@neus/sdk 1.0.3 → 1.0.5

package/client.js

@@ -1,313 +1,312 @@
-/**
- * NEUS SDK Client
- * Create and verify cryptographic proofs across applications
- * @license Apache-2.0
- */
-
 import { ApiError, ValidationError, NetworkError, ConfigurationError } from './errors.js';
-import { constructVerificationMessage, validateWalletAddress, validateUniversalAddress, signMessage, NEUS_CONSTANTS } from './utils.js';
-
-const FALLBACK_PUBLIC_VERIFIERS = [
-  'ownership-basic',
-  'ownership-pseudonym',
-  'ownership-dns-txt',
-  'ownership-social',
-  'ownership-org-oauth',
-  'contract-ownership',
-  'nft-ownership',
-  'token-holding',
-  'wallet-link',
-  'wallet-risk',
-  'proof-of-human',
-  'agent-identity',
-  'agent-delegation',
-  'ai-content-moderation'
-];
-
-const INTERACTIVE_VERIFIERS = new Set([
-  'ownership-social',
-  'ownership-org-oauth',
-  'proof-of-human'
-]);
-
-const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
-
-// Validation for supported verifiers
+import {
+  PORTABLE_PROOF_SIGNER_HEADER,
+  constructVerificationMessage,
+  validateWalletAddress,
+  validateUniversalAddress,
+  signMessage,
+  NEUS_CONSTANTS
+} from './utils.js';
+
+const FALLBACK_PUBLIC_VERIFIER_CATALOG = {
+  'ownership-basic': { supportsDirectApi: true },
+  'ownership-pseudonym': { supportsDirectApi: true },
+  'ownership-dns-txt': { supportsDirectApi: true },
+  'ownership-social': { supportsDirectApi: false },
+  'ownership-org-oauth': { supportsDirectApi: false },
+  'contract-ownership': { supportsDirectApi: true },
+  'nft-ownership': { supportsDirectApi: true },
+  'token-holding': { supportsDirectApi: true },
+  'wallet-link': { supportsDirectApi: true },
+  'wallet-risk': { supportsDirectApi: true },
+  'proof-of-human': { supportsDirectApi: false },
+  'agent-identity': { supportsDirectApi: true },
+  'agent-delegation': { supportsDirectApi: true },
+  'ai-content-moderation': { supportsDirectApi: true }
+};
+
+const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+const WALLET_LINK_RELATIONSHIP_TYPES = new Set(['primary', 'personal', 'org', 'affiliate', 'agent', 'linked']);
+
+function normalizeWalletLinkRelationshipType(value) {
+  const normalized = String(value || '').trim().toLowerCase();
+  return WALLET_LINK_RELATIONSHIP_TYPES.has(normalized) ? normalized : 'linked';
+}
+
 const validateVerifierData = (verifierId, data) => {
   if (!data || typeof data !== 'object') {
     return { valid: false, error: 'Data object is required' };
   }
-  
-  // Format validation for supported verifiers
+
   switch (verifierId) {
-    case 'ownership-basic':
-      // Required: owner (must match request walletAddress).
-      // Reference is optional when content/contentHash is provided.
-      // If neither content nor contentHash is provided, reference.id is required (reference-only proof).
-      if (!data.owner || !validateUniversalAddress(data.owner, typeof data.chain === 'string' ? data.chain : undefined)) {
-        return { valid: false, error: 'owner (universal wallet address) is required' };
+  case 'ownership-basic':
+    if (!data.owner || !validateUniversalAddress(data.owner, typeof data.chain === 'string' ? data.chain : undefined)) {
+      return { valid: false, error: 'owner (universal wallet address) is required' };
+    }
+    if (data.content !== undefined && data.content !== null) {
+      if (typeof data.content !== 'string') {
+        return { valid: false, error: 'content must be a string when provided' };
       }
-      if (data.content !== undefined && data.content !== null) {
-        if (typeof data.content !== 'string') {
-          return { valid: false, error: 'content must be a string when provided' };
-        }
-        if (data.content.length > 50000) {
-          return { valid: false, error: 'content exceeds 50KB inline limit' };
-        }
+      if (data.content.length > 50000) {
+        return { valid: false, error: 'content exceeds 50KB inline limit' };
       }
-      if (data.contentHash !== undefined && data.contentHash !== null) {
-        if (typeof data.contentHash !== 'string' || !/^0x[a-fA-F0-9]{64}$/.test(data.contentHash)) {
-          return { valid: false, error: 'contentHash must be a 32-byte hex string (0x + 64 hex chars) when provided' };
-        }
+    }
+    if (data.contentHash !== undefined && data.contentHash !== null) {
+      if (typeof data.contentHash !== 'string' || !/^0x[a-fA-F0-9]{64}$/.test(data.contentHash)) {
+        return { valid: false, error: 'contentHash must be a 32-byte hex string (0x + 64 hex chars) when provided' };
       }
-      if (data.contentType !== undefined && data.contentType !== null) {
-        if (typeof data.contentType !== 'string' || data.contentType.length > 100) {
-          return { valid: false, error: 'contentType must be a string (max 100 chars) when provided' };
-        }
-        const base = String(data.contentType).split(';')[0].trim().toLowerCase();
-        // Minimal MIME sanity check (server validates more precisely).
-        if (!base || base.includes(' ') || !base.includes('/')) {
-          return { valid: false, error: 'contentType must be a valid MIME type when provided' };
+    }
+    if (data.contentType !== undefined && data.contentType !== null) {
+      if (typeof data.contentType !== 'string' || data.contentType.length > 100) {
+        return { valid: false, error: 'contentType must be a string (max 100 chars) when provided' };
+      }
+      const base = String(data.contentType).split(';')[0].trim().toLowerCase();
+      // Minimal MIME sanity check (server validates more precisely).
+      if (!base || base.includes(' ') || !base.includes('/')) {
+        return { valid: false, error: 'contentType must be a valid MIME type when provided' };
+      }
+    }
+    if (data.provenance !== undefined && data.provenance !== null) {
+      if (!data.provenance || typeof data.provenance !== 'object' || Array.isArray(data.provenance)) {
+        return { valid: false, error: 'provenance must be an object when provided' };
+      }
+      const dk = data.provenance.declaredKind;
+      if (dk !== undefined && dk !== null) {
+        const allowed = ['human', 'ai', 'mixed', 'unknown'];
+        if (typeof dk !== 'string' || !allowed.includes(dk)) {
+          return { valid: false, error: `provenance.declaredKind must be one of: ${allowed.join(', ')}` };
         }
       }
-      if (data.provenance !== undefined && data.provenance !== null) {
-        if (!data.provenance || typeof data.provenance !== 'object' || Array.isArray(data.provenance)) {
-          return { valid: false, error: 'provenance must be an object when provided' };
+      const ai = data.provenance.aiContext;
+      if (ai !== undefined && ai !== null) {
+        if (typeof ai !== 'object' || Array.isArray(ai)) {
+          return { valid: false, error: 'provenance.aiContext must be an object when provided' };
         }
-        const dk = data.provenance.declaredKind;
-        if (dk !== undefined && dk !== null) {
-          const allowed = ['human', 'ai', 'mixed', 'unknown'];
-          if (typeof dk !== 'string' || !allowed.includes(dk)) {
-            return { valid: false, error: `provenance.declaredKind must be one of: ${allowed.join(', ')}` };
+        if (ai.generatorType !== undefined && ai.generatorType !== null) {
+          const allowed = ['local', 'saas', 'agent'];
+          if (typeof ai.generatorType !== 'string' || !allowed.includes(ai.generatorType)) {
+            return { valid: false, error: `provenance.aiContext.generatorType must be one of: ${allowed.join(', ')}` };
           }
         }
-        const ai = data.provenance.aiContext;
-        if (ai !== undefined && ai !== null) {
-          if (typeof ai !== 'object' || Array.isArray(ai)) {
-            return { valid: false, error: 'provenance.aiContext must be an object when provided' };
-          }
-          if (ai.generatorType !== undefined && ai.generatorType !== null) {
-            const allowed = ['local', 'saas', 'agent'];
-            if (typeof ai.generatorType !== 'string' || !allowed.includes(ai.generatorType)) {
-              return { valid: false, error: `provenance.aiContext.generatorType must be one of: ${allowed.join(', ')}` };
-            }
-          }
-          if (ai.provider !== undefined && ai.provider !== null) {
-            if (typeof ai.provider !== 'string' || ai.provider.length > 64) {
-              return { valid: false, error: 'provenance.aiContext.provider must be a string (max 64 chars) when provided' };
-            }
-          }
-          if (ai.model !== undefined && ai.model !== null) {
-            if (typeof ai.model !== 'string' || ai.model.length > 128) {
-              return { valid: false, error: 'provenance.aiContext.model must be a string (max 128 chars) when provided' };
-            }
-          }
-          if (ai.runId !== undefined && ai.runId !== null) {
-            if (typeof ai.runId !== 'string' || ai.runId.length > 128) {
-              return { valid: false, error: 'provenance.aiContext.runId must be a string (max 128 chars) when provided' };
-            }
+        if (ai.provider !== undefined && ai.provider !== null) {
+          if (typeof ai.provider !== 'string' || ai.provider.length > 64) {
+            return { valid: false, error: 'provenance.aiContext.provider must be a string (max 64 chars) when provided' };
           }
         }
-      }
-      if (data.reference !== undefined) {
-        if (!data.reference || typeof data.reference !== 'object') {
