Add Design glyph API client (0.110.0) (#153)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 77a3a20..cf60145 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,13 @@
  # Changelog
  
++## 0.110.0 — 2026-11-09
++
++- **`openvibe-sdk/design`: a typed client for the Design glyph API.**
++  - `createDesignClient({ accessToken, baseUrl })` returns `icons.search(q)`, `icons.draft({ name, sentence, styles, sourceSvg })`
++    and `icons.get(name, { style })` for the authenticated glyph draft, get and search calls. It is server-side only
++    (the `./design` subpath is browser-blocked) and takes a signed-in access token rather than a service token.
++  - Styles are checked against the set the API accepts (`thin`, `light`, `regular`, `bold`, `solid`, `duotone`).
++
  ## 0.109.0 — 2026-11-09
  
  - Add Vibe compare methods to `openvibe-sdk/chat` for submitting answers and recording a user's preferred model.
ddiff --git a/README.md b/README.md
iindex 9f35e1c..d87ef6e 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.109.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.110.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -11,7 +11,7 @@
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.109.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.110.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -184,7 +184,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/search` | both | `createSearchClient(client, {actingSubject?})`: `query(text, {owner, type, lang, filter, facets, limit, cursor})`, `iterate(text, {…, max})`, `suggest(text, {owner, type, limit})`, `document(owner, type, id)` (null when missing or not visible) |
  | `openvibe-sdk/limits` | node | `createActorLimiter({limits: {minute, hour, day}, actor?, maxActors?, onLimited?})` → `limits(name, {minute?, hour?, day?})` Express middleware: per-actor fixed windows at a capability boundary (service principal, else the signed-in person, else `ip:`), 429 problem+json `rate_limited` with Retry-After before the handler; `defaultActor(req)`, `.stats()` |
  | `openvibe-sdk/account-data` | node | `createAccountData({db, service, tables: [{table, subject, value?, file?, columns?, erase?}], extraExport?, extraErase?})` → `.apply(event, {send})`, `.consumer({secrets, send, onEvent?})` (a POST /internal/events handler), `.exportPart(subject)`, `.erase(subjects)`, `.ensureSchema()`; `createNetworkSender({networkInternalUrl, clientId, clientSecret})`; `startSubscriptions({eventsUrl, endpoint, secret, networkInternalUrl, clientId, clientSecret})` (the two Events subscriptions, created at boot when missing): a service's share of account export and deletion (ADR-033), idempotent per export/deletion id; telemetry is covered once here (the person's `telemetry_samples` exported as `telemetry.json`, its `subject` set to NULL and the sample kept) unless the table is listed; `uncovered(db, {tables, taskKeyed?, exempt?})` lists the tables with a person column (`subject`, `owner`, `created_by`, `user_id`, `person`) that nothing covers, for a service test to assert is empty |
--| `openvibe-sdk/chat` | both | `createChatClient(client)`: `ask({ message, models })`, `pick(messageId, model)`, `prefer(messageId, model)`, `global.send/history/search`, `rooms.*` (list, create, get, update, messages, send, deleteMessage, join, leave, read, members, setMember), `dms.*` (list, create, get, messages, send, deleteMessage, read, unread, blocks, block, unblock), `exportMine()`, `vibe.*` (list, start, rename, remove: chats with Vibe), `inboxes.*` (list, create, get, update, remove, addMember, removeMember, conversations, messages, reply, setStatus, read, identity, replies, saveReply, deleteReply, webhooks, addWebhook, testWebhook, removeWebhook: a support inbox's team), `support.*` (list, messages, send: their own conversations with sites' chats), `feeds.*` (mine, create, update, rotateKey, remove, view, onLive). With no account: `createInboxVisitor(client, { inbox, token, user, account })` (visit, send, messages, handoff, rate: your own panel for an inbox, from any site) and `createFeedPublisher(client, { feed, key })` (hello, publish, claudeCode: vibe coding events with the feed's key) |
