FARCASTER_HUB = _chunkOIE72R6Jcjs.FARCASTER_HUB; exports.IDENTITY_ERROR_TEXT = _chunkOIE72R6Jcjs.IDENTITY_ERROR_TEXT; exports.IDENTITY_KINDS = _chunkOIE72R6Jcjs.IDENTITY_KINDS; exports.IPFS_GATEWAY = _chunkOIE72R6Jcjs.IPFS_GATEWAY; exports.IPFS_GATEWAYS = _chunkOIE72R6Jcjs.IPFS_GATEWAYS; exports.KNOWN_KINDS = _chunkOIE72R6Jcjs.KNOWN_KINDS; exports.MAX_RECORD_BYTES = _chunkOIE72R6Jcjs.MAX_RECORD_BYTES; exports.NETWORKS = _chunkOIE72R6Jcjs.NETWORKS; exports.NFT_AVATAR_ABI = _chunkOIE72R6Jcjs.NFT_AVATAR_ABI; exports.REGISTRY_ABI = _chunkOIE72R6Jcjs.REGISTRY_ABI; exports.REGISTRY_ADDRESS = _chunkOIE72R6Jcjs.REGISTRY_ADDRESS; exports.addPointer = _chunkOIE72R6Jcjs.addPointer; exports.attestTypedData = _chunkOIE72R6Jcjs.attestTypedData; exports.authorizationDigest = _chunkOIE72R6Jcjs.authorizationDigest; exports.avatarFallbacks = _chunkOIE72R6Jcjs.avatarFallbacks; exports.avatarUrl = _chunkOIE72R6Jcjs.avatarUrl; exports.bytesToFingerprint = _chunkOIE72R6Jcjs.bytesToFingerprint; exports.chainFor = _chunkOIE72R6Jcjs.chainFor; exports.decodeRecord = _chunkOIE72R6Jcjs.decodeRecord; exports.displayUrl = _chunkOIE72R6Jcjs.displayUrl; exports.encodeRecord = _chunkOIE72R6Jcjs.encodeRecord; exports.ensHintFor = _chunkOIE72R6Jcjs.ensHintFor; exports.ensHintValue = _chunkOIE72R6Jcjs.ensHintValue; exports.ensHintWrite = _chunkOIE72R6Jcjs.ensHintWrite; exports.fetchEFPGraph = _chunkOIE72R6Jcjs.fetchEFPGraph; exports.fetchEnsHint = _chunkOIE72R6Jcjs.fetchEnsHint; exports.fetchRecords = _chunkOIE72R6Jcjs.fetchRecords; exports.fingerprintHash = _chunkOIE72R6Jcjs.fingerprintHash; exports.fingerprintToBytes = _chunkOIE72R6Jcjs.fingerprintToBytes; exports.getRegistry = _chunkOIE72R6Jcjs.getRegistry; exports.hasEmailUserID = _chunkOIE72R6Jcjs.hasEmailUserID; exports.identifyProof = _chunkOIE72R6Jcjs.identifyProof; exports.identityErrorKind = _chunkOIE72R6Jcjs.identityErrorKind; exports.isNetworkName = _chunkOIE72R6Jcjs.isNetworkName; exports.keyIdOf = _chunkOIE72R6Jcjs.keyIdOf; exports.keyIdToBytes = _chunkOIE72R6Jcjs.keyIdToBytes; exports.kindName = _chunkOIE72R6Jcjs.kindName; exports.needsRpcProbe = _chunkOIE72R6Jcjs.needsRpcProbe; exports.nftAvatarImage = _chunkOIE72R6Jcjs.nftAvatarImage; exports.normalizeFingerprint = _chunkOIE72R6Jcjs.normalizeFingerprint; exports.parseNftAvatar = _chunkOIE72R6Jcjs.parseNftAvatar; exports.parsePgpKey = _chunkOIE72R6Jcjs.parsePgpKey; exports.parsePointer = _chunkOIE72R6Jcjs.parsePointer; exports.parseRecord = _chunkOIE72R6Jcjs.parseRecord; exports.proofHref = _chunkOIE72R6Jcjs.proofHref; exports.proofSecondaryHref = _chunkOIE72R6Jcjs.proofSecondaryHref; exports.reattestTypedData = _chunkOIE72R6Jcjs.reattestTypedData; exports.recordKind = _chunkOIE72R6Jcjs.recordKind; exports.registryDomain = _chunkOIE72R6Jcjs.registryDomain; exports.renderPointer = _chunkOIE72R6Jcjs.renderPointer; exports.revokeTypedData = _chunkOIE72R6Jcjs.revokeTypedData; exports.setRecordTypedData = _chunkOIE72R6Jcjs.setRecordTypedData; exports.stripEmailUserIDs = _chunkOIE72R6Jcjs.stripEmailUserIDs; exports.updateKeyTypedData = _chunkOIE72R6Jcjs.updateKeyTypedData; exports.verifyAttestation = _chunkOIE72R6Jcjs.verifyAttestation; exports.verifyClearsigned = _chunkOIE72R6Jcjs.verifyClearsigned; exports.verifyProof = _chunkOIE72R6Jcjs.verifyProof;
 //# sourceMappingURL=core.cjs.map