-          return { valid: false, error: 'reference must be an object when provided' };
+        if (ai.model !== undefined && ai.model !== null) {
+          if (typeof ai.model !== 'string' || ai.model.length > 128) {
+            return { valid: false, error: 'provenance.aiContext.model must be a string (max 128 chars) when provided' };
+          }
         }
-        if (!data.reference.type || typeof data.reference.type !== 'string') {
-          // Only required when reference object is present (or when doing reference-only proofs).
-          // Server requires reference.type when reference is used for traceability.
-          return { valid: false, error: 'reference.type is required when reference is provided' };
+        if (ai.runId !== undefined && ai.runId !== null) {
+          if (typeof ai.runId !== 'string' || ai.runId.length > 128) {
+            return { valid: false, error: 'provenance.aiContext.runId must be a string (max 128 chars) when provided' };
+          }
         }
       }
-      if (!data.content && !data.contentHash) {
-        if (!data.reference || typeof data.reference !== 'object') {
-          return { valid: false, error: 'reference is required when neither content nor contentHash is provided' };
-        }
-        if (!data.reference.id || typeof data.reference.id !== 'string') {
-          return { valid: false, error: 'reference.id is required when neither content nor contentHash is provided' };
-        }
-        if (!data.reference.type || typeof data.reference.type !== 'string') {
-          return { valid: false, error: 'reference.type is required when neither content nor contentHash is provided' };
-        }
+    }
+    if (data.reference !== undefined) {
+      if (!data.reference || typeof data.reference !== 'object') {
+        return { valid: false, error: 'reference must be an object when provided' };
       }
-      break;
-    case 'nft-ownership':
-      // ownerAddress is optional; server injects from request walletAddress when omitted.
-      if (
-        !data.contractAddress ||
-        data.tokenId === null ||
-        data.tokenId === undefined ||
-        typeof data.chainId !== 'number'
-      ) {
-        return { valid: false, error: 'contractAddress, tokenId, and chainId are required' };
+      if (!data.reference.type || typeof data.reference.type !== 'string') {
+        // Only required when reference object is present (or when doing reference-only proofs).
+        // Server requires reference.type when reference is used for traceability.
+        return { valid: false, error: 'reference.type is required when reference is provided' };
       }
-      if (data.tokenType !== undefined && data.tokenType !== null) {
-        const tt = String(data.tokenType).toLowerCase();
-        if (tt !== 'erc721' && tt !== 'erc1155') {
-          return { valid: false, error: 'tokenType must be one of: erc721, erc1155' };
-        }
+    }
+    if (!data.content && !data.contentHash) {
+      if (!data.reference || typeof data.reference !== 'object') {
+        return { valid: false, error: 'reference is required when neither content nor contentHash is provided' };
       }
-      if (data.blockNumber !== undefined && data.blockNumber !== null && !Number.isInteger(data.blockNumber)) {
-        return { valid: false, error: 'blockNumber must be an integer when provided' };
+      if (!data.reference.id || typeof data.reference.id !== 'string') {
+        return { valid: false, error: 'reference.id is required when neither content nor contentHash is provided' };
       }
-      if (data.ownerAddress && !validateWalletAddress(data.ownerAddress)) {
-        return { valid: false, error: 'Invalid ownerAddress' };
+      if (!data.reference.type || typeof data.reference.type !== 'string') {
+        return { valid: false, error: 'reference.type is required when neither content nor contentHash is provided' };
       }
-      if (!validateWalletAddress(data.contractAddress)) {
-        return { valid: false, error: 'Invalid contractAddress' };
+    }
+    break;
+  case 'nft-ownership':
+    // ownerAddress is optional; server injects from request walletAddress when omitted.
+    if (
+      !data.contractAddress ||
+        data.tokenId === null ||
+        data.tokenId === undefined ||
+        typeof data.chainId !== 'number'
+    ) {
+      return { valid: false, error: 'contractAddress, tokenId, and chainId are required' };
+    }
+    if (data.tokenType !== undefined && data.tokenType !== null) {
+      const tt = String(data.tokenType).toLowerCase();
+      if (tt !== 'erc721' && tt !== 'erc1155') {
+        return { valid: false, error: 'tokenType must be one of: erc721, erc1155' };
       }
-      break;
-    case 'token-holding':
-      // ownerAddress is optional; server injects from request walletAddress when omitted.
-      if (
-        !data.contractAddress ||
+    }
+    if (data.blockNumber !== undefined && data.blockNumber !== null && !Number.isInteger(data.blockNumber)) {
+      return { valid: false, error: 'blockNumber must be an integer when provided' };
+    }
+    if (data.ownerAddress && !validateWalletAddress(data.ownerAddress)) {
+      return { valid: false, error: 'Invalid ownerAddress' };
+    }
+    if (!validateWalletAddress(data.contractAddress)) {
+      return { valid: false, error: 'Invalid contractAddress' };
+    }
+    break;
+  case 'token-holding':
+    // ownerAddress is optional; server injects from request walletAddress when omitted.
+    if (
+      !data.contractAddress ||
         data.minBalance === null ||
         data.minBalance === undefined ||
         typeof data.chainId !== 'number'
-      ) {
-        return { valid: false, error: 'contractAddress, minBalance, and chainId are required' };
-      }
-      if (data.blockNumber !== undefined && data.blockNumber !== null && !Number.isInteger(data.blockNumber)) {
-        return { valid: false, error: 'blockNumber must be an integer when provided' };
-      }
-      if (data.ownerAddress && !validateWalletAddress(data.ownerAddress)) {
-        return { valid: false, error: 'Invalid ownerAddress' };
-      }
-      if (!validateWalletAddress(data.contractAddress)) {
-        return { valid: false, error: 'Invalid contractAddress' };
-      }
-      break;
-    case 'ownership-dns-txt':
-      if (!data.domain || typeof data.domain !== 'string') {
-        return { valid: false, error: 'domain is required' };
-      }
-      if (data.walletAddress && !validateWalletAddress(data.walletAddress)) {
-        return { valid: false, error: 'Invalid walletAddress' };
-      }
-      break;
-    case 'wallet-link':
-      if (!data.primaryWalletAddress || !validateUniversalAddress(data.primaryWalletAddress, data.chain)) {
-        return { valid: false, error: 'primaryWalletAddress is required' };
-      }
-      if (!data.secondaryWalletAddress || !validateUniversalAddress(data.secondaryWalletAddress, data.chain)) {
-        return { valid: false, error: 'secondaryWalletAddress is required' };
-      }
-      if (!data.signature || typeof data.signature !== 'string') {
-        return { valid: false, error: 'signature is required (signed by secondary wallet)' };
-      }
-      if (typeof data.chain !== 'string' || !/^[a-z0-9]+:[^\s]+$/.test(data.chain)) {
-        return { valid: false, error: 'chain is required (namespace:reference)' };
-      }
-      if (typeof data.signatureMethod !== 'string' || !data.signatureMethod.trim()) {
-        return { valid: false, error: 'signatureMethod is required' };
-      }
-      if (typeof data.signedTimestamp !== 'number') {
-        return { valid: false, error: 'signedTimestamp is required' };
-      }
-      break;
-    case 'contract-ownership':
-      if (!data.contractAddress || !validateWalletAddress(data.contractAddress)) {
-        return { valid: false, error: 'contractAddress is required' };
-      }
-      if (data.walletAddress && !validateWalletAddress(data.walletAddress)) {
-        return { valid: false, error: 'Invalid walletAddress' };
-      }
-      if (typeof data.chainId !== 'number') {
-        return { valid: false, error: 'chainId is required' };
-      }
-      break;
-    case 'agent-identity':
-      if (!data.agentId || typeof data.agentId !== 'string' || data.agentId.length < 1 || data.agentId.length > 128) {
-        return { valid: false, error: 'agentId is required (1-128 chars)' };
-      }
-      if (!data.agentWallet || !validateWalletAddress(data.agentWallet)) {
-        return { valid: false, error: 'agentWallet is required' };
-      }
-      if (data.agentType && !['ai', 'bot', 'service', 'automation', 'agent'].includes(data.agentType)) {
-        return { valid: false, error: 'agentType must be one of: ai, bot, service, automation, agent' };
-      }
-      break;
-    case 'agent-delegation':
-      if (!data.controllerWallet || !validateWalletAddress(data.controllerWallet)) {
-        return { valid: false, error: 'controllerWallet is required' };
-      }
-      if (!data.agentWallet || !validateWalletAddress(data.agentWallet)) {
-        return { valid: false, error: 'agentWallet is required' };
-      }
-      if (data.scope && (typeof data.scope !== 'string' || data.scope.length > 128)) {
-        return { valid: false, error: 'scope must be a string (max 128 chars)' };
-      }
-      if (data.expiresAt && (typeof data.expiresAt !== 'number' || data.expiresAt < Date.now())) {
-        return { valid: false, error: 'expiresAt must be a future timestamp' };
-      }
-      break;
-    case 'ai-content-moderation':
