@reclaimprotocol/agent 0.1.1-dev.1 → 0.1.1

package/lib/mcp/tools/verification/result.js

@@ -0,0 +1,126 @@
+import { createReclaim, decryptCallback, DEFAULT_BASE_URL, verifyResultFull, } from '@reclaimprotocol/client';
+import assert from 'node:assert';
+import { defineTool } from "../../server.js";
+import { resolveDecryptionKey } from "../authenticate/decrypt-key.js";
+/** Statuses that can carry a submitted (terminal) result. `expired`/`pending`
+ *  never have one. */
+const TERMINAL = new Set(['success', 'rejected', 'error']);
+/**
+ * Resolve the org secret used to authenticate verification reads. Auth is a
+ * single per-org bearer secret (`rorg_…`), not an eth signature — read it from
+ * `RECLAIM_ORG_SECRET`.
+ */
+function resolveOrgSecret() {
+    const secret = process.env.RECLAIM_ORG_SECRET?.trim();
+    assert(secret, new Error('RECLAIM_ORG_SECRET is not set. Verification reads authenticate with ' +
+        'the org secret (rorg_…) — issue one from the dashboard ' +
+        '(POST /orgs/{orgId}/token) and export it as RECLAIM_ORG_SECRET.'));
+    return secret;
+}
+/**
+ * `get_verification_result` — check a session's status and, once a result has
+ * been submitted, pull the stored payload(s) and verify locally. Auth is the
+ * org token; delivery is org-scoped. Each stored payload is either the
+ * plaintext signed JWS (when the org has no encryption credential) or a compact
+ * JWE (RFC 7516, ECDH-ES+A256GCM over X25519) that we decrypt here with the
+ * optional X25519 key (the `reclaim-decrypt.pem` PEM in the project). The
+ * Builder only ever relays the payload — decryption, when needed, happens
+ * here.
+ */
+export function verificationResultTool() {
+    return defineTool({
+        name: 'get_verification_result',
+        description: 'Check a verification session and return its result when ready. ' +
+            'Authenticates with the org secret (RECLAIM_ORG_SECRET). Fetches the ' +
+            'session status; if it is terminal and a result has been submitted, ' +
+            'pulls the stored result(s) and verifies them locally. Encrypted ' +
+            'deliveries (compact JWE over X25519) are decrypted with your ' +
+            'optional decryption key (the reclaim-decrypt.pem PEM in the ' +
+            'project); plaintext deliveries are read directly. Returns ' +
+            '`ready: false` while the session is still pending or no result has ' +
+            'been delivered yet. Use list_verification_events for the full ' +
+            'lifecycle log.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: {
+                sessionId: {
+                    type: 'string',
+                    description: 'The verification session id from create_verification_session.',
+                },
+            },
+        },
+    }, async (args) => {
+        const orgSecret = resolveOrgSecret();
+        // Optional X25519 decryption key — absent ⇒ plaintext-only.
+        const decryptionKey = await resolveDecryptionKey();
+        const reclaim = createReclaim({
+            baseUrl: process.env.RECLAIM_API_URL || DEFAULT_BASE_URL,
+            orgSecret,
+        });
+        const sessionRes = await reclaim.api('GetVerificationSession', {
+            params: { sessionId: args.sessionId },
+        });
+        const status = sessionRes.data.status;
+        if (!TERMINAL.has(status)) {
+            return { sessionId: args.sessionId, status, ready: false };
+        }
+        const resultRes = await reclaim.api('GetVerificationResult', {
+            params: { sessionId: args.sessionId },
+        });
+        const { items } = resultRes.data;
+        if (!items.length) {
+            return {
+                sessionId: args.sessionId,
+                status,
+                ready: false,
+                note: 'Session is terminal but no result has been submitted yet.',
+            };
+        }
+        // Each item's `payload` is a compact JWE (encrypted to the org's
+        // credential) or the plaintext signed JWS, as raw text. `decryptCallback`
+        // branches on the body shape; an encrypted delivery with no key throws
+        // a clear error, which we surface per-subscription rather than skip.
+        const results = [];
+        const undecryptable = [];
+        for (const item of items) {
+            let jws;
+            try {
+                jws = await decryptCallback(decryptionKey, item.payload);
+            }
+            catch (err) {
+                undecryptable.push(item.subscriptionId);
+                void err;
+                continue;
+            }
+            const outcome = await verifyResultFull(jws, {
+                expectedReclaimSessionId: args.sessionId,
+            });
+            results.push({
+                subscriptionId: item.subscriptionId,
+                valid: outcome.valid,
+                reason: outcome.reason,
+                payload: outcome.payload,
+                proofs: outcome.proofs,
+            });
+        }
+        if (!results.length) {
+            return {
+                sessionId: args.sessionId,
+                status,
+                ready: false,
+                note: 'A result was stored, but no payload could be read — it is ' +
+                    'corrupt, or encrypted (JWE) to a key this consumer does not ' +
+                    'hold. Place an X25519 PEM (reclaim-decrypt.pem) in the ' +
+                    'project matching the org credential.',
+            };
+        }
+        return {
+            sessionId: args.sessionId,
+            status,
+            ready: true,
+            results,
+            ...(undecryptable.length ? { undecryptable } : {}),
+        };
+    });
+}