++| `openvibe-sdk/chat` | both | `createChatClient(client)`: `global.send/history/search`, `rooms.*` (list, create, get, update, messages, send, deleteMessage, join, leave, read, members, setMember), `dms.*` (list, create, get, messages, send, deleteMessage, read, unread, blocks, block, unblock), `exportMine()`, `vibe.*` (list, start, rename, remove: chats with Vibe), `inboxes.*` (list, create, get, update, remove, addMember, removeMember, conversations, messages, reply, setStatus, read, identity, replies, saveReply, deleteReply, webhooks, addWebhook, testWebhook, removeWebhook: a support inbox's team), `support.*` (list, messages, send: their own conversations with sites' chats), `feeds.*` (mine, create, update, rotateKey, remove, view, onLive). With no account: `createInboxVisitor(client, { inbox, token, user, account })` (visit, send, messages, handoff, rate: your own panel for an inbox, from any site) and `createFeedPublisher(client, { feed, key })` (hello, publish, claudeCode: vibe coding events with the feed's key) |
  | `openvibe-sdk/ai` | both | `createAiClient(client)`: `runs.create(workflow, input, {wait, idempotencyKey, latency, deadlineHours, …})`, `runs.get/list/cancel/retry/citations/addCitations/waitFor`, `batches.create/get/list/cancel`, `chat/generate/summarize/classify/extract/enrich/embed`. A run may ask for the class it may wait in (`latency`: `interactive`, `background`, `batch`; `deadlineHours`: 1–72 for a batch run); `waitFor` gives a batch run back pending rather than throwing when the wait is over — the answer comes with the run's completion event or webhook. |
  | `openvibe-sdk/jobs` | both | `createJobsClient(client, {baseUrl?})`: `submit` (Idempotency-Key), `get`, `cancel`, `retry`, `reference`, `unreference`, `events` (SSE, reattaches), `wait`, `file` (raw Response); `isTerminal()`. Default origin: the Tools gateway's jobs facade |
  | `openvibe-sdk/tools` | both | `createToolsClient(client, {baseUrl?, anonymousReads?})`: `list({family, q, execution, api, status})`, `get(id)`, `schema(id)`, `run(id, input, {files, waitMs, idempotencyKey, signal, timeoutMs})` (+ `.wait()`), `jobs`; `ToolRunError`, `isToolRunError()` |
@@@ -645,16 +645,6 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by [
  ### Locker: end-to-end encryption (Node and the browser)
  
  `openvibe-sdk/locker` seals anything and opens it again: the Locker envelope (`locker.envelope@1`), the three locks (people, password, link), streams for files, person key pairs and the eight-word fingerprint, `wrapFor` and `rewrap` for sharing, `recoveryWords` for the phrase to write down, `inspect` for what an envelope says about itself, and opening a people lock by key. `openvibe-sdk/locker/server` gives a service the header checks without a key. WebCrypto only, in Node and the browser. See [the locker module](docs/locker.md).
--
--### Compare answers in Chat
--
--```js
--const ov = createChatClient(client);
--const { chat, message } = await ov.ask({ message: "Explain this tradeoff", models: ["deepseek/deepseek-chat", "qwen/qwen3-32b"] });
--// Read /api/vibe/chat?slug=<chat.slug> to show each model answer and its receipt.