-      if (!data.content || typeof data.content !== 'string') {
-        return { valid: false, error: 'content is required' };
-      }
-      if (!data.contentType || typeof data.contentType !== 'string') {
-        return { valid: false, error: 'contentType (MIME type) is required' };
-      }
-      {
-        // Only allow content types that are actually moderated (no "verified but skipped" bypass).
-        const contentType = String(data.contentType).split(';')[0].trim().toLowerCase();
-        const validTypes = [
-          'image/jpeg',
-          'image/png',
-          'image/webp',
-          'image/gif',
-          'text/plain',
-          'text/markdown',
-          'text/x-markdown',
-          'application/json',
-          'application/xml'
-        ];
-        if (!validTypes.includes(contentType)) {
-          return { valid: false, error: `contentType must be one of: ${validTypes.join(', ')}` };
-        }
-        const isTextual = contentType.startsWith('text/') || contentType.includes('markdown');
-        if (isTextual) {
-          // Backend enforces 50KB UTF-8 limit for textual moderation payloads.
-          try {
-            const maxBytes = 50 * 1024;
-            const bytes = (typeof TextEncoder !== 'undefined')
-              ? new TextEncoder().encode(data.content).length
-              : String(data.content).length;
-            if (bytes > maxBytes) {
-              return { valid: false, error: `content exceeds ${maxBytes} bytes limit for ai-content-moderation verifier (text)` };
-            }
-          } catch {
-            // If encoding fails, defer to server.
+    ) {
+      return { valid: false, error: 'contractAddress, minBalance, and chainId are required' };
+    }
+    if (data.blockNumber !== undefined && data.blockNumber !== null && !Number.isInteger(data.blockNumber)) {
+      return { valid: false, error: 'blockNumber must be an integer when provided' };
+    }
+    if (data.ownerAddress && !validateWalletAddress(data.ownerAddress)) {
+      return { valid: false, error: 'Invalid ownerAddress' };
+    }
+    if (!validateWalletAddress(data.contractAddress)) {
+      return { valid: false, error: 'Invalid contractAddress' };
+    }
+    break;
+  case 'ownership-dns-txt':
+    if (!data.domain || typeof data.domain !== 'string') {
+      return { valid: false, error: 'domain is required' };
+    }
+    if (data.walletAddress && !validateWalletAddress(data.walletAddress)) {
+      return { valid: false, error: 'Invalid walletAddress' };
+    }
+    break;
+  case 'wallet-link':
+    if (!data.primaryWalletAddress || !validateUniversalAddress(data.primaryWalletAddress, data.chain)) {
+      return { valid: false, error: 'primaryWalletAddress is required' };
+    }
+    if (!data.secondaryWalletAddress || !validateUniversalAddress(data.secondaryWalletAddress, data.chain)) {
+      return { valid: false, error: 'secondaryWalletAddress is required' };
+    }
+    if (!data.signature || typeof data.signature !== 'string') {
+      return { valid: false, error: 'signature is required (signed by secondary wallet)' };
+    }
+    if (typeof data.chain !== 'string' || !/^[a-z0-9]+:[^\s]+$/.test(data.chain)) {
+      return { valid: false, error: 'chain is required (namespace:reference)' };
+    }
+    if (typeof data.signatureMethod !== 'string' || !data.signatureMethod.trim()) {
+      return { valid: false, error: 'signatureMethod is required' };
+    }
+    if (typeof data.signedTimestamp !== 'number') {
+      return { valid: false, error: 'signedTimestamp is required' };
+    }
+    break;
+  case 'contract-ownership':
+    if (!data.contractAddress || !validateWalletAddress(data.contractAddress)) {
+      return { valid: false, error: 'contractAddress is required' };
+    }
+    if (data.walletAddress && !validateWalletAddress(data.walletAddress)) {
+      return { valid: false, error: 'Invalid walletAddress' };
+    }
+    if (typeof data.chainId !== 'number') {
+      return { valid: false, error: 'chainId is required' };
+    }
+    break;
+  case 'agent-identity':
+    if (!data.agentId || typeof data.agentId !== 'string' || data.agentId.length < 1 || data.agentId.length > 128) {
+      return { valid: false, error: 'agentId is required (1-128 chars)' };
+    }
+    if (!data.agentWallet || !validateWalletAddress(data.agentWallet)) {
+      return { valid: false, error: 'agentWallet is required' };
+    }
+    if (data.agentType && !['ai', 'bot', 'service', 'automation', 'agent'].includes(data.agentType)) {
+      return { valid: false, error: 'agentType must be one of: ai, bot, service, automation, agent' };
+    }
+    break;
+  case 'agent-delegation':
+    if (!data.controllerWallet || !validateWalletAddress(data.controllerWallet)) {
+      return { valid: false, error: 'controllerWallet is required' };
+    }
+    if (!data.agentWallet || !validateWalletAddress(data.agentWallet)) {
+      return { valid: false, error: 'agentWallet is required' };
+    }
+    if (data.scope && (typeof data.scope !== 'string' || data.scope.length > 128)) {
+      return { valid: false, error: 'scope must be a string (max 128 chars)' };
+    }
+    if (data.expiresAt && (typeof data.expiresAt !== 'number' || data.expiresAt < Date.now())) {
+      return { valid: false, error: 'expiresAt must be a future timestamp' };
+    }
+    break;
+  case 'ai-content-moderation':
+    if (!data.content || typeof data.content !== 'string') {
+      return { valid: false, error: 'content is required' };
+    }
+    if (!data.contentType || typeof data.contentType !== 'string') {
+      return { valid: false, error: 'contentType (MIME type) is required' };
+    }
+    {
+      // Only allow content types that are actually moderated (no "verified but skipped" bypass).
+      const contentType = String(data.contentType).split(';')[0].trim().toLowerCase();
+      const validTypes = [
+        'image/jpeg',
+        'image/png',
+        'image/webp',
+        'image/gif',
+        'text/plain',
+        'text/markdown',
+        'text/x-markdown',
+        'application/json',
+        'application/xml'
+      ];
+      if (!validTypes.includes(contentType)) {
+        return { valid: false, error: `contentType must be one of: ${validTypes.join(', ')}` };
+      }
+      const isTextual = contentType.startsWith('text/') || contentType.includes('markdown');
+      if (isTextual) {
+        // Backend enforces 50KB UTF-8 limit for textual moderation payloads.
+        try {
+          const maxBytes = 50 * 1024;
+          const bytes = (typeof TextEncoder !== 'undefined')
+            ? new TextEncoder().encode(data.content).length
+            : String(data.content).length;
+          if (bytes > maxBytes) {
+            return {
+              valid: false,
+              error: `content exceeds ${maxBytes} bytes limit for ai-content-moderation verifier (text)`
+            };
           }
+        } catch {
+          // If encoding fails, defer to server.
         }
       }
-      if (data.content.length > 13653334) {
-        return { valid: false, error: 'content exceeds 10MB limit' };
-      }
-      break;
-    case 'ownership-pseudonym':
-      if (!data.pseudonymId || typeof data.pseudonymId !== 'string') {
-        return { valid: false, error: 'pseudonymId is required' };
-      }
-      // Validate handle format (3-64 chars, lowercase alphanumeric with ._-)
-      if (!/^[a-z0-9._-]{3,64}$/.test(data.pseudonymId.trim().toLowerCase())) {
-        return { valid: false, error: 'pseudonymId must be 3-64 characters, lowercase alphanumeric with dots, underscores, or hyphens' };
-      }
-      // Validate namespace if provided (1-64 chars)
-      if (data.namespace && typeof data.namespace === 'string') {
-        if (!/^[a-z0-9._-]{1,64}$/.test(data.namespace.trim().toLowerCase())) {
-          return { valid: false, error: 'namespace must be 1-64 characters, lowercase alphanumeric with dots, underscores, or hyphens' };
-        }
-      }
-      // Note: signature is not required - envelope signature provides authentication
-      break;
-    case 'wallet-risk':
-      if (data.walletAddress && !validateUniversalAddress(data.walletAddress, data.chain)) {
-        return { valid: false, error: 'Invalid walletAddress' };
+    }
+    if (data.content.length > 13653334) {
+      return { valid: false, error: 'content exceeds 10MB limit' };
+    }
+    break;
+  case 'ownership-pseudonym':
+    if (!data.pseudonymId || typeof data.pseudonymId !== 'string') {
+      return { valid: false, error: 'pseudonymId is required' };
+    }
+    // Validate handle format (3-64 chars, lowercase alphanumeric with ._-)
+    if (!/^[a-z0-9._-]{3,64}$/.test(data.pseudonymId.trim().toLowerCase())) {
+      return { valid: false, error: 'pseudonymId must be 3-64 characters, lowercase alphanumeric with dots, underscores, or hyphens' };
+    }
+    // Validate namespace if provided (1-64 chars)
+    if (data.namespace && typeof data.namespace === 'string') {
+      if (!/^[a-z0-9._-]{1,64}$/.test(data.namespace.trim().toLowerCase())) {
+        return { valid: false, error: 'namespace must be 1-64 characters, lowercase alphanumeric with dots, underscores, or hyphens' };
       }
-      break;
+    }
+    // Note: signature is not required - envelope signature provides authentication
+    break;
+  case 'wallet-risk':
+    if (data.walletAddress && !validateUniversalAddress(data.walletAddress, data.chain)) {
+      return { valid: false, error: 'Invalid walletAddress' };
+    }
+    break;
   }
-  
+
   return { valid: true };
 };
 