package/dist/core.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/ben/code/thurinlabs/identity-kit/dist/core.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,i6GAAC","file":"/home/ben/code/thurinlabs/identity-kit/dist/core.cjs"}
+{"version":3,"sources":["/home/ben/code/thurinlabs/identity-kit/dist/core.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,glHAAC","file":"/home/ben/code/thurinlabs/identity-kit/dist/core.cjs"}

package/dist/core.d.cts

@@ -90,7 +90,10 @@ interface ThurinIdentity {
 type Theme = 'thurin' | 'dark' | 'light';
 interface IdentityKitConfig {
     rpcUrl?: string;
+    /** Optional: read Farcaster proofs through Neynar's hub with this key. Not needed since 1.3.7. */
     neynarApiKey?: string;
+    /** A Farcaster node's HTTP API for Farcaster proofs. Default: Quilibrium's public Hypersnap node (keyless). */
+    farcasterHub?: string;
     baseUrl?: string;
     /** Which PGPRegistry deployment to read: 'mainnet' (default) or 'sepolia'. */
     network?: 'mainnet' | 'sepolia' | 'local';
@@ -1715,7 +1718,24 @@ declare function identifyProof(notation: Notation): Proof | null;
 declare function displayUrl(proof: Proof): string;
 declare function proofHref(proof: Proof): string | null;
 declare function proofSecondaryHref(proof: Proof): string | null;
-declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
+/**
+ * Farcaster proofs are read from a Farcaster node's HTTP API (`/v1/userNameProofByName`,
+ * `/v1/castsByFid`). The default is Quilibrium's public Hypersnap node, which needs no key and
+ * allows browser requests; it sees the visitor's IP and which account was checked. Point
+ * `farcasterHub` at your own node to avoid that, or pass a Neynar key to use Neynar's hub.
+ */
+declare const FARCASTER_HUB = "https://haatz.quilibrium.com";
+interface ProofOptions {
+    /** A Farcaster node's HTTP API base URL. Default: FARCASTER_HUB (keyless). */
+    farcasterHub?: string;
+    /** Optional: read Farcaster through Neynar's hub with this key instead. */
+    neynarApiKey?: string;
+}
+/**
+ * Check one proof. The third argument is options; a plain string is still accepted as a
+ * Neynar API key (the pre-1.3.7 signature).
+ */
+declare function verifyProof(proof: Proof, fingerprint: string, opts?: ProofOptions | string): Promise<PGPVerification>;
 
 declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
 /**
@@ -1807,20 +1827,29 @@ declare const IDENTITY_ERROR_TEXT: Record<IdentityErrorKind, string>;
  * chooses; loading an ordinary https:// link would tell that owner's server the IP and time of
  * everyone who views the card. So only images the owner can't watch load: content-addressed
  * ones (IPFS, Arweave, inline data, or an NFT whose metadata and image are content-addressed)
- * through one public gateway, and euc.li, ENS Labs' host behind the ENS app's avatar upload
+ * through public gateways, and euc.li, ENS Labs' host behind the ENS app's avatar upload
  * (most avatars; ENS Labs sees the view, the name's owner doesn't). Anything else: no avatar.
  */
-declare const IPFS_GATEWAY = "https://ipfs.io/ipfs/";
+/**
+ * Public IPFS gateways, tried in order: when an image fails to load, the next one is used.
+ * Any single public gateway can stop serving (ipfs.io and dweb.link went "service worker only"
+ * in 2026), so there is always a fallback. The gateway sees the viewer's IP and the avatar.
+ */
+declare const IPFS_GATEWAYS: readonly ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
+/** The first gateway in IPFS_GATEWAYS (kept for code that imported it before 1.3.6). */
+declare const IPFS_GATEWAY: string;
 declare const ARWEAVE_GATEWAY = "https://arweave.net/";
 /** An image URL safe to load for `uri`, or null if loading it would reach a host the owner picked. */
 declare function avatarUrl(uri: unknown): string | null;
+/** The same content through the other IPFS gateways, for retrying a failed load. [] for non-IPFS URLs. */
+declare function avatarFallbacks(url: string | null | undefined): string[];
 interface NftAvatar {
     chainId: number;
     standard: 'erc721' | 'erc1155';
     contract: `0x${string}`;
     tokenId: bigint;
 }
-/** `eip155:1/erc721:0x…/123` (or erc1155) → its parts; null for anything else. */
+/** `eip155:1/erc721:0x…/123` (or erc1155; any case, as records in the wild vary) → its parts; null otherwise. */
 declare function parseNftAvatar(raw: unknown): NftAvatar | null;
 declare const NFT_AVATAR_ABI: readonly [{
     readonly type: "function";
@@ -1866,4 +1895,4 @@ declare function keyIdOf(fingerprint: string): Hex;
 /** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
 declare function keyIdToBytes(keyId: string): Hex | null;
 
-export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, IDENTITY_ERROR_TEXT, IDENTITY_KINDS, IPFS_GATEWAY, type IdentityErrorKind, type IdentityKitConfig, type IdentityLookupState, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, avatarUrl, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, identityErrorKind, isNetworkName, keyIdOf, keyIdToBytes, kindName, needsRpcProbe, nftAvatarImage, normalizeFingerprint, parseNftAvatar, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof };
+export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, FARCASTER_HUB, IDENTITY_ERROR_TEXT, IDENTITY_KINDS, IPFS_GATEWAY, IPFS_GATEWAYS, type IdentityErrorKind, type IdentityKitConfig, type IdentityLookupState, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofOptions, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, avatarFallbacks, avatarUrl, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, identityErrorKind, isNetworkName, keyIdOf, keyIdToBytes, kindName, needsRpcProbe, nftAvatarImage, normalizeFingerprint, parseNftAvatar, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof };

package/dist/core.d.ts

@@ -90,7 +90,10 @@ interface ThurinIdentity {
 type Theme = 'thurin' | 'dark' | 'light';
 interface IdentityKitConfig {
     rpcUrl?: string;
+    /** Optional: read Farcaster proofs through Neynar's hub with this key. Not needed since 1.3.7. */
     neynarApiKey?: string;
+    /** A Farcaster node's HTTP API for Farcaster proofs. Default: Quilibrium's public Hypersnap node (keyless). */
+    farcasterHub?: string;
     baseUrl?: string;
     /** Which PGPRegistry deployment to read: 'mainnet' (default) or 'sepolia'. */
     network?: 'mainnet' | 'sepolia' | 'local';
@@ -1715,7 +1718,24 @@ declare function identifyProof(notation: Notation): Proof | null;
 declare function displayUrl(proof: Proof): string;
 declare function proofHref(proof: Proof): string | null;
 declare function proofSecondaryHref(proof: Proof): string | null;
-declare function verifyProof(proof: Proof, fingerprint: string, neynarApiKey?: string): Promise<PGPVerification>;
+/**
+ * Farcaster proofs are read from a Farcaster node's HTTP API (`/v1/userNameProofByName`,
+ * `/v1/castsByFid`). The default is Quilibrium's public Hypersnap node, which needs no key and
+ * allows browser requests; it sees the visitor's IP and which account was checked. Point
+ * `farcasterHub` at your own node to avoid that, or pass a Neynar key to use Neynar's hub.
+ */
+declare const FARCASTER_HUB = "https://haatz.quilibrium.com";
+interface ProofOptions {
+    /** A Farcaster node's HTTP API base URL. Default: FARCASTER_HUB (keyless). */
+    farcasterHub?: string;
+    /** Optional: read Farcaster through Neynar's hub with this key instead. */
+    neynarApiKey?: string;
+}
+/**
+ * Check one proof. The third argument is options; a plain string is still accepted as a
+ * Neynar API key (the pre-1.3.7 signature).
+ */
+declare function verifyProof(proof: Proof, fingerprint: string, opts?: ProofOptions | string): Promise<PGPVerification>;
 
 declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
 /**
@@ -1807,20 +1827,29 @@ declare const IDENTITY_ERROR_TEXT: Record<IdentityErrorKind, string>;
  * chooses; loading an ordinary https:// link would tell that owner's server the IP and time of
  * everyone who views the card. So only images the owner can't watch load: content-addressed
  * ones (IPFS, Arweave, inline data, or an NFT whose metadata and image are content-addressed)
- * through one public gateway, and euc.li, ENS Labs' host behind the ENS app's avatar upload
+ * through public gateways, and euc.li, ENS Labs' host behind the ENS app's avatar upload
  * (most avatars; ENS Labs sees the view, the name's owner doesn't). Anything else: no avatar.
  */
-declare const IPFS_GATEWAY = "https://ipfs.io/ipfs/";
+/**
+ * Public IPFS gateways, tried in order: when an image fails to load, the next one is used.
+ * Any single public gateway can stop serving (ipfs.io and dweb.link went "service worker only"
+ * in 2026), so there is always a fallback. The gateway sees the viewer's IP and the avatar.
+ */
+declare const IPFS_GATEWAYS: readonly ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
+/** The first gateway in IPFS_GATEWAYS (kept for code that imported it before 1.3.6). */
+declare const IPFS_GATEWAY: string;
 declare const ARWEAVE_GATEWAY = "https://arweave.net/";
 /** An image URL safe to load for `uri`, or null if loading it would reach a host the owner picked. */
 declare function avatarUrl(uri: unknown): string | null;
+/** The same content through the other IPFS gateways, for retrying a failed load. [] for non-IPFS URLs. */
+declare function avatarFallbacks(url: string | null | undefined): string[];
 interface NftAvatar {
     chainId: number;
     standard: 'erc721' | 'erc1155';
     contract: `0x${string}`;
     tokenId: bigint;
 }
-/** `eip155:1/erc721:0x…/123` (or erc1155) → its parts; null for anything else. */
+/** `eip155:1/erc721:0x…/123` (or erc1155; any case, as records in the wild vary) → its parts; null otherwise. */
 declare function parseNftAvatar(raw: unknown): NftAvatar | null;
 declare const NFT_AVATAR_ABI: readonly [{
     readonly type: "function";
@@ -1866,4 +1895,4 @@ declare function keyIdOf(fingerprint: string): Hex;
 /** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
 declare function keyIdToBytes(keyId: string): Hex | null;
 
-export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, IDENTITY_ERROR_TEXT, IDENTITY_KINDS, IPFS_GATEWAY, type IdentityErrorKind, type IdentityKitConfig, type IdentityLookupState, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, avatarUrl, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, identityErrorKind, isNetworkName, keyIdOf, keyIdToBytes, kindName, needsRpcProbe, nftAvatarImage, normalizeFingerprint, parseNftAvatar, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof };
+export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, FARCASTER_HUB, IDENTITY_ERROR_TEXT, IDENTITY_KINDS, IPFS_GATEWAY, IPFS_GATEWAYS, type IdentityErrorKind, type IdentityKitConfig, type IdentityLookupState, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofOptions, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, avatarFallbacks, avatarUrl, bytesToFingerprint, chainFor, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, getRegistry, hasEmailUserID, identifyProof, identityErrorKind, isNetworkName, keyIdOf, keyIdToBytes, kindName, needsRpcProbe, nftAvatarImage, normalizeFingerprint, parseNftAvatar, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof };

package/dist/core.js

@@ -5,9 +5,11 @@ import {
   EIP712_VERSION,
   ENS_HINT_KEY,
   ENS_TEXT_RESOLVER_ABI,
+  FARCASTER_HUB,
   IDENTITY_ERROR_TEXT,
   IDENTITY_KINDS,
   IPFS_GATEWAY,
+  IPFS_GATEWAYS,
   KNOWN_KINDS,
   MAX_RECORD_BYTES,
   NETWORKS,
@@ -17,6 +19,7 @@ import {
   addPointer,
   attestTypedData,
   authorizationDigest,
+  avatarFallbacks,
   avatarUrl,
   bytesToFingerprint,
   chainFor,
@@ -59,7 +62,7 @@ import {
   verifyAttestation,
   verifyClearsigned,
   verifyProof
-} from "./chunk-CF64QQZO.js";
+} from "./chunk-ROQWHCHP.js";
 export {
   ARWEAVE_GATEWAY,
   AUTHORIZATION_TYPES,
@@ -67,9 +70,11 @@ export {
   EIP712_VERSION,
   ENS_HINT_KEY,
   ENS_TEXT_RESOLVER_ABI,
+  FARCASTER_HUB,
   IDENTITY_ERROR_TEXT,
   IDENTITY_KINDS,
   IPFS_GATEWAY,
+  IPFS_GATEWAYS,
   KNOWN_KINDS,
   MAX_RECORD_BYTES,
   NETWORKS,
@@ -79,6 +84,7 @@ export {
   addPointer,
   attestTypedData,
   authorizationDigest,
+  avatarFallbacks,
   avatarUrl,
   bytesToFingerprint,
   chainFor,

package/dist/embed.global.js

@@ -30400,17 +30400,21 @@ ${prettyStateOverride(stateOverride)}`;
     children,
     rpcUrl,
     neynarApiKey,
+    farcasterHub,
     baseUrl = "https://thurin.id",
     network = "mainnet",
     registryAddress
   }) {
     const config = (0, import_react8.useMemo)(
-      () => ({ rpcUrl, neynarApiKey, baseUrl, network, registryAddress }),
-      [rpcUrl, neynarApiKey, baseUrl, network, registryAddress]
+      () => ({ rpcUrl, neynarApiKey, farcasterHub, baseUrl, network, registryAddress }),
+      [rpcUrl, neynarApiKey, farcasterHub, baseUrl, network, registryAddress]
     );
     return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(IdentityKitContext.Provider, { value: config, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(WagmiDetector, { rpcUrl, network, children }) });
   }
 