package/lib/mcp/verifications/build.d.ts

@@ -0,0 +1,5 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import type { RegisteredTool } from '../server.ts';
+/** Verification CRUD tools — build the flat list of RegisteredTool
+ *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
+export declare function buildVerificationTools(client: ReclaimClient): RegisteredTool[];

package/lib/mcp/verifications/build.js

@@ -0,0 +1,14 @@
+import { createTool } from "./create.js";
+import { findTool } from "./find.js";
+import { getTool } from "./get.js";
+import { updateTool } from "./update.js";
+/** Verification CRUD tools — build the flat list of RegisteredTool
+ *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
+export function buildVerificationTools(client) {
+    return [
+        findTool(client),
+        getTool(client),
+        createTool(client),
+        updateTool(client),
+    ];
+}

package/lib/mcp/verifications/create.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function createTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/create.js

@@ -0,0 +1,57 @@
+import { defineTool } from "../server.js";
+export function createTool(client) {
+    return defineTool({
+        name: 'create_verification',
+        description: 'Create a new Reclaim verification. Use this only ' +
+            'after `find_verification` returned nothing useful ' +
+            'for the domain. The caller must be an active ' +
+            'member of the target organization.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                orgId: {
+                    type: 'string',
+                    description: 'uuid identifier of the organization ' +
+                        'that will own the verification.'
+                },
+                domain: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 200,
+                    description: 'Canonical root domain (e.g. `github.com`). ' +
+                        'No scheme, no port, no path.',
+                },
+                slug: {
+                    type: 'string',
+                    pattern: '^[a-z0-9]+(?:-[a-z0-9]+)*$',
+                    minLength: 1,
+                    maxLength: 100,
+                    description: 'URL-safe identifier. Globally unique — pick ' +
+                        'something domain-specific like `github-followers`.',
+                },
+                title: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 100,
+                    description: 'Short headline shown to end-users. Defaults ' +
+                        'to a domain-derived brand name.',
+                },
+                description: { type: 'string', minLength: 1, maxLength: 2000 },
+                iconUrl: { type: 'string', description: 'uri of the icon' },
+                tags: { type: 'array', items: { type: 'string' }, maxItems: 50 },
+            },
+            required: ['orgId', 'domain', 'slug'],
+        },
+    }, async (args) => client.call('CreateProvider', {
+        body: {
+            orgId: args.orgId,
+            domain: args.domain,
+            slug: args.slug,
+            title: args.title,
+            description: args.description,
+            iconUrl: args.iconUrl,
+            tags: args.tags ?? [],
+            visibility: 'PRIVATE'
+        },
+    }));
+}

package/lib/mcp/verifications/find.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function findTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/find.js