@@ -319,7 +318,6 @@ export class NeusClient {
       ...config
     };
 
-    // NEUS Network API
     this.baseUrl = this.config.apiUrl || 'https://api.neus.network';
     // Enforce HTTPS for neus.network domains to satisfy CSP and normalize URLs
     try {
@@ -332,32 +330,25 @@ export class NeusClient {
     } catch {
       // If invalid URL string, leave as-is
     }
-    // Normalize apiUrl on config
     this.config.apiUrl = this.baseUrl;
-    // Default headers for API requests
+
+    // Default headers
+
     this.defaultHeaders = {
       'Content-Type': 'application/json',
       'Accept': 'application/json',
       'X-Neus-Sdk': 'js'
     };
 
-    // Optional API key (server-side only; do not embed in browser apps)
     if (typeof this.config.apiKey === 'string' && this.config.apiKey.trim().length > 0) {
       this.defaultHeaders['Authorization'] = `Bearer ${this.config.apiKey.trim()}`;
     }
-    // Public app attribution header (non-secret)
     if (typeof this.config.appId === 'string' && this.config.appId.trim().length > 0) {
       this.defaultHeaders['X-Neus-App'] = this.config.appId.trim();
     }
-    // Ephemeral sponsor capability token
-    if (typeof this.config.sponsorGrant === 'string' && this.config.sponsorGrant.trim().length > 0) {
-      this.defaultHeaders['X-Sponsor-Grant'] = this.config.sponsorGrant.trim();
-    }
-    // x402 retry receipt header
-    if (typeof this.config.paymentSignature === 'string' && this.config.paymentSignature.trim().length > 0) {
-      this.defaultHeaders['PAYMENT-SIGNATURE'] = this.config.paymentSignature.trim();
-    }
-    // Optional caller-supplied passthrough headers.
+    if (typeof this.config.paymentSignature === 'string' && this.config.paymentSignature.trim().length > 0) {
+      this.defaultHeaders['PAYMENT-SIGNATURE'] = this.config.paymentSignature.trim();
+    }
     if (this.config.extraHeaders && typeof this.config.extraHeaders === 'object') {
       for (const [k, v] of Object.entries(this.config.extraHeaders)) {
         if (!k || v === undefined || v === null) continue;
@@ -368,7 +359,6 @@ export class NeusClient {
       }
     }
     try {
-      // Attach origin in browser environments
       if (typeof window !== 'undefined' && window.location && window.location.origin) {
         this.defaultHeaders['X-Client-Origin'] = window.location.origin;
       }
@@ -493,76 +483,136 @@ export class NeusClient {
     };
   }
 