+  // src/components/ThurinCard/ThurinCard.tsx
+  var import_react9 = __toESM(require_react(), 1);
+
   // src/core/identityError.ts
   function needsRpcProbe(s2) {
     return s2.ensEmpty || s2.ensFailed || s2.claimsFailed;
@@ -31637,29 +31641,27 @@ ${prettyStateOverride(stateOverride)}`;
       return { verified: false, reason: `DNS fetch failed: ${err.message}` };
     }
   }
+  var FARCASTER_HUB = "https://haatz.quilibrium.com";
   var NEYNAR_HUB = "https://hub-api.neynar.com";
-  async function resolveFid(username, apiKey) {
-    const resp = await fetch(
-      `${NEYNAR_HUB}/v1/userNameProofByName?name=${encodeURIComponent(username)}`,
-      { headers: { "x-api-key": apiKey } }
-    );
-    if (!resp.ok) return null;
-    const data = await resp.json();
-    return data.fid ?? null;
-  }
-  async function verifyFarcaster(proof, fingerprint, neynarApiKey) {
-    if (!neynarApiKey) {
-      return { verified: false, reason: "Farcaster verification requires a Neynar API key" };
-    }
+  function farcasterSource(opts) {
+    if (opts.farcasterHub) return { base: opts.farcasterHub.replace(/\/+$/, ""), headers: {} };
+    if (opts.neynarApiKey) return { base: NEYNAR_HUB, headers: { "x-api-key": opts.neynarApiKey } };
+    return { base: FARCASTER_HUB, headers: {} };
+  }
+  async function verifyFarcaster(proof, fingerprint, opts = {}) {
+    const { base, headers } = farcasterSource(opts);
+    const host = base.replace(/^https?:\/\//, "");
     try {
-      const fid = await resolveFid(proof.user, neynarApiKey);
+      const nameResp = await fetch(`${base}/v1/userNameProofByName?name=${encodeURIComponent(proof.user)}`, { headers });
+      if (nameResp.status === 404) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
+      if (!nameResp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${nameResp.status}` };
+      const fid = (await nameResp.json()).fid;
       if (!fid) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
-      const headers = { "x-api-key": neynarApiKey };
       let pageToken = "";
       for (let page = 0; page < 5; page++) {
-        const url = `${NEYNAR_HUB}/v1/castsByFid?fid=${fid}&pageSize=100&reverse=true${pageToken ? `&pageToken=${pageToken}` : ""}`;
+        const url = `${base}/v1/castsByFid?fid=${fid}&pageSize=100&reverse=true${pageToken ? `&pageToken=${pageToken}` : ""}`;
         const resp = await fetch(url, { headers });
-        if (!resp.ok) return { verified: false, reason: `Farcaster Hub returned ${resp.status}` };
+        if (!resp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${resp.status}` };
         const data = await resp.json();
         for (const msg of data.messages || []) {
           if (msg.hash && msg.hash.startsWith(proof.castHash)) {
@@ -31674,7 +31676,7 @@ ${prettyStateOverride(stateOverride)}`;
       }
       return { verified: false, reason: "Cast not found" };
     } catch (err) {
-      return { verified: false, reason: `Farcaster fetch failed: ${err.message}` };
+      return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) didn't answer (${err.message})` };
     }
   }
   async function verifyCodeberg(proof, fingerprint) {
@@ -31727,10 +31729,10 @@ ${prettyStateOverride(stateOverride)}`;
     codeberg: verifyCodeberg,
     mastodon: verifyMastodon
   };
-  async function verifyProof(proof, fingerprint, neynarApiKey) {
+  async function verifyProof(proof, fingerprint, opts) {
     const fn2 = verifiers[proof.provider];
     if (!fn2) return { verified: false, reason: "Unknown provider" };
-    return fn2(proof, fingerprint, neynarApiKey);
+    return fn2(proof, fingerprint, typeof opts === "string" ? { neynarApiKey: opts } : opts ?? {});
   }
 
   // src/hooks/usePGPProofs.ts
@@ -31747,7 +31749,7 @@ ${prettyStateOverride(stateOverride)}`;
         const identified = keyInfo.notations.map((n2) => identifyProof(n2)).filter((p2) => p2 !== null && p2.provider !== "unknown");
         const proofs = await Promise.all(
           identified.map(async (proof) => {
-            const result = await verifyProof(proof, fingerprint, config.neynarApiKey);
+            const result = await verifyProof(proof, fingerprint, { neynarApiKey: config.neynarApiKey, farcasterHub: config.farcasterHub });
             return {
               provider: proof.provider,
               label: proof.label,
@@ -31785,7 +31787,8 @@ ${prettyStateOverride(stateOverride)}`;
   }
 