@@ -0,0 +1,37 @@
+import { defineTool } from "../server.js";
+export function findTool(client) {
+    return defineTool({
+        name: 'find_verification',
+        description: 'Search published Reclaim verifications by domain or ' +
+            'data point. A verification is the recipe an end-user ' +
+            'follows to prove something about themselves (e.g. ' +
+            '"I have N followers on Twitter"). Returns a list of ' +
+            'matches. Call this BEFORE `create_verification` — ' +
+            'most popular domains already have a public ' +
+            'verification you can reuse.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 200,
+                    description: 'Free-text query. Matches domain (e.g. ' +
+                        '"github.com"), title, description, and the ' +
+                        'data points a verification can prove.',
+                },
+                tags: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Restrict to verifications carrying every tag.',
+                },
+                limit: { type: 'number', minimum: 1, maximum: 100 },
+            },
+        },
+    }, async (args) => client.call('Providers', {
+        query: {
+            q: args.query,
+            tag: args.tags ?? [],
+        },
+    }));
+}

package/lib/mcp/verifications/get.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function getTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/get.js

@@ -0,0 +1,26 @@
+import { defineTool } from "../server.js";
+export function getTool(client) {
+    return defineTool({
+        name: 'get_verification',
+        description: 'Fetch a single Reclaim verification by id. Returns ' +
+            'every field needed to integrate it into a flow: ' +
+            'domain, the live version (initialUrl + requests), ' +
+            'and the data points it can prove. Use ' +
+            '`find_verification` first if you only have a query ' +
+            'string.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the verification. (Internally stored ' +
+                        'as `providerId` — the field name reflects ' +
+                        'the openapi schema.)',
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async (args) => client.call('GetProvider', {
+        params: { providerId: args.providerId },
+    }));
+}

package/lib/mcp/verifications/update.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function updateTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/update.js

@@ -0,0 +1,78 @@
+import { defineTool } from "../server.js";
+export function updateTool(client) {
+    return defineTool({
+        name: 'update_verification',
+        description: "Update a Reclaim verification's metadata. Partial " +
+            'PATCH — pass only fields you want to change. The ' +
+            'caller must be an active member of the owning ' +
+            "organization. To change the verification's " +
+            'recipe (initialUrl, requests, …) cut a new ' +
+            'version via the dashboard. Use `seo` to control how ' +
+            'the verification appears in search results and social ' +
+            'shares; omit a subfield to keep the server default.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the verification. (Internally stored ' +
+                        'as `providerId` — the field name reflects ' +
+                        'the openapi schema.)',
+                },
+                title: { type: 'string', minLength: 1, maxLength: 100 },
+                description: { type: 'string', minLength: 1, maxLength: 2000 },
+                iconUrl: { type: 'string', description: 'uri of icon' },
+                clearIcon: {
+                    type: 'boolean',
+                    description: 'Set true to wipe the icon explicitly.',
+                },
+                visibility: { type: 'string', enum: ['PRIVATE', 'PUBLIC'] },
+                status: { type: 'string', enum: ['ACTIVE', 'ARCHIVED'] },
+                tags: { type: 'array', items: { type: 'string' }, maxItems: 50 },
+                seo: {
+                    type: 'object',
+                    additionalProperties: false,
+                    description: 'Author SEO overrides. Each field falls back to a ' +
+                        'server-derived suggestion when unset.',
+                    properties: {
+                        brandUrl: {
+                            type: 'string',
+                            maxLength: 2000,
+                            description: 'Canonical homepage url of the brand.',
+                        },
+                        primaryDataPoint: {
+                            type: 'string',
+                            maxLength: 200,
+                            description: 'Headline data point (e.g. "subscriber ' +
+                                'count"); used in the SEO title.',
+                        },
+                        dataPoints: {
+                            type: 'array',
+                            items: { type: 'string', maxLength: 200 },
+                            maxItems: 50,
+                            description: 'Full list of verifiable data points.',
+                        },
+                        titleOverride: {
+                            type: 'string',
+                            maxLength: 200,
+                            description: 'Replaces the composed page title.',
+                        },
+                        descriptionOverride: {
+                            type: 'string',
+                            maxLength: 320,
+                            description: 'Replaces the composed meta description.',
+                        },
+                    },
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async (args) => {
+        const { providerId, ...rest } = args;
+        return client.call('UpdateProvider', {
+            params: { providerId },
+            headers: {},
+            body: rest,
+        });
+    });
+}