-  async createGatePrivateAuth(params = {}) {
-    const address = (params.address || '').toString();
-    if (!validateUniversalAddress(address, params.chain)) {
-      throw new ValidationError('Valid address is required');
-    }
+  async createGatePrivateAuth(params = {}) {
+    const address = (params.address || '').toString();
+    if (!validateUniversalAddress(address, params.chain)) {
+      throw new ValidationError('Valid address is required');
+    }
     return this._buildPrivateGateAuth({
       address,
       wallet: params.wallet,
       chain: params.chain,
-      signatureMethod: params.signatureMethod
-    });
-  }
-
-  // ============================================================================
-  // CORE VERIFICATION METHODS
-  // ============================================================================
-
-  /**
-   * VERIFY - Standard verification (auto or manual)
-   * 
-   * Create proofs with complete control over the verification process.
-   * If signature and walletAddress are omitted but verifier/content are provided,
-   * this method performs the wallet flow inline (no aliases, no secondary methods).
-   * 
+      signatureMethod: params.signatureMethod
+    });
+  }
+
+  async createWalletLinkData(params = {}) {
+    const normalizedPrimary = this._normalizeIdentity(params.primaryWalletAddress);
+    const normalizedSecondary = this._normalizeIdentity(params.secondaryWalletAddress);
+
+    if (!EVM_ADDRESS_RE.test(normalizedPrimary)) {
+      throw new ValidationError('wallet-link requires a valid primaryWalletAddress');
+    }
+    if (!EVM_ADDRESS_RE.test(normalizedSecondary)) {
+      throw new ValidationError('wallet-link requires a valid secondaryWalletAddress');
+    }
+    if (normalizedPrimary === normalizedSecondary) {
+      throw new ValidationError('wallet-link secondaryWalletAddress must differ from primaryWalletAddress');
+    }
+
+    const providerWallet = params.wallet || this._getDefaultBrowserWallet();
+    const { signerWalletAddress, provider } = await this._resolveWalletSigner(providerWallet);
+    const normalizedSigner = this._normalizeIdentity(signerWalletAddress);
+    if (!EVM_ADDRESS_RE.test(normalizedSigner)) {
+      throw new ValidationError('wallet-link requires an EVM wallet/provider for the secondary wallet');
+    }
+    if (normalizedSigner !== normalizedSecondary) {
+      throw new ValidationError('wallet-link wallet/provider must be connected to secondaryWalletAddress');
+    }
+
+    const resolvedChain = (() => {
+      const raw = String(params.chain || '').trim();
+      if (!raw) return `eip155:${this._getHubChainId()}`;
+      if (!/^eip155:\d+$/.test(raw)) {
+        throw new ValidationError('wallet-link requires chain in the form eip155:<chainId>');
+      }
+      return raw;
+    })();
+    const signedTimestamp = Number.isFinite(Number(params.signedTimestamp)) && Number(params.signedTimestamp) > 0
+      ? Number(params.signedTimestamp)
+      : Date.now();
+    const linkData = {
+      primaryAccountId: `${resolvedChain}:${normalizedPrimary}`,
+      secondaryAccountId: `${resolvedChain}:${normalizedSecondary}`,
+      primaryWalletAddress: normalizedPrimary,
+      secondaryWalletAddress: normalizedSecondary
+    };
+    const message = constructVerificationMessage({
+      walletAddress: normalizedSecondary,
+      signedTimestamp,
+      data: linkData,
+      verifierIds: ['wallet-link'],
+      chain: resolvedChain
+    });
+
+    let signature;
+    try {
+      signature = await signMessage({
+        provider,
+        message,
+        walletAddress: signerWalletAddress
+      });
+    } catch (error) {
+      if (error?.code === 4001) {
+        throw new ValidationError('User rejected wallet-link signature request');
+      }
+      throw new ValidationError(`Failed to sign wallet-link message: ${error?.message || String(error)}`);
+    }
+
+    const label = String(params.label || '').trim().slice(0, 64);
+    return {
+      primaryWalletAddress: normalizedPrimary,
+      secondaryWalletAddress: normalizedSecondary,
+      signature,
+      chain: resolvedChain,
+      signatureMethod: 'eip191',
+      signedTimestamp,
+      relationshipType: normalizeWalletLinkRelationshipType(params.relationshipType),
+      ...(label ? { label } : {})
+    };
+  }
+
+  /**
+   * Create a verification proof.
+   *
+   * Supports two paths:
+   *   - **Auto:** Supply `verifier`, `content`, and/or `data` with an optional
+   *     `wallet` provider. The SDK performs signing in the client.
+   *   - **Manual:** Supply pre-signed `verifierIds`, `data`, `walletAddress`,
+   *     `signature`, and `signedTimestamp`.
+   *
    * @param {Object} params - Verification parameters
+   * @param {string} [params.verifier] - Verifier ID (auto path, e.g. 'ownership-basic')
+   * @param {string} [params.content] - Content to verify (auto path)
+   * @param {Object} [params.data] - Structured verification data
+   * @param {Object} [params.wallet] - Wallet provider (auto path)
+   * @param {Object} [params.options] - Additional options
    * @param {Array<string>} [params.verifierIds] - Array of verifier IDs (manual path)
-   * @param {Object} [params.data] - Verification data object (manual path)
    * @param {string} [params.walletAddress] - Wallet address that signed the request (manual path)
    * @param {string} [params.signature] - EIP-191 signature (manual path)
    * @param {number} [params.signedTimestamp] - Unix timestamp when signature was created (manual path)
-   * @param {number} [params.chainId] - Chain ID for verification context (optional, managed by protocol)
-   * @param {Object} [params.options] - Additional options
-   * @param {string} [params.verifier] - Verifier ID (auto path)
-   * @param {string} [params.content] - Content/description (auto path)
-   * @param {Object} [params.wallet] - Optional injected wallet/provider (auto path)
-   * @returns {Promise<Object>} Verification result with proofId (qHash is a deprecated alias)
-   * 
+   * @param {number} [params.chainId] - EVM signing-context hint; when omitted, resolved to the NEUS protocol primary chain for signing
+   * @returns {Promise<Object>} Verification result with proofId
+   *
+   * @example
+   * // Auto path
+   * const proof = await client.verify({
+   *   verifier: 'ownership-basic',
+   *   content: 'Hello World',
+   *   wallet: window.ethereum
+   * });
+   *
    * @example
+   * // Manual path
    * const proof = await client.verify({
    *   verifierIds: ['ownership-basic'],
-   *   data: {
-   *     content: "My content",
-   *     owner: walletAddress, // or ownerAddress for nft-ownership/token-holding
-   *     reference: { type: 'other', id: 'my-unique-identifier' }
-   *   },
+   *   data: { content: "My content", owner: walletAddress },
    *   walletAddress: '0x...',
    *   signature: '0x...',
    *   signedTimestamp: Date.now(),
    *   options: { targetChains: [421614, 11155111] }
    * });
    */
-  /**
-   * Create a verification proof
-   *
-   * @param {Object} params - Verification parameters
-   * @param {string} [params.verifier] - Verifier ID (e.g., 'ownership-basic')
-   * @param {string} [params.content] - Content to verify
-   * @param {Object} [params.data] - Structured verification data
-   * @param {Object} [params.wallet] - Wallet provider
-   * @param {Object} [params.options] - Additional options
-   * @returns {Promise<Object>} Verification result with proofId (qHash is a deprecated alias)
-   *
-   * @example
-   * // Simple ownership proof
-   * const proof = await client.verify({
-   *   verifier: 'ownership-basic',
-   *   content: 'Hello World',
-   *   wallet: window.ethereum
-   * });
-   */
   async verify(params) {
     // Auto path: if no manual signature fields but auto fields are provided, perform inline wallet flow
     if ((!params?.signature || !params?.walletAddress) && (params?.verifier || params?.content || params?.data)) {
@@ -573,30 +623,31 @@ export class NeusClient {
         throw new ValidationError('content is required and must be a string (or use data param with owner + reference)');
       }
 
-      let validVerifiers = FALLBACK_PUBLIC_VERIFIERS;
+      let verifierCatalog = FALLBACK_PUBLIC_VERIFIER_CATALOG;
       try {
-        const discovered = await this.getVerifiers();
-        if (Array.isArray(discovered) && discovered.length > 0) {
-          validVerifiers = discovered;
+        const discovered = await this.getVerifierCatalog();
+        if (discovered && discovered.metadata && Object.keys(discovered.metadata).length > 0) {
+          verifierCatalog = discovered.metadata;
         }
       } catch {
         // Fallback keeps SDK usable if verifier catalog endpoint is temporarily unavailable.
       }
+      const validVerifiers = Object.keys(verifierCatalog);
       if (!validVerifiers.includes(verifier)) {
         throw new ValidationError(`Invalid verifier '${verifier}'. Must be one of: ${validVerifiers.join(', ')}.`);
       }
 
-      if (INTERACTIVE_VERIFIERS.has(verifier)) {
+      if (verifierCatalog?.[verifier]?.supportsDirectApi === false) {
         const hostedCheckoutUrl = options?.hostedCheckoutUrl || 'https://neus.network/verify';
         throw new ValidationError(
           `${verifier} requires hosted interactive checkout. Use VerifyGate or redirect to ${hostedCheckoutUrl}.`
         );
       }
-      
+
       // These verifiers require explicit data parameter (no auto-path)
       const requiresDataParam = [
-        'ownership-dns-txt', 
-        'wallet-link', 
+        'ownership-dns-txt',
+        'wallet-link',
         'contract-ownership',
         'ownership-pseudonym',
         'wallet-risk',
@@ -739,7 +790,10 @@ export class NeusClient {
           ...(data?.agentLabel && { agentLabel: data.agentLabel }),
           ...(data?.agentType && { agentType: data.agentType }),
           ...(data?.description && { description: data.description }),
-          ...(data?.capabilities && { capabilities: data.capabilities })
+          ...(data?.capabilities && { capabilities: data.capabilities }),
+          ...(data?.instructions && { instructions: data.instructions }),
+          ...(data?.skills && { skills: data.skills }),
+          ...(data?.services && { services: data.services })
         };
       } else if (verifier === 'agent-delegation') {
         if (!data?.agentWallet) {
@@ -752,7 +806,11 @@ export class NeusClient {
           ...(data?.scope && { scope: data.scope }),
           ...(data?.permissions && { permissions: data.permissions }),
           ...(data?.maxSpend && { maxSpend: data.maxSpend }),
-          ...(data?.expiresAt && { expiresAt: data.expiresAt })
+          ...(data?.allowedPaymentTypes && { allowedPaymentTypes: data.allowedPaymentTypes }),
+          ...(data?.receiptDisclosure && { receiptDisclosure: data.receiptDisclosure }),
+          ...(data?.expiresAt && { expiresAt: data.expiresAt }),
+          ...(data?.instructions && { instructions: data.instructions }),
+          ...(data?.skills && { skills: data.skills })
         };
       } else if (verifier === 'ai-content-moderation') {
         if (!data?.content) {
@@ -787,7 +845,6 @@ export class NeusClient {
           ...(data?.includeDetails !== undefined && { includeDetails: data.includeDetails })
         };
       } else {
-        // Default structure for unknown verifiers (should not reach here with validVerifiers check)
         verificationData = data ? {
           content,
           owner: walletAddress,
@@ -810,7 +867,6 @@ export class NeusClient {
 