--await ov.pick(message.id, "qwen/qwen3-32b");
--```
--
  # AI comparison and Arena
  
  Read Report's public AI data and create or vote on Exchange Arena rounds:
@@@ -670,4 +660,3 @@ const exchange = require('openvibe-sdk/exchange').createExchangeClient({ develop
  const round = await exchange.arena.start({ prompt: 'Explain a binary search.', category: 'code', entries });
  await exchange.arena.vote(round.id, 'left');
  ```
--```
ddiff --git a/STATUS.json b/STATUS.json
iindex aea2f14..1809b8e 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.109.0",
++  "version": "0.110.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
@@@ -49,5 +49,5 @@
      "vibes (openvibe-sdk/vibes): Vibes Pay charges (create with the app reference as the Idempotency-Key, get, refund) and constant-time webhook verification (X-OpenVibe-Signature-V2, ±300 s) for developer apps",
      "streams (openvibe-sdk/streams): the Agent Streams plan S1 — start an agent stream on OpenVibe.Live (live.agent-stream@1) with its publish ticket, renew and revoke that ticket (the kill switch), poll state, post the last frame, set the curtain, switch visibility, end it and mint the view ticket; the publish ticket is a bearer of its own on the desk routes"
    ],
--  "updated": "2026-11-08"
++  "updated": "2026-11-09"
  }
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex e9dc5eb..7c163a9 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.109.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.110.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, modules, realtime, media, cam, community, homeFeed, bot, search, bench, meme, vision, themes, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -52,7 +52,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.109.0';
++const SDK_VERSION = '0.110.0';
  
  module.exports = {
      createClient,
ddiff --git a/docs/api-surface.json b/docs/api-surface.json
iindex 1533427..c0ea8c2 100644
---- a/docs/api-surface.json
++++ b/docs/api-surface.json
@@@ -130,6 +130,12 @@
          "createDealsClient"
        ]
      },
++    "design": {
++      "object": [
++        "DEFAULT_DESIGN_URL",
++        "createDesignClient"
++      ]
++    },
      "download": {
        "object": [
          "contentTypeOf",
@@@ -664,6 +670,10 @@
      "deliveryOffer": "function",
      "validateDeliveryOffer": "function"
    },
++  "openvibe-sdk/design": {
++    "DEFAULT_DESIGN_URL": "string",
++    "createDesignClient": "function"
++  },
    "openvibe-sdk/download": {
      "contentTypeOf": "function",
      "createDownloadClient": "function"
ddiff --git a/docs/design-icons.md b/docs/design-icons.md
nnew file mode 100644
iindex 0000000..4f99ecd
---- /dev/null
++++ b/docs/design-icons.md
@@@ -0,0 +1,19 @@
++# Design icon client
++
++Use the Design client with a signed-in access token to find glyphs, request a style family, or fetch a drawing:
++
++```js
++const { createDesignClient } = require('openvibe-sdk/design');
++const design = createDesignClient({ accessToken });
++
++const matches = await design.icons.search('hot tub');
++const draft = await design.icons.draft({
++    name: 'hot-tub',
++    sentence: 'A rental tub with steam over it',
++    styles: ['thin', 'light', 'regular', 'bold', 'solid', 'duotone'],
++});
++const glyph = await design.icons.get('hot-tub', { style: 'duotone' });
++```
++
++For a solid twin, pass the existing line drawing as `sourceSvg` and request `styles: ['solid']`. The server sanitizes and
++fits both drawings before saving them for review. Drafts stay private until an administrator approves them.