package/lib/old/client.d.ts

@@ -24,6 +24,9 @@ export interface RegisterProviderBody {
     description?: string;
     loginUrl: string;
     geoLocation?: string;
+    /** Provider-level flag on the old backend (defaults false there; the
+     *  translator sends `true` to match the builder default). */
+    useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
     requestData: unknown[];
 }

package/lib/old/instructions.d.ts

@@ -1,7 +1 @@
-/**
- * MCP server instructions shown to the LLM when running in OLD-devtools mode
- * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
- * surface — there are no org/credential-link/review flows and no generated
- * API tools here. Must not mention disabled tools.
- */
 export declare const OLD_MODE_INSTRUCTIONS: string;

package/lib/old/instructions.js

@@ -2,28 +2,10 @@
  * MCP server instructions shown to the LLM when running in OLD-devtools mode
  * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
  * surface — there are no org/credential-link/review flows and no generated
- * API tools here. Must not mention disabled tools.
+ * API tools here. The prose lives in `skill/old-mode.md` (published via the
+ * `files` array); the path resolves identically from `src/old` (dev) and
+ * `lib/old` (published).
  */
-export const OLD_MODE_INSTRUCTIONS = 'This server is running against the LEGACY Reclaim devtools backend ' +
-    '(temporary, while the new builder backend is in development), so its ' +
-    'capabilities are intentionally limited.\n\n' +
-    'Provider-authoring flow:\n' +
-    '1. `reclaim_authenticate` — by default opens the dashboard in Chrome, ' +
-    'waits for you to sign in, captures the token automatically, and closes ' +
-    'the tab (or paste a `token` / pass an eth `ethAddress` to skip the ' +
-    'browser). Do this once before publishing or listing.\n' +
-    '2. `attach_chrome` → `start_capture` → drive the page (`navigate`, ' +
-    '`wait_for_page`) → inspect (`list_requests`, `get_request`, ' +
-    '`find_requests_containing`).\n' +
-    '3. `propose_provider` to draft a provider, `replay_request` to ' +
-    'pre-flight, `run_proof` to verify with the attestor. OPRF/`hash` ' +
-    'redactions are optional and supported.\n' +
-    '4. `create_provider_version_from_capture` to publish. With NO ' +
-    '`providerId` it REGISTERS A NEW provider (re-running creates a ' +
-    'duplicate); pass a ' +
-    '`providerId` from `get_me_providers` to add a new version to an existing ' +
-    'provider instead.\n' +
-    '5. `get_me_providers` lists the providers you own (the only ' +
-    'provider-listing tool available in this mode).\n\n' +
-    'Only GET/POST endpoints can be captured into providers here. There is no ' +
-    'organization, credential-linking, or public-review workflow in this mode.';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+export const OLD_MODE_INSTRUCTIONS = readFileSync(fileURLToPath(new URL('../../skill/old-mode.md', import.meta.url)), 'utf8').trim();

package/lib/old/to-register.d.ts

@@ -17,7 +17,10 @@ import type { RegisterProviderBody, UpdateProviderConfigBody } from './client.ts
 export interface OldProviderOpts {
     initialUrl: string;
     description?: string;
+    /** Defaults to `{{DYNAMIC_GEO}}` when omitted. */
     geoLocation?: string;
+    /** Defaults to `true` when omitted. Register only (Provider-level flag). */
+    useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
 }
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. */