       let signature;
       try {
-        // UNIFIED SIGNING: Matches utils/core.ts personalSignUniversal exactly
         const toHexUtf8 = (s) => {
           try {
             const enc = new TextEncoder();
@@ -824,7 +880,7 @@ export class NeusClient {
             return hex;
           }
         };
-        
+
         // Detect Farcaster wallet - requires hex-encoded messages FIRST
         const isFarcasterWallet = (() => {
           if (typeof window === 'undefined') return false;
@@ -841,7 +897,7 @@ export class NeusClient {
           }
           return false;
         })();
-        
+
         if (isFarcasterWallet) {
           try {
             const hexMsg = toHexUtf8(message);
@@ -850,7 +906,7 @@ export class NeusClient {
             // Fall through
           }
         }
-        
+
         if (!signature) {
           try {
             signature = await provider.request({ method: 'personal_sign', params: [message, walletAddress] });
@@ -858,15 +914,17 @@ export class NeusClient {
             const msg = String(e && (e.message || e.reason) || e || '').toLowerCase();
             const errCode = (e && (e.code || (e.error && e.error.code))) || null;
             const needsHex = /byte|bytes|invalid byte sequence|encoding|non-hex/i.test(msg);
-            
+
+            const unsupportedRe =
+              /method.*not.*supported|unsupported|not implemented|method not found|unknown method|does not support/i;
             const methodUnsupported = (
-              /method.*not.*supported|unsupported|not implemented|method not found|unknown method|does not support/i.test(msg) ||
+              unsupportedRe.test(msg) ||
               errCode === -32601 ||
               errCode === 4200 ||
               (msg.includes('personal_sign') && msg.includes('not')) ||
               (msg.includes('request method') && msg.includes('not supported'))
             );
-            
+
             if (methodUnsupported) {
               this._log('personal_sign not supported; attempting eth_sign fallback');
               try {
@@ -974,14 +1032,15 @@ export class NeusClient {
       }
     }
 
-    // Build options payload (public surface)
+    // Build options payload.
     const optionsPayload = {
       ...(options && typeof options === 'object' ? options : {}),
       targetChains: Array.isArray(options?.targetChains) ? options.targetChains : [],
       // Privacy and storage options (defaults)
       privacyLevel: options?.privacyLevel || 'private',
       publicDisplay: options?.publicDisplay || false,
-      storeOriginalContent: options?.storeOriginalContent || false
+      storeOriginalContent:
+        typeof options?.storeOriginalContent === 'boolean' ? options.storeOriginalContent : true
     };
     if (typeof options?.enableIpfs === 'boolean') optionsPayload.enableIpfs = options.enableIpfs;
 
@@ -997,8 +1056,6 @@ export class NeusClient {
       options: optionsPayload
     };
 
-    // SECURITY: Do not send proof signatures in Authorization headers.
-    // Signatures belong in the request body only (they are not bearer tokens).
     const response = await this._makeRequest('POST', '/api/v1/verification', requestData);
 
     if (!response.success) {
@@ -1008,50 +1065,44 @@ export class NeusClient {
     return this._formatResponse(response);
   }
 
-  // ============================================================================
-  // STATUS AND UTILITY METHODS
-  // ============================================================================
-
   /**
-   * Get verification status
+   * Get proof record by proof receipt id.
    *
-   * @param {string} proofId - Proof ID (standard). `qHash` is a deprecated alias (same value).
-   * @returns {Promise<Object>} Verification status and data
+   * @param {string} proofId - Proof receipt ID (0x + 64 hex).
+   * @returns {Promise<Object>} Proof record and verification state
    *
    * @example
-   * const result = await client.getStatus('0x...');
+   * const result = await client.getProof('0x...');
    * console.log('Status:', result.status);
    */
-  async getStatus(proofId) {
+  async getProof(proofId) {
     if (!proofId || typeof proofId !== 'string') {
       throw new ValidationError('proofId is required');
     }
-    const response = await this._makeRequest('GET', `/api/v1/verification/status/${proofId}`);
+    const response = await this._makeRequest('GET', `/api/v1/proofs/${proofId}`);
 
     if (!response.success) {
-      throw new ApiError(`Failed to get status: ${response.error?.message || 'Unknown error'}`, response.error);
+      throw new ApiError(`Failed to get proof: ${response.error?.message || 'Unknown error'}`, response.error);
     }
 
     return this._formatResponse(response);
   }
 
   /**
-   * Get private proof status with wallet signature
+   * Get private proof record with wallet signature
    *
-   * @param {string} proofId - Proof ID (standard). `qHash` is a deprecated alias (same value).
+   * @param {string} proofId - Proof receipt ID.
    * @param {Object} wallet - Wallet provider (window.ethereum or ethers Wallet)
-   * @returns {Promise<Object>} Private verification status and data
+   * @returns {Promise<Object>} Private proof record and verification state
    *
    * @example
-   * // Access private proof
-   * const privateData = await client.getPrivateStatus(proofId, window.ethereum);
+   * const privateData = await client.getPrivateProof(proofId, window.ethereum);
    */
-  async getPrivateStatus(proofId, wallet = null) {
+  async getPrivateProof(proofId, wallet = null) {
     if (!proofId || typeof proofId !== 'string') {
       throw new ValidationError('proofId is required');
     }
 
-    // Allow pre-signed universal owner auth (e.g. Solana) to avoid wallet-provider assumptions.
     const isPreSignedAuth = wallet &&
       typeof wallet === 'object' &&
       typeof wallet.walletAddress === 'string' &&
@@ -1066,7 +1117,7 @@ export class NeusClient {
         ...(typeof auth.chain === 'string' && auth.chain.trim() ? { 'x-chain': auth.chain.trim() } : {}),
         ...(typeof auth.signatureMethod === 'string' && auth.signatureMethod.trim() ? { 'x-signature-method': auth.signatureMethod.trim() } : {})
       };
-      const response = await this._makeRequest('GET', `/api/v1/verification/status/${proofId}`, null, headers);
+      const response = await this._makeRequest('GET', `/api/v1/proofs/${proofId}`, null, headers);
       if (!response.success) {
         throw new ApiError(
           `Failed to access private proof: ${response.error?.message || 'Unauthorized'}`,
@@ -1087,8 +1138,6 @@ export class NeusClient {
 
     const signedTimestamp = Date.now();
 
-    // IMPORTANT: This must match the server's Standard Signing String owner-access check.
-    // Keep wire payload key `qHash` for backwards compatibility.
     const message = constructVerificationMessage({
       walletAddress,
       signedTimestamp,
@@ -1112,8 +1161,7 @@ export class NeusClient {
       throw new ValidationError(`Failed to sign message: ${error.message}`);
     }
 
-    // Make request with signature headers (server reads x-wallet-address/x-signature/x-signed-timestamp)
-    const response = await this._makeRequest('GET', `/api/v1/verification/status/${proofId}`, null, {
+    const response = await this._makeRequest('GET', `/api/v1/proofs/${proofId}`, null, {
       'x-wallet-address': walletAddress,
       'x-signature': signature,
       'x-signed-timestamp': signedTimestamp.toString(),
@@ -1150,26 +1198,45 @@ export class NeusClient {
    * @returns {Promise<string[]>} Array of verifier IDs
    */
   async getVerifiers() {
+    const catalog = await this.getVerifierCatalog();
+    return Array.isArray(catalog?.data) ? catalog.data : [];
+  }
+
+  /**
+   * Get the public verifier catalog with per-verifier capabilities.
+   * @returns {Promise<{data: string[], metadata: Record<string, { supportsDirectApi?: boolean }>, meta?: object}>}
+   */
+  async getVerifierCatalog() {
     const response = await this._makeRequest('GET', '/api/v1/verification/verifiers');
     if (!response.success) {
       throw new ApiError(`Failed to get verifiers: ${response.error?.message || 'Unknown error'}`, response.error);
     }
-    return Array.isArray(response.data) ? response.data : [];
+    return {
+      data: Array.isArray(response.data) ? response.data : [],
+      metadata:
+        response.metadata && typeof response.metadata === 'object' && !Array.isArray(response.metadata)
+          ? response.metadata
+          : {},
+      meta:
+        response.meta && typeof response.meta === 'object' && !Array.isArray(response.meta)
+          ? response.meta
+          : {}
+    };
   }
 