ddiff --git a/esm/design.mjs b/esm/design.mjs
nnew file mode 100644
iindex 0000000..4d37df8
---- /dev/null
++++ b/esm/design.mjs
@@@ -0,0 +1,3 @@
++import cjs from '../src/design.js';
++export const { createDesignClient, DEFAULT_DESIGN_URL } = cjs;
++export default cjs;
ddiff --git a/esm/index.mjs b/esm/index.mjs
iindex 46d5e3e..5511152 100644
---- a/esm/index.mjs
++++ b/esm/index.mjs
@@@ -14,6 +14,6 @@ export const {
      coupons, deals, trade, space, host, news,
      food, actor, run, video, work, zone,
      play, download, openre, geo, usage, commerce,
--    telemetry,
++    telemetry, design,
  } = cjs;
  export default cjs;
ddiff --git a/index.js b/index.js
iindex 38c6fbe..7309e02 100644
---- a/index.js
++++ b/index.js
@@@ -64,4 +64,5 @@ module.exports = {
      usage: require('./src/usage'),
      commerce: require('./src/commerce'),
      telemetry: require('./src/telemetry'),
++    design: require('./src/design'),
  };
ddiff --git a/package-lock.json b/package-lock.json
iindex aed0126..e7f64d8 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.109.0",
++  "version": "0.110.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.109.0",
++      "version": "0.110.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 605b410..2b03294 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.109.0",
++  "version": "0.110.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
@@@ -198,6 +198,12 @@
        "import": "./esm/exchange.mjs",
        "default": "./src/exchange.js"
      },
++    "./design": {
++      "types": "./types/design.d.ts",
++      "browser": null,
++      "import": "./esm/design.mjs",
++      "default": "./src/design.js"
++    },
      "./report": {
        "types": "./types/report.d.ts",
        "import": "./esm/report.mjs",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex f8a15b3..a8d350f 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.109.0';
++const SDK_VERSION = '0.110.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/design.js b/src/design.js
nnew file mode 100644
iindex 0000000..d3fefd6
---- /dev/null
++++ b/src/design.js
@@@ -0,0 +1,49 @@
++'use strict';
++
++const DEFAULT_DESIGN_URL = 'https://openvibe.design';
++const STYLES = new Set(['thin', 'light', 'regular', 'bold', 'solid', 'duotone']);
++
++/** A small authenticated client for the Design icon API. */
++function createDesignClient({ accessToken, baseUrl = DEFAULT_DESIGN_URL, fetchImpl = globalThis.fetch, timeoutMs = 15000 } = {}) {
++    if (typeof accessToken !== 'string' || !accessToken) throw new TypeError('createDesignClient: accessToken is required');
++    if (typeof fetchImpl !== 'function') throw new TypeError('createDesignClient: fetch is unavailable');
++    const base = String(baseUrl).replace(/\/+$/, '');
++    if (!/^https?:\/\/[^/]+$/i.test(base)) throw new TypeError('createDesignClient: baseUrl must be an origin');
++    async function request(path, { method = 'GET', body, signal } = {}) {
++        const response = await fetchImpl(`${base}${path}`, {
++            method,
++            headers: { accept: 'application/json', authorization: `Bearer ${accessToken}`,
++                ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
++            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
++            signal: signal || AbortSignal.timeout(timeoutMs),
++        });
++        const data = await response.json().catch(() => ({}));
++        if (!response.ok) {
++            const err = new Error(data.detail || data.message || `Design API returned ${response.status}`);
++            err.status = response.status;
++            err.code = data.code || null;
++            throw err;
++        }
++        return data;
++    }
++    const icons = Object.freeze({
++        async draft({ name, sentence = '', styles = [...STYLES], sourceSvg = undefined }, { signal } = {}) {
++            if (!/^[a-z][a-z0-9-]{1,31}$/.test(String(name || ''))) throw new TypeError('icons.draft: name must be 2–32 lowercase letters, digits or dashes');