package/lib/old/to-register.js

@@ -1,3 +1,9 @@
+/** Default web settings, mirroring the builder openapi defaults
+ *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The old
+ *  backend accepts both: `geoLocation` lives on the providerConfig, `useProxy`
+ *  is a Provider-level flag (register only). */
+const DEFAULT_GEO_LOCATION = '{{DYNAMIC_GEO}}';
+const DEFAULT_USE_PROXY = true;
 /** Build the single `requestData` entry shared by register + update. */
 function requestDataFromProvider(provider) {
     const method = String(provider.method).toUpperCase();
@@ -5,13 +11,34 @@ function requestDataFromProvider(provider) {
         throw new Error('Old devtools supports only GET/POST requests; got ' +
             `"${provider.method}". Re-capture against a GET/POST endpoint.`);
     }
+    // The old backend has no dotted interpolation: consumer-supplied params
+    // must use the `{{context_<name>}}` form here, not the builder's
+    // `{{context.<name>}}`. Catch the mix-up at publish with a clear error
+    // instead of a template that silently never resolves.
+    const dotted = `${provider.url}\n${provider.body ?? ''}`
+        .match(/\{\{context\.[A-Za-z_][A-Za-z0-9_]*\}\}/);
+    if (dotted) {
+        throw new Error(`Old devtools does not support ${dotted[0]} — rename ` +
+            'consumer-supplied params to the {{context_<name>}} form ' +
+            'for this backend.');
+    }
     const responseMatches = provider.responseMatches.map((m, i) => ({
         value: m.value,
         type: m.type ?? 'contains',
         isOptional: false,
         order: i,
     }));
-    const responseRedactions = (provider.responseRedactions ?? []).map((r, i) => {
+    // Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
+    // arrays. A drafted provider may instead carry each redaction nested in its
+    // match's `extract` (the builder shape). Prefer the explicit parallel array;
+    // fall back to the nested `extract`s so redactions are never dropped.
+    const nestedRedactions = provider.responseMatches
+        .map((m) => m.extract)
+        .filter((e) => Boolean(e));
+    const sourceRedactions = provider.responseRedactions?.length
+        ? provider.responseRedactions
+        : nestedRedactions;
+    const responseRedactions = sourceRedactions.map((r, i) => {
         const out = { order: i };
         if (r.xPath !== undefined) {
             out.xPath = r.xPath;
@@ -54,27 +81,28 @@ export function providerToRegisterBody(provider, opts) {
         name: provider.name,
         loginUrl: opts.initialUrl,
         providerType: opts.providerType ?? 'PRIVATE',
+        // Web-settings defaults mirror the builder openapi defaults.
+        geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
+        useProxy: opts.useProxy ?? DEFAULT_USE_PROXY,
         requestData: [requestDataFromProvider(provider)],
     };
     if (opts.description !== undefined) {
         body.description = opts.description;
     }
-    if (opts.geoLocation !== undefined) {
-        body.geoLocation = opts.geoLocation;
-    }
     return body;
 }
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
 export function providerToConfigBody(provider, opts, version, versionInfo) {
+    // `useProxy` is a Provider-level flag on the old backend, not part of a
+    // version's providerConfig — so the config (new-version) path only carries
+    // `geoLocation`. It defaults the same way as register.
     const providerConfig = {
         loginUrl: opts.initialUrl,
+        geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
         requestData: [requestDataFromProvider(provider)],
     };
-    if (opts.geoLocation !== undefined) {
-        providerConfig.geoLocation = opts.geoLocation;
-    }
     return { providerConfig, version, versionInfo };
 }
 /**