   /**
    * POLL PROOF STATUS - Wait for verification completion
-   * 
+   *
    * Polls the verification status until it reaches a terminal state (completed or failed).
    * Useful for providing real-time feedback to users during verification.
-   * 
-   * @param {string} proofId - Proof ID to poll (standard). `qHash` is a deprecated alias (same value).
+   *
+   * @param {string} proofId - Proof ID to poll.
    * @param {Object} [options] - Polling options
    * @param {number} [options.interval=5000] - Polling interval in ms
    * @param {number} [options.timeout=120000] - Total timeout in ms
    * @param {Function} [options.onProgress] - Progress callback function
    * @returns {Promise<Object>} Final verification status
-   * 
+   *
    * @example
    * const finalStatus = await client.pollProofStatus(proofId, {
    *   interval: 3000,
@@ -1195,34 +1262,34 @@ export class NeusClient {
 
     const startTime = Date.now();
     let consecutiveRateLimits = 0;
-    
+
     while (Date.now() - startTime < timeout) {
       try {
-        const status = await this.getStatus(proofId);
+        const status = await this.getProof(proofId);
         consecutiveRateLimits = 0;
-        
+
         // Call progress callback if provided
         if (onProgress && typeof onProgress === 'function') {
           onProgress(status.data || status);
         }
-        
+
         // Check for terminal states
         const currentStatus = status.data?.status || status.status;
         if (this._isTerminalStatus(currentStatus)) {
           this._log('Verification completed', { status: currentStatus, duration: Date.now() - startTime });
           return status;
         }
-        
+
         // Wait before next poll
         await new Promise(resolve => setTimeout(resolve, interval));
-        
+
       } catch (error) {
         this._log('Status poll error', error.message);
         // Continue polling unless it's a validation error
         if (error instanceof ValidationError) {
           throw error;
         }
-        
+
         let nextDelay = interval;
         if (error instanceof ApiError && Number(error.statusCode) === 429) {
           consecutiveRateLimits += 1;
@@ -1233,17 +1300,17 @@ export class NeusClient {
           const jitter = Math.floor(backoff * (0.5 + Math.random() * 0.5)); // 50-100%
           nextDelay = jitter;
         }
-        
+
         await new Promise(resolve => setTimeout(resolve, nextDelay));
       }
     }
-    
+
     throw new NetworkError(`Polling timeout after ${timeout}ms`, 'POLLING_TIMEOUT');
   }
 
   /**
    * DETECT CHAIN ID - Get current wallet chain
-   * 
+   *
    * @returns {Promise<number>} Current chain ID
    */
   async detectChainId() {
@@ -1277,7 +1344,6 @@ export class NeusClient {
     const message = constructVerificationMessage({
       walletAddress: address,
       signedTimestamp,
-      // Keep wire payload key `qHash` for backwards compatibility.
       data: { action: 'revoke_proof', qHash: proofId },
       verifierIds: ['ownership-basic'],
       ...(signerIsEvm ? { chainId: this._getHubChainId() } : { chain })
@@ -1298,9 +1364,8 @@ export class NeusClient {
       throw new ValidationError(`Failed to sign revocation: ${error.message}`);
     }
 
-    const res = await fetch(`${this.config.apiUrl}/api/v1/proofs/${proofId}/revoke-self`, {
+    const res = await fetch(`${this.config.apiUrl}/api/v1/proofs/revoke-self/${proofId}`, {
       method: 'POST',
-      // SECURITY: Do not put proof signatures into Authorization headers.
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({
         walletAddress: address,
@@ -1316,19 +1381,16 @@ export class NeusClient {
     return true;
   }
 
-  // ============================================================================
-  // PROOFS & GATING METHODS
-  // ============================================================================
-
   /**
    * GET PROOFS BY WALLET - Fetch proofs for a wallet address
-   * 
+   *
    * @param {string} walletAddress - Wallet identity (EVM/Solana/DID)
    * @param {Object} [options] - Filter options
    * @param {number} [options.limit] - Max results (default: 50; higher limits require owner access)
    * @param {number} [options.offset] - Pagination offset (default: 0)
+   * @param {string} [options.qHash] - Filter to single proof by qHash
    * @returns {Promise<Object>} Proofs result
-   * 
+   *
    * @example
    * const result = await client.getProofsByWallet('0x...', {
    *   limit: 50,
@@ -1346,11 +1408,12 @@ export class NeusClient {
     const qs = [];
     if (options.limit) qs.push(`limit=${encodeURIComponent(String(options.limit))}`);
     if (options.offset) qs.push(`offset=${encodeURIComponent(String(options.offset))}`);
+    if (options.qHash) qs.push(`qHash=${encodeURIComponent(options.qHash.toLowerCase())}`);
 
     const query = qs.length ? `?${qs.join('&')}` : '';
     const response = await this._makeRequest(
       'GET',
-      `/api/v1/proofs/byWallet/${encodeURIComponent(pathId)}${query}`
+      `/api/v1/proofs/by-wallet/${encodeURIComponent(pathId)}${query}`
     );
 
     if (!response.success) {
@@ -1377,6 +1440,7 @@ export class NeusClient {
    * @param {Object} [options]
    * @param {number} [options.limit] - Max results (server enforces caps)
    * @param {number} [options.offset] - Pagination offset
+   * @param {string} [options.qHash] - Filter to single proof by qHash
    * @param {Object} [wallet] - Optional injected wallet/provider (MetaMask/ethers Wallet)
    */
   async getPrivateProofsByWallet(walletAddress, options = {}, wallet = null) {
@@ -1442,9 +1506,10 @@ export class NeusClient {
     const qs = [];
     if (options.limit) qs.push(`limit=${encodeURIComponent(String(options.limit))}`);
     if (options.offset) qs.push(`offset=${encodeURIComponent(String(options.offset))}`);
+    if (options.qHash) qs.push(`qHash=${encodeURIComponent(options.qHash.toLowerCase())}`);
     const query = qs.length ? `?${qs.join('&')}` : '';
 
-    const response = await this._makeRequest('GET', `/api/v1/proofs/byWallet/${encodeURIComponent(pathId)}${query}`, null, {
+    const response = await this._makeRequest('GET', `/api/v1/proofs/by-wallet/${encodeURIComponent(pathId)}${query}`, null, {
       'x-wallet-address': signerWalletAddress,
       'x-signature': signature,
       'x-signed-timestamp': signedTimestamp.toString(),
@@ -1466,16 +1531,16 @@ export class NeusClient {
   }
 
   /**
-   * GATE CHECK (API) - Minimal eligibility check
+   * Gate check (HTTP API) — minimal eligibility response.
    *
    * Calls the gate endpoint and returns a **minimal** yes/no response.
-   * By default this checks **public + discoverable** proofs only.
+   * By default this checks **public + unlisted** proofs.
    *
    * When `includePrivate=true`, this can perform owner-signed private checks
    * (no full proof payloads returned) by providing a wallet/provider.
    *
-   * Prefer this over `checkGate()` for integrations that want the
-   * smallest, most stable surface area (and do NOT need full proof payloads).
+   * Prefer this over `checkGate()` when you need the smallest, most stable
+   * response shape and do not need full proof payloads.
    *
    * @param {Object} params - Gate check query params
    * @param {string} params.address - Wallet identity to check (EVM/Solana/DID)
@@ -1550,6 +1615,8 @@ export class NeusClient {
 
     // Wallet filters
     setIfPresent('provider', params.provider);
+    setIfPresent('handle', params.handle);
+    setIfPresent('namespace', params.namespace);
     setIfPresent('ownerAddress', params.ownerAddress);
     setIfPresent('riskLevel', params.riskLevel);
     setBoolIfPresent('sanctioned', params.sanctioned);
@@ -1574,7 +1641,7 @@ export class NeusClient {
         }
       }
       if (!auth) {
-        // No signer context available - proceed as public/discoverable gate check.
+        // Without a signer: public and unlisted proofs only.
       } else {
         const normalizedAuthWallet = this._normalizeIdentity(auth.walletAddress);
         const normalizedAddress = this._normalizeIdentity(address);
@@ -1603,11 +1670,17 @@ export class NeusClient {
   }
 