++            if (!Array.isArray(styles) || !styles.length || styles.some((s) => !STYLES.has(s))) throw new TypeError('icons.draft: styles must be thin, light, regular, bold, solid or duotone');
++            return request('/api/v1/glyphs/draft', { method: 'POST', body: { name, sentence, styles, ...(sourceSvg ? { sourceSvg } : {}) }, signal });
++        },
++        async get(name, { style = 'regular', signal } = {}) {
++            if (!/^[a-z][a-z0-9-]{1,31}$/.test(String(name || ''))) throw new TypeError('icons.get: name must be lowercase letters, digits or dashes');
++            if (!STYLES.has(style)) throw new TypeError('icons.get: unsupported style');
++            return request(`/api/v1/glyphs/${encodeURIComponent(name)}?style=${encodeURIComponent(style)}`, { signal });
++        },
++        async search(q, { limit = 24, signal } = {}) {
++            const query = String(q || '').trim();
++            if (!query) throw new TypeError('icons.search: q is required');
++            return request(`/api/v1/glyphs/search?q=${encodeURIComponent(query)}&limit=${encodeURIComponent(Math.min(Math.max(Number(limit) || 24, 1), 60))}`, { signal });
++        },
++    });
++    return Object.freeze({ icons });
++}
++
++module.exports = { createDesignClient, DEFAULT_DESIGN_URL };
ddiff --git a/test/browser-entries.test.js b/test/browser-entries.test.js
iindex 5d3a7bb..2853905 100644
---- a/test/browser-entries.test.js
++++ b/test/browser-entries.test.js
@@@ -76,7 +76,7 @@ run([
              for (const [re, why] of FORBIDDEN) if (re.test(src)) problems.push(`${path.relative(ROOT, file)}: ${why}`);
          }
          assert.deepEqual(problems, []);
--        assert.deepEqual(blocked.sort(), ['./account-data', './actor', './app-signin', './assertions', './blog', './cache', './chat-apps', './commerce', './compute', './consent', './cost', './coupons', './db', './deals', './delivery', './download', './events', './exchange', './food', './govern', './host', './identity', './inventory', './limits', './live', './menu', './news', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './reports', './resources', './reviews', './run', './runtime', './service', './share', './space', './sso', './storage', './streams', './telemetry', './testing', './tips', './trade', './usage', './valkey', './vibes', './video', './vip', './wiki', './work', './zone']);
++        assert.deepEqual(blocked.sort(), ['./account-data', './actor', './app-signin', './assertions', './blog', './cache', './chat-apps', './commerce', './compute', './consent', './cost', './coupons', './db', './deals', './delivery', './design', './download', './events', './exchange', './food', './govern', './host', './identity', './inventory', './limits', './live', './menu', './news', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './reports', './resources', './reviews', './run', './runtime', './service', './share', './space', './sso', './storage', './streams', './telemetry', './testing', './tips', './trade', './usage', './valkey', './vibes', './video', './vip', './wiki', './work', './zone']);
          const rel = [...scanned].map((f) => path.relative(ROOT, f).split(path.sep).join('/'));   // the same names on Windows
          for (const must of ['browser.js', 'src/core/client.js', 'src/auth/browser.js', 'src/cam/index.js', 'src/realtime.js', 'src/media.js', 'src/community.js', 'src/bot.js', 'src/modules.js', 'src/registry.js', 'src/jobs.js', 'src/tools.js', 'src/core/form.js', 'src/projects.js', 'browser/openvibe-sdk.mjs']) {
              assert.ok(rel.includes(must), `${must} is scanned`);
ddiff --git a/test/design-icons.test.js b/test/design-icons.test.js
nnew file mode 100644
iindex 0000000..61919d8
---- /dev/null
++++ b/test/design-icons.test.js
@@@ -0,0 +1,26 @@
++'use strict';
++const assert = require('node:assert/strict');
++const { createDesignClient } = require('../src/design');
++
++(async () => {
++    const calls = [];
++    const client = createDesignClient({ accessToken: 'test-token', fetchImpl: async (url, init) => {
++        calls.push({ url: String(url), init });