package/lib/old/tools/publish.js

@@ -58,7 +58,16 @@ export function createVersionFromCaptureTool(client) {
                     type: 'string',
                     description: 'Provider description (new-provider register only).',
                 },
-                geoLocation: { type: 'string' },
+                geoLocation: {
+                    type: 'string',
+                    description: 'Geo the verification appears to originate from. Defaults to ' +
+                        "'{{DYNAMIC_GEO}}' (the user's geo) when omitted.",
+                },
+                useProxy: {
+                    type: 'boolean',
+                    description: 'Route portal/attestation traffic through a proxy. Defaults to ' +
+                        'true when omitted. Applied on register only.',
+                },
                 providerType: { type: 'string', enum: ['PRIVATE', 'PUBLIC'] },
                 notes: {
                     type: 'string',
@@ -76,6 +85,9 @@ export function createVersionFromCaptureTool(client) {
         if (args.geoLocation !== undefined) {
             opts.geoLocation = args.geoLocation;
         }
+        if (args.useProxy !== undefined) {
+            opts.useProxy = args.useProxy;
+        }
         if (args.providerType !== undefined) {
             opts.providerType = args.providerType;
         }

package/lib/proof/attestor.d.ts

@@ -4,6 +4,35 @@ export interface AttestorLogEntry {
     msg: string;
     ctx?: Record<string, unknown>;
 }
+/** The attestor's signed claim data + signature, for building the nested proof
+ *  JWS a Consumer verifies against the attestor's key. Populated when
+ *  `includeAttestorClaim` is set (the app's verification runner needs it; the
+ *  MCP `run_proof` tool ignores it). */
+export interface AttestorClaim {
+    /** ProviderClaimData: provider, parameters, context (JSON string), owner,
+     *  timestampS, epoch, identifier. */
+    claim: Record<string, unknown>;
+    /** Hex (0x) attestor ETH address that signed the claim (the nested `kid`). */
+    attestorAddress: string;
+    /** Hex (0x) attestor claim signature (EIP-191 over the claim sign-data). */
+    claimSignature: string;
+}
+/** Options for {@link runAttestorProof}. */
+export interface RunAttestorProofOptions {
+    attestorUrl?: string;
+    /** When resolving the key from env/.env/file, the address the caller expects
+     *  to sign with (sanity check). Ignored when `ownerPrivateKey` is given. */
+    ownerAddress?: string;
+    /** Sign with this key directly (e.g. the app/VC's ephemeral per-session key)
+     *  instead of resolving from env/.env/file. */
+    ownerPrivateKey?: string;
+    /** ZK engine for `createClaimOnAttestor`. Defaults to `'gnark'`; the app's
+     *  server-side verification runner uses `'snarkjs'`. */
+    zkEngine?: 'gnark' | 'snarkjs';
+    /** Extract the structured {@link AttestorClaim} (claim + attestor signature)
+     *  onto the result for nested-proof construction. */
+    includeAttestorClaim?: boolean;
+}
 export interface ProofResult {
     proof: unknown;
     extractedValue: string;
@@ -12,6 +41,9 @@ export interface ProofResult {
     owner?: string;
     verified: boolean;
     error?: string;
+    /** Structured claim + signature for nested-proof verification. Set only when
+     *  `includeAttestorClaim` was requested and the claim carries signatures. */
+    attestorClaim?: AttestorClaim;
     /** Set to `'missing-owner-key'` when no credential was available to
      *  sign with — distinguishes this recoverable case from other proof
      *  errors so the skill can point the dev at `issue_credentials` /
@@ -36,4 +68,4 @@ export declare function tailLogs(entries: AttestorLogEntry[], n?: number): Attes
 /** Filter to just warn/error/fatal — for the LLM-visible response on
  *  successful proofs, where chatty trace/info would just waste context. */
 export declare function warnsAndErrors(entries: AttestorLogEntry[]): AttestorLogEntry[];
-export declare function runAttestorProof(provider: ReclaimProvider, secrets: Record<string, string>, attestorUrl?: string, ownerAddress?: string): Promise<ProofResult>;
+export declare function runAttestorProof(provider: ReclaimProvider, secrets: Record<string, string>, opts?: RunAttestorProofOptions): Promise<ProofResult>;