   // src/core/avatar.ts
-  var IPFS_GATEWAY = "https://ipfs.io/ipfs/";
+  var IPFS_GATEWAYS = ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
+  var IPFS_GATEWAY = IPFS_GATEWAYS[0];
   var ARWEAVE_GATEWAY = "https://arweave.net/";
   function avatarUrl(uri) {
     if (typeof uri !== "string") return null;
@@ -31800,9 +31803,14 @@ ${prettyStateOverride(stateOverride)}`;
     if (m2) return IPFS_GATEWAY + m2[1];
     return null;
   }
+  function avatarFallbacks(url) {
+    if (!url || !url.startsWith(IPFS_GATEWAYS[0])) return [];
+    const path = url.slice(IPFS_GATEWAYS[0].length);
+    return IPFS_GATEWAYS.slice(1).map((g2) => g2 + path);
+  }
   function parseNftAvatar(raw) {
-    const m2 = typeof raw === "string" && raw.trim().match(/^eip155:(\d+)\/(erc721|erc1155):(0x[0-9a-fA-F]{40})\/(\d+)$/);
-    return m2 ? { chainId: Number(m2[1]), standard: m2[2], contract: m2[3], tokenId: BigInt(m2[4]) } : null;
+    const m2 = typeof raw === "string" && raw.trim().match(/^eip155:(\d+)\/(erc721|erc1155):(0x[0-9a-fA-F]{40})\/(\d+)$/i);
+    return m2 ? { chainId: Number(m2[1]), standard: m2[2].toLowerCase(), contract: m2[3], tokenId: BigInt(m2[4]) } : null;
   }
   var NFT_AVATAR_ABI = [
     { type: "function", name: "tokenURI", stateMutability: "view", inputs: [{ type: "uint256" }], outputs: [{ type: "string" }] },
@@ -31816,9 +31824,17 @@ ${prettyStateOverride(stateOverride)}`;
     else {
       const url = uri.startsWith("data:") ? null : avatarUrl(uri);
       if (!url) return null;
-      const res = await fetchFn(url);
-      if (!res.ok) return null;
-      meta = await res.json();
+      for (const candidate of [url, ...avatarFallbacks(url)]) {
+        try {
+          const res = await fetchFn(candidate);
+          if (res.ok) {
+            meta = await res.json();
+            break;
+          }
+        } catch {
+        }
+      }
+      if (!meta) return null;
     }
     return avatarUrl(meta?.image ?? meta?.image_url);
   }
@@ -31936,6 +31952,14 @@ ${prettyStateOverride(stateOverride)}`;
       /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("path", { d: "M50 65 L50 53", fill: "none", stroke: "#c9a227", strokeWidth: "4", strokeLinecap: "round" })
     ] });
   }
+  function Avatar({ src, alt }) {
+    const [tries, setTries] = (0, import_react9.useState)([]);
+    (0, import_react9.useEffect)(() => {
+      setTries(src ? [src, ...avatarFallbacks(src)] : []);
+    }, [src]);
+    if (!tries.length) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(ThurinLogo, {});
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("img", { className: "thurin-card-avatar", src: tries[0], alt, onError: () => setTries((t2) => t2.slice(1)) });
+  }
   function ThurinCard({ ens, address, theme = "thurin" }) {
     const input = ens || address;
     const identity = useThurinIdentity(input);
@@ -31962,14 +31986,7 @@ ${prettyStateOverride(stateOverride)}`;
     const hasVerifiedPgp = identity.claims.some((c2) => c2.verification?.verified && !c2.revoked);
     return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "thurin-card", "data-thurin-theme": theme, children: [
       /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("a", { className: "thurin-card-header", href: profileUrl || void 0, target: "_blank", rel: "noopener noreferrer", children: [
-        identity.ensAvatar ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
-          "img",
-          {
-            className: "thurin-card-avatar",
-            src: identity.ensAvatar,
-            alt: identity.ensName || ""
-          }
-        ) : /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(ThurinLogo, {}),
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(Avatar, { src: identity.ensAvatar, alt: identity.ensName || "" }),
         /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { children: [
           identity.ensName && /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "thurin-card-name", children: identity.ensName }),
           displayAddress && /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "thurin-card-address", children: displayAddress })
@@ -32036,6 +32053,7 @@ ${prettyStateOverride(stateOverride)}`;
       const theme = el2.dataset.theme || "thurin";
       const rpcUrl = el2.dataset.rpcUrl;
       const neynarApiKey = el2.dataset.neynarKey;
+      const farcasterHub = el2.dataset.farcasterHub;
       const baseUrl = el2.dataset.baseUrl;
       const network = isNetworkName(el2.dataset.network) ? el2.dataset.network : "mainnet";
       const registryAddress = el2.dataset.registryAddress;
@@ -32048,7 +32066,7 @@ ${prettyStateOverride(stateOverride)}`;
       shadow.appendChild(container);
       const root = (0, import_client.createRoot)(container);
       const render = (t2) => root.render(
-        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(IdentityKitProvider, { rpcUrl, neynarApiKey, network, registryAddress, baseUrl, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ThurinCard, { ...props, theme: t2 }) })
+        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(IdentityKitProvider, { rpcUrl, neynarApiKey, farcasterHub, network, registryAddress, baseUrl, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ThurinCard, { ...props, theme: t2 }) })
       );
       render(theme);
       new MutationObserver(() => {