++        return { ok: true, async json() { return { glyphs: [], kept: [], refused: [] }; } };
++    } });
++    await client.icons.draft({ name: 'hot-tub', styles: ['thin', 'solid'], sourceSvg: '<path d="M5 12h14"/>' });
++    await client.icons.get('hot-tub', { style: 'duotone' });
++    await client.icons.search('hot tub', { limit: 5 });
++    assert.equal(calls[0].init.headers.authorization, 'Bearer test-token');
++    assert.deepEqual(JSON.parse(calls[0].init.body).styles, ['thin', 'solid']);
++    assert.equal(JSON.parse(calls[0].init.body).sourceSvg, '<path d="M5 12h14"/>');
++    assert.match(calls[1].url, /\/api\/v1\/glyphs\/hot-tub\?style=duotone$/);
++    assert.match(calls[2].url, /\/api\/v1\/glyphs\/search\?q=hot%20tub&limit=5$/);
++    await assert.rejects(client.icons.get('bad name'), TypeError);
++    const esm = await import('../esm/index.mjs');
++    assert.equal(typeof esm.design.createDesignClient, 'function', 'the ESM root exposes the Design client');
++    const designEsm = await import('../esm/design.mjs');
++    const esmClient = designEsm.createDesignClient({ accessToken: 'test-token', fetchImpl: async () => ({ ok: true, async json() { return {}; } }) });
++    await esmClient.icons.get('heart', { style: 'bold' });
++    console.log('Design SDK icons: draft, get and search use the authenticated glyph API');
++})().catch((err) => { console.error(err); process.exit(1); });
ddiff --git a/test/pack.test.js b/test/pack.test.js
iindex 1ccd251..b289d99 100644
---- a/test/pack.test.js
++++ b/test/pack.test.js
@@@ -72,7 +72,7 @@ run([
                  })().catch((err) => { console.error(err); process.exit(1); });`;
              const res = execFileSync(process.execPath, ['-e', script], { cwd: app, encoding: 'utf8' });
              assert.match(res, new RegExp(`consumer ok: ${subpaths.length} subpaths \\+ the browser bundle`));
--            assert.equal(subpaths.length, 93);   // Daily quest methods extend the existing quest subpath (0.108.0); the 93-subpath count is unchanged.
++            assert.equal(subpaths.length, 94);   // Adds the Design icon client.
              assert.ok(!fs.existsSync(path.join(app, 'node_modules/openvibe-contracts')), 'the optional peer is not installed');
          } finally {
              fs.rmSync(tmp, { recursive: true, force: true });
ddiff --git a/types/design.d.ts b/types/design.d.ts
nnew file mode 100644
iindex 0000000..c01d136
---- /dev/null
++++ b/types/design.d.ts
@@@ -0,0 +1,12 @@
++export type GlyphStyle = 'thin' | 'light' | 'regular' | 'bold' | 'solid' | 'duotone';
++export interface DesignGlyph { name: string; style: GlyphStyle; svg: string; solid: string; strokeWidth: number | null; underlay: string; underlayOpacity: number; }
++export interface DesignGlyphReference { name: string; set: string; setName: string; author: string; license: string; licenseUrl: string; preview: string; }
++export interface DesignGlyphDraft { id: string; name: string; svg: string; solid_svg: string | null; styles: GlyphStyle[]; references: DesignGlyphReference[]; status: string; }
++export declare function createDesignClient(options: { accessToken: string; baseUrl?: string; fetchImpl?: typeof fetch; timeoutMs?: number }): {
++    icons: {
++        draft(input: { name: string; sentence?: string; styles?: GlyphStyle[]; sourceSvg?: string }, opts?: { signal?: AbortSignal }): Promise<{ kept: DesignGlyphDraft[]; refused: string[] }>;
++        get(name: string, opts?: { style?: GlyphStyle; signal?: AbortSignal }): Promise<DesignGlyph>;
++        search(q: string, opts?: { limit?: number; signal?: AbortSignal }): Promise<{ query: string; glyphs: DesignGlyph[] }>;
++    };
++};
++export declare const DEFAULT_DESIGN_URL: string;
ddiff --git a/types/index.d.ts b/types/index.d.ts
iindex 5ff09a6..f963f1a 100644
---- a/types/index.d.ts
++++ b/types/index.d.ts
@@@ -1,5 +1,6 @@
  export * from './core';
  export * as auth from './auth';
++export * as design from './design';
  export * as report from './report';
  export * as report from './report';
  export * as registry from './registry';