   /**
-   * CHECK GATE - Evaluate requirements against existing proofs
-   * 
+   * CHECK GATE — Local preview against proofs you already have in memory or from `getProofsByWallet`.
+   *
+   * **Not authoritative for access control.** For production allow/deny, use {@link NeusClient#gateCheck}
+   * (`GET /api/v1/proofs/check`), which applies the same rules as the NEUS API. This method is useful for
+   * UI previews, offline-ish flows, or when you already fetched proofs and want a quick match without
+   * another round trip — but it can disagree with the server (e.g. `contentHash` matching uses a local
+   * approximation when proof data only has inline `content`; the API uses the standard server-side hash).
+   *
    * Gate-first verification: checks if wallet has valid proofs satisfying requirements.
    * Returns which requirements are missing/expired.
-   * 
+   *
    * @param {Object} params - Gate check parameters
    * @param {string} params.walletAddress - Target wallet
    * @param {Array<Object>} params.requirements - Array of gate requirements
@@ -1625,7 +1698,7 @@ export class NeusClient {
    *   Note: contentHash matching uses approximation in SDK; for exact SHA-256 matching, use backend API
    * @param {Array} [params.proofs] - Pre-fetched proofs (skip API call)
    * @returns {Promise<Object>} Gate result with satisfied, missing, existing
-   * 
+   *
    * @example
    * // Basic gate check
    * const result = await client.checkGate({
@@ -1682,20 +1755,28 @@ export class NeusClient {
         if (match && typeof match === 'object') {
           const data = verifier.data || {};
           const input = data.input || {}; // NFT/token verifiers store fields in input
-          
-          for (const [key, expected] of Object.entries(match)) {
+          // Gate format: match as array [{path, op, value}]. Convert to {path: value} for iteration.
+          const matchObj = Array.isArray(match)
+            ? Object.fromEntries(
+              match
+                .filter((m) => m && m.path && String(m.value ?? '').trim() !== '')
+                .map((m) => [String(m.path).trim(), m.value])
+            )
+            : match;
+
+          for (const [key, expected] of Object.entries(matchObj)) {
             let actualValue = null;
-            
+
             // Handle nested field access
             if (key.includes('.')) {
               const parts = key.split('.');
               let current = data;
-              
+
               if (parts[0] === 'input' && input) {
                 current = input;
                 parts.shift();
               }
-              
+
               for (const part of parts) {
                 if (current && typeof current === 'object' && part in current) {
                   current = current[part];
@@ -1708,13 +1789,14 @@ export class NeusClient {
             } else {
               actualValue = input[key] || data[key];
             }
-            
+
             if (key === 'content' && actualValue === undefined) {
               actualValue = data.reference?.id || data.content;
             }
-            
-            // Special handling for verifier-specific fields
+
+            // Special handling for verifier-specific fields (claim-based, aligns with proofs/check)
             if (actualValue === undefined) {
+              const claims = data.claims || {};
               if (key === 'contractAddress') {
                 actualValue = input.contractAddress || data.contractAddress;
               } else if (key === 'tokenId') {
@@ -1733,9 +1815,28 @@ export class NeusClient {
                 actualValue = data.verificationMethod;
               } else if (key === 'domain') {
                 actualValue = data.domain;
+              } else if (key === 'handle') {
+                actualValue = data.handle || data.pseudonymId;
+              } else if (key === 'namespace') {
+                actualValue =
+                  data.namespace !== undefined && data.namespace !== null && data.namespace !== ''
+                    ? data.namespace
+                    : 'neus';
+              } else if (key === 'claims.sanctions_passed') {
+                actualValue = claims.sanctions_passed ?? claims.sanctionsPassed;
+              } else if (key === 'claims.age_min') {
+                actualValue = claims.age_min ?? claims.ageMin;
+              } else if (key === 'neusPersonhoodId') {
+                actualValue = data.neusPersonhoodId;
+              } else if (key === 'riskLevel') {
+                actualValue = data.riskLevel;
+              } else if (key === 'sanctioned') {
+                actualValue = data.sanctioned;
+              } else if (key === 'poisoned') {
+                actualValue = data.poisoned;
               }
             }
-            
+
             // Content hash check (approximation)
             if (key === 'contentHash' && actualValue === undefined && data.content) {
               try {
@@ -1747,19 +1848,27 @@ export class NeusClient {
                   hash = ((hash << 5) - hash) + char;
                   hash = hash & hash;
                 }
-                actualValue = '0x' + Math.abs(hash).toString(16).padStart(64, '0').substring(0, 66);
+                actualValue = `0x${  Math.abs(hash).toString(16).padStart(64, '0').substring(0, 66)}`;
               } catch {
                 actualValue = String(data.content);
               }
             }
-            
+
             let normalizedActual = actualValue;
             let normalizedExpected = expected;
-            
+
             if (actualValue === undefined || actualValue === null) {
               return false;
             }
-            
+
+            // Boolean claims (sanctions_passed, sanctioned, poisoned)
+            if (typeof actualValue === 'boolean' || (key && (key.includes('sanctions') || key.includes('sanctioned') || key.includes('poisoned')))) {
+              const bActual = Boolean(actualValue);
+              const bExpected = expected === true || expected === 'true' || String(expected).toLowerCase() === 'true';
+              if (bActual !== bExpected) return false;
+              continue;
+            }
+
             if (key === 'chainId' || (key === 'tokenId' && (typeof actualValue === 'number' || !isNaN(Number(actualValue))))) {
               normalizedActual = Number(actualValue);
               normalizedExpected = Number(expected);
@@ -1773,7 +1882,7 @@ export class NeusClient {
               normalizedActual = actualValue;
               normalizedExpected = expected;
             }
-            
+
             if (normalizedActual !== normalizedExpected) {
               return false;
             }
@@ -1799,14 +1908,6 @@ export class NeusClient {
     };
   }
 
-  // ============================================================================
-  // PRIVATE UTILITY METHODS
-  // ============================================================================
-
-  /**
-   * Get connected wallet address
-   * @private
-   */
   async _getWalletAddress() {
     if (typeof window === 'undefined' || !window.ethereum) {
       throw new ConfigurationError('No Web3 wallet detected');
@@ -1820,16 +1921,12 @@ export class NeusClient {
     return accounts[0];
   }
 
-  /**
-   * Make HTTP request to API
-   * @private
-   */
   async _makeRequest(method, endpoint, data = null, headersOverride = null) {
     const url = `${this.baseUrl}${endpoint}`;
-    
+
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
-    
+
     const options = {
       method,
       headers: { ...this.defaultHeaders, ...(headersOverride || {}) },
@@ -1845,7 +1942,7 @@ export class NeusClient {
     try {
       const response = await fetch(url, options);
       clearTimeout(timeoutId);
-      
+
       let responseData;
       try {
         responseData = await response.json();
@@ -1861,23 +1958,19 @@ export class NeusClient {
 
     } catch (error) {
       clearTimeout(timeoutId);
-      
+
       if (error.name === 'AbortError') {
         throw new NetworkError(`Request timeout after ${this.config.timeout}ms`);
       }
-      
+
       if (error instanceof ApiError) {
         throw error;
       }
-      
+
       throw new NetworkError(`Network error: ${error.message}`);
     }
   }
 
-  /**
-   * Format API response for consistent structure
-   * @private
-   */
   _formatResponse(response) {
     const proofId = response?.data?.proofId ||
                     response?.proofId ||
@@ -1893,9 +1986,9 @@ export class NeusClient {
                   response?.data?.id;
     const finalProofId = proofId || qHash || null;
     const finalQHash = qHash || proofId || finalProofId;
-                  
-    const status = response?.data?.status || 
-                   response?.status || 
+
+    const status = response?.data?.status ||
+                   response?.status ||
                    response?.data?.resource?.status ||
                    (response?.success ? 'completed' : 'unknown');
 
@@ -1907,14 +2000,10 @@ export class NeusClient {
       data: response.data,
       message: response.message,
       timestamp: Date.now(),
-      statusUrl: finalProofId ? `${this.baseUrl}/api/v1/verification/status/${finalProofId}` : null
+      proofUrl: finalProofId ? `${this.baseUrl}/api/v1/proofs/${finalProofId}` : null
     };
   }
 
-  /**
-   * Check if status is terminal (completed or failed)
-   * @private
-   */
   _isTerminalStatus(status) {
     const terminalStates = [
       'verified',
@@ -1947,5 +2036,5 @@ export class NeusClient {
   }
 }
 
-// Export the constructVerificationMessage function for advanced use
-export { constructVerificationMessage };
+// Export signing helpers for advanced use
+export { PORTABLE_PROOF_SIGNER_HEADER, constructVerificationMessage };